Emergency stop requirements: IEC 60204
Industrial Control · Lesson 16 · Advanced
Purpose
Apply emergency stop as a risk-reduction function with deliberate stop category, latching, reset and restart behavior.
Learning objectives
- Read state and cross-references
- Separate standard control from safety functions
- Analyse faults and reset behavior
- Validate the complete input-logic-output path
Emergency stop is a complementary protective measure intended to avert or reduce an emerging hazard. It does not replace guards, normal stopping or energy isolation.
Core theory
Select stop category from the risk assessment: uncontrolled removal of power, controlled stop followed by power removal, or another permitted controlled strategy where justified.
The actuator must be readily identifiable/accessible, latch on actuation and require deliberate reset. Reset permits restart but must not itself command hazardous motion.
Define the hazard zone, every relevant energy/motion, span of control, output devices, fault detection and validation. An E-stop may leave electrical or stored energy present.
| Term | Meaning | Symbol | Unit |
|---|---|---|---|
| Emergency stop | Complementary manually initiated protective function | Not applicable | Not applicable |
| Stop category | Defined relationship between controlled stopping and removal of actuator power | Not applicable | Not applicable |
| Reset | Deliberate restoration of readiness, not a start command | Not applicable | Not applicable |
Assumptions: Symbols and terminal designations are defined by the supplied drawing set; Required safety performance comes from the machine risk assessment.
- Reset: The safety function may return to ready state.
- Restart rule: Reset alone must not cause hazardous motion.
- Action: Require a separate deliberate start and verify command-state logic.
The machine must remain stopped until a separate valid start action.
Reasonableness check: The conclusion is checked across normal, demand, fault, reset and restart states rather than inferred from one component label.
- Reading a contact in the energized instead of defined normal state
- Using an ordinary PLC bit as an unvalidated safety function
- Assuming emergency stop isolates every energy source
Where this appears in practice
Clear diagrams and validated safety functions let competent people build, test, diagnose and modify machinery without losing the intended protective behavior.
Knowledge check
Does operating an emergency stop prove the machine is electrically isolated?
No. Hazardous voltage and stored energy can remain; isolation is separate.
Answer: No. Hazardous voltage and stored energy can remain; isolation is separate.
Practical exercise
Write and validate an E-stop cause-effect test for each zone, output device, reset location and single-fault case.
Summary
- A diagram is a state model plus physical cross-reference
- Safety performance belongs to the complete function
- Stop, emergency stop and isolation are distinct
Sources and review
- IEC 60204-1:2016+AMD1:2021: Electrical equipment of machines: IEC; 6.1; International
- ISO 13849-1:2023: Safety-related parts of control systems: ISO; 2023; International
- IEC 62061:2021 with current amendments: Functional safety of machinery control systems: IEC; 2021; confirm current consolidated version; International
- IEC 61496-1:2020: Electro-sensitive protective equipment: IEC; 2020; International
- Electricity at Work Regulations 1989: UK Legislation; Current official text; Great Britain
Editorial review date: 2026-08-22. Professional electrical review is pending.