First off, I like to keep the "Safety" shutdown / reset functions separate from the control functions. Machine safety is an entire field of endeavor all by itself, tied directly to the machine type and operating systems and involves a lot of other complexities.
As to "Manual / Auto" functionality, it is a generally accepted practice to not allow automated restarting, say after a power failure, unless it is a totally unattended operation with no human interactions. So in your "auto" functionality, that requirement for a "Start/Run" command is going to be part of your programming of whatever automatic system is involved. In the "manual" mode however, it is considered best practice to have a separate manual "Start" input (button) so that if someone is there working on the machine, and power fails, they must again hit the Start button to re-initialize the machine.
This basic functional operating method is referred to as "3 wire control", as opposed to "2 wire control". In 3 wire control, a momentary Start button is pressed, the Start function has an auxiliary contact that seals in around that Start button that keeps it running, until a Stop button is pressed, or some other limit is reached (i.e. float switch, pressure switch, limit switch etc.), someone moves the selector switch to Off, or the power fails. In "2 wire control", you just have the selector switch, so when it is On it's On and if power fails, it comes BACK ON when the power does, leading to "unexpected" restarting of the machine. Again, that MIGHT be desired, for example in an unmanned pump station for example, but it's something that should only be implemented with careful thought.
Once you get into machine safety controls, it is
also going to end up being tied into this by default, in that if a Safety device causes a shutdown, resetting that Safety Device should also require a re-start command.
As a side note (and for what it's worth), I DO have a copy of NFPA-79 (machinery controls), here is what it has to say:
9.2.3 Operating Modes.
9.2.3.1 Each machine shall be permitted to have one or more
operating modes (e.g., automatic, manual, normal, and bypass)
determined by the type of machine and its application.
9.2.3.2 Where a hazardous condition results from mode selection,
inadvertent selection shall be prevented from occurring
(e.g., key-operated switch, access code). Mode selection
by itself shall not initiate machine operation. A separate action
by the operator shall be required.
9.2.3.3* Safeguarding means shall remain effective for all operating
modes.
NFPA-79 is a "voluntary" standard of course, unless a particular company or entity has adopted it.
