Interlock Architectures — Pt. 1: What do those categories really mean?

This entry is part 1 of 8 in the series Cir­cuit Archi­tec­tures Explored

In 1995 CEN pub­lished an impor­tant stan­dard for machine builders — EN 954–1, Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design. This stan­dard set the stage for defin­ing con­trol reli­a­bil­i­ty in machin­ery safe­guard­ing sys­tems, intro­duc­ing the Reli­a­bil­i­ty cat­e­gories that have become ubiq­ui­tous. So what do these cat­e­gories mean, and how are they applied under the lat­est machin­ery stan­dard, ISO 13849–1?

What do those categories really mean?

The archi­tec­tures used as the basis of inter­lock design and analy­sis have a long his­to­ry. Two basic forms exist­ed in the ear­ly days: the ANSI cat­e­gories and the CSA vari­ant, and the CEN forms.

The ANSI/CSA archi­tec­tures were called SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL-MONITORED, and CONTROL RELIABLE. The basic sys­tem arose in the ANSI/RIA R15.06 1992 stan­dard and was used until 2014. The CSA vari­ant used the same names as the ANSI ver­sion but made a small dif­fer­en­ti­a­tion in the CONTROL RELIABLE cat­e­go­ry. This dif­fer­en­ti­a­tion was very sub­tle and was often com­plete­ly mis­un­der­stood by read­ers. This sys­tem was intro­duced in Cana­da in CSA Z434-1994 and was dis­con­tin­ued in 2016. This sys­tem of safe­ty-relat­ed con­trol sys­tem archi­tec­ture cat­e­gories is no longer used in any juris­dic­tion.

And then there was EN 954–1

In 1996 CEN pub­lished an impor­tant stan­dard for machine builders — EN 954–1, “Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design” [1]. This stan­dard set the stage for defin­ing con­trol reli­a­bil­i­ty in machin­ery safe­guard­ing sys­tems, intro­duc­ing the Reli­a­bil­i­ty cat­e­gories that have become ubiq­ui­tous. So what do these cat­e­gories mean, and how are they applied under the lat­est machin­ery func­tion­al safe­ty stan­dard, ISO 13849–1 [2]?

Down­load ISO Stan­dards

Circuit Categories

The cat­e­gories are used to describe sys­tem archi­tec­tures for safe­ty-relat­ed con­trol sys­tems. Each archi­tec­ture car­ries with it a range of reli­able per­for­mance that can be relat­ed to the degree of risk reduc­tion you are expect­ing to achieve with the sys­tem. These archi­tec­tures can be applied equal­ly to elec­tri­cal, elec­tron­ic, pneu­mat­ic, hydraulic or mechan­i­cal con­trol sys­tems.

Historical Circuits

Ear­ly elec­tri­cal ‘mas­ter-con­trol-relay’ cir­cuits used a sim­ple archi­tec­ture with a sin­gle con­tac­tor, or some­times two, and a sin­gle chan­nel style of archi­tec­ture to main­tain the con­tac­tor coil cir­cuit once the START or POWER ON but­ton (PB2 in Fig. 1) had been pressed. Pow­er to the out­put ele­ments of the machine con­trols was sup­plied via con­tacts on the con­tac­tor, which is why it was called the Mas­ter Con­trol Relay or ‘MCR’. The POWER OFF but­ton (PB1 in Fig. 1) could be labeled that way, or you could make the same cir­cuit into an Emer­gency Stop by sim­ply replac­ing the oper­a­tor with a red mush­room-head push but­ton. These devices were usu­al­ly spring-return, so to restore pow­er, all that was need­ed was to push the POWER ON but­ton again (Fig.1).

Basic Stop/Start Circuit
Fig­ure 1 — Basic Stop/Start Cir­cuit
Allen-Bradley 700PK Heavy Duty Contactor
Allen-Bradley 700PK Heavy Duty Con­tac­tor

Typ­i­cal­ly, the com­po­nents used in these cir­cuits were spec­i­fied to meet the cir­cuit con­di­tions, but not more. Con­trols man­u­fac­tur­ers brought out over-dimen­sioned ver­sions, such as Allen-Bradley’s Bul­letin 700-PK con­tac­tor which had 20 A rat­ed con­tacts instead of the stan­dard Bul­letin 700’s 10 A con­tacts.

When inter­locked guards began to show up, they were inte­grat­ed into the orig­i­nal MCR cir­cuit by adding a basic con­trol relay (CR1 in Fig. 2) whose coil was con­trolled by the inter­lock switch(es) (LS1 in Fig. 2), and whose out­put con­tacts were in series with the coil cir­cuit of the MCR con­tac­tor. Open­ing the guard inter­lock would open the MCR coil cir­cuit and drop pow­er to the machine con­trols. Very sim­ple.

Start/Stop Circuit with Guard Relay
Fig­ure 2 — Old-School Start/Stop Cir­cuit with Guard Relay
Typical ice-cube style relay
Typ­i­cal ice-cube style relay

Ice-cube’ style plug-in relays were often cho­sen for CR1. These devices did not have ‘force-guid­ed’ con­tacts in them, so it was pos­si­ble to have one con­tact in the relay fail while the oth­er con­tin­ued to oper­ate prop­er­ly.

LS1 could be any kind of switch. Fre­quent­ly a ‘micro-switch’ style of lim­it switch was cho­sen. These snap-action switch­es could fail short­ed inter­nal­ly, or weld closed and the actu­a­tor would con­tin­ue to work nor­mal­ly even though the switch itself had failed. These switch­es are also ridicu­lous­ly easy to bypass. All that is required is a piece of tape or an elas­tic band and the switch is no longer doing its job.

Micro-Switch style limit switch used as an interlock switch
Micro-Switch style lim­it switch used as a cov­er inter­lock switch in a piece of indus­tri­al laun­dry equip­ment

The prob­lem with these cir­cuits is that they can fail in a num­ber of ways that aren’t obvi­ous to the user, with the result being that the inter­lock might not work as expect­ed, or the Emer­gency Stop might fail just when you need it most.

Modern Circuits

Category B

These orig­i­nal cir­cuits are the basis for what became known as ‘Cat­e­go­ry B’ (‘B’ for ‘Basic’) cir­cuits. Here’s the def­i­n­i­tion from the stan­dard. Note that I am tak­ing this excerpt from ISO 13849–1: 2007 (Edi­tion 2). “SRP/CS” stands for “Safe­ty Relat­ed Parts of Con­trol Sys­tems”:

6.2.3 Cat­e­go­ry B
The SRP/CS shall, as a min­i­mum, be designed, con­struct­ed, select­ed, assem­bled and com­bined in accor­dance with the rel­e­vant stan­dards and using basic safe­ty prin­ci­ples for the spe­cif­ic appli­ca­tion to with­stand

  • the expect­ed oper­at­ing stress­es, e.g. the reli­a­bil­i­ty with respect to break­ing capac­i­ty and fre­quen­cy,
  • the influ­ence of the processed mate­r­i­al, e.g. deter­gents in a wash­ing machine, and
  • oth­er rel­e­vant exter­nal influ­ences, e.g. mechan­i­cal vibra­tion, elec­tro­mag­net­ic inter­fer­ence, pow­er sup­ply inter­rup­tions or dis­tur­bances.

There is no diag­nos­tic cov­er­age (DCavg = none) with­in cat­e­go­ry B sys­tems and the MTTFd of each chan­nel can be low to medi­um. In such struc­tures (nor­mal­ly sin­gle-chan­nel sys­tems), the con­sid­er­a­tion of CCF is not rel­e­vant.

The max­i­mum PL achiev­able with cat­e­go­ry B is PL = b.

NOTE When a fault occurs it can lead to the loss of the safe­ty func­tion.

Spe­cif­ic require­ments for elec­tro­mag­net­ic com­pat­i­bil­i­ty are found in the rel­e­vant prod­uct stan­dards, e.g. IEC 61800–3 for pow­er dri­ve sys­tems. For func­tion­al safe­ty of SRP/CS in par­tic­u­lar, the immu­ni­ty require­ments are rel­e­vant. If no prod­uct stan­dard exists, at least the immu­ni­ty require­ments of IEC 61000–6-2 should be fol­lowed.

The stan­dard also pro­vides us with a nice block dia­gram of what a sin­gle-chan­nel sys­tem might look like:

Category B Designated Architecture
ISO 13849–1 Cat­e­go­ry B Des­ig­nat­ed Archi­tec­ture

If you look at this block dia­gram and the Start/Stop Cir­cuit with Guard Relay above, you can see how this basic cir­cuit trans­lates into a sin­gle chan­nel archi­tec­ture, since from the con­trol inputs to the con­trolled load you have a sin­gle chan­nel. Even the guard loop is a sin­gle chan­nel. A fail­ure in any com­po­nent in the chan­nel can result in loss of con­trol of the load.

Lets look at each part of this require­ment in more detail, since each of the sub­se­quent Cat­e­gories builds upon these BASIC require­ments.

The SRP/CS shall, as a min­i­mum, be designed, con­struct­ed, select­ed, assem­bled and com­bined in accor­dance with the rel­e­vant stan­dards and using basic safe­ty prin­ci­ples for the spe­cif­ic appli­ca­tion…

Basic Safety Principles

We have to go to ISO 13849–2 to get a def­i­n­i­tion of what Basic Safe­ty Prin­ci­ples might include. Look­ing at Annex A.2 of the stan­dard we find:

Table A.1 — Basic Safety Principles

Basic Safe­ty Prin­ci­ples Remarks
Use of suit­able mate­ri­als and ade­quate man­u­fac­tur­ing Selec­tion of mate­r­i­al, man­u­fac­tur­ing meth­ods and treat­ment in rela­tion to, e. g. stress, dura­bil­i­ty, elas­tic­i­ty, fric­tion, wear,
cor­ro­sion, tem­per­a­ture.
Cor­rect dimen­sion­ing and shap­ing Con­sid­er e. g. stress, strain, fatigue, sur­face rough­ness, tol­er­ances, stick­ing, man­u­fac­tur­ing.
Prop­er selec­tion, com­bi­na­tion, arrange­ments, assem­bly and instal­la­tion of components/systems. Apply manufacturer’s appli­ca­tion notes, e. g. cat­a­logue sheets, instal­la­tion instruc­tions, spec­i­fi­ca­tions, and use of good engi­neer­ing prac­tice in sim­i­lar components/systems.
Use of de–energisation prin­ci­ple The safe state is obtained by release of ener­gy. See pri­ma­ry action for stop­ping in EN 292–2:1991 (ISO/TR 12100–2:1992), 3.7.1. Ener­gy is sup­plied for start­ing the move­ment of a mech­a­nism. See pri­ma­ry action for start­ing in EN 292–2:1991 (ISO/TR 12100–2:1992), 3.7.1.Consider dif­fer­ent modes, e. g. oper­a­tion mode, main­te­nance mode.

This prin­ci­ple shall not be used in spe­cial appli­ca­tions, e. g. to keep ener­gy for clamp­ing devices.

Prop­er fas­ten­ing For the appli­ca­tion of screw lock­ing con­sid­er manufacturer’s appli­ca­tion notes.Overloading can be avoid­ed by apply­ing ade­quate torque load­ing tech­nol­o­gy.
Lim­i­ta­tion of the gen­er­a­tion and/or trans­mis­sion of force and sim­i­lar para­me­ters Exam­ples are break pin, break plate, torque lim­it­ing clutch.
Lim­i­ta­tion of range of envi­ron­men­tal para­me­ters Exam­ples of para­me­ters are tem­per­a­ture, humid­i­ty, pol­lu­tion at the instal­la­tion place. See clause 8 and con­sid­er
manufacturer’s appli­ca­tion notes.
Lim­i­ta­tion of speed and sim­i­lar para­me­ters Con­sid­er e. g. the speed, accel­er­a­tion, decel­er­a­tion required by the appli­ca­tion
Prop­er reac­tion time Con­sid­er e. g. spring tired­ness, fric­tion, lubri­ca­tion, tem­per­a­ture, iner­tia dur­ing accel­er­a­tion and decel­er­a­tion,
com­bi­na­tion of tol­er­ances.
Pro­tec­tion against unex­pect­ed start–up Con­sid­er unex­pect­ed start-up caused by stored ener­gy and after pow­er “sup­ply” restora­tion for dif­fer­ent modes as
oper­a­tion mode, main­te­nance mode etc.
Spe­cial equip­ment for release of stored ener­gy may be nec­es­sary.
Spe­cial appli­ca­tions, e. g. to keep ener­gy for clamp­ing devices or ensure a posi­tion, need to be con­sid­ered
sep­a­rate­ly.
Sim­pli­fi­ca­tion Reduce the num­ber of com­po­nents in the safe­ty-relat­ed sys­tem.
Sep­a­ra­tion Sep­a­ra­tion of safe­ty-relat­ed func­tions from oth­er func­tions.
Prop­er lubri­ca­tion
Prop­er pre­ven­tion of the ingress of flu­ids and dust Con­sid­er IP rat­ing [see EN 60529 (IEC 60529)]

Down­load ISO Stan­dards
As you can see, the basic safe­ty prin­ci­ples are pret­ty basic — select com­po­nents appro­pri­ate­ly for the appli­ca­tion, con­sid­er the oper­at­ing con­di­tions for the com­po­nents, fol­low manufacturer’s data, and use de-ener­giza­tion to cre­ate the stop func­tion. That way, a loss of pow­er results in the sys­tem fail­ing into a safe state, as does an open relay coil or set of burnt con­tacts.

…the expect­ed oper­at­ing stress­es, e.g. the reli­a­bil­i­ty with respect to break­ing capac­i­ty and fre­quen­cy,”

Spec­i­fy your com­po­nents cor­rect­ly with regard to volt­age, cur­rent, break­ing capac­i­ty, tem­per­a­ture, humid­i­ty, dust,…

…oth­er rel­e­vant exter­nal influ­ences, e.g. mechan­i­cal vibra­tion, elec­tro­mag­net­ic inter­fer­ence, pow­er sup­ply inter­rup­tions or dis­tur­bances.”

Spe­cif­ic require­ments for elec­tro­mag­net­ic com­pat­i­bil­i­ty are found in the rel­e­vant prod­uct stan­dards, e.g. IEC 61800–3 for pow­er dri­ve sys­tems. For func­tion­al safe­ty of SRP/CS in par­tic­u­lar, the immu­ni­ty require­ments are rel­e­vant. If no prod­uct stan­dard exists, at least the immu­ni­ty require­ments of IEC 61000–6-2 should be fol­lowed.”

Prob­a­bly the biggest ‘gotcha’ in this point is “elec­tro­mag­net­ic inter­fer­ence”. This is impor­tant enough that the stan­dard devotes a para­graph to it specif­i­cal­ly. I added the bold text to high­light the idea of ‘func­tion­al safe­ty’. You can find oth­er infor­ma­tion in oth­er posts on this blog on that top­ic. If your prod­uct is des­tined for the Euro­pean Union (EU), then you will almost cer­tain­ly be doing some EMC test­ing, unless your prod­uct is a ‘fixed instal­la­tion’. If it’s going to almost any oth­er mar­ket, you prob­a­bly are not under­tak­ing this test­ing. So how do you know if your design meets this cri­te­ria? Unless you test, you don’t. You can make some edu­cat­ed guess­es based on using sound engi­neer­ing prac­tices , but after that you can only hope.

Diagnostic Coverage

…There is no diag­nos­tic cov­er­age (DCavg = none) with­in cat­e­go­ry B sys­tems…”

Cat­e­go­ry B sys­tems are fun­da­men­tal­ly sin­gle-chan­nel. A sin­gle fault in the sys­tem will lead to the loss of the safe­ty func­tion. This sen­tence refers to the con­cept of “diag­nos­tic cov­er­age” that was intro­duced in ISO 13849–1:2007, but what this means in prac­tice is that there is no mon­i­tor­ing or feed­back from any crit­i­cal ele­ments. Remem­ber our basic MCR cir­cuit? If the MCR con­tac­tor weld­ed closed, the only diag­nos­tic was the fail­ure of the machine to stop when the emer­gency stop but­ton was pressed.

Component Failure Rates

…the MTTFd of each chan­nel can be low to medi­um.”

This part of the state­ment is refer­ring to anoth­er new con­cept from ISO 13849–1:2007, “MTTFd”. Stand­ing for “Mean Time to Fail­ure Dan­ger­ous”, this con­cept looks at the expect­ed fail­ure rates of the com­po­nent in hours. Cal­cu­lat­ing MTTFd is a sig­nif­i­cant part of imple­ment­ing the new stan­dard. From the per­spec­tive of under­stand­ing Cat­e­go­ry B, what this means is that you do not need to use high-reli­a­bil­i­ty com­po­nents in these sys­tems.

Common Cause Failures

In such struc­tures (nor­mal­ly sin­gle-chan­nel sys­tems), the con­sid­er­a­tion of CCF is not rel­e­vant.”

CCF is anoth­er new con­cept from ISO 13849–1:2007, and stands for “Com­mon Cause Fail­ure”. I’m not going to get into this in any detail here, but suf­fice to say that design tech­niques, as well as chan­nel sep­a­ra­tion (impos­si­ble in a sin­gle chan­nel archi­tec­ture) and oth­er tech­niques are used to reduce the like­li­hood of CCF in high­er reli­a­bil­i­ty sys­tems.

Performance Levels

The max­i­mum PL achiev­able with cat­e­go­ry B is PL = b.”

PL stands for “Per­for­mance Lev­el”, divid­ed into five degrees from ‘a’ to ‘e’. PLa is equal to an aver­age prob­a­bil­i­ty of dan­ger­ous fail­ure per hour of >= 10-5 to 10-4 fail­ures per hour. PLb is equal to >= 3 × 10-6 to 10-5 fail­ures per hour or once in 10,000 to 100,000 hours, to once in 3,000,000 hours of oper­a­tion. This sounds like a lot, but when deal­ing with prob­a­bil­i­ties, these num­bers are actu­al­ly pret­ty low.

If you con­sid­er an oper­a­tion run­ning a sin­gle shift in Cana­da where the nor­mal work­ing year is 50 weeks and the nor­mal work­day is 7.5 hours, a work­ing year is

7.5 h/d x 5 d/w x 50 w/a = 1875 hours/a

Tak­ing the fail­ure rates per hour above, yields:

PLa = one fail­ure in 5.3 years of oper­a­tion to one fail­ure in 53.3 years

PLb = one fail­ure in 1600 years of oper­a­tion

If we go to an oper­a­tion run­ning three shifts in Cana­da, a work­ing year is:

7.5 h/shift x 3 shifts x 5 d/w x 50 w/a = 5625 hours/a

Tak­ing the fail­ure rates per hour above, yields:

PLa = one fail­ure in 1.8 years of oper­a­tion to one fail­ure in 17 years

PLb = one fail­ure in 533 years of oper­a­tion

Now you should be start­ing to get an idea about where this is going. It’s impor­tant to remem­ber that prob­a­bil­i­ties are just that — the fail­ure could hap­pen in the first hour of oper­a­tion or at any time after that, or nev­er. These fig­ures give you some way to gauge the rel­a­tive reli­a­bil­i­ty of the design, and ARE NOT any sort of guar­an­tee.

Watch for the next post in this series where I will look at Cat­e­go­ry 1 require­ments!

References

[1] Safe­ty of Machin­ery — Safe­ty Relat­ed Parts of Con­trol Sys­tems — Part 1: Gen­er­al Prin­ci­ples for Design. CEN Stan­dard EN 954–1. 1996.

[2] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1. 2006.

[3] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion, ISO Stan­dard 13849–2. 2003.

[4] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 100: Guide­lines for the use and appli­ca­tion of ISO 13849–1. ISO Tech­ni­cal Report TR 100. 2000.

[5] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. CEN Stan­dard EN ISO 13849–1. 2008.

Down­load ISO Stan­dards

Digiprove sealCopy­right secured by Digiprove © 2011–2012
Acknowl­edge­ments: As cit­ed-IDEC, Allen Bradley
Some Rights Reserved

Emergency Stop — What’s so confusing about that?

This entry is part 1 of 13 in the series Emer­gency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decep­tive­ly sim­ple con­cepts that has man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some prod­uct-spe­cif­ic stan­dards

Editor’s Note: Since we first pub­lished this arti­cle on emer­gency stop in March of 2009, it has become our most pop­u­lar post of all time! We decid­ed it was time for a lit­tle refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN-July, 2017.

The Emer­gency Stop func­tion is one of those decep­tive­ly sim­ple con­cepts that have man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user. Some prod­uct-spe­cif­ic stan­dards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trollers are required to pro­vide emer­gency stop func­tion­al­i­ty, and work cells inte­grat­ing robots are also required to have emer­gency stop capa­bil­i­ty.

Defining Emergency Stop

Pho­to 1 — This OLD but­ton is def­i­nite­ly non-com­pli­ant.

So what is the Emer­gency Stop func­tion, or E-stop func­tion, and when do you need to have one? Let’s look at a few def­i­n­i­tions tak­en from CSA Z432-14 [2]:

Emer­gency sit­u­a­tion
an imme­di­ate­ly haz­ardous sit­u­a­tion that needs to be end­ed or avert­ed quick­ly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is intend­ed to avert harm or to reduce exist­ing haz­ards to per­sons, machin­ery, or work in progress.
Emer­gency stop but­ton
a red mush­room-head­ed but­ton that, when acti­vat­ed, will imme­di­ate­ly start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­men­tary pro­tec­tive mea­sures
Pro­tec­tive mea­sures which are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use, could have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine.

Pho­to 2 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e-stop is a func­tion that is intend­ed for use in Emer­gency con­di­tions to try to lim­it or avert harm to some­one or some­thing. It isn’t a safe­guard but is con­sid­ered to be a Com­ple­men­tary Pro­tec­tive Mea­sure. Look­ing at emer­gency stop func­tions from the per­spec­tive of the Hier­ar­chy of Con­trols, emer­gency stop func­tions fall into the same lev­el as Per­son­al Pro­tec­tive Equip­ment like safe­ty glass­es, safe­ty boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stan­dards you choose to read, machin­ery is may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­po­nents and ele­ments to achieve the emer­gency stop func­tion

If, fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­po­nents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency sit­u­a­tions to be avert­ed, the fol­low­ing require­ments apply:

  • the actu­a­tors shall be clear­ly iden­ti­fi­able, clear­ly vis­i­ble and read­i­ly acces­si­ble;
  • the haz­ardous process shall be stopped as quick­ly as pos­si­ble with­out cre­at­ing addi­tion­al haz­ards, but if this is not pos­si­ble or the risk can­not be reduced, it should be ques­tioned whether imple­men­ta­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where nec­es­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

Lat­er in [2, 7.15.1.2]:

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment deter­mines that the emer­gency stop func­tion will not con­tribute to risk con­trol.

Note: There could be sit­u­a­tions where an e-stop does not con­tribute to risk con­trol and alter­na­tives could be con­sid­ered in con­junc­tion with a risk assess­ment.

The bold text in the pre­ced­ing para­graph is mine. I want­ed to be sure that you caught this impor­tant bit of text. Not every machine requires an E-stop func­tion. The func­tion is only required where there is a ben­e­fit to the user. In some cas­es, prod­uct fam­i­ly stan­dards often called “Type C” stan­dards, includ­ing spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­i­mum PLr or SILr, based on the opin­ion of the Tech­ni­cal Com­mit­tee respon­si­ble for the stan­dard and their knowl­edge of the par­tic­u­lar type of machin­ery cov­ered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tri­cal design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204–1.

Down­load NFPA stan­dards through ANSI

Pho­to 3 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontario’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (Reg­u­la­tion 851), you will find that prop­er iden­ti­fi­ca­tion of the emer­gency stop device(s) and loca­tion “with­in easy reach” of the oper­a­tor are the only require­ment. What does “prop­er­ly iden­ti­fied” mean? In Cana­da, the USA and Inter­na­tion­al­ly, a RED oper­a­tor device on a YELLOW back­ground, with or with­out any text behind it, is rec­og­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switch­es or con­trol switch­es. I’ve scat­tered some exam­ples of dif­fer­ent com­pli­ant and non-com­pli­ant e-stop devices through this arti­cle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ing­ly, the Euro­pean Union has tak­en what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machin­ery Direc­tive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machin­ery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing dan­ger to be avert­ed.

Notice the words “…actu­al or impend­ing dan­ger…” This har­monis­es with the def­i­n­i­tion of Com­ple­men­tary Pro­tec­tive Mea­sures, in that they are intend­ed to allow a user to “avert or lim­it harm” from a haz­ard. Clear­ly, the direc­tion from the Euro­pean per­spec­tive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machin­ery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial mea­sures required to deal with the risk to be tak­en,
  • portable hand-held and/or hand-guid­ed machin­ery.

From these two bul­lets it becomes clear that, just as in the Cana­di­an and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is huge­ly impor­tant and often over­looked. If the risks can­not be con­trolled effec­tive­ly with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-stop sys­tem, then it should not be includ­ed in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clear­ly iden­ti­fi­able, clear­ly vis­i­ble and quick­ly acces­si­ble con­trol devices,
  • stop the haz­ardous process as quick­ly as pos­si­ble, with­out cre­at­ing addi­tion­al risks,
  • where nec­es­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sis­tent with the gen­er­al require­ments found in the Cana­di­an and US reg­u­la­tions. [3] goes on to define the func­tion­al­i­ty of the sys­tem in more detail:

Once active oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is specif­i­cal­ly over­rid­den; it must not be pos­si­ble to engage the device with­out trig­ger­ing a stop com­mand; it must be pos­si­ble to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tional at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing mea­sures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-stop devices to latch in the acti­vat­ed posi­tion. The last part of that sen­tence is even more impor­tant: “…dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a sec­ond dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-stop but­ton and hav­ing pow­er come back imme­di­ate­ly is not OK. Once that but­ton has been reset, a sec­ond action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol pow­er is need­ed.

Point of Clar­i­fi­ca­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machin­ery does not indi­cate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­is­tics:
    • The device must latch in the acti­vat­ed posi­tion;
    • The device must have a “neu­tral” posi­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset posi­tion must be dis­tinct from the pre­vi­ous two posi­tions, and the device must spring-return to the neu­tral posi­tion.

The sec­ond sen­tence har­mo­nizes with the require­ments of the Cana­di­an and US stan­dards. The last sen­tence har­mo­nizes with the idea of “Com­ple­men­tary Pro­tec­tive Mea­sures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sid­er the loca­tions where you EXPECT an oper­a­tor to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can rea­son­ably expect an oper­a­tor to be under nor­mal cir­cum­stances is a rea­son­able place to put an e-stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not intend­ed for use by chil­dren). The “easy reach” require­ment trans­lates to 500–600 mm either side of the cen­tre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start analy­sis. Iden­ti­fy all the nor­mal start­ing and stop­ping modes that you antic­i­pate on the equip­ment. Con­sid­er all of the dif­fer­ent oper­at­ing modes that you are pro­vid­ing, such as Auto­mat­ic, Man­u­al, Teach, Set­ting, etc. Iden­ti­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most juris­dic­tions today.

As you deter­mine your risk con­trol mea­sures (fol­low­ing the Hier­ar­chy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e-stops fall below safe­guards in the hier­ar­chy, so you must use a safe­guard­ing tech­nique if pos­si­ble, you can’t just default down to an emer­gency stop. IF the e-stop can pro­vide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Final­ly, once you deter­mine the need for an emer­gency stop sys­tem, you need to con­sid­er the system’s func­tion­al­i­ty and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stan­dard for Cana­da and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tri­cal stan­dard for machin­ery, CSA C22.2 #301 [5]. This stan­dard is intend­ed for cer­ti­fi­ca­tion of indus­tri­al machines. My opin­ion is that this stan­dard has some sig­nif­i­cant issues. You can find very sim­i­lar elec­tri­cal require­ments to this in [4] in IEC 60204–1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204–1 applies to the EU mar­ket for indus­tri­al machines and is tech­ni­cal­ly iden­ti­cal to [6].

Down­load NFPA stan­dards through ANSI
Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

Functional Stop Categories

NFPA 79 calls out three basic cat­e­gories of stop func­tions. Note that these cat­e­gories are NOT func­tion­al safe­ty archi­tec­tur­al cat­e­gories, but are cat­e­gories describ­ing stop­ping func­tions. Reli­a­bil­i­ty is not addressed in these sec­tions. Quot­ing from the stan­dard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride relat­ed start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ardous con­di­tions. The three cat­e­gories of stop func­tions shall be as fol­lows:

(1) Cat­e­go­ry 0 is an uncon­trolled stop by imme­di­ate­ly remov­ing pow­er to the machine actu­a­tors.

(2) Cat­e­go­ry 1 is a con­trolled stop with pow­er to the machine actu­a­tors avail­able to achieve the stop then pow­er is removed when the stop is achieved.

(3) Cat­e­go­ry 2 is a con­trolled stop with pow­er left avail­able to the machine actu­a­tors.

This E-Stop Button is correct.
Pho­to 4 — This E-Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­a­tor and the YELLOW back­ground.

A bit lat­er in the stan­dard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­e­go­ry 0, Cat­e­go­ry 1, and/or Cat­e­go­ry 2 stops shall be pro­vid­ed as deter­mined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­e­go­ry 0 and Cat­e­go­ry 1 stops shall be oper­a­tional regard­less of oper­at­ing modes, and Cat­e­go­ry 0 shall take pri­or­i­ty.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tec­tive devices and inter­locks shall be pro­vid­ed. Where applic­a­ble, the stop func­tion shall sig­nal the log­ic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­e­gories are aligned with sim­i­lar terms used with motor dri­ves. You may want to read this arti­cle if your machin­ery uses a motor dri­ve.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Pho­to 5 — Dis­con­nect with E-Stop Colours indi­cates that this dis­con­nect­ing device is intend­ed to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­e­go­ry of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can deter­mine the func­tion­al safe­ty require­ments. In Cana­da, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­di­an machin­ery into har­mo­niza­tion with the Inter­na­tion­al Stan­dards.

Emer­gency stop func­tions are required to pro­vide a min­i­mum of ISO 13849–1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that greater reli­a­bil­i­ty is required, the sys­tem can be designed to meet any high­er reli­a­bil­i­ty require­ment that is suit­able. Essen­tial­ly, the greater the risk reduc­tion required, the high­er the degree of reli­a­bil­i­ty required.

I’ve writ­ten exten­sive­ly about the appli­ca­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tri­cal haz­ard’ warn­ing label imme­di­ate­ly above the dis­con­nect han­dle in Pho­to 5 above is

a) upside down, and

b) using a non-stan­dard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­est­ed, here is the cor­rect ISO elec­tri­cal haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Pho­to 6 — Elec­tric Shock Haz­ard — IEC 60417–5036

You can find these labels at Clar­i­on Safe­ty Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switch­es used for e-stop) CANNOT be used for ener­gy iso­la­tion in an HECP — Haz­ardous Ener­gy Con­trol Pro­ce­dure (which includes Lock­out). Devices for this pur­pose must phys­i­cal­ly sep­a­rate the ener­gy source from the down­stream com­po­nents. See CSA Z460 [10] for more on that sub­ject.

Read our Arti­cle on Using E-Stops in Haz­ardous Ener­gy Con­trol Pro­ce­dures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Pho­to 7 — Pneu­mat­ic E-Stop/Iso­la­tion device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adopt­ed ISO 10218–1:2011, sec­ond edi­tion, 2011-07-01, with Cana­di­an devi­a­tions and ISO 10218–2:2011, first edi­tion, 2011-07-01, with Cana­di­an devi­a­tions). Cana­di­an Nation­al Stan­dard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machin­ery, CSA Stan­dard Z432. 2016

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machin­ery, and amend­ing Direc­tive 95/16/EC (recast). Brus­sels: Euro­pean Com­mis­sion, 2006.

[4]  Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery. ANSI/NFPA Stan­dard 79. 2015.

Down­load NFPA stan­dards at ANSI

[5] Indus­tri­al elec­tri­cal machin­ery. CSA Stan­dard C22.2 NO. 301. 2016. 

[6] Safe­ty of machin­ery — Elec­tri­cal Equip­ment of machines — Part 1: Gen­er­al require­ments. IEC Stan­dard 60204–1. 2016.  

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

[7] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1. 2015.

[8] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. ISO Stan­dard 13849–2. 2012.

[9] Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. IEC Stan­dard 62061+AMD1+AMD2. 2015.

[10] Safe­ty of machin­eryEmer­gency Stop—Principals for design. ISO Stan­dard 13850. 2015.

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
Down­load ISO Stan­dards

[11] Con­trol of haz­ardous energy—Lockout and oth­er meth­ods. CSA Stan­dard Z460. 2013.