An important note first
This article is a general introduction. It is not a design guide, and nothing here should be used to build, modify or approve a safety circuit. Safety functions on real machinery are specified, designed, validated and maintained according to the applicable standards and regulations in your region, by trained and competent people, and in line with the machine and component manufacturers’ instructions. The purpose here is to explain the ideas, so that the terms make sense.
What an emergency stop is for
An emergency stop, or e-stop, is a manually operated control that lets a person bring a machine, or a part of it, to a stop quickly when something is going wrong. It is typically a red mushroom-head button on a yellow background, designed to be easy to find and hit, and to stay latched down until it is deliberately reset.
An e-stop is generally regarded as a complementary protective measure, not a replacement for guarding or other primary protection. Guards, interlocks and safe design reduce the need to use it. It exists for the situations that other measures did not prevent.
Why not just use ordinary wiring
In a normal control circuit, a stop button might be wired to a PLC input, and the program decides to stop the motor. This is fine for routine stops. But a safety function has to work even when something has failed: a wire might break, a contact might weld shut, a program might hang, or a relay might stick.
Safety circuits are therefore designed so that the more likely failures lead to a safe state, usually the machine stopping. Some common ideas:
- Using normally closed contacts. A stop button is normally closed, so a broken wire looks the same as a pressed button, and the machine stops.
- Redundancy. Two independent channels are used, so a single fault does not defeat the function.
- Monitoring. The circuit checks that its parts are working, for instance that a contactor really opened, and refuses to restart if not.
- Defined reset behavior. Releasing an e-stop must not restart anything on its own. A separate, deliberate reset action is required.
What a safety relay does
A safety relay is a purpose-built module that takes in safety inputs (e-stop buttons, interlock switches on guard doors, light curtains) and controls safety outputs that remove power from, or otherwise stop, hazardous motion. Internally it uses redundant, cross-monitored contacts and logic, and it checks for faults such as welded contacts or short circuits between channels.
Typical features, at a general level:
- Two input channels that are compared. If they disagree for too long, the relay faults.
- Forcibly guided (mechanically linked) contacts so that a stuck contact can be detected.
- Manual or monitored reset inputs, so that restart needs deliberate action.
- Several outputs, often with different stop timing.
Larger or more complex machines may use configurable safety controllers, which do the same job but handle many inputs and outputs with programmable logic. The same principle applies: certified hardware, tested logic and documented verification.
Ordinary relays, contactors and standard PLC outputs should not be assumed to be safety rated. Components used in safety functions carry their own ratings and documentation, and these must be respected.
Stopping the motion
When the safety relay opens its outputs, something has to actually stop the machine. The method varies, and the standards describe categories of stop. At a general level:
- Some stops remove power immediately and let the machine coast or rely on a brake. This is simple but can be slow for high-inertia loads.
- Others bring the machine to a controlled stop first, using the drive to decelerate, and then remove power. This can be gentler on the machinery and is sometimes safer for the process.
A related feature on modern drives is a safe torque off function, which prevents the drive from supplying torque to the motor through certified internal circuits. Where a stop is done through a drive instead of a contactor, the details depend on the drive’s own safety documentation. Vertical loads and stored energy, such as pneumatic or hydraulic pressure and spring forces, need extra thought because removing power does not necessarily remove the hazard.
Where e-stops are placed
Common practice, again in general terms, is to place e-stops within easy reach at operator stations and at other points where a person might need to stop the machine, and to make them clearly visible. Some arrangements use pull-cord switches along a long conveyor. Which locations, how many and what they stop are decisions that follow the risk assessment for the machine and the relevant rules.
Testing and upkeep
Safety circuits are only useful if they keep working. Common upkeep ideas include periodic functional tests, inspection for damage or loose wiring, and checking that nobody has bypassed or jumpered a device. Changes, even small ones, should go through the plant’s management-of-change process and the verification the standards require. A bypassed safety device is a serious hazard, and defeating one is never an acceptable shortcut.
Maintenance on equipment with stop circuits should be done with the machine isolated using the plant’s lockout tagout procedure, because an e-stop is not an isolation device. It stops motion, but it does not make the machine safe to service. Training, such as electrical safety training, helps staff understand the difference.
How this fits with the rest of machine safety
An e-stop is one layer. Other layers include guards that physically block access, interlocks that stop motion when a door opens, safe speed limiting, and well-considered procedures. How these combine is covered in broader discussions of machine safety features and safety regulations, and in the standards themselves. When in doubt on a real machine, ask a qualified safety professional and consult the standards that apply to your location.