The E-Stop That Didn’t Actually Stop Anything
We tested the e-stop on a new machine. The operator pressed the big red button. The lights went out on the HMI. The pneumatic cylinders dropped. The servos de-energized. We nodded, signed off, and shipped it. Six weeks later the customer called: the e-stop stops the press, but the rotary indexer keeps spinning because its motor is on a separate contactor that the safety circuit doesn’t control.
We had designed the safety circuit for the obvious hazards — the press, the grippers — and missed the motor that kept moving when the e-stop was pressed. That’s what happens when safety circuit design for machine guarding is treated as “wire an e-stop to a relay” instead of a systematic analysis of every moving part and every energy source.
This article is how I now approach safety circuits — not as a checkbox exercise, but as a design that prevents real injuries.
Risk Assessment: The Starting Point Nobody Wants to Do
Every safety circuit starts with a risk assessment. Not a formality — a real walk through the machine, identifying every hazard and deciding what level of protection it needs. You can’t design a safety circuit without knowing what you’re protecting against.
What to Identify on the Risk Walk
- Pinch points: Where do moving parts meet fixed parts? (Gripper closing, press descending, indexer rotating)
- Crush points: Where does a heavy load move toward a fixed surface? (Vertical axis descending, slide extending)
- Shear points: Where do two edges move past each other? (Conveyor transfer, knife gate)
- Ejection hazards: What could fly out if a part jams? (Press, blow-off, high-speed motion)
- Energy sources: What moves when the e-stop is pressed? (Pneumatics, servos, motors, springs, gravity)
For each hazard, ask: what’s the severity (minor injury, serious injury, fatality)? What’s the frequency of exposure (operator in the area every cycle, occasionally, rarely)? What’s the possibility of avoidance (can they get out of the way)? The answers determine the required safety category — not a generic “use a safety relay.”
Safety Categories: What They Actually Mean
Safety circuits are rated by performance level (PL) per ISO 13849 or safety integrity level (SIL) per IEC 62061. For most custom machines, PL c through PL e covers the range.
| Category | What It Means | Where It’s Used |
|---|---|---|
| Category B (PL a) | Single channel, no monitoring. Fault causes loss of safety function. | Low-risk applications, not for e-stop |
| Category 1 (PL c) | Well-tested components, but single channel. No fault detection. | Simple guarding, low risk |
| Category 2 (PL d) | Single channel with monitoring. Fault detected at next cycle. | Moderate risk, intermittent access |
| Category 3 (PL d) | Dual channel. Single fault doesn’t cause loss of safety. Fault detected. | Most machine guarding, e-stop, door interlocks |
| Category 4 (PL e) | Dual channel, high reliability. Any single fault detected. Redundancy. | High-risk, frequent access, serious injury potential |
For a standard custom machine with an operator loading parts, Category 3 is the default. It’s what a safety relay (dual channel, monitored) provides. Category 4 is for applications where the consequences of a failure are severe — a press that could crush a hand, a robot cell where the operator is regularly inside the fence.
Practical default: Category 3 for almost everything. If the risk assessment says higher, go Category 4. If it says lower, still don’t go below Category 2 for e-stop. The cost difference between Category 3 and Category 4 is a few relays. The cost of an injury is not.
The E-Stop Circuit: More Than a Button
The e-stop is the most visible safety device, but the circuit behind it is what matters.
Dual Channel Wiring
A Category 3 e-stop has two channels through the button. The e-stop is a dual-contact button (normally closed, two contacts). Both channels go to the safety relay. If one channel fails (a wire breaks, a contact welds), the safety relay detects the discrepancy and drops out. A single-channel e-stop can’t detect a broken wire — the button might not work, and nobody knows until they press it.
What the Safety Relay Actually Does
A safety relay (or safety PLC) monitors the safety circuit. When the e-stop is pressed, both channels open. The relay de-energizes its output contacts. Those contacts drop power to:
- The motor contactor (controlling the main drive motors)
- The pneumatic soft-start valve (exhausting air, stopping cylinders)
- The servo drive enable (disabling servo power)
- The brake control (engaging holding brakes on vertical axes)
The relay also has monitored feedback contacts. If a contactor welds shut (the contacts don’t open when the relay drops out), the relay detects it and won’t reset. This is the fault detection that makes Category 3 work.
Reset: Manual, Automatic, or Monitored?
After an e-stop, the machine doesn’t restart on its own. Someone has to reset it. The reset should be:
- Manual: A physical button (HMI or physical) that the operator presses after the hazard is cleared.
- Not automatic: The machine doesn’t restart when the e-stop is released. This is critical — if it restarted automatically, the operator could be in the danger zone when it starts.
- Monitored start: The reset only works if all safety devices are clear (guards closed, e-stop released, light curtain clear).
Guard Interlocks: Every Door, Every Panel
Every removable guard panel has an interlock. The interlock is a switch that opens when the panel is removed. It’s wired into the safety circuit — opening the panel drops the safety relays the same way an e-stop does.
Interlock Types
| Interlock Type | How It Works | Where to Use |
|---|---|---|
| Safety switch (gate lock) | A physical switch with an actuator on the door. Opens when door opens. | Hinged doors, removable panels |
| Solenoid lock (guard locking) | The door stays locked until the machine is safe to enter. Unlocks only after motion stops. | High-risk stations, long stop times (spindles, heavy flywheels) |
| Non-contact RFID switch | No physical contact. Detects the door by RFID tag. More tamper-resistant. | Washdown areas, where physical switches wear out |
Key point: the interlock doesn’t just “tell the PLC the door is open.” It’s hard-wired into the safety circuit. A PLC input that says “door is open” is not a safety device — a PLC bug can override it. The safety relay directly removes power from the dangerous motion.
Light Curtains and Safety Scanners
For load/unload stations where the operator reaches into the machine, a light curtain is common. The curtain is a pair of transmitter/receiver bars across the opening. Breaking the beam triggers the safety circuit.
How to Mount and Configure
- Height: Mount the curtain at the height of the operator’s reach into the machine. A curtain at knee height doesn’t stop an arm reaching over it.
- Resolution: A 30 mm resolution curtain detects a hand. A 14 mm resolution detects a finger. Use 30 mm for body detection, 14 mm for finger pinch points. Higher resolution (finer beams) costs more and needs more precise mounting.
- Muting: If the machine needs to pass material through the curtain (conveyor through the light curtain), use muting sensors that bypass the curtain during normal material flow. The muting sensors must be arranged so they don’t bypass when a person reaches in.
What the E-Stop Actually Stops (And What It Doesn’t)
Back to the rotary indexer that kept spinning. The safety circuit needs to stop every hazardous motion, not just the obvious ones. Walk through the machine and list every energy source:
| Energy Source | What the E-Stop Does | Common Miss |
|---|---|---|
| Servo motors | Disable drive enable, engage brakes | Vertical axis without brake drops |
| Pneumatic cylinders | Soft-start valve exhausts air, pilot checks hold vertical loads | Vertical cylinders drop without pilot checks |
| Main drive motors (conveyors, indexers) | Contactor drops power | Separate contactor not wired to safety relay |
| Springs / gravity loads | Mechanical blocking or brake | Spring-loaded mechanism releases on air loss |
| Electrical panels | Control power drops, but high-voltage mains stays | E-stop doesn’t cut mains (that’s what the disconnect does) |
The e-stop doesn’t cut mains power. That’s what the main disconnect (a separate switch) does. The e-stop stops motion and removes power from the hazardous functions. The mains stays connected so the HMI, fans, and safety circuit itself stay alive. This is intentional — you need power to know what fault occurred after an e-stop.
Documentation: What the Customer Needs to See
A safety circuit isn’t complete without documentation. The customer’s safety officer will ask for:
- Risk assessment: The document that identified each hazard and the protection chosen.
- Safety circuit schematic: The wiring diagram showing the dual channels, safety relay, contactors, and interlocks.
- Performance level calculation: The PL calculation showing that the circuit achieves the required PL per ISO 13849.
- Test report: The documented test where each e-stop, interlock, and light curtain was pressed and verified to stop motion.
This isn’t bureaucracy. It’s the record that shows the machine was designed to the standard. Without it, the customer’s insurance carrier won’t approve the machine, and their safety officer won’t sign off.
A Safety Circuit Checklist
- Has a risk assessment been done for every hazard?
- Is the required performance level (PL c/d/e) identified for each function?
- Are e-stops dual-channel and wired to a safety relay?
- Does the safety relay drop power to ALL hazardous motions (not just the obvious ones)?
- Does the reset require manual action after all guards are clear?
- Does every removable guard panel have an interlock?
- Are vertical axes held by brakes or pilot checks on e-stop?
- Are light curtains (if used) mounted at the right height and resolution?
- Is there fault detection (welded contact monitoring, channel mismatch)?
- Is the safety circuit documented with schematic and PL calculation?
- Has the circuit been physically tested (press every e-stop, open every door)?
The Bottom Line
Industrial machinery safety circuit design isn’t about wiring an e-stop button. It’s about a dual-channel, monitored circuit that stops every hazardous motion when any safety device triggers. The machine that came back because the indexer kept spinning wasn’t unsafe because the e-stop was wired wrong — it was unsafe because we didn’t trace every energy source on the machine. Walk the machine, list every moving part, and wire the safety circuit to stop all of them. That’s the difference between a circuit that looks safe and one that actually is.
