Someone wires the emergency-stop button into a PLC input, writes a rung that drops the output on signal, and calls it a safety circuit. It works, most of the time. Then the PLC locks up mid-scan, the watchdog resets the program, and during that 50 ms window the e-stop did nothing.
What a safety circuit has to do
An e-stop has to remove power from the dangerous motion, unconditionally, every time, even if the PLC crashes, loses power, or has a bug. That’s the whole requirement. It’s not a signal to the controller; it’s a direct control of the power circuit.
A PLC input that triggers a logic rung has three failure modes the wiring can’t protect against: the PLC stops scanning, the output relay welds shut, or the program has a logic error that overrides the stop. None of these are theoretical. They happen, and on a conveyor with people near moving rollers, they matter.
The right architecture
Run the e-stop button (and safety gate switches, and light curtain outputs) into a safety relay or a safety PLC. The safety relay directly cuts power to the motor contactor or the drive enable circuit. The standard PLC can read the safety relay status as an ordinary input for indication and sequence control, but it doesn’t control the stop.
This is redundant by design. The safety relay has two channels: pressing e-stop opens both channels, and the relay drops out even if one channel sticks. The contactor that powers the motor has a mechanically guided contact set, so if one contact welds, the other channel still opens. This redundancy is what gets you a Performance Level rating (PL d or PL e per ISO 13849) or a SIL rating (IEC 62061). A plain PLC input rung doesn’t get you any of that, no matter how well it’s written.
Chain vs. zone
A long conveyor line has e-stop stations every 20 meters. You can wire them all in series on one safety relay, or zone them so a stop at station 5 only kills the section around it.
Series wiring is simpler and cheaper, but hitting e-stop at the end of the line stops everything. That’s often fine for a short conveyor. On a long line with multiple operators, zoning is better: a jam at one workstation doesn’t stop the whole system. But zoning needs safety relays for each zone, interlocked so that if an upstream section stops, the downstream section stops too, or parts pile up.
Don’t zone based on what’s cheapest. Zone based on what a stop at each station should actually do. If an operator hits e-stop because they’re reaching into a nip point, that section needs to stop. The section 50 meters away doesn’t.
The reset is part of the circuit
After an e-stop, the machine shouldn’t restart when the button is released. It should require a deliberate reset: a pushbutton that the operator presses after confirming the area is clear. The safety relay handles this: it latches when the e-stop is pressed, and requires a manual reset to re-energize.
Programming this reset in the PLC is a common mistake. The PLC can re-scan after a fault and restart the line without a human confirming. A safety relay with a monitored reset circuit doesn’t. It stays latched until someone physically presses reset.
What the PLC is for
None of this means the PLC is useless. It should know the safety state: which e-stop was pressed, whether the guard is closed, whether the light curtain is clear. It uses that information to manage the normal sequence: hold the conveyor until the gate is closed, flash a beacon, log the event, and not restart the line automatically.
But the PLC reads the safety status over normal I/O. It doesn’t command the stop. The stop is hardwired. If the PLC disappears, the machine still stops when you hit e-stop.
Diagnose before you certify
Safety circuits have to be tested, not assumed. Every quarter, hit each e-stop and verify the right contactor drops and the right motion stops. Check that the reset requires a deliberate action. Measure the stop time. A safety relay that’s been in service for five years with no testing is a safety circuit that nobody has actually verified.
Document the circuit. The electrical drawing should show the safety chain separately from the control circuit, with the safety rating labeled. If the next technician can’t tell which wires are safety and which are signal, someone will rewire it wrong.
Bottom line
If your e-stop goes into a regular PLC input and drops an output rung, you have an indicator, not a safety circuit. Put the stop on a safety relay or safety PLC, wire it directly to the motor contactor, and let the standard PLC only read the state. It costs a few hundred dollars in relays and contacts. The alternative is explaining why the stop didn’t work.
