Dual-Channel E-Stop Circuit

An emergency-stop function must be designed from the machine risk assessment and applicable standards. Under ISO 13849-1, Category 3 and Category 4 describe architectural and diagnostic behavior; they are not interchangeable labels for PLd, PLe, or a particular SIL. The achieved Performance Level depends on category, component reliability, diagnostic coverage, common-cause measures, mission time, and validation of the complete safety function.

A common implementation uses an E-stop device with two direct-opening NC contacts wired to separate inputs. Opening either channel must initiate the stop. A compatible safety relay or safety PLC monitors the channels and, when configured for discrepancy detection, prevents reset after specified faults such as one contact failing to open. The device manual defines whether the inputs must change within a discrepancy time and how reset is permitted.

Some safety input modules use test pulses or other diagnostics to detect shorts between channels, to supply, or to 0 V. This behavior is product- and wiring-mode-specific: use the approved connection diagram and configure the input diagnostics for the actual device.

Releasing an E-stop must not by itself restart hazardous motion. Resetting the safety function and starting the machine are distinct actions, and their permitted implementation follows the risk assessment and applicable standards. Where manual reset is required, place it where the operator can check the danger zone and ensure a held or shorted reset signal cannot cause an unintended restart.

Multiple E-stops may be connected using an approved series or networked arrangement, but series wiring can reduce diagnostic coverage and mask faults when more than one device is operated. Validate the complete circuit, including the final switching elements and measured stopping time, against the required PL or SIL.