IEC 60204-1:2016 defines three stop categories, but only two of them, Category 0 and Category 1, are legal choices for an emergency stop function; Category 2 is reserved for ordinary process stop functions and is explicitly excluded from emergency-stop use [S2][S3].
An emergency stop is therefore a function description (a "stop that is initiated in an emergency"), not a hardware architecture, and it is the risk assessment under ISO 12100/ISO 13850 that picks which of the two allowed categories the machine actually uses [S3][S4].
Stop Category 0: uncontrolled, immediate power removal
Category 0 is defined as "stopping by immediate removal of power to the machine actuators," which is an uncontrolled stop because no energy is left to brake the moving parts in a controlled way [S3][S9]. In practice the contactor, frequency inverter, or STO input cuts the energy path within the response time of the safety chain, and the mechanical inertia of the load, plus any stored hydraulic or pneumatic energy, dictates the actual stopping distance [S3].
Category 0 is the right pick for hazardous motions with low inertia, for example small electric axes, conveyors with short stopping distances, and valve actuators that are already at end of travel; it is also the simplest stop to wire and to validate, because a single forced-guided contactor plus an emergency stop button checks the box mechanically [S3][S8]. At the drive level, Category 0 maps directly to Safe Torque Off (STO) per EN 61800-5-2, with the caveat that STO removes torque but does not by itself remove external hazards such as gravity loads on a vertical axis, which still need a separate mechanical brake [S3].
Stop Category 1: controlled stop, then power removal
Category 1 is a controlled stop with power remaining available to the actuators during the deceleration phase, followed by removal of power once zero speed has been reached, which is why it is sometimes called a "controlled then de-energised" stop [S3][S9]. It exists because high-inertia loads, vertical axes, and any machine where an uncontrolled coast-down creates its own hazard need active braking while the safety chain still has authority [S3].
At the drive level, Category 1 maps to Safe Stop 1 (SS1) in EN 61800-5-2, which has three sub-variants: SS1-r (ramp-monitored), SS1-t (time-controlled), and SS1-d (deceleration-controlled); all three end by transitioning the drive into the STO state once the monitored speed or time threshold is satisfied [S3]. A typical wiring pattern is an emergency stop wired into a safety relay or safety PLC that simultaneously issues a controlled stop command to the drive and starts a timer, after which the STO input is asserted and the main contactor is dropped, and the validation of that timing window is exactly what the TÜV/SCC audit will check [S3][S7].
Stop Category 2: controlled stop, power stays on
Category 2 is a controlled stop with power remaining available to the actuators after the stop is complete, which means the drive or valve stays energised and the controller keeps closed-loop control of position or pressure [S3][S6]. It is the right category for normal process stop functions like a "cycle stop" or a controlled homing sequence, where the machine must hold position or torque after stopping, but it is explicitly not allowed as an emergency stop because the energy remains available to recreate a hazard if a fault occurs during the stop [S2][S3].
At the drive level, Category 2 maps to Safe Stop 2 (SS2), again with r, t, and d variants, and the end state is the Safe Operating Stop (SOS) function rather than STO; the drive is still alive and still under safety supervision, which is why SS2 is never wired to a red emergency stop button and never justified in a risk assessment as an E-stop [S3]. If your process engineer asks why a Category 2 E-stop is not permissible, the short answer is: the energy stays on, so a single contactor weld or a software fault during the stop can re-start motion while the operator is still in the danger zone [S2].
Category selection: what the risk assessment actually decides
ISO 13850 and IEC 60204-1 both leave the choice between Category 0 and Category 1 to the risk assessment, and the two engineering rules that drive the decision are load inertia and the consequences of an uncontrolled coast-down [S3]. Machines with low inertia and no additional risk during coast-down, such as small spindles and short conveyors, normally land on Category 0 because the simpler circuit is also the cheaper and faster-to-validate circuit [S3].
Machines with high inertia, vertical axes, or stored energy that would create a fresh hazard if uncontrolled, such as large centrifuges, press flywheels, hoists, and robot cells with suspended tooling, are forced to Category 1, because the controlled deceleration is the only way to keep the stop inside the safety distance calculated from the operator's reach and reaction time [S3][S4]. The same risk assessment must also set the Performance Level (PL) per ISO 13849-1 or the Safety Integrity Level (SIL) per IEC 62061, and the architectural category (Cat. B, 1, 2, 3, 4) sits on a different axis from the stop category, which is a common source of confusion in spec sheets and on the engineering bench [S2].
Wiring and device rules that travel with the category
IEC 60204-1 requires the emergency stop to override all other functions in every operating mode, which means a software-only stop or a soft-key on an HMI is not an emergency stop and cannot be wired in place of a hardwired emergency stop button [S5][S8]. The actuator hardware must be positively-opening and forced-guided, with the red mushroom head on a yellow background, and the device must be accessible without the operator having to reach over a guard or through a shroud [S8].
For Category 0 the typical validated architecture is a dual-channel E-stop loop feeding a safety contactor with monitored auxiliaries, or an STO input on a drive with the EN 61800-5-2 STO certification and a 24-month proof-test interval, while for Category 1 the same E-stop loop additionally triggers a controlled-stop input on the drive or motion controller before the contactor drops, and the time between "stop command issued" and "STO asserted" is a documented and audited parameter [S3][S7]. A practical electronic test and measurement routine for either category is a no-load functional test at defined intervals (commonly every 12 months for PL d, every 6 months for PL e), with a measured response time recorded against the calculated safety distance [S5][S6].
Comparison: Category 0 vs Category 1 vs Category 2 for E-stop use
On four decision criteria, the three stop categories line up as follows for emergency-stop purposes. Power state during stop: Category 0 removes power immediately, Category 1 keeps power during controlled deceleration and removes it at zero speed, Category 2 keeps power throughout [S3][S6]. Drive-level mapping per EN 61800-5-2: Category 0 = STO, Category 1 = SS1 (r, t, or d), Category 2 = SS2 (r, t, or d) [S3]. Permitted as emergency stop under IEC 60204-1 / ISO 13850: Category 0 yes, Category 1 yes, Category 2 no [S2][S3][S5]. Typical application fit: Category 0 suits low-inertia axes, short conveyors, valve end-of-travel, while Category 1 suits high-inertia flywheels, vertical axes, large centrifuges, and Category 2 is reserved for normal cycle stop functions where position must be held after stopping [S3][S4].
Standards chain and what to cite on the drawing
The standards chain that actually shows up on a P&ID or a control-panel drawing is: ISO 12100 for the risk-assessment framework, ISO 13850 for the emergency stop function requirements, IEC 60204-1 for the electrical realisation and the stop categories, ISO 13849-1 (or IEC 62061) for the performance level / SIL, and EN 61800-5-2 for the drive-level safety functions that implement the chosen category [S1][S3][S5]. A spec line that reads "E-stop per IEC 60204-1 Cat. 1, PL e per ISO 13849-1, realised via STO+SS1 on the VFD per EN 61800-5-2" is unambiguous and survives an SCC/TÜV desk review; one that just says "E-stop, Cat 0" without naming the risk-assessment outcome is the line that gets returned for revision [S2][S5].
The next signal worth tracking is the harmonisation status of any 2026 amendment to IEC 60204-1 against ISO 13850, because the two documents are maintained on different cycles and any divergence in stop-category wording will propagate into CE/UKCA technical-construction-file reviews; a second signal is the growing list of VFD vendors publishing EN 61800-5-2 SS1-r/SS1-t/SS1-d as a single certified function block rather than three separate parameter sets, which simplifies the audit trail but tightens the proof-test discipline on the safety chain. Related reading: Category 4 safety circuits beyond simple redundancy for the architectural axis that sits beside the stop-category axis, and board-to-board connector spec pressure in 2026 for the related control-panel wiring context. Also worth checking against the field layout: gas detector mounting distance rules and IEC 60079-29-4 open-path detector performance for the broader hazardous-area spec context.