Machinery Safety 101

A while back I wrote about the basic design require­ments for Emergency Stop sys­tems. I’ve had sev­eral peo­ple con­tact me want­ing to know about check­ing and test­ing emer­gency stops, so here are my thoughts on this process.

Figure 1 below, excerpted from the 1996 edi­tion of ISO 13850, Safety of machin­ery — Emergency stop — Principles for design, shows the emer­gency stop func­tion graph­i­cally. As you can see, the ini­ti­at­ing fac­tor in this func­tion is a per­son becom­ing aware of the need for an emer­gency stop. This is NOT an auto­matic func­tion and is NOT a safety or safe­guard­ing function.

Download ISO Standards

ISO 13850 1996 Figure 1 — Emergency Stop Function

Download ISO Standards

I men­tion this because many peo­ple are con­fused about this point. Emergency stop sys­tems are con­sid­ered to be ‘com­pli­men­tary pro­tec­tive mea­sures’, mean­ing that their func­tions com­ple­ment the safe­guard­ing sys­tems, but can­not be con­sid­ered to be safe­guards in and of them­selves. This is sig­nif­i­cant. Safeguarding sys­tems are required to act auto­mat­i­cally to pro­tect an exposed per­son. Think about how an inter­locked gate or a light cur­tain acts to stop haz­ardous motion BEFORE the per­son can reach it. Emergency stop is nor­mally used AFTER the per­son is already involved with the haz­ard, and the next step is nor­mally to call 911.

All of that is impor­tant from the per­spec­tive of con­trol reli­a­bil­ity. The con­trol reli­a­bil­ity require­ments for emer­gency stop sys­tems are often dif­fer­ent from those for the safe­guard­ing sys­tems because they are a backup sys­tem. Determination of the reli­a­bil­ity require­ments is based on the risk assess­ment and on an analy­sis of the cir­cum­stances where you, as the designer, antic­i­pate that emer­gency stop may be help­ful in reduc­ing or avoid­ing injury or machin­ery dam­age. Frequently, these sys­tems have lower con­trol reli­a­bil­ity require­ments than do safe­guard­ing systems.

Before you begin any test­ing, under­stand what effects the test­ing will have on the machin­ery. Emergency stops can be par­tially tested with the machin­ery at rest. Depending on the func­tion of the machin­ery and the dif­fi­culty in recov­er­ing from an emer­gency stop con­di­tion, you may need to adjust your approach to these tests. Start by review­ing the emer­gency stop func­tional descrip­tion in the man­ual. Here’s an exam­ple taken from a real machine manual:

Emergency Stop (E-​​Stop) Button

Figure 2.1 Emergency Stop (E-​​Stop) Button

A red emer­gency stop (E-​​Stop) but­ton is a safety device which allows the oper­a­tor to stop the machine in an emer­gency. At any time dur­ing oper­a­tion, press the E-​​Stop but­ton to dis­con­nect actu­a­tor power and stop all con­nected machines in the pro­duc­tion line. Figure 2.1 shows the emer­gency stop but­ton.

There is one E-​​Stop but­ton on the pneu­matic panel.

NOTE: After press­ing the E-​​Stop but­ton, the entire pro­duc­tion line from spreader-​​feeder to stacker shuts down. When the E-​​Stop but­ton is reset, all machines in the pro­duc­tion line will need to be restarted.

DANGER: These devices do not dis­con­nect main elec­tri­cal power from the machine. See “Electrical Disconnect” on page 21.

As you can see, the gen­eral func­tion of the but­ton is described, and some warn­ings are given about what does and doesn’t hap­pen when the but­ton is pressed.

Now, if the emer­gency stop sys­tem has been designed prop­erly and the machine is oper­at­ing nor­mally, press­ing the emer­gency stop but­ton while the machine is in mid-​​cycle should result in the machin­ery com­ing to a fast and grace­ful stop. Here is what ISO 13850 has to say about this condition:

4.1.3 The emer­gency stop func­tion shall be so designed that, after actu­a­tion of the emer­gency stop actu­a­tor, haz­ardous move­ments and oper­a­tions of the machine are stopped in an appro­pri­ate man­ner, with­out cre­at­ing addi­tional haz­ards and with­out any fur­ther inter­ven­tion by any per­son, accord­ing to the risk assess­ment.
An “appro­pri­ate man­ner” can include

• choice of an opti­mal decel­er­a­tion rate,
• selec­tion of the stop cat­e­gory (see 4.1.4), and
• employ­ment of a pre­de­ter­mined shut­down sequence.

The emer­gency stop func­tion shall be so designed that a deci­sion to use the emer­gency stop device does not
require the machine oper­a­tor to con­sider the resul­tant effects.

The inten­tion of this func­tion is to bring the machin­ery to a halt as quickly as pos­si­ble with­out break­ing it. However, if the brak­ing sys­tems fail, e.g. the servo drive fails to decel­er­ate the tool­ing as it should, then drop­ping power and poten­tially break­ing the machin­ery is acceptable.

In many sys­tems, press­ing the e-​​stop but­ton or oth­er­wise acti­vat­ing the emer­gency stop sys­tem will result in a fault or an error being dis­played on the machine’s oper­a­tor dis­play. This can be used as an indi­ca­tion that the con­trol sys­tem ‘knows’ that the sys­tem has been activated.

ISO 13850 requires that emer­gency stop sys­tems exhibit the fol­low­ing key behaviours:

• It must over­ride all other con­trol func­tions, and no start func­tions are per­mit­ted (intended, unin­tended or unex­pected) until the emer­gency stop has been reset;
• Use of the emer­gency stop can­not impair the oper­a­tion of any func­tions of the machine intended for the release of trapped persons;
• It is not per­mit­ted to affect the func­tion of any other safety crit­i­cal sys­tems or devices.

Tests

Once the emer­gency stop device has been acti­vated, con­trol power is nor­mally lost. Pressing any START func­tion on the con­trol panel, except POWER ON or RESET should have no effect. If any aspect of the machine starts, count this as a FAILED test.

If reset­ting the emer­gency stop device results in con­trol power being re-​​applied, count this as a FAILED test.

Pressing POWER ON or RESET before the acti­vated emer­gency stop device has been reset (i.e. the e-​​stop but­ton has been pulled out to the ‘oper­ate’ posi­tion), should have no effect. If you can turn the power back on before you reset the emer­gency stop device, count this as a FAILED test.

Once the emer­gency stop device has been reset, press­ing POWER ON or RESET should result in the con­trol power being restored. This is accept­able. The machine should not restart. If the machine restarts nor­mal oper­a­tion, count this as a FAILED test.

Once con­trol power is back on, you may have a num­ber of faults to clear. When all the faults have been cleared, press­ing the START but­ton should result in the machine restart­ing. This is accept­able behaviour.

If you break the machine while test­ing the emer­gency stop sys­tem, count this as a FAILED test.

Test all emer­gency stop devices. A wiring error or other prob­lems may not be appar­ent until the emer­gency stop device is tested. Push all but­tons, pull all pull cords, acti­vate all emer­gency stop devices. If any fail to cre­ate the emer­gency stop con­di­tion, count this as a FAILED test.

If, hav­ing con­ducted all of these tests, no fail­ures have been detected, con­sider the sys­tem to have passed basic func­tional test­ing. Depending on the com­plex­ity of the sys­tem and the crit­i­cal­ity of the emer­gency stop func­tion, addi­tional test­ing may be required. It may be nec­es­sary to develop some func­tional tests that are con­ducted while var­i­ous EMI sig­nals are present, for example.

If you have any ques­tions regard­ing test­ing of emer­gency stop devices, please email me!

Download ISO Standards

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://​www​.com​pli​an​cein​sight​.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog.

Doug’s work includes teach­ing machin­ery risk assess­ment tech­niques pri­vately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as pro­vid­ing tech­ni­cal ser­vices and train­ing pro­grams to clients related to risk assess­ment, indus­trial machin­ery safety, safety-​​related con­trol sys­tem inte­gra­tion and reli­a­bil­ity, laser safety and reg­u­la­tory conformity.

Connect me on Facebook | Twitter | Google + | LinkedIn | Website