Machinery Safety 101

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Busting here on the MS101 blog!

What does ‘emer­gency’ mean?

Consider for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a sit­u­a­tion that is devel­op­ing or emerg­ing in the moment. Emergency stop sys­tems are intended to help the user deal with poten­tially haz­ardous con­di­tions that are emerg­ing in the moment. These con­di­tions have prob­a­bly arisen because the design­ers of the machin­ery failed to con­sider all the fore­see­able uses of the equip­ment, or because some­one has cho­sen to mis­use the equip­ment in a way that was not intended by the design­ers. The key func­tion of an Emergency Stop sys­tem is to pro­vide the user with a backup to the pri­mary safe­guards. These sys­tems are referred to as “Complementary Protective Measures” and are intended to give the user a chance to “avert or limit harm” in a haz­ardous sit­u­a­tion. With that in mind, let’s look at three myths I hear about regularly.

Myth #1 – The Emergency Stop Is A Safety Device

A Fitz Water Wheel and Belt Drive, Credit: Harry Matthews & http://​www​.old​-engine​.com

Early in the Industrial Revolution machine builders real­ized that users of their machin­ery needed a way to quickly stop a machine when some­thing went wrong. At that time, over­head line-​​shafts were dri­ven by large cen­tral power sources like water­wheels, steam engines or large elec­tric motors. Machinery was cou­pled to the cen­tral shafts with pul­leys, clutches and belts which trans­mit­ted the power to the machinery.

See pic­tures of a line-​​shaft pow­ered machine shop or click the image below.

Photo: Larry Evans & www​.old​engine​.org

These cen­tral engines pow­ered an entire fac­tory, so they were much larger than an indi­vid­ual motor sized for a mod­ern machine. In addi­tion, they could not be eas­ily stopped, since stop­ping the cen­tral power source would mean stop­ping the entire fac­tory – not a wel­come choice. Emergency stop devices were born in this environment.

Learn more about Line Shafts at Harry’s Old Engines.

Due to their early use as a safety device, some have incor­rectly con­sid­ered emer­gency stop sys­tems safe­guard­ing devices. Modern stan­dards make the dif­fer­ence very clear. The eas­i­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tional stan­dards pub­lished by IEC¹ and ISO².

emer­gency stop³
emer­gency stop function

func­tion that is intended to

—   avert aris­ing, or reduce exist­ing, haz­ards to per­sons, dam­age to machin­ery or to work in progress,

—   be ini­ti­ated by a sin­gle human action

NOTE 1

Hazards, for the pur­poses of this International Standard, are those which can arise from

—   func­tional irreg­u­lar­i­ties (e.g. machin­ery mal­func­tion, unac­cept­able prop­er­ties of the mate­r­ial processed, human error),

—   nor­mal operation.

It is impor­tant to under­stand that an emer­gency stop func­tion is “ini­ti­ated by a sin­gle human action”. This means that it is not auto­matic, and there­fore can­not be con­sid­ered to be a risk con­trol mea­sure for oper­a­tors or bystanders. Emergency stop may pro­vide the abil­ity to avoid or reduce harm, by pro­vid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­ally be to call 911 and admin­is­ter first aid.

Safeguarding sys­tems act auto­mat­i­cally to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­a­bil­ity of a haz­ardous sit­u­a­tion aris­ing, and may also involve a reduc­tion in the sever­ity of injury by con­trol­ling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machin­ery before it can be reached.) This con­sti­tutes a risk con­trol mea­sure and can be shown to reduce the risk of injury to an exposed person.

Emergency stop is reac­tive; safe­guard­ing sys­tems are proac­tive.

In Canada, CSA defines emer­gency stop as a ‘Complementary Protective Measure’ in CSA Z432-​​04⁶:

6.2.2.1.1
Safeguards (guards, pro­tec­tive devices) shall be used to pro­tect per­sons from the haz­ards that can­not rea­son­ably be avoided or suf­fi­ciently lim­ited by inher­ently safe design. Complementary pro­tec­tive mea­sures involv­ing addi­tional equip­ment (e.g., emer­gency stop equip­ment) may have to be taken.

6.2.3.5.3 Complementary pro­tec­tive mea­sures
Following the risk assess­ment, the mea­sures in this clause either shall be applied to the machine or shall be dealt with in the infor­ma­tion for use.
Protective mea­sures that are nei­ther inher­ently safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/​or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­mented as required by the intended use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­ited to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
© means of energy iso­la­tion and dissipation.

In the USA, three stan­dards apply: ANSI B11,  ANSI B11.19–2003, and NFPA 79:

ANSI B11-​​2008

3.80 stop: Immediate or con­trolled ces­sa­tion of machine motion or other haz­ardous sit­u­a­tions. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user– or supplier-​​specific terms, the oper­a­tion and func­tion of which is deter­mined by the indi­vid­ual design. Definitions of some of the more com­monly used “stop” ter­mi­nol­ogy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­ally ini­ti­ated, for emer­gency purposes;

7.6 Emergency stop

Electrical, pneu­matic and hydraulic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-​​specific stan­dard or NFPA 79.
Informative Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Informative Note 2: For addi­tional infor­ma­tion, see ISO 13850 and IEC 60204–1.

ANSI B11.19–2003

12.9 Stop and emer­gency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­men­tary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ce­dures in clauses 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI /​ NFPA 79.

E12.9

Emergency stop devices include but are not lim­ited to, but­tons, rope-​​pulls, and cable-​​pulls.

A safe­guard­ing device detects or pre­vents inad­ver­tent access to a haz­ard, typ­i­cally with­out overt action by the indi­vid­ual or oth­ers. Since an indi­vid­ual must actu­ate an emer­gency stop device to issue the stop com­mand, usu­ally in reac­tion to an event or haz­ardous sit­u­a­tion, it nei­ther detects nor pre­vents expo­sure to the hazard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the level of per­for­mance of the safety func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tri­cal func­tions of the emer­gency stop func­tion which is not directly rel­e­vant to this arti­cle, so that is why I haven’t quoted directly from that doc­u­ment here.

As you can clearly see, the essen­tial def­i­n­i­tions of these devices in the US and Canada match very closely, although the US does not specif­i­cally use the term ‘com­ple­men­tary pro­tec­tive measures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emergency stop sys­tems act pri­mar­ily by remov­ing power from the prime movers in a machine, ensur­ing that power is removed and the equip­ment brought to a stand­still as quickly as pos­si­ble, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­a­ble until the emer­gency stop sys­tem is reset. In some cases, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the process quickly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still fully oper­a­ble and may still be in auto­matic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-​​2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing power to the machine actu­a­tors dur­ing the stop­ping process. Also referred to as Category 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­ally ini­ti­ated, for emer­gency purposes;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Fifteen to twenty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ce­dure”. Lockout is one aspect of haz­ardous energy con­trol pro­ce­dures (HECP).  HECPs rec­og­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nected tem­porar­ily, to allow diag­nos­tics and test­ing to be car­ried out. This process is detailed in two cur­rent stan­dards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or other con­trols from being reset until the machine is ready for test­ing. They can­not be used to iso­late an energy source.

No cur­rent stan­dard allows for the use of con­trol devices such as push but­tons or selec­tor switches to be used as energy iso­la­tion devices.

CSA Z460-​​05 specif­i­cally pro­hibits this use in their def­i­n­i­tion of ‘energy iso­la­tion devices’:

Energy-​​isolating device — a mechan­i­cal device that phys­i­cally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a man­u­ally oper­ated elec­tri­cal cir­cuit breaker; a dis­con­nect switch; a man­u­ally oper­ated switch by which the con­duc­tors of a cir­cuit can be dis­con­nected from all ungrounded sup­ply con­duc­tors; a line valve; a block; and other devices used to block or iso­late energy (push-​​button selec­tor switches and other control-​​type devices are not energy-​​isolating devices).⁴

Similar require­ments are found in ANSI Z244.1⁵ and in ISO 13850³.

Myth #4 — All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is sim­ply not true.

Emergency stop sys­tems may be use­ful where they can pro­vide a back-​​up to other safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-​​stop analy­sis must be car­ried out as part of the design process. This analy­sis will help the designer develop a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The analy­sis also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing power will cause the haz­ard to cease in a short time, or if the haz­ard can be quickly con­tained in some way, then emer­gency stop is a valid choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing removal of power, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For exam­ple, con­sider an oven. If the burner stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only results in the start of the nat­ural cool­ing cycle of the oven. In some cases that could take hours or days, so the emer­gency stop has no value. It might be use­ful for con­trol­ling other haz­ards, such as fire, that might be related to the same fail­ure. Without a full analy­sis of the fail­ure modes of the con­trol sys­tem, a sound deci­sion can­not be made.

Simple machines like drill presses and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­i­nitely ben­e­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low han­dle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­i­cally re-​​start imme­di­ately when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through other con­trols. Reset of the emer­gency stop device is not per­mit­ted to reap­ply power to the machine on its own.

These require­ments are detailed in ISO 13850³, CSA Z432⁶ and other standards.

Design Considerations

Emergency Stop is a con­trol that is often designed in with lit­tle thought and used for a vari­ety of things that it was never intended to be used to accom­plish. The three myths dis­cussed in this arti­cle are the tip of the iceberg.

Consider these ques­tions when think­ing about the design and use of emer­gency stop systems:

1. Have all the intended uses and fore­see­able mis­uses of the equip­ment been considered?
2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assessment.)
3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
4. How reli­able does the emer­gency stop sys­tem need to be?
5. Am I expect­ing the emer­gency stop to be used for other pur­poses, like ‘Power Off’, energy iso­la­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Taking the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to pro­vide the func­tion­al­ity that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affected you?

Got any more myths about e-​​stops you’d like to share?

I really appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sider adding it to this arti­cle, with credit of course!

References

5% Discount on All Standards with code: CC2011

1. IEC – International Electrotechnical Commission. Download IEC stan­dards, International Electrotechnical Commission standards.
2. ISO – International Organization for Standardization Download ISO Standards
3. Safety of machin­ery — Emergency stop — Principles for design, ISO 13850, 2006, ISO, Geneva, Switzerland.
4. Control of Hazardous Energy ­– Lockout and Other Methods, CSA Z460, 2005, Canadian Standards Association, Toronto, Canada.
   Buy CSA Standards online at CSA​.ca
5. Safeguarding of Machinery, CSA Z432-​​04, Canadian Standards Association, Toronto, Canada.
6. Control of Hazardous Energy – Lockout/​Tagout and Alternative Methods, ANSI/​ASSE Z244.1, 2003, American National Standards Institute /​ American Society of Safety Engineers, Des Plaines, IL, USA.
   Download ANSI standards
7. American National Standard for Machine Tools – Performance Criteria for Safeguarding, ANSI B11.19–2003, American National Standards Institute, Des Plaines, IL, USA.
8. General Safety Requirements Common to ANSI B11 Machines, ANSI B11-​​2008, American National Standards Institute, Des Plaines, IL, USA.
9. Electrical Standard for Industrial Machinery, NFPA 79–2007, NFPA, 1 Batterymarch Park, Quincy, MA 02169–7471, USA.
   Buy NFPA Standards online.

5% Discount on All Standards with code: CC2011

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://​www​.com​pli​an​cein​sight​.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog.

Doug’s work includes teach­ing machin­ery risk assess­ment tech­niques pri­vately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as pro­vid­ing tech­ni­cal ser­vices and train­ing pro­grams to clients related to risk assess­ment, indus­trial machin­ery safety, safety-​​related con­trol sys­tem inte­gra­tion and reli­a­bil­ity, laser safety and reg­u­la­tory conformity.

Connect me on Facebook | Twitter | Google + | LinkedIn | Website

Copyright secured by Digiprove © 2011

Acknowledgements: See cita­tions in the article.

Some Rights Reserved