Emergency Stop Categories (0, 1, 2) Explained
Stop categories explained — the difference between Stop Category 0, 1, and 2 per IEC 60204-1, how each removes power, and how to wire an E-stop correctly.
Stop Category 0, 1, and 2 are machine stop classifications defined by IEC 60204-1 (Safety of Machinery — Electrical Equipment of Machines). They describe how a machine removes power from its actuators during a stop, not when or why the stop is triggered. Category 0 cuts power immediately. Category 1 decelerates under control, then cuts power. Category 2 decelerates under control and keeps power applied. Choosing the wrong category for a hazard can result in injury, equipment damage, or a non-compliant machine design.
What Stop Categories Are — and What They Are Not (IEC 60204-1)
IEC 60204-1 Clause 9.2.2 defines three stop categories. The standard applies to the electrical equipment of industrial machines and is the primary reference engineers use when designing stopping functions, whether triggered by an emergency stop, guard interlock, or normal operational stop.
Stop categories are not the same as Performance Level (PL) or Safety Integrity Level (SIL). PL and SIL (from ISO 13849-1 and IEC 62061 respectively) quantify the reliability and probability of failure on demand of a safety function. Stop categories describe the behavior of the stopping action — the sequence in which power is removed and motion ceases. A single E-stop function will have both a stop category and a PL/SIL rating, but these are independent attributes.
| Parameter | Stop Category | PL / SIL |
|---|---|---|
| Defined by | IEC 60204-1 | ISO 13849-1 / IEC 62061 |
| Describes | How the machine stops | How reliably it stops |
| Applies to | Stopping behavior | Failure probability |
This distinction matters in practice: a risk assessment may require an E-stop to be Category 0 behavior at PLd reliability — two separate requirements that each need to be verified.
Stop Category 0 — Immediate Removal of Power (Uncontrolled Stop)
Stop Category 0 is an immediate, uncontrolled stop. Power to the machine actuators is removed as quickly as possible, without any controlled deceleration phase. The load coasts or brakes to a standstill under residual friction and mechanical braking only.
How Category 0 works in the control system
From a controls perspective, Category 0 means the safety function acts directly on the power-removal path, bypassing the drive or motion controller entirely:
- A safety relay or safety PLC de-energizes the main contactor, removing line voltage from the motor or drive input.
- Where a servo or variable-frequency drive (VFD) supports it, Safe Torque Off (STO) is asserted — this disables the drive's output transistors without removing bus voltage, effectively achieving the same immediate torque removal in a way the drive itself handles safely.
- The machine decelerates only through friction, gravity, or a spring-applied brake. There is no drive-controlled deceleration ramp.
When Category 0 is appropriate
- Hazards where continued motion after a stop command is the primary danger (e.g., a press, a shear, a robot arm moving toward a pinch point).
- Machines with low inertia where coasting is short and predictable.
- Applications where the drive or motion controller cannot be trusted as part of the safety function (which is common — drives are rarely certified as safety-related components).
Category 0 limitations
Immediate power removal can itself cause harm on high-inertia machines. A large centrifuge or grinding wheel that loses drive torque abruptly may generate mechanical shock, cause a workpiece to be thrown, or result in unpredictable rundown behavior. For these machines, Category 1 is usually safer.
Stop Category 1 — Controlled Stop, Then Remove Power
Stop Category 1 allows the drive to execute a controlled deceleration ramp before power is finally removed. The machine stops in a defined, predictable manner, and only after motion has ceased (or within a defined time) does the safety function remove power.
How Category 1 works in the control system
The sequence is:
- The stop command is issued (E-stop pressed, guard opened, etc.).
- The drive receives a deceleration command — either from the safety PLC via a safe speed reference, or from the standard controller if a time-monitored approach is used.
- The drive decelerates the load along a controlled ramp.
- Once zero speed is confirmed (via encoder feedback, Safe Speed monitoring, or a fixed time delay), the safety function removes power — typically by asserting STO or de-energizing the contactor.
The key requirement is that the power removal at the end of the Category 1 sequence is positively enforced by the safety system, not left to the drive's own normal stop logic. This is what distinguishes it from a normal operational stop.
Safety relay and safety PLC implementation
A Category 1 stop is more complex to implement than Category 0 because you must monitor the deceleration phase:
- Time-monitored approach: The safety relay starts a timer when the stop command is received. After a fixed interval, it de-energizes the output regardless of actual speed. Simple, but requires a conservative (worst-case) time estimate.
- Speed-monitored approach: A safety PLC with a safe speed input (or a safety drive with SS1 — Safe Stop 1 — function) monitors actual speed and applies STO only when speed drops below a threshold. More precise, requires more complex wiring and commissioning.
Many modern safety drives implement SS1 (Safe Stop 1) natively — this is the drive-integrated equivalent of a Category 1 stop. When SS1 is triggered, the drive decelerates at its configured ramp, then applies STO internally after monitoring speed or time.
When Category 1 is appropriate
- High-inertia loads where immediate power removal would result in dangerous rundown or mechanical shock.
- Machines where the workpiece or tooling must be retracted to a safe position before motion ceases.
- Robots and servo axes where a coast stop from full speed could move the axis into a hazard zone.
Stop Category 2 — Controlled Stop, Power Maintained
Stop Category 2 is a controlled stop in which the drive remains energized and power is maintained after motion ceases. The machine is at zero speed but the drive holds it there under torque.
How Category 2 works in the control system
- The drive decelerates the load to zero speed along a controlled ramp.
- Once at zero speed, the drive applies holding torque to keep the axis in position. Power is not removed.
- The safety function must monitor that the machine remains at zero speed — safe operating stop (SOS) in drive terminology.
Because power remains on, Category 2 is not used for emergency stop functions in most machine designs. IEC 60204-1 notes that Category 2 stops may be used where maintaining position under power is operationally necessary (e.g., a vertical axis that would drop if de-energized), but the ongoing hazard requires careful risk assessment.
When Category 2 is — and is not — appropriate
- Appropriate where a vertical or gravity-loaded axis must be held in position and a mechanical brake is not fitted.
- Requires separate monitoring (SOS function or safety PLC monitoring speed and position) to confirm the machine stays stopped.
- Not appropriate as the primary emergency stop category where isolation from energy is the goal, since power remains applied.
Choosing the Right Stop Category — Risk Assessment First
The correct stop category is determined by the machine's risk assessment, not by convenience or cost. IEC 60204-1 does not prescribe which category to use for a given machine — that decision comes from the hazard analysis conducted under ISO 12100 or an equivalent risk assessment methodology.
Key factors in the selection
| Factor | Category 0 | Category 1 | Category 2 |
|---|---|---|---|
| Inertia | Low — coasting is short | High — controlled decel needed | High — power holding needed |
| Speed at stop | Any | High (ramp required) | Any |
| Position accuracy at stop | Not required | Not required | Required |
| Power must be removed | Yes | Yes (after decel) | No |
| Drive trusted as safety component | No | Partially (with monitoring) | Yes (with SOS monitoring) |
| Typical E-stop use | Yes | Yes | Rarely |
Interaction with guard interlocks and normal stop
Not every stop on a machine is an emergency stop. IEC 60204-1 distinguishes:
- Normal operational stop (Category 0, 1, or 2 as appropriate for the sequence).
- Emergency stop — always Category 0 or Category 1 per the standard; Category 2 is not permitted as an emergency stop category because power is maintained.
- Guard interlock stop — category selected by risk assessment; often Category 1 for processes where an abrupt stop would cause secondary hazards.
E-stop vs Emergency Switching Off — An Important Distinction
IEC 60204-1 defines two related but distinct functions that are often confused:
Emergency Stop (Clause 9.2.5.4) removes motion energy from the machine. It stops moving parts. It does not necessarily isolate all electrical energy from the machine.
Emergency Switching Off (Clause 9.2.5.5) removes electrical power from the entire machine or a defined section of it. It is used where electrical shock or electrical fire is the hazard. Typical use: transformer substations, high-voltage equipment.
An E-stop button does not replace a lockout/tagout isolation point. After an E-stop, hazardous energy (electrical, pneumatic, hydraulic) may still be present. The E-stop reduces motion hazards; energy isolation is a separate procedural and engineering control.
Wiring an E-stop Correctly — NC Contacts, Dual Channel, Safety Relay
Normally Closed (NC) contacts
An E-stop button must be wired with normally closed (NC) contacts. When the button is not pressed, the NC contact is closed and the circuit is complete. When the button is pressed, the NC contact opens, breaking the circuit and triggering the safety function.
This "positive-opening" principle ensures that a broken wire, a corroded contact, or a faulty connection causes the same response as pressing the button — a safe state. A normally open (NO) wired E-stop would fail silently on a wire break.
Dual-channel wiring
For PLc and above (ISO 13849-1), E-stop circuits use dual-channel wiring — two independent signal paths from the E-stop button to the safety relay or safety PLC input. Both channels must open simultaneously for a valid stop signal. The safety relay monitors cross-channel faults (one channel open, one closed) and detects short circuits between channels.
A typical dual-channel E-stop wiring layout:
- Channel 1 (CH1): NC contact 1 of the E-stop button → Input 1 of safety relay
- Channel 2 (CH2): NC contact 2 of the E-stop button → Input 2 of safety relay
- Safety relay output: Controls contactor coil or STO input
Safety relay operation
A safety relay monitors the input channels and controls one or more output circuits. On a valid stop signal (both channels open), it de-energizes its outputs, which in turn:
- De-energizes the main contactor (Category 0 stop), or
- Sends a stop command to the drive and starts a monitoring timer, then de-energizes after deceleration (Category 1 stop).
The safety relay also performs a start interlock check (also called reset monitoring): before the outputs can re-energize after a stop, the E-stop button must be released and a manual reset signal applied. This prevents automatic restart after an E-stop.
Cross-faults and diagnostics
Safety relays generate diagnostic coverage by testing the input circuits on each operating cycle. Some relays test channels dynamically during normal operation using pulse testing — short pulses applied to the channel that would reveal a short to a voltage source. This is the mechanism behind the diagnostic coverage (DC) rating used in ISO 13849-1 calculations.
For a deeper look at the full E-stop safety circuit in ladder logic, including how the safety relay output is mapped to PLC inputs and how the ladder handles interlock and reset logic, see the dedicated guide.
Frequently Asked Questions
What are stop categories? Stop categories (0, 1, and 2) are defined in IEC 60204-1 and describe how a machine removes power from its actuators during a stop. Category 0 removes power immediately. Category 1 decelerates under control then removes power. Category 2 decelerates under control and keeps power applied.
What is the difference between Stop Category 0 and 1? Category 0 cuts power to the actuators immediately — the machine coasts or brakes to a standstill without drive-controlled deceleration. Category 1 allows the drive to execute a controlled deceleration ramp first, then removes power once the machine has stopped or a time limit is reached. Category 1 is preferred for high-inertia loads where an abrupt stop creates secondary hazards.
Is an E-stop always Category 0? No. IEC 60204-1 permits emergency stops to be either Category 0 or Category 1, depending on the risk assessment. Category 0 is more common because it removes power immediately and does not rely on the drive completing a deceleration sequence. Category 1 is used where a sudden stop from full speed would itself cause injury or damage. Category 2 is not permitted for emergency stops.
What is a controlled stop? A controlled stop is one in which the drive or motion controller actively decelerates the load along a defined ramp before motion ceases, rather than simply removing torque and allowing the load to coast. Category 1 and Category 2 both use controlled stops. The distinction between them is whether power is removed (Category 1) or maintained (Category 2) after the machine reaches zero speed.
What is Safe Torque Off (STO) and how does it relate to stop categories? STO is a drive safety function (defined in IEC 61800-5-2) that disables the drive's output transistors, preventing it from delivering torque. When STO is asserted, the drive cannot accelerate the load. Used alone (STO only, no deceleration command), it achieves Category 0 behavior. When used at the end of a controlled deceleration sequence (SS1 function), it achieves Category 1 behavior.
Related Reading
Understanding stop categories in isolation is only part of machine safety design. See also:
- Functional safety basics — PL, SIL, risk assessment, and how stop categories fit into the broader functional safety lifecycle.
- What is a safety relay — how safety relays implement stop categories in hardware, including dual-channel monitoring and cross-fault detection.
- E-stop safety circuit in PLC ladder logic — wiring diagrams and ladder logic for integrating E-stop signals with a PLC control system.
- For a comparison with other safety devices that also involve defined stopping behavior, the two-hand control guide covers how two-hand controls interact with stop functions on press machines.
- Safety circuit categories covers the IEC/ISO circuit architecture categories (B, 1, 2, 3, 4) that define redundancy and diagnostic requirements — complementary to, but distinct from, the stop categories covered here.
