Emergency Stop and Safety Circuits: Why It Cannot Just Be a PLC Input

The rule

A standard PLC is not a safety device. An emergency stop must remove power to the hazard through hardware that does not depend on the program executing correctly.

If your answer to "how does the emergency stop work?" is "it goes into an input and the program stops the outputs", you have described a control function, not a safety function, and any competent interviewer will follow up.

Why the program cannot be trusted with it

A standard PLC can fail in ways that leave outputs energised:

• The processor can halt with outputs latched, depending on configuration.
• An output transistor or relay contact can fail short. A welded contact does not care what the program says.
• The program can be edited. Anybody with the software and the password can change the logic.
• A scan can hang. The watchdog catches it, but the failure state has to be safe by design, not by hope.

None of that is exotic. Welded contactor contacts in particular are an everyday failure.

What a safety relay does

A safety relay sits between the emergency stop devices and the contactor coils. It is built to fail safe, using redundancy and self-checking:

• Dual channel monitoring. The E-stop button has two independent normally closed contacts on separate circuits. The relay checks that both open together. One channel failing, or the two disagreeing, faults the relay.
• Cross-fault detection. If the two channels short to each other, the relay detects it, because a short would otherwise mask a genuine break.
• Forced-guided contacts. Mechanically linked contacts, so the state of one can be inferred from another. This is what makes the self-check meaningful.
• Manual reset. The circuit does not re-energise when the E-stop is released. Somebody must deliberately press reset. Automatic restart after a safety stop is a serious design fault.
• Feedback loop (EDM). The relay monitors the contactors' mirror contacts. If a contactor welds, the relay refuses to reset, which is exactly the failure the PLC could not catch.

The output of the safety relay breaks the contactor coil circuit directly. Power removal does not pass through the program.

Wiring conventions that are not optional

• E-stop contacts are normally closed. A cut wire must stop the machine. This is the same principle as the stop button in a seal-in circuit, and it is non-negotiable here.
• E-stop buttons are latching mushroom heads, twist or pull to release. They must stay in.
• They are red on yellow. This is standardised so that a person who has never seen the machine can find it.
• Multiple E-stops go in series, so any one stops everything in its zone.
• The PLC still gets a copy of the E-stop state, on a separate input, so it can display a message and manage the sequence. That input is for information, not for stopping.

When you need a safety PLC

A safety relay handles one or a few simple functions. Once a machine has many zones, muting, safe speed monitoring, or complex interlocking, discrete relays become unmanageable and you move to a safety PLC: a controller with a certified safety processor, dual-channel safety I/O, and a restricted, validated instruction set.

Safety programs are written, verified and documented differently from standard programs, and on many platforms they are password-protected separately with a checksum that changes if anything is altered.

Siemens, Rockwell, Pilz, Sick and others all make them. The concept transfers between vendors.

Terminology to know for interviews

You are not expected to be a safety engineer as a junior, but you are expected to know the vocabulary exists:

• Risk assessment first. The required safety level comes from assessing the hazard, not from a catalogue.
• Performance Level (PL a to e), from ISO 13849. The common European framework for machinery.
• Safety Integrity Level (SIL 1 to 4), from IEC 61508 and IEC 62061. More common in process industries.
• Category (B, 1, 2, 3, 4). Describes the architecture: single channel, redundancy, monitoring.
• Stop categories 0, 1 and 2, from IEC 60204-1. Category 0 is immediate removal of power. Category 1 is a controlled stop and then power removal. Category 2 keeps power on with the machine stopped.

The distinction between stop category 0 and 1 is worth understanding: on a machine with a large rotating mass, cutting power instantly can be more dangerous than a controlled ramp followed by isolation.

What to say when asked

If an interviewer asks how you would implement an emergency stop, the answer they want is roughly:

The E-stop function is hardwired, not programmed. Dual-channel NC contacts into a safety relay, which breaks the contactor coils directly, with manual reset and contactor feedback so a welded contact prevents reset. The PLC gets a copy of the state on a separate input for display and sequence handling only. The required architecture comes from a risk assessment, and for a machine with multiple zones you would use a safety PLC rather than discrete relays.

That answer tells them you understand the boundary between control and safety, which is the actual question.

Learn it around real equipment

Safety is one of the areas where reading is least sufficient. On the Automation Engineer Program safety circuits are wired and tested on real panels, including making a contactor fail and watching the relay refuse to reset.

Related: Control panel wiring standards, The seal-in circuit.