Archive for March, 2009

ESA Manufacturer Registration in Ontario, Canada

Monday, March 16th, 2009

Electrical Safety Authority LogoSince February 17th,  there has been an interesting discussion thread on the PSES‘s EMC-PSTC list on the new Manufacturer’s Registry in the Province of Ontario, Canada. Since there was so much interest, I decided to try to summarize things here.

Background

Ontario is the second oldest and the most populous Province in Canada, with 12,160,282 people as of the 2006 census. Canada has 10 Provinces and three Territories. Ontario is Canada’s manufacturing heartland and is often a leader in new legislation.

ESA, or the Electrical Safety Authority as they are more properly known, is the Authority Having Jurisdiction (AHJ) in the Province of Ontario, Canada. This means that they are authorized by the Government of Ontario to regulate electrical safety in the Province. ESA was formerly the inspection arm of Ontario Hydro, a crown corporation that was dissolved in 1998. ESA provides building and equipment electrical inspection services to the general public and industry in the Province, and publishes the Ontario Electrical Code. The Code is adapted directly from CSA’s Canadian Electrical Code – Part 1 (CSA C22.1), with Provincial deviations.

On 1-Aug-07, the Ministry of Small Business and Consumer Services filed Ontario Regulation 438/07, Product Safety. This new regulation enables the Electrical Safety Authority to address the safety of electrical products and equipment sold and used in Ontario.

The regulation was phased in to ensure that ESA and stakeholders had sufficient time to develop technical guidelines to support the regulation.

  • On 1-Oct-07 the sections of the regulation that govern approval of electrical products (currently contained in the Ontario Electrical Safety Code) and that allow notice be given to the public of unsafe electrical products came into effect.
  • On 1-Jan-08 other sections relating to ESA’s investigative and order-making powers will came into effect.
  • On 1-Jul-08 sections of the regulation requiring organizations to report serious electrical incidents or defects came into effect.
  • On 1-Apr-09 the Registry will open and manufacturers can begin to register with ESA. For manufacturers currently selling products in Ontario, registrations must be completed by 30-Aug-09. If your company wants to begin selling porducts in Ontario, the company must register before products can be sold.

What is the Registry?

Recent Changes in the Ontario Electricity Act have increased the requirements for reporting of “serious incidents” with electrical origins. These requirements are found in Ontario Regulation 438 on Product Safety. In the past, significant numbers of injuries caused by either unapproved equipment, or fraudulently marked equipment have occurred. When ESA has investigated the equipment, they run into problems with finding the originator of the gear, and therefore the person or company who bears responsibility for the problem. The new additions to the regulation address this by requiring reporting of severe injuries caused by electrical equipment. In order to improve traceability of electrical products sold in Ontario, ESA introduced the Manufacturer’s Registry, and made it mandatory under their authority as the AHJ in Ontario. Registration begins 1-Apr-09. Registration must be completed by 30-Aug-09. A fee of $350 Canadian dollars must be paid in the first year, with a reduced fee in each following year.

Manufacturers of electrical equipment for sale in Ontario are required to register with ESA, regardless of whether they are located in Ontario or elsewhere. Failure to register will mean that certified or labeled electrical products will be deemed to be unapproved and non-compliant with the Ontario Electrical Code. Under Regulation 438, it is illegal to sell, display or use unapproved electrical products [Section 5]. Under the Industrial Establishments regulations (part of the Ontario Occupational Health and Safety Act), it is illegal to use unapproved electrical products in the workplace [Section 40]. Similar requirements are also found in the Construction Regulations (Ontario Regulation 213, Section 185).

More information on the Registry can be found on the ESA web site in the Product Safety area. There are a number of FAQ’s available from this page as well. They include:

The registration is per manufacturer and not per product, so once you have registered your company you do not need to re-register for every product.

Recognized electrical safety marks

ESA provides a list of all of the Certification and Inspection marks that are recognized in the province. As long as your product or the products yopu are selling bear one of these marks, the product can be displayed, sold or used in the Province, presuming the manufacturer is registered.

View the list of Recognized Marks and Field Evaluation Labels.

What is a ‘serious incident’?

Regulation 438 defines a serious incident in Section 1:

“serious electrical incident or accident” means an electrical incident or accident that,

(a) results in death or serious injury to a person,

(b) has the potential to cause death or a risk of serious injury to a person, or

(c) causes or has the potential to cause substantial property damage.

Reporting Requirements

Once your company has registered with ESA, any serious incidents occurring anywhere you market your products becomes reportable, but only for products sold in Ontario.

Quoting from Regulation 438:

8. (1)  A manufacturer, wholesaler, importer, product distributor or retailer that becomes aware of a serious electrical incident or accident or a defect in the design, construction or functioning of an electrical product or device that affects or is likely to affect the safety of any person or cause damage to property, shall report to the Authority as soon as practicable after becoming aware of the serious electrical incident or accident or defect.

(2)  A certification body or field evaluation agency that becomes aware of a serious electrical incident or accident or a defect in the design, construction or functioning of an electrical product or device that was the subject of a report given by the certification body or field evaluation agency that affects or is likely to affect the safety of any person or cause damage to property shall report to the Authority as soon as practicable after becoming aware of the serious electrical incident or accident or defect.

There is more to Section 8 of the regulation than quoted. Additional subsections include information on what needs to be in the report and who needs to be involved in the investigation. If you need to make a report, check the rest of Section 8 first.

For example, say that your company manufactures a widget, Model 1523. Model 1523 is sold in the USA, Ontario Canada, Mexico and India. The company also manufactures a different widget, Model 2000, sold in the USA and Mexico.

At some point, reports of electrical shock and fires caused by Model 2000 start to come into your Product Safety department. Do you need to report this to ESA? NO – Model 2000 is not sold in Ontario, so severe incidents caused by that model do not require reporting to ESA.

Model 1523 has a clean record, so no reporting is required there. After manufacturing Model 1523 for a few years, a key component is changed for a cost reduced version from a different supplier. Six months after the change, reports come in from Mexico and India that users have been killed by electric shock received from units of Model 1523. After investigating the reports, your Product Safety department determines that the faulty units used the new component. Do you need to report this to ESA? YES – because Model 1523 is sold in Ontario.

Here’s another example. Your company imports electrical products from a number of countries and sells them wholesale to large retailers, some of whom have stores in Ontario. Do you need to register? NO – But you cannot legally sell products from manufacturers who are not registered in Ontario.

What if the products are imported into Ontario but are not sold to users in the Province, and are only warehoused and wholesaled to retailers or other distributors outside of Ontario? Do you need to register? NO – But you must comply with the requirements in the other jurisdictions where the product is sold. Check with the AHJ in each Province or Territory where your products are sold to determine the requirements.

What if I become aware of serious incidents that are occurring with products I sell in Ontario? You MUST report them to ESA, whether you make the product, import, distribute or retail it.

What Products are Covered by the Regulations?

  • Consumer electrical products;
  • Commercial electrical products;
  • Electrical Medical Devices;
  • Industrial electrical products;
  • Wiring devices and products;
  • Battery-operated devices used in Hazardous Locations;
  • Battery chargers used with battery operated products;
  • Hardwired and plug-in life safety products like Smoke Detectors and CO Detectors;
  • Certified components used in any of the above.

Will this become a Canadian National System?

This is not yet known. There are discussions going on with the other Provinces and Territories, however these are very preliminary stages. ESA has stated that they are supportive of a National Program should it be developed, but at this time these requirements exist only in Ontario.

Tax Grab?

Some people have expressed the opinion that this is simply a way to mask a new tax, since registration fees are payable on an annual basis. In fact, a means is required to fund the registry, and the fees collected are to be used for that purpose. See the Funding Model Report. Since ESA’s mandate is to protect the people of Ontario from electrical hazards, and since there are increasing numbers of serious incidents occurring where the products turn out be be unapproved or fraudulently marked, this is a reasonable way for the Authority to gain control over the products entering the marketplace, and to hold everyone in the supply chain responsible for ensuring that only approved products are sold in the Province.

Since there is no new marking requirement, and since reputable manufacturers are already certifying or labeling their products for sale, and furthermore since the registration fee is quite small for any organization selling any quantity of product in the Province, this is not an onerous requirement. You are still free to have any SCC accredited body whose mark is recognized in Ontario do the certification work.

Will it work?

This is the big unknown. Canadians are known for creating registries in response to a perceived need to control something. Notable failures include: The National Handgun Registry, which has succeeded in registering guns owned legally but has done nothing to control handgun violence, the original intent; The National Do Not Call registry was supposed to allow Canadians to register their phone numbers with the government, who was then requiring Canadian based telemarketers to scrub those numbers from their calling databases. Unfortunately this only provided numbers to off-shore telemarketers who are using the DNC Registry lists as a way to get numbers to call.

It’s unfair to group this registry with the ones in the previous examples for a number of reasons. The implementation of this registry is different from the previous examples in intent and execution. Compliance is monitored by the entire supply chain. It probably stands a pretty good chance of working. Time will tell!

Emergency Stop – What’s so confusing about that?

Friday, March 6th, 2009
This entry is part 1 of 4 in the series Emergency Stop

I get a lot of calls and emails asking about emergency stops. This is one of those deceptively simple concepts that has managed to get very complicated over time. Not every machine needs or can benefit from an emergency stop. In some cases, it may lead to an unreasonable expectation of safety from the user, which can lead to injury if they don’t understand the hazards involved. Some product-specific standards mandate the requirement for emergency stop, such as CSA Z434-03, where robot controllers are required to provide emergency stop functionality and work cells integrating robots are also required to have emergency stop capability.

Defining Emergency Stop

Old, non-compliant, E-Stop Button

This **OLD** button is definitely non-compliant.

So what is an Emergency Stop, or e-stop, and when do you need to have one? Let’s look at a few definitions taken from CSA Z432-04:

Emergency situation — an immediately hazardous situation that needs to be ended or averted quickly in order to prevent injury or damage.

Emergency stop — a function that is intended to avert harm or to reduce existing hazards to persons, machinery, or work in progress.

Emergency stop button — a red mushroom-headed button that, when activated, will immediately start the emergency stop sequence.

and one more:

6.2.3.5.3 Complementary protective measures
Following the risk assessment, the measures in this clause either shall be applied to the machine or shall be dealt with in the information for use.

Protective measures that are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use may have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine. Such measures shall include, but not be limited to,

(a) emergency stop;

(b) means of rescue of trapped persons; and

(c) means of energy isolation and dissipation.

Modern, non-compliant e-stop button.

This more modern button is non-compliant due to the RED background and spring-return button.

So, an e-stop is a system that is intended for use in Emergency conditions to try to limit or avert harm to someone or something. It isn’t a safeguard, but is considered to be a Complementary Protective Measure. So far so, good.

Is an Emergency Stop Required?

Depending on the regulations and the standards you choose to read, machinery is not required to have  an Emergency Stop. Quoting from CSA Z432-04:

6.2.5.2.1 Components and elements to achieve the emergency stop function
If, following a risk assessment, it is determined that in order to achieve adequate risk reduction under emergency circumstances a machine must be fitted with components and elements necessary to achieve an emergency stop function so that actual or impending emergency situations can be controlled, the following requirements shall apply:

(a) The actuators shall be clearly identifiable, clearly visible, and readily accessible.

(b) The hazardous process shall be stopped as quickly as possible without creating additional hazards.
If this is not possible or the risk cannot be adequately reduced, this may indicate that an emergency stop function may not be the best solution (i.e., other solutions should be sought). (Bolding added for emphasis – DN)

(c) The emergency stop control shall trigger or permit the triggering of certain safeguard movements where necessary.

Note: For more detailed provisions, see NFPA 79.

Download NFPA standards through ANSI

This more modern button is still wrong due to the RED background.

This more modern button is non-compliant due to the RED background.

In fact, if you read Ontario’s Industrial Establishments regulation (Regulation 851), you will find that the only requirement for an emergency stop is that it is properly identified and located “within easy reach” of the operator. What does “properly identified” mean? In Canada, the USA and Internationally, a RED operator device on a YELLOW background, with or without any text behind it, is recognized as EMERGENCY STOP or EMERGENCY OFF, in the case of disconnecting switches or control switches. I’ve scattered some examples of different compliant and non-compliant e-stop devices through this article.

How Many and Where?

Where? “Within easy reach”. Consider the locations where you EXPECT an operator to be. Besides the main control console, these could include feed hoppers, consumables feeders, finished goods exit points… you get the idea. Anywhere you can reasonably expect an operator to be under normal circumstances is a reasonable place to put an e-stop device. “Easy Reach” I interpret as within the arm-span of an adult (presuming the equipment is not intended for use by children). This translates to 500-600 mm either side of the center line of most work stations.

How do you know if you need an emergency stop? Start with a stop/start analysis. Identify all the normal starting and stopping modes that you anticipate on the equipment. Consider all of the different operating modes that you are providing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the matching stop conditions in the same modes, and ensure that all start functions have a matching stop function.

Do a risk assessment. This is a basic requirement in almost every jurisdiction today.

As you determine your risk control measures (following the hierarchy of controls), look at what risks you might control with an Emergency Stop. Remember that e-stops fall below safeguards in the hierarchy, so you must use a safeguarding technique if possible, you can’t just default down to an emergency stop. IF the e-stop can provide you with the required risk reduction, then use it. If not, you need to reduce the risks in other ways first.

Control Reliability Requirements

Finally, once you determine the need for an emergency stop system, you need to consider the system’s functionality and controls architecture. NFPA 79 is the reference standard for Canada, although you can find very similar requirements in IEC 60204-1 if you are working in an international market.

Download NFPA standards through ANSI
Download IEC standards, International Electrotechnical Commission standards.

NFPA 79 calls out three basic categories of stop. Note that these are NOT reliability categories, but are different ways of functioning. Reliability is not addressed in these sections. Quoting from the standard:

9.2.2 Stop Functions. The three categories of stop functions shall be as follows:

(1) Category 0 is an uncontrolled stop by immediately removing power to the machine actuators.

(2) Category 1 is a controlled stop with power to the machine actuators available to achieve the stop then remove power when the stop is achieved.

(3) Category 2 is a controlled stop with power left available to the machine actuators.

This E-Stop Button is correct.

This E-Stop button is CORRECT. Note the Push-Pull-Twist operator and the YELLOW background.

A bit later, the standards says:

9.2.5.3 Stop.
9.2.5.3.1 Each machine shall be equipped with a Category 0 stop.

9.2.5.3.2 Category 0, Category 1, and/or Category 2 stops shall be provided where indicated by an analysis of the risk assessment (DN) and the functional requirements of the machine. Category 0 and Category 1 stops shall be operational regardless of operating modes, and Category 0 shall take priority. Stop function shall operate by de-energizing that relevant circuit and shall override related start functions.

Note that 9.2.5.3.1 does NOT mean that every machine must have an e-stop. It simply says that every machine must have a way to stop the machine that is equivalent to “pulling the plug”. The main disconnect on the control panel can be used for this function if sized and rated appropriately. The question of HOW to effect the Category 0 stop depends on WHEN it will be used – i.e. what risks must be reduced, or what hazards must be controlled by the e-stop.

You’ll also note that that pesky “risk assessment” pops up again in 9.2.5.3.2. You just can’t get away from it…

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.

Once you know what category of stop you need, and what degree of risk reduction you are expecting from the emergency stop system, you can determine the degree of reliability required. In Canada, CSA Z432 gives us these categories: SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL MONITORED and CONTROL RELIABLE. These categories are being replaced slowly by Performance Levels (PL) as defined in ISO 13849-1 2007.

The short answer is that the greater the risk reduction required, the higher the degree of reliability required. In many cases, a SINGLE CHANNEL or SINGLE CHANNEL MONITORED solution may be acceptable, particularly when there are more reliable safeguards in place. On the other hand, you may require CONTROL RELIABLE designs if the e-stop is the primary risk reduction for some risks or specific tasks.

Extra points go to any reader who noticed that the ‘electrical hazard’ warning label immediately above the disconnect handle in the above photo is a) upside down, and b) using a non-standard lighting flash.

Cheap hazard warning labels are often as good as none at all. I’ll be writing more on hazard warnings in future posts.

Use of Emergency Stop as part of a Lockout Procedure or HECP.

One last note: Emergency stop systems (with the exception of emergency switching off devices, such as disconnect switches used for e-stop) CANNOT be used for energy isolation in a Hazardous Energy Control Procedure (a.k.a. Lockout). Devices for this purpose must physically separate the energy source from the down-stream components. See CSA Z460-05 for more on that subject.

Pneumatic E-Stop Device

Pneumatic E-Stop/Isolation device.

Standards Referenced in this post:

CSA Z432-04, Safeguarding of Machinery

NFPA 79-07, Electrical Standard for Industrial Machinery Download NFPA standards at ANSI

IEC 60204-1:09,  SAFETY OF MACHINERY – ELECTRICAL EQUIPMENT OF MACHINES – PART 1: GENERAL REQUIREMENTS

ISO 13849-1-2007, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design

See also

ISO 13850:06, SAFETY OF MACHINERY – EMERGENCY STOP – PRINCIPLES FOR DESIGN

Download IEC standards, International Electrotechnical Commission standards.
Download ISO Standards