Machinery Safety 101

Manual reset using an HMI

This entry is part 2 of 3 in the series Under­stand­ing Safety Functions
An ABB HMI showing some graphical objects representing control functions and data.

Ques­tion: Can a safety-related stop func­tion, for example, be reset via a graph­ic­al object rep­res­ent­ing a reset but­ton on an HMI?

The short answer: No, with an excep­tion. Read on if you’d like to know more.

If you’re inter­ested in know­ing more about the manu­al reset func­tion, see our pre­vi­ous post on the manu­al reset function.

Why not?

Why can­’t manu­al reset actu­at­ors appear on HMI screens? There are a few reas­ons for this. 

First, ISO 13849 – 1 [1] requires that manu­al reset actu­at­ors be sep­ar­ate con­trol devices con­nec­ted to the SRP/CS. The point could be made that an HMI is a sep­ar­ate device, how­ever, as of this writ­ing, there are no HMIs that are designed to con­nect to a Safety PLC.

Second, [1] requires that com­pon­ents used for the manu­al reset func­tion not reduce the Per­form­ance Level (PL) of the safety func­tion. Since there are no safety-rated HMIs, the only struc­tur­al cat­egory that could be assigned to an HMI-PLC com­bin­a­tion is Cat­egory B, a single-chan­nel archi­tec­ture using com­pon­ents rated for the cir­cuit con­di­tions. This struc­tur­al cat­egory lim­it­a­tion means that the highest PL that could be assigned would be PL=b. Emer­gency stop func­tions must provide at least PL=c per­form­ance accord­ing to ISO 13850, so an HMI-based reset can­not be used with emer­gency stop func­tions. In addi­tion, most indus­tri­al machines will require at least PL=c, d or e for their safety-related inter­locks, so an HMI-based manu­al reset can­not be used to reset an inter­lock stop function.

Finally, the large con­trols com­pon­ent man­u­fac­tur­ers, like Rock­well Allen-Brad­ley, Omron, Pilz, Schmersal, Siemens, Tele­meca­nique, etc., do not recom­mend the prac­tice for the reas­ons discussed.

PS – I men­tioned in the video that rising edge sig­nals are not used for the Manu­al Reset Func­tion – in truth, rising edges are not used for safety-related sig­nals. Rising edges can occur more read­ily due to elec­tric­al faults while fall­ing edges are much less likely. For example, a fall­ing edge gen­er­ated by an elec­tromech­an­ic­al push but­ton requires that the but­ton is pushed and released, which helps avoid inten­tion­al defeat through a “tie-down” of the button.


[1] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design, ISO 13849 – 1. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

[2] Safety of machinery — Emer­gency stop func­tion — Prin­ciples for design, ISO 13850. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

[3] Real­iz­ing Reset Func­tion in Safety Related Parts of Con­trol Sys­tems, 1st ed. Hoof­d­dorp, Neth­er­lands: OMRON Europe B.V., 2015.

Series Nav­ig­a­tionUnder­stand­ing safety func­tions: Manu­al Reset

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.