Machinery Safety 101

Understanding Safety Functions: the Safety-related stop function

This entry is part of 3 in the series Under­stand­ing Safety Functions

The most used safety func­tion on machinery is the safety-related stop func­tion. The require­ments dis­cussed in this post are not gen­er­ally applic­able to pro­cess-related stop func­tions unless the pro­cess and safety stop func­tions share the same con­trol sys­tem hard­ware and software. 

The pur­pose of a stop func­tion is pretty obvi­ous: When activ­ated, the stop func­tion stops whatever is oper­at­ing. After that, things start to get a bit muddy. So what is a safety-related stop func­tion, and what makes it dif­fer­ent from a pro­cess-related stop? By the end of this post, you’ll under­stand this clearly.

Process-related stop function

Any con­trol func­tion that can bring a pro­cess to a stop is a pro­cess-related stop func­tion. It can be executed in hard­ware or soft­ware, without any spe­cial requirements. 

An example from daily life is the stop func­tion that oper­ates in your car’s engine con­trol­ler when you press the engine start/stop but­ton. When the engine is already run­ning, press­ing the start/stop but­ton will

  • turn off the igni­tion for gas­ol­ine/­pet­rol-fuelled engines, or 
  • it cuts off the fuel sup­ply to a dies­el engine, or
  • if your car is fully elec­tric, it shuts down the motor drives. 

There is a safety func­tion that oper­ates here too – if the car is in gear or rolling, the engine con­trol­ler will require repeated presses of the but­ton before shut­ting down power, put­ting warn­ing mes­sages on the driver dis­play to con­firm the shut­down. The stop­ping func­tion is not safety-related because it can­not be activ­ated immediately.

The “cycle stop” or “top-stop” but­ton on a mech­an­ic­al power press is anoth­er good example. When the press is cyc­ling con­tinu­ously, press­ing the cycle stop but­ton will com­plete the cur­rent stroke and stop at the top-dead-centre pos­i­tion. Oth­er ways can be used to stop the press safely should it fail to stop.

Pro­cess-related stop func­tions do not need any spe­cial hard­ware or soft­ware. Simple hard­ware or a stand­ard PLC can be used.

Safety related stop function

Safety-related stop func­tions appear in a vari­ety of forms, with the emer­gency stop func­tion being one of the most com­mon. Guard inter­lock­ing func­tions are anoth­er type of safety-related stop func­tion. Let’s look at the require­ment from ISO 13849 – 1 [1].

5.2.1 Safety-related stop function

The fol­low­ing applies in addi­tion to the require­ments of Table 8.

A safety-related stop func­tion (e.g. ini­ti­ated by a safe­guard) shall, as soon as neces­sary after actu­ation, put the machine in a safe state. Such a stop shall have pri­or­ity over a stop for oper­a­tion­al reasons.

When a group of machines are work­ing togeth­er in a coördin­ated man­ner, pro­vi­sion shall be made for sig­nalling the super­vis­ory con­trol and/or the oth­er machines that such a stop con­di­tion exists.

NOTE A safety-related stop func­tion can cause oper­a­tion­al prob­lems and a dif­fi­cult restart, e.g. in an arc weld­ing applic­a­tion. To reduce the tempta­tion to defeat this stop func­tion, it can be pre­ceded with a stop for oper­a­tion­al reas­ons to final­ize the actu­al oper­a­tion and pre­pare for an easy and quick restart from the stop pos­i­tion (e.g. without any dam­age of the pro­duc­tion). One solu­tion is the use of inter­lock­ing device with guard lock­ing where the guard lock­ing is released when the cycle has reached a defined pos­i­tion where the easy restart is possible.

[1, 5.2.1]

Unpacking the requirement

Table 8 is shown below. On the first line, you’ll notice that the safety-related stop func­tion is also covered in IEC 60204 – 1 [3], ISO 14119 [4] and ISO 13855 [5].

Speed and priority

A safety-related stop func­tion (e.g. ini­ti­ated by a safe­guard) shall, as soon as neces­sary after actu­ation, put the machine in a safe state. Such a stop shall have pri­or­ity over a stop for oper­a­tion­al reasons.

The second para­graph, above, opens with a require­ment for oper­a­tion in a short time. It also estab­lishes the pri­or­ity level of the safety-related stop above any pro­cess stop func­tion. The emer­gency stop func­tion is unique in that it has pri­or­ity over all oth­er con­trol func­tions. More about that in a moment.

Achieving a safe state

The second para­graph also requires that the machine must be placed into a safe state.

When a group of machines are work­ing togeth­er in a coördin­ated man­ner, pro­vi­sion shall be made for sig­nalling the super­vis­ory con­trol and/or the oth­er machines that such a stop con­di­tion exists.

Integration of multiple machines

The third para­graph speaks to the integ­ra­tion of machines into a lar­ger sys­tem, like a pro­duc­tion line. This para­graph does not require that an emer­gency stop on one machine stop all oth­er machines in the line, but only provides the cap­ab­il­ity to sig­nal a super­vis­ory sys­tem about the stop. 

The integ­ra­tion of the emer­gency stop func­tions between machines must be determ­ined by the risk assess­ment of the integ­rated line. The need to inter­con­nect the emer­gency stop func­tions must be care­fully con­sidered. Prob­lems can be cre­ated in restart­ing the machines if bi-dir­ec­tion­al emer­gency stop integ­ra­tion is done, since a race con­di­tion can be cre­ated, pre­vent­ing the reset of the emer­gency stop func­tions on one or both machines.

Restarting

NOTE A safety-related stop func­tion can cause oper­a­tion­al prob­lems and a dif­fi­cult restart, e.g. in an arc weld­ing applic­a­tion. To reduce the tempta­tion to defeat this stop func­tion, it can be pre­ceded with a stop for oper­a­tion­al reas­ons to final­ize the actu­al oper­a­tion and pre­pare for an easy and quick restart from the stop pos­i­tion (e.g. without any dam­age of the pro­duc­tion). One solu­tion is the use of inter­lock­ing device with guard lock­ing where the guard lock­ing is released when the cycle has reached a defined pos­i­tion where the easy restart is possible.

The NOTE in [1, 5.2.1] does not include require­ments, because notes in stand­ards are inform­at­ive, not norm­at­ive. Thus, you won’t see the word “shall” used in a Note. If you want to learn more about read­ing stand­ards, check out the course I’m teach­ing.

The NOTE dis­cusses dif­fi­cult restart con­di­tions that can occur from a safety-related stop. In the case dis­cussed, a robot­ic weld­ing sys­tem can end up stuck to the work if the inter­locked guard is opened while the weld­ing is in pro­gress. Sim­il­ar prob­lems can occur in oth­er con­tinu­ous flow pro­cesses, like paint­ing or adhes­ive applic­a­tion. Two pos­sible solu­tions are offered,

  1. Integ­rate a fast pro­cess stop to bring the machine into a state where restart­ing will be eas­ily pos­sible, or 
  2. Use a guard lock­ing func­tion to keep the guard­ing closed until the cycle can be grace­fully stopped. Guard lock­ing sys­tems typ­ic­ally use a “request to enter” but­ton at the entry point. Press­ing the but­ton ini­ti­ates a cycle stop. When the machine cycle is stopped, the guard lock is released, allow­ing the guard to be opened which also opens the inter­lock. The inter­lock will ensure that the machine can­not be restar­ted until the guard is closed again. Clos­ing the guard or restart­ing the cycle will lock the guard shut again.

Emergency stop function

The emer­gency stop func­tion is com­plex enough that it war­rants a stand­ard of its own, ISO 13850 [6]. Since I can­’t repro­duce that stand­ard here, I’m going to recom­mend that you obtain a copy for your­self, how­ever, I can offer the defin­i­tion and a bit of explanation.

3.1
emer­gency stop (E‑stop)
emer­gency stop function
func­tion which is inten­ded to 
  • avert arising or reduce exist­ing haz­ards to per­sons, dam­age to machinery or to work in pro­gress, and
  • be ini­ti­ated by a single human action
[SOURCE: ISO 12100:2010, 3.40]

Emer­gency stop func­tions are MANUALLY INITIATED, i.e., a but­ton or anoth­er device needs to be activ­ated to ini­ti­ate the stop. At the point where the emer­gency stop is activ­ated the machine is either already broken, or a per­son is already hurt. The next step is often to call 911 or 112 to get emer­gency help.

This is dif­fer­ent from a guard inter­lock or oth­er auto­mat­ic safety stop func­tion which ini­ti­ates the stop BEFORE a per­son can be harmed. Inter­locked guards and pres­ence-sens­ing safe­guard­ing devices like light cur­tains and scan­ners are designed into applic­a­tions where they are loc­ated in a way that provides enough time for the machine to safely stop when a per­son is detec­ted, pre­vent­ing any injur­ies from occurring.

In the same way, an over-speed detec­tion sys­tem will activ­ate auto­mat­ic­ally when an over-speed con­di­tion is detec­ted, invok­ing a safety-related stop func­tion to bring the machine to a safe stand­still condition.

There is much more to know about emer­gency stop func­tions, so if you’re inter­ested, check out my series on the top­ic.


References

[1] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design, ISO 13849 – 1. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

[2] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 2: Val­id­a­tion, ISO 13849 – 2. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2012.

[3] Safety of machinery – Elec­tric­al equip­ment of machines – Part 1: Gen­er­al require­ments, IEC 60204 – 1. Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion (IEC), Geneva. 2018.

[4] Safety of machinery — Inter­lock­ing devices asso­ci­ated with guards — Prin­ciples for design and selec­tion, ISO 14119. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2013.

[5] Safety of machinery? — ?Pos­i­tion­ing of safe­guards with respect to the approach speeds of parts of the human body, ISO 13855. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2010.

[6] Safety of machinery — Emer­gency stop — Prin­ciples for design, ISO 13850. Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion (ISO), Geneva. 2015.

Series Nav­ig­a­tionUnder­stand­ing safety func­tions: Manu­al Reset

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.