CanadaCE MarkComplementary Protective MeasuresControl FunctionsControl ReliabilityEmergency StopEU European UnionEU RoboticsInternational RoboticsNorth American RoboticsOntarioRoboticsUSA

Emergency Stop – What’s so confusing about that?

Emergency Stop on machine console
This entry is part 1 of 14 in the series Emer­gency Stop

Editor’s Note: Since we first pub­lished this art­icle on emer­gency-stop in March of 2009, it has become our most pop­u­lar post of all time! We decided it was time for a little refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN Feb-2018.

The Emer­gency Stop func­tion is one of those decept­ively simple con­cepts that have man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user. Some product-spe­cif­ic stand­ards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity, and work cells integ­rat­ing robots are also required to have emer­gency stop cap­ab­il­ity.

Defining Emergency Stop

Photo 1 – This OLD but­ton is def­in­itely non-com­pli­ant.

Before we look at the emer­gency-stop func­tion itself, we need to under­stand what the word “emer­gency” implies. This may seem obvi­ous but bear with me for a minute. The word “emer­gency” has the root “emer­gent”, mean­ing “in the pro­cess of com­ing into being or becom­ing prom­in­ent” accord­ing to the Oxford Dic­tion­ary of Eng­lish. An emer­gency con­di­tion is, there­fore, some con­di­tion that is arising and becom­ing prom­in­ent at the moment. This con­di­tion implies that the situ­ation is not some­thing fore­seen by the machine design­er, and there­fore there are no design fea­tures present to con­trol the con­di­tion.

So what is the Emer­gency Stop func­tion, or E-stop func­tion, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-14 [2]:

Emer­gency situ­ation
an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in pro­gress.
Emer­gency stop but­ton
a red mush­room-headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­ment­ary pro­tect­ive meas­ures
Pro­tect­ive meas­ures which are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/or pro­tect­ive devices), nor inform­a­tion for use, could have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine.

Old spring-return type of e-stop button with a plain red background legend plate.
Photo 2 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e-stop is a func­tion that is inten­ded for use in Emer­gency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard but is con­sidered to be a Com­ple­ment­ary Pro­tect­ive Meas­ure. Look­ing at emer­gency stop func­tions from the per­spect­ive of the Hier­archy of Con­trols, emer­gency stop func­tions fall into the same level as Per­son­al Pro­tect­ive Equip­ment like safety glasses, safety boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stand­ards you choose to read, machinery may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­pon­ents and ele­ments to achieve the emer­gency stop func­tion

If fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­pon­ents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency situ­ations to be aver­ted, the fol­low­ing require­ments apply:

  • the actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible and read­ily access­ible;
  • the haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards, but if this is not pos­sible or the risk can­not be reduced, it should be ques­tioned wheth­er imple­ment­a­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where neces­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

I added the bold text in the pre­vi­ous quo­ta­tion, because that state­ment, “If after a risk assess­ment…” is very import­ant. Later in [2, 7.15.1.2]:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk con­trol.

Note: There could be situ­ations where an e-stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assess­ment.

The bold­ing in the text in the pre­ced­ing para­graph was added for emphas­is. I wanted to be sure that you caught this import­ant bit of text. Not every machine requires an E-stop func­tion. The func­tion is only required where there is a bene­fit to the user unless a product-spe­cif­ic stand­ard requires it. In some cases, product-spe­cif­ic stand­ards often called “Type C” stand­ards, include spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­im­um PLr or SILr, based on the opin­ion of the Tech­nic­al Com­mit­tee respons­ible for the stand­ard and their know­ledge of the par­tic­u­lar type of machinery covered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204 – 1.

Down­load NFPA stand­ards through ANSI

Photo 3 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontario’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (O. Reg. 851), you will find that prop­er iden­ti­fic­a­tion of the emer­gency stop device(s) and loc­a­tion “with­in easy reach” of the oper­at­or are the only require­ment. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Inter­na­tion­ally, a RED oper­at­or device on a YELLOW back­ground, with or without any text on the back­ground, is recog­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. You may also see the IEC sym­bol for emer­gency stop used to identi­fy these devices.

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417 – 5638 – Sym­bol for “emer­gency stop” ©IEC.

I’ve scattered some examples of dif­fer­ent com­pli­ant and non-com­pli­ant e-stop devices through this art­icle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ingly, the European Uni­on has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machinery Dir­ect­ive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Com­ple­ment­ary Pro­tect­ive Meas­ures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-held and/or hand-guided machinery.

From these two bul­lets it becomes clear that, just as in the Cana­dian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-stop sys­tem, then it should not be included in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Cana­dian and US reg­u­la­tions. [3] goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed.

Point of Cla­ri­fic­a­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­ist­ics:
    • The device must latch in the activ­ated pos­i­tion;
    • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-return to the neut­ral pos­i­tion.

The second sen­tence har­mon­izes with the require­ments of the Cana­dian and US stand­ards. The last sen­tence har­mon­izes with the idea of “Com­ple­ment­ary Pro­tect­ive Meas­ures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e-stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). The “easy reach” require­ment trans­lates to 500 – 600 mm either side of the centre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start ana­lys­is. Identi­fy all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Con­sider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Auto­mat­ic, Manu­al, Teach, Set­ting, etc. Identi­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hier­archy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e-stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can’t just default down to an emer­gency stop. IF the e-stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stand­ard for Canada and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tric­al stand­ard for machinery, CSA C22.2 #301 [5]. This stand­ard is inten­ded for cer­ti­fic­a­tion of indus­tri­al machines. My opin­ion is that this stand­ard has some sig­ni­fic­ant issues. You can find very sim­il­ar elec­tric­al require­ments to this in [4] in IEC 60204 – 1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines and is tech­nic­ally identic­al to [6].

Down­load NFPA stand­ards through ANSI
Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reli­ab­il­ity is not addressed in these sec­tions. Quot­ing from the stand­ard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride related start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ard­ous con­di­tions. The three cat­egor­ies of stop func­tions shall be as fol­lows:

(1) Cat­egory 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actu­at­ors.

(2) Cat­egory 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then power is removed when the stop is achieved.

(3) Cat­egory 2 is a con­trolled stop with power left avail­able to the machine actu­at­ors.

This E-Stop Button is correct.
Photo 4 – This E-Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­at­or and the YELLOW back­ground.

A bit later in the stand­ard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­egory 0, Cat­egory 1, and/or Cat­egory 2 stops shall be provided as determ­ined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­egory 0 and Cat­egory 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Cat­egory 0 shall take pri­or­ity.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tect­ive devices and inter­locks shall be provided. Where applic­able, the stop func­tion shall sig­nal the logic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­egor­ies are aligned with sim­il­ar terms used with motor drives. You may want to read this art­icle if your machinery uses a motor drive.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Photo 5 – Dis­con­nect with E-Stop Col­ours indic­ates that this dis­con­nect­ing device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the func­tion­al safety require­ments. In Canada, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­dian machinery into har­mon­iz­a­tion with the Inter­na­tion­al Stand­ards.

Emer­gency stop func­tions are required to provide a min­im­um of ISO 13849 – 1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that great­er reli­ab­il­ity is required, the sys­tem can be designed to meet any high­er reli­ab­il­ity require­ment that is suit­able. Essen­tially, the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required.

I’ve writ­ten extens­ively about the applic­a­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in Photo 5 above is

a) upside down, and

b) using a non-stand­ard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­ested, here is the cor­rect ISO elec­tric­al haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Photo 6 – Elec­tric Shock Haz­ard – IEC 60417 – 5036

You can find these labels at Clari­on Safety Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-stop) CANNOT be used for energy isol­a­tion in an HECP – Haz­ard­ous Energy Con­trol Pro­ced­ure (which includes Lock­out). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 [10] for more on that sub­ject.

Read our Art­icle on Using E-Stops in Haz­ard­ous Energy Con­trol Pro­ced­ures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Photo 7 – Pneu­mat­ic E-Stop/Isol­a­tion device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adop­ted ISO 10218 – 1:2011, second edi­tion, 2011-07-01, with Cana­dian devi­ations and ISO 10218 – 2:2011, first edi­tion, 2011-07-01, with Cana­dian devi­ations). Cana­dian Nation­al Stand­ard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machinery, CSA Stand­ard Z432. 2016

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machinery, and amend­ing Dir­ect­ive 95/16/EC (recast). Brus­sels: European Com­mis­sion, 2006.

[4]  Elec­tric­al Stand­ard for Indus­tri­al Machinery. ANSI/NFPA Stand­ard 79. 2015.

Down­load NFPA stand­ards at ANSI

[5] Indus­tri­al elec­tric­al machinery. CSA Stand­ard C22.2 NO. 301. 2016. 

[6] Safety of machinery – Elec­tric­al Equip­ment of machines – Part 1: Gen­er­al require­ments. IEC Stand­ard 60204 – 1. 2016.  

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

[7] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design. ISO Stand­ard 13849 – 1. 2015.

[8] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 2: Val­id­a­tion. ISO Stand­ard 13849 – 2. 2012.

[9] Safety of machinery – Func­tion­al safety of safety-related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems. IEC Stand­ard 62061+AMD1+AMD2. 2015.

[10] Safety of machineryEmer­gency Stop — Prin­cipals for design. ISO Stand­ard 13850. 2015.

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.
Down­load ISO Stand­ards

[11] Con­trol of haz­ard­ous energy — Lock­out and oth­er meth­ods. CSA Stand­ard Z460. 2013.

 

 

Series Nav­ig­a­tionCheck­ing Emer­gency Stop Sys­tems

34 thoughts on “Emergency Stop – What’s so confusing about that?

  1. Hi Doug,

    Would you con­sider laser cut­ting and engrav­ing machines (40-watt CO2 lasers) designed for small office / home office / hobby use would need an emer­gency stop. The biggest risk is fire (when work­ing in class 1 mode) and hav­ing an emer­gency stop makes it easy to switch off the laser source and laser move­ment, yet I see a num­ber of man­u­fac­tur­ers sup­ply­ing equip­ment without emer­gency stops.

    1. Gareth,

      That depends. The premise for need­ing a risk assess­ment is two-fold:
      1) There needs to be the poten­tial for unfore­seen (emer­gent) con­di­tions to occur, and
      2) The e-stop should be able to per­mit avoid­ing or lim­it­ing harm.

      With laser engravers/markers/cutting equip­ment you basic­ally have three main classes of haz­ards related to the laser:
      a) Laser light – spec­u­lar or dif­fuse reflec­tions from the work­piece;
      b) LGACS – Laser Gen­er­ated Air Con­tam­in­ants, i.e., fumes, smoke, dust, par­tic­u­lates; and
      c) Hot-work haz­ards – spat­ter, sparks, hot mater­i­al which can then cre­ate fire haz­ards.

      An e-stop can def­in­itely deal with a run­away laser beam, but that will really only be effect­ive for spec­u­lar reflec­tions. The NHZ for dif­fuse reflec­tions from CO2 laser mark­ers is usu­ally quite small.

      An e-stop will do noth­ing for LGACS. You need a good ventilation/fume extraction/dust col­lect­or for that, and you don’t want that to shut down unex­pec­tedly, unless the dust col­lect­or is on fire.

      An estop will do noth­ing for the hot-work haz­ards.

      There may be oth­er haz­ards related to the oper­a­tion of the equip­ment where the e-stop can be use­ful for risk reduc­tion. A risk assess­ment is required to determ­ine the need for an e-stop.

      In my exper­i­ence, most laser sys­tems that are Class 3 or 4 come with e-stops and safety inter­lock inputs as stand­ard equip­ment. The inter­locks are there so you can inter­face inter­lock­ing devices on the laser guard­ing enclos­ure to the laser to pre­vent or stop laser beam emis­sions when the guards are open. If you are using home-built or very inex­pens­ive units, you may have big­ger prob­lems. I don’t know where you are geo­graph­ic­ally loc­ated, but if you are loc­ated in the EU, EN 60825 – 1 is applic­able as well as the appro­pri­ate elec­tric­al safety stand­ard, prob­ably EN 61010 – 1, although there are a couple oth­ers that could be used. If you’re in the USA, the laser has to be registered with the CDRH by the laser man­u­fac­turer or dis­trib­ut­or. The laser will need to con­form to 29 CFR 1040 or ANSI Z136.1 or IEC 60825 – 1. It will also require an NRTL mark for elec­tric­al safety. If you’re in Canada, the laser may need to con­form to the Radi­ation Emit­ting Devices Act, and can be cer­ti­fied under CAN/CSA E60825-1. The applic­a­tion may also need to be eval­u­ated under ANSI Z136.1, as E60825-1 does not cov­er applic­a­tion require­ments. Equip­ment used in Canada requires an elec­tric­al safety mark or a field eval­u­ation label to show com­pli­ance with elec­tric­al safety require­ments.

      Note that IEC 60825 – 1 (and the nation­al vari­ants) does not require an emer­gency stop, nor does ANSI Z136.1.

      So, there are the “it depends” cri­ter­ia. I hope that helps.

      1. Hi Doug,

        Thank you for the very detailed response. Time to get check­ing the spe­cif­ic stand­ards.

  2. Hi. I’m after some inform­a­tion on E-Stop. I am cur­rently look­ing at hav­ing the wir­ing done in my garage/workshop. I would like to have 2 ring mains fit­ted. One as nor­mal from the board for gen­er­al power, bat­ter char­ger, radio etc, the oth­er I would like to run through a con­tact­or set up as an E-Stop power ring that power tools will be run from. The reas­on behind this is my daugh­ter is get­ting older and likes to join me/help on pro­jects. The concept it I will have a key switch to lock off the start but­ton, this must be on and all the ‘mush­room’ but­tons released so that when I press the green ‘on’ but­ton the con­tact­or pulls in and turns on the ring to the power tools, bench grinder, pil­lar drill etc. I know this this is overkill for a home/garage set up BUT I would rather do it now and have the abil­ity to lock off the machine power when required (not in there etc) but also to just have the but­tons there if needed and I’m on the oth­er side of the room. I am used to this set up from work (D&T teach­er in a school) and have put a lot of thought into it in my plan­ning (I would hate myself for not doing it and some­thing going wrong later that it could have stopped). As for the wir­ing, now I could do the install­a­tion myself but obvi­ously it wouldn’t be ‘signed off’ and the nor­mal run of the mill house sparks are clue­less on this. I was an elec­tron­ics engin­eer for many years pri­or to my teach­ing work and my fath­er worked on indus­tri­al machine con­trol. I would like to be able to get all the inform­a­tion so I can get it all togeth­er for a will­ing spark to carry out.
    The issues I have cur­rently are the spec of the con­tact­or as it is going ring with sev­er­al machines that could be run­ning from it I am work­ing on the prin­ciple that not all machines will be run­ning at any one time, the largest motor is 1hp lathe (all single phase) and I would say there would be the pos­sib­il­ity of that run­ning and a pil­lar drill or band saw each 3/4hp.
    The con­tact­or will not be switch­ing on load, just dis­con­nect­ing a load in an emer­gency. the rest of the time all it will switch would be a hand­ful of LED lights, one on each machine.
    The oth­er area I want to know about is cable col­ours, an where to find out what to use to/from the start switch and to the 4 stop but­tons in series round the room.
    Basic prin­ciple, Live is on a NO push­but­ton, pulls con­tact­or in, which then feeds a live through all the NC E-Stops in a ring back to the con­tact­or keep­ing the coil activ­ated once the start but­ton is released. Oth­er con­tact on sup­ply the live feed to the machine ring. Hit any stop but­ton, power to coil in con­tact­or is lost, con­tact­or drops out, power dis­con­nec­ted from machine ring.
    Thanks

    1. Pete,
      Thanks for your com­ment and all the details you provided!
      First, kudos for con­sid­er­ing put­ting in a sys­tem like this in a home shop. I am def­in­itely sup­port­ive of this idea.
      The “easy” way to do this is to select an emer­gency stop mod­ule from a com­pany like Pilz, Rock­well, Schmersal, Tele­meca­nique, or your favour­ite sup­pli­er. These com­pan­ies will provide you with sug­ges­ted wir­ing dia­grams.

      Siz­ing the con­tact­ors (yes, con­tact­ors, mul­tiple) is crit­ic­al. They need to be over­di­men­sioned for the applic­a­tion to reduce the stresses on the con­tact­ors in oper­a­tion. For example: If your single run from the pan­el is sized at 32 A, select 64 A con­tact­ors to provide a 2x over dimen­sion­ing of the con­tact­ors. Next, care­fully con­sider how many e-stop devices you really need. Daisy-chain­ing the e-stop devices into a single e-stop mod­ule will res­ult in fault mask­ing and may even­tu­ally lead to a fail-to-func­tion con­di­tion. ISO 13849 – 1 addresses this idea in Table 11. It’s also dis­cussed in ISO/TR 24119 (https://www.iso.org/standard/63160.html). If you daisy chain more than 2 devices, you will be decreas­ing the reli­ab­il­ity of the con­trol sys­tem. You can seg­ment the sys­tem, using 2 – 3 devices into an estop mod­ule, and then sub­sequently daisy-chain­ing the out­put con­tacts of the e-stop mod­ules and sub­sequently into the con­tact­or coils.
      You will need redund­ant con­tact­ors for high-reli­ab­il­ity, or if you feel you can tol­er­ate a some­what reduced level of reli­ab­il­ity, you could drop down to one. Just be aware that if that con­tact­or fails in a wel­ded con­di­tion, the sys­tem will fail.

      Hope­fully that helps. If you need more help, I’d be happy to offer you some coach­ing. You can book a 1-hour ses­sion with me at this link: https://dougnix.acuityscheduling.com/schedule.php?appointmentType=3948927

      1. On more thing: Con­nect the ring mains to the load side of the contactor(s). Depend­ing on the require­ments in the loc­al BS code for this type of wir­ing, you may need addi­tion­al over­cur­rent pro­tec­tion down­stream of the con­tact­ors. 🙂

  3. Hello Mis­ter Nix,

    In CSA Z432-04 we find clause 7.17.1.2:
    Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion shall have a manu­ally ini­ti­ated emer­gency stop device.
    Can we find the same rule some­where in the EU reg­u­la­tion?

    1. Her­man,

      1) That ver­sion of the stand­ard is with­drawn and has been replaced by CSA Z432-16.
      2) Have a look at EN 60204 – 1, 9.2.4, 9.2.5.4, and 10.7.1. This stand­ard is har­mon­ised under both the Machinery Dir­ect­ive 2006/42/EC and the Low Voltage Dir­ect­ive, 2014/35/EU.

  4. Hello. I have one ques­tion regard­ing the emer­gency stop push but­tons for the machines. Can we use Nor­mal Open Con­tact push but­ton with lead break detec­tion in the cicuit. Is there any ref­er­ence stand­ard which pemits use of NO con­tact estop but­ton with lead break detec­tion

    1. None of the stand­ards make expli­cit require­ments for the con­tact func­tion­al­ity for any estop device, includ­ing but­tons, how­ever, ISO 13849 – 1 requires that all cat­egor­ies of archi­tec­ture except Cat­egory B use “well-tried safety prin­ciples” which include open­ing a cir­cuit in order to turn some­thing off. The lists cov­er­ing the require­ments for well-tried safety prin­ciples can be found in ISO 13849 – 2, Annexes A-D, Tables A.2, B.2, C.2 and D.2.

      Based on this, use of a nor­mally open con­tact for ini­ti­ation of emer­gency stop would not meet the cri­ter­ia for any archi­tec­ture Cat­egory except B. Since ISO 13850 requires that emer­gency stop sys­tems provide at least ISO 13849 – 1 PLc, and since PLc requires Cat­egory 1, 2 or 3 archi­tec­ture, the use of a nor­mally open con­tact would not be accept­able.

  5. Hello Mr. Nix. Can you tell me if the EU dir­ect­ive shows any require­ments for E-Stop devices on Engine Driv­en machines such as Pres­sure Wash­ers? I know on most indus­tri­al elec­tric indus­tri­al equip­ment it is required but I am hav­ing a hard time believ­ing that it may be required for an engine driv­en pres­sure wash­er. The pres­sure wash­er uses a key switch to start the engine and enables oth­er devices to oper­ate. When the key switch is off it dis­ables the entire sys­tem.

    1. Adam, great ques­tion!

      To under­stand the require­ments, the first stop is the Machinery Dir­ect­ive, 2006/42/EC, Annex I. In Annex I, you will find clause 1.2.4.3. Emer­gency stop:

      Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

      The fol­low­ing excep­tions apply:
       — machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
       — port­able hand-held and/or hand-guided machinery.

      The device must:
       — have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
       — stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
       — where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

      Since a pres­sure wash­er is covered by the second bul­let in the third para­graph, “port­able hand-held and/or hand-guided machinery”, there is no require­ment for an e-stop sys­tem on any hand-guided pres­sure wash­ing sys­tem, regard­less of energy source.

  6. Hello Mr. Nix,

    is it leg­ally pos­sible to install an emer­gency stop push but­ton in a machine for a dif­fer­ent pur­pose than emer­gency stop­ping it? Obvi­ously, without the ‘emer­gency stop’ mark­ing.

    Thank you.

    1. I’m con­fused as to why you would want to do what you are sug­gest­ing, and here’s why: There is a fun­da­ment­al func­tion­al dif­fer­ence between the way an emer­gency stop func­tion works, and how a nor­mal stop func­tion works. Let me explain a bit more.

      In a nor­mal stop­ping con­di­tion, there is no urgency as to how quickly the stop occurs. The stop may have con­straints placed on it for repeat­ab­il­ity, i.e., you always want a power press ram to stop at top-dead-centre in nor­mal oper­a­tion, but with regard to the stop­ping time involved, nor­mally the time it takes is the time it takes. Also, you don’t want to inad­vert­ently dam­age the machinery by for­cing an unduly quick stop. Power remains on the sys­tem and no recov­ery mode is required because the machine has nev­er gone out­side the nor­mal con­trol envel­ope. Nor­mal stop­ping is usu­ally done via the pro­cess PLC or con­trol­ler, and no func­tion­al safety require­ments apply because nor­mal stop­ping is not usu­ally con­sidered to be a safety func­tion. There are excep­tions of course, like the ser­vice brake on mobile machinery which is both a nor­mal pro­cess func­tion and a safety func­tion.

      In an emer­gency stop­ping con­di­tion, the primary goal is to bring the machinery to a stop as quickly as pos­sible, and dam­aging the machinery to do this is per­mit­ted. To do this the func­tion may include high-fric­tion mech­an­ic­al brak­ing sys­tems, and may use the max­im­um avail­able decel­er­a­tion pos­sible with vari­able fre­quency drives, servo or step­per sys­tems. Com­plete remov­al of power at the end of the stop­ping cycle is the final step. The machine will nor­mally need some kind of recov­ery mode because the sys­tem may be par­tially or com­pletely out of con­trol dur­ing the emer­gency stop­ping time. In fact, this may be WHY an emer­gency stop was invoked. Emer­gency stop is clas­si­fied as a Com­ple­ment­ary Pro­tect­ive Meas­ure (see ISO 12100:2010), and is always con­sidered to be a safety func­tion. ISO 13850 requires PLc / SIL1 as a min­im­um per­form­ance level for emer­gency stop­ping func­tions.

      As you can see, the two func­tions are com­pletely dif­fer­ent. From a leg­al­ity stand­point, to my know­ledge there are no laws or reg­u­la­tions in any jur­is­dic­tion that reg­u­late which type of stop func­tion you choose – that is strictly a design decision. Once taken, that decision then drives the rest of the require­ments regard­ing the details of the way the func­tion is real­ized.

      1. Hello, Mr Nix.

        Thank you for your extens­ive answer. It must be I didn’t explain my ques­tion very well. I meant if I could install an emer­gency stop but­ton, which for example has a par­tic­u­lar mech­an­ism for rearm it, for any oth­er pur­pose than emer­gency stop­ping or stop­ping at all a machine. I was just won­der­ing if an engin­eer or tech­ni­cian thinks of a func­tion for what the hard­ware of an emer­gency but­ton is just right, it would be accept­able or not to use it for it.

        1. If you are won­der­ing if you can use an e-stop device, like a latch­ing push­but­ton for example, for oth­er pur­poses, the answer is tech­nic­ally YES, and prac­tic­ally NO. The rel­ev­ant stand­ards (IEC 60204 – 1, ISO 13850, NFPA 79, CSA C22.2 #301, etc.) lim­it the use of the col­our RED for emer­gency stop device actu­at­ors – that is, the head of the push­but­ton. Also, mush­room head oper­at­ors on push­but­tons are nor­mally only used for e-stop devices. To my know­ledge, none of the com­pon­ent man­u­fac­tur­ers make latch­ing push­but­tons with any­thing oth­er than a red, mush­room head oper­at­or. So, based on that I can­not see how you could use a device inten­ded for e-stop in any­thing oth­er than an e-stop sys­tem without viol­at­ing the require­ments of one or more stand­ards. IF you can find a latch­ing push­but­ton with a BLACK, WHITE, GRAY, or BLUE oper­at­or device, you could cer­tainly use it for oth­er pur­poses, con­sist­ent with the cod­ing require­ments giv­en in the stand­ards.

          1. Ok, that was exactly what I was look­ing for. Thank you.

  7. Is it pos­sible to con­nect sev­er­al emer­gency stops for dif­fer­ent motors loc­ated in the same area, con­nect them to a junc­tion box, wire a mul­ticore cable towards the sub­sta­tion to anoth­er junc­tion box, and then segreg­ate towards the MCC drive for each of the motors? or is it man­dat­ory a single cable for each of the emer­gency stops. Motors are not related to each oth­er.

    1. Enrique,

      From a purely func­tion­al per­spect­ive, this would work, how­ever, you are cre­at­ing a single point of fail­ure for mul­tiple emer­gency stop sys­tems (I’m assum­ing that each e-stop affects dif­fer­ent machinery).

      If you read ISO 13850, you will find that the min­im­um Per­form­ance Level is ISO 13849 – 1 PLc. PLc can be achieved using Cat­egory 1, 2 or 3 archi­tec­ture. If you do this using Cat­egory 1 or 2, no chan­nel sep­ar­a­tion is pos­sible, since these are both single-chan­nel archi­tec­tures. If you use Cat­egory 3, then chan­nel sep­ar­a­tion is one of the basic Com­mon Cause Fail­ure mit­ig­a­tion meth­ods, so group­ing the chan­nels in a single cable would elim­in­ate the pos­sib­il­ity of sep­ar­at­ing the chan­nels.

      So the short answer is: It depends on the archi­tec­ture of the con­trol sys­tem, but no mat­ter what, it cre­ates a single point of fail­ure for all the sys­tems grouped in that cable.

      1. I just read this art­icle. Do I under­stand cor­rectly – so for cat 3 archi­tec­ture – each estop sta­tion should be wired back to safety relay with two cables? (one per chan­nel) I must admit – I have nev­er seen any­one doing it before.

        1. Radoslaw,
          Not neces­sar­ily, BUT, if you look at the CCF table in the Annexes you will see that you can gain CCF points if you provide chan­nel sep­ar­a­tion, which is done by run­ning sep­ar­ate cables to sep­ar­ate sens­ing devices. For con­ven­tion­al estop but­ton install­a­tions, this usu­ally not done because both chan­nels are run to a single phys­ic­al device. By the way, you can achieve the min­im­um PLc required by ISO 13850 using a Cat. 1, 2, or 3 archi­tec­ture. Noth­ing says Cat 3 is required.

        2. Radoslaw,

          Sorry for the delay in reply­ing to your ques­tion – I tried to reply anoth­er way a few days ago and didn’t real­ize it hadn’t pos­ted prop­erly.

          This entire dis­cus­sion starts with a risk assess­ment AND with ISO 13850, the estop stand­ard. If you read this stand­ard, you will find that the min­im­um require­ment for an emer­gency stop is PLc, unless the risk assess­ment says you need a high­er level of reli­ab­il­ity. PLc can be achieved using Cat. 1, 2, or 3 archi­tec­tures and appro­pri­ate com­pon­ent selec­tion. If you review ISO 13849 – 1, Annex F, you will find Table F.1, the Com­mon Cause Estim­a­tion scor­ing ques­tion­naire. One of the ways to reduce the like­li­hood of CCFs is to provide chan­nel sep­ar­a­tion, and it’s import­ant enough that it is giv­en a score of 15, mak­ing it one of the more highly weighted meas­ures in the table. You need a min­im­um score of 65 to claim the PL value that your archi­tec­ture and com­pon­ent selec­tions may be able to yield for you. So, must you sep­ar­ate the chan­nels? No. Is there a bene­fit in high reli­ab­il­ity con­di­tions? Yes. Is it com­monly done? No. You need to care­fully eval­u­ate your applic­a­tion and make the right decision. Don’t for­get Table F.1. Without scor­ing your CCF prop­erly, you can­not claim your PL, regard­less of what your cal­cu­la­tions may tell you.

        3. Radoslaw,

          It is ONE way to achieve the CCF score you need to claim your PL. See Annex F, Table F.1. If you can’t hit 65 on the CCF scale, you can’t claim your PL, regard­less of what the rest of your cal­cu­la­tions may tell you.

  8. Hi All, Just wanted to query is it pos­sible to put a clear plastic cov­er over an E-stop for acci­dent­al activ­a­tions, This cov­er would just be a lift pan­el with the estop as nor­mal under it.

  9. edu­ca­tion­al inform­a­tion pos­ted about emer­gency stop (e-stop) are very inter­est­ing keep your good work. By the way i under­stand most of the new gen­er­a­tions of engines, machinery and equip­ment are man­u­fac­tured with built in safety and pro­tec­tion devices. In any case when they are in oper­a­tion any prob­lems may arise such as pres­sure, tem­per­at­ure and mech­an­ic­al prob­lems it will give and alarm if not rec­ti­fied sub­sequently the sys­tem will stop it to avert fur­ther dam­age. Please bare with me its my only own opin­ion..

  10. Pingback: Doug Nix

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.