Editor’s Note: Since we first published this article on emergency-stop in March of 2009, it has become our most popular post of all time! We decided it was time for a little refresh. Enjoy, and please comment if you find the post helpful, or if you have any questions you’d like answered. DN Feb-2018.
The Emergency Stop function is one of those deceptively simple concepts that have managed to get very complicated over time. Not every machine needs or can benefit from an emergency stop. In some cases, it may lead to an unreasonable expectation of safety from the user. Some product-specific standards mandate the requirement for an emergency stop, such as CSA Z434-14 , where robot controllers are required to provide emergency stop functionality, and work cells integrating robots are also required to have emergency stop capability.
Defining Emergency Stop
Before we look at the emergency-stop function itself, we need to understand what the word “emergency” implies. This may seem obvious but bear with me for a minute. The word “emergency” has the root “emergent”, meaning “in the process of coming into being or becoming prominent” according to the Oxford Dictionary of English. An emergency condition is, therefore, some condition that is arising and becoming prominent at the moment. This condition implies that the situation is not something foreseen by the machine designer, and therefore there are no design features present to control the condition.
So what is the Emergency Stop function, or E-stop function, and when do you need to have one? Let’s look at a few definitions taken from CSA Z432-14 :
- Emergency situation
- an immediately hazardous situation that needs to be ended or averted quickly in order to prevent injury or damage.
- Emergency stop
- a function that is intended to avert harm or to reduce existing hazards to persons, machinery, or work in progress.
- Emergency stop button
- a red mushroom-headed button that, when activated, will immediately start the emergency stop sequence.
One more [2, 6.3.5]:
Complementary protective measures
Protective measures which are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use, could have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine.
An e-stop is a function that is intended for use in Emergency conditions to try to limit or avert harm to someone or something. It isn’t a safeguard but is considered to be a Complementary Protective Measure. Looking at emergency stop functions from the perspective of the Hierarchy of Controls, emergency stop functions fall into the same level as Personal Protective Equipment like safety glasses, safety boots, and hearing protection.
So far so good.
Is an Emergency Stop Function Required?
Depending on the regulations and the standards you choose to read, machinery may not be required to have an Emergency Stop. Quoting from [2, 126.96.36.199]:
Components and elements to achieve the emergency stop function
If following a risk assessment, a machine needs to be fitted with components and elements to achieve an emergency stop function for enabling actual or impending emergency situations to be averted, the following requirements apply:
- the actuators shall be clearly identifiable, clearly visible and readily accessible;
- the hazardous process shall be stopped as quickly as possible without creating additional hazards, but if this is not possible or the risk cannot be reduced, it should be questioned whether implementation of an emergency stop function is the best solution;
- the emergency stop control shall trigger or permit the triggering of certain safeguard movements where necessary.
Note For more detailed provisions, see ISO 13850.
I added the bold text in the previous quotation, because that statement, “If after a risk assessment…” is very important. Later in [2, 188.8.131.52]:
Each operator control station, including pendants, capable of initiating machine motion and/or automatic motion shall have an emergency stop function (see Clause 184.108.40.206), unless a risk assessment determines that the emergency stop function will not contribute to risk control.
Note: There could be situations where an e-stop does not contribute to risk control and alternatives could be considered in conjunction with a risk assessment.
The bolding in the text in the preceding paragraph was added for emphasis. I wanted to be sure that you caught this important bit of text. Not every machine requires an E-stop function. The function is only required where there is a benefit to the user unless a product-specific standard requires it. In some cases, product-specific standards often called “Type C” standards, include specific requirements for the provision of an emergency stop function. The requirement may include a minimum PLr or SILr, based on the opinion of the Technical Committee responsible for the standard and their knowledge of the particular type of machinery covered by their document.
Note: For more detailed provisions on the electrical design requirements, see CSA C22.2 #301, NFPA 79 or IEC 60204–1.
If you read Ontario’s Industrial Establishments Regulation (O. Reg. 851), you will find that proper identification of the emergency stop device(s) and location “within easy reach” of the operator are the only requirement. What does “properly identified” mean? In Canada, the USA and Internationally, a RED operator device on a YELLOW background, with or without any text on the background, is recognized as EMERGENCY STOP or EMERGENCY OFF, in the case of disconnecting switches or control switches. You may also see the IEC symbol for emergency stop used to identify these devices.
I’ve scattered some examples of different compliant and non-compliant e-stop devices through this article.
The EU Machinery Directive, 2006/42/EC, and Emergency Stop
Interestingly, the European Union has taken what looks like an opposing view of the need for emergency stop systems. Quoting from the Machinery Directive [3, Annex I, 220.127.116.11]:
18.104.22.168. Emergency stop
Machinery must be fitted with one or more emergency stop devices to enable actual or impending danger to be averted.
Notice the words “…actual or impending danger…” This harmonises with the definition of Complementary Protective Measures, in that they are intended to allow a user to “avert or limit harm” from a hazard. Clearly, the direction from the European perspective is that ALL machines need to have an emergency stop. Or do they? The same clause goes on to say:
The following exceptions apply:
- machinery in which an emergency stop device would not lessen the risk, either because it would not reduce the stopping time or because it would not enable the special measures required to deal with the risk to be taken,
- portable hand-held and/or hand-guided machinery.
From these two bullets it becomes clear that, just as in the Canadian and US regulations, machines only need emergency stops WHEN THEY CAN REDUCE THE RISK. This is hugely important and often overlooked. If the risks cannot be controlled effectively with an emergency stop, or if the risk would be increased or new risks would be introduced by the action of an e-stop system, then it should not be included in the design.
Carrying on with [3, 22.214.171.124]:
The device must:
- have clearly identifiable, clearly visible and quickly accessible control devices,
- stop the hazardous process as quickly as possible, without creating additional risks,
- where necessary, trigger or permit the triggering of certain safeguard movements.
Once again, this is consistent with the general requirements found in the Canadian and US regulations.  goes on to define the functionality of the system in more detail:
Once active operation of the emergency stop device has ceased following a stop command, that command must be sustained by engagement of the emergency stop device until that engagement is specifically overridden; it must not be possible to engage the device without triggering a stop command; it must be possible to disengage the device only by an appropriate operation, and disengaging the device must not restart the machinery but only permit restarting.
The emergency stop function must be available and operational at all times, regardless of the operating mode.
Emergency stop devices must be a back-up to other safeguarding measures and not a substitute for them.
The first sentence of the first paragraph above is the one that requires e-stop devices to latch in the activated position. The last part of that sentence is even more important: “…disengaging the device must not restart the machinery but only permit restarting.” That phrase requires that every emergency stop system has a second discrete action to reset the emergency stop system. Pulling out the e-stop button and having power come back immediately is not OK. Once that button has been reset, a second action, such as pushing a “POWER ON” or “RESET” button to restore control power is needed.
Point of Clarification: I had a question come from a reader asking if combining the E-stop function and the reset function was acceptable. It can be, but only if:
- The risk assessment for the machinery does not indicate any hazards that might preclude this approach; and
- The device is designed with the following characteristics:
- The device must latch in the activated position;
- The device must have a “neutral” position where the machine’s emergency stop system can be reset, or where the machine can be enabled to run;
- The reset position must be distinct from the previous two positions, and the device must spring-return to the neutral position.
The second sentence harmonizes with the requirements of the Canadian and US standards. The last sentence harmonizes with the idea of “Complementary Protective Measures” as described in .
How Many and Where?
Where? “Within easy reach”. Consider the locations where you EXPECT an operator to be. Besides the main control console, these could include feed hoppers, consumables feeders, finished goods exit points, etc. You get the idea. Anywhere you can reasonably expect an operator to be under normal circumstances is a reasonable place to put an e-stop device. “Easy Reach” I interpret as within the arm-span of an adult (presuming the equipment is not intended for use by children). The “easy reach” requirement translates to 500–600 mm either side of the centre line of most workstations.
How do you know if you need an emergency stop? Start with a stop/start analysis. Identify all the normal starting and stopping modes that you anticipate on the equipment. Consider all of the different operating modes that you are providing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the matching stop conditions in the same modes, and ensure that all start functions have a matching stop function.
Do a risk assessment. Risk assessment is a basic requirement in most jurisdictions today.
As you determine your risk control measures (following the Hierarchy of Controls), look at what risks you might control with an Emergency Stop. Remember that e-stops fall below safeguards in the hierarchy, so you must use a safeguarding technique if possible, you can’t just default down to an emergency stop. IF the e-stop can provide you with the additional risk reduction then use it, but first, reduce the risks in other ways.
The Stop Function and Functional Safety Requirements
Finally, once you determine the need for an emergency stop system, you need to consider the system’s functionality and controls architecture. NFPA 79  has been the reference standard for Canada and is the reference for the USA. In 2016, CSA introduced a new electrical standard for machinery, CSA C22.2 #301 . This standard is intended for certification of industrial machines. My opinion is that this standard has some significant issues. You can find very similar electrical requirements to this in  in IEC 60204–1  if you are working in an international market. EN 60204–1 applies to the EU market for industrial machines and is technically identical to .
Functional Stop Categories
NFPA 79 calls out three basic categories of stop functions. Note that these categories are NOT functional safety architectural categories, but are categories describing stopping functions. Reliability is not addressed in these sections. Quoting from the standard:
9.2.2 Stop Functions
Stop functions shall override related start functions. The reset of the stop functions shall not initiate any hazardous conditions. The three categories of stop functions shall be as follows:
(1) Category 0 is an uncontrolled stop by immediately removing power to the machine actuators.
(2) Category 1 is a controlled stop with power to the machine actuators available to achieve the stop then power is removed when the stop is achieved.
(3) Category 2 is a controlled stop with power left available to the machine actuators.
A bit later in the standard, we find:
126.96.36.199.1* Category 0, Category 1, and/or Category 2 stops shall be provided as determined by the risk assessment and the functional requirements of the machine. Category 0 and Category 1 stops shall be operational regardless of operating modes, and Category 0 shall take priority.
188.8.131.52.2 Where required, provisions to connect protective devices and interlocks shall be provided. Where applicable, the stop function shall signal the logic of the control system that such a condition exists.
You’ll also note that that pesky “risk assessment” pops up again in 184.108.40.206.1. You just can’t get away from it…
The functional stop categories are aligned with similar terms used with motor drives. You may want to read this article if your machinery uses a motor drive.
Once you know what functional category of stop you need, and what degree of risk reduction you are expecting from the emergency stop system, you can determine the functional safety requirements. In Canada, [2, 8.2.1] requires that all new equipment be designed to comply with ISO 13849 , , or IEC 62061 . This is a new requirement that was added to  to help bring Canadian machinery into harmonization with the International Standards.
Emergency stop functions are required to provide a minimum of ISO 13849–1, PLc, or IEC 62061 SIL1. If the risk assessment shows that greater reliability is required, the system can be designed to meet any higher reliability requirement that is suitable. Essentially, the greater the risk reduction required, the higher the degree of reliability required.
Extra points go to any reader who noticed that the ‘electrical hazard’ warning label immediately above the disconnect handle in Photo 5 above is
a) upside down, and
b) using a non-standard lighting flash.
Cheap hazard warning labels, like this one, are often as good as none at all. I’ll be writing more on hazard warnings in future posts. In case you are interested, here is the correct ISO electrical hazard label:
You can find these labels at Clarion Safety Systems.
Use of Emergency Stop as part of a Lockout Procedure or HECP
One last note: Emergency stop functions and the system that implement the functions (with the exception of emergency switching off devices, such as disconnect switches used for e-stop) CANNOT be used for energy isolation in an HECP — Hazardous Energy Control Procedure (which includes Lockout). Devices for this purpose must physically separate the energy source from the downstream components. See CSA Z460  for more on that subject.
 Industrial robots and robot systems (Adopted ISO 10218–1:2011, second edition, 2011-07-01, with Canadian deviations and ISO 10218–2:2011, first edition, 2011-07-01, with Canadian deviations). Canadian National Standard CAN/CSA Z434. 2014.
 Safeguarding of Machinery, CSA Standard Z432. 2016.
 Electrical Standard for Industrial Machinery. ANSI/NFPA Standard 79. 2015.
 Industrial electrical machinery. CSA Standard C22.2 NO. 301. 2016.
 Safety of machinery — Electrical Equipment of machines — Part 1: General requirements. IEC Standard 60204–1. 2016.
 Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design. ISO Standard 13849–1. 2015.
 Safety of machinery — Safety-related parts of control systems — Part 2: Validation. ISO Standard 13849–2. 2012.
 Safety of machinery — Functional safety of safety-related electrical, electronic and programmable electronic control systems. IEC Standard 62061+AMD1+AMD2. 2015.
 Safety of machinery—Emergency Stop—Principals for design. ISO Standard 13850. 2015.
 Control of hazardous energy—Lockout and other methods. CSA Standard Z460. 2013.