The E-Stop That Did Not Stop the Machine
A packaging line had a red mushroom button on the control panel. The operator hit it during a jam — the line kept running. The electrician opened the panel. The e-stop switch was wired as a single contact, in series with a PLC input. When it was pressed, the PLC saw the signal and was supposed to stop the line. But the PLC scan was 100 ms, and the line was still moving. Worse, the main contactor (which cuts power to the motors) was not in the e-stop circuit at all. The e-stop was a PLC command, not a hardwired stop. It was a “soft stop” that could be defeated by a software fault.
Emergency stop circuits are the last line of defense. If they are wrong, they are decoration. Here is how to design one that actually stops the machine.
The Rule: Hardwired, Not PLC-Controlled
An e-stop must cut power to the actuators through a hardwired safety relay (or safety PLC), not through a standard PLC ladder. The safety circuit does not wait for a scan cycle; it acts in milliseconds. The safety relay has redundant contacts that drop out on the e-stop signal, removing power from the contactors. The PLC may also see the signal (for logging), but the stopping itself is hardwired.
The packaging line’s e-stop was PLC-only. When the PLC failed, the e-stop failed. A safety relay between the button and the contactor would have stopped the line in under 50 ms — regardless of the software.
The e-stop rule: The mushroom button drives a safety relay (dual-channel), which drops out the main contactor(s). The PLC sees the signal but does not own the stop. A single-contact, PLC-input e-stop is not compliant — it is a decoration.
Dual Channel: The Redundancy Requirement
A safety relay is dual-channel: the e-stop button has two normally-closed (NC) contacts, wired to two separate inputs on the relay. If one contact welds shut, the other still opens the circuit. The relay monitors the two channels for mismatch — if they disagree (one is open, one is closed), it faults out. This redundancy is what makes the circuit reliable enough for a safety function. A single-channel e-stop can fail silently (the contact welds, and nobody knows until it is too late).
Where the E-Stops Go
Every operator position must have an e-stop within reach (within 1 meter, within arm’s length). The list:
- Main operator panel.
- Each maintenance access point.
- Robot teach pendant (if any).
- Remote stations (if the machine has multiple operator points).
The button must be a mushroom head, red on yellow background, and the stop must be latched (it stays stopped until reset). A button that springs back and restarts automatically is a hazard — the operator may still be reaching in.
Stop Categories: 0, 1, 2
Per IEC 60204-1, e-stops fall into three categories:
- Category 0: Immediate removal of power (coast to stop). Used where an uncontrolled stop is safer than a powered stop (a saw blade, a press).
- Category 1: Controlled stop (powered deceleration), then power removal once stopped. Used on machines where coasting is dangerous (a conveyor with product).
- Category 2: Controlled stop, power remains on. Used only for non-hazardous stops (not for e-stop).
For most machines, the e-stop is Category 0: power off immediately. The Category 1 stop is a separate pushbutton (controlled stop), not the red mushroom.
Reset: Manual, Not Automatic
After an e-stop, the machine must not restart until a person intentionally resets it. The reset is a separate button (or a twist of the mushroom) — and the machine starts in a safe state (hold, not auto-cycle). The packaging line’s e-stop, when it did work, restarted automatically. That is a violation. The operator must confirm the hazard is clear before reset.
A Circuit Design Checklist
- Is the e-stop hardwired through a safety relay (not PLC-only)?
- Are the e-stop contacts dual-channel (two NC contacts)?
- Does the safety relay drop out the main contactor(s)?
- Is the stop Category 0 (immediate power removal) for hazards?
- Is the mushroom red on yellow, latched?
- Is there an e-stop at every operator point?
- Does the machine require a manual reset (no auto-restart)?
- Does the relay fault if the channels mismatch (weld detection)?
- Has the circuit been tested (press e-stop; does the line stop)?
- Is there a diagram of the safety circuit in the cabinet?
The Bottom Line
The e-stop that did not stop the machine was a PLC input with a red button on the panel. It looked safe; it was not. A real e-stop is a hardwired, dual-channel safety relay that cuts the contactor in milliseconds, requires a manual reset, and stops in Category 0. The mushroom on the panel is only as good as the wires behind it — if those wires go through the PLC, they are not a safety circuit.
