Machinery Safety 101

Understanding safety functions: Manual Reset

A reset button graphic

Following the risk assessment, risk reduction is the next step. Whenever the control system is called upon to reduce the risk, a safety function is needed. Safety functions are defined in safety requirement specifications. ISO 13849-1:2015 [1] offers descriptions of some of the more common safety functions. One of the most poorly understood is the manual reset function. This post should help to clear up the confusion.

If you are looking for more information on how to conduct ISO 13849 analyses, see our series on How to do a 13849-1 Analysis or Exploring Circuit Architectures.

Two kinds of manual reset functions

There are two kinds of manual reset functions: those that are safety functions and those that are not. Distinguishing between the two is where all of the confusion arises.

Manual reset functions are used to enable the re-start of a machine following the activation of a safety-related stop, such as a guard interlock, a presence-sensing device stop or an emergency stop. When the event that triggered the safety function is over, activating the manual reset function verifies that all of the safety inputs are at a logical “1” condition and any other pre-conditions are met, before re-enabling the safety function. Re-enabling the safety function does not re-start the machine, it only permits re-starting.

Non-safety reset functions

Worker standing in front of a CNC milling machine with the guard open.
CNC Milling Machine

A non-safety reset function is most easily distinguished by looking at the safeguarded space. Non-safety reset functions are suitable when whole-body access into the safeguarded space is not possible. A common example would the guarding on a CNC milling machine, like that pictured.

Non-safety reset functions can be implemented in a standard PLC since an error in resetting the safety function has a limited negative consequence – i.e., the risk of significant injury is relatively low.

Safety reset functions

If whole-body access into the safeguarded space is possible, then the reset function is a safety function. The most common example of this in industry is a robot cell with a perimeter fence, but there are other applications with similar whole-body access needs.

Plan view of a robot cell showing access gate and locations of equipment.
Plan view of a robot cell with whole-body access [2]

The basis for this comes from [1, 5.2.2]. There are a few statements that contribute to creating this requirement:

After a stop command has been initiated by a safeguard, the stop condition shall be maintained until safe conditions for restarting exist.

The re-establishment of the safety function by resetting of the safeguard cancels the stop command. If indicated by the risk assessment, this cancellation of the stop command shall be confirmed by a manual, separate and deliberate action (manual reset).

The manual reset function shall be provided through a separate and manually operated device within the SRP/CS.

The manual reset function shall be by deliberate action.

The reset actuator shall be situated outside the danger zone and in a safe position from which there is good visibility for checking that no person is within the danger zone.

[1, 5.2.2]

ISO 13849-1 includes additional requirements for the reset function. Since ISO 13849-1 is a type-B1 standard, it is possible for a machine-specific type-C standard to set different requirements

Reset function description

The complete manual reset function description is as follows:

5.2.2 Manual reset function

The following applies in addition to the requirements of Table 8.

After a stop command has been initiated by a safeguard, the stop condition shall be maintained until safe conditions for restarting exist.

The re-establishment of the safety function by resetting of the safeguard cancels the stop command. If indicated by the risk assessment, this cancellation of the stop command shall be confirmed by a manual, separate and deliberate action (manual reset).

The manual reset function shall

— be provided through a separate and manually operated device within the SRP/CS,

— only be achieved if all safety functions and safeguards are operative,

— not initiate motion or a hazardous situation by itself,

— be by deliberate action,

— enable the control system for accepting a separate start command,

— only be accepted by disengaging the actuator from its energized (on) position.

The performance level of safety-related parts providing the manual reset function shall be selected so that the inclusion of the manual reset function does not diminish the safety required of the relevant safety function.

The reset actuator shall be situated outside the danger zone and in a safe position from which there is good visibility for checking that no person is within the danger zone.

Where the visibility of the danger zone is not complete, a special reset procedure is required.

NOTE One solution is the use of a second reset actuator. The reset function is initiated within the danger zone by the first actuator in combination with a second reset actuator located outside the danger zone (near the safeguard). This reset procedure needs to be realized within a limited time before the control system accepts a separate start command.

[1, 5.2.2]

Unpacking the requirement

Table 8 reference

The first sentence in the requirement refers to Table 8, which points to IEC 60204–1:2005, 9.2.5.3, 9.2.5.4 [3] for the electrical requirements for the reset function.

In [3, 9.2.5.3], Stop, the requirement for resetting a stopping function is that “The reset of the stop function shall not initiate any hazardous situation.” This requirement parallels the third bullet in the requirement.

[3, 9.2.5.4] provides the requirements for emergency stop equipment. [3, 9.2.5.4.1] includes this requirement:

Once active operation of an emergency stop (see 10.7) or emergency switching off (see 10.8) actuator has ceased following a command, the effect of this command shall be sustained until it is reset. This reset shall be possible only by a manual action at that location where the command has been initiated. The reset of the command shall not restart the machinery but only permit restarting.

It shall not be possible to restart the machinery until all emergency stop commands have been reset. It shall not be possible to reenergize the machinery until all emergency switching off commands have been reset.

[3, 9.2.5.4.1]

Here again we see that restarting the machine cannot occur until two pre-conditions are met:

  1. All of the emergency stop commands have been reset – in practical terms, this means ensuring that all of the emergency stop buttons have been pulled out to their “run” position, and
  2. The emergency stop function is manually reset.

These requirements in [3] have been changed in the current edition of IEC 60204-1 [4], however, the requirement relating to the resetting of emergency stop functions remains unchanged in clause [4, 9.2.3.4.1].

Maintained condition

The second paragraph in the requirements reads,

After a stop command has been initiated by a safeguard, the stop condition shall be maintained until
safe conditions for restarting exist.

This clause sets up the requirement for manual reset of a safety function to be executed in a safety PLC or other safety rated controller, including simple safety relays.

Pressing the reset button starts a process in the controller that checks that all the safety-related pre-conditions have been met, i.e., are the inputs to the functions all at logically TRUE? If this is the case, the safety function can be reset, if not, then the safety function will remain in the STOP condition. This same requirement is seen in [4, 9.2.3.4.1]”

Once active operation of an emergency stop (see 10.7) or emergency switching off (see 10.8)
actuator has ceased following a stop or switching off command, the effect of this command
shall be sustained until it is reset
. This reset shall be possible only by a manual action at the device where the command has been initiated. The reset of the command shall not restart the
machinery but only permit restarting.

It shall not be possible to restart the machinery until all emergency stop commands have been
reset. It shall not be possible to reenergize the machinery until all emergency switching off
commands have been reset.

[4, 9.2.3.4.1]

Re-establishment of the safety function

“Re-establishing the safety function” is resetting the safety function into the normal operating condition. Resetting the safety function does not re-start the machine, but permits re-starting. Here are the requirements:

The re-establishment of the safety function by resetting of the safeguard cancels the stop command. If indicated by the risk assessment, this cancellation of the stop command shall be confirmed by a manual, separate and deliberate action (manual reset).

The manual reset function shall

— be provided through a separate and manually operated device within the SRP/CS,

— only be achieved if all safety functions and safeguards are operative,

— not initiate motion or a hazardous situation by itself,

— be by deliberate action,

— enable the control system for accepting a separate start command,

— only be accepted by disengaging the actuator from its energized (on) position.

Cancellation of the stop command is fairly obvious, of course, but the requirement for the manual reset is based on the risk assessment. This is where an understanding of the hazards and the exposure of the person to the hazards is needed in order to determine whether or not the reset function is a safety function.

An example will help to clarify this requirement. Consider a machine with a rotary table fitted with four fixtures. Each fixture has pockets for the parts needed in the assembly process. An operator loads parts to the fixture exposed at the work station, while the other three fixtures are inside the safeguarded space where the machine can work on the assembly process. A light curtain is fitted across the front of the workstation so that the operator must break the sensing field to place parts in the nest.

The safety function in this case is a safety-related stop function [1, 5.2.1]. When the operator’s hands are inside the safeguarded space, a STOP command is generated by the light curtain and the rest of the safety-related parts of the control system, preventing the table from rotating. Once the operator is done loading parts and is ready for the machine to start the next cycle, they press a cycle start button to initiate the table rotation and the next machine cycle.

What is not mentioned in the description of the safety function is that the safety-related stop function must be reset somehow after the sensing field has been broken. This can be done in a number of ways, with the most common being an automatic reset of the stop function. As long as the risk is reasonably low, this might be acceptable. This is not a manual reset function and is therefore outside this discussion, however, it is worth knowing that automatic reset is possible under some circumstances.

If the risk is greater, then automatic reset should not be used, but rather a manual rest function.

Another option is to use a start/restart function [1, 5.2.3]. This is the case where “presence-sensing device initiation” (PSDI) [5, 6.3.2.5.3] or a “control guard” is used [5, 6.3.3.2.5]. In PSDI mode, the act of clearing the sensing field of the light curtain immediately starts the machine cycle. PSDI requires that a timer with a delay-off condition not longer than a machine cycle is used to monitor the time between breaks of the sensing field. If the timer is not reset within one cycle, then a separate cycle-start button must be pressed to start the machine cycle and re-initialize the PSDI mode. Control guards work in a similar way, with the cycle start signal derived from the closing of the interlock on the guard.

Performance Level requirement

Since the manual reset function can be a safety function, two requirements arise:

  1. The manual reset function must be identified in the risk assessment relative to the safety-related stop function, i.e., if you identify the need for an interlock on a whole-body access gate into a work cell, then you must also identify the need for a related manual reset function.
  2. The required Performance Level (PLr) must be identified based on the risk.

The performance level of safety-related parts providing the manual reset function shall be selected so that the inclusion of the manual reset function does not diminish the safety required of the relevant safety function.

[1, 5.2.2]

Since the manual reset function cannot reduce the Performance Level (PL) of the related safety function, you will need to determine what the minimum PL for the manual reset function can be. For example, if the risk assessment identifies the need for an interlocked guard with a PLr = d, then the PL of the manual reset function cannot be less than PL=d according to [1, 6.3] and [1, Table 11].

Location of the reset device

For a safety-related reset function, it has been established that a separate reset device connected to the SRP/CS, but the location is not yet clearly established. The last two paragraphs of the requirement and the following note help clarify this part of the requirement.

The manual reset function shall

— be provided through a separate and manually operated device within the SRP/CS,

The reset actuator shall be situated outside the danger zone and in a safe position from which there is good visibility for checking that no person is within the danger zone.

Where the visibility of the danger zone is not complete, a special reset procedure is required.

NOTE One solution is the use of a second reset actuator. The reset function is initiated within the danger zone by the first actuator in combination with a second reset actuator located outside the danger zone (near the safeguard). This reset procedure needs to be realized within a limited time before the control system accepts a separate start command.

[1, 5.2.2]

When the operator cannot see the complete interior of the work cell from the proposed placement of the reset actuator, there are at least two possibilities you can consider to correct the problem:

  1. move the reset actuator to a location where the operator can see the complete area, or as suggested by the note,
  2. add a second reset actuator inside the cell that the worker must press on the way out.

Pressing the first reset starts a countdown timer that enables the second reset button, located on the outside of the cell. A worker would have to press the first button, exit the cell and close the gate, and then press the second actuator to reset the safety function, all before the countdown ends.

Other concepts could be used under the “special reset procedure” umbrella, so do not feel completely constrained by the text of the note. Remember that in ISO standards, the text of a note is informative, so there are no requirements in notes, only guidance.


References

[1] Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design, ISO 13849-1. International Organization for Standardization (ISO), Geneva. 2015.

[2] D. Lukac, “Profibus Interface Based Connection and Actuation of the Servo-Electric and Pneumatic 2-Finger Parallel Gripper by Using of the Quick Release Gripper-Change-System Realized for the Fanuc Robot”, Electronics, 2010. Available: https://www.researchgate.net/publication/50392740_Profibus_Interface_Based_Connection_and_Actuation_of_the_Servo-Electric_and_Pneumatic_2-Finger_Parallel_Gripper_by_Using_of_the_Quick_Release_Gripper-Change-System_Realized_for_the_Fanuc_Robot. [Accessed 19 May 2021].

[3] Safety of machinery – Electrical equipment of machines – Part 1: General requirements, IEC 60204-1. International Electrotechnical Commission (IEC), Geneva. 2005.

[4] Safety of machinery – Electrical equipment of machines – Part 1: General requirements, IEC 60204-1. International Electrotechnical Commission (IEC), Geneva. 2018.

[5] Safety of machinery — General principles for design — Risk assessment and risk reduction, ISO 12100. International Organization for Standardization (ISO), Geneva. 2010.

Digiprove sealCopyright secured by Digiprove © 2021
Acknowledgements: ISO, IEC, Duško Lukač
Some Rights Reserved

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.