I had an inter­est­ing ques­tion come in from a reader today that is rel­e­vant to many situations:

“When you have mul­ti­ple E-​​Stop but­tons I have often got­ten into an argu­ment that says you can have a reset beside each one. I was taught that you were required to have a sin­gle point of reset. Who is correct?”

— Michael Barb, Sr. Electrical Engineer

The Short Answer

There is noth­ing in the EU, US or Canadian reg­u­la­tions that would for­bid hav­ing mul­ti­ple reset but­tons. However, you must under­stand the over­lap­ping require­ments for emer­gency stop and pre­ven­tion of unex­pected start-​​up.

The Long Answer:

First I need to define two dif­fer­ent types of reset for clarity:

1. Emergency Stop Device Reset: Each e-​​stop device, i.e. but­ton, pull cord, foot switch, etc., is required to latch in the acti­vated state and must be indi­vid­u­ally reset. Resetting the e-​​stop device is NOT per­mit­ted to re-​​start the machin­ery, only to per­mit restart­ing. (NFPA 79, CSA Z432, ISO 14118).
2. Restarting the machine is a sep­a­rate delib­er­ate action from reset­ting the emer­gency stop device(s).

ANSI B11-​​2008 pro­vides some direct guid­ance on this topic:

7.2.2 Zones

A machine or an assem­bly of machines may be divided into sev­eral con­trol zones (e.g., for emer­gency stop­ping, stop­ping as a result of safe­guard­ing devices, start-​​up, iso­la­tion or energy dis­si­pa­tion). The machine and con­trols in dif­fer­ent zones shall be defined and iden­ti­fied. Controls for machines in zones can be local for each machine, across sev­eral machines in a zone, or glob­ally for machines across zones. The con­trol require­ments shall be based on the oper­a­tional require­ments and on the risk assess­ment.The inter­faces between zones, includ­ing syn­chro­niza­tion and inde­pen­dent oper­a­tion, shall be designed such that no func­tion in one zone cre­ates a haz­ard(s) /​ haz­ardous sit­u­a­tion in another zone.

CSA Z432-​​04 has sim­i­lar wording:

6.2.1.8.4

When zones can be deter­mined, their delim­i­ta­tions shall be evi­dent (includ­ing the effect of the asso­ci­ated emer­gency stop device). This shall also apply to the effect of iso­la­tion and energy dissipation.

Let’s take a case with a sin­gle e-​​stop but­ton first. The same require­ments apply for all e-​​stop devices. The require­ments include:

1. Button must be in ‘easy-​​reach’ of the nor­mal oper­a­tor posi­tion. I con­sider ‘easy-​​reach’ to be the range I can touch while sit­ting or stand­ing at the nor­mal oper­a­tor posi­tion. This posi­tion is not nec­es­sar­ily in front of the con­trol panel. This is the posi­tion where the oper­a­tor is expected to be while car­ry­ing out the tasks expected of them when the machine is oper­at­ing. This is the require­ment that dri­ves hav­ing mul­ti­ple but­tons in most cases.
2. E-​​stop devices can­not be located so that the oper­a­tor must reach over or past a haz­ard to acti­vate them.
3. The but­ton must latch in the oper­ated position.
4. The but­ton must be robust enough to han­dle the mechan­i­cal and elec­tri­cal stresses that will be placed on it when used. i.e. rugged but­tons are required.
5. When the e-​​stop device is reset — i.e returned to the ‘RUN’ posi­tion — the machine is NOT per­mit­ted to restart. It is only PERMITTED to restart. It must be restarted through another delib­er­ate action, like press­ing a ‘Power On’ button.

So what do you do with the ‘POWER ON’ or safety cir­cuit reset but­ton? The first ques­tion to ask is: ‘What hap­pens when I reset this cir­cuit, apply­ing power to the con­trol circuits?”

Case A: If it is impos­si­ble to see the entire machine from the loca­tion of the reset but­ton, then I would rec­om­mend a sin­gle reset but­ton located at the HMI or main con­sole. The oper­a­tor must check to make sure the machine is clear before re-​​applying power. Where the machine is too big to be com­pletely vis­i­ble from the main oper­a­tor con­sole, then I would also recommend:

• warn­ing horn,
• warn­ing lights, and
• a start-​​up delay that is long enough to allow a per­son to get clear of the machine before it starts moving.

Case B: If the machine is sim­ply ‘enabled’ at this point, but no motion occurs, then mul­ti­ple ‘reset’ or ‘power on’ but­tons may be accept­able, depend­ing on the out­come of the risk assess­ment and start/​stop analy­sis. Having said that, the oper­a­tor will likely have to return to a main con­sole to reset the machine and restart oper­a­tion, and chances are there is only one HMI screen on the machine, so there may not be any advan­tage to hav­ing mul­ti­ple reset buttons.

I would rec­om­mend doing two things to get a good han­dle on this: Conduct a detailed risk assess­ment and include all nor­mal oper­a­tions and all main­te­nance oper­a­tions. Then con­duct a start/​stop analy­sis to look at all of the start­ing and stop­ping con­di­tions that you can rea­son­ably fore­see. Combine the results of these two analy­ses to find the start­ing and stop­ping con­di­tions with the high­est risk, and then deter­mine if hav­ing mul­ti­ple reset but­tons will con­tribute to the risk or not. You may also want to look at the con­trol reli­a­bil­ity require­ments for the emer­gency stop sys­tem based on the out­come of the risk assess­ment and the start/​stop analysis.

In a case where there are mul­ti­ple emer­gency stop devices, loca­tions are impor­tant. There must be one at each nor­mal work­sta­tion to meet the reg­u­la­tory require­ments in most juris­dic­tions, and within ‘easy reach’. You may also want some inside the machine if it is pos­si­ble to gain full body access inside the machin­ery. i.e. inside a robot work cell. Make sure that the but­tons or other devices are located so that a per­son exposed to the hazard(s) inside the machine is not required to reach over or past the haz­ard to get to the button.

Michael, I hope that set­tles the argument!