Emergency Stop

What is an emergency stop?

An emergency stop is a manually actuated safety function that lets anyone halt a machine or process as quickly as possible in an acute hazard, without creating new risks. The best-known form is the red mushroom-head button on a yellow background, but pull cords, foot pedals and bars can also serve as emergency stop devices. An emergency stop is a complementary protective measure: it is the last resort when guarding, interlocks and the normal control system fall short, and it never replaces them. It is one of the most visible elements of machine safety.

The Machinery Directive requires an emergency stop on almost every machine; the detail is set out in NEN-EN-ISO 13850 (the function) and IEC 60204-1 (the electrical implementation), while the required level of reliability follows from NEN-EN-ISO 13849 or IEC 62061.

🧠 How does an emergency stop work?

An emergency stop function always consists of a chain of three links. If one link fails, the whole function fails.

1. Actuator - the emergency stop button, pull cord or pedal. When pressed, the contact opens by direct opening action (positively driven contacts to IEC 60947-5-1 Annex K), so that even a welded contact is forced open mechanically. The actuator latches itself in the pressed position; the requirements for electrical emergency stop buttons with mechanical latching are in IEC 60947-5-5.
2. Logic - a safety relay or Safety PLC monitors the signal, usually on two channels, and detects faults such as a short circuit between channels or a relay that fails to drop out.
3. Output - two contactors in series, a variable frequency drive with safe torque off (STO, preceded by controlled braking via SS1 to IEC 61800-5-2 for stop category 1), or safety valves in pneumatics and hydraulics remove the energy from the hazardous motion.

What happens after the button is pressed matters just as much. The stop command stays active as long as the button is latched. Releasing it (by twisting or pulling) must not restart the machine; it only permits a new, deliberate start command.

📏 Which stop categories are allowed?

IEC 60204-1 defines three stop categories. Only categories 0 and 1 are allowed for an emergency stop; which of the two fits follows from the risk assessment to ISO 12100.

Category 1 sounds less immediate but is often safer: a heavy shaft left to coast can stay dangerous longer than one that is actively braked. An emergency stop must therefore end the hazardous motion as quickly as possible, not necessarily remove all power in one go.

⚖️ Which laws and standards apply to the emergency stop?

Under the directive, the emergency stop must be clearly identifiable, clearly visible and quickly accessible, and it must remain available in every operating mode. It overrides all other functions. ISO 13850 refers to ISO 13849-1 or IEC 62061 for the reliability level; in practice PL c (or SIL 1) is treated as the minimum, and machines with a risk of serious injury often end up at PL d. Machinery placed on the market before 20 January 2027 remains under the old directive.

🔄 What is the difference between emergency stop, emergency switching off and ESD?

These terms are often used interchangeably, but they protect against different hazards:

• Emergency stop - stops hazardous motion or a hazardous process. Stop category 0 or 1.
• Emergency switching off - disconnects the electrical supply to limit the risk of electric shock or fire. Always stop category 0; in building installations it belongs to NEN 1010 (the Dutch standard based on the IEC 60364 series).
• ESD (emergency shutdown) - brings a process plant to a safe state automatically or manually, usually via an SIS to IEC 61511. This is about closing valves and depressurising, not stopping a single machine.
• Normal stop - the regular stop button of the control system; not a safety function and never red-on-yellow.

🛠️ How do you design and maintain an emergency stop in practice?

1. Establish the need and stop category in the risk assessment. Record how long the machine takes to come to a standstill.
2. Determine the required PL or SIL and choose the architecture accordingly: dual-channel wiring, cross-fault detection and monitored contactors.
3. Place the buttons logically: at every operator station and wherever people intervene, unobstructed and preferably between 0.6 and 1.7 m above the floor. On long conveyors a pull cord is often more practical than individual buttons.
4. Link emergency stop circuits on integrated machinery: a production line with several modules needs clearly defined emergency stop zones, so that operators know what will stop.
5. Validate at commissioning with a functional test of each button, including a stopping-time measurement and a check that releasing does not restart.
6. Test periodically as set out in the manufacturer’s instructions and the risk assessment, and record the results.

A common mistake is using the emergency stop as energy isolation during maintenance. A pressed emergency stop is not a safe isolation: that is what Lock-out Tag-out and a work permit are for. Buttons on detachable or wireless operator panels also need attention: an inactive emergency stop must not be confused with a working one.

🔐 How does the emergency stop relate to networks and cybersecurity?

More and more emergency stop signals no longer run over a dedicated wire but over the network, using safety protocols such as PROFIsafe and CIP Safety. These protocols add counters, timeouts and checksums, so that a lost or corrupted message leads to a safe stop. That is the fail-safe principle: when in doubt, the machine goes to the safe state.

For IT/OT practice this means:

• The safe stop must not depend on IT - an emergency stop works locally, in the Safety PLC or safety relay, never via a server, the cloud or a SCADA screen.
• A button on an HMI touchscreen is not an emergency stop - it lacks direct opening action, mechanical latching and a demonstrated PL.
• Changes to safety logic are functional safety - manage them with passwords, version control and revalidation, in line with IEC 62443 and good security practice.
• The Machinery Regulation makes this explicit: from 2027 manufacturers must show that safety functions withstand deliberate tampering.

Bypassing or disabling an emergency stop is a serious violation: the Dutch Working Conditions Decree requires that safeguards cannot easily be circumvented, and the Netherlands Labour Authority can impose fines after an accident. Include emergency stop locations in the RI&E and in operator instructions.

🏭 Where do you find emergency stops in industry?

• Machines with moving parts - conveyors, presses, robots and cobots
• Control cabinets and operator panels - at every operator station, often next to the HMI panel
• Integrated production lines - with zone-based emergency stop circuits
• Process plants - as a manual trigger of an ESD in the control room or in the field
• Mobile units and technical rooms - at pumps, compressors and drives

❓ Frequently asked questions

Is an emergency stop mandatory on every machine?

Under the Machinery Directive almost every machine must have an emergency stop. Exceptions are machinery where an emergency stop would not lessen the risk, because it would not shorten the stopping time, and portable hand-held or hand-guided machinery. For employers in the Netherlands, the Working Conditions Decree requires an emergency stop where the hazards and stopping time of the work equipment make it necessary.

What colour must an emergency stop button be?

An emergency stop button has a red actuator on a yellow background, as ISO 13850 and IEC 60204-1 prescribe. That combination is reserved for emergency stops. A normal stop button, or an inactive button on a disconnected operator panel, must therefore not look like one.

May an emergency stop restart the machine when released?

No, releasing an emergency stop must never restart a machine. After twisting or pulling the button out, only a new start command is possible, which the operator gives deliberately. This prevents a machine from moving unexpectedly while someone is still in the danger zone.

Which Performance Level does an emergency stop need?

The required Performance Level of an emergency stop follows from the risk assessment to ISO 13849-1, or a SIL to IEC 62061. In practice PL c is the minimum, and machines with a risk of serious injury often end up at PL d. A type-C standard for the specific machine can require a higher level.

Can an emergency stop work over a network or wirelessly?

Yes, an emergency stop can work over a network using a certified safety protocol such as PROFIsafe or CIP Safety. These protocols monitor every message, so a broken connection or corrupted message leads to a safe stop. A software button on an ordinary HMI screen or a stop command via SCADA does not count as an emergency stop.

Is a pressed emergency stop enough to carry out maintenance safely?

No, a pressed emergency stop is not safe energy isolation for maintenance. Someone can release the button, and stored energy in pneumatics, hydraulics or springs remains present. For maintenance you use Lock-out Tag-out together with a work permit.

📌 In summary

An emergency stop is the last, manual safety function that stops hazardous motion as quickly as possible: red on yellow, self-latching, with no automatic restart and always available.

The emergency stop is mandatory under the Machinery Directive and soon the Machinery Regulation, detailed in ISO 13850 and IEC 60204-1, with a reliability you demonstrate via ISO 13849-1 or IEC 62061. It never replaces guarding, interlocks or energy isolation, and it always works locally and fail-safe, even when the signal runs over a network.