Machinery Safety 101

Emergency Stop – What’s so confusing about that?

This entry is part 1 of 16 in the series Emer­gency Stop

Edit­or­’s Note: Since we first pub­lished this art­icle on emer­gency-stop in March of 2009, it has become our most pop­u­lar post of all time! We decided it was time for a little refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN Feb-2018.

The Emer­gency Stop func­tion is one of those decept­ively simple con­cepts that have man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user. Some product-spe­cif­ic stand­ards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity, and work cells integ­rat­ing robots are also required to have emer­gency stop cap­ab­il­ity.

Defining Emergency Stop

Photo 1 – This OLD but­ton is def­in­itely non-com­pli­ant.

Before we look at the emer­gency-stop func­tion itself, we need to under­stand what the word “emer­gency” implies. This may seem obvi­ous but bear with me for a minute. The word “emer­gency” has the root “emer­gent”, mean­ing “in the pro­cess of com­ing into being or becom­ing prom­in­ent” accord­ing to the Oxford Dic­tion­ary of Eng­lish. An emer­gency con­di­tion is, there­fore, some con­di­tion that is arising and becom­ing prom­in­ent at the moment. This con­di­tion implies that the situ­ation is not some­thing fore­seen by the machine design­er, and there­fore there are no design fea­tures present to con­trol the con­di­tion.

So what is the Emer­gency Stop func­tion, or E‑stop func­tion, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-14 [2]:

Emer­gency situ­ation
an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in pro­gress.
Emer­gency stop but­ton
a red mush­room-headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­ment­ary pro­tect­ive meas­ures
Pro­tect­ive meas­ures which are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/or pro­tect­ive devices), nor inform­a­tion for use, could have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine.

Old spring-return type of e-stop button with a plain red background legend plate.
Photo 2 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e‑stop is a func­tion that is inten­ded for use in Emer­gency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard but is con­sidered to be a Com­ple­ment­ary Pro­tect­ive Meas­ure. Look­ing at emer­gency stop func­tions from the per­spect­ive of the Hier­archy of Con­trols, emer­gency stop func­tions fall into the same level as Per­son­al Pro­tect­ive Equip­ment like safety glasses, safety boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stand­ards you choose to read, machinery may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­pon­ents and ele­ments to achieve the emer­gency stop func­tion

If fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­pon­ents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency situ­ations to be aver­ted, the fol­low­ing require­ments apply:

  • the actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible and read­ily access­ible;
  • the haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards, but if this is not pos­sible or the risk can­not be reduced, it should be ques­tioned wheth­er imple­ment­a­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where neces­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

I added the bold text in the pre­vi­ous quo­ta­tion, because that state­ment, “If after a risk assess­ment…” is very import­ant. Later in [2, 7.15.1.2]:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk con­trol.

Note: There could be situ­ations where an e‑stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assess­ment.

The bold­ing in the text in the pre­ced­ing para­graph was added for emphas­is. I wanted to be sure that you caught this import­ant bit of text. Not every machine requires an E‑stop func­tion. The func­tion is only required where there is a bene­fit to the user unless a product-spe­cif­ic stand­ard requires it. In some cases, product-spe­cif­ic stand­ards often called “Type C” stand­ards, include spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­im­um PLr or SILr, based on the opin­ion of the Tech­nic­al Com­mit­tee respons­ible for the stand­ard and their know­ledge of the par­tic­u­lar type of machinery covered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204 – 1.

Down­load NFPA stand­ards through ANSI

Photo 3 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontari­o’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (O. Reg. 851), you will find that prop­er iden­ti­fic­a­tion of the emer­gency stop device(s) and loc­a­tion “with­in easy reach” of the oper­at­or are the only require­ment. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Inter­na­tion­ally, a RED oper­at­or device on a YELLOW back­ground, with or without any text on the back­ground, is recog­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. You may also see the IEC sym­bol for emer­gency stop used to identi­fy these devices.

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417 – 5638 – Sym­bol for “emer­gency stop” ©IEC.

I’ve scattered some examples of dif­fer­ent com­pli­ant and non-com­pli­ant e‑stop devices through this art­icle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ingly, the European Uni­on has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machinery Dir­ect­ive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Com­ple­ment­ary Pro­tect­ive Meas­ures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-held and/or hand-guided machinery.

From these two bul­lets it becomes clear that, just as in the Cana­dian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e‑stop sys­tem, then it should not be included in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Cana­dian and US reg­u­la­tions. [3] goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e‑stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e‑stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed.

Point of Cla­ri­fic­a­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E‑stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­ist­ics:
    • The device must latch in the activ­ated pos­i­tion;
    • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-return to the neut­ral pos­i­tion.

The second sen­tence har­mon­izes with the require­ments of the Cana­dian and US stand­ards. The last sen­tence har­mon­izes with the idea of “Com­ple­ment­ary Pro­tect­ive Meas­ures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e‑stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). The “easy reach” require­ment trans­lates to 500 – 600 mm either side of the centre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start ana­lys­is. Identi­fy all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Con­sider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Auto­mat­ic, Manu­al, Teach, Set­ting, etc. Identi­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hier­archy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e‑stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can­’t just default down to an emer­gency stop. IF the e‑stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the sys­tem’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stand­ard for Canada and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tric­al stand­ard for machinery, CSA C22.2 #301 [5]. This stand­ard is inten­ded for cer­ti­fic­a­tion of indus­tri­al machines. My opin­ion is that this stand­ard has some sig­ni­fic­ant issues. You can find very sim­il­ar elec­tric­al require­ments to this in [4] in IEC 60204 – 1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines and is tech­nic­ally identic­al to [6].

Down­load NFPA stand­ards through ANSI
Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reli­ab­il­ity is not addressed in these sec­tions. Quot­ing from the stand­ard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride related start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ard­ous con­di­tions. The three cat­egor­ies of stop func­tions shall be as fol­lows:

(1) Cat­egory 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actu­at­ors.

(2) Cat­egory 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then power is removed when the stop is achieved.

(3) Cat­egory 2 is a con­trolled stop with power left avail­able to the machine actu­at­ors.

This E-Stop Button is correct.
Photo 4 – This E‑Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­at­or and the YELLOW back­ground.

A bit later in the stand­ard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­egory 0, Cat­egory 1, and/or Cat­egory 2 stops shall be provided as determ­ined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­egory 0 and Cat­egory 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Cat­egory 0 shall take pri­or­ity.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tect­ive devices and inter­locks shall be provided. Where applic­able, the stop func­tion shall sig­nal the logic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can­’t get away from it…

The func­tion­al stop cat­egor­ies are aligned with sim­il­ar terms used with motor drives. You may want to read this art­icle if your machinery uses a motor drive.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Photo 5 – Dis­con­nect with E‑Stop Col­ours indic­ates that this dis­con­nect­ing device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the func­tion­al safety require­ments. In Canada, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­dian machinery into har­mon­iz­a­tion with the Inter­na­tion­al Stand­ards.

Emer­gency stop func­tions are required to provide a min­im­um of ISO 13849 – 1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that great­er reli­ab­il­ity is required, the sys­tem can be designed to meet any high­er reli­ab­il­ity require­ment that is suit­able. Essen­tially, the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required.

I’ve writ­ten extens­ively about the applic­a­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in Photo 5 above is

a) upside down, and

b) using a non-stand­ard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­ested, here is the cor­rect ISO elec­tric­al haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Photo 6 – Elec­tric Shock Haz­ard – IEC 60417 – 5036

You can find these labels at Clari­on Safety Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e‑stop) CANNOT be used for energy isol­a­tion in an HECP – Haz­ard­ous Energy Con­trol Pro­ced­ure (which includes Lock­out). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 [10] for more on that sub­ject.

Read our Art­icle on Using E‑Stops in Haz­ard­ous Energy Con­trol Pro­ced­ures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Photo 7 – Pneu­mat­ic E‑Stop/Isolation device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adop­ted ISO 10218 – 1:2011, second edi­tion, 2011-07-01, with Cana­dian devi­ations and ISO 10218 – 2:2011, first edi­tion, 2011-07-01, with Cana­dian devi­ations). Cana­dian Nation­al Stand­ard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machinery, CSA Stand­ard Z432. 2016

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machinery, and amend­ing Dir­ect­ive 95/16/EC (recast). Brus­sels: European Com­mis­sion, 2006.

[4]  Elec­tric­al Stand­ard for Indus­tri­al Machinery. ANSI/NFPA Stand­ard 79. 2015.

Down­load NFPA stand­ards at ANSI

[5] Indus­tri­al elec­tric­al machinery. CSA Stand­ard C22.2 NO. 301. 2016. 

[6] Safety of machinery – Elec­tric­al Equip­ment of machines – Part 1: Gen­er­al require­ments. IEC Stand­ard 60204 – 1. 2016.  

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

[7] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design. ISO Stand­ard 13849 – 1. 2015.

[8] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 2: Val­id­a­tion. ISO Stand­ard 13849 – 2. 2012.

[9] Safety of machinery – Func­tion­al safety of safety-related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems. IEC Stand­ard 62061+AMD1+AMD2. 2015.

[10] Safety of machineryEmer­gency Stop — Prin­cipals for design. ISO Stand­ard 13850. 2015.

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.
Down­load ISO Stand­ards

[11] Con­trol of haz­ard­ous energy — Lock­out and oth­er meth­ods. CSA Stand­ard Z460. 2013.

 

 

Series Nav­ig­a­tionCheck­ing Emer­gency Stop Sys­tems

37 thoughts on “Emergency Stop – What’s so confusing about that?

  1. Pingback: 1,000,000 Views!
  2. Hi Doug,

    Would you con­sider laser cut­ting and engrav­ing machines (40-watt CO2 lasers) designed for small office / home office / hobby use would need an emer­gency stop. The biggest risk is fire (when work­ing in class 1 mode) and hav­ing an emer­gency stop makes it easy to switch off the laser source and laser move­ment, yet I see a num­ber of man­u­fac­tur­ers sup­ply­ing equip­ment without emer­gency stops.

    1. Gareth,

      That depends. The premise for need­ing a risk assess­ment is two-fold:
      1) There needs to be the poten­tial for unfore­seen (emer­gent) con­di­tions to occur, and
      2) The e‑stop should be able to per­mit avoid­ing or lim­it­ing harm.

      With laser engravers/markers/cutting equip­ment you basic­ally have three main classes of haz­ards related to the laser:
      a) Laser light – spec­u­lar or dif­fuse reflec­tions from the work­piece;
      b) LGACS – Laser Gen­er­ated Air Con­tam­in­ants, i.e., fumes, smoke, dust, par­tic­u­lates; and
      c) Hot-work haz­ards – spat­ter, sparks, hot mater­i­al which can then cre­ate fire haz­ards.

      An e‑stop can def­in­itely deal with a run­away laser beam, but that will really only be effect­ive for spec­u­lar reflec­tions. The NHZ for dif­fuse reflec­tions from CO2 laser mark­ers is usu­ally quite small.

      An e‑stop will do noth­ing for LGACS. You need a good ventilation/fume extraction/dust col­lect­or for that, and you don’t want that to shut down unex­pec­tedly, unless the dust col­lect­or is on fire.

      An estop will do noth­ing for the hot-work haz­ards.

      There may be oth­er haz­ards related to the oper­a­tion of the equip­ment where the e‑stop can be use­ful for risk reduc­tion. A risk assess­ment is required to determ­ine the need for an e‑stop.

      In my exper­i­ence, most laser sys­tems that are Class 3 or 4 come with e‑stops and safety inter­lock inputs as stand­ard equip­ment. The inter­locks are there so you can inter­face inter­lock­ing devices on the laser guard­ing enclos­ure to the laser to pre­vent or stop laser beam emis­sions when the guards are open. If you are using home-built or very inex­pens­ive units, you may have big­ger prob­lems. I don’t know where you are geo­graph­ic­ally loc­ated, but if you are loc­ated in the EU, EN 60825 – 1 is applic­able as well as the appro­pri­ate elec­tric­al safety stand­ard, prob­ably EN 61010 – 1, although there are a couple oth­ers that could be used. If you’re in the USA, the laser has to be registered with the CDRH by the laser man­u­fac­turer or dis­trib­ut­or. The laser will need to con­form to 29 CFR 1040 or ANSI Z136.1 or IEC 60825 – 1. It will also require an NRTL mark for elec­tric­al safety. If you’re in Canada, the laser may need to con­form to the Radi­ation Emit­ting Devices Act, and can be cer­ti­fied under CAN/CSA E60825‑1. The applic­a­tion may also need to be eval­u­ated under ANSI Z136.1, as E60825‑1 does not cov­er applic­a­tion require­ments. Equip­ment used in Canada requires an elec­tric­al safety mark or a field eval­u­ation label to show com­pli­ance with elec­tric­al safety require­ments.

      Note that IEC 60825 – 1 (and the nation­al vari­ants) does not require an emer­gency stop, nor does ANSI Z136.1.

      So, there are the “it depends” cri­ter­ia. I hope that helps.

      1. Hi Doug,

        Thank you for the very detailed response. Time to get check­ing the spe­cif­ic stand­ards.

  3. Hi. I’m after some inform­a­tion on E‑Stop. I am cur­rently look­ing at hav­ing the wir­ing done in my garage/workshop. I would like to have 2 ring mains fit­ted. One as nor­mal from the board for gen­er­al power, bat­ter char­ger, radio etc, the oth­er I would like to run through a con­tact­or set up as an E‑Stop power ring that power tools will be run from. The reas­on behind this is my daugh­ter is get­ting older and likes to join me/help on pro­jects. The concept it I will have a key switch to lock off the start but­ton, this must be on and all the ‘mush­room’ but­tons released so that when I press the green ‘on’ but­ton the con­tact­or pulls in and turns on the ring to the power tools, bench grinder, pil­lar drill etc. I know this this is overkill for a home/garage set up BUT I would rather do it now and have the abil­ity to lock off the machine power when required (not in there etc) but also to just have the but­tons there if needed and I’m on the oth­er side of the room. I am used to this set up from work (D&T teach­er in a school) and have put a lot of thought into it in my plan­ning (I would hate myself for not doing it and some­thing going wrong later that it could have stopped). As for the wir­ing, now I could do the install­a­tion myself but obvi­ously it would­n’t be ‘signed off’ and the nor­mal run of the mill house sparks are clue­less on this. I was an elec­tron­ics engin­eer for many years pri­or to my teach­ing work and my fath­er worked on indus­tri­al machine con­trol. I would like to be able to get all the inform­a­tion so I can get it all togeth­er for a will­ing spark to carry out.
    The issues I have cur­rently are the spec of the con­tact­or as it is going ring with sev­er­al machines that could be run­ning from it I am work­ing on the prin­ciple that not all machines will be run­ning at any one time, the largest motor is 1hp lathe (all single phase) and I would say there would be the pos­sib­il­ity of that run­ning and a pil­lar drill or band saw each 3/4hp.
    The con­tact­or will not be switch­ing on load, just dis­con­nect­ing a load in an emer­gency. the rest of the time all it will switch would be a hand­ful of LED lights, one on each machine.
    The oth­er area I want to know about is cable col­ours, an where to find out what to use to/from the start switch and to the 4 stop but­tons in series round the room.
    Basic prin­ciple, Live is on a NO push­but­ton, pulls con­tact­or in, which then feeds a live through all the NC E‑Stops in a ring back to the con­tact­or keep­ing the coil activ­ated once the start but­ton is released. Oth­er con­tact on sup­ply the live feed to the machine ring. Hit any stop but­ton, power to coil in con­tact­or is lost, con­tact­or drops out, power dis­con­nec­ted from machine ring.
    Thanks

    1. Pete,
      Thanks for your com­ment and all the details you provided!
      First, kudos for con­sid­er­ing put­ting in a sys­tem like this in a home shop. I am def­in­itely sup­port­ive of this idea.
      The “easy” way to do this is to select an emer­gency stop mod­ule from a com­pany like Pilz, Rock­well, Schmersal, Tele­meca­nique, or your favour­ite sup­pli­er. These com­pan­ies will provide you with sug­ges­ted wir­ing dia­grams.

      Siz­ing the con­tact­ors (yes, con­tact­ors, mul­tiple) is crit­ic­al. They need to be over­di­men­sioned for the applic­a­tion to reduce the stresses on the con­tact­ors in oper­a­tion. For example: If your single run from the pan­el is sized at 32 A, select 64 A con­tact­ors to provide a 2x over dimen­sion­ing of the con­tact­ors. Next, care­fully con­sider how many e‑stop devices you really need. Daisy-chain­ing the e‑stop devices into a single e‑stop mod­ule will res­ult in fault mask­ing and may even­tu­ally lead to a fail-to-func­tion con­di­tion. ISO 13849 – 1 addresses this idea in Table 11. It’s also dis­cussed in ISO/TR 24119 (https://www.iso.org/standard/63160.html). If you daisy chain more than 2 devices, you will be decreas­ing the reli­ab­il­ity of the con­trol sys­tem. You can seg­ment the sys­tem, using 2 – 3 devices into an estop mod­ule, and then sub­sequently daisy-chain­ing the out­put con­tacts of the e‑stop mod­ules and sub­sequently into the con­tact­or coils.
      You will need redund­ant con­tact­ors for high-reli­ab­il­ity, or if you feel you can tol­er­ate a some­what reduced level of reli­ab­il­ity, you could drop down to one. Just be aware that if that con­tact­or fails in a wel­ded con­di­tion, the sys­tem will fail.

      Hope­fully that helps. If you need more help, I’d be happy to offer you some coach­ing. You can book a 1‑hour ses­sion with me at this link: https://dougnix.acuityscheduling.com/schedule.php?appointmentType=3948927

      1. On more thing: Con­nect the ring mains to the load side of the contactor(s). Depend­ing on the require­ments in the loc­al BS code for this type of wir­ing, you may need addi­tion­al over­cur­rent pro­tec­tion down­stream of the con­tact­ors. 🙂

  4. Hello Mis­ter Nix,

    In CSA Z432-04 we find clause 7.17.1.2:
    Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion shall have a manu­ally ini­ti­ated emer­gency stop device.
    Can we find the same rule some­where in the EU reg­u­la­tion?

    1. Her­man,

      1) That ver­sion of the stand­ard is with­drawn and has been replaced by CSA Z432-16.
      2) Have a look at EN 60204 – 1, 9.2.4, 9.2.5.4, and 10.7.1. This stand­ard is har­mon­ised under both the Machinery Dir­ect­ive 2006/42/EC and the Low Voltage Dir­ect­ive, 2014/35/EU.

  5. Hello. I have one ques­tion regard­ing the emer­gency stop push but­tons for the machines. Can we use Nor­mal Open Con­tact push but­ton with lead break detec­tion in the cicuit. Is there any ref­er­ence stand­ard which pemits use of NO con­tact estop but­ton with lead break detec­tion

    1. None of the stand­ards make expli­cit require­ments for the con­tact func­tion­al­ity for any estop device, includ­ing but­tons, how­ever, ISO 13849 – 1 requires that all cat­egor­ies of archi­tec­ture except Cat­egory B use “well-tried safety prin­ciples” which include open­ing a cir­cuit in order to turn some­thing off. The lists cov­er­ing the require­ments for well-tried safety prin­ciples can be found in ISO 13849 – 2, Annexes A‑D, Tables A.2, B.2, C.2 and D.2.

      Based on this, use of a nor­mally open con­tact for ini­ti­ation of emer­gency stop would not meet the cri­ter­ia for any archi­tec­ture Cat­egory except B. Since ISO 13850 requires that emer­gency stop sys­tems provide at least ISO 13849 – 1 PLc, and since PLc requires Cat­egory 1, 2 or 3 archi­tec­ture, the use of a nor­mally open con­tact would not be accept­able.

  6. Hello Mr. Nix. Can you tell me if the EU dir­ect­ive shows any require­ments for E‑Stop devices on Engine Driv­en machines such as Pres­sure Wash­ers? I know on most indus­tri­al elec­tric indus­tri­al equip­ment it is required but I am hav­ing a hard time believ­ing that it may be required for an engine driv­en pres­sure wash­er. The pres­sure wash­er uses a key switch to start the engine and enables oth­er devices to oper­ate. When the key switch is off it dis­ables the entire sys­tem.

    1. Adam, great ques­tion!

      To under­stand the require­ments, the first stop is the Machinery Dir­ect­ive, 2006/42/EC, Annex I. In Annex I, you will find clause 1.2.4.3. Emer­gency stop:

      Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

      The fol­low­ing excep­tions apply:
       — machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
       — port­able hand-held and/or hand-guided machinery.

      The device must:
       — have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
       — stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
       — where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

      Since a pres­sure wash­er is covered by the second bul­let in the third para­graph, “port­able hand-held and/or hand-guided machinery”, there is no require­ment for an e‑stop sys­tem on any hand-guided pres­sure wash­ing sys­tem, regard­less of energy source.

  7. Hello Mr. Nix,

    is it leg­ally pos­sible to install an emer­gency stop push but­ton in a machine for a dif­fer­ent pur­pose than emer­gency stop­ping it? Obvi­ously, without the ’emer­gency stop’ mark­ing.

    Thank you.

    1. I’m con­fused as to why you would want to do what you are sug­gest­ing, and here’s why: There is a fun­da­ment­al func­tion­al dif­fer­ence between the way an emer­gency stop func­tion works, and how a nor­mal stop func­tion works. Let me explain a bit more.

      In a nor­mal stop­ping con­di­tion, there is no urgency as to how quickly the stop occurs. The stop may have con­straints placed on it for repeat­ab­il­ity, i.e., you always want a power press ram to stop at top-dead-centre in nor­mal oper­a­tion, but with regard to the stop­ping time involved, nor­mally the time it takes is the time it takes. Also, you don’t want to inad­vert­ently dam­age the machinery by for­cing an unduly quick stop. Power remains on the sys­tem and no recov­ery mode is required because the machine has nev­er gone out­side the nor­mal con­trol envel­ope. Nor­mal stop­ping is usu­ally done via the pro­cess PLC or con­trol­ler, and no func­tion­al safety require­ments apply because nor­mal stop­ping is not usu­ally con­sidered to be a safety func­tion. There are excep­tions of course, like the ser­vice brake on mobile machinery which is both a nor­mal pro­cess func­tion and a safety func­tion.

      In an emer­gency stop­ping con­di­tion, the primary goal is to bring the machinery to a stop as quickly as pos­sible, and dam­aging the machinery to do this is per­mit­ted. To do this the func­tion may include high-fric­tion mech­an­ic­al brak­ing sys­tems, and may use the max­im­um avail­able decel­er­a­tion pos­sible with vari­able fre­quency drives, servo or step­per sys­tems. Com­plete remov­al of power at the end of the stop­ping cycle is the final step. The machine will nor­mally need some kind of recov­ery mode because the sys­tem may be par­tially or com­pletely out of con­trol dur­ing the emer­gency stop­ping time. In fact, this may be WHY an emer­gency stop was invoked. Emer­gency stop is clas­si­fied as a Com­ple­ment­ary Pro­tect­ive Meas­ure (see ISO 12100:2010), and is always con­sidered to be a safety func­tion. ISO 13850 requires PLc / SIL1 as a min­im­um per­form­ance level for emer­gency stop­ping func­tions.

      As you can see, the two func­tions are com­pletely dif­fer­ent. From a leg­al­ity stand­point, to my know­ledge there are no laws or reg­u­la­tions in any jur­is­dic­tion that reg­u­late which type of stop func­tion you choose – that is strictly a design decision. Once taken, that decision then drives the rest of the require­ments regard­ing the details of the way the func­tion is real­ized.

      1. Hello, Mr Nix.

        Thank you for your extens­ive answer. It must be I did­n’t explain my ques­tion very well. I meant if I could install an emer­gency stop but­ton, which for example has a par­tic­u­lar mech­an­ism for rearm it, for any oth­er pur­pose than emer­gency stop­ping or stop­ping at all a machine. I was just won­der­ing if an engin­eer or tech­ni­cian thinks of a func­tion for what the hard­ware of an emer­gency but­ton is just right, it would be accept­able or not to use it for it.

        1. If you are won­der­ing if you can use an e‑stop device, like a latch­ing push­but­ton for example, for oth­er pur­poses, the answer is tech­nic­ally YES, and prac­tic­ally NO. The rel­ev­ant stand­ards (IEC 60204 – 1, ISO 13850, NFPA 79, CSA C22.2 #301, etc.) lim­it the use of the col­our RED for emer­gency stop device actu­at­ors – that is, the head of the push­but­ton. Also, mush­room head oper­at­ors on push­but­tons are nor­mally only used for e‑stop devices. To my know­ledge, none of the com­pon­ent man­u­fac­tur­ers make latch­ing push­but­tons with any­thing oth­er than a red, mush­room head oper­at­or. So, based on that I can­not see how you could use a device inten­ded for e‑stop in any­thing oth­er than an e‑stop sys­tem without viol­at­ing the require­ments of one or more stand­ards. IF you can find a latch­ing push­but­ton with a BLACK, WHITE, GRAY, or BLUE oper­at­or device, you could cer­tainly use it for oth­er pur­poses, con­sist­ent with the cod­ing require­ments giv­en in the stand­ards.

          1. Ok, that was exactly what I was look­ing for. Thank you.

  8. Is it pos­sible to con­nect sev­er­al emer­gency stops for dif­fer­ent motors loc­ated in the same area, con­nect them to a junc­tion box, wire a mul­ticore cable towards the sub­sta­tion to anoth­er junc­tion box, and then segreg­ate towards the MCC drive for each of the motors? or is it man­dat­ory a single cable for each of the emer­gency stops. Motors are not related to each oth­er.

    1. Enrique,

      From a purely func­tion­al per­spect­ive, this would work, how­ever, you are cre­at­ing a single point of fail­ure for mul­tiple emer­gency stop sys­tems (I’m assum­ing that each e‑stop affects dif­fer­ent machinery).

      If you read ISO 13850, you will find that the min­im­um Per­form­ance Level is ISO 13849 – 1 PLc. PLc can be achieved using Cat­egory 1, 2 or 3 archi­tec­ture. If you do this using Cat­egory 1 or 2, no chan­nel sep­ar­a­tion is pos­sible, since these are both single-chan­nel archi­tec­tures. If you use Cat­egory 3, then chan­nel sep­ar­a­tion is one of the basic Com­mon Cause Fail­ure mit­ig­a­tion meth­ods, so group­ing the chan­nels in a single cable would elim­in­ate the pos­sib­il­ity of sep­ar­at­ing the chan­nels.

      So the short answer is: It depends on the archi­tec­ture of the con­trol sys­tem, but no mat­ter what, it cre­ates a single point of fail­ure for all the sys­tems grouped in that cable.

      1. I just read this art­icle. Do I under­stand cor­rectly – so for cat 3 archi­tec­ture – each estop sta­tion should be wired back to safety relay with two cables? (one per chan­nel) I must admit – I have nev­er seen any­one doing it before.

        1. Radoslaw,
          Not neces­sar­ily, BUT, if you look at the CCF table in the Annexes you will see that you can gain CCF points if you provide chan­nel sep­ar­a­tion, which is done by run­ning sep­ar­ate cables to sep­ar­ate sens­ing devices. For con­ven­tion­al estop but­ton install­a­tions, this usu­ally not done because both chan­nels are run to a single phys­ic­al device. By the way, you can achieve the min­im­um PLc required by ISO 13850 using a Cat. 1, 2, or 3 archi­tec­ture. Noth­ing says Cat 3 is required.

        2. Radoslaw,

          Sorry for the delay in reply­ing to your ques­tion – I tried to reply anoth­er way a few days ago and did­n’t real­ize it had­n’t pos­ted prop­erly.

          This entire dis­cus­sion starts with a risk assess­ment AND with ISO 13850, the estop stand­ard. If you read this stand­ard, you will find that the min­im­um require­ment for an emer­gency stop is PLc, unless the risk assess­ment says you need a high­er level of reli­ab­il­ity. PLc can be achieved using Cat. 1, 2, or 3 archi­tec­tures and appro­pri­ate com­pon­ent selec­tion. If you review ISO 13849 – 1, Annex F, you will find Table F.1, the Com­mon Cause Estim­a­tion scor­ing ques­tion­naire. One of the ways to reduce the like­li­hood of CCFs is to provide chan­nel sep­ar­a­tion, and it’s import­ant enough that it is giv­en a score of 15, mak­ing it one of the more highly weighted meas­ures in the table. You need a min­im­um score of 65 to claim the PL value that your archi­tec­ture and com­pon­ent selec­tions may be able to yield for you. So, must you sep­ar­ate the chan­nels? No. Is there a bene­fit in high reli­ab­il­ity con­di­tions? Yes. Is it com­monly done? No. You need to care­fully eval­u­ate your applic­a­tion and make the right decision. Don’t for­get Table F.1. Without scor­ing your CCF prop­erly, you can­not claim your PL, regard­less of what your cal­cu­la­tions may tell you.

        3. Radoslaw,

          It is ONE way to achieve the CCF score you need to claim your PL. See Annex F, Table F.1. If you can­’t hit 65 on the CCF scale, you can­’t claim your PL, regard­less of what the rest of your cal­cu­la­tions may tell you.

  9. Hi All, Just wanted to query is it pos­sible to put a clear plastic cov­er over an E‑stop for acci­dent­al activ­a­tions, This cov­er would just be a lift pan­el with the estop as nor­mal under it.

  10. edu­ca­tion­al inform­a­tion pos­ted about emer­gency stop (e‑stop) are very inter­est­ing keep your good work. By the way i under­stand most of the new gen­er­a­tions of engines, machinery and equip­ment are man­u­fac­tured with built in safety and pro­tec­tion devices. In any case when they are in oper­a­tion any prob­lems may arise such as pres­sure, tem­per­at­ure and mech­an­ic­al prob­lems it will give and alarm if not rec­ti­fied sub­sequently the sys­tem will stop it to avert fur­ther dam­age. Please bare with me its my only own opin­ion..

  11. Pingback: Doug Nix

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

All original content on these pages is fingerprinted and certified by Digiprove