Checking Emergency Stop Systems

This entry is part 2 of 12 in the series Emergency Stop

A while back I wrote about the basic design require­ments for Emergency Stop sys­tems. I’ve had sev­er­al people con­tact me want­ing to know about check­ing and test­ing emer­gency stops, so here are my thoughts on this pro­cess.

Figure 1 below, excerp­ted from the 1996 edi­tion of ISO 13850, Safety of machinery — Emergency stop — Principles for design, shows the emer­gency stop func­tion graph­ic­ally. As you can see, the ini­ti­at­ing factor in this func­tion is a per­son becom­ing aware of the need for an emer­gency stop. This is NOT an auto­mat­ic func­tion and is NOT a safety or safe­guard­ing func­tion.

Download ISO Standards 

ISO 13850 1996 Figure 1 - Emergency Stop Function
ISO 13850 1996 Figure 1 – Emergency Stop Function

Download ISO Standards 

I men­tion this because many people are con­fused about this point. Emergency stop sys­tems are con­sidered to be ‘com­pli­ment­ary pro­tect­ive meas­ures’, mean­ing that their func­tions com­ple­ment the safe­guard­ing sys­tems, but can­not be con­sidered to be safe­guards in and of them­selves. This is sig­ni­fic­ant. Safeguarding sys­tems are required to act auto­mat­ic­ally to pro­tect an exposed per­son. Think about how an inter­locked gate or a light cur­tain acts to stop haz­ard­ous motion BEFORE the per­son can reach it. Emergency stop is nor­mally used AFTER the per­son is already involved with the haz­ard, and the next step is nor­mally to call 911.

All of that is import­ant from the per­spect­ive of con­trol reli­ab­il­ity. The con­trol reli­ab­il­ity require­ments for emer­gency stop sys­tems are often dif­fer­ent from those for the safe­guard­ing sys­tems because they are a backup sys­tem. Determination of the reli­ab­il­ity require­ments is based on the risk assess­ment and on an ana­lys­is of the cir­cum­stances where you, as the design­er, anti­cip­ate that emer­gency stop may be help­ful in redu­cing or avoid­ing injury or machinery dam­age. Frequently, these sys­tems have lower con­trol reli­ab­il­ity require­ments than do safe­guard­ing sys­tems.

Before you begin any test­ing, under­stand what effects the test­ing will have on the machinery. Emergency stops can be par­tially tested with the machinery at rest. Depending on the func­tion of the machinery and the dif­fi­culty in recov­er­ing from an emer­gency stop con­di­tion, you may need to adjust your approach to these tests. Start by review­ing the emer­gency stop func­tion­al descrip­tion in the manu­al. Here’s an example taken from a real machine manu­al:

Emergency Stop (E-​Stop) Button

Emergency Stop Button
Figure 2.1 Emergency Stop (E-​Stop) Button

A red emer­gency stop (E-​Stop) but­ton is a safety device which allows the oper­at­or to stop the machine in an emer­gency. At any time dur­ing oper­a­tion, press the E-​Stop but­ton to dis­con­nect actu­at­or power and stop all con­nec­ted machines in the pro­duc­tion line. Figure 2.1 shows the emer­gency stop but­ton.

There is one E-​Stop but­ton on the pneu­mat­ic pan­el.

NOTE: After press­ing the E-​Stop but­ton, the entire pro­duc­tion line from spreader-​feeder to stack­er shuts down. When the E-​Stop but­ton is reset, all machines in the pro­duc­tion line will need to be restar­ted.

DANGER: These devices do not dis­con­nect main elec­tric­al power from the machine. See “Electrical Disconnect” on page 21.

As you can see, the gen­er­al func­tion of the but­ton is described, and some warn­ings are giv­en about what does and doesn’t hap­pen when the but­ton is pressed.

Now, if the emer­gency stop sys­tem has been designed prop­erly and the machine is oper­at­ing nor­mally, press­ing the emer­gency stop but­ton while the machine is in mid-​cycle should res­ult in the machinery com­ing to a fast and grace­ful stop. Here is what ISO 13850 has to say about this con­di­tion:

4.1.3 The emer­gency stop func­tion shall be so designed that, after actu­ation of the emer­gency stop actu­at­or, haz­ard­ous move­ments and oper­a­tions of the machine are stopped in an appro­pri­ate man­ner, without cre­at­ing addi­tion­al haz­ards and without any fur­ther inter­ven­tion by any per­son, accord­ing to the risk assess­ment.
An “appro­pri­ate man­ner” can include

  • choice of an optim­al decel­er­a­tion rate,
  • selec­tion of the stop cat­egory (see 4.1.4), and
  • employ­ment of a pre­de­ter­mined shut­down sequence.

The emer­gency stop func­tion shall be so designed that a decision to use the emer­gency stop device does not require the machine oper­at­or to con­sider the res­ult­ant effects.

The inten­tion of this func­tion is to bring the machinery to a halt as quickly as pos­sible without dam­aging the machine. However, if the brak­ing sys­tems fail, e.g. the servo drive fails to decel­er­ate the tool­ing as it should, then drop­ping power and poten­tially dam­aging the machinery is accept­able.

In many sys­tems, press­ing the e-​stop but­ton or oth­er­wise activ­at­ing the emer­gency stop sys­tem will res­ult in a fault or an error being dis­played on the machine’s oper­at­or dis­play. This can be used as an indic­a­tion that the con­trol sys­tem ‘knows’ that the sys­tem has been activ­ated.

ISO 13850 requires that emer­gency stop sys­tems exhib­it the fol­low­ing key beha­viours:

  • It must over­ride all oth­er con­trol func­tions, and no start func­tions are per­mit­ted (inten­ded, unin­ten­ded or unex­pec­ted) until the emer­gency stop has been reset;
  • Use of the emer­gency stop can­not impair the oper­a­tion of any func­tions of the machine inten­ded for the release of trapped per­sons;
  • It is not per­mit­ted to affect the func­tion of any oth­er safety crit­ic­al sys­tems or devices.

Tests

Once the emer­gency stop device has been activ­ated, con­trol power is nor­mally lost. Pressing any START func­tion on the con­trol pan­el, except POWER ON or RESET should have no effect. If any aspect of the machine starts, count this as a FAILED test.

If reset­ting the emer­gency stop device res­ults in con­trol power being re-​applied, count this as a FAILED test.

Pressing POWER ON or RESET before the activ­ated emer­gency stop device has been reset (i.e. the e-​stop but­ton has been pulled out to the ‘oper­ate’ pos­i­tion), should have no effect. If you can turn the power back on before you reset the emer­gency stop device, count this as a FAILED test.

Once the emer­gency stop device has been reset, press­ing POWER ON or RESET should res­ult in the con­trol power being restored. This is accept­able. The machine should not restart. If the machine restarts nor­mal oper­a­tion, count this as a FAILED test.

Once con­trol power is back on, you may have a num­ber of faults to clear. When all the faults have been cleared, press­ing the START but­ton should res­ult in the machine restart­ing. This is accept­able beha­viour.

If you break the machine while test­ing the emer­gency stop sys­tem, count this as a FAILED test.

Test all emer­gency stop devices. A wir­ing error or oth­er prob­lems may not be appar­ent until the emer­gency stop device is tested. Push all but­tons, pull all pull cords, activ­ate all emer­gency stop devices. If any fail to cre­ate the emer­gency stop con­di­tion, count this as a FAILED test.

If, hav­ing con­duc­ted all of these tests, no fail­ures have been detec­ted, con­sider the sys­tem to have passed basic func­tion­al test­ing. Depending on the com­plex­ity of the sys­tem and the crit­ic­al­ity of the emer­gency stop func­tion, addi­tion­al test­ing may be required. It may be neces­sary to devel­op some func­tion­al tests that are con­duc­ted while vari­ous EMI sig­nals are present, for example.

If you have any ques­tions regard­ing test­ing of emer­gency stop devices, please email me!

Download ISO Standards 

Series NavigationEmergency Stop – What’s so con­fus­ing about that?Busting Emergency Stop Myths

Author: Doug Nix

+DougNix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://www.complianceinsight.ca) in Kitchener, Ontario, and is Lead Author and Managing Editor of the Machinery Safety 101 blog.

Doug's work includes teaching machinery risk assessment techniques privately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as providing technical services and training programs to clients related to risk assessment, industrial machinery safety, safety-related control system integration and reliability, laser safety and regulatory conformity.

Follow me on Academia.edu//a.academia-assets.com/javascripts/social.js

  • Myles Cantrell

    I have read through lots of doc­u­ment­a­tion, and recently many of your art­icles on machinerysafety101​.com, but I still can­not derive a defin­it­ive answer to my issue. I would greatly appre­ci­ate any light you could shed on my scen­ario.

    For example: A machine is using a safety gate cir­cuit to remove all voltage (through a safety relay with redund­ant & mon­itored force-​guided con­tacts) to motors loc­ated inside the guard­ing once the gate is opened. The same machine is using an E-​Stop safety cir­cuit to remove all con­trol voltage from the PLC and its out­puts, but does not dis­con­nect voltage to motors. Based on risk assess­ments it seems like our oper­at­ors are com­pletely pro­tec­ted by the safety gate cir­cuit. But, does the inclu­sion of E-​Stop but­tons man­date that they have to also pro­tect everything that the safety gate cir­cuit pro­tects?

    Your art­icle men­tions,
    “Emergency stop sys­tems are con­sidered to be ‘com­pli­ment­ary pro­tect­ive meas­ures’,” and
    “It is not per­mit­ted to affect the func­tion of any oth­er safety crit­ic­al sys­tems or devices.” This makes me think that the E-​Stop safety cir­cuit can be mutu­ally exclus­ive. Would this be a cor­rect con­clu­sion?

    • Myles, this is a really good ques­tion. Here is the answer:

      1) Emergency Stop func­tions, if needed based on the risk assess­ment, are required to have final con­trol over power to the prime movers. The e-​stop func­tion must be able to over­ride ALL OTHER func­tions.

      If the motor starter (con­tact­or and over­load com­bin­a­tion) coils are driv­en dir­ectly from a PLC out­put, and the e-​stop switched off power to the PLC card, then this is OK. Power dis­con­nec­tion is achieved through the motor starter contactor(s). The con­tact­ors must be mon­itored by the safety sys­tem.

      If the motors are powered by a VFD or oth­er motor drive, this gets to be more com­plic­ated. See my recent art­icle on STO.

      2) Safeguarding func­tions and e-​stop func­tions should nor­mally be com­pletely sep­ar­ate, even if they act upon the same haz­ards. One major reas­on for this divi­sion is that the func­tion­al safety require­ments for the safe­guard­ing sys­tems are often much great­er than what is required of the e-​stop. i.e., the safe­guard­ing requires PLd while the e-​stop requires PLc.

      The fre­quency of use for the safe­guard­ing func­tions (called the “demand fre­quency”) is almost always sig­ni­fic­antly high­er than the e-​stop, which if the machine risk assess­ment was done well, should almost nev­er be used.

      3) It is pos­sible to zone the e-​stop func­tions, so that they can con­trol one small area, like a single cell in a multi-​cell line, but there also needs to be a “Master E-​Stop” that can stop the whole line. See ISO 13850:2015 for more on that top­ic.

      The key thing to remem­ber here is the word “emer­gency.” It come from the root word “emer­gent.” The only time it should be used is to deal with an emer­gent situ­ation that was not fore­seen by the machine build­er. It’s a BACK UP to the primary safe­guard­ing, not the oth­er way around.

      I hope that helps!

  • con­trols­girl

    I love these con­ver­sa­tions. Although, it bugs me look­ing at how many pro­jects I have worked on where no test­ing was con­duc­ted before ship­ping the machine.

    • I can relate – many cli­ents have no under­stand­ing of the fun­da­ment­al part that sys­tem V&V plays. I think part of the prob­lem is that Project Managers may not know that this crit­ic­al step is needed, so it doesn’t get into the sched­ule. The oth­er side of this is that V&V takes time; time to plan, time to com­plete, and that equates to addi­tion­al costs that may not have been planned for. Anyway, when we know more we do more, and we can help those that con­trol the work bet­ter under­stand what is needed to do the job prop­erly. 🙂

  • Pingback: Penmar Automation()

  • Pingback: machinerysafety()

  • Pingback: MachinerySafety()

  • Pingback: machinerysafety()

  • Pingback: MachinerySafety()

  • Pingback: Doug Nix()

  • Pingback: Tweets that mention Checking Emergency Stop Systems | Machinery Safety 101 -- Topsy.com()