Emergency Stop — What’s so confusing about that?

Posted by on March 6, 2009 1 comment
Emergency Stop on machine console
This entry is part 1 of 9 in the series Emergency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decep­tively sim­ple con­cepts that has man­aged to get very com­pli­cated over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cases, it may lead to an unrea­son­able expec­ta­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-​​specific stan­dards man­date the require­ment for emer­gency stop, such as CSA Z434-​​03, where robot con­trollers are required to pro­vide emer­gency stop func­tion­al­ity and work cells inte­grat­ing robots are also required to have emer­gency stop capability.

Defining Emergency Stop

Old, non-compliant, E-Stop Button

This OLD but­ton is def­i­nitely non-​​compliant.

So what is an Emergency Stop, or e-​​stop, and when do you need to have one? Let’s look at a few def­i­n­i­tions taken from CSA Z432-​​04:

Emergency sit­u­a­tion — an imme­di­ately haz­ardous sit­u­a­tion that needs to be ended or averted quickly in order to pre­vent injury or damage.

Emergency stop — a func­tion that is intended to avert harm or to reduce exist­ing haz­ards to per­sons, machin­ery, or work in progress.

Emergency stop but­ton — a red mushroom-​​headed but­ton that, when acti­vated, will imme­di­ately start the emer­gency stop sequence.

and one more:

6.2.3.5.3 Complementary pro­tec­tive mea­sures
Following the risk assess­ment, the mea­sures in this clause either shall be applied to the machine or shall be dealt with in the infor­ma­tion for use.

Protective mea­sures that are nei­ther inher­ently safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/​or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­mented as required by the intended use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­ited to,

a) emer­gency stop;

b) means of res­cue of trapped per­sons; and

c) means of energy iso­la­tion and dissipation.

Modern, non-compliant e-stop button.

This more mod­ern but­ton is non-​​compliant due to the RED back­ground and spring-​​return button.

So, an e-​​stop is a sys­tem that is intended for use in Emergency con­di­tions to try to limit or avert harm to some­one or some­thing. It isn’t a safe­guard, but is con­sid­ered to be a Complementary Protective Measure. So far so, good.

Is an Emergency Stop Required?

Depending on the reg­u­la­tions and the stan­dards you choose to read, machin­ery is not required to have  an Emergency Stop. Quoting from CSA Z432-​​04:

6.2.5.2.1 Components and ele­ments to achieve the emer­gency stop func­tion
If, fol­low­ing a risk assess­ment, it is deter­mined that in order to achieve ade­quate risk reduc­tion under emer­gency cir­cum­stances a machine must be fit­ted with com­po­nents and ele­ments nec­es­sary to achieve an emer­gency stop func­tion so that actual or impend­ing emer­gency sit­u­a­tions can be con­trolled, the fol­low­ing require­ments shall apply:

a) The actu­a­tors shall be clearly iden­ti­fi­able, clearly vis­i­ble, and read­ily accessible.

b) The haz­ardous process shall be stopped as quickly as pos­si­ble with­out cre­at­ing addi­tional haz­ards.
If this is not pos­si­ble or the risk can­not be ade­quately reduced, this may indi­cate that an emer­gency stop func­tion may not be the best solu­tion (i.e., other solu­tions should be sought). (Bolding added for empha­sis — DN)

c) The emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where necessary.

Note: For more detailed pro­vi­sions, see NFPA 79.

Download NFPA stan­dards through ANSI

This more modern button is still wrong due to the RED background.

This more mod­ern but­ton is non-​​compliant due to the RED background.

In fact, if you read Ontario’s Industrial Establishments reg­u­la­tion (Regulation 851), you will find that the only require­ment for an emer­gency stop is that it is prop­erly iden­ti­fied and located “within easy reach” of the oper­a­tor. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Internationally, a RED oper­a­tor device on a YELLOW back­ground, with or with­out any text behind it, is rec­og­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. I’ve scat­tered some exam­ples of dif­fer­ent com­pli­ant and non-​​compliant e-​​stop devices through this article.

The EU Machinery Directive, 2006/​42/​EC, and Emergency Stop

Interestingly, the European Union has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quoting from Annex I of the Machinery Directive:

1.2.4.3. Emergency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actual or impend­ing dan­ger to be averted.

Notice the words “…actual or impend­ing dan­ger…” This har­mo­nizes with the def­i­n­i­tion of Complementary Protective Measures, in that they are intended to allow a user to “avert or limit harm” from a haz­ard. Clearly, the direc­tion from the European per­spec­tive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machin­ery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial mea­sures required to deal with the risk to be taken,
  • portable hand-​​held and/​or hand-​​guided machinery.

From these two bul­lets it becomes clear that, just as in the Canadian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely impor­tant, and often over­looked. If the risks can­not be con­trolled effec­tively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-​​stop sys­tem, then it should not be included in the design.

Carrying on with the same clause:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­i­ble and quickly acces­si­ble con­trol devices,
  • stop the haz­ardous process as quickly as pos­si­ble, with­out cre­at­ing addi­tional risks,
  • where nec­es­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard movements.

Once again, this is con­sis­tent with the gen­eral require­ments found in the Canadian and US reg­u­la­tions. The direc­tive goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once active oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is specif­i­cally over­rid­den; it must not be pos­si­ble to engage the device with­out trig­ger­ing a stop com­mand; it must be pos­si­ble to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­gag­ing the device must not restart the machin­ery but only per­mit restarting.

The emer­gency stop func­tion must be avail­able and oper­a­tional at all times, regard­less of the oper­at­ing mode.

Emergency stop devices must be a back-​​up to other safe­guard­ing mea­sures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-​​stop devices to latch in the acti­vated posi­tion. The last part of that sen­tence is even more impor­tant: “…dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem have a sec­ond dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-​​stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a sec­ond action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed. Point of Clarification: I had a ques­tion come from a reader ask­ing if com­bin­ing the e-​​stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machin­ery does not indi­cate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing characteristics:
  • The device must latch in the acti­vated position;
  • The device must have a “neu­tral” posi­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
  • The reset posi­tion must be dis­tinct from the pre­vi­ous two posi­tions, and the device must spring-​​return to the neu­tral position.

The sec­ond sen­tence har­mo­nizes with the require­ments of the Canadian and US standards.

Finally, the last sen­tence har­mo­nizes with the idea of “Complementary Protective Measures” as described in CSA Z432.

How Many and Where?

Where? “Within easy reach”. Consider the loca­tions where you EXPECT an oper­a­tor to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points… you get the idea. Anywhere you can rea­son­ably expect an oper­a­tor to be under nor­mal cir­cum­stances is a rea­son­able place to put an e-​​stop device. “Easy Reach” I inter­pret as within the arm-​​span of an adult (pre­sum­ing the equip­ment is not intended for use by chil­dren). This trans­lates to 500–600 mm either side of the cen­ter line of most work stations.

How do you know if you need an emer­gency stop? Start with a stop/​start analy­sis. Identify all the nor­mal start­ing and stop­ping modes that you antic­i­pate on the equip­ment. Consider all of the dif­fer­ent oper­at­ing modes that you are pro­vid­ing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop function.

Do a risk assess­ment. This is a basic require­ment in most juris­dic­tions today.

As you deter­mine your risk con­trol mea­sures (fol­low­ing the hier­ar­chy of con­trols), look at what risks you might con­trol with an Emergency Stop. Remember that e-​​stops fall below safe­guards in the hier­ar­chy, so you must use a safe­guard­ing tech­nique if pos­si­ble, you can’t just default down to an emer­gency stop. IF the e-​​stop can pro­vide you with the addi­tional risk reduc­tion, then use it but first,  reduce the risks in other ways.

The Stop Function and Control Reliability Requirements

Finally, once you deter­mine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 is the ref­er­ence stan­dard for Canada, although you can find very sim­i­lar require­ments in IEC 60204–1 if you are work­ing in an inter­na­tional market.

Download NFPA stan­dards through ANSI
Download IEC stan­dards, International Electrotechnical Commission standards.

Functional Stop Categories

NFPA 79 calls out three basic cat­e­gories of stop. Note that these are NOT reli­a­bil­ity cat­e­gories, but are func­tional cat­e­gories. Reliability is not addressed in these sec­tions. Quoting from the standard:

9.2.2 Stop Functions. The three cat­e­gories of stop func­tions shall be as follows:

(1) Category 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actuators.

(2) Category 1 is a con­trolled stop with power to the machine actu­a­tors avail­able to achieve the stop then remove power when the stop is achieved.

(3) Category 2 is a con­trolled stop with power left avail­able to the machine actuators.

This E-Stop Button is correct.

This E-​​Stop but­ton is CORRECT. Note the Push-​​Pull-​​Twist oper­a­tor and the YELLOW background.

A bit later, the stan­dards says:

9.2.5.3 Stop.
9.2.5.3.1 Each machine shall be equipped with a Category 0 stop.

9.2.5.3.2 Category 0, Category 1, and/​or Category 2 stops shall be pro­vided where indi­cated by an analy­sis of the risk assess­ment and the func­tional require­ments of the machine. Category 0 and Category 1 stops shall be oper­a­tional regard­less of oper­at­ing modes, and Category 0 shall take pri­or­ity. Stop func­tion shall oper­ate by de-​​energizing that rel­e­vant cir­cuit and shall over­ride related start functions.

Note that 9.2.5.3.1 does NOT mean that every machine must have an e-​​stop. It sim­ply says that every machine must have a way to stop the machine that is equiv­a­lent to “pulling the plug”. The main dis­con­nect on the con­trol panel can be used for this func­tion if sized and rated appro­pri­ately. The ques­tion of HOW to effect the Category 0 stop depends on WHEN it will be used — i.e. what risks must be reduced, or what haz­ards must be con­trolled by the e-​​stop.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.2. You just can’t get away from it…

Control Reliability

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.

Disconnect with E-​​Stop Colours indi­cates that this device is intended to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tional cat­e­gory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can deter­mine the degree of reli­a­bil­ity required. In Canada, CSA Z432 gives us these cat­e­gories: SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL MONITORED and CONTROL RELIABLE. These cat­e­gories are being replaced slowly by Performance Levels (PL) as defined in ISO 13849–1 2007.

The short answer is that the greater the risk reduc­tion required, the higher the degree of reli­a­bil­ity required. In many cases, a SINGLE CHANNEL or SINGLE CHANNEL MONITORED solu­tion may be accept­able, par­tic­u­larly when there are more reli­able safe­guards in place. On the other hand, you may require CONTROL RELIABLE designs if the e-​​stop is the pri­mary risk reduc­tion for some risks or spe­cific tasks.

Extra points go to any reader who noticed that the ‘elec­tri­cal haz­ard’ warn­ing label imme­di­ately above the dis­con­nect han­dle in the above photo is a) upside down, and b) using a non-​​standard light­ing flash. Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts.

Use of Emergency Stop as part of a Lockout Procedure or HECP.

One last note: Emergency stop sys­tems (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-​​stop) CANNOT be used for energy iso­la­tion in a Hazardous Energy Control Procedure (a.k.a. Lockout). Devices for this pur­pose must phys­i­cally sep­a­rate the energy source from the down-​​stream com­po­nents. See CSA Z460-​​05 for more on that subject.

Read our Article on Using E-​​Stops in HECP.

Pneumatic E-Stop Device

Pneumatic E-​​Stop/​Isolation device.

Standards Referenced in this post:

CSA Z432-​​04, Safeguarding of Machinery

NFPA 79–07, Electrical Standard for Industrial Machinery
Download NFPA stan­dards at ANSI

IEC 60204–1:09,  SAFETY OF MACHINERY — ELECTRICAL EQUIPMENT OF MACHINES — PART 1: GENERAL REQUIREMENTS

Download IEC stan­dards, International Electrotechnical Commission standards.

ISO 13849−1−2007, Safety of machin­ery — Safety-​​related parts of con­trol sys­tems — Part 1: General prin­ci­ples for design

See also

ISO 13850:06, SAFETY OF MACHINERY — EMERGENCY STOP — PRINCIPLES FOR DESIGN

Download IEC stan­dards, International Electrotechnical Commission stan­dards.
Download ISO Standards

Checking Emergency Stop Systems

Posted by on July 15, 2010 7 comments
This entry is part 2 of 9 in the series Emergency Stop

A while back I wrote about the basic design require­ments for Emergency Stop sys­tems. I’ve had sev­eral peo­ple con­tact me want­ing to know about check­ing and test­ing emer­gency stops, so here are my thoughts on this process.

Figure 1 below, excerpted from the 1996 edi­tion of ISO 13850, Safety of machin­ery — Emergency stop — Principles for design, shows the emer­gency stop func­tion graph­i­cally. As you can see, the ini­ti­at­ing fac­tor in this func­tion is a per­son becom­ing aware of the need for an emer­gency stop. This is NOT an auto­matic func­tion and is NOT a safety or safe­guard­ing function.

Download ISO Standards

ISO 13850 1996 Figure 1 - Emergency Stop Function

ISO 13850 1996 Figure 1 — Emergency Stop Function

Download ISO Standards

I men­tion this because many peo­ple are con­fused about this point. Emergency stop sys­tems are con­sid­ered to be ‘com­pli­men­tary pro­tec­tive mea­sures’, mean­ing that their func­tions com­ple­ment the safe­guard­ing sys­tems, but can­not be con­sid­ered to be safe­guards in and of them­selves. This is sig­nif­i­cant. Safeguarding sys­tems are required to act auto­mat­i­cally to pro­tect an exposed per­son. Think about how an inter­locked gate or a light cur­tain acts to stop haz­ardous motion BEFORE the per­son can reach it. Emergency stop is nor­mally used AFTER the per­son is already involved with the haz­ard, and the next step is nor­mally to call 911.

All of that is impor­tant from the per­spec­tive of con­trol reli­a­bil­ity. The con­trol reli­a­bil­ity require­ments for emer­gency stop sys­tems are often dif­fer­ent from those for the safe­guard­ing sys­tems because they are a backup sys­tem. Determination of the reli­a­bil­ity require­ments is based on the risk assess­ment and on an analy­sis of the cir­cum­stances where you, as the designer, antic­i­pate that emer­gency stop may be help­ful in reduc­ing or avoid­ing injury or machin­ery dam­age. Frequently, these sys­tems have lower con­trol reli­a­bil­ity require­ments than do safe­guard­ing systems.

Before you begin any test­ing, under­stand what effects the test­ing will have on the machin­ery. Emergency stops can be par­tially tested with the machin­ery at rest. Depending on the func­tion of the machin­ery and the dif­fi­culty in recov­er­ing from an emer­gency stop con­di­tion, you may need to adjust your approach to these tests. Start by review­ing the emer­gency stop func­tional descrip­tion in the man­ual. Here’s an exam­ple taken from a real machine manual:

Emergency Stop (E-​​Stop) Button


Emergency Stop Button

Figure 2.1 Emergency Stop (E-​​Stop) Button


A red emer­gency stop (E-​​Stop) but­ton is a safety device which allows the oper­a­tor to stop the machine in an emer­gency. At any time dur­ing oper­a­tion, press the E-​​Stop but­ton to dis­con­nect actu­a­tor power and stop all con­nected machines in the pro­duc­tion line. Figure 2.1 shows the emer­gency stop but­ton.

There is one E-​​Stop but­ton on the pneu­matic panel.

NOTE: After press­ing the E-​​Stop but­ton, the entire pro­duc­tion line from spreader-​​feeder to stacker shuts down. When the E-​​Stop but­ton is reset, all machines in the pro­duc­tion line will need to be restarted.

DANGER: These devices do not dis­con­nect main elec­tri­cal power from the machine. See “Electrical Disconnect” on page 21.

As you can see, the gen­eral func­tion of the but­ton is described, and some warn­ings are given about what does and doesn’t hap­pen when the but­ton is pressed.

Now, if the emer­gency stop sys­tem has been designed prop­erly and the machine is oper­at­ing nor­mally, press­ing the emer­gency stop but­ton while the machine is in mid-​​cycle should result in the machin­ery com­ing to a fast and grace­ful stop. Here is what ISO 13850 has to say about this condition:

4.1.3 The emer­gency stop func­tion shall be so designed that, after actu­a­tion of the emer­gency stop actu­a­tor, haz­ardous move­ments and oper­a­tions of the machine are stopped in an appro­pri­ate man­ner, with­out cre­at­ing addi­tional haz­ards and with­out any fur­ther inter­ven­tion by any per­son, accord­ing to the risk assess­ment.
An “appro­pri­ate man­ner” can include

  • choice of an opti­mal decel­er­a­tion rate,
  • selec­tion of the stop cat­e­gory (see 4.1.4), and
  • employ­ment of a pre­de­ter­mined shut­down sequence.

The emer­gency stop func­tion shall be so designed that a deci­sion to use the emer­gency stop device does not
require the machine oper­a­tor to con­sider the resul­tant effects.

The inten­tion of this func­tion is to bring the machin­ery to a halt as quickly as pos­si­ble with­out break­ing it. However, if the brak­ing sys­tems fail, e.g. the servo drive fails to decel­er­ate the tool­ing as it should, then drop­ping power and poten­tially break­ing the machin­ery is acceptable.

In many sys­tems, press­ing the e-​​stop but­ton or oth­er­wise acti­vat­ing the emer­gency stop sys­tem will result in a fault or an error being dis­played on the machine’s oper­a­tor dis­play. This can be used as an indi­ca­tion that the con­trol sys­tem ‘knows’ that the sys­tem has been activated.

ISO 13850 requires that emer­gency stop sys­tems exhibit the fol­low­ing key behaviours:

  • It must over­ride all other con­trol func­tions, and no start func­tions are per­mit­ted (intended, unin­tended or unex­pected) until the emer­gency stop has been reset;
  • Use of the emer­gency stop can­not impair the oper­a­tion of any func­tions of the machine intended for the release of trapped persons;
  • It is not per­mit­ted to affect the func­tion of any other safety crit­i­cal sys­tems or devices.

Tests

Once the emer­gency stop device has been acti­vated, con­trol power is nor­mally lost. Pressing any START func­tion on the con­trol panel, except POWER ON or RESET should have no effect. If any aspect of the machine starts, count this as a FAILED test.

If reset­ting the emer­gency stop device results in con­trol power being re-​​applied, count this as a FAILED test.

Pressing POWER ON or RESET before the acti­vated emer­gency stop device has been reset (i.e. the e-​​stop but­ton has been pulled out to the ‘oper­ate’ posi­tion), should have no effect. If you can turn the power back on before you reset the emer­gency stop device, count this as a FAILED test.

Once the emer­gency stop device has been reset, press­ing POWER ON or RESET should result in the con­trol power being restored. This is accept­able. The machine should not restart. If the machine restarts nor­mal oper­a­tion, count this as a FAILED test.

Once con­trol power is back on, you may have a num­ber of faults to clear. When all the faults have been cleared, press­ing the START but­ton should result in the machine restart­ing. This is accept­able behaviour.

If you break the machine while test­ing the emer­gency stop sys­tem, count this as a FAILED test.

Test all emer­gency stop devices. A wiring error or other prob­lems may not be appar­ent until the emer­gency stop device is tested. Push all but­tons, pull all pull cords, acti­vate all emer­gency stop devices. If any fail to cre­ate the emer­gency stop con­di­tion, count this as a FAILED test.

If, hav­ing con­ducted all of these tests, no fail­ures have been detected, con­sider the sys­tem to have passed basic func­tional test­ing. Depending on the com­plex­ity of the sys­tem and the crit­i­cal­ity of the emer­gency stop func­tion, addi­tional test­ing may be required. It may be nec­es­sary to develop some func­tional tests that are con­ducted while var­i­ous EMI sig­nals are present, for example.

If you have any ques­tions regard­ing test­ing of emer­gency stop devices, please email me  (dnixatcom­pli­an­cein­sightdotca)  !

Download ISO Standards

Guarding Emergency Stop Devices

Posted by on September 3, 2010 6 comments
This entry is part 3 of 9 in the series Emergency Stop

A lot of con­fu­sion exists when it comes to Emergency Stop sys­tems, and clients often ask me if it is ‘OK’ to guard emer­gency stop devices like e-​​stop but­tons, foot ped­als, pull-​​cords, etc. Without get­ting into a ton of reg­u­la­tory details, this arti­cle will look at the require­ments in for emer­gency stop devices in three key juris­dic­tions: Canada, the USA and the European Union.

If you need infor­ma­tion on the func­tional aspects of emer­gency stop sys­tems, see “Emergency Stop — What’s so con­fus­ing about that?”

Why Guard an Emergency Stop?

Generally, emer­gency stop devices, or e-​​stop devices as they’re often called, need to be pro­tected from unin­ten­tional use. This prob­lem occurs because e-​​stop devices have to be located close to where peo­ple work in order to be use­ful. An e-​​stop you can’t reach when you need it may as well not be there in the first place. So emer­gency stops are located at ‘nor­mal oper­a­tor sta­tions’. This often means they are located under the edge of a machine table, or on an oper­a­tor con­trol bar like that used on power presses, putting the e-​​stop within reach, but also in the ‘line-​​of-​​fire’ when it comes to the operator’s nor­mal movements.

To pre­vent unin­tended oper­a­tion, peo­ple often want to put rings, col­lars, or worse — cov­ers — on or around the e-​​stop device to keep peo­ple from bump­ing the device. Some of these can be done and should be done, and oth­ers are never per­mit­ted for good reason.

Regulatory Requirements

Let’s take a look at the key require­ments from the reg­u­la­tions world wide:

  1. Emergency Stop devices must be clearly iden­ti­fied. The tech­ni­cal stan­dards require that emer­gency stop devices be coloured RED with a YELLOW background.
  2. They must be located within easy reach of the oper­a­tor. This applies to all nor­mal work­sta­tions where oper­a­tors inter­act with the machine. For main­te­nance and ser­vice activ­i­ties where work­ers may be in loca­tions other than nor­mal work­sta­tions, a pen­dant or other portable con­trol must be used to cause machine motion. This device must include an emer­gency stop con­trol along with other com­ple­men­tary safe­guard­ing devices such as enabling devices and hold-​​to-​​run con­trols. Where access is only allowed under lock­out con­di­tions, this is not required.
  3. Buttons must be palm or mushroom-​​shaped devices.
  4. Devices must require man­ual reset­ting. This means that the device must latch in the oper­ated posi­tion and require a delib­er­ate action to reset the device. This includes actions such as: pulling put a pressed but­ton, twist­ing a but­ton to release the latched con­di­tion, press­ing a reset but­ton on a pull-​​cord to reset the tripped con­di­tion, etc.
  5. Unguarded. This means that easy access to the device may not be impeded, con­sid­er­ing the per­sonal pro­tec­tive equip­ment (PPE) that work­ers are required to wear. Devices that would be con­sid­ered to be guards would include:
  • Close fit­ting rings or col­lars that require a worker to insert a fin­ger inside the ring or col­lar to reach the device and acti­vate it,
  • cov­ers that close over the device to pre­vent access,
  • lock­ing device that pre­vent access to the device, etc.

So, con­sid­er­ing point 5 above, isn’t this the end of the dis­cus­sion? Not at all! There are a few fac­tors to con­sider first.

An impor­tant con­sid­er­a­tion is the poten­tial for acci­den­tal oper­a­tion. Depending on the machine or process, acci­den­tal oper­a­tion of emer­gency stop devices may result in sig­nif­i­cant lost pro­duc­tion and/​or dam­age to equip­ment. In cases like this, it is rea­son­able to pro­tect the device from acci­den­tal oper­a­tion as long as the mea­sures taken to pro­tect the device do not impede the oper­a­tion of the device in emer­gency conditions.

ISO 13850 2006 sup­ports this idea in Clause 4.4 Emergency stop device:

4.4.2 An emer­gency stop device shall be located at each oper­a­tor con­trol sta­tion, except where the risk assess­ment indi­cates that this is not nec­es­sary, as well as at other loca­tions, as deter­mined by the risk assess­ment. It shall be posi­tioned such that it is read­ily acces­si­ble and capa­ble of non-​​hazardous actu­a­tion by the oper­a­tor and oth­ers who could need to actu­ate it. Measures against inad­ver­tent actu­a­tion should not impair its acces­si­bil­ity. (Author’s Note: Bold text added for emphasis.)

Summing Up

The key dif­fer­ence between North American think­ing and International/​EU think­ing is in the term “unguarded” as used in the North American stan­dards, ver­sus ISO 13850, § 4.2.2, where the designer is reminded, “Measures against inad­ver­tent actu­a­tion should not impair its accessibility.”

In my opin­ion it is rea­son­able to pro­tect an emer­gency stop device from inad­ver­tent oper­a­tion by plac­ing a ring or other sim­i­lar struc­ture around an emer­gency stop device as long as the struc­ture does not impair easy access to the device by the operator.

I know this opin­ion appears ini­tially to go against the estab­lished North American stan­dards, how­ever it can be log­i­cally argued, based on the def­i­n­i­tion of the word “guard”.

A guard is a device that pre­vents access to some­thing, usu­ally a haz­ard. Considering that we are talk­ing about a con­trol that is designed to reduce or limit harm, any struc­ture that does not pre­vent access to the emer­gency stop device asso­ci­ated with the struc­ture should be con­sid­ered to be acceptable.

That said, devices like:

  • hinged cov­ers;
  • doors;
  • lock­ing devices;
  • nar­row col­lars; and
  • any other device or structure

that unduly lim­its access to the emer­gency stop device can­not be con­sid­ered acceptable.

Effects of PPE

The phrase ‘unduly lim­its access’ has spe­cific mean­ing here. If work­ers are expected to be wear­ing PPE on the body part used to acti­vate the emer­gency stop device, such as gloves or boots for exam­ple, then the struc­ture placed around the emer­gency stop device must take the added dimen­sions of the PPE and the reduc­tion in tac­tile capa­bil­ity that may occur (e.g. heavy work gloves make it hard to feel things eas­ily), and must com­pen­sate for the effects of the PPE. Big gloves/​boots = Big open­ing in the structure.

Lighting and pro­tec­tive eye­wear can also play a part. You may need to use reflec­tive or lumi­nes­cent paint to high­light the loca­tion of the device in low light envi­ron­ments or where very dark eye­wear is required, like that needed by welders or used by work­ers around some infrared lasers with open beam paths.

Effects of State-​​of-​​Mind

It’s also impor­tant to con­sider the likely state-​​of-​​mind of a worker need­ing to use an emer­gency stop device. They are either urgently try­ing to stop the machine because,

  1. another safe­guard has failed an some­one is involved with a haz­ard, includ­ing them­selves, or
  2. the machine is dam­ag­ing itself or the prod­uct and they need to limit the damage.

Both sce­nar­ios have a high level of urgency attached to them. The human mind tends to miss obvi­ous things includ­ing train­ing, when placed under high lev­els of stress. Structures placed around emer­gency stop devices, such as cov­ers, that com­pletely block access, even though they may be eas­ily opened, may be enough to pre­vent access in an emergency.

The answer you’ve all been wait­ing for!

So in the end, can you put a struc­ture around an emer­gency stop to reduce inad­ver­tent oper­a­tion of the device:

YES!

Just make sure that you con­sider all the fac­tors that may affect it’s use, doc­u­ment your analy­sis, and don’t unduly restrict access to the device.

Need more help? Feel free to email me!

References

IEC – International Electrotechnical Commission

ISO – International Organization for Standardization

Safety of machin­ery — Emergency stop — Principles for design, ISO 13850, 2006, ISO, Geneva, Switzerland.

Control of Hazardous Energy ­– Lockout and Other Methods, CSA Z460, 2005, Canadian Standards Association, Toronto, Canada.

Control of Hazardous Energy – Lockout/​Tagout and Alternative Methods, ANSI ASSE Z244.1, 2003, American National Standards Institute /​ American Society of Safety Engineers, Des Plaines, IL, USA.

All original content on these pages is fingerprinted and certified by Digiprove
Performance Optimization WordPress Plugins by W3 EDGE