Busting Emergency Stop Myths

Emergency Stop on machine console
This entry is part 3 of 13 in the series Emergency Stop

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Busting here on the MS101 blog!

What does ‘emergency’ mean?

Consider for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a situ­ation that is devel­op­ing or emer­ging in the moment. Emergency stop sys­tems are inten­ded to help the user deal with poten­tially haz­ard­ous con­di­tions that are emer­ging in the moment. These con­di­tions have prob­ably aris­en because the design­ers of the machinery failed to con­sider all the fore­see­able uses of the equip­ment, or because someone has chosen to mis­use the equip­ment in a way that was not inten­ded by the design­ers. The key func­tion of an Emergency Stop sys­tem is to provide the user with a backup to the primary safe­guards. These sys­tems are referred to as “Complementary Protective Measures” and are inten­ded to give the user a chance to “avert or lim­it harm” in a haz­ard­ous situ­ation. With that in mind, let’s look at three myths I hear about regularly.

 

Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Drive, Credit: Harry Matthews & http://​www​.old​-engine​.com

Early in the Industrial Revolution machine build­ers real­ized that users of their machinery needed a way to quickly stop a machine when some­thing went wrong. At that time, over­head line-​shafts were driv­en by large cent­ral power sources like water­wheels, steam engines or large elec­tric motors. Machinery was coupled to the cent­ral shafts with pul­leys, clutches and belts which trans­mit­ted the power to the machinery.

See pic­tures of a line-​shaft powered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Photo: Larry Evans & www​.olden​gine​.org

These cent­ral engines powered an entire fact­ory, so they were much lar­ger than an indi­vidu­al motor sized for a mod­ern machine. In addi­tion, they could not be eas­ily stopped, since stop­ping the cent­ral power source would mean stop­ping the entire fact­ory – not a wel­come choice. Emergency stop devices were born in this environment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their early use as a safety device, some have incor­rectly con­sidered emer­gency stop sys­tems safe­guard­ing devices. Modern stand­ards make the dif­fer­ence very clear. The easi­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stand­ards pub­lished by IEC1 and ISO2.

emer­gency stop3
emer­gency stop function

func­tion that is inten­ded to

—   avert arising, or reduce exist­ing, haz­ards to per­sons, dam­age to machinery or to work in progress,

—   be ini­ti­ated by a single human action

NOTE 1

Hazards, for the pur­poses of this International Standard, are those which can arise from

—   func­tion­al irreg­u­lar­it­ies (e.g. machinery mal­func­tion, unac­cept­able prop­er­ties of the mater­i­al pro­cessed, human error),

—   nor­mal operation.

It is import­ant to under­stand that an emer­gency stop func­tion is “ini­ti­ated by a single human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sidered to be a risk con­trol meas­ure for oper­at­ors or bystand­ers. Emergency stop may provide the abil­ity to avoid or reduce harm, by provid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­ally be to call 911 and admin­is­ter first aid.

Safeguarding sys­tems act auto­mat­ic­ally to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­ab­il­ity of a haz­ard­ous situ­ation arising, and may also involve a reduc­tion in the sever­ity of injury by con­trolling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machinery before it can be reached.) This con­sti­tutes a risk con­trol meas­ure and can be shown to reduce the risk of injury to an exposed person.

Emergency stop is react­ive; safe­guard­ing sys­tems are pro­act­ive.

In Canada, CSA defines emer­gency stop as a ‘Complementary Protective Measure’ in CSA Z432-​046:

6.2.2.1.1
Safeguards (guards, pro­tect­ive devices) shall be used to pro­tect per­sons from the haz­ards that can­not reas­on­ably be avoided or suf­fi­ciently lim­ited by inher­ently safe design. Complementary pro­tect­ive meas­ures involving addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be taken.

6.2.3.5.3 Complementary pro­tect­ive measures
Following the risk assess­ment, the meas­ures in this clause either shall be applied to the machine or shall be dealt with in the inform­a­tion for use.
Protective meas­ures that are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/​or pro­tect­ive devices), nor inform­a­tion for use may have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine. Such meas­ures shall include, but not be lim­ited to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
(c) means of energy isol­a­tion and dissipation.

In the USA, three stand­ards apply: ANSI B11,  ANSI B11.19 – 2003, and NFPA 79:

ANSI B11-​2008

3.80 stop: Immediate or con­trolled ces­sa­tion of machine motion or oth­er haz­ard­ous situ­ations. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or supplier-​specific terms, the oper­a­tion and func­tion of which is determ­ined by the indi­vidu­al design. Definitions of some of the more com­monly used “stop” ter­min­o­logy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency purposes;

7.6 Emergency stop

Electrical, pneu­mat­ic and hydraul­ic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-​specific stand­ard or NFPA 79.
Informative Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Informative Note 2: For addi­tion­al inform­a­tion, see ISO 13850 and IEC 60204 – 1.

ANSI B11.19 – 2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­ment­ary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ced­ures in clauses 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI /​ NFPA 79.

E12.9

Emergency stop devices include but are not lim­ited to, but­tons, rope-​pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­vert­ent access to a haz­ard, typ­ic­ally without overt action by the indi­vidu­al or oth­ers. Since an indi­vidu­al must actu­ate an emer­gency stop device to issue the stop com­mand, usu­ally in reac­tion to an event or haz­ard­ous situ­ation, it neither detects nor pre­vents expos­ure to the hazard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the level of per­form­ance of the safety func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tric­al func­tions of the emer­gency stop func­tion which is not dir­ectly rel­ev­ant to this art­icle, so that is why I haven’t quoted dir­ectly from that doc­u­ment here.

As you can clearly see, the essen­tial defin­i­tions of these devices in the US and Canada match very closely, although the US does not spe­cific­ally use the term ‘com­ple­ment­ary pro­tect­ive measures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emergency stop sys­tems act primar­ily by remov­ing power from the prime movers in a machine, ensur­ing that power is removed and the equip­ment brought to a stand­still as quickly as pos­sible, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­able until the emer­gency stop sys­tem is reset. In some cases, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the pro­cess quickly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still fully oper­able and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing power to the machine actu­at­ors dur­ing the stop­ping pro­cess. Also referred to as Category 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency purposes;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFifteen to twenty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ced­ure”. Lockout is one aspect of haz­ard­ous energy con­trol pro­ced­ures (HECP).  HECPs recog­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nec­ted tem­por­ar­ily, to allow dia­gnostics and test­ing to be car­ried out. This pro­cess is detailed in two cur­rent stand­ards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to isol­ate an energy source.

No cur­rent stand­ard allows for the use of con­trol devices such as push but­tons or select­or switches to be used as energy isol­a­tion devices.

CSA Z460-​05 spe­cific­ally pro­hib­its this use in their defin­i­tion of ‘energy isol­a­tion devices’:

Energy-​isolating device — a mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a manu­ally oper­ated elec­tric­al cir­cuit break­er; a dis­con­nect switch; a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors; a line valve; a block; and oth­er devices used to block or isol­ate energy (push-​button select­or switches and oth­er control-​type devices are not energy-​isolating devices).4

Similar require­ments are found in ANSI Z244.15 and in ISO 138503.

Myth #4 – All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is simply not true. A read­er poin­ted out to me that CSA Z432-​04, clause 7.17.1.2, does make this require­ment. To my know­ledge this is the only gen­er­al level (i.e., not machine spe­cif­ic) stand­ard that makes this require­ment. I stand cor­rec­ted! Having said that, the rest of my com­ments on this top­ic still stand. Clause 7.17.1.2 lim­its the applic­a­tion of this requirement:

7.17.1.2

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion shall have a manu­ally ini­ti­ated emer­gency stop device.

Emergency stop sys­tems may be use­ful where they can provide a back-​up to oth­er safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-​stop ana­lys­is must be car­ried out as part of the design pro­cess. This ana­lys­is will help the design­er devel­op a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The ana­lys­is also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing power will cause the haz­ard to cease in a short time, or if the haz­ard can be quickly con­tained in some way, then emer­gency stop is a val­id choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing remov­al of power, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For example, con­sider an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only res­ults in the start of the nat­ur­al cool­ing cycle of the oven. In some cases that could take hours or days, so the emer­gency stop has no value. It might be use­ful for con­trolling oth­er haz­ards, such as fire, that might be related to the same fail­ure. Without a full ana­lys­is of the fail­ure modes of the con­trol sys­tem, a sound decision can­not be made.

Simple machines like drill presses and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­in­itely bene­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low handle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­ic­ally re-​start imme­di­ately when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reapply power to the machine on its own.

These require­ments are detailed in ISO 138503, CSA Z4326 and oth­er standards.

Design Considerations

Emergency Stop is a con­trol that is often designed in with little thought and used for a vari­ety of things that it was nev­er inten­ded to be used to accom­plish. The three myths dis­cussed in this art­icle are the tip of the iceberg.

Consider these ques­tions when think­ing about the design and use of emer­gency stop systems:

  1. Have all the inten­ded uses and fore­see­able mis­uses of the equip­ment been considered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assessment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be?
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­poses, like ‘Power Off’, energy isol­a­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Taking the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to provide the func­tion­al­ity that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affected you?

Got any more myths about e-​stops you’d like to share?

I really appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sider adding it to this art­icle, with cred­it of course!

References

5% Discount on All Standards with code: CC2011 

  1. IEC – International Electrotechnical Commission. Download IEC stand­ards, International Electrotechnical Commission standards.
  2. ISO – International Organization for Standardization Download ISO Standards 
  3. Safety of machinery — Emergency stop — Principles for design, ISO 13850, 2006, ISO, Geneva, Switzerland.
  4. Control of Hazardous Energy ­– Lockout and Other Methods, CSA Z460, 2005, Canadian Standards Association, Toronto, Canada.
    Buy CSA Standards online at CSA​.ca
  5. Safeguarding of Machinery, CSA Z432-​04, Canadian Standards Association, Toronto, Canada.
  6. Control of Hazardous Energy – Lockout/​Tagout and Alternative Methods, ANSI/​ASSE Z244.1, 2003, American National Standards Institute /​ American Society of Safety Engineers, Des Plaines, IL, USA.
    Download ANSI standards
  7. American National Standard for Machine Tools – Performance Criteria for Safeguarding, ANSI B11.19 – 2003, American National Standards Institute, Des Plaines, IL, USA.
  8. General Safety Requirements Common to ANSI B11 Machines, ANSI B11-​2008, American National Standards Institute, Des Plaines, IL, USA.
  9. Electrical Standard for Industrial Machinery, NFPA 79 – 2007, NFPA, 1 Batterymarch Park, Quincy, MA 02169 – 7471, USA.
    Buy NFPA Standards online.

5% Discount on All Standards with code: CC2011 

Series NavigationChecking Emergency Stop SystemsGuarding Emergency Stop Devices

Author: Doug Nix

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://www.complianceinsight.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog. Doug's work includes teaching machinery risk assessment techniques privately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as providing technical services and training programs to clients related to risk assessment, industrial machinery safety, safety-related control system integration and reliability, laser safety and regulatory conformity. Follow me on Academia.edu//a.academia-assets.com/javascripts/social.js

  • Pingback: MachinerySafety()

  • Roberta Nelson Shea,

    Thanks for the com­ment. I decided after read­ing your thoughts that I would add the quo­ta­tion from CSA Z460 back into the post. I took it out earli­er for brev­ity, but I think it adds.

    If you’ve got any oth­er Myths you’d like to add to this post from your own exper­i­ence, email them to me and I’ll add them in!

  • Roberta Nelson Shea

    Doug,

    Well stated! The top­ic of Emergency Stops/​ Stopping is all to fre­quently mis-​understood. It is not meant for safe­guard­ing, but meant as a means of pre­vent­ing FURTHER dam­age. Safeguarding is used to PREVENT injury.

    Also lock­ing an emer­gency stop device is NOT an energy isol­a­tion means and would not com­ply with the require­ments of the Control of Hazardous Energy.

    Roberta