Machinery Safety 101

Do you use the phrase ‘dead­man’ or ‘dead­man switch’ when talk­ing about safety related con­trols on your machin­ery? I often run into this when I’m work­ing with clients who use the terms to refer to ‘enabling devices’ — you know, those two or three-​​position switches that are found on robot teach­ing pen­dants and in other appli­ca­tions to give the oper­a­tor a way to stop machin­ery, even if they have already been injured or killed by the equip­ment. Calling these devices a ‘Deadman Switch’ or even a ‘Live-​​Man Switch’ as the three-​​position devices are some­times called, sends entirely the wrong mes­sage to the user as far as I’m con­cerned. The objec­tive of our work as machin­ery safety engi­neers is to pre­vent injuries from hap­pen­ing in the first place. Using a device that is designed to deter­mine if the user is dead or uncon­scious means some­one screwed up.

A lit­tle history

The term ‘dead­man’ comes from a device that was devel­oped by the rail­road loco­mo­tive builders in the 1800’s. In those days, loco­mo­tives were fired by coal or wood used to heat the boiler to gen­er­ate steam. The engines were usu­ally attended by two men: a Fireman and the Engineer. The Fireman’s job was pri­mar­ily to keep the fire­box stoked and to assist the Engineer. The Engineer’s job was to keep the loco­mo­tive run­ning, includ­ing dri­ving the train.

The cabin was gen­er­ally open at the back, and even in cold weather this was sel­dom a prob­lem because the heat from the fire­box was more than enough to keep the men warm. In the sum­mer, it was very dif­fi­cult to keep the cab cool enough, even with the win­dows open.

The motion of the engine was reg­u­lated with two valves, one that pro­vided the for­ward /​ reverse selec­tion and a long lever with a ratchet mech­a­nism that con­trolled the speed and brak­ing. The ratchet allowed the engi­neer to set the valve in one posi­tion and have it stay steady. As long as the boiler was pro­duc­ing suf­fi­cient steam, the engine would keep on rolling.

The loco­mo­tives occa­sion­ally had prob­lems with car­bon monox­ide build­ing up in the cab, caus­ing the engi­neer to slip into uncon­scious­ness and some­times die. As long as the CO didn’t also affect the fire­man, the engine could be stopped. In the sum­mer, the pos­si­bil­ity of heat exhaus­tion and heat stroke could also cause the men to suc­cumb while the train was moving.

A ‘dead­man’ pedal in a rail­way locomotive

Since the speed valve was nor­mally set in one posi­tion, the train could con­tinue with the crew uncon­scious or worse. After some ter­ri­ble acci­dents, design­ers came up with the ‘dead­man’ con­trol — the engi­neer would be required to main­tain a device in a cer­tain posi­tion in addi­tion to the speed con­trol valve, oth­er­wise the brakes would be applied stop­ping the engine. The intent was lit­er­ally to detect a dead man at the controls!

With the advent of elec­tric trains, trams and sub­ways, the con­cerns about heat and CO were elim­i­nated, but other pos­si­bil­i­ties, includ­ing heart attacks and other infir­mi­ties caused these devices to be inte­grated into these new trans­porta­tion sys­tems. To learn more about these appli­ca­tions, see the Wikipedia arti­cle Dead Man’s Switch.

It’s worth not­ing that the rail­ways now call these devices ‘Driver Safety Devices’ or DSD. See a mod­ern DSD at the Arrowvale Electronics web site.

Robots Enter the Picture

Motoman Pendant show­ing Enabling Device

In the 1980’s indus­trial robots began to appear in the work­place. Accidents in these early days drove changes in the design of the con­trol pen­dants used to ‘teach’ these devices their tasks. Early pen­dants pro­vided motion con­trol and an emer­gency stop device. Later, the motion con­trols were altered to become ‘hold-​​to-​​run’ devices that could jog the selected robot axis at a pre-​​selected slow-​​speed, one axis at a time. In the 90’s the ‘enabling device’ was added to the pen­dant. These two-​​position switches, still called ‘dead-​​man switches’, had to be held closed in order for the robot to move under con­trol of the axis hold-​​to-​​run con­trols. Accidents con­tin­ued to occur. In the mid 90’s the three-​​position enabling device, some­times called a ‘live-​​man-​​switch’, was intro­duced after stud­ies showed that some peo­ple would release their grip on the con­trol pen­dant when struck by the robot, while oth­ers would clench the hand hold­ing the pen­dant. The new switches are required to be held in the mid posi­tion to enable motion. The pic­ture at left shows the back of a mod­ern robot pen­dant. The black bar in the lower right is the enabling device, located so that your hand will nat­u­rally hold the device in the cor­rect posi­tion when you hold the pen­dant in your left hand. Not so good if you are left-​​handed!

ABB IRB640 Robot Pendant

Euchner ZS Switches

In addi­tion to the pen­dant enabling devices, addi­tional enabling devices are required where more than one worker is required inside the dan­ger zone of the machine. These devices can be pur­chased sep­a­rately and added to sys­tems as needed. Depending on the appli­ca­tion, you can get these devices with emer­gency stop but­tons and jog but­tons inte­grated into a sin­gle unit as shown in the pic­ture of the Euchner ZS switches.

Machinery Standards and Definitions

Enabling devices are one of those pro­tec­tive mea­sures that can­not be read­ily clas­si­fied as a safe­guard­ing device because they do not proac­tively pre­vent injury. INstead, like an emer­gency stop, they may allow a worker to avert or limit harm that is already occur­ing. That makes the enabling device a ‘com­ple­men­tary pro­tec­tive mea­sure’.

Let’s take a minute to look at a cou­ple of impor­tant def­i­n­i­tions from the machin­ery stan­dards. At the moment, the best def­i­n­i­tion for a com­ple­men­tary pro­tec­tive mea­sure comes from the Canadian stan­dard, CSA Z432-​​04. Excerpted from CSA Z432-​​04, §6.2.3.5.3 Complementary Protective Measures:

Protective mea­sures that are nei­ther inher­ently safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/​or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­mented as required by the intended use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­ited to,

a) emer­gency stop;

b) means of res­cue of trapped per­sons; and

c) means of energy iso­la­tion and dissipation.

Let’s also look at the for­mal def­i­n­i­tion of an ‘enabling device’ in the same standard:

7.23.3 Enabling devices
7.23.3.1
An enabling device is an addi­tional man­u­ally oper­ated 2– or 3-​​position con­trol device used in con­junc­tion with a start con­trol and which, when con­tin­u­ously actu­ated in one posi­tion only, allows a machine to func­tion. In any other posi­tion, motion is stopped or a start is prevented.

7.23.3.2
Enabling devices shall have the fol­low­ing features:

a) They shall be con­nected to a Category 0 or a Category 1 stop (see NFPA 79).

b) They shall be designed in accor­dance with ergonomic principles:

(i) posi­tion 1 is the off func­tion of the switch (actu­a­tor is not operated);

(ii) posi­tion 2 is the enabling func­tion (actu­a­tor is oper­ated); and

(iii) posi­tion 3 (if used) is the off func­tion of the switch (actu­a­tor is not oper­ated past its mid position).

c) Three-​​position enabling devices shall be designed to require man­ual oper­a­tion in order to reach posi­tion 3.

d) When return­ing from posi­tion 3 to posi­tion 2, the func­tion shall not be enabled.

e) An enabling device shall auto­mat­i­cally return to its off func­tion when its actu­a­tor is not man­u­ally held in the enabling position.

Note: Tests have shown that human reac­tion to an emer­gency may be to release an object or to hold on tighter, thus com­press­ing an enabling device. The ergonomic issues of sus­tained acti­va­tion should be con­sid­ered dur­ing design and instal­la­tion of the enabling device.

OMRON A4EG Enabling Switches

Similar def­i­n­i­tions exist in the International, European and US stan­dards, although they may not be quite as formalized.

Most enabling devices on their own do noth­ing except PERMIT motion to take place, although the actual def­i­n­i­tion of enabling device in CSA Z432 actu­ally per­mits the enabling device to cause motion. Absence of the enabling sig­nal pre­vents or stops motion. These devices are then used in con­junc­tion with hold-​​to-​​run con­trols on robots and machin­ery, and with throt­tle con­trols on trains, street cars, sub­ways and sim­i­lar equip­ment. Note that most stan­dards to not per­mit enabling devices to actu­ally cause motion. This is a unique sit­u­a­tion in the Canadian standard.

So what’s the big deal?

Using the terms ‘dead-​​man’ or ‘live-​​man’ to describe these devices puts the wrong mes­sage out as far as I’m con­cerned. As safety engi­neers and OHS prac­ti­tion­ers, we care about keep­ing work­ers out of dan­ger. This is nei­ther check­ing to see if we have either a ‘dead man’ or a ‘live man’, but rather ensur­ing that the per­son in con­trol of the equip­ment is ‘in con­trol’.  Using a phrase like ‘enabling device’ clearly says what the device does.

In my opin­ion, and  sup­ported by the cur­rent International and Canadian Standards, these terms must be aban­doned in favour of ‘enabling device’ and the qual­i­fiers ‘2-​​position enabling device’ and ‘3-​​position enabling device’. These terms are also used in many of the cur­rent machin­ery safety stan­dards, so using them cor­rectly improves clar­ity in writ­ing and speak­ing. Clarity in com­mu­ni­ca­tion in safety is too impor­tant for prac­ti­tion­ers to per­mit the ongo­ing use of terms that con­vey the wrong mes­sage and do not pro­mote clar­ity of mean­ing. Since clar­ity is often lack­ing when it comes to safety, any­thing we can do to improve our com­mu­ni­ca­tions should be high on our pri­or­ity list!

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://​www​.com​pli​an​cein​sight​.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog.

Doug’s work includes teach­ing machin­ery risk assess­ment tech­niques pri­vately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as pro­vid­ing tech­ni­cal ser­vices and train­ing pro­grams to clients related to risk assess­ment, indus­trial machin­ery safety, safety-​​related con­trol sys­tem inte­gra­tion and reli­a­bil­ity, laser safety and reg­u­la­tory conformity.

Connect me on Facebook | Twitter | Google + | LinkedIn | Website

Copyright secured by Digiprove © 2011Some Rights Reserved