Interlock Architectures – Pt. 1: What do those categories really mean?

This entry is part 1 of 8 in the series Circuit Architectures Explored

In 1995 CEN pub­lished an import­ant stand­ard for machine build­ers – EN 954 – 1, Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design. This stand­ard set the stage for defin­ing con­trol reli­ab­il­ity in machinery safe­guard­ing sys­tems, intro­du­cing the Reliability cat­egor­ies that have become ubi­quit­ous. So what do these cat­egor­ies mean, and how are they applied under the latest machinery stand­ard, ISO 13849 – 1?

It all started with EN 954 – 1

In 1996 CEN pub­lished an import­ant stand­ard for machine build­ers – EN 954 – 1, “Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design” [1]. This stand­ard set the stage for defin­ing con­trol reli­ab­il­ity in machinery safe­guard­ing sys­tems, intro­du­cing the Reliability cat­egor­ies that have become ubi­quit­ous. So what do these cat­egor­ies mean, and how are they applied under the latest machinery func­tion­al safety stand­ard, ISO 13849 – 1 [2]?

Download ISO Standards 

Circuit Categories

The cat­egor­ies are used to describe sys­tem archi­tec­tures for safety related con­trol sys­tems. Each archi­tec­ture car­ries with it a range of reli­ab­il­ity per­form­ance that can be related to the degree of risk reduc­tion you are expect­ing to achieve with the sys­tem. These archi­tec­tures can be applied equally to elec­tric­al, elec­tron­ic, pneu­mat­ic, hydraul­ic or mech­an­ic­al con­trol systems.

Historical Circuits

Early elec­tric­al ‘master-​control-​relay’ cir­cuits used a simple archi­tec­ture with a single con­tact­or, or some­times two, and a single chan­nel style of archi­tec­ture to main­tain the con­tact­or coil cir­cuit once the START or POWER ON but­ton (PB2 in Fig. 1) had been pressed. Power to the out­put ele­ments of the machine con­trols was sup­plied via con­tacts on the con­tact­or, which is why it was called the Master Control Relay or ‘MCR’. The POWER OFF but­ton (PB1 in Fig. 1) could be labeled that way, or you could make the same cir­cuit into an Emergency Stop by simply repla­cing the oper­at­or with a red mushroom-​head push but­ton. These devices were usu­ally spring-​return, so to restore power, all that was needed was to push the POWER ON but­ton again (Fig.1).

Basic Stop/Start Circuit
Figure 1 – Basic Stop/​Start Circuit

Typically, the com­pon­ents used in these cir­cuits were spe­cified to meet the cir­cuit con­di­tions, but not more. Controls man­u­fac­tur­ers brought out over-​dimensioned ver­sions, such as Allen-Bradley’s Bulletin 700-​PK con­tact­or which had 20 A rated con­tacts instead of the stand­ard Bulletin 700’s 10 A contacts.

When inter­locked guards began to show up, they were integ­rated into the ori­gin­al MCR cir­cuit by adding a basic con­trol relay (CR1 in Fig. 2) whose coil was con­trolled by the inter­lock switch(es) (LS1 in Fig. 2), and whose out­put con­tacts were in series with the coil cir­cuit of the MCR con­tact­or. Opening the guard inter­lock would open the MCR coil cir­cuit and drop power to the machine con­trols. Very simple.

Start/Stop Circuit with Guard Relay
Figure 2 – Old-​School Start/​Stop Circuit with Guard Relay

Ice-​cube’ style plug-​in relays were often chosen for CR1. These devices did not have ‘force-​guided’ con­tacts in them, so it was pos­sible to have one con­tact in the relay fail while the oth­er con­tin­ued to oper­ate properly.

LS1 could be any kind of switch. Frequently a ‘micro-​switch’ style of lim­it switch was chosen. These snap-​action switches could fail shor­ted intern­ally, or weld closed and the actu­at­or would con­tin­ue to work nor­mally even though the switch itself had failed. These switches are also ridicu­lously easy to bypass. All that is required is a piece of tape or an elast­ic band and the switch is no longer doing it’s job.

Micro-Switch style limit switch used as an interlock switch
Photo 1 – Micro-​Switch style lim­it switch used as a cov­er inter­lock switch in a piece of indus­tri­al laun­dry equipment

The prob­lem with these cir­cuits is that they can fail in a num­ber of ways that aren’t obvi­ous to the user, with the res­ult being that the inter­lock might not work as expec­ted, or the Emergency Stop might fail just when you need it most.

Modern Circuits

Category B

These ori­gin­al cir­cuits are the basis for what became known as ‘Category B’ (‘B’ for ‘Basic’) cir­cuits. Here’s the defin­i­tion from the stand­ard. Note that I am tak­ing this excerpt from ISO 13849 – 1: 2007 (Edition 2). “SRP/​CS” stands for “Safety Related Parts of Control Systems”:

6.2.3 Category B
The SRP/​CS shall, as a min­im­um, be designed, con­struc­ted, selec­ted, assembled and com­bined in accord­ance with the rel­ev­ant stand­ards and using basic safety prin­ciples for the spe­cif­ic applic­a­tion to withstand

  • the expec­ted oper­at­ing stresses, e.g. the reli­ab­il­ity with respect to break­ing capa­city and frequency,
  • the influ­ence of the pro­cessed mater­i­al, e.g. deter­gents in a wash­ing machine, and
  • oth­er rel­ev­ant extern­al influ­ences, e.g. mech­an­ic­al vibra­tion, elec­tro­mag­net­ic inter­fer­ence, power sup­ply inter­rup­tions or disturbances.

There is no dia­gnost­ic cov­er­age (DCavg = none) with­in cat­egory B sys­tems and the MTTFd of each chan­nel can be low to medi­um. In such struc­tures (nor­mally single-​channel sys­tems), the con­sid­er­a­tion of CCF is not relevant.

The max­im­um PL achiev­able with cat­egory B is PL = b.

NOTE When a fault occurs it can lead to the loss of the safety function.

Specific require­ments for elec­tro­mag­net­ic com­pat­ib­il­ity are found in the rel­ev­ant product stand­ards, e.g. IEC 61800 – 3 for power drive sys­tems. For func­tion­al safety of SRP/​CS in par­tic­u­lar, the immunity require­ments are rel­ev­ant. If no product stand­ard exists, at least the immunity require­ments of IEC 61000 – 6-​2 should be followed.

The stand­ard also provides us with a nice block dia­gram of what a single-​channel sys­tem might look like:

Category B Designated Architecture
ISO 13849 – 1 Category B Designated Architecture

If you look at this block dia­gram and the Start/​Stop Circuit with Guard Relay above, you can see how this basic cir­cuit trans­lates into a single chan­nel archi­tec­ture, since from the con­trol inputs to the con­trolled load you have a single chan­nel. Even the guard loop is a single chan­nel. A fail­ure in any com­pon­ent in the chan­nel can res­ult in loss of con­trol of the load.

Lets look at each part of this require­ment in more detail, since each of the sub­sequent Categories builds upon these BASIC requirements.

The SRP/​CS shall, as a min­im­um, be designed, con­struc­ted, selec­ted, assembled and com­bined in accord­ance with the rel­ev­ant stand­ards and using basic safety prin­ciples for the spe­cif­ic application…

Basic Safety Principles

We have to go to ISO 13849 – 2 to get a defin­i­tion of what Basic Safety Principles might include. Looking at Annex A.2 of the stand­ard we find:

Table A.1 — Basic Safety Principles

Basic Safety Principles Remarks
Use of suit­able mater­i­als and adequate manufacturing Selection of mater­i­al, man­u­fac­tur­ing meth­ods and treat­ment in rela­tion to, e. g. stress, dur­ab­il­ity, elasti­city, fric­tion, wear,
cor­ro­sion, temperature.
Correct dimen­sion­ing and shaping Consider e. g. stress, strain, fatigue, sur­face rough­ness, tol­er­ances, stick­ing, manufacturing.
Proper selec­tion, com­bin­a­tion, arrange­ments, assembly and install­a­tion of components/​systems. Apply manufacturer’s applic­a­tion notes, e. g. cata­logue sheets, install­a­tion instruc­tions, spe­cific­a­tions, and use of good engin­eer­ing prac­tice in sim­il­ar components/​systems.
Use of de – ener­gisa­tion principle The safe state is obtained by release of energy. See primary action for stop­ping in EN 292 – 2:1991 (ISO/​TR 12100 – 2:1992), 3.7.1. Energy is sup­plied for start­ing the move­ment of a mech­an­ism. See primary action for start­ing in EN 292 – 2:1991 (ISO/​TR 12100 – 2:1992), 3.7.1.Consider dif­fer­ent modes, e. g. oper­a­tion mode, main­ten­ance mode.

This prin­ciple shall not be used in spe­cial applic­a­tions, e. g. to keep energy for clamp­ing devices.

Proper fasten­ing For the applic­a­tion of screw lock­ing con­sider manufacturer’s applic­a­tion notes.Overloading can be avoided by apply­ing adequate torque load­ing technology.
Limitation of the gen­er­a­tion and/​or trans­mis­sion of force and sim­il­ar parameters Examples are break pin, break plate, torque lim­it­ing clutch.
Limitation of range of envir­on­ment­al parameters Examples of para­met­ers are tem­per­at­ure, humid­ity, pol­lu­tion at the install­a­tion place. See clause 8 and consider
manufacturer’s applic­a­tion notes.
Limitation of speed and sim­il­ar parameters Consider e. g. the speed, accel­er­a­tion, decel­er­a­tion required by the application
Proper reac­tion time Consider e. g. spring tired­ness, fric­tion, lub­ric­a­tion, tem­per­at­ure, iner­tia dur­ing accel­er­a­tion and deceleration,
com­bin­a­tion of tolerances.
Protection against unex­pec­ted start – up Consider unex­pec­ted start-​up caused by stored energy and after power “sup­ply” res­tor­a­tion for dif­fer­ent modes as
oper­a­tion mode, main­ten­ance mode etc.
Special equip­ment for release of stored energy may be necessary.
Special applic­a­tions, e. g. to keep energy for clamp­ing devices or ensure a pos­i­tion, need to be considered
separately.
Simplification Reduce the num­ber of com­pon­ents in the safety-​related system.
Separation Separation of safety-​related func­tions from oth­er functions.
Proper lub­ric­a­tion
Proper pre­ven­tion of the ingress of flu­ids and dust Consider IP rat­ing [see EN 60529 (IEC 60529)]

Download ISO Standards 
As you can see, the basic safety prin­ciples are pretty basic – select com­pon­ents appro­pri­ately for the applic­a­tion, con­sider the oper­at­ing con­di­tions for the com­pon­ents, fol­low manufacturer’s data, and use de-​energization to cre­ate the stop func­tion. That way, a loss of power res­ults in the sys­tem fail­ing into a safe state, as does an open relay coil or set of burnt contacts.

…the expec­ted oper­at­ing stresses, e.g. the reli­ab­il­ity with respect to break­ing capa­city and frequency,”

Specify your com­pon­ents cor­rectly with regard to voltage, cur­rent, break­ing capa­city, tem­per­at­ure, humid­ity, dust,…

…oth­er rel­ev­ant extern­al influ­ences, e.g. mech­an­ic­al vibra­tion, elec­tro­mag­net­ic inter­fer­ence, power sup­ply inter­rup­tions or disturbances.”

Specific require­ments for elec­tro­mag­net­ic com­pat­ib­il­ity are found in the rel­ev­ant product stand­ards, e.g. IEC 61800 – 3 for power drive sys­tems. For func­tion­al safety of SRP/​CS in par­tic­u­lar, the immunity require­ments are rel­ev­ant. If no product stand­ard exists, at least the immunity require­ments of IEC 61000 – 6-​2 should be followed.”

Probably the biggest ‘gotcha’ in this point is “elec­tro­mag­net­ic inter­fer­ence”. This is import­ant enough that the stand­ard devotes a para­graph to it spe­cific­ally. I added the bold text to high­light the idea of ‘func­tion­al safety’. You can find oth­er inform­a­tion in oth­er posts on this blog on that top­ic. If your product is destined for the European Union (EU), then you will almost cer­tainly be doing some EMC test­ing, unless your product is a ‘fixed install­a­tion’. If it’s going to almost any oth­er mar­ket, you prob­ably are not under­tak­ing this test­ing. So how do you know if your design meets this cri­ter­ia? Unless you test, you don’t. You can make some edu­cated guesses based on using sound engin­eer­ing prac­tices , but after that you can only hope.

Diagnostic Coverage

…There is no dia­gnost­ic cov­er­age (DCavg = none) with­in cat­egory B systems…”

Category B sys­tems are fun­da­ment­ally single chan­nel. A single fault in the sys­tem will lead to the loss of the safety func­tion. This sen­tence refers to the concept of “dia­gnost­ic cov­er­age” that was intro­duced in ISO 13849 – 1:2007, but what this means in prac­tice is that there is no mon­it­or­ing or feed­back from any crit­ic­al ele­ments. Remember our basic MCR cir­cuit? If the MCR con­tact­or wel­ded closed, the only dia­gnost­ic was the fail­ure of the machine to stop when the emer­gency stop but­ton was pressed.

Component Failure Rates

…the MTTFd of each chan­nel can be low to medium.”

This part of the state­ment is refer­ring to anoth­er new concept from ISO 13849 – 1:2007, “MTTFd”. Standing for “Mean Time to Failure Dangerous”, this concept looks at the expec­ted fail­ure rates of the com­pon­ent in hours. Calculating MTTFd is a sig­ni­fic­ant part of imple­ment­ing the new stand­ard. From the per­spect­ive of under­stand­ing Category B, what this means is that you do not need to use high-​reliability com­pon­ents in these systems.

Common Cause Failures

In such struc­tures (nor­mally single-​channel sys­tems), the con­sid­er­a­tion of CCF is not relevant.”

CCF is anoth­er new concept from ISO 13849 – 1:2007, and stands for “Common Cause Failure”. I’m not going to get into this in any detail here, but suf­fice to say that design tech­niques, as well as chan­nel sep­ar­a­tion (impossible in a single chan­nel archi­tec­ture) and oth­er tech­niques are used to reduce the like­li­hood of CCF in high­er reli­ab­il­ity systems.

Performance Levels

The max­im­um PL achiev­able with cat­egory B is PL = b.”

PL stands for “Performance Level”, divided into five degrees from ‘a’ to ‘e’. PLa is equal to an aver­age prob­ab­il­ity of dan­ger­ous fail­ure per hour of >= 10-5 to < 10-4 fail­ures per hour. PLb is equal to >= 3 × 10-6 to < 10-5 fail­ures per hour or once in 10,000 to 100,000 hours, to once in 3,000,000 hours of oper­a­tion. This sounds like a lot, but when deal­ing with prob­ab­il­it­ies, these num­bers are actu­ally pretty low.

If you con­sider an oper­a­tion run­ning a single shift in Canada where the nor­mal work­ing year is 50 weeks and the nor­mal work­day is 7.5 hours, a work­ing year is

7.5 h/​d x 5 d/​w x 50 w/​a = 1875 hours/​a

Taking the fail­ure rates per hour above, yields:

PLa = one fail­ure in 5.3 years of oper­a­tion to one fail­ure in 53.3 years

PLb = one fail­ure in 1600 years of operation

If we go to an oper­a­tion run­ning three shifts in Canada, a work­ing year is:

7.5 h/​shift x 3 shifts x 5 d/​w x 50 w/​a = 5625 hours/​a

Taking the fail­ure rates per hour above, yields:

PLa = one fail­ure in 1.8 years of oper­a­tion to one fail­ure in 17 years

PLb = one fail­ure in 533 years of operation

Now you should be start­ing to get an idea about where this is going. It’s import­ant to remem­ber that prob­ab­il­it­ies are just that – the fail­ure could hap­pen in the first hour of oper­a­tion or at any time after that, or nev­er. These fig­ures give you some way to gauge the rel­at­ive reli­ab­il­ity of the design, and ARE NOT any sort of guarantee.

Watch for the next post in this series where I will look at Category 1 requirements!

References

[1] Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design. CEN Standard EN 954 – 1. 1996.

[2] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. ISO Standard 13849 – 1. 2006.

[3] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 2: Validation, ISO Standard 13849 – 2. 2003.

[4] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 100: Guidelines for the use and applic­a­tion of ISO 13849 – 1. ISO Technical Report TR 100. 2000.

[5] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. CEN Standard EN ISO 13849 – 1. 2008.

Download ISO Standards 

Interlocked gate testing

Did you know that inter­locked gates require stop­ping per­form­ance testing? 

Machinery needs to be able to stop in the time it takes a per­son to open the guard and reach the haz­ard. If the dis­tance from the guard open­ing to the haz­ard is short enough that a per­son can reach the danger point before the haz­ard can be con­trolled, the guard is use­less. The res­ult­ing situ­ation may be worse

Did you know that inter­locked gates require stop­ping per­form­ance testing?

Machinery needs to be able to stop in the time it takes a per­son to open the guard and reach the haz­ard. If the dis­tance from the guard open­ing to the haz­ard is short enough that a per­son can reach the danger point before the haz­ard can be con­trolled, the guard is use­less. The res­ult­ing situ­ation may be worse than not hav­ing a guard because it’s pres­ence leads to a false sense of secur­ity in users.

Test the stop­ping time of guarded haz­ards and make sure that guards are far enough away from the danger zone to be effect­ive. For more on stop­ping per­form­ance require­ments, see CSA Z434, EN 999 (soon to be replaced by EN 13855:2010), and in the USA, 29 CFR 1910.217(h)(9)(v).

Download ISO Standards 
Download IEC stand­ards, International Electrotechnical Commission standards.
Download BSI Standards (British Standards Institution)
Download ANSI standards

Need help with stop­ping per­form­ance test­ing? Contact us!

Emergency Stop – What’s so confusing about that?

This entry is part 1 of 13 in the series Emergency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decept­ively simple con­cepts that has man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-​specific standards

Editor’s Note: Since we first pub­lished this art­icle on emer­gency stop in March of 2009, it has become our most pop­u­lar post of all time! We decided it was time for a little refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN-​July, 2017.

The Emergency Stop func­tion is one of those decept­ively simple con­cepts that have man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user. Some product-​specific stand­ards man­date the require­ment for an emer­gency stop, such as CSA Z434-​14 [1], where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity, and work cells integ­rat­ing robots are also required to have emer­gency stop capability.

Defining Emergency Stop

Old, non-compliant, E-Stop Button
Photo 1 – This OLD but­ton is def­in­itely non-compliant.

So what is the Emergency Stop func­tion, or E-​stop func­tion, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-​14 [2]:

Emergency situ­ation
an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or damage.
Emergency stop
a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in progress.
Emergency stop button
a red mushroom-​headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

One more [2, 6.3.5]:

Complementary pro­tect­ive measures
Protective meas­ures which are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/​or pro­tect­ive devices), nor inform­a­tion for use, could have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine.

Modern, non-compliant e-stop button.
Photo 2 – This more mod­ern but­ton is non-​compliant due to the RED back­ground and spring-​return button.

An e-​stop is a func­tion that is inten­ded for use in Emergency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard but is con­sidered to be a Complementary Protective Measure. Looking at emer­gency stop func­tions from the per­spect­ive of the Hierarchy of Controls, emer­gency stop func­tions fall into the same level as Personal Protective Equipment like safety glasses, safety boots, and hear­ing protection. 

So far so good.

Is an Emergency Stop Function Required?

Depending on the reg­u­la­tions and the stand­ards you choose to read, machinery is may not be required to have an Emergency Stop. Quoting from [2, 6.3.5.2]:

Components and ele­ments to achieve the emer­gency stop function

If, fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­pon­ents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency situ­ations to be aver­ted, the fol­low­ing require­ments apply:

  • the actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible and read­ily accessible;
  • the haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards, but if this is not pos­sible or the risk can­not be reduced, it should be ques­tioned wheth­er imple­ment­a­tion of an emer­gency stop func­tion is the best solution;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where necessary.

Note For more detailed pro­vi­sions, see ISO 13850.

Later in [2, 7.15.1.2]:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/​or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk control.

Note: There could be situ­ations where an e-​stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assessment.

The bold text in the pre­ced­ing para­graph is mine. I wanted to be sure that you caught this import­ant bit of text. Not every machine requires an E-​stop func­tion. The func­tion is only required where there is a bene­fit to the user. In some cases, product fam­ily stand­ards often called “Type C” stand­ards, includ­ing spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­im­um PLr or SILr, based on the opin­ion of the Technical Committee respons­ible for the stand­ard and their know­ledge of the par­tic­u­lar type of machinery covered by their document.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204 – 1.

Download NFPA stand­ards through ANSI

This more modern button is still wrong due to the RED background.
Photo 3 – This more mod­ern but­ton is non-​compliant due to the RED background.

If you read Ontario’s Industrial Establishments Regulation (Regulation 851), you will find that prop­er iden­ti­fic­a­tion of the emer­gency stop device(s) and loc­a­tion “with­in easy reach” of the oper­at­or are the only require­ment. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Internationally, a RED oper­at­or device on a YELLOW back­ground, with or without any text behind it, is recog­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. I’ve scattered some examples of dif­fer­ent com­pli­ant and non-​compliant e-​stop devices through this article.

The EU Machinery Directive, 2006/​42/​EC, and Emergency Stop

Interestingly, the European Union has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quoting from the Machinery Directive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emergency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be averted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Complementary Protective Measures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-​held and/​or hand-​guided machinery.

From these two bul­lets it becomes clear that, just as in the Canadian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-​stop sys­tem, then it should not be included in the design.

Carrying on with [3, 1.2.4.3]:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard movements.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Canadian and US reg­u­la­tions. [3] goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restarting.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emergency stop devices must be a back-​up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-​stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-​stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed.

Point of Clarification: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-​stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing characteristics: 
    • The device must latch in the activ­ated position;
    • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-​return to the neut­ral position.

The second sen­tence har­mon­izes with the require­ments of the Canadian and US stand­ards. The last sen­tence har­mon­izes with the idea of “Complementary Protective Measures” as described in [2].

How Many and Where?

Where? “Within easy reach”. Consider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Anywhere you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e-​stop device. “Easy Reach” I inter­pret as with­in the arm-​span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). The “easy reach” require­ment trans­lates to 500 – 600 mm either side of the centre line of most workstations.

How do you know if you need an emer­gency stop? Start with a stop/​start ana­lys­is. Identify all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Consider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop function.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hierarchy of Controls), look at what risks you might con­trol with an Emergency Stop. Remember that e-​stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can’t just default down to an emer­gency stop. IF the e-​stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stand­ard for Canada and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tric­al stand­ard for machinery, CSA C22.2 #301 [5]. This stand­ard is inten­ded for cer­ti­fic­a­tion of indus­tri­al machines. My opin­ion is that this stand­ard has some sig­ni­fic­ant issues. You can find very sim­il­ar elec­tric­al require­ments to this in [4] in IEC 60204 – 1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines and is tech­nic­ally identic­al to [6].

Download NFPA stand­ards through ANSI
Download IEC stand­ards, International Electrotechnical Commission standards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reliability is not addressed in these sec­tions. Quoting from the standard:

9.2.2 Stop Functions

Stop func­tions shall over­ride related start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ard­ous con­di­tions. The three cat­egor­ies of stop func­tions shall be as follows:

(1) Category 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actuators.

(2) Category 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then power is removed when the stop is achieved.

(3) Category 2 is a con­trolled stop with power left avail­able to the machine actuators.

This E-Stop Button is correct.
Photo 4 – This E-​Stop but­ton is CORRECT. Note the Push-​Pull-​Twist oper­at­or and the YELLOW background.

A bit later in the stand­ard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Category 0, Category 1, and/​or Category 2 stops shall be provided as determ­ined by the risk assess­ment and the func­tion­al require­ments of the machine. Category 0 and Category 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Category 0 shall take priority.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tect­ive devices and inter­locks shall be provided. Where applic­able, the stop func­tion shall sig­nal the logic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­egor­ies are aligned with sim­il­ar terms used with motor drives. You may want to read this art­icle if your machinery uses a motor drive.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Photo 5 – Disconnect with E-​Stop Colours indic­ates that this dis­con­nect­ing device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the func­tion­al safety require­ments. In Canada, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Canadian machinery into har­mon­iz­a­tion with the International Standards.

Emergency stop func­tions are required to provide a min­im­um of ISO 13849 – 1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that great­er reli­ab­il­ity is required, the sys­tem can be designed to meet any high­er reli­ab­il­ity require­ment that is suit­able. Essentially, the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required.

I’ve writ­ten extens­ively about the applic­a­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that topic.

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in Photo 5 above is

a) upside down, and

b) using a non-​standard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­ested, here is the cor­rect ISO elec­tric­al haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Photo 6 – Electric Shock Hazard – IEC 60417 – 5036

You can find these labels at Clarion Safety Systems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emergency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-​stop) CANNOT be used for energy isol­a­tion in an HECP – Hazardous Energy Control Procedure (which includes Lockout). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 [10] for more on that subject.

Read our Article on Using E-​Stops in Hazardous Energy Control Procedures (HECP) includ­ing lockout.

Pneumatic E-Stop Device
Photo 7 – Pneumatic E-​Stop/​Isolation device.

References

[1]  Industrial robots and robot sys­tems (Adopted ISO 10218 – 1:2011, second edi­tion, 2011-​07-​01, with Canadian devi­ations and ISO 10218 – 2:2011, first edi­tion, 2011-​07-​01, with Canadian devi­ations). Canadian National Standard CAN/​CSA Z434. 2014. 

[2]  Safeguarding of Machinery, CSA Standard Z432. 2016

[3]  DIRECTIVE 2006/​42/​EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machinery, and amend­ing Directive 95/​16/​EC (recast). Brussels: European Commission, 2006.

[4]  Electrical Standard for Industrial Machinery. ANSI/​NFPA Standard 79. 2015.

Download NFPA stand­ards at ANSI

[5] Industrial elec­tric­al machinery. CSA Standard C22.2 NO. 301. 2016. 

[6] Safety of machinery – Electrical Equipment of machines – Part 1: General require­ments. IEC Standard 60204 – 1. 2016.  

Download IEC stand­ards, International Electrotechnical Commission standards.

[7] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. ISO Standard 13849 – 1. 2015.

[8] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 2: Validation. ISO Standard 13849 – 2. 2012.

[9] Safety of machinery – Functional safety of safety-​related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems. IEC Standard 62061+AMD1+AMD2. 2015.

[10] Safety of machineryEmergency Stop — Principals for design. ISO Standard 13850. 2015.

Download IEC stand­ards, International Electrotechnical Commission standards.
Download ISO Standards 

[11] Control of haz­ard­ous energy — Lockout and oth­er meth­ods. CSA Standard Z460. 2013.