What is an emergency stop?
It is a safety function that allows a system to be shut down in a dangerous situation requiring a rapid response. Its purpose is to prevent or reduce consequences when action can be effective. A distinction must be made between the device that a person operates and the complete function, which includes the response of the control system and the elements that halt the process.
In machine safety, the need for and characteristics of safety measures are determined by the equipment and the risks involved. Not all situations are resolved in the same way, nor does every shutdown reduce the danger. The design must consider what happens after the shutdown command and prevent the stoppage from creating an additional, more dangerous situation.
Difference compared to a normal stop
Normal shutdowns are part of the equipment’s regular operation. Emergency shutdowns are for exceptional situations and must be easily identifiable and accessible for their intended purpose. Using emergency shutdowns routinely to address process deficiencies can mask underlying design or organizational problems that require different solutions.
Nor should the emergency response depend solely on someone detecting the hazard and reaching the device in time. Machine guards and other necessary preventive measures still serve their purpose. A visible mushroom-shaped device next to a hazardous area does not justify maintaining accessible access points that require technical protection.
Scope and response of the function
It is essential to know which parts of the equipment will shut down and which components can remain energized or in motion. In interconnected installations, the response of one machine can affect others and must be analyzed together. A device with an ambiguous range can create a false sense of security during an emergency.
Stopping times, residual movement, gravity, and stored energy must also be considered. Activating a device does not necessarily imply an instantaneous stop. The function is specified and technically validated, using criteria appropriate to the risk and the equipment. Modifying the control system or adding devices without this evaluation is not permitted.
Location, access and identification
Devices must be positioned so they can be located and operated when needed, taking into account workstations, routes, and planned operations. Simply checking their presence on the main panel is insufficient if a routine task is performed in another area. Accessibility must be maintained during use, avoiding obstructions from materials or changes in layout.
The device’s identification and characteristics must comply with applicable technical requirements. Training must ensure that its function and scope are understood. Colors, mechanisms, or safety guards that hinder the necessary response should not be improvised. Specific requirements are addressed through competent design and evaluation, not by general rules disconnected from the machine.
Resetting and prevention of unexpected starts
After an emergency, the situation must be assessed, the hazard resolved, and conditions verified before resuming operations. Releasing or rearming the device should not be interpreted as automatic authorization to return to work. The system must prevent hazardous startups, and the organization must define responsibilities for safe recovery.
Emergency shutdown does not replace lockout/tagout or other necessary isolation measures when working on equipment. Electrical, pneumatic, hydraulic, mechanical, or gravity-fed energy may still be present. The selection of the intervention procedure depends on these energy sources and the work to be performed.
Practical example
A person activates the emergency stop because they observe jammed material near a hazardous movement. The equipment stops the cycle, but the jam persists. Immediately entering to remove it, assuming the machine is isolated, could create a new exposure.
The organization must implement the established procedure for resolving the blockage, with trained personnel and energy controls in place where appropriate. Before resuming operations, it is verified that the situation is resolved and that no one remains exposed. This example illustrates the difference between stopping an emergency and preparing a safe intervention; they are related decisions, but not equivalent.
Defect detection and treatment
Equipment inspections must include the emergency function, with the appropriate scope and frequency. Checks should be planned to avoid creating hazards during testing. A visual inspection of the push button alone does not demonstrate that the entire system is functioning as intended.
Defects require a technical decision regarding the use of the equipment. They must be recorded, corrected, and verified before the function is considered restored. It is also advisable to investigate recurring activations: these may indicate operational problems, poor accessibility, or conditions that require repeated responses to uncontrolled hazards.
Regulatory framework and limits
Royal Decree 1215/1997 provides for emergency stop devices when necessary based on the risks and the normal stopping time. Their specific application must take into account the equipment, the activity, and the applicable technical regulations. The presence of the device alone does not guarantee the complete safety of a machine.
Effectiveness depends on design, integration, maintenance, training, and response organization. The general information in this sheet allows you to understand its function and limitations, but it does not replace the technical analysis necessary to select or validate a shutdown system for a specific piece of equipment.
