Series: Emergency Stop

This series delves into the sim­plic­i­ty and the com­plex­i­ty that is ‘Emer­gency Stop’. This is one of the most com­mon and most fre­quent­ly mis­un­der­stood con­trol func­tions in machine design.

Emergency Stop — What’s so confusing about that?

This entry is part 1 of 13 in the series Emer­gency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decep­tive­ly sim­ple con­cepts that has man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some prod­uct-spe­cif­ic stan­dards

Editor’s Note: Since we first pub­lished this arti­cle on emer­gency-stop in March of 2009, it has become our most pop­u­lar post of all time! We decid­ed it was time for a lit­tle refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN Feb-2018.

The Emer­gency Stop func­tion is one of those decep­tive­ly sim­ple con­cepts that have man­aged to get very com­pli­cat­ed over time. Not every machine needs or can ben­e­fit from an emer­gency stop. In some cas­es, it may lead to an unrea­son­able expec­ta­tion of safe­ty from the user. Some prod­uct-spe­cif­ic stan­dards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trollers are required to pro­vide emer­gency stop func­tion­al­i­ty, and work cells inte­grat­ing robots are also required to have emer­gency stop capa­bil­i­ty.

Defining Emergency Stop

Pho­to 1 — This OLD but­ton is def­i­nite­ly non-com­pli­ant.

Before we look at the emer­gency-stop func­tion itself, we need to under­stand what the word “emer­gency” implies. This may seem obvi­ous but bear with me for a minute. The word “emer­gency” has the root “emer­gent”, mean­ing “in the process of com­ing into being or becom­ing promi­nent” accord­ing to the Oxford Dic­tio­nary of Eng­lish. An emer­gency con­di­tion is, there­fore, some con­di­tion that is aris­ing and becom­ing promi­nent at the moment. This con­di­tion implies that the sit­u­a­tion is not some­thing fore­seen by the machine design­er, and there­fore there are no design fea­tures present to con­trol the con­di­tion.

So what is the Emer­gency Stop func­tion, or E-stop func­tion, and when do you need to have one? Let’s look at a few def­i­n­i­tions tak­en from CSA Z432-14 [2]:

Emer­gency sit­u­a­tion
an imme­di­ate­ly haz­ardous sit­u­a­tion that needs to be end­ed or avert­ed quick­ly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is intend­ed to avert harm or to reduce exist­ing haz­ards to per­sons, machin­ery, or work in progress.
Emer­gency stop but­ton
a red mush­room-head­ed but­ton that, when acti­vat­ed, will imme­di­ate­ly start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­men­tary pro­tec­tive mea­sures
Pro­tec­tive mea­sures which are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use, could have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine.

Old spring-return type of e-stop button with a plain red background legend plate.
Pho­to 2 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e-stop is a func­tion that is intend­ed for use in Emer­gency con­di­tions to try to lim­it or avert harm to some­one or some­thing. It isn’t a safe­guard but is con­sid­ered to be a Com­ple­men­tary Pro­tec­tive Mea­sure. Look­ing at emer­gency stop func­tions from the per­spec­tive of the Hier­ar­chy of Con­trols, emer­gency stop func­tions fall into the same lev­el as Per­son­al Pro­tec­tive Equip­ment like safe­ty glass­es, safe­ty boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stan­dards you choose to read, machin­ery may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­po­nents and ele­ments to achieve the emer­gency stop func­tion

If fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­po­nents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency sit­u­a­tions to be avert­ed, the fol­low­ing require­ments apply:

  • the actu­a­tors shall be clear­ly iden­ti­fi­able, clear­ly vis­i­ble and read­i­ly acces­si­ble;
  • the haz­ardous process shall be stopped as quick­ly as pos­si­ble with­out cre­at­ing addi­tion­al haz­ards, but if this is not pos­si­ble or the risk can­not be reduced, it should be ques­tioned whether imple­men­ta­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where nec­es­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

I added the bold text in the pre­vi­ous quo­ta­tion, because that state­ment, “If after a risk assess­ment…” is very impor­tant. Lat­er in [2, 7.15.1.2]:

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment deter­mines that the emer­gency stop func­tion will not con­tribute to risk con­trol.

Note: There could be sit­u­a­tions where an e-stop does not con­tribute to risk con­trol and alter­na­tives could be con­sid­ered in con­junc­tion with a risk assess­ment.

The bold­ing in the text in the pre­ced­ing para­graph was added for empha­sis. I want­ed to be sure that you caught this impor­tant bit of text. Not every machine requires an E-stop func­tion. The func­tion is only required where there is a ben­e­fit to the user unless a prod­uct-spe­cif­ic stan­dard requires it. In some cas­es, prod­uct-spe­cif­ic stan­dards often called “Type C” stan­dards, include spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­i­mum PLr or SILr, based on the opin­ion of the Tech­ni­cal Com­mit­tee respon­si­ble for the stan­dard and their knowl­edge of the par­tic­u­lar type of machin­ery cov­ered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tri­cal design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204–1.

Down­load NFPA stan­dards through ANSI

Pho­to 3 — This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontario’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (O. Reg. 851), you will find that prop­er iden­ti­fi­ca­tion of the emer­gency stop device(s) and loca­tion “with­in easy reach” of the oper­a­tor are the only require­ment. What does “prop­er­ly iden­ti­fied” mean? In Cana­da, the USA and Inter­na­tion­al­ly, a RED oper­a­tor device on a YELLOW back­ground, with or with­out any text on the back­ground, is rec­og­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switch­es or con­trol switch­es. You may also see the IEC sym­bol for emer­gency stop used to iden­ti­fy these devices.

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417–5638 — Sym­bol for “emer­gency stop” ©IEC.

I’ve scat­tered some exam­ples of dif­fer­ent com­pli­ant and non-com­pli­ant e-stop devices through this arti­cle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ing­ly, the Euro­pean Union has tak­en what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machin­ery Direc­tive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machin­ery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing dan­ger to be avert­ed.

Notice the words “…actu­al or impend­ing dan­ger…” This har­monis­es with the def­i­n­i­tion of Com­ple­men­tary Pro­tec­tive Mea­sures, in that they are intend­ed to allow a user to “avert or lim­it harm” from a haz­ard. Clear­ly, the direc­tion from the Euro­pean per­spec­tive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machin­ery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial mea­sures required to deal with the risk to be tak­en,
  • portable hand-held and/or hand-guid­ed machin­ery.

From these two bul­lets it becomes clear that, just as in the Cana­di­an and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is huge­ly impor­tant and often over­looked. If the risks can­not be con­trolled effec­tive­ly with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-stop sys­tem, then it should not be includ­ed in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clear­ly iden­ti­fi­able, clear­ly vis­i­ble and quick­ly acces­si­ble con­trol devices,
  • stop the haz­ardous process as quick­ly as pos­si­ble, with­out cre­at­ing addi­tion­al risks,
  • where nec­es­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sis­tent with the gen­er­al require­ments found in the Cana­di­an and US reg­u­la­tions. [3] goes on to define the func­tion­al­i­ty of the sys­tem in more detail:

Once active oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is specif­i­cal­ly over­rid­den; it must not be pos­si­ble to engage the device with­out trig­ger­ing a stop com­mand; it must be pos­si­ble to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tional at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing mea­sures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-stop devices to latch in the acti­vat­ed posi­tion. The last part of that sen­tence is even more impor­tant: “…dis­en­gag­ing the device must not restart the machin­ery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a sec­ond dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-stop but­ton and hav­ing pow­er come back imme­di­ate­ly is not OK. Once that but­ton has been reset, a sec­ond action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol pow­er is need­ed.

Point of Clar­i­fi­ca­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machin­ery does not indi­cate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­is­tics:
    • The device must latch in the acti­vat­ed posi­tion;
    • The device must have a “neu­tral” posi­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset posi­tion must be dis­tinct from the pre­vi­ous two posi­tions, and the device must spring-return to the neu­tral posi­tion.

The sec­ond sen­tence har­mo­nizes with the require­ments of the Cana­di­an and US stan­dards. The last sen­tence har­mo­nizes with the idea of “Com­ple­men­tary Pro­tec­tive Mea­sures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sid­er the loca­tions where you EXPECT an oper­a­tor to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can rea­son­ably expect an oper­a­tor to be under nor­mal cir­cum­stances is a rea­son­able place to put an e-stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not intend­ed for use by chil­dren). The “easy reach” require­ment trans­lates to 500–600 mm either side of the cen­tre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start analy­sis. Iden­ti­fy all the nor­mal start­ing and stop­ping modes that you antic­i­pate on the equip­ment. Con­sid­er all of the dif­fer­ent oper­at­ing modes that you are pro­vid­ing, such as Auto­mat­ic, Man­u­al, Teach, Set­ting, etc. Iden­ti­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most juris­dic­tions today.

As you deter­mine your risk con­trol mea­sures (fol­low­ing the Hier­ar­chy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e-stops fall below safe­guards in the hier­ar­chy, so you must use a safe­guard­ing tech­nique if pos­si­ble, you can’t just default down to an emer­gency stop. IF the e-stop can pro­vide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Final­ly, once you deter­mine the need for an emer­gency stop sys­tem, you need to con­sid­er the system’s func­tion­al­i­ty and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stan­dard for Cana­da and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tri­cal stan­dard for machin­ery, CSA C22.2 #301 [5]. This stan­dard is intend­ed for cer­ti­fi­ca­tion of indus­tri­al machines. My opin­ion is that this stan­dard has some sig­nif­i­cant issues. You can find very sim­i­lar elec­tri­cal require­ments to this in [4] in IEC 60204–1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204–1 applies to the EU mar­ket for indus­tri­al machines and is tech­ni­cal­ly iden­ti­cal to [6].

Down­load NFPA stan­dards through ANSI
Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

Functional Stop Categories

NFPA 79 calls out three basic cat­e­gories of stop func­tions. Note that these cat­e­gories are NOT func­tion­al safe­ty archi­tec­tur­al cat­e­gories, but are cat­e­gories describ­ing stop­ping func­tions. Reli­a­bil­i­ty is not addressed in these sec­tions. Quot­ing from the stan­dard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride relat­ed start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ardous con­di­tions. The three cat­e­gories of stop func­tions shall be as fol­lows:

(1) Cat­e­go­ry 0 is an uncon­trolled stop by imme­di­ate­ly remov­ing pow­er to the machine actu­a­tors.

(2) Cat­e­go­ry 1 is a con­trolled stop with pow­er to the machine actu­a­tors avail­able to achieve the stop then pow­er is removed when the stop is achieved.

(3) Cat­e­go­ry 2 is a con­trolled stop with pow­er left avail­able to the machine actu­a­tors.

This E-Stop Button is correct.
Pho­to 4 — This E-Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­a­tor and the YELLOW back­ground.

A bit lat­er in the stan­dard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­e­go­ry 0, Cat­e­go­ry 1, and/or Cat­e­go­ry 2 stops shall be pro­vid­ed as deter­mined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­e­go­ry 0 and Cat­e­go­ry 1 stops shall be oper­a­tional regard­less of oper­at­ing modes, and Cat­e­go­ry 0 shall take pri­or­i­ty.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tec­tive devices and inter­locks shall be pro­vid­ed. Where applic­a­ble, the stop func­tion shall sig­nal the log­ic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­e­gories are aligned with sim­i­lar terms used with motor dri­ves. You may want to read this arti­cle if your machin­ery uses a motor dri­ve.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Pho­to 5 — Dis­con­nect with E-Stop Colours indi­cates that this dis­con­nect­ing device is intend­ed to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­e­go­ry of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can deter­mine the func­tion­al safe­ty require­ments. In Cana­da, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­di­an machin­ery into har­mo­niza­tion with the Inter­na­tion­al Stan­dards.

Emer­gency stop func­tions are required to pro­vide a min­i­mum of ISO 13849–1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that greater reli­a­bil­i­ty is required, the sys­tem can be designed to meet any high­er reli­a­bil­i­ty require­ment that is suit­able. Essen­tial­ly, the greater the risk reduc­tion required, the high­er the degree of reli­a­bil­i­ty required.

I’ve writ­ten exten­sive­ly about the appli­ca­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tri­cal haz­ard’ warn­ing label imme­di­ate­ly above the dis­con­nect han­dle in Pho­to 5 above is

a) upside down, and

b) using a non-stan­dard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­est­ed, here is the cor­rect ISO elec­tri­cal haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Pho­to 6 — Elec­tric Shock Haz­ard — IEC 60417–5036

You can find these labels at Clar­i­on Safe­ty Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switch­es used for e-stop) CANNOT be used for ener­gy iso­la­tion in an HECP — Haz­ardous Ener­gy Con­trol Pro­ce­dure (which includes Lock­out). Devices for this pur­pose must phys­i­cal­ly sep­a­rate the ener­gy source from the down­stream com­po­nents. See CSA Z460 [10] for more on that sub­ject.

Read our Arti­cle on Using E-Stops in Haz­ardous Ener­gy Con­trol Pro­ce­dures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Pho­to 7 — Pneu­mat­ic E-Stop/Iso­la­tion device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adopt­ed ISO 10218–1:2011, sec­ond edi­tion, 2011-07-01, with Cana­di­an devi­a­tions and ISO 10218–2:2011, first edi­tion, 2011-07-01, with Cana­di­an devi­a­tions). Cana­di­an Nation­al Stan­dard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machin­ery, CSA Stan­dard Z432. 2016. 

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machin­ery, and amend­ing Direc­tive 95/16/EC (recast). Brus­sels: Euro­pean Com­mis­sion, 2006.

[4]  Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery. ANSI/NFPA Stan­dard 79. 2015.

Down­load NFPA stan­dards at ANSI

[5] Indus­tri­al elec­tri­cal machin­ery. CSA Stan­dard C22.2 NO. 301. 2016. 

[6] Safe­ty of machin­ery — Elec­tri­cal Equip­ment of machines — Part 1: Gen­er­al require­ments. IEC Stan­dard 60204–1. 2016.  

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.

[7] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO Stan­dard 13849–1. 2015.

[8] Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion. ISO Stan­dard 13849–2. 2012.

[9] Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems. IEC Stan­dard 62061+AMD1+AMD2. 2015.

[10] Safe­ty of machin­ery—Emer­gency Stop—Principals for design. ISO Stan­dard 13850. 2015.

Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
Down­load ISO Stan­dards

[11] Con­trol of haz­ardous energy—Lockout and oth­er meth­ods. CSA Stan­dard Z460. 2013.

 

 

Checking Emergency Stop Systems

This entry is part 2 of 13 in the series Emer­gency Stop

This short arti­cle dis­cuss­es ways to test emer­gency stop sys­tems on machines.

A while back I wrote about the basic design require­ments for Emer­gency Stop sys­tems. I’ve had sev­er­al peo­ple con­tact me want­i­ng to know about check­ing and test­ing emer­gency stops, so here are my thoughts on this process.

Fig­ure 1 below, excerpt­ed from the 1996 edi­tion of ISO 13850, Safe­ty of machin­ery — Emer­gency stop — Prin­ci­ples for design, shows the emer­gency stop func­tion graph­i­cal­ly. As you can see, the ini­ti­at­ing fac­tor in this func­tion is a per­son becom­ing aware of the need for an emer­gency stop. This is NOT an auto­mat­ic func­tion and is NOT a safe­ty or safe­guard­ing func­tion.

Down­load ISO Stan­dards

ISO 13850 1996 Figure 1 - Emergency Stop Function
ISO 13850 1996 Fig­ure 1 — Emer­gency Stop Func­tion

Down­load ISO Stan­dards

I men­tion this because many peo­ple are con­fused about this point. Emer­gency stop sys­tems are con­sid­ered to be ‘com­pli­men­ta­ry pro­tec­tive mea­sures’, mean­ing that their func­tions com­ple­ment the safe­guard­ing sys­tems, but can­not be con­sid­ered to be safe­guards in and of them­selves. This is sig­nif­i­cant. Safe­guard­ing sys­tems are required to act auto­mat­i­cal­ly to pro­tect an exposed per­son. Think about how an inter­locked gate or a light cur­tain acts to stop haz­ardous motion BEFORE the per­son can reach it. Emer­gency stop is nor­mal­ly used AFTER the per­son is already involved with the haz­ard, and the next step is nor­mal­ly to call 911.

All of that is impor­tant from the per­spec­tive of con­trol reli­a­bil­i­ty. The con­trol reli­a­bil­i­ty require­ments for emer­gency stop sys­tems are often dif­fer­ent from those for the safe­guard­ing sys­tems because they are a back­up sys­tem. Deter­mi­na­tion of the reli­a­bil­i­ty require­ments is based on the risk assess­ment and on an analy­sis of the cir­cum­stances where you, as the design­er, antic­i­pate that emer­gency stop may be help­ful in reduc­ing or avoid­ing injury or machin­ery dam­age. Fre­quent­ly, these sys­tems have low­er con­trol reli­a­bil­i­ty require­ments than do safe­guard­ing sys­tems.

Before you begin any test­ing, under­stand what effects the test­ing will have on the machin­ery. Emer­gency stops can be par­tial­ly test­ed with the machin­ery at rest. Depend­ing on the func­tion of the machin­ery and the dif­fi­cul­ty in recov­er­ing from an emer­gency stop con­di­tion, you may need to adjust your approach to these tests. Start by review­ing the emer­gency stop func­tion­al descrip­tion in the man­u­al. Here’s an exam­ple tak­en from a real machine man­u­al:

Emergency Stop (E-Stop) Button

Emergency Stop Button
Fig­ure 2.1 Emer­gency Stop (E-Stop) But­ton

A red emer­gency stop (E-Stop) but­ton is a safe­ty device which allows the oper­a­tor to stop the machine in an emer­gency. At any time dur­ing oper­a­tion, press the E-Stop but­ton to dis­con­nect actu­a­tor pow­er and stop all con­nect­ed machines in the pro­duc­tion line. Fig­ure 2.1 shows the emer­gency stop but­ton.

There is one E-Stop but­ton on the pneu­mat­ic pan­el.

NOTE: After press­ing the E-Stop but­ton, the entire pro­duc­tion line from spread­er-feed­er to stack­er shuts down. When the E-Stop but­ton is reset, all machines in the pro­duc­tion line will need to be restart­ed.

DANGER: These devices do not dis­con­nect main elec­tri­cal pow­er from the machine. See “Elec­tri­cal Dis­con­nect” on page 21.

As you can see, the gen­er­al func­tion of the but­ton is described, and some warn­ings are giv­en about what does and doesn’t hap­pen when the but­ton is pressed.

Now, if the emer­gency stop sys­tem has been designed prop­er­ly and the machine is oper­at­ing nor­mal­ly, press­ing the emer­gency stop but­ton while the machine is in mid-cycle should result in the machin­ery com­ing to a fast and grace­ful stop. Here is what ISO 13850 has to say about this con­di­tion:

4.1.3 The emer­gency stop func­tion shall be so designed that, after actu­a­tion of the emer­gency stop actu­a­tor, haz­ardous move­ments and oper­a­tions of the machine are stopped in an appro­pri­ate man­ner, with­out cre­at­ing addi­tion­al haz­ards and with­out any fur­ther inter­ven­tion by any per­son, accord­ing to the risk assess­ment.
An “appro­pri­ate man­ner” can include

  • choice of an opti­mal decel­er­a­tion rate,
  • selec­tion of the stop cat­e­go­ry (see 4.1.4), and
  • employ­ment of a pre­de­ter­mined shut­down sequence.

The emer­gency stop func­tion shall be so designed that a deci­sion to use the emer­gency stop device does not require the machine oper­a­tor to con­sid­er the resul­tant effects.

The inten­tion of this func­tion is to bring the machin­ery to a halt as quick­ly as pos­si­ble with­out dam­ag­ing the machine. How­ev­er, if the brak­ing sys­tems fail, e.g. the ser­vo dri­ve fails to decel­er­ate the tool­ing as it should, then drop­ping pow­er and poten­tial­ly dam­ag­ing the machin­ery is accept­able.

In many sys­tems, press­ing the e-stop but­ton or oth­er­wise acti­vat­ing the emer­gency stop sys­tem will result in a fault or an error being dis­played on the machine’s oper­a­tor dis­play. This can be used as an indi­ca­tion that the con­trol sys­tem ‘knows’ that the sys­tem has been acti­vat­ed.

ISO 13850 requires that emer­gency stop sys­tems exhib­it the fol­low­ing key behav­iours:

  • It must over­ride all oth­er con­trol func­tions, and no start func­tions are per­mit­ted (intend­ed, unin­tend­ed or unex­pect­ed) until the emer­gency stop has been reset;
  • Use of the emer­gency stop can­not impair the oper­a­tion of any func­tions of the machine intend­ed for the release of trapped per­sons;
  • It is not per­mit­ted to affect the func­tion of any oth­er safe­ty crit­i­cal sys­tems or devices.

Tests

Once the emer­gency stop device has been acti­vat­ed, con­trol pow­er is nor­mal­ly lost. Press­ing any START func­tion on the con­trol pan­el, except POWER ON or RESET should have no effect. If any aspect of the machine starts, count this as a FAILED test.

If reset­ting the emer­gency stop device results in con­trol pow­er being re-applied, count this as a FAILED test.

Press­ing POWER ON or RESET before the acti­vat­ed emer­gency stop device has been reset (i.e. the e-stop but­ton has been pulled out to the ‘oper­ate’ posi­tion), should have no effect. If you can turn the pow­er back on before you reset the emer­gency stop device, count this as a FAILED test.

Once the emer­gency stop device has been reset, press­ing POWER ON or RESET should result in the con­trol pow­er being restored. This is accept­able. The machine should not restart. If the machine restarts nor­mal oper­a­tion, count this as a FAILED test.

Once con­trol pow­er is back on, you may have a num­ber of faults to clear. When all the faults have been cleared, press­ing the START but­ton should result in the machine restart­ing. This is accept­able behav­iour.

If you break the machine while test­ing the emer­gency stop sys­tem, count this as a FAILED test.

Test all emer­gency stop devices. A wiring error or oth­er prob­lems may not be appar­ent until the emer­gency stop device is test­ed. Push all but­tons, pull all pull cords, acti­vate all emer­gency stop devices. If any fail to cre­ate the emer­gency stop con­di­tion, count this as a FAILED test.

If, hav­ing con­duct­ed all of these tests, no fail­ures have been detect­ed, con­sid­er the sys­tem to have passed basic func­tion­al test­ing. Depend­ing on the com­plex­i­ty of the sys­tem and the crit­i­cal­i­ty of the emer­gency stop func­tion, addi­tion­al test­ing may be required. It may be nec­es­sary to devel­op some func­tion­al tests that are con­duct­ed while var­i­ous EMI sig­nals are present, for exam­ple.

If you have any ques­tions regard­ing test­ing of emer­gency stop devices, please email me!

Down­load ISO Stan­dards

Busting Emergency Stop Myths

This entry is part 3 of 13 in the series Emer­gency Stop

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Bust­ing here on the MS101 blog!

There are a num­ber of myths that have grown up around emer­gency stops over the years. These myths can lead to injury or death, so it’s time for a lit­tle Myth Bust­ing here on the MS101 blog!

What does ‘emergency’ mean?

Con­sid­er for a moment the roots of the word ‘emer­gency’. This word comes from the word ‘emer­gent’, mean­ing a sit­u­a­tion that is devel­op­ing or emerg­ing in the moment. Emer­gency stop sys­tems are intend­ed to help the user deal with poten­tial­ly haz­ardous con­di­tions that are emerg­ing in the moment. These con­di­tions have prob­a­bly arisen because the design­ers of the machin­ery failed to con­sid­er all the fore­see­able uses of the equip­ment, or because some­one has cho­sen to mis­use the equip­ment in a way that was not intend­ed by the design­ers. The key func­tion of an Emer­gency Stop sys­tem is to pro­vide the user with a back­up to the pri­ma­ry safe­guards. These sys­tems are referred to as “Com­ple­men­tary Pro­tec­tive Mea­sures” and are intend­ed to give the user a chance to “avert or lim­it harm” in a haz­ardous sit­u­a­tion. With that in mind, let’s look at three myths I hear about reg­u­lar­ly.

 

Myth #1 – The Emergency Stop Is A Safety Device

Waterwheel and belt. Credit: Harry Matthews & http://www.old-engine.com
A Fitz Water Wheel and Belt Dri­ve, Cred­it: Har­ry Matthews & http://www.old-engine.com

Ear­ly in the Indus­tri­al Rev­o­lu­tion machine builders real­ized that users of their machin­ery need­ed a way to quick­ly stop a machine when some­thing went wrong. At that time, over­head line-shafts were dri­ven by large cen­tral pow­er sources like water­wheels, steam engines or large elec­tric motors. Machin­ery was cou­pled to the cen­tral shafts with pul­leys, clutch­es and belts which trans­mit­ted the pow­er to the machin­ery.

See pic­tures of a line-shaft pow­ered machine shop or click the image below.

Line Shaft in the Mt. Wilson Observatory Machine Shop
Pho­to: Lar­ry Evans & www.oldengine.org

These cen­tral engines pow­ered an entire fac­to­ry, so they were much larg­er than an indi­vid­ual motor sized for a mod­ern machine. In addi­tion, they could not be eas­i­ly stopped, since stop­ping the cen­tral pow­er source would mean stop­ping the entire fac­to­ry – not a wel­come choice. Emer­gency stop devices were born in this envi­ron­ment.

Learn more about Line Shafts at Harry’s Old Engines.

See pho­tos and video of a work­ing line shaft machine shop. 

Due to their ear­ly use as a safe­ty device, some have incor­rect­ly con­sid­ered emer­gency stop sys­tems safe­guard­ing devices. Mod­ern stan­dards make the dif­fer­ence very clear. The eas­i­est way to under­stand the cur­rent mean­ing of the term “EMERGENCY STOP” is to begin by look­ing at the inter­na­tion­al stan­dards pub­lished by IEC1 and ISO2.

emer­gency stop3
emer­gency stop func­tion

func­tion that is intend­ed to

—   avert aris­ing, or reduce exist­ing, haz­ards to per­sons, dam­age to machin­ery or to work in progress,

—   be ini­ti­at­ed by a sin­gle human action

NOTE 1

Haz­ards, for the pur­pos­es of this Inter­na­tion­al Stan­dard, are those which can arise from

—   func­tion­al irreg­u­lar­i­ties (e.g. machin­ery mal­func­tion, unac­cept­able prop­er­ties of the mate­r­i­al processed, human error),

—   nor­mal oper­a­tion.

It is impor­tant to under­stand that an emer­gency stop func­tion is “ini­ti­at­ed by a sin­gle human action”. This means that it is not auto­mat­ic, and there­fore can­not be con­sid­ered to be a risk con­trol mea­sure for oper­a­tors or bystanders. Emer­gency stop may pro­vide the abil­i­ty to avoid or reduce harm, by pro­vid­ing a means to stop the equip­ment once some­thing has already gone wrong. Your next actions will usu­al­ly be to call 911 and admin­is­ter first aid.

Safe­guard­ing sys­tems act auto­mat­i­cal­ly to pre­vent a per­son from becom­ing involved with the haz­ard in the first place. This is a reduc­tion in the prob­a­bil­i­ty of a haz­ardous sit­u­a­tion aris­ing, and may also involve a reduc­tion in the sever­i­ty of injury by con­trol­ling the haz­ard (i.e., slow­ing or stop­ping rotat­ing machin­ery before it can be reached.) This con­sti­tutes a risk con­trol mea­sure and can be shown to reduce the risk of injury to an exposed per­son.

Emer­gency stop is reac­tive; safe­guard­ing sys­tems are proac­tive.

In Cana­da, CSA defines emer­gency stop as a ‘Com­ple­men­tary Pro­tec­tive Mea­sure’ in CSA Z432-046:

6.2.2.1.1
Safe­guards (guards, pro­tec­tive devices) shall be used to pro­tect per­sons from the haz­ards that can­not rea­son­ably be avoid­ed or suf­fi­cient­ly lim­it­ed by inher­ent­ly safe design. Com­ple­men­tary pro­tec­tive mea­sures involv­ing addi­tion­al equip­ment (e.g., emer­gency stop equip­ment) may have to be tak­en.

6.2.3.5.3 Com­ple­men­tary pro­tec­tive mea­sures
Fol­low­ing the risk assess­ment, the mea­sures in this clause either shall be applied to the machine or shall be dealt with in the infor­ma­tion for use.
Pro­tec­tive mea­sures that are nei­ther inher­ent­ly safe design mea­sures, nor safe­guard­ing (imple­men­ta­tion of guards and/or pro­tec­tive devices), nor infor­ma­tion for use may have to be imple­ment­ed as required by the intend­ed use and the rea­son­ably fore­see­able mis­use of the machine. Such mea­sures shall include, but not be lim­it­ed to,

(a) emer­gency stop;
(b) means of res­cue of trapped per­sons; and
© means of ener­gy iso­la­tion and dis­si­pa­tion.

In the USA, three stan­dards apply: ANSI B11,  ANSI B11.19–2003, and NFPA 79:

ANSI B11-2008

3.80 stop: Imme­di­ate or con­trolled ces­sa­tion of machine motion or oth­er haz­ardous sit­u­a­tions. There are many terms used to describe the dif­fer­ent kinds of stops, includ­ing user- or sup­pli­er-spe­cif­ic terms, the oper­a­tion and func­tion of which is deter­mined by the indi­vid­ual design. Def­i­n­i­tions of some of the more com­mon­ly used “stop” ter­mi­nol­o­gy include:

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

7.6 Emergency stop

Elec­tri­cal, pneu­mat­ic and hydraulic emer­gency stops shall con­form to require­ments in the ANSI B11 machine-spe­cif­ic stan­dard or NFPA 79.
Infor­ma­tive Note 1: An emer­gency stop is not a safe­guard­ing device. See also, B11.19.
Infor­ma­tive Note 2: For addi­tion­al infor­ma­tion, see ISO 13850 and IEC 60204–1.

ANSI B11.19–2003

12.9 Stop and emergency stop devices

Stop and emer­gency stop devices are not safe­guard­ing devices. They are com­ple­men­tary to the guards, safe­guard­ing device, aware­ness bar­ri­ers, sig­nals and signs, safe­guard­ing meth­ods and safe­guard­ing pro­ce­dures in claus­es 7 through 11.

Stop and emer­gency stop devices shall meet the require­ments of ANSI / NFPA 79.

E12.9

Emer­gency stop devices include but are not lim­it­ed to, but­tons, rope-pulls, and cable-pulls.

A safe­guard­ing device detects or pre­vents inad­ver­tent access to a haz­ard, typ­i­cal­ly with­out overt action by the indi­vid­ual or oth­ers. Since an indi­vid­ual must actu­ate an emer­gency stop device to issue the stop com­mand, usu­al­ly in reac­tion to an event or haz­ardous sit­u­a­tion, it nei­ther detects nor pre­vents expo­sure to the haz­ard.

If an emer­gency stop device is to be inter­faced into the con­trol sys­tem, it should not reduce the lev­el of per­for­mance of the safe­ty func­tion (see sec­tion 6.1 and Annex C).

NFPA 79 deals with the elec­tri­cal func­tions of the emer­gency stop func­tion which is not direct­ly rel­e­vant to this arti­cle, so that is why I haven’t quot­ed direct­ly from that doc­u­ment here.

As you can clear­ly see, the essen­tial def­i­n­i­tions of these devices in the US and Cana­da match very close­ly, although the US does not specif­i­cal­ly use the term ‘com­ple­men­tary pro­tec­tive mea­sures’.

Myth #2 – Cycle Stop And Emergency Stop Are Equivalent

Emer­gency stop sys­tems act pri­mar­i­ly by remov­ing pow­er from the prime movers in a machine, ensur­ing that pow­er is removed and the equip­ment brought to a stand­still as quick­ly as pos­si­ble, regard­less of the por­tion of the oper­at­ing cycle that the machine is in. After an emer­gency stop, the machine is inop­er­a­ble until the emer­gency stop sys­tem is reset. In some cas­es, emer­gency stop­ping the machine may dam­age the equip­ment due to the forces involved in halt­ing the process quick­ly.

Cycle stop is a con­trol sys­tem com­mand func­tion that is used to bring the machine cycle to a grace­ful stop at the end of the cur­rent cycle. The machine is still ful­ly oper­a­ble and may still be in auto­mat­ic mode at the com­ple­tion of this stop.

Again, refer­ring to ANSI B11-2008:

3.80.1 con­trolled stop: The stop­ping of machine motion while retain­ing pow­er to the machine actu­a­tors dur­ing the stop­ping process. Also referred to as Cat­e­go­ry 1 or 2 stop (see also NFPA 79: 2007, 9.2.2);

3.80.2 emer­gency stop: The stop­ping of a machine tool, man­u­al­ly ini­ti­at­ed, for emer­gency pur­pos­es;

Myth #3 – Emergency Stop Systems Can Be Used For Energy Isolation

Disconnect Switch with Lock and TagFif­teen to twen­ty years ago it was not uncom­mon to see emer­gency stop but­tons fit­ted with lock­ing devices.  The lock­ing device allowed a per­son to pre­vent the reset­ting of the emer­gency stop device. This was done as part of a “lock­out pro­ce­dure”. Lock­out is one aspect of haz­ardous ener­gy con­trol pro­ce­dures (HECP).  HECPs rec­og­nize that live work needs to be done from time to time, and that nor­mal safe­guards may be bypassed or dis­con­nect­ed tem­porar­i­ly, to allow diag­nos­tics and test­ing to be car­ried out. This process is detailed in two cur­rent stan­dards, CSA Z460 and ANSI Z244.1. Note that these lock­ing devices are still avail­able for sale, and can be used as part of an HECP to pre­vent the emer­gency stop sys­tem or oth­er con­trols from being reset until the machine is ready for test­ing. They can­not be used to iso­late an ener­gy source.

No cur­rent stan­dard allows for the use of con­trol devices such as push but­tons or selec­tor switch­es to be used as ener­gy iso­la­tion devices.

CSA Z460-05 specif­i­cal­ly pro­hibits this use in their def­i­n­i­tion of ‘ener­gy iso­la­tion devices’:

Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).4

Sim­i­lar require­ments are found in ANSI Z244.15 and in ISO 138503.

Myth #4 — All Machines are Required to have an Emergency Stop

Some machine design­ers believe that all machines are required to have an emer­gency stop. This is sim­ply not true. A read­er point­ed out to me that CSA Z432-04, clause 7.17.1.2, does make this require­ment. To my knowl­edge this is the only gen­er­al lev­el (i.e., not machine spe­cif­ic) stan­dard that makes this require­ment. I stand cor­rect­ed! Hav­ing said that, the rest of my com­ments on this top­ic still stand. Clause 7.17.1.2 lim­its the appli­ca­tion of this require­ment:

7.17.1.2

Each oper­a­tor con­trol sta­tion, includ­ing pen­dants, capa­ble of ini­ti­at­ing machine motion shall have a man­u­al­ly ini­ti­at­ed emer­gency stop device.

Emer­gency stop sys­tems may be use­ful where they can pro­vide a back-up to oth­er safe­guard­ing sys­tems. To under­stand where to use an emer­gency stop, a start-stop analy­sis must be car­ried out as part of the design process. This analy­sis will help the design­er devel­op a clear under­stand­ing of the nor­mal start and stop con­di­tions for the machine. The analy­sis also needs to include fail­ure modes for all of the stop func­tions. It is here that the emer­gency stop can be help­ful. If remov­ing pow­er will cause the haz­ard to cease in a short time, or if the haz­ard can be quick­ly con­tained in some way, then emer­gency stop is a valid choice. If the haz­ard will remain for a con­sid­er­able time fol­low­ing removal of pow­er, then emer­gency stop will have no effect and is use­less for avoid­ing or lim­it­ing harm.

For exam­ple, con­sid­er an oven. If the burn­er stop con­trol failed, and assum­ing that the only haz­ard we are con­cerned with is the hot sur­faces inside the oven, then using an emer­gency stop to turn the burn­ers off only results in the start of the nat­ur­al cool­ing cycle of the oven. In some cas­es that could take hours or days, so the emer­gency stop has no val­ue. It might be use­ful for con­trol­ling oth­er haz­ards, such as fire, that might be relat­ed to the same fail­ure. With­out a full analy­sis of the fail­ure modes of the con­trol sys­tem, a sound deci­sion can­not be made.

Sim­ple machines like drill press­es and table saws are sel­dom fit­ted with emer­gency stop sys­tems. These machines, which can be very dan­ger­ous, could def­i­nite­ly ben­e­fit from hav­ing an emer­gency stop. They are some­times fit­ted with a dis­con­nect­ing device with a red and yel­low han­dle that can be used for ‘emer­gency switch­ing off’. This dif­fers from emer­gency stop because the machine, and the haz­ard, will typ­i­cal­ly re-start imme­di­ate­ly when the emer­gency switch­ing off device is turned back on. This is not per­mit­ted with emer­gency stop, where reset­ting the emer­gency stop device only per­mits the restart­ing of the machine through oth­er con­trols. Reset of the emer­gency stop device is not per­mit­ted to reap­ply pow­er to the machine on its own.

These require­ments are detailed in ISO 138503, CSA Z4326 and oth­er stan­dards.

Design Considerations

Emer­gency Stop is a con­trol that is often designed in with lit­tle thought and used for a vari­ety of things that it was nev­er intend­ed to be used to accom­plish. The three myths dis­cussed in this arti­cle are the tip of the ice­berg.

Con­sid­er these ques­tions when think­ing about the design and use of emer­gency stop sys­tems:

  1. Have all the intend­ed uses and fore­see­able mis­us­es of the equip­ment been con­sid­ered?
  2. What do I expect the emer­gency stop sys­tem to do for the user of the machine? (The answer to this should be in the risk assess­ment.)
  3. How much risk reduc­tion am I expect­ing to achieve with the emer­gency stop?
  4. How reli­able does the emer­gency stop sys­tem need to be?
  5. Am I expect­ing the emer­gency stop to be used for oth­er pur­pos­es, like ‘Pow­er Off’, ener­gy iso­la­tion, or reg­u­lar stop­ping of the machine? (The answer to this should be ‘NO’.)

Tak­ing the time to assess the design require­ments before design­ing the sys­tem can help ensure that the machine con­trols are designed to pro­vide the func­tion­al­i­ty that the user needs, and the risk reduc­tion that is required. The answers lie in the five ques­tions above.

Have any of these myths affect­ed you?

Got any more myths about e-stops you’d like to share?

I real­ly appre­ci­ate hear­ing from my read­ers! Leave a com­ment or email it to us and we’ll con­sid­er adding it to this arti­cle, with cred­it of course!

References

5% Dis­count on All Stan­dards with code: CC2011

  1. IEC – Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion. Down­load IEC stan­dards, Inter­na­tion­al Elec­trotech­ni­cal Com­mis­sion stan­dards.
  2. ISO – Inter­na­tion­al Orga­ni­za­tion for Stan­dard­iza­tion Down­load ISO Stan­dards
  3. Safe­ty of machin­ery — Emer­gency stop — Prin­ci­ples for design, ISO 13850, 2006, ISO, Gene­va, Switzer­land.
  4. Con­trol of Haz­ardous Ener­gy ­– Lock­out and Oth­er Meth­ods, CSA Z460, 2005, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
    Buy CSA Stan­dards online at CSA.ca
  5. Safe­guard­ing of Machin­ery, CSA Z432-04, Cana­di­an Stan­dards Asso­ci­a­tion, Toron­to, Cana­da.
  6. Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods, ANSI/ASSE Z244.1, 2003, Amer­i­can Nation­al Stan­dards Insti­tute / Amer­i­can Soci­ety of Safe­ty Engi­neers, Des Plaines, IL, USA.
    Down­load ANSI stan­dards
  7. Amer­i­can Nation­al Stan­dard for Machine Tools – Per­for­mance Cri­te­ria for Safe­guard­ing, ANSI B11.19–2003, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  8. Gen­er­al Safe­ty Require­ments Com­mon to ANSI B11 Machines, ANSI B11-2008, Amer­i­can Nation­al Stan­dards Insti­tute, Des Plaines, IL, USA.
  9. Elec­tri­cal Stan­dard for Indus­tri­al Machin­ery, NFPA 79–2007, NFPA, 1 Bat­tery­march Park, Quin­cy, MA 02169–7471, USA.
    Buy NFPA Stan­dards online.

5% Dis­count on All Stan­dards with code: CC2011

Digiprove sealCopy­right secured by Digiprove © 2011–2013
Acknowl­edge­ments: See cita­tions in the arti­cle.
Some Rights Reserved