An emergency stop (E-stop) is a manually initiated safety function that brings a robot or machine to a halt as quickly and safely as possible in order to avert or reduce harm to people, equipment or the work in progress. In robot safety, it is a mandatory complementary protective measure: it supports, but never replaces, safeguards such as fences, light curtains and speed and separation monitoring.
The function is defined by the machinery safety standard ISO 13850, the electrical requirements come from IEC 60204-1, and robot-specific rules are set by ISO 10218. Together they specify what the device looks like, which type of stop it triggers, how it is wired and how the robot may be restarted afterwards.
How an emergency stop works
Pressing the E-stop actuator opens normally closed contacts with direct opening action, meaning the contacts are forced apart mechanically even if they are welded. The open circuit is detected by a safety relay or safety controller, which removes the energy that causes hazardous motion. The device latches in the pressed position, so the stop command persists until a person deliberately releases it.
The function follows a fail-safe principle: a broken wire, a lost connector or a power failure produces the same result as pressing the button. In robot cells, the E-stop circuit is usually dual channel, with two independent contacts monitored for discrepancy, so a single fault cannot disable the function and is detected at the next demand or test.
The table summarizes the elements of a complete emergency stop function.
| Element | Requirement | Purpose |
|---|---|---|
| Actuator | Red palm or mushroom button on a yellow background | Instant recognition under stress |
| Contacts | Normally closed, direct opening action | Reliable opening even after contact welding |
| Latching | Stays engaged until manually released | Prevents an accidental restart |
| Logic | Safety relay or safety PLC, usually dual channel | Detects faults and executes the stop |
| Final elements | Contactors, Safe Torque Off, brakes | Remove or control the hazardous energy |
Stop categories for an emergency stop
IEC 60204-1 defines three stop categories, and an emergency stop must use category 0 or category 1. Category 2 keeps the drives energized at standstill and is therefore not permitted for an E-stop, although it is common for operational stops.
| Stop category | Behavior | Allowed for emergency stop | Robot consequence |
|---|---|---|---|
| Category 0 | Immediate removal of power, uncontrolled stop | Yes | Mechanical brakes stop the arm; the path may deviate |
| Category 1 | Controlled deceleration, then power removed | Yes | Arm stops on its path, then Safe Torque Off engages |
| Category 2 | Controlled stop, power remains applied | No | Used for operational and some protective stops |
Many modern robot controllers implement the E-stop as category 1, often realized as the drive function Safe Stop 1 followed by Safe Torque Off. A controlled stop keeps the tool on its programmed path, shortens the stopping distance of heavy arms and reduces brake wear. Category 0 remains the fallback if the controlled stop does not complete within its monitored time.
Emergency stop compared with other robot stops
Robot standards distinguish the emergency stop from the protective stop, which is triggered automatically by safeguards, and from the operational stop of normal production. Confusing them leads to poorly designed cells and to E-stop buttons used as routine off switches.
| Stop type | Initiated by | Reset | Typical use |
|---|---|---|---|
| Emergency stop | Person pressing a dedicated device | Manual release plus separate restart | Unexpected hazardous situations |
| Protective stop | Safeguard such as a light curtain or door switch | Can be automatic if the hazard zone is clear | Entry into the robot workspace |
| Operational stop | Program or operator command | Normal start command | End of a cycle, planned pauses |
| Enabling device release | Releasing or fully squeezing a three-position switch | Return to the middle position | Teaching and manual mode |
An E-stop is not a primary safeguard. It depends on a person noticing the danger and reaching the button in time, so the risk assessment must reduce hazards through design and guarding first and treat the E-stop as an additional layer.
Safety integrity and placement requirements
The emergency stop is a safety function whose reliability is rated under ISO 13849-1 or IEC 62061. For industrial robots, ISO 10218 has long set a default target of performance level d with category 3 architecture, roughly equivalent to SIL 2, unless the risk assessment justifies another value. Category 3 means a single fault does not cause loss of the function.
Placement matters as much as circuit design. Every teach pendant carries an E-stop, and additional devices are placed at each operator station and cell entry, within easy reach and without the need to lean over hazards. Mobile robots and automated guided vehicles usually carry buttons on several sides. A pendant that can be disconnected must be stored out of sight when detached so that an inactive button is never mistaken for a working one.
Robot manufacturers also publish stopping time and stopping distance for category 0 and category 1 stops, typically for the first three axes at different speeds and payloads. These figures feed the calculation of safety distances for other safeguards.
Common mistakes with emergency stops
- Using the E-stop as a normal off switch: frequent category 0 stops wear brakes and mask real emergencies.
- Software-only implementation: an E-stop read by a standard PLC input without safety-rated logic does not meet the required performance level.
- Series wiring of many buttons without diagnostics: fault masking can hide a failed contact until a real demand.
- Reset that restarts the robot: releasing the button must only allow a restart, never start motion by itself.
- Skipping periodic tests: E-stops that are never pressed can fail unnoticed, so functional tests at defined intervals are required.
The simple explanation
An emergency stop is the big red button that halts a robot when something goes wrong. Anyone nearby can hit it with the palm of a hand, and the robot stops moving at once.
The button stays pressed until someone pulls or twists it back. Even then, the robot does not start again on its own. A person must restart it deliberately. It is a last line of defense, not the main protection. Fences, sensors and careful design keep people safe first.
How it is used in practice
An automotive supplier runs a welding cell with two six-axis robots behind fences. The cell has four E-stop buttons: one on each teach pendant, one on the main operator panel and one at the maintenance door. All are wired dual channel to a safety PLC rated for PL d, which triggers a category 1 stop and then Safe Torque Off on both robot controllers.
During a changeover, an operator notices a clamping fixture that was not locked and presses the panel E-stop. Both robots decelerate on their paths and halt within the stopping distance documented by the manufacturer, the welding power is switched off and the fixture can be secured. After releasing the button, the operator must acknowledge a reset on the panel and then press start. A monthly test, in which each button is pressed and the safety PLC log is checked, confirms that every channel still opens correctly.