Emergency Stop Circuit

I understand why you would want to remove power from the drives. I do not do that, but that is a preference thing.

Why you want to remove power from vfd and not let Linuxcnc handle the estop I don't agree. e-stop will shut off your vfd and let it brake. And Linuxcnc will be at a known state. If you dont trust Linuxcnc to handle an estop and shut the spindle off, then whats the point? You will be resetting errors in Linuxcnc gui.
The safety switch is in alot of machines I work on but the controller handles the estop also. The safety switch does the same thing you can do with relays and inputs.

Just my 2 cents.

I have to agree with Begins, having two separate e-stops without being aware of each other is useless and will cause issues mentioned above.
On biger machines I wire the e-stop loop and limit switches in such a way that the signal has to pass through all the electronics also, so any issue with wiring or electronics will not slow the machine out of e-stop or will not allow clearing of limits. I'll try to put it as simple as possible :
E-stop switches and limit switches are all NC wired to a Mesa 7i70 that is in turn wired to 7i74 being controlled by 5i25 or 6i25 or 7i92, from here signal goes to 7i74 and to the outputs wired to 7i71. That way anything wrong in that chain will not allow the machine to run.

I think I may not be clear or maybe you are responding to some of the other posters here but I do not want to have two seperate loops by any means. In fact the whole original purpose of this post was trying to get some ideas to integrate LCNC control to my Estop circuit.

The idea would be that at power up the control would have power boot completely and once that was done would provide a ready signal to the estop circuit. At that point it would require pressing a machine ready button then latch the main contactor providing power to the drives.

In the case of a software related alarm LCNC would generate an "estop signal" (or w/e I want to call it) that would then open the circuit and kill the mains through the contactor to the drives.

In the case of a physical E Stop the NC switch would open, breaking the circuit dropping the contactor and main power. this would also generate an alarm on the contol. That alarm would prevent the machine from being able to power back on without clearing the alarm and pressing the machine ready.

Drives should have power when estop is reset not when the machine on button is pressed. (machine-is-on)

When machine is on button is pressed, the drives should then be enabled, either by mesa ena or by having a relay follow machine-is-on and that relay enabling and disabling the drives.
Estop will take card of turning machine off and disabling the drives and in the case of removing power from the drives the drives will drop out. But the drives should have power before machine-is-on.

My 2 cents,

I think that is really the question. Do you trust linuxcnc to be operational and thrusthworty of the e-stop?
Even when the display hangs for some reason and the program is running, it doesn't
react to the "program stop" button and the spindle is at top rev.
After some beers I concluded I don't trust linuxcnc for such a vital task. And my design follows from that.

It is just my take on it. Hopefully you get more confident in your way of acting after giving this a thought,
I don't intend to change your mind. After all I get to understand that real safety includes risk assessment,
risk mitigation and and a number of other things. And i haven't been there. I have just drawn up a solution
that suits my immediate thinking. Hmm, but I think I am happy with it. I just wanted to share and raise some thoughts.

My current standing is a combination of both. Allow the control to trigger it's software estop and then allow that to trigger the physical estop circuit or trigger the circuit directly via mechanical switches.

I won't soley rely on software because there are to many risks. If the software had some kind of glitch causing the machine to run away you will be thankfully to have an Estop circuit that drops drive power.

I think the biggest question now is do I allow for a sub second delay to allow the control to try and stop motion prior to dropping drive power?

And how do you implement that?