Busting Emergency Stop Myths

Emergency Stop on machine console

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Bust­ing here on the MS101 blog!

What does ‘emergency’ mean?

Con­sid­er for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a sit­u­a­tion that is devel­op­ing or emerg­ing in the moment. Emer­gency stop sys­tems are intend­ed to help the user deal with poten­tial­ly haz­ardous con­di­tions that are emerg­ing in the moment. These con­di­tions have prob­a­bly arisen because the design­ers of the machin­ery failed to con­sid­er all the fore­see­able uses of the equip­ment, or because some­one has cho­sen to mis­use the equip­ment in a way that was not intend­ed by the design­ers. The key func­tion of an Emer­gency Stop sys­tem is to pro­vide the user with a back­up to the pri­ma­ry safe­guards. These sys­tems are referred to as “Com­ple­men­tary Pro­tec­tive Mea­sures” and are intend­ed to give the user a chance to “avert or lim­it harm” in a haz­ardous sit­u­a­tion. With that in mind, let’s look at three myths I hear about reg­u­lar­ly.

 

Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Dri­ve, Cred­it: Har­ry Matthews & http://www.old-engine.com

Ear­ly in the Indus­tri­al Rev­o­lu­tion machine builders real­ized that users of their machin­ery need­ed a way to quick­ly stop a machine when some­thing went wrong. At that time, over­head line-shafts were dri­ven by large cen­tral pow­er sources like water­wheels, steam engines or large elec­tric motors. Machin­ery was cou­pled to the cen­tral shafts with pul­leys, clutch­es and belts which trans­mit­ted the pow­er to the machin­ery.

See pic­tures of a line-shaft pow­ered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Pho­to: Lar­ry Evans & www.oldengine.org

These cen­tral engines pow­ered an entire fac­to­ry, so they were much larg­er than an indi­vid­ual motor sized for a mod­ern machine. In addi­tion, they could not be eas­i­ly stopped, since stop­ping the cen­tral pow­er source would mean stop­ping the entire fac­to­ry – not a wel­come choice. Emer­gency stop devices were born in this envi­ron­ment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their ear­ly use as a safe­ty device, some have incor­rect­ly con­sid­ered emer­gency stop sys­tems safe­guard­ing devices. Mod­ern stan­dards make the dif­fer­ence very clear. The eas­i­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stan­dards pub­lished by IEC1 and ISO2.

emer­gency stop3
emer­gency stop func­tion

func­tion that is intend­ed to

—   avert aris­ing, or reduce exist­ing, haz­ards to per­sons, dam­age to machin­ery or to work in progress,

—   be ini­ti­at­ed by a sin­gle human action

NOTE 1

Haz­ards, for the pur­pos­es of this Inter­na­tion­al Stan­dard, are those which can arise from

—   func­tion­al irreg­u­lar­i­ties (e.g. machin­ery mal­func­tion, unac­cept­able prop­er­ties of the mate­r­i­al processed, human error),

—   nor­mal oper­a­tion.

It is impor­tant to under­stand that an emer­gency stop func­tion is “ini­ti­at­ed by a sin­gle human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sid­ered to be a risk con­trol mea­sure for oper­a­tors or bystanders. Emer­gency stop may pro­vide the abil­i­ty to avoid or reduce harm, by pro­vid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­al­ly be to call 911 and admin­is­ter first aid.

Safe­guard­ing sys­tems act auto­mat­i­cal­ly to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­a­bil­i­ty of a haz­ardous sit­u­a­tion aris­ing, and may also involve a reduc­tion in the sever­i­ty of injury by con­trol­ling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machin­ery before it can be reached.) This con­sti­tutes a risk con­trol mea­sure and can be shown to reduce the risk of injury to an exposed per­son.

Emer­gency stop is reac­tive; safe­guard­ing sys­tems are proac­tive.

In Cana­da, CSA defines emer­gency stop as a ‘Com­ple­men­tary Pro­tec­tive Mea­sure’ in CSA Z432-046:

6.2.2.1.1
Safe­guards (guards, pro­tec­tive devices) shall be used to pro­tect per­sons from the haz­ards that can­not rea­son­ably be avoid­ed or suf­fi­cient­ly lim­it­ed by inher­ent­ly safe design. Com­ple­men­tary pro­tec­tive mea­sures involv­ing addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be tak­en.

6.2.3.5.3 Com­ple­men­tary pro­tec­tive mea­sures
Fol­low­ing the risk assess­ment, the mea­sures in this clause either shall be applied to the machine or shall be dealt with in the infor­ma­tion for use.
Pro­tec­tive mea­sures that are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­it­ed to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
© means of ener­gy iso­la­tion and dis­si­pa­tion.

In the USA, three stan­dards apply: ANSI B11ANSI B11.19–2003, and NFPA 79:

ANSI B11-2008

3.80 stop: Imme­di­ate or con­trolled ces­sa­tion of machine motion or oth­er haz­ardous sit­u­a­tions. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or sup­pli­er-spe­cif­ic terms, the oper­a­tion and func­tion of which is deter­mined by the indi­vid­ual design. Def­i­n­i­tions of some of the more com­mon­ly used “stop” ter­mi­nol­o­gy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

7.6 Emergency stop

Elec­tri­cal, pneu­mat­ic and hydraulic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-spe­cif­ic stan­dard or NFPA 79.
Infor­ma­tive Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Infor­ma­tive Note 2: For addi­tion­al infor­ma­tion, see ISO 13850 and IEC 60204–1.

ANSI B11.19–2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­men­tary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ce­dures in claus­es 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI / NFPA 79.

E12.9

Emer­gency stop devices include but are not lim­it­ed to, but­tons, rope-pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­ver­tent access to a haz­ard, typ­i­cal­ly with­out overt action by the indi­vid­ual or oth­ers. Since an indi­vid­ual must actu­ate an emer­gency stop device to issue the stop com­mand, usu­al­ly in reac­tion to an event or haz­ardous sit­u­a­tion, it nei­ther detects nor pre­vents expo­sure to the haz­ard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the lev­el of per­for­mance of the safe­ty func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tri­cal func­tions of the emer­gency stop func­tion which is not direct­ly rel­e­vant to this arti­cle, so that is why I haven’t quot­ed direct­ly from that doc­u­ment here.

As you can clear­ly see, the essen­tial def­i­n­i­tions of these devices in the US and Cana­da match very close­ly, although the US does not specif­i­cal­ly use the term ‘com­ple­men­tary pro­tec­tive mea­sures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emer­gency stop sys­tems act pri­mar­i­ly by remov­ing pow­er from the prime movers in a machine, ensur­ing that pow­er is removed and the equip­ment brought to a stand­still as quick­ly as pos­si­ble, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­a­ble until the emer­gency stop sys­tem is reset. In some cas­es, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the process quick­ly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still ful­ly oper­a­ble and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing pow­er to the machine actu­a­tors dur­ing the stop­ping process. Also referred to as Cat­e­go­ry 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFif­teen to twen­ty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ce­dure”. Lock­out is one aspect of haz­ardous ener­gy con­trol pro­ce­dures (HECP).  HECPs rec­og­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nect­ed tem­porar­i­ly, to allow diag­nos­tics and test­ing to be car­ried out. This process is detailed in two cur­rent stan­dards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to iso­late an ener­gy source.

No cur­rent stan­dard allows for the use of con­trol devices such as push but­tons or selec­tor switch­es to be used as ener­gy iso­la­tion devices.

CSA Z460-05 specif­i­cal­ly pro­hibits this use in their def­i­n­i­tion of ‘ener­gy iso­la­tion devices’:

Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).4

Sim­i­lar require­ments are found in ANSI Z244.15 and in ISO 138503.

Myth #4 — All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is sim­ply not true. A read­er point­ed out to me that CSA Z432-04, clause 7.17.1.2, does make this require­ment. To my knowl­edge this is the only gen­er­al lev­el (i.e., not machine spe­cif­ic) stan­dard that makes this require­ment. I stand cor­rect­ed! Hav­ing said that, the rest of my com­ments on this top­ic still stand. Clause 7.17.1.2 lim­its the appli­ca­tion of this require­ment:

7.17.1.2

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion shall have a man­u­al­ly ini­ti­at­ed emer­gency stop device.

Emer­gency stop sys­tems may be use­ful where they can pro­vide a back-up to oth­er safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-stop analy­sis must be car­ried out as part of the design process. This analy­sis will help the design­er devel­op a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The analy­sis also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing pow­er will cause the haz­ard to cease in a short time, or if the haz­ard can be quick­ly con­tained in some way, then emer­gency stop is a valid choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing removal of pow­er, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For exam­ple, con­sid­er an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only results in the start of the nat­ur­al cool­ing cycle of the oven. In some cas­es that could take hours or days, so the emer­gency stop has no val­ue. It might be use­ful for con­trol­ling oth­er haz­ards, such as fire, that might be relat­ed to the same fail­ure. With­out a full analy­sis of the fail­ure modes of the con­trol sys­tem, a sound deci­sion can­not be made.

Sim­ple machines like drill press­es and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­i­nite­ly ben­e­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low han­dle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­i­cal­ly re-start imme­di­ate­ly when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reap­ply pow­er to the machine on its own.

These require­ments are detailed in ISO 138503, CSA Z4326 and oth­er stan­dards.

Design Considerations

Emer­gency Stop is a con­trol that is often designed in with lit­tle thought and used for a vari­ety of things that it was nev­er intend­ed to be used to accom­plish. The three myths dis­cussed in this arti­cle are the tip of the ice­berg.

Con­sid­er these ques­tions when think­ing about the design and use of emer­gency stop sys­tems:

  1. Have all the intend­ed uses and fore­see­able mis­us­es of the equip­ment been con­sid­ered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assess­ment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be?
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­pos­es, like ‘Pow­er Off’, ener­gy iso­la­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Tak­ing the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to pro­vide the func­tion­al­i­ty that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affect­ed you?

Got any more myths about e-stops you’d like to share?

I real­ly appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sid­er adding it to this arti­cle, with cred­it of course!

References

5% Dis­count on All Stan­dards with code: CC2011

  1. IEC – Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion. Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
  2. ISO – Inter­na­tion­al Orga­ni­za­tion for Stan­dard­iza­tion Down­load ISO Stan­dards
  3. Safe­ty of machin­ery — Emer­gency stop — Prin­ci­ples for design, ISO 13850, 2006, ISO, Gene­va, Switzer­land.
  4. Con­trol of Haz­ardous Ener­gy ­– Lock­out and Oth­er Meth­ods, CSA Z460, 2005, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
    Buy CSA Stan­dards online at CSA.ca
  5. Safe­guard­ing of Machin­ery, CSA Z432-04, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
  6. Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods, ANSI/ASSE Z244.1, 2003, Amer­i­can Nation­al Stan­dards Insti­tute / Amer­i­can Soci­ety of Safe­ty Engi­neers, Des Plaines, IL, USA.
    Down­load ANSI stan­dards
  7. Amer­i­can Nation­al Stan­dard for Machine Tools – Per­for­mance Cri­te­ria for Safe­guard­ing, ANSI B11.19–2003, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  8. Gen­er­al Safe­ty Require­ments Com­mon to ANSI B11 Machines, ANSI B11-2008, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  9. Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery, NFPA 79–2007, NFPA, 1 Bat­tery­march Park, Quin­cy, MA 02169–7471, USA.
    Buy NFPA Stan­dards online.

5% Dis­count on All Stan­dards with code: CC2011

Digiprove sealCopy­right secured by Digiprove © 2011–2013
Acknowl­edge­ments: See cita­tions in the arti­cle.
Some Rights Reserved
Series Nav­i­ga­tionCheck­ing Emer­gency Stop Sys­temsGuard­ing Emer­gency Stop Devices

Author: Doug Nix

Doug Nix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://www.complianceinsight.ca) in Kitchener, Ontario, and is Lead Author and Senior Editor of the Machinery Safety 101 blog. Doug's work includes teaching machinery risk assessment techniques privately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as providing technical services and training programs to clients related to risk assessment, industrial machinery safety, safety-related control system integration and reliability, laser safety and regulatory conformity. For more see Doug's LinkedIn profile.