Emergency stop and emergency switching off are not interchangeable under IEC 60204-1: emergency stop halts hazardous mechanical motion per ISO 13850, while emergency switching off isolates electrical power to prevent shock or ignition, with both limited to stop category 0 or 1 [S1][S3].
IEC 60204-1 defines three stop categories (0, 1, 2) for machinery; only category 0 (immediate uncontrolled power removal) and category 1 (controlled stop with power maintained until stop achieved, then removed) are permitted for emergency functions, while category 2 keeps power available and is therefore excluded from emergency use [S4][S5].
Definition and Scope Under IEC 60204-1
IEC 60204-1, titled "Safety of machinery, Electrical equipment of machines, Part 1: General requirements," governs the electrical equipment of machines and defines emergency stop, emergency switching off, and stop as three distinct functions, each with separate triggering logic and risk-reduction targets [S2][S3].
Emergency stop is defined in ISO 13850 as a function intended to avert or reduce existing hazards to persons, damage to machinery, or work in progress, initiated by a single human action when the normal stopping function is inadequate, and it must be available and operational at all times for quick access [S1][S2]. Emergency switching off, by contrast, is defined in IEC 60204-1 and IEC 60364-5-53 as the disconnection of the electrical power supply to prevent risk from electrical energy itself, for example shock or arc-flash, rather than to halt mechanical motion [S3][S4].
Schlegel summarizes the distinction directly: emergency switching off provides a complete disruption of the power supply, while emergency stop ensures a safe stopping of the machine without loss of power to the safety logic until stop is achieved [S6]. Pilz adds that the primary difference lies in the reaction: hazardous movements are arrested in an emergency stop, whereas supply conductors are isolated in an emergency switching-off action [S7].
Stop Categories 0, 1, and the Excluded Category 2
Category 0 stops the machine by immediate removal of power to the actuators, an uncontrolled stop in which mechanical brake engagement (if present) is the only retardation force once power is cut [S4][S5]. Category 1 is a controlled stop in which power remains available long enough for the drive to execute a controlled deceleration, after which the energy supply is interrupted; category 2 keeps energy available to the actuators throughout and is explicitly not permitted for emergency stop or emergency switching off because it does not remove the hazard source [S4][S5].
ISO 13850 restricts emergency stop devices to category 0 (uncontrolled) or category 1 (controlled) only, and the choice between them must be driven by the risk assessment: machines without inertia and without additional risks from coast-down can use category 0, while machines with inertia or that need other safety systems require category 1 [S1][S5]. IEC 61800-5-2 mirrors this mapping at the drive level: Safe Torque Off (STO) implements a category 0 stop, Safe Stop 1 (SS1, with variants d, r, and t) implements a category 1 stop, and Safe Stop 2 (SS2) implements the power-retained category 2 [S5].
Kollmorgen explicitly notes that an emergency stop category 0 implemented through an approved STO function can meet IEC 62061 SIL2, but that functional safety on vertical axes still requires an additional mechanical brake because STO alone does not block gravity-loaded shafts [S4].
Selection Criteria: Which Function Fits the Hazard
The deciding question is the hazard that must be removed: if the hazard is mechanical motion (rotating spindles, conveyors, robotic arms, press rams), specify an emergency stop function per ISO 13850 wired through IEC 60204-1 stop category 0 or 1, with a red mushroom actuator on a yellow background and a mechanically latching control device per EN/IEC 60947-5-5 [S2][S3][S4]. If the hazard is electrical energy itself (live busbars, capacitor banks, inverter DC link exposed during maintenance), specify emergency switching off per IEC 60204-1 and IEC 60364-5-53, which results in a category 0 disconnection of the supply by electro-mechanical switching devices [S3][S4].
Both functions share three engineering rules that are easy to get wrong on site. First, both must be initiated by a single human action and must be fully operational at all times in every operating mode, not just in automatic [S1][S2][S4]. Second, both must override every other function: emergency stop has priority over all other functions and controls, and emergency switching off must be capable of disconnecting supply regardless of the running mode [S2][S3][S4]. Third, neither may auto-restart: the reset must not initiate a restart, only re-arm the function for the next manual command [S1][S4].
Devices also differ mechanically. Per EN/IEC 60204-1, EN ISO 13850, and EN/IEC 60947-5-5, emergency stop actuators must be red with a yellow background where practicable, and the actuator must be a mushroom or palm type; NFPA 79 goes further by reserving the red/yellow combination exclusively for emergency stop applications [S2]. The standard mushroom is rounded; European variants are often a cone with a rounded top, which is intended to lift an object hung on the stem out of the way so the button can still be actuated [S2]. A separate emergency stop button reference covers the actuator geometry and color rules in more detail.
Wiring, Reset, and Guarding Pitfalls
EN/IEC 60204-1 requires emergency stop devices to be easily accessed and operated, which is widely read as prohibiting guards or shrouds around the actuator that would slow down the single human action [S2]. Rockwell Automation notes that while a yellow guard is accepted in some industries, it is not typically allowed under the European reading of the standard, and any shroud should be specified only after a documented risk assessment that demonstrates no delay to actuation [S2].
Reset behaviour is a common specification trap. The reset of an emergency stop is not a start command: pressing reset must only re-arm the safety circuit, and any subsequent machine start must require a separate, deliberate operator action, otherwise a Category 0 or 1 stop can be re-energised automatically on power restoration [S1][S4]. For emergency switching off, re-energising the supply after isolation is treated as a new commissioning step and must follow the same lock-out/tag-out discipline as any deliberate energisation [S3][S4].
For installations where the hazard is dual (both motion and exposed electrical energy), the practical specification is to fit both: an emergency stop function on the safety control loop wired to the drives, and a separate emergency switching-off device on the main supply disconnect, each with its own actuator and its own reset chain, so that a category 0 on the drives does not also black out the safety PLC and a category 0 on the supply does not strand the operator mid-cycle with un-braked motion [S3][S4][S7].
Limits, Failure Modes, and Common Misreadings
Category 0 is not free. Because it removes power before the drive can apply controlled deceleration, any kinetic energy in the machine must be absorbed by mechanical brakes, friction, or process-specific dissipation; for high-inertia loads such as flywheels, large fan impellers, or vertical axes, a category 0 stop can itself create a hazard (overspeed, collapse, coast into a pinch point) and the risk assessment typically forces the choice toward category 1 [S4][S5].
Stop category 2 is the function most often misapplied to emergency circuits. Category 2 leaves power on the actuators and is appropriate for a controlled operational stop where removing energy would create a different hazard (for example, holding a vertical load against gravity with the motor); because the hazard source is not removed, ISO 13850 forbids it for emergency stop, and the same logic excludes it from emergency switching off [S1][S5]. Drives literature often lists SS2 (Safe Stop 2) in the same breath as STO and SS1, which makes category 2 look interchangeable with category 0/1 at the safety function level, but the wiring intent is fundamentally different and the two should not be cross-substituted in an E-stop circuit [S5].
Emergency switching off is also frequently mis-specified as a substitute for emergency stop because both use a red button, but switching off the main supply does not arrest motion if the actuators retain stored energy (pneumatic, hydraulic, gravitational), and stopping the drives does not remove the shock hazard from a still-energised cabinet [S3][S7]. Standards governing emergency stop circuits in North America include ISO 13850, IEC 60204-1, NFPA 79, and OSHA 1910.217 for mechanical power presses, and the specific clause chosen should match the dominant hazard in the risk assessment, not the convenience of a single button [S8].
Application Examples and Sourcing
A typical CNC machining cell with a 15 kW spindle, a 4-axis servo chain, and a 480 V three-phase cabinet is a textbook case for both functions in parallel: ISO 13850 emergency stop category 1 on the safety control wired through STO/SS1 on each drive (so the spindle decelerates under control before torque is removed), plus IEC 60204-1 emergency switching off on the main disconnect so a maintenance electrician can isolate the cabinet without entering the cell [S3][S4][S5]. A packaging line with low-inertia conveyors and pneumatic actuators typically uses only ISO 13850 emergency stop category 0, since coast-down distances are short and removing power does not create secondary hazards [S1][S5].
For procurement, the relevant normative references in any submittal datasheet are IEC 60204-1 for both functions, ISO 13850 for the emergency stop function, EN/IEC 60947-5-5 for the electrical emergency stop device with mechanical latching, IEC 60364-5-53 for emergency switching off, and IEC 61800-5-2 if the stop is implemented through drive-integrated safety functions (STO, SS1, SS2) [S2][S3][S4][S5]. Component selection should be driven by the stop category declared in the manufacturer's functional safety data (SIL or PL), and on a switching power supply feeding the safety circuit, the hold-up time and 24 V ride-through must be long enough to outlast the controlled-stop ramp of a category 1 emergency stop, otherwise the safety logic can brown out before the drive reaches zero speed [S4][S5].
Trackable signal: IEC committee work on the next amendment to IEC 60204-1 is in the public comment phase, and the next consolidated edition is the version to watch when re-validating existing risk assessments that currently separate emergency stop from emergency switching off in the same cell.
This topic is covered further in CuSn12 vs CuSn12Ni2 vs Aluminum Bronze for Worm Wheels.