CanadaControl FunctionsEmergency StopEU European UnionGuards and GuardingHazardous Energy Control ProceduresInternationalLockoutRoboticsUSA

Busting Emergency Stop Myths

Emergency Stop on machine console
This entry is part 5 of 14 in the series Emer­gency Stop

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a little Myth Bust­ing here on the MS101 blog!

What does ‘emergency’ mean?

Con­sider for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a situ­ation that is devel­op­ing or emer­ging at the moment. Emer­gency stop sys­tems are inten­ded to help the user deal with poten­tially haz­ard­ous con­di­tions that are emer­ging at the moment. These con­di­tions have prob­ably aris­en because the design­ers of the machinery failed to con­sider all the fore­see­able uses of the equip­ment, the reas­on­ably pre­dict­able fail­ure modes or because someone has chosen to mis­use the equip­ment in a way that was not inten­ded by the design­ers. The key func­tion of an Emer­gency Stop sys­tem is to provide the user with a backup to the primary safe­guards. These sys­tems are referred to as “Com­ple­ment­ary Pro­tect­ive Meas­ures” and are inten­ded to give the user a chance to “avert or lim­it harm” in a haz­ard­ous situ­ation. With that in mind, let’s look at three myths I hear about reg­u­larly.

Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Drive, Cred­it: Harry Mat­thews & http://www.old-engine.com

Early in the Indus­tri­al Revolu­tion machine build­ers real­ized that users of their machinery needed a way to quickly stop a machine when some­thing went wrong. At that time, power was sup­plied to machinery using over­head line-shafts driv­en by large cent­ral power sources like water­wheels, steam engines or large elec­tric motors. This was a func­tion of the fact that small, high-effi­ciency power sources had yet to be developed, and the use of elec­tri­city for power­ing equip­ment was not yet developed enough to be prac­tic­al. Machinery was coupled to the cent­ral shafts with pul­leys, clutches and belts that trans­mit­ted the power to the machinery.

Jedediah Strutt, North Mill at Belper in 1819, showing vertical shaft leading from the 18 feet (5.5 m) waterwheel, to horizontal drive shafts running the length of each floor.
Jeded­i­ah Strutt, North Mill at Belp­er in 1819, show­ing ver­tic­al shaft lead­ing from the 18 feet (5.5 m) water­wheel, to hori­zont­al drive shafts run­ning the length of each floor image: Wiki­me­dia Com­mons

See pic­tures of a line-shaft powered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Photo: Larry Evans & www.oldengine.org

These cent­ral engines powered an entire fact­ory, so they were much lar­ger than an indi­vidu­al motor sized for a mod­ern machine. In addi­tion, they could not be eas­ily stopped, since stop­ping the cent­ral power source would mean stop­ping the entire fact­ory – not a wel­come choice. Emer­gency stop devices were born in this envir­on­ment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their early use as a safety device, some have incor­rectly con­sidered emer­gency stop sys­tems safe­guard­ing devices. Mod­ern stand­ards make the dif­fer­ence very clear. The easi­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stand­ards pub­lished by IEC [1] and ISO [2].

emer­gency stop [3]
emer­gency stop func­tion

func­tion that is inten­ded to

—   avert arising, or reduce exist­ing, haz­ards to per­sons, dam­age to machinery or to work in pro­gress,

—   be ini­ti­ated by a single human action

NOTE 1

Haz­ards, for the pur­poses of this Inter­na­tion­al Stand­ard, are those which can arise from

—   func­tion­al irreg­u­lar­it­ies (e.g. machinery mal­func­tion, unac­cept­able prop­er­ties of the mater­i­al pro­cessed, human error),

—   nor­mal oper­a­tion.

It is import­ant to under­stand that an emer­gency stop func­tion is “ini­ti­ated by a single human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sidered to be a risk con­trol meas­ure for oper­at­ors or bystand­ers. Emer­gency stop may provide the abil­ity to avoid or reduce harm, by provid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­ally be to call 911 (or 112, etc.) and admin­is­ter first aid.

Safe­guard­ing sys­tems act auto­mat­ic­ally to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­ab­il­ity of a haz­ard­ous situ­ation arising, and may also involve a reduc­tion in the sever­ity of injury by con­trolling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machinery before it can be reached.) This con­sti­tutes a risk con­trol meas­ure and can be shown to reduce the risk of injury to an exposed per­son.

The emer­gency stop func­tion is react­ive; safe­guard­ing sys­tems are pro­act­ive.

In Canada, CSA defines emer­gency stop as a ‘Com­ple­ment­ary Pro­tect­ive Meas­ure’ in CSA Z432-04 [6]:

6.2.2.1.1
Safe­guards (guards, pro­tect­ive devices) shall be used to pro­tect per­sons from the haz­ards that can­not reas­on­ably be avoided or suf­fi­ciently lim­ited by inher­ently safe design. Com­ple­ment­ary pro­tect­ive meas­ures involving addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be taken.

6.2.3.5.3 Com­ple­ment­ary pro­tect­ive meas­ures
Fol­low­ing the risk assess­ment, the meas­ures in this clause either shall be applied to the machine or shall be dealt with in the inform­a­tion for use.
Pro­tect­ive meas­ures that are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/or pro­tect­ive devices), nor inform­a­tion for use may have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine. Such meas­ures shall include, but not be lim­ited to,

a) emer­gency stop;
b) means of res­cue of trapped per­sons; and
c) means of energy isol­a­tion and dis­sip­a­tion.

In the USA, three stand­ards apply: ANSI B11ANSI B11.19 – 2003, and NFPA 79:

ANSI B11-2008

3.80 stop: Imme­di­ate or con­trolled ces­sa­tion of machine motion or oth­er haz­ard­ous situ­ations. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or sup­pli­er-spe­cif­ic terms, the oper­a­tion and func­tion of which is determ­ined by the indi­vidu­al design. Defin­i­tions of some of the more com­monly used “stop” ter­min­o­logy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency pur­poses;

7.6 Emergency stop

Elec­tric­al, pneu­mat­ic and hydraul­ic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-spe­cif­ic stand­ard or NFPA 79.
Inform­at­ive Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Inform­at­ive Note 2: For addi­tion­al inform­a­tion, see ISO 13850 and IEC 60204 – 1.

ANSI B11.19 – 2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­ment­ary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ced­ures in clauses 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI / NFPA 79.

E12.9

Emer­gency stop devices include but are not lim­ited to, but­tons, rope-pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­vert­ent access to a haz­ard, typ­ic­ally without overt action by the indi­vidu­al or oth­ers. Since an indi­vidu­al must actu­ate an emer­gency stop device to issue the stop com­mand, usu­ally in reac­tion to an event or haz­ard­ous situ­ation, it neither detects nor pre­vents expos­ure to the haz­ard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the level of per­form­ance of the safety func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tric­al func­tions of the emer­gency stop func­tion which is not dir­ectly rel­ev­ant to this art­icle, so that is why I haven’t quoted dir­ectly from that doc­u­ment here.

As you can clearly see, the essen­tial defin­i­tions of these devices in the US and Canada match very closely, although the US does not spe­cific­ally use the term ‘com­ple­ment­ary pro­tect­ive meas­ures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emer­gency stop sys­tems act primar­ily by remov­ing power from the prime movers in a machine, ensur­ing that power is removed and the equip­ment brought to a stand­still as quickly as pos­sible, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­able until the emer­gency stop sys­tem is reset. In some cases, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the pro­cess quickly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still fully oper­able and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing power to the machine actu­at­ors dur­ing the stop­ping pro­cess. Also referred to as Cat­egory 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, manu­ally ini­ti­ated, for emer­gency pur­poses;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFif­teen to twenty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ced­ure”. A lock­out pro­ced­ure is one aspect of a haz­ard­ous energy con­trol pro­ced­ure (HECP).  HECPs recog­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nec­ted tem­por­ar­ily, to allow dia­gnostics and test­ing to be car­ried out. This pro­cess is detailed in two cur­rent stand­ards, CSA Z460 [2] and ANSI Z244.1 [4]. Note that these lock­ing devices are still avail­able for sale, and can be used as part of a HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to isol­ate an energy source. 

No cur­rent stand­ard allows for the use of con­trol devices such as push but­tons or select­or switches to be used as energy isol­a­tion devices. 

CSA Z460-05 [2] spe­cific­ally pro­hib­its this use in their defin­i­tion of ‘energy isol­a­tion devices’:

Energy-isol­at­ing device — a mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a manu­ally oper­ated elec­tric­al cir­cuit break­er; a dis­con­nect switch; a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors; a line valve; a block; and oth­er devices used to block or isol­ate energy (push-but­ton select­or switches and oth­er con­trol-type devices are not energy-isol­at­ing devices).

Sim­il­ar require­ments are found in ANSI Z244.1 [4] and in ISO 13850 [1].

Myth #4 – All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. In the Province of Ontario, Canada, there is no legis­la­tion that requires machinery to have an emer­gency stop, only that it be prop­erly marked and loc­ated with­in reach of the oper­at­or [8, § 27].

27. An emer­gency stop con­trol on a power-driv­en machine shall,

(a) be con­spicu­ously iden­ti­fied; and

(b) be loc­ated with­in easy reach of the oper­at­or.  R.R.O. 1990, Reg. 851, s. 27.

By con­trast, in the Province of Québec, Canada, the machine guard­ing require­ments require that all machines have an emer­gency stop [9, § 192].

192. Emer­gency stop: Sub­ject to sec­tion 270, any machine whose oper­a­tion requires the pres­ence of at least one work­er shall be equipped with an emer­gency stop­ping device or switch. This device or switch stops the machine, con­sid­er­ing the machine’s design, in the shortest pos­sible time. In addi­tion, it has the fol­low­ing char­ac­ter­ist­ics:

  1.  it is eas­ily vis­ible and with­in reach of the work­er;
  2.  a single action activ­ates it;
  3.  it is clearly iden­ti­fied.

The reset­ting of the emer­gency stop­ping device after it is used shall not by itself cause the machine to start up. O.C. 885‑2001, s. 192.

Depend­ing on the reg­u­la­tions in your jur­is­dic­tion, machines may or may not be required to have an emer­gency stop sys­tem. Hav­ing said that, the basic level stand­ards (some­times called type A and B stand­ards) do not require that machine have emer­gency stop sys­tems. This includes Canada’s CSA Z432-16 [10] and the USA’s ANSI B11.0 [11].  
 
[10] provides this revised guid­ance. Under­lin­ing added for emphas­is:

7.15.1.2
Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk con­trol.

Note: There could be situ­ations where an e-stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assess­ment. See Clause 5.

Product spe­cif­ic stand­ards (also called type C stand­ards) nor­mally include require­ments for an emer­gency stop. Emer­gency stop sys­tems may be use­ful to the design­er where they can provide a back-up to oth­er safe­guard­ing sys­tems.

Start-Stop Analysis

To under­stand where to use an emer­gency stop, a start-stop ana­lys­is must be car­ried out as part of the design pro­cess. The concept was men­tioned in [3], although not detailed in any sig­ni­fic­ant way. A stop-start ana­lys­is will help the design­er devel­op a clear under­stand­ing of the nor­mal start­ing and stop­ping con­di­tions for the machine. The ana­lys­is also needs to include fail­ure modes for all of the stop func­tions. 

Once the fail­ure modes are under­stood, then the need for an emer­gency stop func­tion can be determ­ined. If remov­ing power will cause the haz­ard to cease in a short time, or if the haz­ard can be quickly con­tained in some way, then an emer­gency stop func­tion is a val­id choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing remov­al of power, i.e., high tem­per­at­ure with sig­ni­fic­ant thermal mass, then emer­gency stop is unlikely to have much effect and is prob­ably use­less for avoid­ing or lim­it­ing harm.

For example, con­sider an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only res­ults in the start of the nat­ur­al cool­ing cycle of the oven. This could take hours or days, so the emer­gency stop has no value. It might be use­ful for con­trolling oth­er haz­ards, such as fire or spin­ning cir­cu­lat­ing fans, that might be related to the same fail­ure. Without a full ana­lys­is of the fail­ure modes of the con­trol sys­tem, a sound decision can­not be made.

Emergency Switching Off

Simple machines like drill presses and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­in­itely bene­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low handle that can be used for “emer­gency switch­ing off”. This dif­fers from an emer­gency stop func­tion because the machine, and the haz­ard, will typ­ic­ally re-start imme­di­ately when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reapply power to the machine on its own.

These require­ments are detailed in ISO 13850 [1], CSA Z432 [11] and oth­er stand­ards.

Design Considerations

Emer­gency Stop is a con­trol that is often designed in with little thought and used for a vari­ety of things that it was nev­er inten­ded to be used to accom­plish. The myths dis­cussed in this art­icle are the tip of the ice­berg.

Con­sider these ques­tions when think­ing about the design and use of emer­gency stop sys­tems:

  1. Have all the inten­ded uses and fore­see­able mis­uses of the equip­ment been con­sidered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assess­ment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be? (At least PLc)
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­poses, like ‘Power Off’, energy isol­a­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Tak­ing the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to provide the func­tion­al­ity that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affected you? Got any more myths about e-stops you’d like to share? I really appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sider adding it to this art­icle, with cred­it of course!

Updates

This art­icle was updated 29-Aug-2018, adding the North Mill at Belp­er draw­ing and fix­ing a few oth­er edit­or­i­al issues. Note that CSA Z432-04 is now obsol­ete and has been replaced by CSA Z432-16. This edi­tion includes sim­il­ar lan­guage to that quoted in this art­icle. In Myth #4, addi­tion­al ref­er­ences to Ontario and Québec reg­u­la­tions were added to show the con­trast in these two Cana­dian Provinces. Addi­tion­al ref­er­ences were made to cur­rent stand­ards.

References

5% Dis­count on All Stand­ards with code: CC2011

IEC – Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion.

ISO – Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion

[1] Safety of machinery — Emer­gency stop — Prin­ciples for design, ISO 13850, 2006. (obsol­ete – replaced by 2015 edi­tion)

[2] Con­trol of Haz­ard­ous Energy ­– Lock­out and Oth­er Meth­ods, CSA Z460, 2005. (obsol­ete – replaced by 2013 edi­tion)
Buy CSA Stand­ards online at CSA.ca

[3] Safe­guard­ing of Machinery, CSA Z432. 2004. (obsol­ete – replaced by 2016 edi­tion)

[4] Con­trol of Haz­ard­ous Energy – Lockout/Tagout and Altern­at­ive Meth­ods, ANSI/ASSE Z244.1, 2003, Amer­ic­an Nation­al Stand­ards Insti­tute / Amer­ic­an Soci­ety of Safety Engin­eers, Des Plaines, IL, USA. (obsol­ete – replaced by 2016 edi­tion)
Down­load ANSI stand­ards

[5] Amer­ic­an Nation­al Stand­ard for Machine Tools – Per­form­ance Cri­ter­ia for Safe­guard­ing, ANSI B11.19. 2003. (obsol­ete – replaced by 2010 edi­tion)

[6] Gen­er­al Safety Require­ments Com­mon to ANSI B11 Machines, ANSI B11. 2008. (obsol­ete – replaced by 2015 edi­tion)

[7] Elec­tric­al Stand­ard for Indus­tri­al Machinery, NFPA 79. 2007. (obsol­ete – replaced by 2018 edi­tion)

Buy NFPA Stand­ards online.

[8]     “R.R.O. 1990, Reg. 851: INDUSTRIAL ESTABLISHMENTS”, Ontario.ca, 2018. [Online]. Avail­able: https://www.ontario.ca/laws/regulation/900851#BK11. [Accessed: 27- Aug- 2018].
[9]     “S-2.1, r. 13 – Reg­u­la­tion respect­ing occu­pa­tion­al health and safety”, Legisquebec.gouv.qc.ca, 2018. [Online]. Avail­able: http://legisquebec.gouv.qc.ca/en/showdoc/cr/S-2.1, r. 13?langCont=en#se:192. [Accessed: 27- Aug- 2018].

[10] Safe­guard­ing of Machinery. CSA Z432. 2016

[11] Safety of Machinery. ANSI B11.0. 2015.

5% Dis­count on All Stand­ards with code: CC2011

Digiprove sealCopy­right secured by Digi­prove © 2011 – 2018
Acknow­ledge­ments: See cita­tions in the art­icle.
Some Rights Reserved
Series Nav­ig­a­tionEmer­gency Stop Cat­egor­iesUsing E-Stops in Lock­out Pro­ced­ures