The E-Stop That Didn’t Stop
We wired an e-stop button directly to a standard relay coil. When the e-stop was pressed, the relay dropped out and cut the motor. On the floor, the customer’s safety auditor flagged it. A single relay with a single e-stop contact isn’t a safety circuit. If the relay welds closed (contacts stick), pressing the e-stop does nothing — the motor keeps running. We replaced it with a dual-channel safety relay with forced-guided contacts. Two e-stop contacts in series, monitored by the safety relay. If one contact welds, the relay detects it and locks out. The auditor signed off. The mistake was using a standard relay where a safety-rated relay was required.
Safety circuit design for machine automation is about more than wiring an e-stop to a relay. The circuit must detect its own faults (welded contacts, broken wires) and fail safe. This article covers the basics.
Why a Standard Relay Isn’t Enough
A standard relay has contacts that open when the coil is de-energized. But contacts can weld (stick closed) from arcing. If the relay contacts weld, the e-stop does nothing — pressing it de-energizes the coil, but the contacts stay closed. The machine keeps running. That’s a single point of failure.
A safety relay (or safety PLC) uses dual channels and forced-guided contacts. It monitors itself. If a contact welds, the relay detects it on the next cycle and locks out. The machine can’t restart until the fault is fixed.
What a Safety Relay Does
A safety relay (or safety module) is a dedicated device for safety circuits. It:
- Monitors two channels (dual-channel wiring) — if one channel fails, the other still stops the machine.
- Has forced-guided contacts (mechanically linked) — if one contact welds, the others can’t close.
- Monitors the external device (e-stop, gate switch) — detects a broken wire or a short circuit.
- Provides manual or monitored reset — the machine doesn’t restart automatically after a safety event.
Common Safety Devices
| Device | What It Does | Where It Goes |
|---|---|---|
| E-stop button | Cuts power when pressed | Operator station, every side |
| Interlocked gate switch | Stops when gate opens | Fence gates, access doors |
| Light curtain | Stops when beam broken | Loading openings, hazard zones |
| Safety mat | Stops when stepped on | Walking-up hazard zones |
| Enable switch (3-position) | Runs only when middle position held | Teach mode, setup |
Dual-Channel Wiring: The Key Concept
Safety circuits use two channels (Channel 1 and Channel 2). Both must be healthy for the machine to run. If either channel fails (wire breaks, contact welds), the safety relay trips.
For an e-stop button with dual contacts (NC + NC):
- Channel 1: one NC contact of the e-stop, wired to S11/S12 on the safety relay.
- Channel 2: the other NC contact, wired to S21/S22.
- Both channels must be closed for the relay to energize its safety outputs.
- If the e-stop is pressed, both channels open, and the relay drops out.
- If one wire breaks (channel 1 open), the relay also drops out (it detects the mismatch between channels).
This is the fault detection: the relay compares the two channels. If they don’t match (one open, one closed), it’s a fault — lock out.
Safety Relay vs. Safety PLC
Safety Relay (Single Function)
A dedicated relay for one safety function (e-stop, gate, light curtain). Hardwired. Simple. For small machines with one or two safety devices.
Best for: Simple machines, 1–3 safety devices, low complexity.
Safety PLC (Programmable)
A safety PLC (or safety relay with multiple inputs) monitors multiple safety devices and logic. The safety logic is programmed (AND/OR between devices, time delays, muting). For complex cells with multiple gates, light curtains, and muting.
Best for: Complex cells, multiple safety zones, muting requirements, machines with several interlocked gates.
| Type | Flexibility | Cost | Best For |
|---|---|---|---|
| Safety relay (single) | Fixed (one function) | Low | E-stop only, simple machines |
| Safety relay (multi-input) | Limited logic | Medium | Several safety devices |
| Safety PLC | Programmable logic | High | Complex cells, muting, zones |
Safety Categories (ISO 13849)
The safety circuit’s performance is rated by a category (B, 1, 2, 3, 4) and a performance level (PL a–e). Higher categories require more redundancy and self-monitoring.
- Category B / PL b: Basic. Single channel, no fault detection. Not for serious hazards.
- Category 1 / PL c: Certified components, but single channel.
- Category 3 / PL d: Dual channel. A single fault doesn’t cause loss of safety. This is the minimum for most industrial machinery.
- Category 4 / PL e: Dual channel with continuous monitoring. A fault is detected before the next cycle. For the highest-risk machines (presses, robotics).
For most automation cells (robot cells, assembly machines), Category 3 / PL d is standard. This requires dual-channel wiring and a safety relay that detects faults.
The safety circuit rule: Any safety device (e-stop, gate, light curtain) must be wired to a safety relay (or safety PLC), not a standard relay. The safety relay must be dual-channel (Category 3 / PL d minimum). Single-channel wiring through a standard relay is a single point of failure. The auditor will flag it, and it’s a real safety hazard.
Reset (Monitor Start)
After a safety event (e-stop pressed, gate opened), the machine doesn’t restart automatically. It requires a manual reset.
- Manual reset button: The operator resets the safety relay after clearing the fault. Then presses start.
- Monitored start: The reset must be a deliberate action (button press), not automatic. The machine doesn’t restart on its own when the gate closes.
This prevents the machine from restarting unexpectedly when the operator is still in the hazard zone.
Stop Categories (0, 1, 2)
How the machine stops when the safety circuit trips:
- Stop Category 0: Immediate power removal (coast to stop). For e-stop. The motor power is cut instantly.
- Stop Category 1: Controlled stop (the motor ramps down), then power removal. For machines where coasting is dangerous (large inertias).
- Stop Category 2: Controlled stop, power maintained (the motor stays energized). Not a safety stop — for normal stops.
E-stop and gate opening typically use Stop Category 0 (immediate stop). The safety relay drops out and cuts the motor contactor. The motor coasts.
Wiring Best Practices
- Dual-channel wiring: Two separate wires from the safety device to the relay. Don’t use a single wire.
- Forced-guided contacts: Use safety-rated relays with mechanically linked contacts (IEC 60947-5-1). A standard relay doesn’t have this.
- Safety output contacts: The safety relay’s output contacts drop out the motor contactor or disable the drive. They’re in the safety circuit, not the PLC’s logic.
- Separate from control wiring: Safety wiring runs in its own conduit (or separated from signal wiring). Don’t mix safety and control wires.
- Label everything: Every safety wire is labeled (S11, S12, S21, S22). Troubleshooting safety circuits is hard without labels.
A Safety Circuit Checklist
- What safety devices? (E-stop, gates, light curtains?)
- What safety category? (PL d / Cat 3 minimum for machinery.)
- Is a safety relay or safety PLC used? (Not a standard relay.)
- Is the wiring dual-channel? (Two wires per device.)
- Does the relay detect a single fault? (Welded contact, broken wire?)
- Is there a monitored manual reset?
- What stop category? (0 for e-stop.)
- Are safety outputs (contactors, drives) disabled by the relay?
- Is safety wiring separated from control wiring?
- Are all safety wires labeled?
- Has the circuit been verified (test each safety device)?
- Is the safety file documented (risk assessment, circuit diagram)?
The Bottom Line
Safety circuit design isn’t wiring the e-stop to a relay. It’s dual-channel wiring through a safety relay with forced-guided contacts, Category 3 / PL d minimum, and a monitored reset. The e-stop that didn’t stop wasn’t broken — it was wired to a standard relay that could weld closed. Use a safety relay (or safety PLC), wire dual channels, and let the relay monitor itself. The safety circuit that passes the auditor and protects the operator wasn’t just an e-stop button — it was a circuit that detects its own faults.
