More flip-​flopping on EN 954 – 1?

In recent posts I’ve been dis­cuss­ing the changes in the use of EN 954 – 1, Safety of Machinery – Safety Related Parts of Control Systems. Part 1: General Principles for Design. The EU ori­gin­ally announced that this stand­ard was to be with­drawn on 31-​Dec-​09, being replaced by EN ISO 13849 – 1. As you may know, there are sig­ni­fic­ant dif­fer­ences in these two stand­ards.

A later announce­ment from the European Commission repealed

In recent posts I’ve been dis­cuss­ing the changes in the use of EN 954 – 1, Safety of Machinery – Safety Related Parts of Control Systems. Part 1: General Principles for Design. The EU ori­gin­ally announced that this stand­ard was to be with­drawn on 31-​Dec-​09, being replaced by EN ISO 13849 – 1. As you may know, there are sig­ni­fic­ant dif­fer­ences in these two stand­ards.

A later announce­ment from the European Commission repealed the with­draw­al of EN 954 – 1, extend­ing its use until 31-​Dec-​12. This announce­ment was itself with­drawn.

So where do we stand today? Currently, EN 954 – 1 will be with­drawn on 31-​Dec-​09 and will be replaced by EN ISO 13849 – 1, UNLESS this decision is again reversed by the EC in con­sulta­tion with the EC Machinery Working Group. A meet­ing is planned for 7/​8-​Dec-​09 to dis­cuss this situ­ation and to resolve the con­fu­sion.

As a machine build­er, there is only one prudent course of action – imple­ment EN ISO 13849 – 1 in your designs. If the decision remains as it cur­rently stands, then your products will con­form to the require­ments on 31-​Dec-​09 and you will be able to con­tin­ue to ship product to the EU. If the decision is reversed by the EC and EN 954 – 1 remains in use until 2012, then you are three years ahead of the require­ment and should be using that to full advant­age in your mar­ket­ing and sales efforts.

My friend Jon Severn has a post related to this on his blog at MachineBuilding​.net.

EU changes direction on EN ISO 13849 – 1

Update on EN ISO 13849 – 1 man­dat­ory imple­ment­a­tion date.

In a post on 15-​Sep I repor­ted that the European Union had decided to delay the man­dat­ory imple­ment­a­tion date of  EN ISO 13849 – 1 for an addi­tion­al three years. This report was based on inform­a­tion obtained from an intern­al source at the European Commission and has since been reversed by that same source.

Mr. Glyn Garside provided the fol­low­ing update to this import­ant story:

It has been widely repor­ted, but nev­er con­firmed, that the EU com­mis­sion had accep­ted the CEN pro­pos­al to extend the date of ces­sa­tion of pre­sump­tion of con­form­ity of EN 954 – 1:1996 until the end of 2012. THESE REPORTS HAVE NOW BEEN AUTHORITATIVELY DENIED.

(By the way, this dis­cus­sion of dates of ces­sa­tion of pre­sump­tion of con­form­ity only affects the European stand­ards, EN 954 – 1 and EN ISO 13849 – 1. International stand­ard ISO 13849 – 1 is obvi­ously con­trolled by ISO and not by CEN or the EU. The cur­rent edi­tion of ISO 13849 – 1 is 2006, essen­tially identic­al to EN ISO 13849 – 1 : 2008.)

At this point the pos­sib­il­ity of an exten­sion of the trans­ition from EN 954 – 1 to EN ISO 13849 – 1 remains con­tro­ver­sial, con­fused and IMHO uncer­tain. (There’s been approx 3 years trans­ition peri­od already.) If I were still a man­u­fac­turer, I would not want to wait until Dec 29th to find out if I could still ship my product using EN 954 – 1!

The reports of an exten­sion were based on an email sent earli­er this month (3rd Sept) by a CEN employ­ee. However, the EU Commission nev­er con­firmed the report, and on September 24th the same CEN employ­ee, Marie Poidevin, has writ­ten,
— —  —  —  — –
> “We have been informed today by the European Commission […] that con­trary to what was expressed in
> my pre­vi­ous mes­sage sent on the 3rd of September, EN 954 – 1 will not give pre­sump­tion of con­form­ity
>  to the new MD 2006/​42/​EC until fur­ther notice.
> “Indeed, due to dis­cus­sions fol­low­ing the announce­ment made below, the EC wishes to gath­er experts’
> views and, there­fore, this issue will be dis­cussed at the next Machinery Working group to be held on
> the 7 – 8th December.”
— —  —  —  — –

A related email from Ian Fraser (“EC Policy Director for the Machinery Directive”), dated 2009-​09-​18 states,
— —  —  —  — –
“Following the dis­cus­sion at the meet­ing of the Machinery Working Group held on 7 and 8
July 2009, we have received a num­ber of ques­tions con­cern­ing the trans­ition from stand­ard
EN 954 – 1 to stand­ard EN ISO 13849 – 1 on safety-​related parts of con­trol sys­tems.
At the meet­ing of the Machinery Working Group, there was gen­er­al agree­ment on two
aspects:
1. Manufacturers who apply stand­ard EN ISO 13849 – 1 bene­fit from a pre­sump­tion of
con­form­ity, even if the har­mon­ised C-​type stand­ard relat­ing to the machinery con­cerned still
refers to the cat­egor­ies of EN 954 – 1;
2. Harmonised C-​type stand­ards that refer to the cat­egor­ies of EN 954 – 1 con­tin­ue to con­fer a
pre­sump­tion of con­form­ity until they are amended to refer to stand­ard EN ISO 13849 – 1.
These con­clu­sions will be recor­ded in the minutes of the meet­ing.

During the dis­cus­sion, sev­er­al par­ti­cipants indic­ated that more time was needed for the
industry, and in par­tic­u­lar for SMEs, to adapt to the new stand­ard. As Chairman of the
meet­ing, I asked wheth­er it might not be prefer­able to post­pone the date of ces­sa­tion of
pre­sump­tion of con­form­ity for EN 954 – 1.
In response to this sug­ges­tion, on 30 July 2009, Mr. Steiger wrote to the Commission, on
behalf of the CEN Machinery Sector, to request that the date of ces­sa­tion of pre­sump­tion of
con­form­ity for EN 954 – 1 be excep­tion­ally post­poned until 31 December 2012 […].
The Commission will reply to this request from CEN. However, giv­en the com­plex­ity of the
issues involved, the Commission intends to con­sult experts and to seek the opin­ion of the
Machinery Working Group to be held on 7 and 8 December 2009, before reach­ing a final
decision.
Kind regards,
Ian FRASER
— —  —  — —

Thanks again to Glyn Garside and the EMC-​PSTC List Server!

Emergency Stop – What’s so confusing about that?

This entry is part 1 of 11 in the series Emergency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decept­ively simple con­cepts that has man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-​specific stand­ards

This entry is part 1 of 11 in the series Emergency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decept­ively simple con­cepts that has man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-​specific stand­ards man­date the require­ment for emer­gency stop, such as CSA Z434-​03, where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity and work cells integ­rat­ing robots are also required to have emer­gency stop cap­ab­il­ity.

Defining Emergency Stop

Old, non-compliant, E-Stop Button
This OLD but­ton is def­in­itely non-​compliant.

So what is an Emergency Stop, or e-​stop, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-​04:

Emergency situ­ation — an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or dam­age.

Emergency stop — a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in pro­gress.

Emergency stop but­ton — a red mushroom-​headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

and one more:

6.2.3.5.3 Complementary pro­tect­ive meas­ures
Following the risk assess­ment, the meas­ures in this clause either shall be applied to the machine or shall be dealt with in the inform­a­tion for use.

Protective meas­ures that are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/​or pro­tect­ive devices), nor inform­a­tion for use may have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine. Such meas­ures shall include, but not be lim­ited to,

a) emer­gency stop;

b) means of res­cue of trapped per­sons; and

c) means of energy isol­a­tion and dis­sip­a­tion.

Modern, non-compliant e-stop button.
This more mod­ern but­ton is non-​compliant due to the RED back­ground and spring-​return but­ton.

So, an e-​stop is a sys­tem that is inten­ded for use in Emergency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard, but is con­sidered to be a Complementary Protective Measure. In terms of the Hierarchy of Controls, emer­gency stop sys­tems fall into the same level as Personal Protective Equipment like safety glasses, safety boots and hear­ing pro­tec­tion. So far so good.

Is an Emergency Stop Required?

Depending on the reg­u­la­tions and the stand­ards you choose to read, machinery is may not be required to have an Emergency Stop. Quoting from CSA Z432-​04:

6.2.5.2.1 Components and ele­ments to achieve the emer­gency stop func­tion
If, fol­low­ing a risk assess­ment, it is determ­ined that in order to achieve adequate risk reduc­tion under emer­gency cir­cum­stances a machine must be fit­ted with com­pon­ents and ele­ments neces­sary to achieve an emer­gency stop func­tion so that actu­al or impend­ing emer­gency situ­ations can be con­trolled, the fol­low­ing require­ments shall apply:

a) The actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible, and read­ily access­ible.

b) The haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards.
If this is not pos­sible or the risk can­not be adequately reduced, this may indic­ate that an emer­gency stop func­tion may not be the best solu­tion (i.e., oth­er solu­tions should be sought). (Bolding added for emphas­is – DN)

c) The emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where neces­sary.

Later in CSA Z432-​04 we find clause 7.17.1.2:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion shall have a manu­ally ini­ti­ated emer­gency stop device.

To my know­ledge, this is the only gen­er­al level machinery stand­ard that makes this require­ment. Product fam­ily stand­ards often make spe­cif­ic require­ments, based on the opin­ion of the Technical Committee respons­ible for the stand­ard and their know­ledge of the spe­cif­ic type of machinery covered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see NFPA 79 or IEC 60204 – 1.

Download NFPA stand­ards through ANSI

This more modern button is still wrong due to the RED background.
This more mod­ern but­ton is non-​compliant due to the RED back­ground.

If you read Ontario’s Industrial Establishments Regulation (Regulation 851), you will find that the only require­ment for an emer­gency stop is that it is prop­erly iden­ti­fied and loc­ated “with­in easy reach” of the oper­at­or. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Internationally, a RED oper­at­or device on a YELLOW back­ground, with or without any text behind it, is recog­nised as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. I’ve scattered some examples of dif­fer­ent com­pli­ant and non-​compliant e-​stop devices through this art­icle.

The EU Machinery Directive, 2006/​42/​EC, and Emergency Stop

Interestingly, the European Union has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quoting from Annex I of the Machinery Directive:

1.2.4.3. Emergency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Complementary Protective Measures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-​held and/​or hand-​guided machinery.

From these two bul­lets it becomes clear that, just as in the Canadian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-​stop sys­tem, then it should not be included in the design.

Carrying on with the same clause:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Canadian and US reg­u­la­tions. The dir­ect­ive goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emergency stop devices must be a back-​up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-​stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-​stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed. Point of Clarification: I had a ques­tion come from a read­er ask­ing if com­bin­ing the e-​stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­ist­ics:
  • The device must latch in the activ­ated pos­i­tion;
  • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
  • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-​return to the neut­ral pos­i­tion.

The second sen­tence har­mon­ises with the require­ments of the Canadian and US stand­ards.

Finally, the last sen­tence har­mon­ises with the idea of “Complementary Protective Measures” as described in CSA Z432.

How Many and Where?

Where? “Within easy reach”. Consider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points… you get the idea. Anywhere you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e-​stop device. “Easy Reach” I inter­pret as with­in the arm-​span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). This trans­lates to 500 – 600 mm either side of the centre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/​start ana­lys­is. Identify all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Consider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. This is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hierarchy of Controls), look at what risks you might con­trol with an Emergency Stop. Remember that e-​stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can’t just default down to an emer­gency stop. IF the e-​stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Control Reliability Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 is the ref­er­ence stand­ard for Canada and the USA, and you can find very sim­il­ar require­ments in IEC 60204 – 1 if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines.

Download NFPA stand­ards through ANSI
Download IEC stand­ards, International Electrotechnical Commission stand­ards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reliability is not addressed in these sec­tions. Quoting from the stand­ard:

9.2.2 Stop Functions. The three cat­egor­ies of stop func­tions shall be as fol­lows:

(1) Category 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actu­at­ors.

(2) Category 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then remove power when the stop is achieved.

(3) Category 2 is a con­trolled stop with power left avail­able to the machine actu­at­ors.

This E-Stop Button is correct.
This E-​Stop but­ton is CORRECT. Note the Push-​Pull-​Twist oper­at­or and the YELLOW back­ground.

A bit later, the stand­ards says:

9.2.5.3 Stop.
9.2.5.3.1 Each machine shall be equipped with a Category 0 stop.

9.2.5.3.2 Category 0, Category 1, and/​or Category 2 stops shall be provided where indic­ated by an ana­lys­is of the risk assess­ment and the func­tion­al require­ments of the machine. Category 0 and Category 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Category 0 shall take pri­or­ity. Stop func­tion shall oper­ate by de-​energizing that rel­ev­ant cir­cuit and shall over­ride related start func­tions.

Note that 9.2.5.3.1 does NOT mean that every machine must have an e-​stop. It simply says that every machine must have a way to stop the machine that is equi­val­ent to “pulling the plug”. The main dis­con­nect on the con­trol pan­el can be used for this func­tion if sized and rated appro­pri­ately. For cord con­nec­ted equip­ment, the plug and sock­et used to provide power to the equip­ment can also serve this func­tion. The ques­tion of HOW to effect the Category 0 stop depends on WHEN it will be used – i.e. is it being used for a safety-​related func­tion? What risks must be reduced, or what haz­ards must be con­trolled by the stop func­tion?

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.2. You just can’t get away from it…

Control Reliability

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Disconnect with E-​Stop Colours indic­ates that this device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the degree of reli­ab­il­ity required. In Canada, CSA Z432 gives us these cat­egor­ies: SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL MONITORED and CONTROL RELIABLE. These cat­egor­ies are being replaced slowly by Performance Levels (PL) as defined in ISO 13849 – 1 2007.

The short answer is that the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required. In many cases, a SINGLE CHANNEL or SINGLE CHANNEL MONITORED solu­tion may be accept­able, par­tic­u­larly when there are more reli­able safe­guards in place. On the oth­er hand, you may require CONTROL RELIABLE designs if the e-​stop is the primary risk reduc­tion for some risks or spe­cif­ic tasks.

To add to the con­fu­sion, ISO 13849 – 1 appears to exclude com­ple­ment­ary pro­tect­ive meas­ures from its scope in Table 8 — Some International Standards applic­able to typ­ic­al machine safety func­tions and cer­tain of their char­ac­ter­ist­ics. At the very bot­tom of this table, Complementary Protective Measures are lis­ted, but they appear to be excluded from the stand­ard. I can say that there is noth­ing wrong with apply­ing the tech­niques in ISO 13849 – 1 to the reli­ab­il­ity ana­lys­is of a com­ple­ment­ary pro­tect­ive meas­ure that uses the con­trol sys­tem, so do this if it makes sense in your applic­a­tion.

ISO 13849-1:2006 Table 8
ISO 13849 – 1:2006 Table 8

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in the above photo is a) upside down, and b) using a non-​standard light­ing flash. Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts.

Use of Emergency Stop as part of a Lockout Procedure or HECP.

One last note: Emergency stop sys­tems (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-​stop) CANNOT be used for energy isol­a­tion in a Hazardous Energy Control Procedure (a.k.a. Lockout). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 for more on that sub­ject.

Read our Article on Using E-​Stops in Hazardous Energy Control Procedures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Pneumatic E-​Stop/​Isolation device.

Standards Referenced in this post:

CSA Z432-​04, Safeguarding of Machinery

NFPA 79 – 07, Electrical Standard for Industrial Machinery 
Download NFPA stand­ards at ANSI

IEC 60204 – 1:09,  SAFETY OF MACHINERYELECTRICAL EQUIPMENT OF MACHINESPART 1: GENERAL REQUIREMENTS

Download IEC stand­ards, International Electrotechnical Commission stand­ards.

ISO 13849−1−2006, Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design

See also

ISO 13850:06, SAFETY OF MACHINERYEMERGENCY STOPPRINCIPLES FOR DESIGN

Download IEC stand­ards, International Electrotechnical Commission stand­ards.
Download ISO Standards