Busting Emergency Stop Myths

This entry is part 3 of 11 in the series Emergency Stop

There are a number of myths that have grown up around emergency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Busting here on the MS101 blog!

This entry is part 3 of 11 in the series Emergency Stop

There are a number of myths that have grown up around emergency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Busting here on the MS101 blog!

What does ’emergency’ mean?

Consider for a moment the roots of the word ‘emergency’. This word comes from the word ‘emergent’, meaning a situation that is developing or emerging in the moment. Emergency stop systems are intended to help the user deal with potentially hazardous conditions that are emerging in the moment. These conditions have probably arisen because the designers of the machinery failed to consider all the foreseeable uses of the equipment, or because someone has chosen to misuse the equipment in a way that was not intended by the designers. The key function of an Emergency Stop system is to provide the user with a backup to the primary safeguards. These systems are referred to as “Complementary Protective Measures” and are intended to give the user a chance to “avert or limit harm” in a hazardous situation. With that in mind, let’s look at three myths I hear about regularly.

 

Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Drive, Credit: Harry Matthews & http://www.old-engine.com

Early in the Industrial Revolution machine builders realized that users of their machinery needed a way to quickly stop a machine when something went wrong. At that time, overhead line-shafts were driven by large central power sources like waterwheels, steam engines or large electric motors. Machinery was coupled to the central shafts with pulleys, clutches and belts which transmitted the power to the machinery.

See pictures of a line-shaft powered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Photo: Larry Evans & www.oldengine.org

These central engines powered an entire factory, so they were much larger than an individual motor sized for a modern machine. In addition, they could not be easily stopped, since stopping the central power source would mean stopping the entire factory – not a welcome choice. Emergency stop devices were born in this environment.

Learn more about Line Shafts at Harry’s Old Engines.

See photos and video of a working line shaft machine shop. 

Due to their early use as a safety device, some have incorrectly considered emergency stop systems safeguarding devices. Modern standards make the difference very clear. The easiest way to understand the current meaning of the term “EMERGENCY STOP” is to begin by looking at the international standards published by IEC1 and ISO2.

emergency stop3
emergency stop function

function that is intended to

—   avert arising, or reduce existing, hazards to persons, damage to machinery or to work in progress,

—   be initiated by a single human action

NOTE 1

Hazards, for the purposes of this International Standard, are those which can arise from

—   functional irregularities (e.g. machinery malfunction, unacceptable properties of the material processed, human error),

—   normal operation.

It is important to understand that an emergency stop function is “initiated by a single human action”. This means that it is not automatic, and therefore cannot be considered to be a risk control measure for operators or bystanders. Emergency stop may provide the ability to avoid or reduce harm, by providing a means to stop the equipment once something has already gone wrong. Your next actions will usually be to call 911 and administer first aid.

Safeguarding systems act automatically to prevent a person from becoming involved with the hazard in the first place. This is a reduction in the probability of a hazardous situation arising, and may also involve a reduction in the severity of injury by controlling the hazard (i.e., slowing or stopping rotating machinery before it can be reached.) This constitutes a risk control measure and can be shown to reduce the risk of injury to an exposed person.

Emergency stop is reactive; safeguarding systems are proactive.

In Canada, CSA defines emergency stop as a ‘Complementary Protective Measure’ in CSA Z432-046:

6.2.2.1.1
Safeguards (guards, protective devices) shall be used to protect persons from the hazards that cannot reasonably be avoided or sufficiently limited by inherently safe design. Complementary protective measures involving additional equipment (e.g., emergency stop equipment) may have to be taken.

6.2.3.5.3 Complementary protective measures
Following the risk assessment, the measures in this clause either shall be applied to the machine or shall be dealt with in the information for use.
Protective measures that are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use may have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine. Such measures shall include, but not be limited to,

(a) emergency stop;
(b) means of rescue of trapped persons; and
(c) means of energy isolation and dissipation.

In the USA, three standards apply: ANSI B11,  ANSI B11.19-2003, and NFPA 79:

ANSI B11-2008

3.80 stop: Immediate or controlled cessation of machine motion or other hazardous situations. There are many terms used to describe the different kinds of stops, including user- or supplier-specific terms, the operation and function of which is determined by the individual design. Definitions of some of the more commonly used “stop” terminology include:

3.80.2 emergency stop: The stopping of a machine tool, manually initiated, for emergency purposes;

7.6 Emergency stop

Electrical, pneumatic and hydraulic emergency stops shall conform to requirements in the ANSI B11 machine-specific standard or NFPA 79.
Informative Note 1: An emergency stop is not a safeguarding device. See also, B11.19.
Informative Note 2: For additional information, see ISO 13850 and IEC 60204-1.

ANSI B11.19-2003

12.9 Stop and emergency stop devices

Stop and emergency stop devices are not safeguarding devices. They are complementary to the guards, safeguarding device, awareness barriers, signals and signs, safeguarding methods and safeguarding procedures in clauses 7 through 11.

Stop and emergency stop devices shall meet the requirements of ANSI / NFPA 79.

E12.9

Emergency stop devices include but are not limited to, buttons, rope-pulls, and cable-pulls.

A safeguarding device detects or prevents inadvertent access to a hazard, typically without overt action by the individual or others. Since an individual must actuate an emergency stop device to issue the stop command, usually in reaction to an event or hazardous situation, it neither detects nor prevents exposure to the hazard.

If an emergency stop device is to be interfaced into the control system, it should not reduce the level of performance of the safety function (see section 6.1 and Annex C).

NFPA 79 deals with the electrical functions of the emergency stop function which is not directly relevant to this article, so that is why I haven’t quoted directly from that document here.

As you can clearly see, the essential definitions of these devices in the US and Canada match very closely, although the US does not specifically use the term ‘complementary protective measures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emergency stop systems act primarily by removing power from the prime movers in a machine, ensuring that power is removed and the equipment brought to a standstill as quickly as possible, regardless of the portion of the operating cycle that the machine is in. After an emergency stop, the machine is inoperable until the emergency stop system is reset. In some cases, emergency stopping the machine may damage the equipment due to the forces involved in halting the process quickly.

Cycle stop is a control system command function that is used to bring the machine cycle to a graceful stop at the end of the current cycle. The machine is still fully operable and may still be in automatic mode at the completion of this stop.

Again, referring to ANSI B11-2008:

3.80.1 controlled stop: The stopping of machine motion while retaining power to the machine actuators during the stopping process. Also referred to as Category 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emergency stop: The stopping of a machine tool, manually initiated, for emergency purposes;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFifteen to twenty years ago it was not uncommon to see emergency stop buttons fitted with locking devices.  The locking device allowed a person to prevent the resetting of the emergency stop device. This was done as part of a “lockout procedure”. Lockout is one aspect of hazardous energy control procedures (HECP).  HECPs recognize that live work needs to be done from time to time, and that normal safeguards may be bypassed or disconnected temporarily, to allow diagnostics and testing to be carried out. This process is detailed in two current standards, CSA Z460 and ANSI Z244.1. Note that these locking devices are still available for sale, and can be used as part of an HECP to prevent the emergency stop system or other controls from being reset until the machine is ready for testing. They cannot be used to isolate an energy source.

No current standard allows for the use of control devices such as push buttons or selector switches to be used as energy isolation devices.

CSA Z460-05 specifically prohibits this use in their definition of ‘energy isolation devices’:

Energy-isolating device — a mechanical device that physically prevents the transmission or release of energy, including but not limited to the following: a manually operated electrical circuit breaker; a disconnect switch; a manually operated switch by which the conductors of a circuit can be disconnected from all ungrounded supply conductors; a line valve; a block; and other devices used to block or isolate energy (push-button selector switches and other control-type devices are not energy-isolating devices).4

Similar requirements are found in ANSI Z244.15 and in ISO 138503.

Myth #4 – All Machines are Required to have an Emergency Stop

Some machine designers believe that all machines are required to have an emergency stop. This is simply not true. A reader pointed out to me that CSA Z432-04, clause 7.17.1.2, does make this requirement. To my knowledge this is the only general level (i.e., not machine specific) standard that makes this requirement. I stand corrected! Having said that, the rest of my comments on this topic still stand. Clause 7.17.1.2 limits the application of this requirement:

7.17.1.2

Each operator control station, including pendants, capable of initiating machine motion shall have a manually initiated emergency stop device.

Emergency stop systems may be useful where they can provide a back-up to other safeguarding systems. To understand where to use an emergency stop, a start-stop analysis must be carried out as part of the design process. This analysis will help the designer develop a clear understanding of the normal start and stop conditions for the machine. The analysis also needs to include failure modes for all of the stop functions. It is here that the emergency stop can be helpful. If removing power will cause the hazard to cease in a short time, or if the hazard can be quickly contained in some way, then emergency stop is a valid choice. If the hazard will remain for a considerable time following removal of power, then emergency stop will have no effect and is useless for avoiding or limiting harm.

For example, consider an oven. If the burner stop control failed, and assuming that the only hazard we are concerned with is the hot surfaces inside the oven, then using an emergency stop to turn the burners off only results in the start of the natural cooling cycle of the oven. In some cases that could take hours or days, so the emergency stop has no value. It might be useful for controlling other hazards, such as fire, that might be related to the same failure. Without a full analysis of the failure modes of the control system, a sound decision cannot be made.

Simple machines like drill presses and table saws are seldom fitted with emergency stop systems. These machines, which can be very dangerous, could definitely benefit from having an emergency stop. They are sometimes fitted with a disconnecting device with a red and yellow handle that can be used for ’emergency switching off’. This differs from emergency stop because the machine, and the hazard, will typically re-start immediately when the emergency switching off device is turned back on. This is not permitted with emergency stop, where resetting the emergency stop device only permits the restarting of the machine through other controls. Reset of the emergency stop device is not permitted to reapply power to the machine on its own.

These requirements are detailed in ISO 138503, CSA Z4326 and other standards.

Design Considerations

Emergency Stop is a control that is often designed in with little thought and used for a variety of things that it was never intended to be used to accomplish. The three myths discussed in this article are the tip of the iceberg.

Consider these questions when thinking about the design and use of emergency stop systems:

  1. Have all the intended uses and foreseeable misuses of the equipment been considered?
  2. What do I expect the emergency stop system to do for the user of the machine? (The answer to this should be in the risk assessment.)
  3. How much risk reduction am I expecting to achieve with the emergency stop?
  4. How reliable does the emergency stop system need to be?
  5. Am I expecting the emergency stop to be used for other purposes, like ‘Power Off’, energy isolation, or regular stopping of the machine? (The answer to this should be ‘NO’.)

Taking the time to assess the design requirements before designing the system can help ensure that the machine controls are designed to provide the functionality that the user needs, and the risk reduction that is required. The answers lie in the five questions above.

Have any of these myths affected you?

Got any more myths about e-stops you’d like to share?

I really appreciate hearing from my readers! Leave a comment or email it to us and we’ll consider adding it to this article, with credit of course!

References

5% Discount on All Standards with code: CC2011

  1. IEC – International Electrotechnical Commission. Download IEC standards, International Electrotechnical Commission standards.
  2. ISO – International Organization for Standardization Download ISO Standards
  3. Safety of machinery — Emergency stop — Principles for design, ISO 13850, 2006, ISO, Geneva, Switzerland.
  4. Control of Hazardous Energy ­– Lockout and Other Methods, CSA Z460, 2005, Canadian Standards Association, Toronto, Canada.
    Buy CSA Standards online at CSA.ca
  5. Safeguarding of Machinery, CSA Z432-04, Canadian Standards Association, Toronto, Canada.
  6. Control of Hazardous Energy – Lockout/Tagout and Alternative Methods, ANSI/ASSE Z244.1, 2003, American National Standards Institute / American Society of Safety Engineers, Des Plaines, IL, USA.
    Download ANSI standards
  7. American National Standard for Machine Tools – Performance Criteria for Safeguarding, ANSI B11.19-2003, American National Standards Institute, Des Plaines, IL, USA.
  8. General Safety Requirements Common to ANSI B11 Machines, ANSI B11-2008, American National Standards Institute, Des Plaines, IL, USA.
  9. Electrical Standard for Industrial Machinery, NFPA 79-2007, NFPA, 1 Batterymarch Park, Quincy, MA 02169-7471, USA.
    Buy NFPA Standards online.

5% Discount on All Standards with code: CC2011

Digiprove sealCopyright secured by Digiprove © 2011-2013
Acknowledgements: See citations in the article.
Some Rights Reserved

Emergency Stop – What’s so confusing about that?

This entry is part 1 of 11 in the series Emergency Stop

I get a lot of calls and emails asking about emergency stops. This is one of those deceptively simple concepts that has managed to get very complicated over time. Not every machine needs or can benefit from an emergency stop. In some cases, it may lead to an unreasonable expectation of safety from the user, which can lead to injury if they don’t understand the hazards involved. Some product-specific standards

This entry is part 1 of 11 in the series Emergency Stop

I get a lot of calls and emails asking about emergency stops. This is one of those deceptively simple concepts that has managed to get very complicated over time. Not every machine needs or can benefit from an emergency stop. In some cases, it may lead to an unreasonable expectation of safety from the user, which can lead to injury if they don’t understand the hazards involved. Some product-specific standards mandate the requirement for emergency stop, such as CSA Z434-03, where robot controllers are required to provide emergency stop functionality and work cells integrating robots are also required to have emergency stop capability.

Defining Emergency Stop

Old, non-compliant, E-Stop Button
This OLD button is definitely non-compliant.

So what is an Emergency Stop, or e-stop, and when do you need to have one? Let’s look at a few definitions taken from CSA Z432-04:

Emergency situation — an immediately hazardous situation that needs to be ended or averted quickly in order to prevent injury or damage.

Emergency stop — a function that is intended to avert harm or to reduce existing hazards to persons, machinery, or work in progress.

Emergency stop button — a red mushroom-headed button that, when activated, will immediately start the emergency stop sequence.

and one more:

6.2.3.5.3 Complementary protective measures
Following the risk assessment, the measures in this clause either shall be applied to the machine or shall be dealt with in the information for use.

Protective measures that are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use may have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine. Such measures shall include, but not be limited to,

a) emergency stop;

b) means of rescue of trapped persons; and

c) means of energy isolation and dissipation.

Modern, non-compliant e-stop button.
This more modern button is non-compliant due to the RED background and spring-return button.

So, an e-stop is a system that is intended for use in Emergency conditions to try to limit or avert harm to someone or something. It isn’t a safeguard, but is considered to be a Complementary Protective Measure. In terms of the Hierarchy of Controls, emergency stop systems fall into the same level as Personal Protective Equipment like safety glasses, safety boots and hearing protection. So far so good.

Is an Emergency Stop Required?

Depending on the regulations and the standards you choose to read, machinery is may not be required to have an Emergency Stop. Quoting from CSA Z432-04:

6.2.5.2.1 Components and elements to achieve the emergency stop function
If, following a risk assessment, it is determined that in order to achieve adequate risk reduction under emergency circumstances a machine must be fitted with components and elements necessary to achieve an emergency stop function so that actual or impending emergency situations can be controlled, the following requirements shall apply:

a) The actuators shall be clearly identifiable, clearly visible, and readily accessible.

b) The hazardous process shall be stopped as quickly as possible without creating additional hazards.
If this is not possible or the risk cannot be adequately reduced, this may indicate that an emergency stop function may not be the best solution (i.e., other solutions should be sought). (Bolding added for emphasis – DN)

c) The emergency stop control shall trigger or permit the triggering of certain safeguard movements where necessary.

Later in CSA Z432-04 we find clause 7.17.1.2:

Each operator control station, including pendants, capable of initiating machine motion shall have a manually initiated emergency stop device.

To my knowledge, this is the only general level machinery standard that makes this requirement. Product family standards often make specific requirements, based on the opinion of the Technical Committee responsible for the standard and their knowledge of the specific type of machinery covered by their document.

Note: For more detailed provisions on the electrical design requirements, see NFPA 79 or IEC 60204-1.

Download NFPA standards through ANSI

This more modern button is still wrong due to the RED background.
This more modern button is non-compliant due to the RED background.

If you read Ontario’s Industrial Establishments regulation (Regulation 851), you will find that the only requirement for an emergency stop is that it is properly identified and located “within easy reach” of the operator. What does “properly identified” mean? In Canada, the USA and Internationally, a RED operator device on a YELLOW background, with or without any text behind it, is recognized as EMERGENCY STOP or EMERGENCY OFF, in the case of disconnecting switches or control switches. I’ve scattered some examples of different compliant and non-compliant e-stop devices through this article.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Interestingly, the European Union has taken what looks like an opposing view of the need for emergency stop systems. Quoting from Annex I of the Machinery Directive:

1.2.4.3. Emergency stop
Machinery must be fitted with one or more emergency stop devices to enable actual or impending danger to be averted.

Notice the words “…actual or impending danger…” This harmonizes with the definition of Complementary Protective Measures, in that they are intended to allow a user to “avert or limit harm” from a hazard. Clearly, the direction from the European perspective is that ALL machines need to have an emergency stop. Or do they? The same clause goes on to say:

The following exceptions apply:

  • machinery in which an emergency stop device would not lessen the risk, either because it would not reduce the stopping time or because it would not enable the special measures required to deal with the risk to be taken,
  • portable hand-held and/or hand-guided machinery.

From these two bullets it becomes clear that, just as in the Canadian and US regulations, machines only need emergency stops WHEN THEY CAN REDUCE THE RISK. This is hugely important, and often overlooked. If the risks cannot be controlled effectively with an emergency stop, or if the risk would be increased or new risks would be introduced by the action of an e-stop system, then it should not be included in the design.

Carrying on with the same clause:

The device must:

  • have clearly identifiable, clearly visible and quickly accessible control devices,
  • stop the hazardous process as quickly as possible, without creating additional risks,
  • where necessary, trigger or permit the triggering of certain safeguard movements.

Once again, this is consistent with the general requirements found in the Canadian and US regulations. The directive goes on to define the functionality of the system in more detail:

Once active operation of the emergency stop device has ceased following a stop command, that command must be sustained by engagement of the emergency stop device until that engagement is specifically overridden; it must not be possible to engage the device without triggering a stop command; it must be possible to disengage the device only by an appropriate operation, and disengaging the device must not restart the machinery but only permit restarting.

The emergency stop function must be available and operational at all times, regardless of the operating mode.

Emergency stop devices must be a back-up to other safeguarding measures and not a substitute for them.

The first sentence of the first paragraph above is the one that requires e-stop devices to latch in the activated position. The last part of that sentence is even more important: “…disengaging the device must not restart the machinery but only permit restarting.” That phrase requires that every emergency stop system have a second discrete action to reset the emergency stop system. Pulling out the e-stop button and having power come back immediately is not OK. Once that button has been reset, a second action, such as pushing a “POWER ON” or “RESET” button to restore control power is needed. Point of Clarification: I had a question come from a reader asking if combining the e-stop function and the reset function was acceptable. It can be, but only if:

  • The risk assessment for the machinery does not indicate any hazards that might preclude this approach; and
  • The device is designed with the following characteristics:
  • The device must latch in the activated position;
  • The device must have a “neutral” position where the machine’s emergency stop system can be reset, or where the machine can be enabled to run;
  • The reset position must be distinct from the previous two positions, and the device must spring-return to the neutral position.

The second sentence harmonizes with the requirements of the Canadian and US standards.

Finally, the last sentence harmonizes with the idea of “Complementary Protective Measures” as described in CSA Z432.

How Many and Where?

Where? “Within easy reach”. Consider the locations where you EXPECT an operator to be. Besides the main control console, these could include feed hoppers, consumables feeders, finished goods exit points… you get the idea. Anywhere you can reasonably expect an operator to be under normal circumstances is a reasonable place to put an e-stop device. “Easy Reach” I interpret as within the arm-span of an adult (presuming the equipment is not intended for use by children). This translates to 500-600 mm either side of the center line of most work stations.

How do you know if you need an emergency stop? Start with a stop/start analysis. Identify all the normal starting and stopping modes that you anticipate on the equipment. Consider all of the different operating modes that you are providing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the matching stop conditions in the same modes, and ensure that all start functions have a matching stop function.

Do a risk assessment. This is a basic requirement in most jurisdictions today.

As you determine your risk control measures (following the hierarchy of controls), look at what risks you might control with an Emergency Stop. Remember that e-stops fall below safeguards in the hierarchy, so you must use a safeguarding technique if possible, you can’t just default down to an emergency stop. IF the e-stop can provide you with the additional risk reduction then use it, but first reduce the risks in other ways.

The Stop Function and Control Reliability Requirements

Finally, once you determine the need for an emergency stop system, you need to consider the system’s functionality and controls architecture. NFPA 79 is the reference standard for Canada and the USA, and you can find very similar requirements in IEC 60204-1 if you are working in an international market. EN 60204-1 applies in the EU market for industrial machines.

Download NFPA standards through ANSI
Download IEC standards, International Electrotechnical Commission standards.

Functional Stop Categories

NFPA 79 calls out three basic categories of stop. Note that these are NOT reliability categories, but are functional categories. Reliability is not addressed in these sections. Quoting from the standard:

9.2.2 Stop Functions. The three categories of stop functions shall be as follows:

(1) Category 0 is an uncontrolled stop by immediately removing power to the machine actuators.

(2) Category 1 is a controlled stop with power to the machine actuators available to achieve the stop then remove power when the stop is achieved.

(3) Category 2 is a controlled stop with power left available to the machine actuators.

This E-Stop Button is correct.
This E-Stop button is CORRECT. Note the Push-Pull-Twist operator and the YELLOW background.

A bit later, the standards says:

9.2.5.3 Stop.
9.2.5.3.1 Each machine shall be equipped with a Category 0 stop.

9.2.5.3.2 Category 0, Category 1, and/or Category 2 stops shall be provided where indicated by an analysis of the risk assessment and the functional requirements of the machine. Category 0 and Category 1 stops shall be operational regardless of operating modes, and Category 0 shall take priority. Stop function shall operate by de-energizing that relevant circuit and shall override related start functions.

Note that 9.2.5.3.1 does NOT mean that every machine must have an e-stop. It simply says that every machine must have a way to stop the machine that is equivalent to “pulling the plug”. The main disconnect on the control panel can be used for this function if sized and rated appropriately. For cord connected equipment, the plug and socket used to provide power to the equipment can also serve this function. The question of HOW to effect the Category 0 stop depends on WHEN it will be used – i.e. is it being used for a safety related function? What risks must be reduced, or what hazards must be controlled by the stop function?

You’ll also note that that pesky “risk assessment” pops up again in 9.2.5.3.2. You just can’t get away from it…

Control Reliability

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.

Once you know what functional category of stop you need, and what degree of risk reduction you are expecting from the emergency stop system, you can determine the degree of reliability required. In Canada, CSA Z432 gives us these categories: SIMPLE, SINGLE CHANNEL, SINGLE CHANNEL MONITORED and CONTROL RELIABLE. These categories are being replaced slowly by Performance Levels (PL) as defined in ISO 13849-1 2007.

The short answer is that the greater the risk reduction required, the higher the degree of reliability required. In many cases, a SINGLE CHANNEL or SINGLE CHANNEL MONITORED solution may be acceptable, particularly when there are more reliable safeguards in place. On the other hand, you may require CONTROL RELIABLE designs if the e-stop is the primary risk reduction for some risks or specific tasks.

To add to the confusion, ISO 13849-1 appears to exclude complementary protective measures from its scope in Table 8 — Some International Standards applicable to typical machine safety functions and certain of their characteristics. At the very bottom of this table, Complementary Protective Measures are listed, but they appear to be excluded from the standard. I can say that there is nothing wrong with applying the techniques in ISO 13849-1 to the reliability analysis of a complementary protective measure that uses the control system, so do this if it makes sense in your application.

ISO 13849-1:2006 Table 8
ISO 13849-1:2006 Table 8

Extra points go to any reader who noticed that the ‘electrical hazard’ warning label immediately above the disconnect handle in the above photo is a) upside down, and b) using a non-standard lighting flash. Cheap hazard warning labels, like this one, are often as good as none at all. I’ll be writing more on hazard warnings in future posts.

Use of Emergency Stop as part of a Lockout Procedure or HECP.

One last note: Emergency stop systems (with the exception of emergency switching off devices, such as disconnect switches used for e-stop) CANNOT be used for energy isolation in a Hazardous Energy Control Procedure (a.k.a. Lockout). Devices for this purpose must physically separate the energy source from the down-stream components. See CSA Z460 for more on that subject.

Read our Article on Using E-Stops in HECP.

Pneumatic E-Stop Device
Pneumatic E-Stop/Isolation device.

Standards Referenced in this post:

CSA Z432-04, Safeguarding of Machinery

NFPA 79-07, Electrical Standard for Industrial Machinery
Download NFPA standards at ANSI

IEC 60204-1:09,  SAFETY OF MACHINERY – ELECTRICAL EQUIPMENT OF MACHINES – PART 1: GENERAL REQUIREMENTS

Download IEC standards, International Electrotechnical Commission standards.

ISO 13849-1-2006, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design

See also

ISO 13850:06, SAFETY OF MACHINERY – EMERGENCY STOP – PRINCIPLES FOR DESIGN

Download IEC standards, International Electrotechnical Commission standards.
Download ISO Standards