What this is
What is an emergency stop function?
What is an emergency stop function?
It is a complementary protective measure intended to avert or reduce harm once a hazardous event is under way. It is not a safeguard: it does not prevent access to a hazard and may not be relied on in place of guarding or interlocks. Under ISO 13850 it must be available at all times, override all other functions and modes, and not itself create a new hazard.
What is the difference between stop category 0 and stop category 1?
Stop category 0 removes power to the actuators immediately, an uncontrolled stop. Stop category 1 brings the machine to a controlled halt with power retained, then removes it. ISO 13850 permits either, and the choice belongs to the risk assessment. It matters here because Stop Time Seconds is only interpretable against the intended category.
What does latching mean on an emergency stop?
The actuator must stay engaged after it is released by the person operating it, holding the stop command until a deliberate manual reset. Releasing the actuator must not, on its own, restart the machine. A device that springs back and clears the command is not an emergency stop at all, and the two fields covering this are the ones most often assumed rather than tested.
Scope
When is an emergency stop test record required?
This record covers the emergency stop devices on one machine or line. It is a function and accessibility test, not an assessment of whether the machine's protective system is adequately designed.
Use this template when
- The test frequency set by the machine's risk assessment has fallen due
- A control system, drive or safety relay has been changed, replaced or reprogrammed
- A stop device has been added, moved, or removed during a layout change
- A stop has failed to operate in service, or has been reported as sticking or unresponsive
- A machine is being released back to production after a modification affecting stopping
Do not use it for
- Interlock Function Test, which proves a guard-opening stops motion and covers a safeguard rather than a complementary protective measure.
- Machine Risk Assessment, which decides what stop category and what test frequency this machine needs in the first place.
- Guarding Verification Checklist, which confirms fitted guards match the assessment and resist defeat.
- Conveyor and Transfer Safety Review, which covers the conveyor system whole, including loading, alignment and trapping points.
- LOTO Periodic Inspection, which audits energy isolation; an emergency stop is not an isolation device and must never be recorded as one.
Compliance mapping
Which ISO 13850 requirements does this satisfy?
ISO 13850:2015 sets requirements for the function, the actuator and the reset behaviour separately, and this record separates them the same way. Each row below maps a requirement to the section that evidences it.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 13850:2015 clause 4.1.1 | The emergency stop function shall be available and operational at all times and shall override all other functions and operating modes | Emergency stops |
| ISO 13850:2015 clause 4.1.4 | The stop shall be stop category 0 or stop category 1 as determined by the risk assessment | Emergency stops |
| ISO 13850:2015 clause 4.1.5 | Resetting the actuator shall not by itself restart the machine; a separate deliberate start is required | Emergency stops |
| ISO 13850:2015 clause 4.3.1 | Actuators shall be located so they are readily accessible and operable from every position where a hazard may arise | Emergency stops |
| ISO 13850:2015 clause 4.4 | Wire-rope actuators shall operate over the full run, with correct tension and detection of rope slack or breakage | Pull cord specific |
| ISO 12100:2010 clause 6.3 | Complementary protective measures shall be verified as effective and their limitations recorded | Result |
What it does not cover
- Isolation for maintenance, which requires a lockable energy-isolating device; an emergency stop stops motion but does not remove or lock out stored energy.
- Safeguard adequacy, which depends on guards and interlocks. A full pass here proves nothing about whether the machine can be reached into while running.
- Safety function performance level, which is a design-stage assessment of the control circuit's reliability and cannot be inferred from a working test.
- Stopping-time-based device positioning, which uses the measured stop time to calculate minimum distances for light curtains and mats, a calculation this record supplies input to but does not perform.
- Operator competence, which determines whether anyone actually uses the stop under pressure, and belongs in the training record for the machine.
Global
Emergency Stop Test Record requirements by country
The emergency stop is one of the few machine-safety requirements written into hard law in Europe and left to consensus standards in the United States. That difference decides what an inspector asks to see when a stop is found defective.
Directive 2006/42/EC, Annex I, 1.2.4.3, superseded by Regulation (EU) 2023/1230
A mandatory essential health and safety requirement on the machine as placed on the market, presumed satisfied by conformity with ISO 13850
A machine whose emergency stop no longer performs as designed is arguably no longer in the state it was CE-marked in. Where the failure followed a modification you made, the obligation for the modified assembly transfers to you as the person who created it.
Provision and Use of Work Equipment Regulations 1998, regulation 16
A duty on the employer, in use, to provide emergency stop controls where required by the risks and to keep them operating
The duty sits on the user rather than the manufacturer and runs continuously. A test record showing a device failed with no work order raised is direct evidence of a breach; the record you keep is the one read back to you.
NFPA 79 clause 10.7 and ANSI B11.19, enforced through OSH Act section 5(a)(1)
Consensus standards rather than a specific OSHA rule for emergency stops on general industry machinery
With no clause to cite directly, enforcement runs through the general duty clause and the standards are treated as evidence of recognised practice. That raises the value of a documented periodic test, because the argument turns on what a reasonable employer would have known.
How to complete it
How to complete an emergency stop test record, step by step
The pass and fail marks are easy. Four judgements sit behind them and decide whether the record means anything if the stop later fails in service.
Reachable From Work Position is judged from where a person actually stands during the task, not from the panel. Stand there, with the machine as it normally is, and reach. If it takes a step, a turn or moving a pallet, the honest answer is Partial or Fail. Reachable Within 600 Millimetres is the measured check that stops that judgement drifting between tests.
Stops All Hazardous Motion is not satisfied by the drive dropping out. Flywheels, unbraked rollers, hydraulic descent under gravity, augers coasting in product and downstream conveyors on separate circuits all continue after the command. Watch the machine to full rest before scoring, and time it to rest rather than to the moment the contactor opened.
The per-stop Result offers Pass with conditions between Pass and Fail, scored two against three. It is legitimate where the device works and a real limitation was recorded, such as a stop needing its background repainted. It is misuse where the device failed to stop hazardous motion. Anything touching function is Fail, and Fail blocks release.
Machine Released For Use is the field a regulator reads first, and it must be answerable independently of the score. A machine can score highly and still be unreleasable because one stop covering an operator position failed. Release is a judgement about exposure, not an arithmetic consequence of Score Percent.
What auditors find
Most common emergency stop test record findings
Six findings account for most of what these tests actually turn up.
| Finding | Clause | What fixes it |
|---|---|---|
| Reset restarts the machine, or the device does not latch at all | ISO 13850:2015 clause 4.1.5 | Fail the device and take the machine out of service. This is a control-circuit defect, not a backlog item; raise the work order against the conditional Work Order ID. |
| The stop is obstructed by stock, a trolley or a pallet at the time of test | ISO 13850:2015 clause 4.3.1 | Score Unobstructed as Fail. Recurrent obstruction at the same position is a layout problem, not a housekeeping one, and needs the stop relocated rather than a reminder issued. |
| Pull cord operates from one end of the conveyor but not the other | ISO 13850:2015 clause 4.4 | Fail Operates From Both Ends and check tension along the full run. Long cords sag mid-span and lose the travel needed to trip from the far end, which is where the trapped person is. |
| Stop tested with the machine empty, so stopping time under load was never observed | IEC 60204-1:2016 clause 10.7 | Retest with representative product loaded and record the value in Stop Time Seconds. Compare it with the previous record; a lengthening stop time is a brake wearing out. |
| Actuator is red but on a red or unpainted background, or the label has faded off | ISO 13850:2015 clause 4.3.2 | Score Clearly Identified And Coloured as Partial and raise the work order. It is minor until someone is hunting for the stop in three seconds on a largely red machine. |
| Result Band shows Pass while an individual stop in the repeat section scored Fail | ISO 12100:2010 clause 6.3 | Set Result Band from the worst per-device result and answer Machine Released For Use as No until the work order is closed and the device retested. |
Case in point
Case in point: the stop that worked and the drive that did not stop
A mixing line held twelve months of clean emergency stop test records. Every device latched, every reset behaved, every actuator was red on yellow, and Score Percent had not dropped below ninety-four. The tests were run on Sunday mornings with the vessel empty because that was when the line was free.
An operator hit the stop while clearing a build-up at the discharge. The drive dropped out on command and the loaded agitator coasted for nine seconds, pulling his glove in. Nothing on the record was false: the stop functioned exactly as tested. What had never been tested was the machine in the only state anyone would ever press it in. Stop Time Seconds was blank on all twelve records, and nobody had asked why.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- SAF-098
- Archetype
- Record
- Record ID
- EST-2026-000
- Scoring
- Pass or fail
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 13850
- Links
- Links Asset
- Tags
- Machine, Verification
- Sections
- 4
- Fields
- 40
- Follow up fields
- 4
- Repeating sections
- 1
- Links out
- 4
Header
10 fieldsTest ID*
Auto sequence. Format EST-2026-0000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Machine*
Asset ID*
Format AST-0000.
Links to FDN-002 Asset ID
Test Frequency*
Technician Qualified*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Emergency stops
Repeats14 fieldsStop Identifier*
Location*
Type*
Mushroom button, pull cord, trip bar or foot pedal.
Reachable From Work Position*
A working stop nobody can reach is no stop at all.
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Reachable Within 600 Millimetres*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Unobstructed*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Clearly Identified And Coloured*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Operates On Test*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Stops All Hazardous Motion*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Latches Until Reset*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Reset Does Not Restart Machine*
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Stop Time Seconds
Result*
- Pass3 pts
- Pass with conditions2 pts
- Fail0 pts
Work Order ID
Links to MNT-002 Work Order ID
Pull cord specific
3 fieldsPull Cords Present On Conveyors
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Cord Tension Correct Along Full Run
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Operates From Both Ends
- Pass2 pts
- Partial1 pt
- Fail0 pts
- N/Aexcluded from denominator
Result
13 fieldsItems Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Machine Released For Use*
- Yes3 pts
- No0 pts
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Next Test Due*
Technician*
Signature*
SAF-098 · record IDs look like EST-2026-000 · Links Asset
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
Testing a stop takes minutes. What slips is the interval, the failed device whose work order closed without a retest, and the control system change nobody connected to the stop function.
Keeps the device population against the asset, so a stop added or removed during a layout change shows up as a discrepancy at the next test rather than going untested for a year.
Ties the conditional Work Order ID to the failed device and holds the machine unreleased until the order is closed and a retest record exists against the same stop.
Holds the CAPA raised from a repeat failure and forces the root cause question when the same device fails across consecutive tests.
Schedules from Next Test Due, flags stop times drifting upward across records on one asset, and holds every write for your approval before it touches a record.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Glossary
Emergency Stop Test Record definitions and key terms
- Complementary protective measure
- A measure that reduces harm after a hazardous event has begun, rather than preventing access to the hazard. Emergency stops sit here; guards and interlocks do not.
- Stop category 0
- An uncontrolled stop by immediate removal of power to the machine actuators. Motion decays by friction and inertia alone.
- Stop category 1
- A controlled stop with power retained to achieve the halt, followed by removal of power once standstill is reached.
- Latching
- The actuator holds the stop command mechanically after release, until deliberately reset. Required of every emergency stop device.
- Wire-rope actuator
- The pull-cord device used along conveyors. It must trip on pull from any point of the run, and on rope breakage or slack.
FAQ
Frequently asked questions about emergency stop test record
How often should emergency stops be tested?+
At the frequency the machine's risk assessment sets, which the Test Frequency field records. Weekly is common on food conveyors with pull cords exposed to wash-down; quarterly to six-monthly is typical for panel-mounted stops in dry environments. What is not defensible is a frequency chosen for convenience with no assessment behind it.
Can an emergency stop be used to isolate a machine for cleaning?+
No. It stops motion; it does not isolate energy, cannot be locked in most designs, and leaves stored pneumatic, hydraulic and gravitational energy in place. Reaching into a hazard needs the lockout procedure, and this record is not evidence of isolation.
Does every operator position need its own stop?+
Every position where a person could be exposed to a hazard needs one within reach from that position. The template's 600 millimetre check is a practical proxy for readily accessible; a device requiring a step or a turn is scored Partial at best, because the point of the device is the second you do not have.
What if a machine has no pull cords?+
Leave the Pull cord specific section unanswered or mark it N/A. Those three fields are optional, and N/A items leave the denominator of Score Percent, so an unused section does not distort the result. Completeness Percent still reflects what was genuinely applicable.
Is a failed emergency stop always a stop-work situation?+
Where the failed device is the only stop covering an occupied position, or the failure is a reset that restarts the machine, yes. Where a redundant device on an unoccupied side has a faded label, no. Machine Released For Use carries that judgement, and it should be argued in the record rather than assumed.
Why does the template record stop time when ISO 13850 sets no limit?+
Because the trend is the finding. ISO 13850 does not specify a maximum, but a stop time that grows across successive records is a brake or a drive degrading, and it also feeds the safety-distance calculations for any presence-sensing device positioned against that machine.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Machine Safety
Lockout/Tagout Procedure (Machine Specific)
Sets out exactly how to isolate a specific machine, listing every energy source and isolation point
LOTO Periodic Inspection
Checks that a specific energy control procedure is being followed correctly in practice
Machine Risk Assessment
Assesses a machine across its whole life, including setup, running, cleaning, clearing jams and maintenance
Guarding Verification Checklist
Confirms that guards fitted to a machine match the risk assessment and cannot be easily defeated
Interlock Function Test
Tests that safety interlocks stop the machine when a guard is opened, and cannot be bypassed
Robot Cell Safety Assessment
Assesses an industrial or collaborative robot cell, covering reach, speed, force limits and how people enter the space
More in Machine Safety
Machine Risk Assessment
Assesses a machine across its whole life, including setup, running, cleaning, clearing jams and maintenance
Guarding Verification Checklist
Confirms that guards fitted to a machine match the risk assessment and cannot be easily defeated
Interlock Function Test
Tests that safety interlocks stop the machine when a guard is opened, and cannot be bypassed
Robot Cell Safety Assessment
Assesses an industrial or collaborative robot cell, covering reach, speed, force limits and how people enter the space
Pinch Point Survey
Walks a machine or line looking specifically for pinch, nip, shear and crush points
Machine Modification Review
Reviews a proposed change to a machine before it is made, covering guarding, controls and the tasks people will do afterwards
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 13850:2015 — Safety of machinery: emergency stop function, principles for design
- IEC 60204-1:2016 clause 10.7 — Electrical equipment of machines: emergency stop devices
- ISO 12100:2010 — Safety of machinery: general principles for design, risk assessment and risk reduction
- PUWER 1998 regulation 16 — Emergency stop controls
- Directive 2006/42/EC Annex I 1.2.4.3 — Emergency stop
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.