IEC/​TR 62061 – 1 Reviewed

This entry is part 2 of 2 in the series IEC/​TR 62061 – 1

Why You Need to Spend More Cash on Yet Another Document

Standards organ­iz­a­tions pub­lish doc­u­ments in a fairly con­tinu­ous stream, so for those of us tasked with stay­ing cur­rent with a large num­ber of stand­ards (say, more than 10), the pub­lic­a­tion of anoth­er new stand­ard or Technical Report isn’t news – it’s busi­ness as usu­al. The ques­tion is always: Do we really need to add this to the library?

For those who are new to this busi­ness, hav­ing to pay for crit­ic­al design inform­a­tion is a new exper­i­ence. Finding out that it can cost hun­dreds, if not thou­sands, to build the lib­rary you need can be overwhelming.

This review aims to help you decide if you need IEC/​TR 62061 – 1 in your library.

The Problem

As a machine build­er or a man­u­fac­turer build­ing a product designed to be integ­rated into machinery, how do you choose between ISO 13849 – 1 and IEC 62061?

IEC 62061 – 1 attempts to provide guid­ance on how to make this choice.


When CENELEC pub­lished EN 954 – 1 in 1995, machine build­ers were intro­duced to a whole new world of con­trol reli­ab­il­ity require­ments. Prior to its pub­lic­a­tion, most machines were built with very simple inter­locks, and no spe­cif­ic stand­ards for inter­lock­ing devices exis­ted. In the years since then, the EN 954 – 1 Categories have become well known and are applied inside and out­side the EU.

In the inter­ven­ing years, IEC pub­lished IEC 61508. This seven-​part stand­ard intro­duced the idea of ‘Safety Integrity  Levels’ or SILs. This stand­ard is aimed at pro­cess con­trol sys­tems and could be used for com­plex machinery as well.

Why the Confusion?

In 2006, IEC pub­lished a machinery sec­tor spe­cif­ic stand­ard based on IEC 61508, called IEC 62061. This stand­ard offered a sim­pli­fied applic­a­tion of the IEC 61508 meth­od­o­logy inten­ded for machine build­ers. The key prob­lem with this stand­ard is that it did not provide a means to deal with pneu­mat­ic or hydraul­ic con­trol ele­ments, which are covered by ISO 13849 – 1.

ISO adop­ted EN 954 – 1 and reis­sued it as ISO 13849 – 1 in 1999. This edi­tion of the stand­ard was vir­tu­ally identic­al to the stand­ard it replaced from a tech­nic­al require­ments per­spect­ive. EN 954 – 1/​ISO 13849 – 1 did not provide any means to estim­ate the integ­rity of the safety related con­trols, but did define cir­cuit archi­tec­tures (Categories B, 1 – 4) and spoke to the selec­tion of com­pon­ents, intro­du­cing the con­cepts of ‘well-​tried safety prin­ciples’ and ‘well-​tried com­pon­ents’. A second prob­lem had long exis­ted in addi­tion to this – EN 954 – 2, Validation, was nev­er pub­lished by CENELEC except as a com­mit­tee draft, so a key ele­ment in the applic­a­tion of the stand­ard had been miss­ing for five years at the point where ISO 13849 – 1 Edition 1 was published.

The first cut at guid­ing users in choos­ing an appro­pri­ate stand­ard came with the pub­lic­a­tion of IEC 62061 Edition 1.  Published in 2005, Edition 1 included a table that attemp­ted to provide users with some guid­ance on how to choose between ISO 13849 – 1 or IEC 62061.

…and then came 2007…

In 2007, ISO pub­lished the Second Edition of ISO 13849 – 1, and brought a whole new twist to the dis­cus­sion by intro­du­cing ‘Performance Levels’ or PLs. PLs can be loosely equated to SILs, even though PLs are stated in fail­ures per year and SILs in fail­ures per hour. The same table included in IEC 62061 was included in this edi­tion of ISO 13849 – 1.

Table 1
Recommended application of
IEC 62061 and ISO 13849 – 1(under revision)

(from the Second Edition, 2007)

Technology imple­ment­ing the
safety related con­trol function(s)
13849 – 1 (under revision)
IEC 62061
A Non elec­tric­al, e.g. hydraulics X Not covered
B Electromechanical, e.g. relays, or 
non-​complex electronics
Restricted to designated
archi­tec­tures (see Note 1) and up to PL=e

All archi­tec­tures and up to

C Complex elec­tron­ics, e.g. programmable Restricted to designated
archi­tec­tures (see Note 1) and up
to PL=d
All archi­tec­tures and up to 
D A com­bined with B Restricted to designated
archi­tec­tures (see Note 1) and up
to PL=e
see Note 3
E C com­bined with B Restricted to designated
archi­tec­tures (see Note 1) and up
to PL=d
All archi­tec­tures and up to 
F C com­bined with A, or C com­bined with
A and B
see Note 2
see Note 3

X” indic­ates that this item is dealt with by the stand­ard shown in the column heading.

NOTE 1 Designated archi­tec­tures are defined in Annex B of EN ISO 13849 – 1(rev.) to give a sim­pli­fied approach for quan­ti­fic­a­tion of per­form­ance level.

NOTE 2 For com­plex elec­tron­ics: Use of des­ig­nated archi­tec­tures accord­ing to EN ISO 13849 – 1(rev.) up to PL=d or any archi­tec­ture accord­ing to IEC 62061.

NOTE 3 For non-​electrical tech­no­logy use parts accord­ing to EN ISO 13849 – 1(rev.) as subsystems.

So how is a machine build­er to choose the ‘cor­rect’ stand­ard, if both stand­ards are applic­able and both are cor­rect? Furthermore, how do you assess the reli­ab­il­ity of the safety-​related con­trols when integ­rat­ing equip­ment from vari­ous sup­pli­ers, some of whom rate their equip­ment in PLs and some in SILs? Why are two stand­ards address­ing the same top­ic required? Will ISO 13849 – 1 and IEC 62061 ever be merged?

The Technical Report

In July this year the IEC pub­lished a Technical Report that dis­cusses the selec­tion and applic­a­tion of these two key con­trol reli­ab­il­ity stand­ards for machine build­ers. This guide has long been needed, and pre­cedes a face to face event planned by IEC to bring machine build­ers and stand­ards writers face-​to-​face to dis­cuss these same issues.

The guide, titled IEC/​TR 62061 – 1 — Technical Report — Guidance on the applic­a­tion of ISO 13849 – 1 and IEC 62061 in the design of safety-​related con­trol sys­tems for machinery provides dir­ect guid­ance on how to select between these two standards.

Download IEC stand­ards, International Electrotechnical Commission standards.


In the intro­duc­tion to the report the TC makes it clear that the stand­ards will be merged, although they don’t provide any kind of a time line for the mer­ger. Quoting from the introduction:

It is inten­ded that this Technical Report be incor­por­ated into both IEC 62061 and ISO 13849 – 1 by means of cor­ri­genda that ref­er­ence the pub­lished ver­sion of this doc­u­ment. These cor­ri­genda will also remove the inform­a­tion giv­en in Table 1, Recommended applic­a­tion of IEC 62061 and ISO 13849 – 1, provided in the com­mon intro­duc­tion to both stand­ards, which is now recog­nized as being out of date. Subsequently, it is inten­ded to merge ISO 13849 – 1 and IEC 62061 by means of a JWG of ISO/​TC 199 and IEC/​TC 44.

I added the bold face to the para­graph above to high­light the key state­ment regard­ing the even­tu­al mer­ger of the two doc­u­ments.  If you’re not famil­i­ar with the stand­ards acronyms, a ‘JWG’ is a Joint Working Group, and a TC is a Technical Committee. TC’s are formed from volun­teer experts from industry and aca­demia sup­por­ted by their organ­iz­a­tions. So a JWG formed from two TC’s just means that a joint com­mit­tee has been formed to work out the details of the mer­ger. Eventually.

The oth­er key point in this para­graph relates to the replace­ment of Table 1. In the inter­im, IEC/​TR 62061 – 1 will be incor­por­ated into both stand­ards, repla­cing Table 1.

Eventually the con­fu­sion will be cleared up because only one stand­ard will exist in the machinery sec­tor, but until then, machine build­ers will need to fig­ure out which stand­ard best fits their products.

Comparing PL’s and SIL’s

The Technical Report does a good job of dis­cuss­ing the dif­fer­ences between PL and SIL, includ­ing provid­ing an explan­a­tion of how to cov­ert one to the oth­er, very use­ful if you are try­ing to integ­rate an SIL rated device into a PL ana­lys­is or vice-versa.

Selecting a Standard

Clause 2.5 gives some sol­id advice on select­ing between the two stand­ards based on the tech­no­lo­gies employed in the design and your own com­fort level in using the ana­lyt­ic­al tech­niques in the two standards.

Another key point is that EITHER stand­ard can be used to ana­lyze com­plex OR simple con­trol sys­tems. Some fans of IEC 62061 have been known to put ISO 13849 – 1 down as use­ful exclus­ively for simple hard­wired con­trol sys­tems. Clause 3.3 makes it clear that this is not the case. Pick the one you like or know the best and go with that. As an addi­tion­al thought, con­sider which stand­ard your com­pet­it­ors are using, and also which your cus­tom­ers are using. For example, if your cus­tom­ers use ISO 13849 – 1 primar­ily, qual­i­fy­ing your product under IEC 62061 might seem like a good idea, but may drive your cus­tom­ers to a com­pet­it­or who makes their life easi­er by using ISO 13849 – 1. If your com­pet­it­ors are using a dif­fer­ent stand­ard, try to under­stand the choice before climb­ing on the band­wag­on. There may be a com­pet­it­ive advant­age lurk­ing in being different.

Risk Assessment

Clause 4 speaks dir­ectly to the indis­pens­able need to con­duct a meth­od­ic­al risk assess­ment, and to use that to guide the design of the controls.

In my prac­tice, many cli­ents decide that they would prefer to choose a con­trol reli­ab­il­ity level that they feel will be more than good enough for any of their designs, and then to ‘stand­ard­ize’ on that design for all their products, thereby elim­in­at­ing the need to thought­fully decide on the appro­pri­ate design for the applic­a­tion. In oth­er cases, end-​users may choose to use a ‘stand­ard’ design through­out their facil­ity to assist main­ten­ance per­son­nel by lim­it­ing their need to become tech­nic­ally famil­i­ar with a vari­ety of designs. This is done to speed troubleshoot­ing and reduce down time and spares stocks.

The prob­lem with this approach can be that some man­agers believe this approach can elim­in­ate the need to con­duct risk assess­ments, see­ing this as a fruit­less, expens­ive and often futile exer­cise. This is emphat­ic­ally NOT the case. Risk assess­ments address much more than the selec­tion of con­trol reli­ab­il­ity require­ments and need to be done to ensure that all haz­ards that can­not be elim­in­ated or sub­sti­tuted are safe­guarded. A miss­ing or badly done risk assess­ment may inval­id­ate your claim to a CE mark, or be the land­mine that ends a liab­il­ity case – with you on the los­ing end.

Safety Requirement Specification (SRS)

Each safety func­tion needs to be defined in detail in a Safety Requirement Specification (SRS). A reli­ab­il­ity assess­ment needs to be com­pleted for each safety func­tion defined in the SRS. This point is dis­cussed in detail in IEC 62061, but is not dealt with in any detail in ISO 13849 – 1, so IEC/​TR 62061 – 1 once again bridges the gap by provid­ing an import­ant detail that is miss­ing in one of the two standards.

If you are unfa­mil­i­ar with the concept of an SRS, each safety func­tion needs to be described with a cer­tain min­im­um amount of inform­a­tion, including:

  • The name of safety function;
  • A descrip­tion of the function;
  • The required level of per­form­ance based on the risk assess­ment and accord­ing to either ISO 13849 – 1 (PLr a to e) or the required safety integ­rity accord­ing to IEC 62061 (SIL 1 to 3)

Once the safety func­tions are defined and ana­lyzed, each safety func­tion must be imple­men­ted by a con­trol cir­cuit. The selec­ted PL will drive the design to one or two of the defined ISO 13849 – 1 archi­tec­tures, and then the com­pon­ent selec­tions and oth­er design details will drive the final fail­ure rate and PL. Alternatively, the SRS will drive the selec­tion of IEC 62061 archi­tec­ture (1oo1, 1oo2, 2oo2, etc.) and the rest of the design details will lead to the final fail­ure rate and SIL.

Table 1 in the Technical Report com­pares the levels.

Table 1 – Relationship between PLs and SILs based on the average probability
of dangerous failure per hour

Performance Level (PL) Average prob­ab­il­ity of a dangerous
fail­ure per hour (1/​h)
Safety integ­rity level (SIL)
a >= 10-5 to < 10-4 No spe­cial safety requirements
b >= 3 x 10-6 to < 10-5 1
c >= 10-6 to < 3 x 10-6 1
d >= 10-7 to < 10-6 2
e >= 10-8 to < 10-7 3

This table com­bines ISO 13849 – 1 2007, Tables 3 & 4. No sim­il­ar tables exist in IEC 62061 2005.

Combining Equipment with PLs and SILs

Section 7 of the report speaks to the chal­lenge of integ­rat­ing equip­ment with rat­ings in a mix of PLs and SILs. Until the stand­ards merge and a single sys­tem for describ­ing reli­ab­il­ity cat­egor­ies is agreed on, this prob­lem will be with us.

When design­ing sys­tems using either sys­tem the design­er has to determ­ine the approx­im­ate rate of dan­ger­ous fail­ures. In ISO 13849 – 1, MTTFd is the com­pon­ent fail­ure rate para­met­er, while in IEC 62061, PFHd is the sub­sys­tem fail­ure rate para­met­er. MTTFd does not con­sider dia­gnostics or archi­tec­ture, only the com­pon­ent fail­ure rate per year, while PFHd does include dia­gnostics and archti­tec­ture, and it speaks to the sys­tem fail­ure rate per hour. To com­pare these rates, ISO 13849 – 1 Annex K describes the rela­tion­ship between MTTFd and PFHd for dif­fer­ent architectures.

In the design pro­cess only one meth­od can be used, so where equip­ment with dif­fer­ent rat­ings must be com­bined the fail­ure rates must be con­ver­ted to either MTTFd or to PFHd, depend­ing on the sys­tem being used to com­plete the ana­lys­is. Mixing require­ments with­in the design of a sub­sys­tem is not per­mit­ted (See Clause 7.3.3).

Fault Exclusions

Fault exclu­sions are per­mit­ted under both stand­ards with some lim­it­a­tions: up to IEC 62061 SIL 2. No fault exclu­sions are per­mit­ted in SIL 3. Properly jus­ti­fied fault exclu­sions can be used up to PLe. “Properly jus­ti­fied” fault exclu­sions are those that can be shown to be val­id through the life­time of the SRP/​CS.

In gen­er­al, fault exclu­sions for mech­an­ic­al fail­ures of elec­tromech­an­ic­al devices such as inter­lock devices or emer­gency stop devices are not per­mit­ted, with a few excep­tions giv­en in ISO 13849 – 2, (See Clauses and

This approach is con­sist­ent with the cur­rent approach taken in Canada, as described in CSA Z432 & Z434. Fault exclu­sions are gen­er­ally not per­mit­ted under ANSI standards.

Worked Examples

Section 8 of the Technical Report gives a couple of worked examples, one done under ISO 13849 – 1, and one under IEC 62061. For someone look­ing for a good example of what a prop­erly com­pleted ana­lys­is should look like, this sec­tion is the gold at the end of the rain­bow. Section 8.2 provides a good, clear example of the applic­a­tion of the stand­ards along with a nice, simple example of what a safety require­ment spe­cific­a­tion might look like.

Understanding the Differences

One area where pro­ponents of the two stand­ards often dis­agree is on the ‘accur­acy’ of the ana­lyt­ic­al pro­ced­ures giv­en in the two stand­ards. The Technical Report provides a detailed explan­a­tion of why the two tech­niques provide slightly dif­fer­ent res­ults and provides the rationale explain­ing why this vari­ation should be con­sidered acceptable.

To Buy or Not to Buy…

At the end of the day, the ques­tion that needs to be answered is wheth­er to buy this doc­u­ment or not. If you use either of these stand­ards, I strongly recom­mend that you spend the money to get this Technical Report, if for noth­ing more than the worked examples. Until the two stand­ards are merged, and that could be a few years, you will need to be able to effect­ively apply these approaches to PL and SIL rated equip­ment. This Technical Report will be an invalu­able aid.

It also provides some guid­ance on the dir­ec­tion that the new merged stand­ard will take. Some old argu­ments can be settled, or at least re-​directed, by this document.

Finally, since the TR is to be incor­por­ated in both stand­ards and con­tains mater­i­al repla­cing that in the cur­rent edi­tions of the stand­ard, you must buy a copy to remain current.

For all of these reas­ons, I would spend the money to acquire this doc­u­ment, read and apply it.

Download IEC stand­ards, International Electrotechnical Commission standards.

Download ISO Standards 

If you’ve bought the report and would like to add your thoughts, please add a com­ment below. Got ques­tions? Contact me!

Busting Emergency Stop Myths

This entry is part 3 of 13 in the series Emergency Stop

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Busting here on the MS101 blog!

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Busting here on the MS101 blog!

What does ‘emergency’ mean?

Consider for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a situ­ation that is devel­op­ing or emer­ging in the moment. Emergency stop sys­tems are inten­ded to help the user deal with poten­tially haz­ard­ous con­di­tions that are emer­ging in the moment. These con­di­tions have prob­ably aris­en because the design­ers of the machinery failed to con­sider all the fore­see­able uses of the equip­ment, or because someone has chosen to mis­use the equip­ment in a way that was not inten­ded by the design­ers. The key func­tion of an Emergency Stop sys­tem is to provide the user with a backup to the primary safe­guards. These sys­tems are referred to as “Complementary Protective Measures” and are inten­ded to give the user a chance to “avert or lim­it harm” in a haz­ard­ous situ­ation. With that in mind, let’s look at three myths I hear about regularly.


Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews &
A Fitz Water Wheel and Belt Drive, Credit: Harry Matthews & http://​www​.old​-engine​.com

Early in the Industrial Revolution machine build­ers real­ized that users of their machinery needed a way to quickly stop a machine when some­thing went wrong. At that time, over­head line-​shafts were driv­en by large cent­ral power sources like water­wheels, steam engines or large elec­tric motors. Machinery was coupled to the cent­ral shafts with pul­leys, clutches and belts which trans­mit­ted the power to the machinery.

See pic­tures of a line-​shaft powered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Photo: Larry Evans & www​.olden​gine​.org

These cent­ral engines powered an entire fact­ory, so they were much lar­ger than an indi­vidu­al motor sized for a mod­ern machine. In addi­tion, they could not be eas­ily stopped, since stop­ping the cent­ral power source would mean stop­ping the entire fact­ory – not a wel­come choice. Emergency stop devices were born in this environment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their early use as a safety device, some have incor­rectly con­sidered emer­gency stop sys­tems safe­guard­ing devices. Modern stand­ards make the dif­fer­ence very clear. The easi­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stand­ards pub­lished by IEC1 and ISO2.

emer­gency stop3
emer­gency stop function

func­tion that is inten­ded to

—   avert arising, or reduce exist­ing, haz­ards to per­sons, dam­age to machinery or to work in progress,

—   be ini­ti­ated by a single human action


Hazards, for the pur­poses of this International Standard, are those which can arise from

—   func­tion­al irreg­u­lar­it­ies (e.g. machinery mal­func­tion, unac­cept­able prop­er­ties of the mater­i­al pro­cessed, human error),

—   nor­mal operation.

It is import­ant to under­stand that an emer­gency stop func­tion is “ini­ti­ated by a single human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sidered to be a risk con­trol meas­ure for oper­at­ors or bystand­ers. Emergency stop may provide the abil­ity to avoid or reduce harm, by provid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­ally be to call 911 and admin­is­ter first aid.

Safeguarding sys­tems act auto­mat­ic­ally to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­ab­il­ity of a haz­ard­ous situ­ation arising, and may also involve a reduc­tion in the sever­ity of injury by con­trolling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machinery before it can be reached.) This con­sti­tutes a risk con­trol meas­ure and can be shown to reduce the risk of injury to an exposed person.

Emergency stop is react­ive; safe­guard­ing sys­tems are pro­act­ive.

In Canada, CSA defines emer­gency stop as a ‘Complementary Protective Measure’ in CSA Z432-​046:
Safeguards (guards, pro­tect­ive devices) shall be used to pro­tect per­sons from the haz­ards that can­not reas­on­ably be avoided or suf­fi­ciently lim­ited by inher­ently safe design. Complementary pro­tect­ive meas­ures involving addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be taken. Complementary pro­tect­ive measures
Following the risk assess­ment, the meas­ures in this clause either shall be applied to the machine or shall be dealt with in the inform­a­tion for use.
Protective meas­ures that are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/​or pro­tect­ive devices), nor inform­a­tion for use may have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine. Such meas­ures shall include, but not be lim­ited to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
(c) means of energy isol­a­tion and dissipation.

In the USA, three stand­ards apply: ANSI B11,  ANSI B11.19 – 2003, and NFPA 79:

ANSI B11-​2008

3.80 stop: Immediate or con­trolled ces­sa­tion of machine motion or oth­er haz­ard­ous situ­ations. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or supplier-​specific terms, the oper­a­tion and func­tion of which is determ­ined by the indi­vidu­al design. Definitions of some of the more com­monly used “stop” ter­min­o­logy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency purposes;

7.6 Emergency stop

Electrical, pneu­mat­ic and hydraul­ic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-​specific stand­ard or NFPA 79.
Informative Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Informative Note 2: For addi­tion­al inform­a­tion, see ISO 13850 and IEC 60204 – 1.

ANSI B11.19 – 2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­ment­ary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ced­ures in clauses 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI /​ NFPA 79.


Emergency stop devices include but are not lim­ited to, but­tons, rope-​pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­vert­ent access to a haz­ard, typ­ic­ally without overt action by the indi­vidu­al or oth­ers. Since an indi­vidu­al must actu­ate an emer­gency stop device to issue the stop com­mand, usu­ally in reac­tion to an event or haz­ard­ous situ­ation, it neither detects nor pre­vents expos­ure to the hazard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the level of per­form­ance of the safety func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tric­al func­tions of the emer­gency stop func­tion which is not dir­ectly rel­ev­ant to this art­icle, so that is why I haven’t quoted dir­ectly from that doc­u­ment here.

As you can clearly see, the essen­tial defin­i­tions of these devices in the US and Canada match very closely, although the US does not spe­cific­ally use the term ‘com­ple­ment­ary pro­tect­ive measures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emergency stop sys­tems act primar­ily by remov­ing power from the prime movers in a machine, ensur­ing that power is removed and the equip­ment brought to a stand­still as quickly as pos­sible, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­able until the emer­gency stop sys­tem is reset. In some cases, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the pro­cess quickly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still fully oper­able and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing power to the machine actu­at­ors dur­ing the stop­ping pro­cess. Also referred to as Category 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency purposes;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFifteen to twenty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ced­ure”. Lockout is one aspect of haz­ard­ous energy con­trol pro­ced­ures (HECP).  HECPs recog­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nec­ted tem­por­ar­ily, to allow dia­gnostics and test­ing to be car­ried out. This pro­cess is detailed in two cur­rent stand­ards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to isol­ate an energy source.

No cur­rent stand­ard allows for the use of con­trol devices such as push but­tons or select­or switches to be used as energy isol­a­tion devices.

CSA Z460-​05 spe­cific­ally pro­hib­its this use in their defin­i­tion of ‘energy isol­a­tion devices’:

Energy-​isolating device — a mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a manu­ally oper­ated elec­tric­al cir­cuit break­er; a dis­con­nect switch; a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors; a line valve; a block; and oth­er devices used to block or isol­ate energy (push-​button select­or switches and oth­er control-​type devices are not energy-​isolating devices).4

Similar require­ments are found in ANSI Z244.15 and in ISO 138503.

Myth #4 – All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is simply not true. A read­er poin­ted out to me that CSA Z432-​04, clause, does make this require­ment. To my know­ledge this is the only gen­er­al level (i.e., not machine spe­cif­ic) stand­ard that makes this require­ment. I stand cor­rec­ted! Having said that, the rest of my com­ments on this top­ic still stand. Clause lim­its the applic­a­tion of this requirement:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion shall have a manu­ally ini­ti­ated emer­gency stop device.

Emergency stop sys­tems may be use­ful where they can provide a back-​up to oth­er safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-​stop ana­lys­is must be car­ried out as part of the design pro­cess. This ana­lys­is will help the design­er devel­op a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The ana­lys­is also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing power will cause the haz­ard to cease in a short time, or if the haz­ard can be quickly con­tained in some way, then emer­gency stop is a val­id choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing remov­al of power, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For example, con­sider an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only res­ults in the start of the nat­ur­al cool­ing cycle of the oven. In some cases that could take hours or days, so the emer­gency stop has no value. It might be use­ful for con­trolling oth­er haz­ards, such as fire, that might be related to the same fail­ure. Without a full ana­lys­is of the fail­ure modes of the con­trol sys­tem, a sound decision can­not be made.

Simple machines like drill presses and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­in­itely bene­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low handle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­ic­ally re-​start imme­di­ately when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reapply power to the machine on its own.

These require­ments are detailed in ISO 138503, CSA Z4326 and oth­er standards.

Design Considerations

Emergency Stop is a con­trol that is often designed in with little thought and used for a vari­ety of things that it was nev­er inten­ded to be used to accom­plish. The three myths dis­cussed in this art­icle are the tip of the iceberg.

Consider these ques­tions when think­ing about the design and use of emer­gency stop systems:

  1. Have all the inten­ded uses and fore­see­able mis­uses of the equip­ment been considered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assessment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be?
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­poses, like ‘Power Off’, energy isol­a­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Taking the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to provide the func­tion­al­ity that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affected you?

Got any more myths about e-​stops you’d like to share?

I really appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sider adding it to this art­icle, with cred­it of course!


5% Discount on All Standards with code: CC2011 

  1. IEC – International Electrotechnical Commission. Download IEC stand­ards, International Electrotechnical Commission standards.
  2. ISO – International Organization for Standardization Download ISO Standards 
  3. Safety of machinery — Emergency stop — Principles for design, ISO 13850, 2006, ISO, Geneva, Switzerland.
  4. Control of Hazardous Energy ­– Lockout and Other Methods, CSA Z460, 2005, Canadian Standards Association, Toronto, Canada.
    Buy CSA Standards online at CSA​.ca
  5. Safeguarding of Machinery, CSA Z432-​04, Canadian Standards Association, Toronto, Canada.
  6. Control of Hazardous Energy – Lockout/​Tagout and Alternative Methods, ANSI/​ASSE Z244.1, 2003, American National Standards Institute /​ American Society of Safety Engineers, Des Plaines, IL, USA.
    Download ANSI standards
  7. American National Standard for Machine Tools – Performance Criteria for Safeguarding, ANSI B11.19 – 2003, American National Standards Institute, Des Plaines, IL, USA.
  8. General Safety Requirements Common to ANSI B11 Machines, ANSI B11-​2008, American National Standards Institute, Des Plaines, IL, USA.
  9. Electrical Standard for Industrial Machinery, NFPA 79 – 2007, NFPA, 1 Batterymarch Park, Quincy, MA 02169 – 7471, USA.
    Buy NFPA Standards online.

5% Discount on All Standards with code: CC2011 

New Guide to Applying ISO 13849 – 1 and IEC 62061

This entry is part 1 of 2 in the series IEC/​TR 62061 – 1

IEC and ISO have pub­lished a new guide to help users select between ISO 13849 – 1 and IEC 62061. This new Technical Report will replace Table 1 in both standards.

One of the big chal­lenges facing machine build­ers has been choos­ing between ISO 13849 – 1 and IEC 62061. The IEC pub­lished a new guide at the end of July, 2010 called Technical Report IEC/​TR 62061 – 1 ed1.0 Guidance on the applic­a­tion of ISO 13849 – 1 and IEC 62061 in the design of safety-​related con­trol sys­tems for machinery. The new 38-​page guide is avail­able as a hard copy or a PDF file. Written jointly by Technical Committee IEC/​TC 44, Safety of machinery – Electrotechnical aspects and Technical Committee ISO/​TC 199, Safety of machinery. The Technical Report was pub­lished in par­al­lel by ISO as ISO/​TR 23849.

Technical Reports don’t have the same status as International Standards, but provide the TC’s with  a means to provide guid­ance and explan­a­tion to help users imple­ment the standard.

Table of Contents

Since this is a copy­righted doc­u­ment, I can’t repro­duce it here. Instead, here’s the Table of Contents that will give you some idea of  the document’s contents.

Cover of IEC/TR 62061-1
IEC/​TR 62061 – 1
  1. Scope
  2. General
  3. Comparison of standards
  4. Risk estim­a­tion and assign­ment of required performance
  5. Safety require­ments specification
  6. Assignment of per­form­ance tar­gets: PL versus SIL
  7. System design
  8. Example
  9. Bibliography

Merger Coming Soon

The intro­duc­tion to the TR indic­ates that it will be incor­por­ated into both IEC 62061 and ISO 13849 – 1 through a cor­ri­genda that ref­er­ences this new doc­u­ment. The cor­ri­genda will also remove the inform­a­tion giv­en in Table 1, Recommended applic­a­tion of IEC 62061 and ISO 13849 – 1, found in the com­mon intro­duc­tion to both stand­ards and which is now out of date.

At some point in the near future, IEC and ISO  intend that ISO 13849 – 1 and IEC 62061 will be merged. A  Joint Working Group (JWG) of ISO/​TC 199 and IEC/​TC 44 will be formed to com­plete this task. No pub­lic time line has been set for this activ­ity, how­ever the Introduction to the Technical Report sug­gests that it may be a few years yet, as the TC’s involved want to get some feed­back from users on the latest ver­sions. If I had to haz­ard a guess, I would sug­gest that the new merged doc­u­ment might make its first appear­ance in 2013 when the cur­rent edi­tion of ISO 13849 – 1 comes up for main­ten­ance revi­sion. I guess we’ll have to wait and see wheth­er I’m right on that or not. In any case, I as a user of the stand­ards, I am whole­heartedly behind the mer­ger, and hope­fully the sim­pli­fic­a­tion, of these stand­ards to make them more access­ible to the machine build­ing community.


A bilin­gual (English and French) ver­sion of IEC/​TR 62061 – 1 edi­tion 1.0 is available.

ISO/​TR 23849:2010 is avail­able as a 14-​page doc­u­ment, in either English or French.

Download IEC stand­ards, International Electrotechnical Commission standards.

Watch for my review of this import­ant new doc­u­ment com­ing in the next few days!