Emergency stop categories 0, 1 and 2

Every emergency stop button looks the same: red mushroom head, yellow background. What happens after the button is pressed is decided by the machine's risk assessment and expressed as a stop category - and the three categories are not three equally good options.

The three categories

IEC 60204-1 defines them:

• Category 0 - immediate removal of power to the machine actuators. Uncontrolled stop. Drives coast, brakes are whatever the mechanics provide.
• Category 1 - a controlled stop with power still available to the actuators, and power removed once the stop is complete. The drive brakes the motor, then the contactors open.
• Category 2 - a controlled stop with power left available. Used for normal operational stops, not for emergencies.

ISO 13850 restricts emergency stop functions to Category 0 or Category 1. Category 2 is explicitly excluded, because an emergency stop has to leave the machine in a de-energised state that someone can work on.

Choosing between 0 and 1

The risk assessment decides, but the practical question is what happens to the mechanics if power disappears mid-motion.

Category 0 is correct when:

• Stopping is inherently safe - the load is held by a brake that applies on power loss, or the motion is slow and low-energy.
• A controlled stop would take longer than the hazard allows.
• The machine has no stored energy that would release unpredictably.

Category 1 is correct when:

• Coasting down would damage the machine or the product - a spindle at 12,000 rpm, a web that would break, an axis that would drop.
• The drive can perform a controlled stop and signal when it has finished, and the safety circuit can wait for that signal before cutting power.

Category 1 needs more than a button: it needs a stop command to the drive, a confirmation that speed has reached zero, then a delay or a monitored signal before the contactors open. That logic lives in a safety relay or a safety PLC, not in the standard contactor circuit.

If switching the machine off stops it safely, Category 0 is the simpler and therefore the better circuit. Category 1 earns its extra hardware only where coasting is itself the hazard.

The button itself

Three mechanical details separate an emergency stop device from a normal pushbutton:

1. Direct opening action. The contact is forced apart by the actuator, not by spring pressure alone, to IEC 60947-5-1 Annex K. A welded contact cannot hold the circuit closed.
2. Latching. It stays latched when released - the button is held in, or it is a pull/twist release. It cannot spring back to the run position.
3. Manual reset. Resetting the button must not restart the machine. It only makes the circuit ready for a separate start command.

The colour code is mandatory: red actuator, yellow background. A red button on a plain background is ambiguous with a normal stop, and the distinction matters when someone is reaching for it without looking.

What the contacts are wired to

The classic mistake is wiring the emergency stop into a PLC input and letting the program stop the machine. That gives you a Category 2 stop with a software dependency, plus a single point of failure in the input card.

The correct arrangement is a hardwired circuit that removes power from the actuator supply independent of the control program:

• Single channel - acceptable only for very low risk; one contact, one relay, category B or 1.
• Dual channel with monitoring - two contacts, two paths, cross-monitored by a safety relay. This is what PL d and PL e circuits look like, and it is the default for anything with a person in reach of a moving part.
• With a safety switch on the guard - the emergency stop and the guard interlock usually share the same safety relay, and the relay's logic decides what each one stops.

The stopping category applies to the whole chain. A dual-channel Category 1 stop needs the drive to actually follow the stop command; if the drive ignores it, the circuit degrades to Category 0 by timeout, which may or may not be acceptable.

Reset and restart

Two rules that get violated on retrofits:

• Reset must be at the point of use, and the person resetting must be able to see the hazard area. A reset button inside a cabinet door is not a reset function, it is a maintenance action.
• Restart must be separate. After reset, the machine waits for a deliberate start command. An emergency stop that restarts on reset is a machine that starts itself when someone leans on the button.

Where the spare part hides

When replacing an emergency stop device, four things have to match:

• Contact configuration - usually 1 NC direct-opening, often plus a second NC for monitoring, or 1 NO for signalling.
• Release type - twist release, key release, or pull release. A plant standard usually picks one; mixing them creates confusion in an emergency.
• Mounting - 22 mm, 30 mm, or a complete station.
• Degree of protection - IP65 for washdown areas, IP69K for food.

The contact block is usually what fails, and on most families it is replaceable without changing the head - worth stocking on a machine with thirty stations. Category 0 or 1, never 2; hardwired, not software; latching, direct-opening contacts; a separate, deliberate restart.