Understanding the Hierarchy of Controls

This entry is part 2 of 3 in the series Hier­ar­chy of Con­trols

Risk assess­ment is the first step in reduc­ing the risk that your cus­tomers and users are exposed to when they use your prod­ucts. The sec­ond step is Risk Reduc­tion, some­times called Risk Con­trol or Risk Mit­i­ga­tion. This arti­cle looks at the ways that risk can be con­trolled using the Hier­ar­chy of Con­trols. Fig­ure 2 from ISO 12100–1 (shown below) illus­trates this point.

The sys­tem is called a hier­ar­chy because you must apply each lev­el in the order that they fall in the list. In terms of effec­tive­ness at reduc­ing risk, the first lev­el in the hier­ar­chy, elim­i­na­tion, is the most effec­tive, down to the last, PPE*, which has the least effec­tive­ness.

It’s impor­tant to under­stand that ques­tions must be asked after each step in the hier­ar­chy is imple­ment­ed, and that is “Is the risk reduced as much as pos­si­ble? Is the resid­ual risk a) in com­pli­ance with legal require­ments, and b) accept­able to the user or work­er?”. When you can answer ‘YES’ to all of these ques­tions, the last step is to ensure that you have warned the user of the resid­ual risks, have iden­ti­fied the required train­ing need­ed and final­ly have made rec­om­men­da­tions for any need­ed PPE.

*PPE — Per­son­al Pro­tec­tive Equip­ment. e.g. Pro­tec­tive eye wear, safe­ty boots, bump caps, hard hats, cloth­ing, gloves, res­pi­ra­tors, etc. CSA Z1002 includes ‘…any­thing designed to be worn, held, or car­ried by an indi­vid­ual for pro­tec­tion against one or more haz­ards.’  in this def­i­n­i­tion.

Risk Reduction from the Designer's Viewpoint
ISO 12100:2010 — Fig­ure 2


Introducing the Hierarchy of Controls

The Hier­ar­chy of Con­trols was devel­oped in a num­ber of dif­fer­ent stan­dards over the last 20 years or so. The idea was to pro­vide a com­mon struc­ture that would pro­vide guid­ance to design­ers when con­trol­ling risk.

Typ­i­cal­ly, the first three lev­els of the hier­ar­chy may be con­sid­ered to be ‘engi­neer­ing con­trols’ because they are part of the design process for a prod­uct. This does not mean that they must be done by engi­neers!

We’ll look at each lev­el in the hier­ar­chy in detail. First, let’s take a look at what is includ­ed in the Hier­ar­chy.

The Hier­ar­chy of Con­trols includes:

1)    Haz­ard Elim­i­na­tion or Sub­sti­tu­tion (Design)
2)    Engi­neer­ing Con­trols (see [1, 2, 8, 9, 10, and 11])

a)    Bar­ri­ers

b)    Guards (Fixed, Mov­able w/interlocks)

c)    Safe­guard­ing Devices

d)    Com­ple­men­tary Pro­tec­tive Mea­sures

3)    Infor­ma­tion for Use (see [1, 2, 4, 7, 8, 12, and 13])

a)    Haz­ard Warn­ings

b)    Man­u­als

c)    HMI* & Aware­ness Devices (lights, horns)

4)    Admin­is­tra­tive Con­trols (see [1, 2, 4, 5, 7, and 8])

a)    Train­ing

b)    SOP’s,

c)    Haz­ardous Ener­gy Con­trol Pro­ce­dures (see [5, 14])

d)    Autho­riza­tion

5)    Per­son­al Pro­tec­tive Equip­ment

a)    Spec­i­fi­ca­tion

b)    Fit­ting

c)    Train­ing in use

d)    Main­te­nance

*HMI — Human-Machine Inter­face. Also called the ‘con­sole’ or ‘oper­a­tor sta­tion’. The loca­tion on the machine where the oper­a­tor con­trols are locat­ed. Often includes a pro­gram­ma­ble screen or oper­a­tor dis­play, but can be a sim­ple array of but­tons, switch­es and indi­ca­tor lights.

The man­u­fac­tur­er, devel­op­er or inte­gra­tor of the sys­tem should pro­vide the first three lev­els of the hier­ar­chy. Where they have not been pro­vid­ed, the work­place or user should pro­vide them.

The last two lev­els must be pro­vid­ed by the work­place or user.


Each lay­er in the hier­ar­chy has a lev­el of effec­tive­ness that is relat­ed to the fail­ure modes asso­ci­at­ed with the con­trol mea­sures and the rel­a­tive effec­tive­ness in reduc­ing risk in that lay­er. As you go down the hier­ar­chy, the reli­a­bil­i­ty and effec­tive­ness decrease as shown below.

Effectiveness of the Hierarchy of ControlsThere is no way to mea­sure or specif­i­cal­ly quan­ti­fy the reli­a­bil­i­ty or effec­tive­ness of each lay­er of the hier­ar­chy — that must wait until you make some selec­tions from each lev­el, and even then it can be very hard to do. The impor­tant thing to under­stand is that Elim­i­na­tion is more effec­tive than Guard­ing (engi­neer­ing con­trols), which is more effec­tive than Aware­ness Means, etc.

1. Hazard Elimination or Substitution

Hazard Elimination

Haz­ard elim­i­na­tion is the most effec­tive means of reduc­ing risk from a par­tic­u­lar haz­ard, for the sim­ple rea­son that once the haz­ard has been elim­i­nat­ed there is no remain­ing risk. Remem­ber that risk is a func­tion of sever­i­ty and prob­a­bil­i­ty. Since both sever­i­ty and prob­a­bil­i­ty are affect­ed by the exis­tence of the haz­ard, elim­i­nat­ing the haz­ard reduces the risk from that par­tic­u­lar haz­ard to zero. Some prac­ti­tion­ers con­sid­er this to mean the elim­i­na­tion is 100% effec­tive, how­ev­er it’s my opin­ion that this is not the case because even elim­i­na­tion has fail­ure modes that can re-intro­duce the haz­ard.

Failure Modes:

Haz­ard elim­i­na­tion can fail if the haz­ard is rein­tro­duced into the design. With machin­ery this isn’t that like­ly to occur, but in process­es, ser­vices and work­places it can occur.


Sub­sti­tu­tion requires the design­er to sub­sti­tute a less haz­ardous mate­r­i­al or process for the orig­i­nal mate­r­i­al or process. For exam­ple, beryl­li­um is a high­ly tox­ic met­al that is used in some high tech appli­ca­tions. Inhala­tion or skin con­tact with beryl­li­um dust can do seri­ous harm to a per­son very quick­ly, caus­ing acute beryl­li­um dis­ease. Long term expo­sure can cause chron­ic beryl­li­um dis­ease. Sub­sti­tut­ing a less tox­ic mate­r­i­al with sim­i­lar prop­er­ties in place of the beryl­li­um in the process  could reduce or elim­i­nate the pos­si­bil­i­ty of beryl­li­um dis­ease, depend­ing on the exact con­tent of the sub­sti­tute mate­r­i­al. If the sub­sti­tute mate­r­i­al includes any amount of beryl­li­um, then the risk is only reduced. If it con­tains no beryl­li­um, the risk is elim­i­nat­ed. Note that the risk can also be reduced by ensur­ing that the beryl­li­um dust is not cre­at­ed by the process, since beryl­li­um is not tox­ic unless ingest­ed.

Alter­na­tive­ly, using process­es to han­dle the beryl­li­um with­out cre­at­ing dust or par­ti­cles could reduce the expo­sure to the mate­r­i­al in forms that are like­ly to cause beryl­li­um dis­ease. An exam­ple of this could be sub­sti­tu­tion of water-jet cut­ting instead of mechan­i­cal saw­ing of the mate­r­i­al.

Failure Modes:

Rein­tro­duc­tion of the sub­sti­tut­ed mate­r­i­al into a process is the pri­ma­ry fail­ure mode, how­ev­er there may be oth­ers that are spe­cif­ic to the haz­ard and the cir­cum­stances. In the above exam­ple, pre- and post-cut­ting han­dling of the mate­r­i­al could still cre­ate dust or small par­ti­cles, result­ing in expo­sure to beryl­li­um. A sub­sti­tut­ed mate­r­i­al might intro­duce oth­er, new haz­ards, or might cre­ate fail­ure modes in the final prod­uct that would result in risks to the end user. Care­ful con­sid­er­a­tion is required!

If nei­ther elim­i­na­tion or sub­sti­tu­tion is pos­si­ble, we move to the next lev­el in the hier­ar­chy.

2. Engineering Controls

Engi­neer­ing con­trols typ­i­cal­ly include var­i­ous types of mechan­i­cal guards [16, 17, & 18], inter­lock­ing sys­tems [9, 10, 11, & 15], and safe­guard­ing devices like light cur­tains or fences, area scan­ners, safe­ty mats and two-hand con­trols [19]. These sys­tems are proac­tive in nature, act­ing auto­mat­i­cal­ly to pre­vent access to a haz­ard and there­fore pre­vent­ing injury. These sys­tems are designed to act before a per­son can reach the dan­ger zone and be exposed to the haz­ard.

Control reliability

Bar­ri­er guards and fixed guards are not eval­u­at­ed for reli­a­bil­i­ty because they do not rely on a con­trol sys­tem for their effec­tive­ness. As long as they are placed cor­rect­ly in the first place, and are oth­er­wise prop­er­ly designed to con­tain the haz­ards they are pro­tect­ing, then noth­ing more is required. On the oth­er hand, safe­guard­ing devices, like inter­locked guards, light fences, light cur­tains, area scan­ners, safe­ty mats, two-hand con­trols and safe­ty edges, all rely on a con­trol sys­tem for their effec­tive­ness. Cor­rect appli­ca­tion of these devices requires cor­rect place­ment based on the stop­ping per­for­mance of the haz­ard and cor­rect inte­gra­tion of the safe­ty device into the safe­ty relat­ed parts of the con­trol sys­tem [19]. The degree of reli­a­bil­i­ty is based on the amount of risk reduc­tion that is being required of the safe­guard­ing device and the degree of risk present in the unguard­ed state [9, 10].

There are many detailed tech­ni­cal require­ments for engi­neer­ing con­trols that I can’t get into in this arti­cle, but you can learn more by check­ing out the ref­er­ences at the end of this arti­cle and oth­er arti­cles on this blog.

Failure Modes

Fail­ure modes for engi­neer­ing con­trols are as many and as var­ied as the devices used and the meth­ods of inte­gra­tion cho­sen. This dis­cus­sion will have to wait for anoth­er arti­cle!

Awareness Devices

Of spe­cial note are ‘aware­ness devices’. This group includes warn­ing lights, horns, buzzers, bells, etc. These devices have some aspects that are sim­i­lar to engi­neer­ing con­trols, in that they are usu­al­ly part of the machine con­trol sys­tem, but they are also some­times classed as ‘infor­ma­tion for use’, par­tic­u­lar­ly when you con­sid­er indi­ca­tor or warn­ing lights and HMI screens. In addi­tion to these ‘active’ types of devices, aware­ness devices may also include lines paint­ed or taped on the floor or on the edge of a step or ele­va­tion change, warn­ing chains, sig­nage, etc. Sig­nage may also be includ­ed in the class of ‘infor­ma­tion for use’, along with HMI screens.

Failure Modes

Fail­ure modes for Aware­ness Devices include:

  • Ignor­ing the warn­ings (Com­pla­cen­cy or Fail­ure to com­pre­hend the mean­ing of the warn­ing);
  • Fail­ure to main­tain the device (warn­ing lights burned out or removed);
  • Defeat of the device (silenc­ing an audi­ble warn­ing device);
  • Inap­pro­pri­ate selec­tion of the device (invis­i­ble or inaudi­ble in the pre­dom­i­nat­ing con­di­tions).

Complementary Protective Measures

Com­ple­men­tary Pro­tec­tive mea­sures are a class of con­trols that are sep­a­rate from the var­i­ous types of safe­guard­ing because they gen­er­al­ly can­not pre­vent injury, but may reduce the sever­i­ty of injury or the prob­a­bil­i­ty of the injury occur­ring. Com­ple­men­tary pro­tec­tive mea­sures are reac­tive in nature, mean­ing that they are not auto­mat­ic. They must be man­u­al­ly acti­vat­ed by a user before any­thing will occur, e.g. press­ing an emer­gency stop but­ton. They can only com­ple­ment the pro­tec­tion pro­vid­ed by the auto­mat­ic sys­tems.

A good exam­ple of this is the Emer­gency Stop sys­tem that is designed into many machines. On its own, the emer­gency stop sys­tem will do noth­ing to pre­vent an injury. The sys­tem must be acti­vat­ed man­u­al­ly by press­ing a but­ton or pulling a cable. This relies on some­one detect­ing a prob­lem and real­iz­ing that the machine needs to be stopped to avoid or reduce the sever­i­ty of an injury that is about to occur or is occur­ring. Emer­gency stop can only ever be a back-up mea­sure to the auto­mat­ic inter­locks and safe­guard­ing devices used on the machine. In many cas­es, the next step in emer­gency response after press­ing the emer­gency stop is to call 911.

Failure Modes:

The fail­ure modes for these kinds of con­trols are too numer­ous to list here, how­ev­er they range from sim­ple fail­ure to replace a fixed guard or bar­ri­er fence, to fail­ure of elec­tri­cal, pneu­mat­ic or hydraulic con­trols. These fail­ure modes are enough of a con­cern that a new field of safe­ty engi­neer­ing called ‘Func­tion­al Safe­ty Engi­neer­ing’ has grown up around the need to be able to ana­lyze the prob­a­bil­i­ty of fail­ure of these sys­tems and to use addi­tion­al design ele­ments to reduce the prob­a­bil­i­ty of fail­ure to a lev­el we can tol­er­ate. For more on this, see [9, 10, 11].

Once you have exhaust­ed all the pos­si­bil­i­ties in Engi­neer­ing Con­trols, you can move to the next lev­el down in the hier­ar­chy.

3. Information for Use

This is a very broad top­ic, includ­ing man­u­als, instruc­tion sheets, infor­ma­tion labels on the prod­uct, haz­ard warn­ing signs and labels, HMI screens, indi­ca­tor and warn­ing lights, train­ing mate­ri­als, video, pho­tographs, draw­ings, bills of mate­ri­als, etc. There are some excel­lent stan­dards now avail­able that can guide you in devel­op­ing these mate­ri­als [1, 12 and 13].

Failure Modes:

The major fail­ure modes in this lev­el include:

  • Poor­ly writ­ten or incom­plete mate­ri­als;
  • Pro­vi­sion of the mate­ri­als in a lan­guage that is not under­stood by the user;
  • Fail­ure by the user to read and under­stand the mate­ri­als;
  • Inabil­i­ty to access the mate­ri­als when need­ed;
  • Etcetera.

When all pos­si­bil­i­ties for inform­ing the user have been cov­ered, you can move to the next lev­el down in the hier­ar­chy. Note that this is the usu­al sep­a­ra­tion point between the man­u­fac­tur­er and the user of a prod­uct. This is nice­ly illus­trat­ed in Fig 2 from ISO 12100 above. It is impor­tant to under­stand at this point that the resid­ual risk posed by the prod­uct to the user may not yet be tol­er­a­ble. The user is respon­si­ble for imple­ment­ing the next two lev­els in the hier­ar­chy in most cas­es. The man­u­fac­tur­er can make rec­om­men­da­tions that the user may want to fol­low, but typ­i­cal­ly that is the extent of influ­ence that the man­u­fac­tur­er will have on the user.

4. Administrative Controls

This lev­el in the hier­ar­chy includes:

  • Train­ing;
  • Stan­dard Oper­at­ing Pro­ce­dures (SOP’s);
  • Safe work­ing pro­ce­dures e.g. Haz­ardous Ener­gy Con­trol, Lock­out, Tagout (where per­mit­ted by law), etc.;
  • Autho­riza­tion; and
  • Super­vi­sion.

Train­ing is the method used to get the infor­ma­tion pro­vid­ed by the man­u­fac­tur­er to the work­er or end user. This can be pro­vid­ed by the man­u­fac­tur­er, by a third par­ty, or self-taught by the user or work­er.
SOP’s can include any kind of pro­ce­dure insti­tut­ed by the work­place to reduce risk. For exam­ple, requir­ing work­ers who dri­ve vehi­cles to do a walk-around inspec­tion of the vehi­cle before use, and log­ging of any prob­lems found dur­ing the inspec­tion is an exam­ple of an SOP to reduce risk while dri­ving.
Safe work­ing pro­ce­dures can be strong­ly influ­enced by the man­u­fac­tur­er through the infor­ma­tion for use pro­vid­ed. Main­te­nance pro­ce­dures for haz­ardous tasks pro­vid­ed in the main­te­nance man­u­al are an exam­ple of this.
Autho­riza­tion is the pro­ce­dure that an employ­er uses to autho­rize a work­er to car­ry out a par­tic­u­lar task. For exam­ple, an employ­er might put a pol­i­cy in place that only per­mits licensed elec­tri­cians to access elec­tri­cal enclo­sures and car­ry out work with the enclo­sure live. The employ­er might require that work­ers who may need to use lad­ders in their work take a lad­der safe­ty and a fall pro­tec­tion train­ing course. Once the pre­req­ui­sites for autho­riza­tion are com­plet­ed, the work­er is ‘autho­rized’ by the employ­er to car­ry out the task.
Super­vi­sion is one of the most crit­i­cal of the Admin­is­tra­tive Con­trols. Sound super­vi­sion can make all of the above work. Fail­ure to prop­er­ly super­vise work can cause all of these mea­sures to fail.

Failure Modes

Admin­is­tra­tive con­trols have many fail­ure modes. Here are some of the most com­mon:

  • Fail­ure to train;
  • Fail­ure to inform work­ers regard­ing the haz­ards present and the relat­ed risks;
  • Fail­ure to cre­ate and imple­ment SOP’s;
  • Fail­ure to pro­vide and main­tain spe­cial equip­ment need­ed to imple­ment SOP’s;
  • No for­mal means of autho­riza­tion — i.e. How do you KNOW that Joe has his lift truck license?;
  • Fail­ure to super­vise ade­quate­ly.

I’m sure you can think of MANY oth­er ways that Admin­is­tra­tive Con­trols can go wrong!

5. Personal Protective Equipment (PPE)

PPE includes every­thing from safe­ty glass­es, to hard­hats and bump caps, to fire-retar­dant cloth­ing, hear­ing defend­ers, and work boots. Some stan­dards even include warn­ing devices that are worn by the user, such as gas detec­tors and per­son-down detec­tors, in this group.
PPE is prob­a­bly the sin­gle most over-used and least under­stood risk con­trol mea­sure. It falls at the bot­tom of the hier­ar­chy for a num­ber of rea­sons:

  1. It is a mea­sure of last resort;
  2. It per­mits the haz­ard to come as close to the per­son as their cloth­ing;
  3. It is often incor­rect­ly spec­i­fied;
  4. It is often poor­ly fit­ted;
  5. It is often poor­ly main­tained; and
  6. It is often improp­er­ly used.

The prob­lems with PPE are hard to deal with. You can­not glue or screw a set of safe­ty glass­es to a person’s face, so ensur­ing the the pro­tec­tive equip­ment is used is a big prob­lem that goes back to super­vi­sion.

Many small and medi­um sized enter­pris­es do not have the exper­tise in the orga­ni­za­tion to prop­er­ly spec­i­fy, fit and main­tain the equip­ment.

User com­fort is extreme­ly impor­tant. Uncom­fort­able equip­ment won’t be used for long.

Final­ly, by the time that prop­er­ly spec­i­fied, fit­ted and used equip­ment can do it’s job, the haz­ard is as close to the per­son as it can get. The prob­a­bil­i­ty of fail­ure at this point is very high, which is what makes PPE a mea­sure of last resort, com­ple­men­tary to the more effec­tive mea­sures that can be pro­vid­ed in the first three lev­els of the hier­ar­chy.

If work­ers are not prop­er­ly trained and ade­quate­ly informed about the haz­ards they face and the rea­sons behind the use of PPE, they are deprived of the oppor­tu­ni­ty to make safe choic­es, even if that choice is to refuse the work.

Failure Modes

Fail­ure modes for PPE include:

  • Incor­rect spec­i­fi­ca­tion (not suit­able for the haz­ard);
  • Incor­rect fit (allows haz­ard to bypass PPE);
  • Poor main­te­nance (pre­vents or restricts vision or move­ment, increas­ing the risk; caus­es PPE fail­ure under stress or allows haz­ard to bypass PPE);
  • Incor­rect usage (fail­ure to train and inform users, incor­rect selec­tion or spec­i­fi­ca­tion of PPE).

Time to Apply the Hierarchy

So now you know some­thing about the ‘hier­ar­chy of con­trols’. Each lay­er has its own intri­ca­cies and nuances that can only be learned by train­ing and expe­ri­ence. With a doc­u­ment­ed risk assess­ment in hand, you can begin to apply the hier­ar­chy to con­trol the risks. Don’t for­get to iter­ate the assess­ment post-con­trol to doc­u­ment the degree of risk reduc­tion achieved. You may cre­ate new haz­ards when con­trol mea­sures are applied, and you may need to add addi­tion­al con­trol mea­sures to achieve effec­tive risk reduc­tion.

The doc­u­ments ref­er­enced below should give you a good start in under­stand­ing some of these chal­lenges.


5% Dis­count on All Stan­dards with code: CC2011

NOTE: [1], [2], and[3]  were com­bined by ISO and repub­lished as ISO 12100:2010. This stan­dard has no tech­ni­cal changes from the pre­ced­ing stan­dards, but com­bines them in a sin­gle doc­u­ment. ISO/TR 14121–2 remains cur­rent and should be used with the cur­rent edi­tion of ISO 12100.

[1]             Safe­ty of machin­ery – Basic con­cepts, gen­er­al prin­ci­ples for design – Part 1: Basic ter­mi­nol­o­gy and method­ol­o­gy, ISO Stan­dard 12100–1, 2003.
[2]            Safe­ty of machin­ery – Basic con­cepts, gen­er­al prin­ci­ples for design – Basic ter­mi­nol­o­gy and method­ol­o­gy, Part 2: Tech­ni­cal prin­ci­ples, ISO Stan­dard 12100–2, 2003.
[3]            Safe­ty of Machin­ery – Risk Assess­ment – Part 1: Prin­ci­ples, ISO Stan­dard 14121–1, 2007.
[4]            Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up, ISO 14118, 2000
[5]            Con­trol of haz­ardous ener­gy – Lock­out and oth­er meth­ods, CSA Z460, 2005
[6]            Flu­id pow­er sys­tems and com­po­nents – Graph­ic sym­bols and cir­cuit dia­grams – Part 1: Graph­ic sym­bols for con­ven­tion­al use and data-pro­cess­ing appli­ca­tions, ISO Stan­dard 1219–1, 2006
[7]            Pneu­mat­ic flu­id pow­er — Gen­er­al rules and safe­ty require­ments for sys­tems and their com­po­nents, ISO Stan­dard 4414, 1998
[8]            Amer­i­can Nation­al Stan­dard for Indus­tri­al Robots and Robot Sys­tems — Safe­ty Require­ments, ANSI/RIA R15.06, 1999.
[9]            Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design, ISO Stan­dard 13849–1, 2006
[10]          Safe­ty of machin­ery – Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems, IEC Stan­dard 62061, 2005
[11]           Func­tion­al safe­ty of electrical/electronic/programmable elec­tron­ic safe­ty-relat­ed sys­tems, IEC Stan­dard 61508-X, sev­en parts.
[12]          Prepa­ra­tion of Instruc­tions — Struc­tur­ing, Con­tent and Pre­sen­ta­tion, IEC Stan­dard 62079, 2001
[13]          Amer­i­can Nation­al Stan­dard For Prod­uct Safe­ty Infor­ma­tion in Prod­uct Man­u­als, Instruc­tions, and Oth­er Col­lat­er­al Mate­ri­als, ANSI Stan­dard Z535.6, 2010.
[14]          Con­trol of Haz­ardous Ener­gy Lockout/Tagout and Alter­na­tive Meth­ods, ANSI Stan­dard Z244.1, 2003.
[15]          Safe­ty of Machin­ery — Inter­lock­ing devices asso­ci­at­ed with guards — prin­ci­ples for design and selec­tion, EN 1088+A1:2008.
[16]          Safe­ty of Machin­ery — Guards — Gen­er­al require­ments for the design and con­struc­tion of fixed and mov­able guards, EN 953+A1:2009.
[17]          Safe­ty of machin­ery — Guards — Gen­er­al require­ments for the design and con­struc­tion of fixed and mov­able guards, ISO 14120.
[18]         Safe­ty of machin­ery — Safe­ty dis­tances to pre­vent haz­ard zones being reached by upper and low­er limbs, ISO 13857:2008.
[19]         Safe­ty of machin­ery — Posi­tion­ing of safe­guards with respect to the approach speeds of parts of the human body, ISO 13855:2010.

5% Dis­count on All Stan­dards with code: CC2011

Using E-Stops in Lockout Procedures

This entry is part 6 of 13 in the series Emer­gency Stop

Emer­gency stop devices are some­times, incor­rect­ly, used as part of a lock­out pro­ce­dure for machin­ery. Learn more about how to cor­rect­ly used these devices as part of Haz­ardous Ener­gy Con­trol Pro­ce­dures for indus­tri­al machin­ery.

Disconnect Switch with Lock, Tag, and Gang-hasp
An elec­tri­cal rotary dis­con­nect­ing device han­dle with a typ­i­cal lock, tag, and gang-hasp.

Con­trol of haz­ardous ener­gy is one of the key ways that main­te­nance and ser­vice work­ers are pro­tect­ed while main­tain­ing indus­tri­al equip­ment. Not so long ago we only thought about ‘Lock­out’ or ‘Lockout/Tagout’ pro­ce­dures, but there is much more to pro­tect­ing these work­ers than ‘just’ lock­ing out ener­gy sources. Inevitably con­di­tions come up where safe­guards may need to be removed or tem­porar­i­ly bypassed in order to diag­nose prob­lems or to make crit­i­cal but infre­quent adjust­ments to the equip­ment, and this is where Haz­ardous Ener­gy Con­trol Pro­ce­dures, or HECP, come in.

One of the ques­tions I often get when help­ing clients with devel­op­ing HECPs for their equip­ment is, “Can we use the emer­gency stop cir­cuit for lock­out?” As usu­al, there is a short answer and a long answer to that sim­ple ques­tion!

The Short Answer

The short answer to this ques­tion is NO. Lock­out requires that sources of haz­ardous ener­gy be phys­i­cal­ly iso­lat­ed or blocked. Con­trol sys­tems may be able to meet parts, but not all of this require­ment. Read on if you’d like to know why.

The Long Answer


Lock­out pro­ce­dures are now grouped with oth­er adjust­ment, diag­nos­tic and test pro­ce­dures into what are called Haz­ardous Ener­gy Con­trol Pro­ce­dures or HECP. In the USA, OSHA pub­lish­es a lock­out stan­dard in 29 CFR 1910.147, and ANSI pub­lish­es ANSI Z244.1.

Down­load ANSI stan­dards

In Cana­da, we didn’t have a stan­dard for HECP until 2005 when CSA Z460 was pub­lished, although all the Provinces and Ter­ri­to­ries have some lan­guage in their leg­is­la­tion that at least alludes to the need for con­trol of haz­ardous ener­gy. In the Province of Ontario where I live, this require­ment shows up in Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

In the EU, con­trol of haz­ardous ener­gy is dealt with in ISO 14118:2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up.

Down­load ISO Stan­dards

If you have a look at the sec­tions of the Ontario reg­u­la­tions, they don’t tell you how to per­form lock­out, and they make lit­tle men­tion of what to do with live work for trou­bleshoot­ing pur­pos­es. The US OSHA reg­u­la­tions read more like a stan­dard, but because they are in leg­is­la­tion they are pre­scrip­tive. You MUST meet this min­i­mum require­ment, and you may exceed it.

Let’s look at how “lock­out” is defined in the stan­dards.

Cana­da (Ontario) USA (OSHA) Euro­pean Union
Lock­out — place­ment of a lock or tag on an ener­gy-iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, there­by indi­cat­ing that the ener­gy-iso­lat­ing device is not to be oper­at­ed until removal of the lock or tag in accor­dance with an estab­lished pro­ce­dure.

CSA Z460, 2005

Lock­out. The place­ment of a lock­out device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, ensur­ing that the ener­gy iso­lat­ing device and the equip­ment being con­trolled can­not be oper­at­ed until the lock­out device is removed.

Tagout. The place­ment of a tagout device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.14 lockout/tagout: The place­ment of a lock/tag on the ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, indi­cat­ing that the ener­gy iso­lat­ing device shall not be oper­at­ed until removal of the lock/tag in accor­dance with an estab­lished pro­ce­dure. (The term “lockout/tagout” allows the use of a lock­out device, a tagout device, or a com­bi­na­tion of both.)

ANSI Z244.1–2003


3.3 iso­la­tion and ener­gy dis­si­pa­tion

pro­ce­dure which con­sists of all of the four fol­low­ing actions:

a) iso­lat­ing (dis­con­nect­ing, sep­a­rat­ing) the machine (or defined parts of the machine) from all pow­er sup­plies;

b) lock­ing (or oth­er­wise secur­ing), if nec­es­sary (for instance in large machines or in instal­la­tions), all the iso­lat­ing units in the “iso­lat­ed” posi­tion;

c) dis­si­pat­ing or restrain­ing [con­tain­ing] any stored ener­gy which may give rise to a haz­ard.

NOTE Ener­gy con­sid­ered in c) above may be stored in e.g.:

  • mechan­i­cal parts con­tin­u­ing to move through iner­tia;
  • mechan­i­cal parts liable to move by grav­i­ty;
  • capac­i­tors, accu­mu­la­tors;
  • pres­sur­ized flu­ids;
  • springs.

d) ver­i­fy­ing by using a safe work­ing pro­ce­dure that the actions tak­en accord­ing to a), b) and c) above have pro­duced the desired effect.

ISO 14118–2000

As you can see, the def­i­n­i­tions are fair­ly sim­i­lar, although slight­ly dif­fer­ent terms may be used. The ISO stan­dard actu­al­ly pro­vides the best guid­ance over­all in my opin­ion. Note that these excerpts are all tak­en from the def­i­n­i­tions sec­tions of the rel­e­vant doc­u­ments.

One of the big dif­fer­ences between the US and Cana­da is the idea of ‘tagout’ (pro­nounced TAG-out for those not famil­iar with the term). Tagout is iden­ti­cal to lock­out with the excep­tion of the device that is attached to the ener­gy iso­lat­ing device. Under cer­tain cir­cum­stances, the US per­mits the use of a tag with­out a lock to secure the ener­gy iso­la­tion device. This is not per­mit­ted in Cana­da under any cir­cum­stance, and the term ‘tagout’ is not offi­cial­ly rec­og­nized. In Cana­da, the term is often tak­en to mean the addi­tion of a tag to the lock­ing device,  a manda­to­ry part of the pro­ce­dure.

Use of Controls for Energy Isolation

This is where the ‘rub­ber meets the road’ — how is the source of haz­ardous ener­gy iso­lat­ed effec­tive­ly? To under­stand the require­ments, let’s look at the def­i­n­i­tion of an Ener­gy Iso­lat­ing Device.

Cana­da USA EU
Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).

CSA Z460, 2005

Note — Bold added for empha­sis — DN

Ener­gy iso­lat­ing device. A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: A man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors, and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy. Push but­tons, selec­tor switch­es and oth­er con­trol cir­cuit type devices are not ener­gy iso­lat­ing devices.

Note — Bold added for empha­sis — DN

Tagout device. A promi­nent warn­ing device, such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.8 ener­gy iso­lat­ing device: A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er, a dis­con­nect switch, a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy.

2.20.1 tagout device: A promi­nent warn­ing means such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

ANSI Z244.1–2003

4.1 Iso­la­tion and ener­gy dis­si­pa­tion

Machines shall be pro­vid­ed with means intend­ed for iso­la­tion and ener­gy dis­si­pa­tion (see clause 5), espe­cial­ly with a view to major main­te­nance, work on pow­er cir­cuits and decom­mis­sion­ing in accor­dance with the essen­tial safe­ty require­ment expressed in ISO/TR 12100–2:1992, annex A, 1.6.3.

Note — ISO/TR 12100–2 was with­drawn in Oct-10 and replaced by ISO 12100–2010. — DN Read more on this.

5.1 Devices for iso­la­tion from pow­er sup­plies
Iso­la­tion devices shall:

  • ensure a reli­able iso­la­tion (dis­con­nec­tion, sep­a­ra­tion);
  • have a reli­able mechan­i­cal link between the man­u­al con­trol and the iso­lat­ing element(s);
  • be equipped with clear and unam­bigu­ous iden­ti­fi­ca­tion of the state of the iso­la­tion device which cor­re­sponds to each posi­tion of its man­u­al con­trol (actu­a­tor).

NOTE 1 For elec­tri­cal equip­ment, a sup­ply dis­con­nect­ing device com­ply­ing with IEC 60204–1:1997, 5.3 “Sup­ply dis­con­nect­ing (iso­lat­ing) device” meets this require­ment.

NOTE 2 Plug and sock­et sys­tems (for elec­tri­cal sup­plies), or their pneu­mat­ic, hydraulic or mechan­i­cal equiv­a­lents, are exam­ples of iso­lat­ing devices with which it is pos­si­ble to achieve a vis­i­ble and reli­able dis­con­ti­nu­ity in the pow­er sup­ply cir­cuits.

For elec­tri­cal plug/socket com­bi­na­tions, see IEC 60204–1:1997, 5.3.2 d).

NOTE 3 For hydraulic and pneu­mat­ic equip­ment, see also EN 982:1996, 5.1.6 and EN 983:1996, 5.1.6.

ISO 14118–2000


BRADY Small Plug Lockout Device
BRADY Small Plug Lock­out Device

As you can see from the above def­i­n­i­tions, all the juris­dic­tions require that devices used for ener­gy iso­la­tion are reli­able, man­u­al­ly oper­a­ble, mechan­i­cal devices. While elec­tri­cal con­trol sys­tems that meet high lev­els of design reli­a­bil­i­ty may meet the reli­a­bil­i­ty require­ments, they do not meet the require­ments for phys­i­cal, mechan­i­cal dis­con­nec­tion of the source of haz­ardous ener­gy. Oper­a­tor devices are specif­i­cal­ly exclud­ed from this use in Cana­da and the USA. Note that plug and sock­et com­bi­na­tions are per­mit­ted in all juris­dic­tions. Lock­out devices such as Brady 65675 Large Plug Lock­out Device, like the Brady Small Plug Lock­out Device shown here and sim­i­lar devices, can be used for this pur­pose. With some plugs, it is pos­si­ble to put a small lock through a hole in one of the blades or pins. In some juris­dic­tions, even the sim­ple act of putting the plug in your back pock­et while con­duct­ing the work is suf­fi­cient.

BRADY Button Locking Device
BRADY But­ton Lock­ing Device

In addi­tion, the ener­gy iso­la­tion device is required to be able to be locked in the off, iso­lat­ed, or blocked posi­tion. There are emer­gency stop but­ton oper­a­tors that can be pur­chased with an inte­grat­ed lock cylin­der, and there are some con­trol oper­a­tor acces­sories avail­able that will allow con­trol push­but­tons and selec­tor switch­es to be locked in one posi­tion or anoth­er, but these do not meet the require­ments of the above stan­dards. They can be used in addi­tion to an ener­gy iso­la­tion device as part of the pro­ce­dure, but not on their own as the sole means of pre­vent­ing unex­pect­ed start-up.


Each machine or piece of equip­ment is required to have a HECP that is spe­cif­ic to that piece of equip­ment. ‘Glob­al’ HECP’s are sel­dom use­ful except as a tem­plate doc­u­ment. Devel­op­ment of HECPs takes some care­ful thought and a thor­ough under­stand­ing of the kinds of work that will need to be done to main­tain and ser­vice the machin­ery. Indi­vid­ual juris­dic­tions have some dif­fer­ences in the details of their reg­u­la­tions, but ulti­mate­ly the require­ments come down to the same thing: Pro­tect­ing work­ers.

Con­trol sys­tem devices such as stop but­tons and emer­gency stop devices are not accept­ed as ener­gy iso­lat­ing devices and can­not be used for this pur­pose, although they may be used as part of the HECP shut­down pro­ce­dure lead­ing up to the phys­i­cal iso­la­tion of the haz­ardous ener­gy sources.

Excel­lent stan­dards exist that cov­er devel­op­ment of these pro­ce­dures and should be ref­er­enced as spe­cif­ic HECP are devel­oped.

5% Dis­count on All Stan­dards with code: CC2011



Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

CSA Z460-05 (R2010) — Con­trol of haz­ardous ener­gy — Lock­out and oth­er meth­ods


29 CFR 1910.147The con­trol of haz­ardous ener­gy (lockout/tagout).

ANSI Z244.1 — 2003 (R2008) — Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods

Down­load stan­dards

Allen-Bradley 8579
Allen-Bradley 8579


ISO 14118 2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up

Down­load ISO Stan­dards

Busting Emergency Stop Myths

This entry is part 3 of 13 in the series Emer­gency Stop

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Bust­ing here on the MS101 blog!

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Bust­ing here on the MS101 blog!

What does ‘emergency’ mean?

Con­sid­er for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a sit­u­a­tion that is devel­op­ing or emerg­ing in the moment. Emer­gency stop sys­tems are intend­ed to help the user deal with poten­tial­ly haz­ardous con­di­tions that are emerg­ing in the moment. These con­di­tions have prob­a­bly arisen because the design­ers of the machin­ery failed to con­sid­er all the fore­see­able uses of the equip­ment, or because some­one has cho­sen to mis­use the equip­ment in a way that was not intend­ed by the design­ers. The key func­tion of an Emer­gency Stop sys­tem is to pro­vide the user with a back­up to the pri­ma­ry safe­guards. These sys­tems are referred to as “Com­ple­men­tary Pro­tec­tive Mea­sures” and are intend­ed to give the user a chance to “avert or lim­it harm” in a haz­ardous sit­u­a­tion. With that in mind, let’s look at three myths I hear about reg­u­lar­ly.


Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Dri­ve, Cred­it: Har­ry Matthews & http://www.old-engine.com

Ear­ly in the Indus­tri­al Rev­o­lu­tion machine builders real­ized that users of their machin­ery need­ed a way to quick­ly stop a machine when some­thing went wrong. At that time, over­head line-shafts were dri­ven by large cen­tral pow­er sources like water­wheels, steam engines or large elec­tric motors. Machin­ery was cou­pled to the cen­tral shafts with pul­leys, clutch­es and belts which trans­mit­ted the pow­er to the machin­ery.

See pic­tures of a line-shaft pow­ered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Pho­to: Lar­ry Evans & www.oldengine.org

These cen­tral engines pow­ered an entire fac­to­ry, so they were much larg­er than an indi­vid­ual motor sized for a mod­ern machine. In addi­tion, they could not be eas­i­ly stopped, since stop­ping the cen­tral pow­er source would mean stop­ping the entire fac­to­ry – not a wel­come choice. Emer­gency stop devices were born in this envi­ron­ment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their ear­ly use as a safe­ty device, some have incor­rect­ly con­sid­ered emer­gency stop sys­tems safe­guard­ing devices. Mod­ern stan­dards make the dif­fer­ence very clear. The eas­i­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stan­dards pub­lished by IEC1 and ISO2.

emer­gency stop3
emer­gency stop func­tion

func­tion that is intend­ed to

—   avert aris­ing, or reduce exist­ing, haz­ards to per­sons, dam­age to machin­ery or to work in progress,

—   be ini­ti­at­ed by a sin­gle human action


Haz­ards, for the pur­pos­es of this Inter­na­tion­al Stan­dard, are those which can arise from

—   func­tion­al irreg­u­lar­i­ties (e.g. machin­ery mal­func­tion, unac­cept­able prop­er­ties of the mate­r­i­al processed, human error),

—   nor­mal oper­a­tion.

It is impor­tant to under­stand that an emer­gency stop func­tion is “ini­ti­at­ed by a sin­gle human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sid­ered to be a risk con­trol mea­sure for oper­a­tors or bystanders. Emer­gency stop may pro­vide the abil­i­ty to avoid or reduce harm, by pro­vid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­al­ly be to call 911 and admin­is­ter first aid.

Safe­guard­ing sys­tems act auto­mat­i­cal­ly to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­a­bil­i­ty of a haz­ardous sit­u­a­tion aris­ing, and may also involve a reduc­tion in the sever­i­ty of injury by con­trol­ling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machin­ery before it can be reached.) This con­sti­tutes a risk con­trol mea­sure and can be shown to reduce the risk of injury to an exposed per­son.

Emer­gency stop is reac­tive; safe­guard­ing sys­tems are proac­tive.

In Cana­da, CSA defines emer­gency stop as a ‘Com­ple­men­tary Pro­tec­tive Mea­sure’ in CSA Z432-046:
Safe­guards (guards, pro­tec­tive devices) shall be used to pro­tect per­sons from the haz­ards that can­not rea­son­ably be avoid­ed or suf­fi­cient­ly lim­it­ed by inher­ent­ly safe design. Com­ple­men­tary pro­tec­tive mea­sures involv­ing addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be tak­en. Com­ple­men­tary pro­tec­tive mea­sures
Fol­low­ing the risk assess­ment, the mea­sures in this clause either shall be applied to the machine or shall be dealt with in the infor­ma­tion for use.
Pro­tec­tive mea­sures that are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­it­ed to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
© means of ener­gy iso­la­tion and dis­si­pa­tion.

In the USA, three stan­dards apply: ANSI B11ANSI B11.19–2003, and NFPA 79:

ANSI B11-2008

3.80 stop: Imme­di­ate or con­trolled ces­sa­tion of machine motion or oth­er haz­ardous sit­u­a­tions. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or sup­pli­er-spe­cif­ic terms, the oper­a­tion and func­tion of which is deter­mined by the indi­vid­ual design. Def­i­n­i­tions of some of the more com­mon­ly used “stop” ter­mi­nol­o­gy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

7.6 Emergency stop

Elec­tri­cal, pneu­mat­ic and hydraulic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-spe­cif­ic stan­dard or NFPA 79.
Infor­ma­tive Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Infor­ma­tive Note 2: For addi­tion­al infor­ma­tion, see ISO 13850 and IEC 60204–1.

ANSI B11.19–2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­men­tary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ce­dures in claus­es 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI / NFPA 79.


Emer­gency stop devices include but are not lim­it­ed to, but­tons, rope-pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­ver­tent access to a haz­ard, typ­i­cal­ly with­out overt action by the indi­vid­ual or oth­ers. Since an indi­vid­ual must actu­ate an emer­gency stop device to issue the stop com­mand, usu­al­ly in reac­tion to an event or haz­ardous sit­u­a­tion, it nei­ther detects nor pre­vents expo­sure to the haz­ard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the lev­el of per­for­mance of the safe­ty func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tri­cal func­tions of the emer­gency stop func­tion which is not direct­ly rel­e­vant to this arti­cle, so that is why I haven’t quot­ed direct­ly from that doc­u­ment here.

As you can clear­ly see, the essen­tial def­i­n­i­tions of these devices in the US and Cana­da match very close­ly, although the US does not specif­i­cal­ly use the term ‘com­ple­men­tary pro­tec­tive mea­sures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emer­gency stop sys­tems act pri­mar­i­ly by remov­ing pow­er from the prime movers in a machine, ensur­ing that pow­er is removed and the equip­ment brought to a stand­still as quick­ly as pos­si­ble, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­a­ble until the emer­gency stop sys­tem is reset. In some cas­es, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the process quick­ly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still ful­ly oper­a­ble and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing pow­er to the machine actu­a­tors dur­ing the stop­ping process. Also referred to as Cat­e­go­ry 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFif­teen to twen­ty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ce­dure”. Lock­out is one aspect of haz­ardous ener­gy con­trol pro­ce­dures (HECP).  HECPs rec­og­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nect­ed tem­porar­i­ly, to allow diag­nos­tics and test­ing to be car­ried out. This process is detailed in two cur­rent stan­dards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to iso­late an ener­gy source.

No cur­rent stan­dard allows for the use of con­trol devices such as push but­tons or selec­tor switch­es to be used as ener­gy iso­la­tion devices.

CSA Z460-05 specif­i­cal­ly pro­hibits this use in their def­i­n­i­tion of ‘ener­gy iso­la­tion devices’:

Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).4

Sim­i­lar require­ments are found in ANSI Z244.15 and in ISO 138503.

Myth #4 — All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is sim­ply not true. A read­er point­ed out to me that CSA Z432-04, clause, does make this require­ment. To my knowl­edge this is the only gen­er­al lev­el (i.e., not machine spe­cif­ic) stan­dard that makes this require­ment. I stand cor­rect­ed! Hav­ing said that, the rest of my com­ments on this top­ic still stand. Clause lim­its the appli­ca­tion of this require­ment:

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion shall have a man­u­al­ly ini­ti­at­ed emer­gency stop device.

Emer­gency stop sys­tems may be use­ful where they can pro­vide a back-up to oth­er safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-stop analy­sis must be car­ried out as part of the design process. This analy­sis will help the design­er devel­op a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The analy­sis also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing pow­er will cause the haz­ard to cease in a short time, or if the haz­ard can be quick­ly con­tained in some way, then emer­gency stop is a valid choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing removal of pow­er, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For exam­ple, con­sid­er an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only results in the start of the nat­ur­al cool­ing cycle of the oven. In some cas­es that could take hours or days, so the emer­gency stop has no val­ue. It might be use­ful for con­trol­ling oth­er haz­ards, such as fire, that might be relat­ed to the same fail­ure. With­out a full analy­sis of the fail­ure modes of the con­trol sys­tem, a sound deci­sion can­not be made.

Sim­ple machines like drill press­es and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­i­nite­ly ben­e­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low han­dle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­i­cal­ly re-start imme­di­ate­ly when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reap­ply pow­er to the machine on its own.

These require­ments are detailed in ISO 138503, CSA Z4326 and oth­er stan­dards.

Design Considerations

Emer­gency Stop is a con­trol that is often designed in with lit­tle thought and used for a vari­ety of things that it was nev­er intend­ed to be used to accom­plish. The three myths dis­cussed in this arti­cle are the tip of the ice­berg.

Con­sid­er these ques­tions when think­ing about the design and use of emer­gency stop sys­tems:

  1. Have all the intend­ed uses and fore­see­able mis­us­es of the equip­ment been con­sid­ered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assess­ment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be?
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­pos­es, like ‘Pow­er Off’, ener­gy iso­la­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Tak­ing the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to pro­vide the func­tion­al­i­ty that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affect­ed you?

Got any more myths about e-stops you’d like to share?

I real­ly appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sid­er adding it to this arti­cle, with cred­it of course!


5% Dis­count on All Stan­dards with code: CC2011

  1. IEC – Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion. Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
  2. ISO – Inter­na­tion­al Orga­ni­za­tion for Stan­dard­iza­tion Down­load ISO Stan­dards
  3. Safe­ty of machin­ery — Emer­gency stop — Prin­ci­ples for design, ISO 13850, 2006, ISO, Gene­va, Switzer­land.
  4. Con­trol of Haz­ardous Ener­gy ­– Lock­out and Oth­er Meth­ods, CSA Z460, 2005, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
    Buy CSA Stan­dards online at CSA.ca
  5. Safe­guard­ing of Machin­ery, CSA Z432-04, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
  6. Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods, ANSI/ASSE Z244.1, 2003, Amer­i­can Nation­al Stan­dards Insti­tute / Amer­i­can Soci­ety of Safe­ty Engi­neers, Des Plaines, IL, USA.
    Down­load ANSI stan­dards
  7. Amer­i­can Nation­al Stan­dard for Machine Tools – Per­for­mance Cri­te­ria for Safe­guard­ing, ANSI B11.19–2003, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  8. Gen­er­al Safe­ty Require­ments Com­mon to ANSI B11 Machines, ANSI B11-2008, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  9. Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery, NFPA 79–2007, NFPA, 1 Bat­tery­march Park, Quin­cy, MA 02169–7471, USA.
    Buy NFPA Stan­dards online.

5% Dis­count on All Stan­dards with code: CC2011

Digiprove sealCopy­right secured by Digiprove © 2011–2013
Acknowl­edge­ments: See cita­tions in the arti­cle.
Some Rights Reserved