E-Stop PLC Logic: Safety Circuit vs Status Code

An emergency-stop function is a machine safety function, not a standard ladder rung. It may be implemented with a safety relay, a safety PLC, fail-safe I/O, safety-integrated drives, contactors or a validated combination. A standard PLC can read a diagnostic status and inhibit its ordinary run request, but that code does not become the safety-rated function.

The safety design must meet the risk assessment, applicable machine-specific standards, required performance level or SIL, response-time calculation, fault detection and validation plan. Do not infer compliance from “dual channel,” a component label or a copied program.

Evidence matrix for a safety review

Practice only the standard-PLC status latch and restart inhibit. The simulator cannot design, calculate, emulate or validate the safety-rated emergency-stop function.

This guide explains stop-category context, safety-relay and safety-PLC roles, standard-PLC observation logic, reset boundaries and the evidence to capture during commissioning.

Table of Contents

1. The Three Stop Categories
2. ISO 13849 Performance Levels — a Quick Primer
3. The Safety Relay Between Button and Contactor
4. Where the Standard PLC Fits In
5. Ladder Logic for the PLC-Side Observation Role
6. Safety PLCs: When You Need One
7. Dual-Channel Monitoring and Cross-Checking
8. Reset Logic — Why Auto-Restart is Forbidden
9. Common E-Stop Anti-Patterns
10. Commissioning and Documentation

The Three Stop Categories

IEC 60204-1 describes three stop categories. The emergency-stop function uses Category 0 or 1 as selected by the risk assessment and applicable machine standard.

Stop Category 0 — stopping by immediate removal of power to the machine actuators. The resulting stopping time depends on inertia, braking and the mechanical system. Immediate power removal is not automatically the shortest or safest stop for every hazard.

Stop Category 1 — controlled stop with power available to achieve the stop, followed by removal of power to the actuators. The safety design must monitor or bound the transition and account for the drive, brake and load.

Stop Category 2 — controlled stop with power left available to the actuators. It is a stop category in IEC 60204-1 but is not used for the emergency-stop function described by ISO 13850.

Do not choose the category from a list of machine examples. Record why the selected stop reduces the relevant risk and validate the measured stop behavior across the operating envelope.

ISO 13849 Performance Levels

ISO 13849-1 defines performance levels from PL a through PL e for safety-related parts of control systems. A PL is not a direct injury label, and ISO 13849-1 does not assign the required PL to an application.

Start with the ISO 12100 risk assessment and any applicable Type-C machine standard. Define the safety function and required performance, then design and evaluate the full input–logic–output chain. The achieved PL depends on architecture/category, component reliability data, diagnostic coverage, common-cause measures, mission time and software/systematic requirements.

“Dual channel” alone does not prove PL d or PL e, and a safety PLC is not automatically required by a particular PL. Conversely, a safety relay label does not prove that the installed circuit achieves its headline capability. Document the actual configuration and calculation.

The Safety Relay

A safety relay is one implementation option between the emergency-stop command device and the final switching elements. A safety PLC, fail-safe I/O or safety-integrated drive may perform some or all of the safety logic. These are not interchangeable without checking the certified application and complete safety-function design.

A safety relay:

• Accepts the supported single- or dual-channel input arrangement shown in its manual
• Detects specified faults such as channel discrepancy or shorts when wired and parameterised accordingly
• Controls safety outputs connected to the selected final switching elements
• Provides monitored manual or automatic start/reset modes where the risk assessment permits
• Supplies safety data and certified use cases needed for the function-level calculation

In the illustrated architecture the safety relay performs the logic portion; the complete function also includes the command device, wiring, final switching elements, actuator/load behavior and validation.

Where the Standard PLC Fits In

A standard (non-safety-rated) PLC has three legitimate roles in an E-stop circuit:

1. Observation — read the safety relay's monitoring output (most relays provide one) and reflect the E-stop state in the PLC's logic. Useful for HMI indication, alarm logs, and preventing automatic restart of downstream processes.
2. Latching alarms — when the E-stop trips, write a timestamped entry to the alarm buffer, hold the fault state until an operator acknowledges it, and prevent sequences from resuming until acknowledgement is recorded.
3. Coordinating ordinary process state — clear standard run requests and place related sequences in a defined recovery state. If the emergency-stop function must span multiple zones, that span belongs in the safety-related design, not only in standard PLC coordination.

The PLC does not:

• Replace the specified safety-related input, logic or output subsystem
• Bypass the validated reset/restart requirements
• Supply the safety response-time or fault-tolerance claim for a non-safety-rated signal path

Code that routes an ordinary motor command through an EStopActive status can improve sequence behavior and diagnostics, but it is still standard control logic unless the whole implementation is safety-rated and validated.

Ladder Logic for the PLC-Side Observation Role

Here is a platform-neutral observation pattern. Confirm the diagnostic contact polarity and whether it represents “safety function healthy,” “outputs energised” or another state—the meanings are not identical.

| SafetyFunctionHealthy                    EStopActiveStatus |
|---------|/|------------------------------------( )---------|

| EStopActiveStatus                        EStopEventLatched |
|---------| |-----------------------------------(L)----------|

| ResetPB       SafetyFunctionHealthy       EStopEventLatched |
|---| |----------------| |----------------------(U)-----------|

Reading the rungs:

• Rung 1 translates a positively named diagnostic input into an active-status bit. Confirm whether other safety faults can also make the input false; label the HMI accordingly.
• Rungs 2 and 3 preserve an event for HMI/alarm history until the diagnostic input is healthy and an operator acknowledges it. They do not reset the safety relay or safety PLC.

Display the current safety-system status distinctly from the historical event latch, log transitions with the controller clock quality documented, and inhibit ordinary sequence restart until the approved recovery conditions are met. None of this replaces the safety-related function.

Safety PLCs: When You Need One

Safety PLCs are useful when the validated design benefits from configurable safety logic, distributed fail-safe I/O, zone coordination, safe motion or diagnostics. Required PL alone and a fixed count of safety functions do not determine the architecture.

Examples include Siemens fail-safe CPUs, Rockwell GuardLogix and Pilz safety controllers. Product names, firmware, safety signatures and supported instructions change, so use the current safety manual and certificate for the exact part number. Depending on the platform:

• Safety logic is separated, compiled and identified according to the vendor's safety workflow
• Certified instruction libraries and restricted language features may be provided
• Fail-safe I/O offers configurable discrepancy, test-pulse and fault diagnostics
• The complete application can be evaluated to the required PL/SIL when used inside the certification limits

A safety PLC can directly control suitable fail-safe outputs or drives; an additional safety relay is not universally mandatory. Choose the architecture from the safety requirements, component certificates, maintainability, lifecycle and validation effort—not an unsupported price rule or function-count threshold.

Dual-Channel Monitoring and Cross-Checking

Dual-channel input architectures use two signal paths so specified faults can be detected or tolerated. The exact contact arrangement, test pulses, discrepancy behavior and reset sequence are defined by the safety device and logic manual.

1. Discrepancy monitoring. If the channels do not transition as expected, supported logic can latch a fault. Use the configured time from the validated design, not a generic range.
2. Short and wire-break diagnostics. Test pulses, separate supplies or supported equivalent/complementary contact arrangements can detect particular faults. Each detects a defined set—not every wiring fault.

Wire and parameterise the input exactly as shown for the certified application. Then fault-test one open channel, a discrepancy, shorts covered by the diagnostic design and reset behavior, recording the observed state and diagnostic code.

Reset Logic — Why Auto-Restart is Forbidden

Releasing the emergency-stop command device must not by itself restart the machine. Reset restores the ability to start; it is not a start command. The required reset location, visibility, monitored edge and separate start action come from the applicable standards and risk assessment.

One common sequence is:

1. E-stop physical button rotated (or pulled) back to its armed position — the mushroom "unlocks."
2. Both safety relay input channels read "safe" again.
3. The operator performs the configured reset action with the safeguarded area checked as required.
4. The safety logic accepts the reset only if all monitored conditions and feedback are valid.
5. Any auxiliary interlocks (door closed, guard in place) are also satisfied.
6. Only then can the machine's normal start sequence run — itself requiring a separate Start press per the three-wire control principle.

The standard PLC should clear ordinary run requests and require the approved new-start sequence after recovery. A separate HMI acknowledgement may be useful for process state or alarm history, but it is not universally required and must not reset or bypass the safety function.

Common E-stop anti-patterns

1. Standard PLC logic presented as safety-rated. Certification and validation apply to the complete input–logic–output function, not the variable name.
2. Undefined safe state. “Motor off” may not address gravity, stored pneumatic/hydraulic energy, coasting or connected equipment.
3. PL selected by habit. Determine the required performance from the risk assessment and machine-specific standard.
4. Channel count used as proof. Two wires or two contacts do not establish diagnostic coverage, common-cause measures or achieved PL.
5. Diagnostic timing changed to hide a fault. Parameter changes must follow change control, the certified range and revalidation.
6. Reset without visibility or zone analysis. A reset can be shared only when the safety requirements show that its location and span are appropriate.
7. Restart state retained. Safety reset, communications recovery or power restoration must not create unintended movement.
8. Ambiguous monitoring signal. Distinguish command-device state, safety-function state, safety-output state and final-element feedback on the HMI.
9. No final switching-element feedback. Where required, monitor contactors, brakes or drive status and test stuck/welded feedback behavior.
10. Happy-path-only commissioning. Execute the approved functional and fault-injection plan under controlled conditions, including every command device, channel fault, reset case and measured stop-time requirement.

Commissioning and Documentation

A reviewable emergency-stop function normally needs, at minimum:

1. Risk assessment per ISO 12100 — identifies the hazards, the required PL per function, and the rationale.
2. Safety requirements specification — defines the function, safe state, initiating devices, span, reset/restart behavior, fault reaction and maximum response time.
3. Architecture and calculation per the selected standard — identifies exact parts, safety data, assumptions, diagnostic coverage, common-cause measures and mission time. IFA's SISTEMA or another suitable tool can support a calculation but does not replace engineering review.
4. Verification and validation plan/results — traces each requirement to inspection, functional test, fault test and measured result.
5. Configuration and change record — captures drawings, software safety signature/checksum, parameters, versions, approvals and retest scope.

Keep the records with the machine technical file and update them after safety-related changes. Evidence is part of lifecycle control, not paperwork added after commissioning.

Key Takeaways

• A standard PLC status rung is not the emergency-stop safety function.
• ISO 13850 emergency-stop behavior uses Category 0 or Category 1; Category 2 is outside that emergency-stop definition.
• ISO 13849-1 performance levels flow from a risk assessment, not a guess.
• Channel architecture, diagnostics and achieved PL must be calculated for the complete function; channel count alone proves nothing.
• Releasing or resetting the emergency-stop function must not itself command an unintended restart.
• Verification, validation and controlled configuration records are required evidence for lifecycle safety.

Related Reading

• Motor start/stop ladder logic tutorial
• PLC programming best practices
• Safety PLC vs standard PLC comparison
• PLC security best practices

Once the theory is clear, practise a PLC-side E-stop latch and reset pattern — getting the reset-sequence code correct in a safe environment is far better than debugging it during a plant audit.