Emergency Stop (E-Stop): Function, Reset & Testing
Quick answer
An emergency stop is a manually initiated complementary protective function intended to avert or reduce an existing or impending hazard. It must override normal commands, remain latched until deliberately reset and must not cause an automatic restart when reset.
Key Takeaways
- An emergency stop is a manually initiated complementary protective function intended to avert or reduce an existing or i...
- Beginner-level topic in Safety Systems
- Commonly used in: Machinery emergency-stop devices and pull-cord systems, Stopping hazardous motion or process energy in an emergency
Detailed Definition
An emergency stop is a machine safety function, not an ordinary stop pushbutton and not a single PLC input. The complete function includes the actuator, input devices, safety logic, final switching elements, stored-energy behavior, stopping performance, reset and restart prevention. ISO 13850 specifies functional requirements and design principles; IEC 60204-1 covers electrical realization and stop categories.
The emergency-stop function is complementary protection. It does not replace guarding, presence sensing, safe design or isolation for maintenance. A standard PLC may monitor a validated safety-system status for sequencing and HMI display, but ordinary logic must not be represented as the safety function unless the complete implementation is safety-rated and validated for the required risk reduction.
Evidence and scope
The safety boundary is based on ISO 13850 and IEC 60204-1 publication records. This page explains design and validation concepts; it cannot determine the required PL, SIL, stop category or architecture for a particular machine. Those decisions require a documented risk assessment and competent safety engineering.
Technical review:
Critical behavior
- Resetting an emergency-stop device permits the safety system to become ready; it must not by itself restart hazardous motion.
- The required stop response depends on the hazard and risk assessment. “Remove all power immediately” is not universally the safest response.
- The safety function includes sensors, logic, final elements and stored energy—not only the red mushroom actuator.
- A standard PLC rung that observes EStopHealthy is status or process logic, not proof of achieved PL or SIL.
- Fault detection, discrepancy timing, contactor feedback and restart interlocks must be validated as part of the complete safety function.
Verification checklist
- 1Trace the safety requirement to a named input, logic solver, final element and feedback path.
- 2Test every actuator location and each credible single fault defined by the validation plan.
- 3Measure stopping time or distance at the worst credible load and speed.
- 4Verify that reset never initiates motion and that a maintained start cannot cause restart.
- 5Record device versions, configuration signatures, results, witnesses and corrective actions.
IEC and vendor terminology
Similar-looking instructions do not always have identical execution, initialization or storage behavior.
| Platform | Common term | What to verify |
|---|---|---|
| ISO 13850 | Emergency-stop function | Complementary protective function with defined actuation, latching, reset and restart principles; it does not replace primary safeguarding. |
| IEC 60204-1 | Stop category 0 or 1 | Electrical stop behavior is selected from the risk assessment. Category 2 is not an emergency-stop category under ISO 13850. |
| Safety relay / safety PLC | Safety function | Monitors input channels and final elements using a validated architecture suitable for the required risk reduction. |
| Standard PLC / HMI | EStopHealthy status | May inhibit normal sequence logic and show diagnostics, but must not be mistaken for the certified safety path. |
Separate the safety function from standard sequence logic
E-stop channels ──> safety logic ──> STO/contactors ──> hazardous energy
│ │
└─ healthy status <──┘ feedback
│
└──> standard PLC sequence inhibit / HMIEmergency-stop state and restart table
The table describes functional intent only. Actual channel logic and reset monitoring belong in approved safety components and their validated configuration.
| State / phase | Safety demand | Reset available | Hazardous motion allowed |
|---|---|---|---|
| Normal and healthy | No | Not required | Only under normal control |
| E-stop actuated | Yes | No | No |
| Actuator released | Demand cleared | Yes, if all diagnostics healthy | No |
| Reset completed | No | Ready state | No automatic restart |
| Separate start request | No | Reset already complete | Only if all normal permissives are true |
Working LD and ST example
Standard logic may monitor safety status without implementing it
Use the validated safety-system status to inhibit a normal sequence and expose diagnostics. The example does not implement the safety function.
Ladder Diagram
|----[ Safety_System_Healthy ]----[ Start_Request ]----( ) Cycle_Enable----|
|----[/ Safety_System_Healthy ]------------------------( ) Safety_Status_Alarm|Structured Text
CycleEnable := SafetySystemHealthy AND StartRequest AND NormalPermissives;
SafetyStatusAlarm := NOT SafetySystemHealthy;
// SafetySystemHealthy is supplied by the validated safety system.
// This standard task must not command or bypass the safety outputs.Expected result: Loss of the healthy status immediately inhibits the normal cycle command. Restoring it does not create a start request or reset the safety system.
Failure modes and diagnostic checks
| Symptom | Likely cause | Check next |
|---|---|---|
| Machine restarts when the mushroom is released | Reset and restart were combined or a maintained start request was accepted immediately. | Require a deliberate reset followed by a separate start transition and test every operating mode. |
| E-stop input changes but hazardous motion continues | Final elements, drive safe function, stored energy or wiring were not included in the validated path. | Trace the complete safety function and measure stopping response under worst credible conditions. |
| One channel fault is not diagnosed | Channel architecture, discrepancy monitoring or test-pulse compatibility is incorrect. | Run the approved single-fault tests and inspect device-specific diagnostics. |
| HMI says safe while a contactor remains welded | The displayed bit is a command rather than verified final-element feedback. | Use monitored feedback in the safety design and label command, status and proof distinctly. |
Current primary and technical sources
These sources support the behavior summarized on this page. The project's controller, firmware and IDE help remain authoritative for implementation.
- ISO 13850:2015 publication record
International Organization for Standardization — Emergency-stop functional requirements and design principles
- ISO 13849-1:2023 publication record
International Organization for Standardization — Methodology and principles for safety-related parts of control systems
Continue with the practical guide
Common Questions
What is Emergency Stop?
An emergency stop is a manually initiated complementary protective function intended to avert or reduce an existing or impending hazard. It must override normal commands, remain latched until deliberately reset and must not cause an automatic restart when reset.
When should I use Emergency Stop?
Emergency Stop is particularly useful in scenarios such as Machinery emergency-stop devices and pull-cord systems and Stopping hazardous motion or process energy in an emergency. Consider implementing it when you need reliable, efficient solutions for these types of applications.
What should I verify before using Emergency Stop?
Trace the safety requirement to a named input, logic solver, final element and feedback path. Test every actuator location and each credible single fault defined by the validation plan. Measure stopping time or distance at the worst credible load and speed. Verify that reset never initiates motion and that a maintained start cannot cause restart. Record device versions, configuration signatures, results, witnesses and corrective actions.
What are related concepts I should learn?
To fully understand Emergency Stop, you should also familiarize yourself with Safety PLC, GuardLogix, and Light Curtain. These concepts work together in industrial automation systems.
Continue Learning
Ready to deepen your understanding of Emergency Stop? Here are some recommended resources:
Was this helpful?
Let us know if this glossary term helped you understand Emergency Stop better.
Your feedback helps us improve our glossary and create better content for the PLC programming community.
About Safety Systems
Safety PLCs, interlocks, and protective devices