The Green Bank Telescope (admittedly a rather bigger robot than we deal with) has two big red emergency stop buttons: one is a "soft stop" that shuts down all motion as fast as possible without risking damage to the telescope, and a "hard stop" that just slams all the brakes on full. The latter is for use if, say, someone is about to be crushed or shoved off a hundred-meter drop. Expect damage to the instrument.
For our printers, we need to decide what "emergency" means. Their motion systems are (mostly?) too wimpy to damage people, and they have no sharp power tool attachments or blindingly bright lasers. So I'd say the biggest emergency is "there's a short causing a fire". A distant second would be no risk to life or limb but some potential damage to the machine (head crash, hot part of the machine sitting on a part not meant to be hot). But the real question is, once the emergency has been recognized, is additional motion safe? If the emergency has occurred because the effector is not where it is supposed to be, is there anywhere safe you can ask it to move?
The safest emergency stop for a printer would be to cut all power. So a circuit breaker on the mains input seems like the easiest, possibly with a big red mushroom to make it easier to hit in a hurry. This will shut down all sources of heat, even if (say) the bed heater MOSFET has failed shorted. I'd be inclined to make a smoke alarm trigger this kind of stop.
Second-safest would shut down only the "high-voltage" circuit, the parts that typically run on 12/24 V (or maybe mains, for the bed heater). This would leave the MCU up to record what happened, and if it has some kind of display (LCD, web interface, panel) it could show errors and allow a restart from software. I believe this is what the "emergency stop" on Marlin/RepRapDiscount LCDs does. It's also what the big red "Emergency Stop" button on the Duet's web interface does. Of course, while shutting the 12/24V circuit down kills the heat input to any potential fires, it means you can't move anything and your hot end fan shuts off too, so you could end up with a jammed hot end or a melted spot in your bed.
While printing, the "Pause" button stops printing and pulls the head away from the print, but leaves the heaters on. You can then cancel. This isn't much of an emergency stop, because if you're hitting it because the head has crashed into something, then who knows where the "get the head away" motion will take you; in my experience, probably crashing into the printer frame and dislodging the magballs. Plus it leaves all the heaters on, so if some weird thermal runaway has happened it'll keep happening. Nevertheless it sounds the closest to what you want. So: can you rig a physical button to, effectively, hit "pause"? Or to run a specified macro? I don't see why not. Easiest to hook it up to an unused endstop pin, and you might not even need to recompile the firmware - I think it supports "triggers" that activate particular bits of g-code.
As for what the macro should do, for my delta I'd go with
- "move the effector up a lot" (because that never shoots off into hyperspace), and
- shut off power (M81).
For an even gentler stop, you could ask the hot end to cool to (say) 140 C before shutting off the power, but unfortunately it can be awkward to interrupt such a wait-for-temperature if you want to actually do something immediately afterwards.
So the question is: how can you make an endstop trigger a macro?
(Also where do you get an appropriately serious-looking button? I should ask my father if he has any of those awesome old knife switches or Bakelite buttons lying around his radio room.)