How to configure safety relays and emergency stops in PLCs

What is an emergency stop and why a standard PLC is not enough

When an operator hits the red emergency button on an industrial machine, the goal is to immediately halt any hazardous movement. However, relying solely on a traditional Programmable Logic Controller (PLC) for this task is a massive risk. Standard PLCs run complex software, can freeze, suffer from electromagnetic interference, or experience internal transistor failures. In practice, this means that if the CPU crashes while executing an infinite loop, the software-based stop command might simply be ignored.

To bypass this limitation and comply with strict international safety standards, industrial engineering uses dedicated safety relays and redundant architectures. While the PLC manages day-to-day production logic—such as running conveyors and controlling cylinders—the safety circuit operates in parallel with dedicated hardware, duplicated wiring, and cross-checking. To better understand how to protect electrical systems from interference affecting these critical commands, it is worth checking out the article on how to shield linear power supplies from electromagnetic noise, ensuring clean signals on the factory floor.

How redundant safety relays work

The core of a reliable emergency stop system is the safety relay. Unlike a standard relay, it features multiple internal channels and mechanically linked contacts, meaning that if one internal contact welds shut due to a heavy electrical arc, the remaining contacts mechanically prevent the circuit from closing again. In practice, this redundancy means the system has two independent paths to cut power, commonly referred to as channel A and channel B.

Beyond duplicating pathways, the relay monitors the simultaneity of these channels. If the emergency button is pressed and contact A opens milliseconds before or after contact B beyond a pre-programmed time window, the relay interprets this as a wiring anomaly—such as a crushed cable or a short circuit—and permanently locks the system until a technician investigates. This level of vigilance turns hidden faults into controlled safe stops, avoiding operational tragedies.

Interlock logic and supervised manual reset

Another critical point in emergency stop configuration is preventing the machine from restarting on its own as soon as the red button is pulled back out. Imagine an operator bumping the button and then pulling it back; if the machine restarted instantly, it could crush someone still inside the danger zone adjusting a workpiece.

To prevent this, interlock logic requires an explicit and conscious restart command, known as a supervised reset button. The safety relay only allows power to return to the main contactors if it receives a transition pulse (open and close) on an auxiliary button after the emergency circuit is fully cleared. In practice, this requirement forces the operator to look at the machine, confirm the area is clear, and only then authorize the restart of the production cycle.

Integrating the safety circuit with the PLC without losing isolation

Although the emergency stop circuit must be hardwired (directly connected by copper wires and physical relays without relying on software to cut power), the PLC needs to know what is happening to log alarms on the operator interface (HMI) and gracefully ramp down frequency drives before cutting raw power, reducing mechanical wear.

To safely perform this integration, we use dry auxiliary contacts from the safety relays connected to isolated digital inputs on the PLC. Thus, the PLC only reads the status of the safety system but never has the power to bypass or disable the safety hardware. When complex communication or field sensor failures occur that affect general control, precise diagnostics help isolate the problem quickly, a topic covered in depth in the guide on how to diagnose CAN bus faults with an oscilloscope.

Final considerations on compliance and periodic testing

Implementing emergency stops with redundant relays is not just a matter of following bureaucratic regulations, but of building a culture of respect for human life in the industrial environment. Current standards require these systems to be periodically validated through practical tests, simulating cable faults and verifying whether the system response time complies with safety distance calculations so the operator cannot reach moving parts before a total standstill.

Keeping electrical schematic documentation up to date and training the maintenance team never to use illegal jumpers on safety relays is the only way to sustain a modern, efficient, and above all, safe industrial operation for all workers involved in the production process.