Stop categories 0, 1 and 2 (defined in IEC 60204-1 and used by ISO 13850 for emergency stop) describe what the drive or contactor does when the stop is commanded, not how reliable the wiring is [S4].
ISO 13849-1 categories B, 1, 2, 3 and 4 (with their performance level a to e) describe the architecture of the safety-related control system: single-channel versus redundant, diagnostic coverage, and fault tolerance [S1][S2][S6]. The two systems are orthogonal; stop category is a behaviour, ISO 13849-1 category is a structure.
Stop Categories 0, 1, 2: The Behaviour
Stop category 0 is an uncontrolled stop: power is removed immediately and the mechanical system coasts to rest, equivalent to "pulling the plug" [S4]. There is no braking command issued to the drive, and the stopping time depends entirely on friction, inertia and load.
Stop category 1 is a controlled stop with power retained during braking: the drive decelerates along a defined ramp, the brakes are applied, and only once zero speed is confirmed is the power removed [S4]. Stop category 2 keeps power applied to the actuators throughout the stop: motion is arrested by braking (or active counter-torque) while the contactors stay closed, and the safety circuit is what removes the restart permission.
ISO 13850 (the dedicated emergency-stop standard) is explicit: every emergency-stop device must be capable of at least stop category 0 or 1, and stop category 2 is permitted only when the risk assessment shows category 0 or 1 cannot achieve the required risk reduction; in practice that is rare outside coordinated multi-axis machinery. The physical device is the same emergency stop button regardless of the chosen stop category; the difference sits in the contactor and drive logic downstream.
ISO 13849-1 Categories B, 1, 2, 3, 4: The Architecture
Category B is the baseline: a single-channel architecture built with basic safety principles per ISO 13849-2, no diagnostic coverage requirement, and MTTFd per channel that may be low to medium; the maximum achievable Performance Level is PL b [S1][S6]. A typical realisation is one emergency stop contact feeding a single contactor coil; one contact weld, and the motor cannot be de-energised.
Category 1 keeps the single-channel topology but mandates well-tried components and well-tried safety principles with high MTTFd, again without redundancy; the maximum PL rises to PL c [S1][S5]. The components must be specifically designed and proven for safety duty, e.g. positively driven force-guided contactors rather than general-purpose relays.
Category 2 adds a Test Equipment (TE) channel that periodically checks the single safety channel; the diagnostic test interval must be at least 100 times more frequent than the demand rate, and the test must run before each restart [S1][S2][S7]. MTTFd can be low to high, diagnostic coverage is low, and the maximum PL is PL d. This is the first category where a single fault can be detected, but the architecture itself is still single-channel, so a second fault between test cycles can defeat the function.
Category 3 introduces redundancy: two parallel channels with cross-monitoring, tolerance to a single fault, and the ability to detect the dangerous failure at or before the next demand [S1][S2]. A typical hardware pattern is two e-stop contacts wired in series with two force-guided contactors; the highest PL achievable is PL d without further measures, PL e with adequate diagnostic coverage. Category 4 is similar in topology to Category 3 but tolerates a single fault while still maintaining the safety function and accumulates diagnostic coverage so that a second fault cannot lead to loss of the safety function; it is required for the most demanding risk-reduction (PL e).
Decision Matrix: How The Two Taxonomies Stack
For a given safety function the stop category and the ISO 13849-1 category are chosen independently, but they interact at the contactor and drive interface. Stop category 0 typically uses two redundant contactors (so the safety function tolerates one welded contact) and therefore tends to land in ISO 13849-1 Category 3 or 4. Stop category 1 sits on a drive with controlled braking plus redundant output contactors, again usually Category 3 or 4. Stop category 2, because power stays on, relies heavily on the drive's own STO/SS1 channel and on the architecture surrounding it, often still Category 3 but with more aggressive diagnostic coverage on the I/O side. [S1]
On a simpler machine, Category B/1 with stop category 0 is acceptable when the risk assessment yields PL b or PL c only; the cost saving comes from a single contactor and a single e-stop contact. On a robot cell, press, or any hazard severity 4 scenario, the same wiring must reach Category 3/4 and PL d/e, regardless of whether the stop is category 0, 1 or 2. The misconception that "stop category 1 is safer than stop category 0" is wrong: stop category 1 is safer against mechanical hazards like drive over-travel, but the safety integrity of the circuit is set by ISO 13849-1, not by the stop category number [S4].
Selection Criteria, Mismatches, and Common Mistakes
Selection begins with the risk graph (severity S1/S2, frequency F1/F2, possibility of avoidance P1/P2): this produces the required Performance Level a through e, and from the PL the architect works back to the ISO 13849-1 category. Stop category is then chosen from the mechanical side: hazard type (energy stored in moving parts, drive over-travel, need for controlled braking) and the time needed to clear the hazard without damaging the product or tooling. For high-inertia systems a category 0 stop can introduce unacceptable overshoot; for drives with a controlled brake ramp, category 1 is often the better physical choice even when the risk graph would tolerate category 0. [S1]
Three common mistakes show up on real machinery. First, designers treat ISO 13849-1 Category 2 as "redundant because it has a test channel"; it is not, it is single-channel with diagnostics, and a second fault can defeat it [S2][S7]. Second, designers specify stop category 2 for an e-stop because it sounds like "safer"; ISO 13850 limits this to applications where controlled braking is essential and the risk assessment justifies it, and the standard warns that removing power at a later point must still meet stop category 0 or 1 logic. Third, designers wire a single contactor and call it Category 3; the cross-monitoring requirement of Category 3 is not met by one contactor, no matter how well-tried the component is. The two standards sit on different axes and both must be satisfied in parallel; there is no substitution between them.
Limits, Failure Modes, and Boundary Conditions
Category 2's 100x test-to-demand ratio is the binding numeric constraint in most real machinery: if the demand rate is once per shift, the diagnostic test must run at least 100 times per shift, which forces the test to be embedded in normal cycle logic rather than as a separate maintenance procedure [S1]. If the ratio cannot be met, the architect must drop to Categories 3 or 4, not paper over the gap.
Common-cause failure (CCF) measures become relevant at Category 3 and above: separation of wiring, over-voltage protection, use of well-tried components, and avoidance of a single PCB or single MCU carrying both channels. The ISO 13849-1 score sheet requires a minimum number of CCF points before PL d or PL e can be claimed. For Category 1, the "well-tried component" restriction also bounds the architecture: a general-purpose relay is not acceptable, and a positively driven contactor (e.g. mirror-contact or force-guided type) is the typical solution.
Stop category 2 has a separate boundary condition: because power remains applied, a stop signal must not be implemented in a way that can fail to dangerous, and the standard requires the safety function to still be able to remove power eventually. In practical servo systems this is the SS2 (Safe Stop 2) function per IEC 61800-5-2, with SOS or SLS monitoring on top of the STO that gets asserted at zero speed.
Reading The Two Standards Together
The cleanest mental model is two parallel columns. Left column: stop category (0, 1, 2) describes the physical braking behaviour and the power state of the actuators at the end of the stop. Right column: ISO 13849-1 category (B, 1, 2, 3, 4) and Performance Level (a to e) describe the architectural integrity of input, logic and output. The risk assessment, per ISO 12100, generates the required PL; the hazard mechanics, per ISO 13850 and IEC 60204-1, generate the required stop category. Both columns are then written into the safety requirements specification, validated by calculation (SISTEMA or equivalent), and verified by test before commissioning. [S1]
For engineering reference, a pressure transmitter loop that triggers a machine stop is itself a safety function, and the same dual-taxonomy thinking applies: how the transmitter physically interacts with the process (sensing speed, range) is independent of how the safety circuit around it handles faults. The same pattern is visible on flow meter shut-off chains, where stop category 0 is common because the process is forgiving and integrity dominates. For more on how diagnostic test intervals interact with architecture choice, the comparison pieces on electronic test and measurement loops and on the measurement test side of the safety chain give useful context.
Track, going forward, the steady migration of stop-category logic into IEC 61800-5-2 safety functions (STO, SS1, SS2) inside the drive, and the parallel pressure on ISO 13849-1 to keep Categories 3 and 4 as the default for PL d/e machinery. Both are stable, mature positions in 2026; expect incremental guidance updates on CCF measures and on Category 2's 100x ratio rather than structural rewrites.
Related analysis: EMFR vs strain gauge load cell: weigh-off on capacity, speed, accuracy, duty.