Emergency Stop¶
Interface — instantiates Fail-Safe Default
A user-accessible control that forces immediate stop or safe-state entry when continuation is hazardous.
An Emergency Stop is a deliberately conspicuous, human-actuated control — the palm-struck red mushroom button, the pull-cord strung along a conveyor, the pendant kill switch — that any person who can see the danger can hit to collapse a running machine into a stopped, de-energized state in a single motion. Its defining idea is that the trigger is a human decision, not a sensor: the mechanism adds no intelligence about when continuation is unsafe and instead guarantees that the instant a person judges it unsafe, one reachable action drives the whole hazardous operation to "off." To earn the name it must override every other control, latch in the tripped position so it cannot be nudged back by accident, and refuse to let motion resume until someone deliberately releases it and restarts. It is the archetype's manual, last-resort actuation path.
Example¶
On the floor of a sheet-metal shop, a 200-ton mechanical press is running a stamping run when an operator sees a coworker's glove snag on a blank as it feeds. There is no time to reason about tonnage or die position — she slaps the red mushroom button on the press frame. The button doesn't "ask" the controller to finish the cycle; it drops the main contactor and dumps the ram's stored motion through a brake, and it stays latched in so a bump won't re-energize the line. A backlit ring around the button and an amber beacon on the mast announce, to everyone in the bay, that this press is in an emergency-stopped state and not merely paused mid-program. Restarting is not one touch: the button must be twisted to unlatch, the fault acknowledged at the panel, and a separate two-hand start pressed before the ram will move. The whole sequence, from her palm hitting the button to a legible stopped-and-latched machine, is under a second — and none of it depended on a sensor noticing the glove.
How it works¶
- Single-action actuation. One deliberate motion (palm, pull, twist-to-off) triggers the stop; it must be operable without training, tools, or a menu.
- Priority over all other controls. The stop path is wired to override the normal controller — ideally by removing energy directly rather than routing a request through the logic that may itself have failed.
- Latching. The tripped position holds mechanically until deliberately cleared, so the safe state cannot silently lapse.
- Deliberate two-step reset. Release + a separate restart action, so clearing the stop can never be the same gesture that caused it.
Tuning parameters¶
- Reach density — how many actuators, how close to each hazard. More buttons shorten the reach time in an emergency but raise cost and nuisance-trip surface.
- Stop category — immediate power removal versus a controlled decelerating stop that keeps brakes powered. Immediate is safest for entanglement; controlled avoids secondary hazards like a dropped load or coasting mass.
- Latch and reset friction — how deliberate the release must be. Higher friction prevents casual re-energizing but slows legitimate restart.
- Zoning scope — whether one button stops a section or the whole line. Narrow zones preserve availability; wide zones remove ambiguity about what is still live.
When it helps, and when it misleads¶
Its strength is authority without dependence on correct sensing: it works precisely in the cases automated detection misses, because a human is the detector and the button is only the actuator. That makes it the archetype's floor — the thing that still works when everything cleverer has failed.
Its failure mode is symbolic safety: a stop that is out of reach, wired through the very controller that hangs, painted on but never tested, or so prone to nuisance trips that operators zip-tie it open. A classic misuse is treating the button as a routine production pause, which erodes the two-step reset discipline until an emergency stop and a coffee break look the same to the machine. The guarding discipline is reachability audits, periodic functional testing, and a hard-wired stop path independent of the normal control — the properties an emergency-stop function is expected to have under its governing safety standard.[1]
How it implements the components¶
Emergency Stop fills the manual-actuation slice of the archetype — the parts a human-triggered control can own:
safe_default_state— forces the de-energized, stopped state the moment it is struck.shutdown_or_isolation_rule— the press is the transition rule: a deliberate human action removes power and holds it removed.status_indicator— the latched button and beacon visibly announce that the machine is emergency-stopped, not merely idle.recovery_policy— the twist-release plus separate restart is the disciplined return path that prevents re-energizing by reflex.
It does NOT implement failure_detector — there is no automatic sensing here; a human notices and acts. Continuous-signal-loss detection is Dead-Man Switch's defining component.
Related¶
- Instantiates: Fail-Safe Default — Emergency Stop supplies the human-actuated, last-resort path into the safe state.
- Sibling mechanisms: Dead-Man Switch · Trip Switch or Circuit Trip · Automatic Shutdown · Fail-Closed or Fail-Open Design · Safe Mode · Watchdog Timer · Containment on Alarm
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Activating the control overrides normal operation, immediately removes energy or enters a defined safe state, latches there, and requires a separate deliberate restart.
Nearest alternative: Interface, Display & Cue — The accessible button, pull, or twist is the human affordance, but the operative mechanism is its priority runtime actuation of the safe state.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Machine-safety engineering cohered the conspicuous, latching, human-actuated emergency stop that overrides normal controls and forces a safe state.
Related originating lineages:
- Robotics & Automation — Industrial automation standardized emergency-stop circuits across controlled machinery and cells.
Review resolution: The current reviewers agree that engineering_design is primary. For the reported differences (alternate_origin_disagreement), the evidence supports single_lineage, multi_domain, and robotics_automation; these choices preserve materially formative origins without conflating later domain reach.
Review outcome: Reconciled after independent review; high confidence.
References¶
[1] ISO 13850 is the international standard for the emergency-stop function on machinery. It requires the stop to take priority over all other functions, to remain engaged until deliberately reset, and for that reset alone not to restart the machine — the design properties that separate a real emergency stop from a decorative red button. registry ↩