EN ISO 13850: Emergency Stop Categories, Actuators, and Placement

EN ISO 13850 sets out the emergency stop requirements for machinery: it defines how the stop function must behave, what stop categories are permitted, and how the physical actuator must be designed so an operator can halt dangerous motion without hesitation. The standard treats the emergency stop as a supplementary protective measure, meaning it backs up primary safeguards such as guards and interlocks rather than replacing them.¹ Everything that follows flows from that framing.

What Machinery the Standard Covers

EN ISO 13850 applies broadly across industrial and manufacturing equipment, from CNC lathes and conveyors to packaging lines and robotic cells. Where a machine-specific (Type-C) standard exists, its more detailed instructions take precedence, but the principles in EN ISO 13850 still govern wherever that Type-C standard is silent.²

Two situations sit outside the scope. Hand-held or hand-operated machinery is excluded because releasing the controls already stops the tool. So is any machine where an emergency stop would not meaningfully reduce risk, including cases where a sudden halt would create a worse hazard than the one it addresses.¹

Which Stop Categories Are Allowed

Only two of the three stop categories defined in the wider machinery safety framework are permitted for emergency stop use. Category 2 is explicitly excluded.

Category 0: Immediate Power Removal

A Category 0 stop cuts power to the machine actuators immediately. Moving parts coast to a halt through friction or mechanical braking, with no electronic control over the deceleration. It is the simplest and most decisive option, often chosen for machines without sophisticated drive controls, or where instant power removal is the safest response. The tradeoff is that the stop is uncontrolled, so high-inertia components may take time to wind down.

Category 1: Controlled Stop Then Power Removal

A Category 1 stop keeps power available to the actuators just long enough to execute a controlled deceleration. The drive system actively brakes the moving parts to a standstill in a predictable manner, then disconnects power once the machine has fully stopped.¹ This is the right choice for heavy or high-speed equipment where yanking power abruptly could cause mechanical damage, tooling whiplash, or unpredictable movement. Once the machine reaches zero speed, power must be physically removed.

Why Category 2 Is Not Permitted

A Category 2 stop brings the machine to a controlled halt but leaves power applied to the actuators afterward. That conflicts with the purpose of an emergency stop: energized drives can resume motion due to a control fault, and the operator cannot be certain the hazard has been neutralized. Category 2 stops are fine for normal operational stops or processes where maintaining torque or vacuum matters, but they do not meet the bar for an emergency response.

Choosing between Category 0 and Category 1 is not a matter of preference. It requires a formal risk assessment under ISO 12100, which evaluates hazard severity, exposure frequency, and the machine’s mechanical characteristics.³

How the Emergency Stop Function Must Behave

The emergency stop must remain active in every operational mode of the machine, whether it is running at full production speed, in setup or adjustment mode, or cycling through an automated sequence. The core rule is that the emergency stop command takes absolute priority over all other control functions. When an operator hits the button, the control system executes the safety sequence immediately, regardless of what any programmable controller, operator interface, or automated routine is doing at that moment.²

The stop itself must not introduce new hazards. On a machine with suspended loads, for example, the safety circuit needs to account for the fact that cutting power could release the load. Electrical design typically relies on positive-break (direct-opening) contacts, where physical movement of the actuator mechanically forces the circuit open. That removes any dependence on electronic logic to complete the stop command. If a fault occurs anywhere in the safety circuit, the system must default to a safe condition, the principle often called “fail-safe” or “fail to stop.”

Actuator Design and Color

The physical actuator must be instantly recognizable and reachable without hesitation. The standard requires a red actuator on a yellow background, a combination chosen because it stands out against the typical grays and blues of industrial control panels.¹ The mushroom-head push button is the most common form. Pull-cords, sometimes called cable-operated switches, are used along conveyors and other elongated machines where a single button cannot provide adequate coverage.

Every actuator must include a self-latching mechanism. When the button is pressed or the cord is pulled, the device locks in the activated position and stays there until someone deliberately unlatches it, usually by twisting or pulling the mushroom head or using a key.² This prevents the safety command from being cleared inadvertently if the operator’s hand leaves the actuator during the emergency.

Resetting the actuator and restarting the machine must be two separate actions. Unlatching the button only re-arms the safety circuit. The machine must not restart until the operator issues a separate, intentional start command. That two-step sequence prevents the scenario where a maintenance worker resets an emergency stop and the equipment immediately lunges back into motion.

Span of Control and Placement

The “span of control” is the portion of a machine or production area that a given emergency stop device covers when activated. As a default, each device should cover the entire machine. On a standalone CNC mill, any emergency stop button on the machine shuts down all motion.

Large, interconnected systems complicate this. On a long production line where multiple machines are linked, stopping everything at once could itself create hazards or shut down sections nowhere near the problem. The span of control can then be divided so individual devices cover defined zones. When multiple spans exist, the standard imposes three rules:

Each zone and its associated devices must be clearly identified so operators know exactly what will stop when they hit a particular button.
Emergency stop devices with different spans of control should not be placed near each other, to prevent an operator from hitting the wrong one during a crisis.
Activating an emergency stop in one zone must not create additional dangers or interfere with triggering emergency stops in adjacent zones.

Placement must also ensure an operator can reach a device without passing through a hazard zone. A button on the far side of an exposed blade or moving conveyor defeats its purpose. On machines with long spans, pull-cords running the length of the equipment provide continuous access.

An Emergency Stop Is Not Lockout/Tagout

This distinction causes serious mistakes in practice. An emergency stop button is not a substitute for lockout/tagout during maintenance or servicing. OSHA’s control of hazardous energy standard is explicit: push buttons, selector switches, and other control circuit devices are not energy isolating devices.⁴ An energy isolating device must physically prevent the transmission or release of energy, such as a manually operated disconnect switch or circuit breaker.

The reasoning is practical. An emergency stop holds the machine in a stopped state through its control circuit, but a fault, a software glitch, or someone pressing the reset button could re-energize the drives. Before any maintenance worker enters a hazard zone, the machine must be isolated using lockout/tagout procedures, not merely stopped with the emergency stop button.⁴

How the Requirements Fit Together

Neither the stop category nor the safety architecture should be picked by guesswork. ISO 12100 provides the methodology for conducting a risk assessment that identifies hazards, estimates severity and likelihood, and determines the level of risk reduction needed.³ That assessment feeds directly into stop category selection and the required reliability of the safety circuit. ISO 13849-1 then specifies performance levels for safety-related parts of control systems. Emergency stop circuits typically need to reach a high performance level, often PLd or PLe depending on the risk assessment outcome, which in turn dictates the hardware architecture, component reliability, and diagnostic coverage.

For equipment sold in the European Economic Area, EN ISO 13850 is a harmonized standard under Machinery Directive 2006/42/EC, so applying it creates a presumption of conformity with the Directive’s essential health and safety requirements.⁵ The EU Machinery Regulation 2023/1230 replaces the Directive beginning January 20, 2027, so equipment designed in 2026 should already be tracked against the updated requirements.

1
International Organization for Standardization. ISO 13850 – Safety of Machinery Emergency Stop Function Principles for Design
2
International Organization for Standardization. ISO 13850 – Safety of Machinery Emergency Stop Function Principles for Design
3
International Organization for Standardization. ISO 12100 2010 – Safety of Machinery General Principles for Design Risk Assessment and Risk Reduction
4
Occupational Safety and Health Administration. The Control of Hazardous Energy Lockout Tagout
5
European Commission. Guide to Application of the Machinery Directive 2006 42 EC