power supply - Are normally open contactors virtually safe from failing closed?

Quick question: are normally-open contactors (which I assume are simply high breaking capacity relays) virtually safe from failing closed?

I want to cut off a 400V 3-phase supply using an emergency stop, and I have 2 options:

1. Use a 3-pole emergency stop, and wire the three phases to that button. I don't like the idea of 400V being so close to the user's hands.


2. Wire the contacts of a 3-pole normally-open contactor on the supply line, and wire the emergency stop on the 230V coil.

Three phase is used for heating, not for a giant chainsaw, but the emergency button should still do its job should it be pressed. So is option 2 commonly accepted, and safe enough for an end product? Any norms stating this on which I could rely?

Edit implementing the answer

I am quite keen on the idea of forcing the user to fix a failure in the redundant system, but I'm trying to limit the number of components as well. Is this a good comromise? I found this contactor, which has 1NC and 1NO auxiliary contacts that we can use.

Since the current in the coils is already very small compared to the switches capability, I made them single pole, if that is acceptable.

In particular, I'm not sure whether there is a possibility that the auxiliary contacts do not follow the main contacts (meaning the main contacts may fail closed or welded without the auxiliary contacts staying open when normally closed), could you confirm?

Answer

No, they are not safe from failing closed. No switch is, mechanical or solid-state.

Therefore, an E-STOP or other safety switch requires at least two overrated contacts that operate independently, so that one getting welded does not prevent the other from operating.

For your option #1, you would wire these in series, but it's not recommended because of the reason you stated and because there's no way to tell that one has failed until they both go.

For your option #2, you would wire these as part of two identical circuits, with all relevant safety switches wired in series, and the two channels wired in parallel and kept separate electrically. (no crossover wiring) Then each channel drives the coil of its own contactor, and the contactors are wired in series to control the load.

Also with option #2, you can now create a latching/lockout circuit using the two safety channels and the contactors' auxiliary contacts so that a separate button is required to turn it back on once the safeties are satisfied, and only if both have dropped out. This forces you to fix a stuck contactor before they both become stuck.

Per a comment, here's one possible version of option #2:

^{simulate this circuit – Schematic created using CircuitLab}

Or, if you have sufficiently deep pockets, you could buy a safety rated PLC and do all of this in software with even more fault-checking and detailed diagnostics.

Please note that I am in a different industry now, and so there may have been some legal changes since I left. Check the latest electric codes, OSHA regulations, etc., before trusting this (or anything else really) to an operator.