Machinery Safety 101

Understanding safety functions: Manual Reset

This entry is part 1 of 3 in the series Under­stand­ing Safety Functions
A reset button graphic

Fol­low­ing the risk assess­ment, risk reduc­tion is the next step. Whenev­er the con­trol sys­tem is called upon to reduce the risk, a safety func­tion is needed. Safety func­tions are defined in safety require­ment spe­cific­a­tions. ISO 13849 – 1:2015 [1] offers descrip­tions of some of the more com­mon safety func­tions. One of the most poorly under­stood is the manu­al reset func­tion. This post should help to clear up the confusion.

If you are look­ing for more inform­a­tion on how to con­duct ISO 13849 ana­lyses, see our series on How to do a 13849 – 1 Ana­lys­is or Explor­ing Cir­cuit Archi­tec­tures.

Two kinds of manual reset functions

There are two kinds of manu­al reset func­tions: those that are safety func­tions and those that are not. Dis­tin­guish­ing between the two is where all of the con­fu­sion arises.

Manu­al reset func­tions are used to enable the re-start of a machine fol­low­ing the activ­a­tion of a safety-related stop, such as a guard inter­lock, a pres­ence-sens­ing device stop or an emer­gency stop. When the event that triggered the safety func­tion is over, activ­at­ing the manu­al reset func­tion veri­fies that all of the safety inputs are at a logic­al “1” con­di­tion and any oth­er pre-con­di­tions are met, before re-enabling the safety func­tion. Re-enabling the safety func­tion does not re-start the machine, it only per­mits re-starting.

Non-safety reset functions

Worker standing in front of a CNC milling machine with the guard open.
CNC Milling Machine

A non-safety reset func­tion is most eas­ily dis­tin­guished by look­ing at the safe­guarded space. Non-safety reset func­tions are suit­able when whole-body access into the safe­guarded space is not pos­sible. A com­mon example would the guard­ing on a CNC milling machine, like that pictured.

Non-safety reset func­tions can be imple­men­ted in a stand­ard PLC since an error in reset­ting the safety func­tion has a lim­ited neg­at­ive con­sequence – i.e., the risk of sig­ni­fic­ant injury is rel­at­ively low.

Safety reset functions

If whole-body access into the safe­guarded space is pos­sible, then the reset func­tion is a safety func­tion. The most com­mon example of this in industry is a robot cell with a peri­met­er fence, but there are oth­er applic­a­tions with sim­il­ar whole-body access needs.

Plan view of a robot cell showing access gate and locations of equipment.
Plan view of a robot cell with whole-body access [2]

The basis for this comes from [1, 5.2.2]. There are a few state­ments that con­trib­ute to cre­at­ing this requirement:

After a stop com­mand has been ini­ti­ated by a safe­guard, the stop con­di­tion shall be main­tained until safe con­di­tions for restart­ing exist.

The re-estab­lish­ment of the safety func­tion by reset­ting of the safe­guard can­cels the stop com­mand. If indic­ated by the risk assess­ment, this can­cel­la­tion of the stop com­mand shall be con­firmed by a manu­al, sep­ar­ate and delib­er­ate action (manu­al reset).

The manu­al reset func­tion shall be provided through a sep­ar­ate and manu­ally oper­ated device with­in the SRP/CS.

The manu­al reset func­tion shall be by delib­er­ate action.

The reset actu­at­or shall be situ­ated out­side the danger zone and in a safe pos­i­tion from which there is good vis­ib­il­ity for check­ing that no per­son is with­in the danger zone.

[1, 5.2.2]

ISO 13849 – 1 includes addi­tion­al require­ments for the reset func­tion. Since ISO 13849 – 1 is a type-B1 stand­ard, it is pos­sible for a machine-spe­cif­ic type‑C stand­ard to set dif­fer­ent requirements

Reset function description

The com­plete manu­al reset func­tion descrip­tion is as follows:

5.2.2 Manu­al reset function

The fol­low­ing applies in addi­tion to the require­ments of Table 8.

After a stop com­mand has been ini­ti­ated by a safe­guard, the stop con­di­tion shall be main­tained until safe con­di­tions for restart­ing exist.

The re-estab­lish­ment of the safety func­tion by reset­ting of the safe­guard can­cels the stop com­mand. If indic­ated by the risk assess­ment, this can­cel­la­tion of the stop com­mand shall be con­firmed by a manu­al, sep­ar­ate and delib­er­ate action (manu­al reset).

The manu­al reset func­tion shall

— be provided through a sep­ar­ate and manu­ally oper­ated device with­in the SRP/CS,

— only be achieved if all safety func­tions and safe­guards are operative,

— not ini­ti­ate motion or a haz­ard­ous situ­ation by itself,

— be by delib­er­ate action,

— enable the con­trol sys­tem for accept­ing a sep­ar­ate start command,

— only be accep­ted by dis­en­ga­ging the actu­at­or from its ener­gized (on) position.

The per­form­ance level of safety-related parts provid­ing the manu­al reset func­tion shall be selec­ted so that the inclu­sion of the manu­al reset func­tion does not dimin­ish the safety required of the rel­ev­ant safety function.

The reset actu­at­or shall be situ­ated out­side the danger zone and in a safe pos­i­tion from which there is good vis­ib­il­ity for check­ing that no per­son is with­in the danger zone.

Where the vis­ib­il­ity of the danger zone is not com­plete, a spe­cial reset pro­ced­ure is required.

NOTE One solu­tion is the use of a second reset actu­at­or. The reset func­tion is ini­ti­ated with­in the danger zone by the first actu­at­or in com­bin­a­tion with a second reset actu­at­or loc­ated out­side the danger zone (near the safe­guard). This reset pro­ced­ure needs to be real­ized with­in a lim­ited time before the con­trol sys­tem accepts a sep­ar­ate start command.

[1, 5.2.2]

Unpacking the requirement

Table 8 reference

The first sen­tence in the require­ment refers to Table 8, which points to IEC 60204 – 1:2005, 9.2.5.3, 9.2.5.4 [3] for the elec­tric­al require­ments for the reset function.

In [3, 9.2.5.3], Stop, the require­ment for reset­ting a stop­ping func­tion is that “The reset of the stop func­tion shall not ini­ti­ate any haz­ard­ous situ­ation.” This require­ment par­al­lels the third bul­let in the requirement.

[3, 9.2.5.4] provides the require­ments for emer­gency stop equip­ment. [3, 9.2.5.4.1] includes this requirement:

Once act­ive oper­a­tion of an emer­gency stop (see 10.7) or emer­gency switch­ing off (see 10.8) actu­at­or has ceased fol­low­ing a com­mand, the effect of this com­mand shall be sus­tained until it is reset. This reset shall be pos­sible only by a manu­al action at that loc­a­tion where the com­mand has been ini­ti­ated. The reset of the com­mand shall not restart the machinery but only per­mit restarting.

It shall not be pos­sible to restart the machinery until all emer­gency stop com­mands have been reset. It shall not be pos­sible to reen­er­gize the machinery until all emer­gency switch­ing off com­mands have been reset.

[3, 9.2.5.4.1]

Here again we see that restart­ing the machine can­not occur until two pre-con­di­tions are met:

  1. All of the emer­gency stop com­mands have been reset – in prac­tic­al terms, this means ensur­ing that all of the emer­gency stop but­tons have been pulled out to their “run” pos­i­tion, and
  2. The emer­gency stop func­tion is manu­ally reset.

These require­ments in [3] have been changed in the cur­rent edi­tion of IEC 60204 – 1 [4], how­ever, the require­ment relat­ing to the reset­ting of emer­gency stop func­tions remains unchanged in clause [4, 9.2.3.4.1].

Maintained condition

The second para­graph in the require­ments reads,

After a stop com­mand has been ini­ti­ated by a safe­guard, the stop con­di­tion shall be main­tained until
safe con­di­tions for restart­ing exist.

This clause sets up the require­ment for manu­al reset of a safety func­tion to be executed in a safety PLC or oth­er safety rated con­trol­ler, includ­ing simple safety relays.

Press­ing the reset but­ton starts a pro­cess in the con­trol­ler that checks that all the safety-related pre-con­di­tions have been met, i.e., are the inputs to the func­tions all at logic­ally TRUE? If this is the case, the safety func­tion can be reset, if not, then the safety func­tion will remain in the STOP con­di­tion. This same require­ment is seen in [4, 9.2.3.4.1]”

Once act­ive oper­a­tion of an emer­gency stop (see 10.7) or emer­gency switch­ing off (see 10.8)
actu­at­or has ceased fol­low­ing a stop or switch­ing off com­mand, the effect of this com­mand
shall be sus­tained until it is reset
. This reset shall be pos­sible only by a manu­al action at the device where the com­mand has been ini­ti­ated. The reset of the com­mand shall not restart the
machinery but only per­mit restarting.

It shall not be pos­sible to restart the machinery until all emer­gency stop com­mands have been
reset. It shall not be pos­sible to reen­er­gize the machinery until all emer­gency switch­ing off
com­mands have been reset.

[4, 9.2.3.4.1]

Re-establishment of the safety function

Re-estab­lish­ing the safety func­tion” is reset­ting the safety func­tion into the nor­mal oper­at­ing con­di­tion. Reset­ting the safety func­tion does not re-start the machine, but per­mits re-start­ing. Here are the requirements:

The re-estab­lish­ment of the safety func­tion by reset­ting of the safe­guard can­cels the stop com­mand. If indic­ated by the risk assess­ment, this can­cel­la­tion of the stop com­mand shall be con­firmed by a manu­al, sep­ar­ate and delib­er­ate action (manu­al reset).

The manu­al reset func­tion shall

— be provided through a sep­ar­ate and manu­ally oper­ated device with­in the SRP/CS,

— only be achieved if all safety func­tions and safe­guards are operative,

— not ini­ti­ate motion or a haz­ard­ous situ­ation by itself,

— be by delib­er­ate action,

— enable the con­trol sys­tem for accept­ing a sep­ar­ate start command,

— only be accep­ted by dis­en­ga­ging the actu­at­or from its ener­gized (on) position.

Can­cel­la­tion of the stop com­mand is fairly obvi­ous, of course, but the require­ment for the manu­al reset is based on the risk assess­ment. This is where an under­stand­ing of the haz­ards and the expos­ure of the per­son to the haz­ards is needed in order to determ­ine wheth­er or not the reset func­tion is a safety function.

An example will help to cla­ri­fy this require­ment. Con­sider a machine with a rotary table fit­ted with four fix­tures. Each fix­ture has pock­ets for the parts needed in the assembly pro­cess. An oper­at­or loads parts to the fix­ture exposed at the work sta­tion, while the oth­er three fix­tures are inside the safe­guarded space where the machine can work on the assembly pro­cess. A light cur­tain is fit­ted across the front of the work­sta­tion so that the oper­at­or must break the sens­ing field to place parts in the nest.

The safety func­tion in this case is a safety-related stop func­tion [1, 5.2.1]. When the oper­at­or’s hands are inside the safe­guarded space, a STOP com­mand is gen­er­ated by the light cur­tain and the rest of the safety-related parts of the con­trol sys­tem, pre­vent­ing the table from rotat­ing. Once the oper­at­or is done load­ing parts and is ready for the machine to start the next cycle, they press a cycle start but­ton to ini­ti­ate the table rota­tion and the next machine cycle.

What is not men­tioned in the descrip­tion of the safety func­tion is that the safety-related stop func­tion must be reset some­how after the sens­ing field has been broken. This can be done in a num­ber of ways, with the most com­mon being an auto­mat­ic reset of the stop func­tion. As long as the risk is reas­on­ably low, this might be accept­able. This is not a manu­al reset func­tion and is there­fore out­side this dis­cus­sion, how­ever, it is worth know­ing that auto­mat­ic reset is pos­sible under some circumstances.

If the risk is great­er, then auto­mat­ic reset should not be used, but rather a manu­al rest function.

Anoth­er option is to use a start/restart func­tion [1, 5.2.3]. This is the case where “pres­ence-sens­ing device ini­ti­ation” (PSDI) [5, 6.3.2.5.3] or a “con­trol guard” is used [5, 6.3.3.2.5]. In PSDI mode, the act of clear­ing the sens­ing field of the light cur­tain imme­di­ately starts the machine cycle. PSDI requires that a timer with a delay-off con­di­tion not longer than a machine cycle is used to mon­it­or the time between breaks of the sens­ing field. If the timer is not reset with­in one cycle, then a sep­ar­ate cycle-start but­ton must be pressed to start the machine cycle and re-ini­tial­ize the PSDI mode. Con­trol guards work in a sim­il­ar way, with the cycle start sig­nal derived from the clos­ing of the inter­lock on the guard. 

Performance Level requirement

Since the manu­al reset func­tion can be a safety func­tion, two require­ments arise:

  1. The manu­al reset func­tion must be iden­ti­fied in the risk assess­ment rel­at­ive to the safety-related stop func­tion, i.e., if you identi­fy the need for an inter­lock on a whole-body access gate into a work cell, then you must also identi­fy the need for a related manu­al reset function.
  2. The required Per­form­ance Level (PLr) must be iden­ti­fied based on the risk.

The per­form­ance level of safety-related parts provid­ing the manu­al reset func­tion shall be selec­ted so that the inclu­sion of the manu­al reset func­tion does not dimin­ish the safety required of the rel­ev­ant safety function.

[1, 5.2.2]

Since the manu­al reset func­tion can­not reduce the Per­form­ance Level (PL) of the related safety func­tion, you will need to determ­ine what the min­im­um PL for the manu­al reset func­tion can be. For example, if the risk assess­ment iden­ti­fies the need for an inter­locked guard with a PLr = d, then the PL of the manu­al reset func­tion can­not be less than PL=d accord­ing to [1, 6.3] and [1, Table 11].

Location of the reset device

For a safety-related reset func­tion, it has been estab­lished that a sep­ar­ate reset device con­nec­ted to the SRP/CS, but the loc­a­tion is not yet clearly estab­lished. The last two para­graphs of the require­ment and the fol­low­ing note help cla­ri­fy this part of the requirement.

The manu­al reset func­tion shall

— be provided through a sep­ar­ate and manu­ally oper­ated device with­in the SRP/CS,

The reset actu­at­or shall be situ­ated out­side the danger zone and in a safe pos­i­tion from which there is good vis­ib­il­ity for check­ing that no per­son is with­in the danger zone.

Where the vis­ib­il­ity of the danger zone is not com­plete, a spe­cial reset pro­ced­ure is required.

NOTE One solu­tion is the use of a second reset actu­at­or. The reset func­tion is ini­ti­ated with­in the danger zone by the first actu­at­or in com­bin­a­tion with a second reset actu­at­or loc­ated out­side the danger zone (near the safe­guard). This reset pro­ced­ure needs to be real­ized with­in a lim­ited time before the con­trol sys­tem accepts a sep­ar­ate start command.

[1, 5.2.2]

When the oper­at­or can­not see the com­plete interi­or of the work cell from the pro­posed place­ment of the reset actu­at­or, there are at least two pos­sib­il­it­ies you can con­sider to cor­rect the problem: 

  1. move the reset actu­at­or to a loc­a­tion where the oper­at­or can see the com­plete area, or as sug­ges­ted by the note, 
  2. add a second reset actu­at­or inside the cell that the work­er must press on the way out.

Press­ing the first reset starts a count­down timer that enables the second reset but­ton, loc­ated on the out­side of the cell. A work­er would have to press the first but­ton, exit the cell and close the gate, and then press the second actu­at­or to reset the safety func­tion, all before the count­down ends. 

Oth­er con­cepts could be used under the “spe­cial reset pro­ced­ure” umbrella, so do not feel com­pletely con­strained by the text of the note. Remem­ber that in ISO stand­ards, the text of a note is inform­at­ive, so there are no require­ments in notes, only guidance.


References

[1] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design, ISO 13849 – 1. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

[2] D. Lukac, “Profib­us Inter­face Based Con­nec­tion and Actu­ation of the Servo-Elec­tric and Pneu­mat­ic 2‑Finger Par­al­lel Grip­per by Using of the Quick Release Grip­per-Change-Sys­tem Real­ized for the Fanuc Robot”, Elec­tron­ics, 2010. Avail­able: https://www.researchgate.net/publication/50392740_Profibus_Interface_Based_Connection_and_Actuation_of_the_Servo-Electric_and_Pneumatic_2-Finger_Parallel_Gripper_by_Using_of_the_Quick_Release_Gripper-Change-System_Realized_for_the_Fanuc_Robot. [Accessed 19 May 2021].

[3] Safety of machinery – Elec­tric­al equip­ment of machines – Part 1: Gen­er­al require­ments, IEC 60204 – 1. Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion (IEC), Geneva. 2005.

[4] Safety of machinery – Elec­tric­al equip­ment of machines – Part 1: Gen­er­al require­ments, IEC 60204 – 1. Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion (IEC), Geneva. 2018.

[5] Safety of machinery — Gen­er­al prin­ciples for design — Risk assess­ment and risk reduc­tion, ISO 12100. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2010.

Digiprove sealCopy­right secured by Digi­prove © 2021
Acknow­ledge­ments: ISO, IEC, Duško Lukač
Some Rights Reserved
Series Nav­ig­a­tionUnder­stand­ing Safety Func­tions: the Safety-related stop func­tionHMI”>Manu­al reset using an HMI