ESA Manufacturer Registration in Ontario, Canada

Do you make elec­tri­cal prod­ucts sold in Ontario, Cana­da? Are you aware of the need to reg­is­ter your com­pa­ny with the Elec­tri­cal Safe­ty Author­i­ty (ESA) in order to sell your prod­ucts legal­ly? If not, spend some time and catch up on the new ESA Manufacturer’s Reg­istry!

Electrical Safety Authority LogoThis sto­ry updat­ed 4-Feb-2014.

Since Feb­ru­ary 17th, 2009, there has been an inter­est­ing dis­cus­sion thread on the PSES’s EMC-PSTC list on the new Manufacturer’s Reg­istry in the Province of Ontario, Cana­da. Since there was so much inter­est, I decid­ed to try to sum­ma­rize things here.

Back­ground

Ontario is the sec­ond old­est and the most pop­u­lous Province in Cana­da, with 12,160,282 peo­ple as of the 2006 cen­sus. Cana­da has 10 Provinces and three Ter­ri­to­ries. Ontario is Canada’s man­u­fac­tur­ing heart­land and is often a leader in new leg­is­la­tion.

ESA, or the Elec­tri­cal Safe­ty Author­i­ty as they are more prop­er­ly known, is the Author­i­ty Hav­ing Juris­dic­tion (AHJ) in the Province of Ontario, Cana­da. This means that they are autho­rized by the Gov­ern­ment of Ontario to reg­u­late elec­tri­cal safe­ty in the Province. ESA was for­mer­ly the inspec­tion arm of Ontario Hydro, a crown cor­po­ra­tion dis­solved in 1998. ESA pro­vides build­ing and equip­ment elec­tri­cal inspec­tion ser­vices to the pub­lic and indus­try in the Province, and pub­lish­es the Ontario Elec­tri­cal Code. The Code is adapt­ed direct­ly from CSA’s Cana­di­an Elec­tri­cal Code — Part 1 (CSA C22.1), with Provin­cial devi­a­tions.

On 1-Aug-07, the Min­istry of Small Busi­ness and Con­sumer Ser­vices filed Ontario Reg­u­la­tion 438/07, Prod­uct Safe­ty. This new reg­u­la­tion enables the Elec­tri­cal Safe­ty Author­i­ty to reg­u­late the safe­ty of elec­tri­cal prod­ucts and equip­ment sold and used in Ontario.

The reg­u­la­tion was phased in to ensure that ESA and stake­hold­ers had enough time to devel­op tech­ni­cal guid­ance to sup­port the reg­u­la­tion.

  • On 1-Oct-07 the sec­tions of the reg­u­la­tion that gov­ern approval of elec­tri­cal prod­ucts (cur­rent­ly con­tained in the Ontario Elec­tri­cal Safe­ty Code) and that allow notice be giv­en to the pub­lic of unsafe elec­tri­cal prod­ucts came into effect.
  • On 1-Jan-08 oth­er sec­tions relat­ing to ESA’s inves­tiga­tive and order-mak­ing pow­ers came into effect.
  • On 1-Jul-08 sec­tions of the reg­u­la­tion requir­ing orga­ni­za­tions to report seri­ous elec­tri­cal inci­dents or defects came into effect.
  • On 1-Apr-09 the Reg­istry will open and man­u­fac­tur­ers can begin to reg­is­ter with ESA. For man­u­fac­tur­ers cur­rent­ly sell­ing prod­ucts in Ontario, reg­is­tra­tions must be com­plet­ed by 30-Aug-09. This require­ment is cur­rent­ly post­poned. For more infor­ma­tion, see this arti­cle. If your com­pa­ny wants to begin sell­ing prod­ucts in Ontario, the com­pa­ny must reg­is­ter before prod­ucts can be sold.

What is the Reg­istry?

Recent Changes in the Ontario Elec­tric­i­ty Act have increased the require­ments for report­ing of “seri­ous inci­dents” with elec­tri­cal ori­gins. These require­ments are found in Ontario Reg­u­la­tion 438 on Prod­uct Safe­ty. In the past, sig­nif­i­cant num­bers of injuries caused by either unap­proved equip­ment, or fraud­u­lent­ly marked equip­ment have occurred. When ESA has inves­ti­gat­ed the equip­ment, they run into prob­lems with find­ing the orig­i­na­tor of the gear, and there­fore the per­son or com­pa­ny who bears respon­si­bil­i­ty for the prob­lem. The new addi­tions to the reg­u­la­tion address this by requir­ing report­ing of severe injuries caused by elec­tri­cal equip­ment. In order to improve trace­abil­i­ty of elec­tri­cal prod­ucts sold in Ontario, ESA intro­duced the Manufacturer’s Reg­istry, and made it manda­to­ry under their author­i­ty as the AHJ in Ontario. See the Ontario Reg­u­la­tion. Reg­is­tra­tion begins 1-Apr-09. Reg­is­tra­tion must be com­plet­ed by 30-Aug-09. The manda­to­ry Reg­is­tra­tion dead­line has been indef­i­nite­ly post­poned. A fee of $350 Cana­di­an dol­lars must be paid in the first year, with a reduced fee in each fol­low­ing year.

Man­u­fac­tur­ers of elec­tri­cal equip­ment for sale in Ontario are required to reg­is­ter with ESA, regard­less of whether they are locat­ed in Ontario or else­where. Fail­ure to reg­is­ter will mean that cer­ti­fied or labeled elec­tri­cal prod­ucts will be deemed to be unap­proved and non-com­pli­ant with the Ontario Elec­tri­cal Code. Under Reg­u­la­tion 438, it is ille­gal to sell, dis­play or use unap­proved elec­tri­cal prod­ucts [Sec­tion 5]. Under the Indus­tri­al Estab­lish­ments reg­u­la­tions (part of the Ontario Occu­pa­tion­al Health and Safe­ty Act), it is ille­gal to use unap­proved elec­tri­cal prod­ucts in the work­place [Sec­tion 40]. Sim­i­lar require­ments are also found in the Con­struc­tion Reg­u­la­tions (Ontario Reg­u­la­tion 213, Sec­tion 185).

More infor­ma­tion on the Reg­istry can be found on the ESA web site in the Prod­uct Safe­ty area. There are a num­ber of FAQ’s avail­able from this page as well. They include:

The reg­is­tra­tion is per man­u­fac­tur­er and NOT per prod­uct, so once you have reg­is­tered your com­pa­ny you do not need to re-reg­is­ter for every prod­uct.

Rec­og­nized elec­tri­cal safe­ty marks

ESA pro­vides a list of all of the Cer­ti­fi­ca­tion and Inspec­tion marks that are rec­og­nized in the province. As long as your prod­uct or the prod­ucts you are sell­ing bear one of these marks, the prod­uct can be dis­played, sold or used in the Province, pre­sum­ing the man­u­fac­tur­er is reg­is­tered.

View the list of Rec­og­nized Marks and Field Eval­u­a­tion Labels.

What is a ‘seri­ous inci­dent’?

Reg­u­la­tion 438 defines a seri­ous inci­dent in Sec­tion 1:

seri­ous elec­tri­cal inci­dent or acci­dent” means an elec­tri­cal inci­dent or acci­dent that,

(a) results in death or seri­ous injury to a per­son,

(b) has the poten­tial to cause death or a risk of seri­ous injury to a per­son, or

© caus­es or has the poten­tial to cause sub­stan­tial prop­er­ty dam­age.

Report­ing Require­ments

Once your com­pa­ny has reg­is­tered with ESA, any seri­ous inci­dents occur­ring any­where you mar­ket your prod­ucts becomes reportable, but only for prod­ucts sold in Ontario.

Quot­ing from Reg­u­la­tion 438:

8. (1)  A man­u­fac­tur­er, whole­saler, importer, prod­uct dis­trib­u­tor or retail­er that becomes aware of a seri­ous elec­tri­cal inci­dent or acci­dent or a defect in the design, con­struc­tion or func­tion­ing of an elec­tri­cal prod­uct or device that affects or is like­ly to affect the safe­ty of any per­son or cause dam­age to prop­er­ty, shall report to the Author­i­ty as soon as prac­ti­ca­ble after becom­ing aware of the seri­ous elec­tri­cal inci­dent or acci­dent or defect.

(2)  A cer­ti­fi­ca­tion body or field eval­u­a­tion agency that becomes aware of a seri­ous elec­tri­cal inci­dent or acci­dent or a defect in the design, con­struc­tion or func­tion­ing of an elec­tri­cal prod­uct or device that was the sub­ject of a report giv­en by the cer­ti­fi­ca­tion body or field eval­u­a­tion agency that affects or is like­ly to affect the safe­ty of any per­son or cause dam­age to prop­er­ty shall report to the Author­i­ty as soon as prac­ti­ca­ble after becom­ing aware of the seri­ous elec­tri­cal inci­dent or acci­dent or defect.

There is more to Sec­tion 8 of the reg­u­la­tion than quot­ed. Addi­tion­al sub­sec­tions include infor­ma­tion on what needs to be in the report and who needs to be involved in the inves­ti­ga­tion. If you need to make a report, check the rest of Sec­tion 8 first.

For exam­ple, say that your com­pa­ny man­u­fac­tures a wid­get, Mod­el 1523. Mod­el 1523 is sold in the USA, Ontario Cana­da, Mex­i­co and India. The com­pa­ny also man­u­fac­tures a dif­fer­ent wid­get, Mod­el 2000, sold in the USA and Mex­i­co.

At some point, reports of elec­tri­cal shock and fires caused by Mod­el 2000 start to come into your Prod­uct Safe­ty depart­ment. Do you need to report this to ESA? NO — Mod­el 2000 is not sold in Ontario, so severe inci­dents caused by that mod­el do not require report­ing to ESA.

Mod­el 1523 has a clean record, so no report­ing is required there. After man­u­fac­tur­ing Mod­el 1523 for a few years, a key com­po­nent is changed for a cost reduced ver­sion from a dif­fer­ent sup­pli­er. Six months after the change, reports come in from Mex­i­co and India that users have been killed by elec­tric shock received from units of Mod­el 1523. After inves­ti­gat­ing the reports, your Prod­uct Safe­ty depart­ment deter­mines that the faulty units used the new com­po­nent. Do you need to report this to ESA? YES — because Mod­el 1523 is sold in Ontario.

Here’s anoth­er exam­ple. Your com­pa­ny imports elec­tri­cal prod­ucts from a num­ber of coun­tries and sells them whole­sale to large retail­ers, some of whom have stores in Ontario. Do you need to reg­is­ter? NO — But you can­not legal­ly sell prod­ucts from man­u­fac­tur­ers who are not reg­is­tered in Ontario.

What if the prod­ucts are import­ed into Ontario but are not sold to users in the Province, and are only ware­housed and whole­saled to retail­ers or oth­er dis­trib­u­tors out­side of Ontario? Do you need to reg­is­ter? NO — But you must com­ply with the require­ments in the oth­er juris­dic­tions where the prod­uct is sold. Check with the AHJ in each Province or Ter­ri­to­ry where your prod­ucts are sold to deter­mine the require­ments.

What if I become aware of seri­ous inci­dents that are occur­ring with prod­ucts I sell in Ontario? You MUST report them to ESA, whether you make the prod­uct, import, dis­trib­ute or retail it.

What Prod­ucts are Cov­ered by the Reg­u­la­tions?

  • Con­sumer elec­tri­cal prod­ucts;
  • Com­mer­cial elec­tri­cal prod­ucts;
  • Elec­tri­cal Med­ical Devices;
  • Indus­tri­al elec­tri­cal prod­ucts;
  • Wiring devices and prod­ucts;
  • Bat­tery-oper­at­ed devices used in Haz­ardous Loca­tions;
  • Bat­tery charg­ers used with bat­tery oper­at­ed prod­ucts;
  • Hard­wired and plug-in life safe­ty prod­ucts like Smoke Detec­tors and CO Detec­tors;
  • Cer­ti­fied com­po­nents used in any of the above.

Will this become a Cana­di­an Nation­al Sys­tem?

This is not yet known. There are dis­cus­sions going on with the oth­er Provinces and Ter­ri­to­ries, how­ev­er these are very pre­lim­i­nary stages. ESA has stat­ed that they are sup­port­ive of a Nation­al Pro­gram should it be devel­oped, but at this time these require­ments exist only in Ontario.

Tax Grab?

Some peo­ple have expressed the opin­ion that this is sim­ply a way to mask a new tax, since reg­is­tra­tion fees are payable on an annu­al basis. In fact, a means is required to fund the reg­istry, and the fees col­lect­ed are to be used for that pur­pose. See the Fund­ing Mod­el Report. Since ESA’s man­date is to pro­tect the peo­ple of Ontario from elec­tri­cal haz­ards, and since there are increas­ing num­bers of seri­ous inci­dents occur­ring where the prod­ucts turn out be be unap­proved or fraud­u­lent­ly marked, this is a rea­son­able way for the Author­i­ty to gain con­trol over the prod­ucts enter­ing the mar­ket­place, and to hold every­one in the sup­ply chain respon­si­ble for ensur­ing that only approved prod­ucts are sold in the Province.

Since there is no new mark­ing require­ment, and since rep­utable man­u­fac­tur­ers are already cer­ti­fy­ing or label­ing their prod­ucts for sale, and fur­ther­more since the reg­is­tra­tion fee is quite small for any orga­ni­za­tion sell­ing any quan­ti­ty of prod­uct in the Province, this is not an oner­ous require­ment. You are still free to have any SCC accred­it­ed body whose mark is rec­og­nized in Ontario do the cer­ti­fi­ca­tion work.

Will it work?

This is the big unknown. Cana­di­ans are known for cre­at­ing reg­istries in response to a per­ceived need to con­trol some­thing. Notable fail­ures include the Nation­al Do Not Call reg­istry was sup­posed to allow Cana­di­ans to reg­is­ter their phone num­bers with the gov­ern­ment, who was then requir­ing Cana­di­an based tele­mar­keters to scrub those num­bers from their call­ing data­bas­es. Unfor­tu­nate­ly this only pro­vid­ed num­bers to off-shore tele­mar­keters who are using the DNC Reg­istry lists as a way to get num­bers to call.

It’s unfair to group this reg­istry with the pre­vi­ous exam­ple for a num­ber of rea­sons. The imple­men­ta­tion of this reg­istry is dif­fer­ent from the pre­vi­ous exam­ple in intent and exe­cu­tion. Com­pli­ance is mon­i­tored by the entire sup­ply chain. It prob­a­bly stands a pret­ty good chance of work­ing. Time will tell!

Update on this story

4-Feb-2014

Since this sto­ry was orig­i­nal­ly writ­ten in March of 2009, all men­tion of the Manufacturer’s Reg­istry has dis­ap­peared from the ESA web site. When I have tried to con­tact peo­ple involved in the orig­i­nal roll out of the Reg­istry, they do not respond. I have asked for the oppor­tu­ni­ty to inter­view one per­son in par­tic­u­lar and have yet to receive any kind of reply.

It would seem that this pro­gram has been allowed to qui­et­ly die, how­ev­er the leg­is­la­tion that per­mit­ted it to be cre­at­ed in the first place remains unchanged. Depend­ing on the mood of those in charge, it could the­o­ret­i­cal­ly be brought back to life again.

Emergency Stop — What’s so confusing about that?

This entry is part 1 of 13 in the series Emer­gency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decep­tive­ly sim­ple con­cepts that has man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some prod­uct-spe­cif­ic stan­dards

Editor’s Note: Since we first pub­lished this arti­cle on emer­gency-stop in March of 2009, it has become our most pop­u­lar post of all time! We decid­ed it was time for a lit­tle refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN Feb-2018.

The Emer­gency Stop func­tion is one of those decep­tive­ly sim­ple con­cepts that have man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user. Some prod­uct-spe­cif­ic stan­dards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trollers are required to pro­vide emer­gency stop func­tion­al­i­ty, and work cells inte­grat­ing robots are also required to have emer­gency stop capa­bil­i­ty.

Defining Emergency Stop

Pho­to 1 — This OLD but­ton is def­i­nite­ly non-com­pli­ant.

Before we look at the emer­gency-stop func­tion itself, we need to under­stand what the word “emer­gency” implies. This may seem obvi­ous but bear with me for a minute. The word “emer­gency” has the root “emer­gent”, mean­ing “in the process of com­ing into being or becom­ing promi­nent” accord­ing to the Oxford Dic­tio­nary of Eng­lish. An emer­gency con­di­tion is, there­fore, some con­di­tion that is aris­ing and becom­ing promi­nent at the moment. This con­di­tion implies that the sit­u­a­tion is not some­thing fore­seen by the machine design­er, and there­fore there are no design fea­tures present to con­trol the con­di­tion.

So what is the Emer­gency Stop func­tion, or E-stop func­tion, and when do you need to have one? Let’s look at a few def­i­n­i­tions tak­en from CSA Z432-14 [2]:

Emer­gency sit­u­a­tion
an imme­di­ate­ly haz­ardous sit­u­a­tion that needs to be end­ed or avert­ed quick­ly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is intend­ed to avert harm or to reduce exist­ing haz­ards to per­sons, machin­ery, or work in progress.
Emer­gency stop but­ton
a red mush­room-head­ed but­ton that, when acti­vat­ed, will imme­di­ate­ly start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­men­tary pro­tec­tive mea­sures
Pro­tec­tive mea­sures which are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use, could have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine.

Old spring-return type of e-stop button with a plain red background legend plate.
Pho­to 2 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e-stop is a func­tion that is intend­ed for use in Emer­gency con­di­tions to try to lim­it or avert harm to some­one or some­thing. It isn’t a safe­guard but is con­sid­ered to be a Com­ple­men­tary Pro­tec­tive Mea­sure. Look­ing at emer­gency stop func­tions from the per­spec­tive of the Hier­ar­chy of Con­trols, emer­gency stop func­tions fall into the same lev­el as Per­son­al Pro­tec­tive Equip­ment like safe­ty glass­es, safe­ty boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stan­dards you choose to read, machin­ery may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­po­nents and ele­ments to achieve the emer­gency stop func­tion

If fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­po­nents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency sit­u­a­tions to be avert­ed, the fol­low­ing require­ments apply:

  • the actu­a­tors shall be clear­ly iden­ti­fi­able, clear­ly vis­i­ble and read­i­ly acces­si­ble;
  • the haz­ardous process shall be stopped as quick­ly as pos­si­ble with­out cre­at­ing addi­tion­al haz­ards, but if this is not pos­si­ble or the risk can­not be reduced, it should be ques­tioned whether imple­men­ta­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where nec­es­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

I added the bold text in the pre­vi­ous quo­ta­tion, because that state­ment, “If after a risk assess­ment…” is very impor­tant. Lat­er in [2, 7.15.1.2]:

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment deter­mines that the emer­gency stop func­tion will not con­tribute to risk con­trol.

Note: There could be sit­u­a­tions where an e-stop does not con­tribute to risk con­trol and alter­na­tives could be con­sid­ered in con­junc­tion with a risk assess­ment.

The bold­ing in the text in the pre­ced­ing para­graph was added for empha­sis. I want­ed to be sure that you caught this impor­tant bit of text. Not every machine requires an E-stop func­tion. The func­tion is only required where there is a ben­e­fit to the user unless a prod­uct-spe­cif­ic stan­dard requires it. In some cas­es, prod­uct-spe­cif­ic stan­dards often called “Type C” stan­dards, include spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­i­mum PLr or SILr, based on the opin­ion of the Tech­ni­cal Com­mit­tee respon­si­ble for the stan­dard and their knowl­edge of the par­tic­u­lar type of machin­ery cov­ered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tri­cal design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204–1.

Down­load NFPA stan­dards through ANSI

Pho­to 3 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontario’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (O. Reg. 851), you will find that prop­er iden­ti­fi­ca­tion of the emer­gency stop device(s) and loca­tion “with­in easy reach” of the oper­a­tor are the only require­ment. What does “prop­er­ly iden­ti­fied” mean? In Cana­da, the USA and Inter­na­tion­al­ly, a RED oper­a­tor device on a YELLOW back­ground, with or with­out any text on the back­ground, is rec­og­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switch­es or con­trol switch­es. You may also see the IEC sym­bol for emer­gency stop used to iden­ti­fy these devices.

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417–5638 — Sym­bol for “emer­gency stop” ©IEC.

I’ve scat­tered some exam­ples of dif­fer­ent com­pli­ant and non-com­pli­ant e-stop devices through this arti­cle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ing­ly, the Euro­pean Union has tak­en what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machin­ery Direc­tive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machin­ery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing dan­ger to be avert­ed.

Notice the words “…actu­al or impend­ing dan­ger…” This har­monis­es with the def­i­n­i­tion of Com­ple­men­tary Pro­tec­tive Mea­sures, in that they are intend­ed to allow a user to “avert or lim­it harm” from a haz­ard. Clear­ly, the direc­tion from the Euro­pean per­spec­tive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machin­ery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial mea­sures required to deal with the risk to be tak­en,
  • portable hand-held and/or hand-guid­ed machin­ery.

From these two bul­lets it becomes clear that, just as in the Cana­di­an and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is huge­ly impor­tant and often over­looked. If the risks can­not be con­trolled effec­tive­ly with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-stop sys­tem, then it should not be includ­ed in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clear­ly iden­ti­fi­able, clear­ly vis­i­ble and quick­ly acces­si­ble con­trol devices,
  • stop the haz­ardous process as quick­ly as pos­si­ble, with­out cre­at­ing addi­tion­al risks,
  • where nec­es­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sis­tent with the gen­er­al require­ments found in the Cana­di­an and US reg­u­la­tions. [3] goes on to define the func­tion­al­i­ty of the sys­tem in more detail:

Once active oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is specif­i­cal­ly over­rid­den; it must not be pos­si­ble to engage the device with­out trig­ger­ing a stop com­mand; it must be pos­si­ble to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tional at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing mea­sures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-stop devices to latch in the acti­vat­ed posi­tion. The last part of that sen­tence is even more impor­tant: “…dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a sec­ond dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-stop but­ton and hav­ing pow­er come back imme­di­ate­ly is not OK. Once that but­ton has been reset, a sec­ond action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol pow­er is need­ed.

Point of Clar­i­fi­ca­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machin­ery does not indi­cate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­is­tics:
    • The device must latch in the acti­vat­ed posi­tion;
    • The device must have a “neu­tral” posi­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset posi­tion must be dis­tinct from the pre­vi­ous two posi­tions, and the device must spring-return to the neu­tral posi­tion.

The sec­ond sen­tence har­mo­nizes with the require­ments of the Cana­di­an and US stan­dards. The last sen­tence har­mo­nizes with the idea of “Com­ple­men­tary Pro­tec­tive Mea­sures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sid­er the loca­tions where you EXPECT an oper­a­tor to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can rea­son­ably expect an oper­a­tor to be under nor­mal cir­cum­stances is a rea­son­able place to put an e-stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not intend­ed for use by chil­dren). The “easy reach” require­ment trans­lates to 500–600 mm either side of the cen­tre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start analy­sis. Iden­ti­fy all the nor­mal start­ing and stop­ping modes that you antic­i­pate on the equip­ment. Con­sid­er all of the dif­fer­ent oper­at­ing modes that you are pro­vid­ing, such as Auto­mat­ic, Man­u­al, Teach, Set­ting, etc. Iden­ti­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most juris­dic­tions today.

As you deter­mine your risk con­trol mea­sures (fol­low­ing the Hier­ar­chy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e-stops fall below safe­guards in the hier­ar­chy, so you must use a safe­guard­ing tech­nique if pos­si­ble, you can’t just default down to an emer­gency stop. IF the e-stop can pro­vide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Final­ly, once you deter­mine the need for an emer­gency stop sys­tem, you need to con­sid­er the system’s func­tion­al­i­ty and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stan­dard for Cana­da and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tri­cal stan­dard for machin­ery, CSA C22.2 #301 [5]. This stan­dard is intend­ed for cer­ti­fi­ca­tion of indus­tri­al machines. My opin­ion is that this stan­dard has some sig­nif­i­cant issues. You can find very sim­i­lar elec­tri­cal require­ments to this in [4] in IEC 60204–1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204–1 applies to the EU mar­ket for indus­tri­al machines and is tech­ni­cal­ly iden­ti­cal to [6].

Down­load NFPA stan­dards through ANSI
Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

Functional Stop Categories

NFPA 79 calls out three basic cat­e­gories of stop func­tions. Note that these cat­e­gories are NOT func­tion­al safe­ty archi­tec­tur­al cat­e­gories, but are cat­e­gories describ­ing stop­ping func­tions. Reli­a­bil­i­ty is not addressed in these sec­tions. Quot­ing from the stan­dard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride relat­ed start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ardous con­di­tions. The three cat­e­gories of stop func­tions shall be as fol­lows:

(1) Cat­e­go­ry 0 is an uncon­trolled stop by imme­di­ate­ly remov­ing pow­er to the machine actu­a­tors.

(2) Cat­e­go­ry 1 is a con­trolled stop with pow­er to the machine actu­a­tors avail­able to achieve the stop then pow­er is removed when the stop is achieved.

(3) Cat­e­go­ry 2 is a con­trolled stop with pow­er left avail­able to the machine actu­a­tors.

This E-Stop Button is correct.
Pho­to 4 — This E-Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­a­tor and the YELLOW back­ground.

A bit lat­er in the stan­dard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­e­go­ry 0, Cat­e­go­ry 1, and/or Cat­e­go­ry 2 stops shall be pro­vid­ed as deter­mined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­e­go­ry 0 and Cat­e­go­ry 1 stops shall be oper­a­tional regard­less of oper­at­ing modes, and Cat­e­go­ry 0 shall take pri­or­i­ty.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tec­tive devices and inter­locks shall be pro­vid­ed. Where applic­a­ble, the stop func­tion shall sig­nal the log­ic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­e­gories are aligned with sim­i­lar terms used with motor dri­ves. You may want to read this arti­cle if your machin­ery uses a motor dri­ve.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Pho­to 5 — Dis­con­nect with E-Stop Colours indi­cates that this dis­con­nect­ing device is intend­ed to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­e­go­ry of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can deter­mine the func­tion­al safe­ty require­ments. In Cana­da, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­di­an machin­ery into har­mo­niza­tion with the Inter­na­tion­al Stan­dards.

Emer­gency stop func­tions are required to pro­vide a min­i­mum of ISO 13849–1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that greater reli­a­bil­i­ty is required, the sys­tem can be designed to meet any high­er reli­a­bil­i­ty require­ment that is suit­able. Essen­tial­ly, the greater the risk reduc­tion required, the high­er the degree of reli­a­bil­i­ty required.

I’ve writ­ten exten­sive­ly about the appli­ca­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tri­cal haz­ard’ warn­ing label imme­di­ate­ly above the dis­con­nect han­dle in Pho­to 5 above is

a) upside down, and

b) using a non-stan­dard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­est­ed, here is the cor­rect ISO elec­tri­cal haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Pho­to 6 — Elec­tric Shock Haz­ard — IEC 60417–5036

You can find these labels at Clar­i­on Safe­ty Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switch­es used for e-stop) CANNOT be used for ener­gy iso­la­tion in an HECP — Haz­ardous Ener­gy Con­trol Pro­ce­dure (which includes Lock­out). Devices for this pur­pose must phys­i­cal­ly sep­a­rate the ener­gy source from the down­stream com­po­nents. See CSA Z460 [10] for more on that sub­ject.

Read our Arti­cle on Using E-Stops in Haz­ardous Ener­gy Con­trol Pro­ce­dures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Pho­to 7 — Pneu­mat­ic E-Stop/Iso­la­tion device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adopt­ed ISO 10218–1:2011, sec­ond edi­tion, 2011-07-01, with Cana­di­an devi­a­tions and ISO 10218–2:2011, first edi­tion, 2011-07-01, with Cana­di­an devi­a­tions). Cana­di­an Nation­al Stan­dard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machin­ery, CSA Stan­dard Z432. 2016

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machin­ery, and amend­ing Direc­tive 95/16/EC (recast). Brus­sels: Euro­pean Com­mis­sion, 2006.

[4]  Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery. ANSI/NFPA Stan­dard 79. 2015.

Down­load NFPA stan­dards at ANSI

[5] Indus­tri­al elec­tri­cal machin­ery. CSA Stan­dard C22.2 NO. 301. 2016. 

[6] Safe­ty of machin­ery — Elec­tri­cal Equip­ment of machines — Part 1: Gen­er­al require­ments. IEC Stan­dard 60204–1. 2016.  

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

[7] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1. 2015.

[8] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. ISO Stan­dard 13849–2. 2012.

[9] Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. IEC Stan­dard 62061+AMD1+AMD2. 2015.

[10] Safe­ty of machin­eryEmer­gency Stop—Principals for design. ISO Stan­dard 13850. 2015.

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
Down­load ISO Stan­dards

[11] Con­trol of haz­ardous energy—Lockout and oth­er meth­ods. CSA Stan­dard Z460. 2013.

 

 

Why Conventional EMC Testing is Insufficient for Functional Safety

At the recent PSES Sym­po­sium, I attend­ed a cou­ple of inter­est­ing work­shops on EMC and Func­tion­al Safe­ty. One was called “Work­shop on EMC & Func­tion­al Safe­ty” pre­sent­ed by Kei­th Arm­strong, Bill Radasky and Jacques Dela­balle. The oth­er was a paper pre­sen­ta­tion called “Why Con­ven­tion­al EMC Test­ing is Insuf­fi­cient for Func­tion­al Safe­ty” pre­sent­ed by Kei­th Arm­strong.

For read­ers who are new to the idea of Func­tion­al Safe­ty, this field deals

At the recent PSES Sym­po­sium, I attend­ed a cou­ple of inter­est­ing work­shops on EMC and Func­tion­al Safe­ty. One was called “Work­shop on EMC & Func­tion­al Safe­ty” pre­sent­ed by Kei­th Arm­strong, Bill Radasky and Jacques Dela­balle. The oth­er was a paper pre­sen­ta­tion called “Why Con­ven­tion­al EMC Test­ing is Insuf­fi­cient for Func­tion­al Safe­ty” pre­sent­ed by Kei­th Arm­strong.

For read­ers who are new to the idea of Func­tion­al Safe­ty, this field deals with the abil­i­ty of a prod­uct or sys­tem to func­tion in it’s intend­ed use envi­ron­ment, or in any fore­see­able use envi­ron­ments, while reli­ably pro­vid­ing the pro­tec­tion required by the users. Here’s the for­mal def­i­n­i­tion tak­en from IEC 61508–4:1998:


3.1.9
func­tion­al safe­ty
part of the over­all safe­ty relat­ing to the EUC and the EUC con­trol sys­tem which depends on the cor­rect func­tion­ing of the E/E/PE safe­ty-relat­ed sys­tems, oth­er tech­nol­o­gy safe­ty-relat­ed sys­tems and exter­nal risk reduc­tion facil­i­ties

3.2.3
equip­ment under con­trol (EUC)
equip­ment, machin­ery, appa­ra­tus or plant used for man­u­fac­tur­ing, process, trans­porta­tion, med­ical or oth­er activ­i­ties

NOTE — The EUC con­trol sys­tem is sep­a­rate and dis­tinct from the EUC.

Table 1: (E/E/PE) elec­tri­cal / elec­tron­ic / pro­gram­ma­ble elec­tron­ic

Reli­a­bil­i­ty require­ments are found in two key stan­dards, ISO 13849 and IEC 61508. These two stan­dards over­lap to some degree, and do not define reli­a­bil­i­ty cat­e­gories in the same way, which fre­quent­ly leads to con­fu­sion. In addi­tion there is a Machin­ery Sec­tor Spe­cif­ic stan­dard based on IEC 61508, called IEC 62061, Safe­ty of machin­ery – Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. These three stan­dards make ref­er­ence to EM effects on sys­tems but do not pro­vide guid­ance on how to assess these phe­nom­e­na. This is where IEC TS 61000–1-2 comes into play.

All three experts are mem­bers of IEC TC 77 and are direct­ly engaged in writ­ing the sec­ond edi­tion of IEC TS 61000–1-2 (more info on this at the bot­tom of this post). This IEC Tech­ni­cal Spec­i­fi­ca­tion deals with elec­tro­mag­net­ic (EM) effects on equip­ment that result in func­tion­al safe­ty prob­lems, like fail­ures in guard­ing cir­cuits, or fail­ures in some of the new pro­gram­ma­ble safe­ty sys­tems. This is becom­ing an increas­ing­ly impor­tant issue as pro­gram­ma­ble con­trols migrate into the tra­di­tion­al­ly hard­wired safe­ty world. In fact, Kei­th point­ed out that EM effects are present even in many of our “tried and true” cir­cuits, but the fail­ures have been incor­rect­ly attrib­uted to oth­er phe­nom­e­na because most elec­tri­cal engi­neers have not been used to think­ing about these phe­nom­e­na, espe­cial­ly in 24Vdc relay-based con­trol cir­cuits.

In the work­shop, the pre­sen­ters dis­cussed a typ­i­cal prod­uct life cycle, then went on to explore the typ­i­cal envi­ron­ments that a prod­uct may be exposed to, includ­ing the EM and phys­i­cal envi­ron­ments. They went on to dis­cuss the need for an EMC-relat­ed Risk Assess­ment and then fin­ished up by look­ing at Elec­tro­mag­net­ic Safe­ty Plan­ning. The whole work­shop took the entire sec­ond day of the Sym­po­sium.

A key point in the work­shop is that con­ven­tion­al EMC test­ing can­not prac­ti­cal­ly prove that sys­tems are safe. This is due to the struc­ture of the EMC tests that are nor­mal­ly under­tak­en, includ­ing the use of fixed mod­u­la­tion fre­quen­cies dur­ing immu­ni­ty test­ing, fail­ure to assess inter­mod­u­la­tion effects and many oth­er issues. In addi­tion, EMC test­ing does not and can­not test for aging effects on per­for­mance, wear & tear and oth­er use-relat­ed con­di­tions. The pre­sen­ters dis­cussed a num­ber of ways that these prob­lems could be addressed and ways that test­ing could be extend­ed in selec­tive ways to attack pre­dict­ed vul­ner­a­bil­i­ties. EMC test­ing does not con­sid­er the reli­a­bil­i­ty require­ments of the test­ed prod­uct (i.e. IEC 61508–1 SIL-3 or SIL-4).

On the fol­low­ing morn­ing, Kei­th Arm­strong pre­sent­ed his paper. In this paper, Mr. Arm­strong went into con­sid­er­able detail on the short­com­ings of con­ven­tion­al EMC test­ing when it comes to Func­tion­al Safe­ty. He sug­gest­ed some approach­es that could be used by man­u­fac­tur­ers to address these issues in safe­ty crit­i­cal appli­ca­tions.

The work­shop pre­sen­ta­tions and Mr. Armstong’s paper can be pur­chased through IEEE Xplore for those that did not attend the Sym­po­sium.

The IET has pub­lished a new book, avail­able for free from their web site, enti­tled Elec­tro­mag­net­ic Com­pat­i­bil­i­ty for Func­tion­al Safe­ty. This guide will be reviewed in a future post, so keep read­ing!

Kei­th Arm­strong, Bill Radasky and Jacques Dela­balle are mem­bers of IEC Tech­ni­cal Com­mit­tee 77, writ­ing IEC TS 61000–1-2 Ed 2.0, ELECTROMAGNETIC COMPATIBILITY (EMC) — PART 1–2: GENERALMETHODOLOGY FOR THE ACHIEVEMENT OF THE FUNCTIONAL SAFETY OF ELECTRICAL AND ELECTRONIC EQUIPMENT WITH REGARD TO ELECTROMAGNETIC PHENOMENA. Edi­tion 2 of this stan­dard should be pub­lished by Mar-2009 accord­ing to the IEC.

Kei­th Arm­strong is Prin­ci­pal Con­sul­tant at Cher­ry Clough Con­sul­tants in Broc­ton, UK.

Bill Radasky works with Metat­e­ch Cor­po­ra­tion from his office in Gole­ta, Cal­i­for­nia.

Jacques Dela­balle works for Schnei­der Elec­tric Indus­tries SAS in Greno­ble, France.