30% off your first 3 months

Get the deal

Emergency stops and safe robot design

by DuckyHelperNov 12, 20265 min read
Robotics

TL;DR:

  • An emergency stop (e-stop) removes motor power through hardware, so it still works when the software has crashed.

  • It is wired normally closed, so a broken wire or loose connector stops the robot instead of leaving it running.

  • An e-stop must be tested before every session, and the robot must not restart by itself when it is released.

A classroom robot is driving across a table toward the edge, and the program that controls it has frozen. Pressing a key does nothing. The only thing that helps now is a big red button that does not depend on the program at all.

Stop categories in plain words

Industrial electrical standards (IEC 60204-1) describe three kinds of stop. Category 0: remove power to the motors immediately, and the machine coasts or is held by brakes. Category 1: bring the machine to a controlled stop with power still available for braking, then remove power. Category 2: controlled stop, with power left on to hold position. Emergency stops use category 0 or 1.

Category 0 is the simplest and the most robust, because it does not rely on the motors or the controller doing anything. That is the one used for the classroom robot below. For a heavy arm, a controlled stop can be gentler on the mechanics, which is why category 1 exists.

Hardware versus software stops

A software stop is code that sets the motor commands to zero. It is useful and should be in every program, but it fails if the code hangs, a wire comes loose or a motor driver sticks on. A hardware stop breaks the electrical path that supplies the motors, so no program can keep them running.

A good design has both, plus a rule: the hardware e-stop is the one you trust. Software warnings, limits and slow-downs are extra layers around it.

Worked example: an e-stop on a classroom robot

The robot has two drive motors on a 12 V battery pack, a microcontroller on its own regulated supply, and a motor driver board. A red mushroom-head button with a normally closed (NC) contact is wired in the motor power line, between the battery and the motor driver.

  1. Battery positive goes through an inline fuse, then through the NC contact of the e-stop button, then to the motor driver's power input.

  2. Normal running: the contact is closed, current flows, and the driver can power the motors.

  3. Button pressed: the contact opens, the motor supply is broken, and the motors lose power whatever the program is doing. The button latches down, so it stays open until someone twists or pulls it back up.

  4. A broken wire or loose connector anywhere in this path also opens the circuit, so the robot stops. This is fail-safe behaviour. A normally open button would do the opposite: a broken wire would mean the button silently stops working.

Size the parts with numbers. If each motor draws up to 3 A when stalled, the two together draw 6 A, so the button's contacts and the fuse must be rated well above that: a 10 A fuse and a button rated for the load current at 12 V DC. A contact rated only for a small control signal would burn out. For bigger motors, the button is used to open a relay or contactor coil instead, and the relay's contacts carry the load.

Check the stopping distance with a test, then compare with a calculation. If the robot moves at 0.5 m/s and friction slows it by 0.5 m/s² once power is cut, it travels v² / (2a) = 0.25 / 1.0 = 0.25 m before stopping. A table edge less than 25 cm away is too close. Measure the actual coasting distance with a ruler and mark a keep-out margin larger than that.

Keep the microcontroller's own supply separate from the cut motor line, so the controller stays on and can log what happened and signal that the e-stop is active. It must also refuse to move until the e-stop is released and someone presses a deliberate start.

Testing

  1. Lift the wheels: Put the robot on blocks so the wheels spin freely, and keep fingers away from wheels and gears.

  2. Run at low speed: Command a slow forward drive and press the e-stop. The wheels must stop at once and stay stopped.

  3. Try to restart: With the button still pressed, command a drive. Nothing should move. Release the button: the robot should still wait for a deliberate start.

  4. Test the fault case: With power off, disconnect one wire of the e-stop path. Power up and confirm the robot cannot drive.

  5. Repeat before every session: Test at the start of each day or each time wiring or the battery changes. Write it on a checklist.

Batteries and wiring: Fuse the battery lead as close to the battery as you can. Do not leave a LiPo pack charging unattended, do not use a swollen or dented pack, and never use mains power for any part of a hobby robot. An e-stop stops motors, it does not make a damaged battery safe.

Where it goes wrong

  • Out of reach. An e-stop buried behind the robot is useless. It should be within reach of the person watching.

  • Stopping the controller only. Cutting the logic supply while motor power stays live can leave a driver stuck on.

  • Auto-restart. A robot that drives off the instant the button is released is dangerous.

  • Not used for normal stops. Pressing it at every run teaches people to ignore it and wears the contacts.

  • Stored energy. Springs, raised arms and spinning flywheels can still move after power is gone, so brakes or supports matter.

How real robots use it

Industrial and collaborative robots use certified safety relays or safety controllers, often with two redundant channels so one failure cannot defeat the stop. Their stop buttons are red on a yellow background by convention. How these stops fit with sensors that slow a robot near people is covered in collaborative robots and working safely near people. The microcontroller side is in microcontrollers vs single-board computers.

Try it yourself

On a battery-powered toy with a motor, wire a push-to-break switch in series with the battery and the motor. Add a fuse. Confirm that pressing the switch stops it, then deliberately loosen a connector and see that it stops too. Write a three-line checklist for testing it each time.

Frequently asked questions

Why a mushroom-head button?

It is large, easy to hit with a palm in a panic, and the latching action shows clearly that it has been pressed.

Is a power switch the same as an e-stop?

Not necessarily. An e-stop is designed to be quick to reach, obvious to use, latching and part of a tested stop circuit. A small rocker switch hidden on the body does not meet that.

Get started

DuckyHelper can
do more

It sees your screen and works in any app you use. Try it for 10 minutes, no card.

Get it for Mac, Windows or Linux

Share

Questions and jobs

Do anything

Ask it a question or hand it a job, in any app.

Doing jobs for you is in early access on Mac. Asking works on Mac, Windows and Linux.