Why the robot controller refuses to come out of a safety stop
A safety stop that will not reset is different from a hard fault. The robot controller is often working exactly as designed: something in the safety chain is not satisfied, so the controller correctly refuses to enable motion. Treating this as "the controller has failed" leads to board swapping, and the fault returns the moment the machine runs again.
The reliable route is to treat the safety circuit as its own system — the e-stop buttons, guard interlocks, safety relay or safety PLC, the external device monitoring (EDM) feedback from the contactors, and finally the robot controller's safety input terminals. This guide sets out the symptom pattern, the plausible causes, and the checks you can make safely before calling anyone.
First, separate three different stop conditions
Before touching anything, confirm which kind of stop you are in, because they fail for different reasons:
- Emergency stop (ISO 13850) — latched, usually requires a deliberate manual reset at the device or a monitored reset button.
- Guard / protective stop — triggered by a door interlock or a safety-rated zone violation; often resets as soon as the guard closes and the reset is given.
- Protective stop from a safety configuration mismatch — the hardware chain looks closed but the controller reports a safety input or channel disagreement, which on many modern controllers is logged with a channel or handshake error rather than a plain stop.
Write down the exact message and code, the stop category shown, the time, and whether the fault happened on start-up or mid-cycle. This record is the single most useful thing you can hand to a service engineer later.
Plausible causes, in the order worth checking
1. A device in the chain is open, but not obviously so. A single e-stop button that has been pressed and not fully released, a mushroom head that has been knocked and re-seated without the contacts changing state, or a teach pendant e-stop left latched in its holder. Check every device on the chain, not just the one nearest the fault.
2. Channel disagreement on a dual-channel circuit. Safety functions on robot cells are typically wired as two channels with cross-monitoring. If one channel opens and the other does not — a worn contact, a loose terminal, a damaged cable in the dress pack, a connector half-seated after maintenance — the safety relay or safety PLC sees a discrepancy. The controller reports a fault and will not reset until the discrepancy is cleared. This is the classic "it works when we wiggle the cable" fault, and it should never be reset away.
3. EDM feedback from the output contactors. If the safety output drops but a contactor does not follow — welded contact, sticking armature, or a missing auxiliary contact — the monitoring loop blocks restart by design. A machine that resets once and then refuses on the second attempt is often an EDM problem rather than a button problem.
4. Reset and restart behaviour set up differently from what the operator expects. Manual monitored reset, automatic reset, and edge-triggered reset all behave differently. A missing reset pulse, or a reset button connected to the wrong input, looks exactly like a dead safety circuit.
5. Interface and mapping errors between the cell and the controller. Where the cell safety comes in over a safety network or a dedicated connector (dual-channel inputs on the controller's safety terminal block), a channel swapped during a service visit, a plug re-inserted into the wrong socket, or a configuration where the cell expects a handshake the controller is not sending will hold the robot in a safe stop indefinitely.
6. Supply and earth problems on the safety hardware. Safety relays and safety PLCs are sensitive to a sagging 24 V rail, a shared and noisy supply, or a poor reference to earth. Intermittent resets that only happen when a nearby welder, drive or large contactor operates point at supply quality rather than at a device.
Safe checks a competent person can make
The checks below are about observation and isolation, never about defeating a safety function.
- Read the diagnostic first. Controller safety logs, safety relay LEDs, and safety PLC diagnostics usually name the channel, the device or the discrepancy. This is a read-only step — do it before opening anything.
- Test each device's state individually. With the cell in a safe condition and following the site's isolation procedure, confirm each e-stop and interlock actually changes the state reported by the safety hardware — press, watch, release, watch again. Do not assume a device works because it looks right.
- Inspect the physical chain. Conductor damage in the dress pack, crushed cable at a cable carrier, corrosion in an outdoor or washdown connector, and terminals that move under a light pull. Loose terminals are far more common than failed safety relays.
- Verify the EDM loop separately. Confirm each monitored contactor drops out and that its auxiliary contact changes state. A contactor that is slow to drop or hums is a finding, not a nuisance.
- Record the exact conditions of a successful reset. If resetting works only with a certain door position or only after a delay, that is diagnostic information — write it down, including which device was last operated.
- Check supply quality before condemning hardware. Measure the 24 V rail at the safety device under load, and watch it while the cell does a normal cycle.
Absolute limits: never bypass, jumper, tape or "temporarily" bridge an interlock, an e-stop, or a safety output to get production running. Never change a safety configuration or force a safety input to clear a message. Never energise a robot cell area that may be occupied. Never rely on a single-channel reading to conclude a dual-channel circuit is healthy.
Decision points: what the evidence tells you
- One device consistently reports open while it is visibly closed — suspect that device, its contacts, or its wiring. Replace or repair to the original specification; do not substitute a non-safety-rated part.
- Channel A and channel B disagree only under movement or vibration — wiring or connector fault in the moving part of the installation. Route the fault by flexing cable runs under controlled conditions with the cell de-energised.
- Fault appears only after a maintenance visit — check the last work done: connectors, channel assignment, guard switch alignment, and whether a device was refitted with the wrong actuator.
- Fault appears only when another machine is running — supply quality, earthing, or electromagnetic disturbance. Escalate to an electrical engineer rather than replacing safety hardware.
- Chain is fully closed and healthy, but the controller still holds the stop — the issue is at the interface or in the safety configuration. This is where in-house diagnosis usually stops being productive.
When to stop and escalate
Stop and bring in a qualified machinery safety engineer or the robot integrator when any of the following is true:
- The fault involves a safety function whose required performance level you cannot confirm, or the wiring architecture on the drawing does not match what is installed.
- The safety configuration must be changed, or a safety input must be forced, to clear the message.
- The fault is intermittent, has recurred after two repair attempts, or has already been "reset away" once by production staff.
- The cell has been modified — new equipment, a relocated guard, a changed teach-mode arrangement — since the safety system was last validated.
- There is any doubt about whether the cell can be entered safely, or about which equipment on site a given e-stop actually stops.
Note that e-stop devices and interlocking devices carry their own standards (ISO 13850 and ISO 14119 respectively) separate from the performance-level calculation, and a changed safety function generally means re-validating and re-documenting it rather than only re-testing it. Keep your test records: who tested, when, which function, and the result.
Preventing the repeat
Most recurring safety-interlock faults trace back to the physical layer. Fit strain relief and inspect dress-pack cable at defined intervals, use enclosures and connectors suited to the coolant, swarf and washdown the cell actually sees, torque and re-check terminals at planned intervals, and log every safety reset with its cause. A reset that nobody recorded becomes an "unknown intermittent fault" six months later — and intermittent safety faults are exactly the ones that get bypassed under schedule pressure.
Related reading on this site: the lifecycle view of why robot controller faults can look like hardware failure when they are really support and spare-parts exposure.