Emergency Stop – What’s so confusing about that?

This entry is part 1 of 14 in the series Emer­gency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decept­ively simple con­cepts that has man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-spe­cif­ic stand­ards

Editor’s Note: Since we first pub­lished this art­icle on emer­gency-stop in March of 2009, it has become our most pop­u­lar post of all time! We decided it was time for a little refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN Feb-2018.

The Emer­gency Stop func­tion is one of those decept­ively simple con­cepts that have man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user. Some product-spe­cif­ic stand­ards man­date the require­ment for an emer­gency stop, such as CSA Z434-14 [1], where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity, and work cells integ­rat­ing robots are also required to have emer­gency stop cap­ab­il­ity.

Defining Emergency Stop

Photo 1 – This OLD but­ton is def­in­itely non-com­pli­ant.

Before we look at the emer­gency-stop func­tion itself, we need to under­stand what the word “emer­gency” implies. This may seem obvi­ous but bear with me for a minute. The word “emer­gency” has the root “emer­gent”, mean­ing “in the pro­cess of com­ing into being or becom­ing prom­in­ent” accord­ing to the Oxford Dic­tion­ary of Eng­lish. An emer­gency con­di­tion is, there­fore, some con­di­tion that is arising and becom­ing prom­in­ent at the moment. This con­di­tion implies that the situ­ation is not some­thing fore­seen by the machine design­er, and there­fore there are no design fea­tures present to con­trol the con­di­tion.

So what is the Emer­gency Stop func­tion, or E-stop func­tion, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-14 [2]:

Emer­gency situ­ation
an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or dam­age.
Emer­gency stop
a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in pro­gress.
Emer­gency stop but­ton
a red mush­room-headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

One more [2, 6.3.5]:

Com­ple­ment­ary pro­tect­ive meas­ures
Pro­tect­ive meas­ures which are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/or pro­tect­ive devices), nor inform­a­tion for use, could have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine.

Old spring-return type of e-stop button with a plain red background legend plate.
Photo 2 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground and spring-return but­ton.

An e-stop is a func­tion that is inten­ded for use in Emer­gency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard but is con­sidered to be a Com­ple­ment­ary Pro­tect­ive Meas­ure. Look­ing at emer­gency stop func­tions from the per­spect­ive of the Hier­archy of Con­trols, emer­gency stop func­tions fall into the same level as Per­son­al Pro­tect­ive Equip­ment like safety glasses, safety boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depend­ing on the reg­u­la­tions and the stand­ards you choose to read, machinery may not be required to have an Emer­gency Stop. Quot­ing from [2, 6.3.5.2]:

Com­pon­ents and ele­ments to achieve the emer­gency stop func­tion

If fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­pon­ents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency situ­ations to be aver­ted, the fol­low­ing require­ments apply:

  • the actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible and read­ily access­ible;
  • the haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards, but if this is not pos­sible or the risk can­not be reduced, it should be ques­tioned wheth­er imple­ment­a­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where neces­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

I added the bold text in the pre­vi­ous quo­ta­tion, because that state­ment, “If after a risk assess­ment…” is very import­ant. Later in [2, 7.15.1.2]:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk con­trol.

Note: There could be situ­ations where an e-stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assess­ment.

The bold­ing in the text in the pre­ced­ing para­graph was added for emphas­is. I wanted to be sure that you caught this import­ant bit of text. Not every machine requires an E-stop func­tion. The func­tion is only required where there is a bene­fit to the user unless a product-spe­cif­ic stand­ard requires it. In some cases, product-spe­cif­ic stand­ards often called “Type C” stand­ards, include spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­im­um PLr or SILr, based on the opin­ion of the Tech­nic­al Com­mit­tee respons­ible for the stand­ard and their know­ledge of the par­tic­u­lar type of machinery covered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204 – 1.

Down­load NFPA stand­ards through ANSI

Photo 3 – This more mod­ern but­ton is non-com­pli­ant due to the RED back­ground.

If you read Ontario’s Indus­tri­al Estab­lish­ments Reg­u­la­tion (O. Reg. 851), you will find that prop­er iden­ti­fic­a­tion of the emer­gency stop device(s) and loc­a­tion “with­in easy reach” of the oper­at­or are the only require­ment. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Inter­na­tion­ally, a RED oper­at­or device on a YELLOW back­ground, with or without any text on the back­ground, is recog­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. You may also see the IEC sym­bol for emer­gency stop used to identi­fy these devices.

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417 – 5638 – Sym­bol for “emer­gency stop” ©IEC.

I’ve scattered some examples of dif­fer­ent com­pli­ant and non-com­pli­ant e-stop devices through this art­icle.

The EU Machinery Directive, 2006/42/EC, and Emergency Stop

Inter­est­ingly, the European Uni­on has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quot­ing from the Machinery Dir­ect­ive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emer­gency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Com­ple­ment­ary Pro­tect­ive Meas­ures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-held and/or hand-guided machinery.

From these two bul­lets it becomes clear that, just as in the Cana­dian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-stop sys­tem, then it should not be included in the design.

Car­ry­ing on with [3, 1.2.4.3]:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Cana­dian and US reg­u­la­tions. [3] goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emer­gency stop devices must be a back-up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed.

Point of Cla­ri­fic­a­tion: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­ist­ics:
    • The device must latch in the activ­ated pos­i­tion;
    • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-return to the neut­ral pos­i­tion.

The second sen­tence har­mon­izes with the require­ments of the Cana­dian and US stand­ards. The last sen­tence har­mon­izes with the idea of “Com­ple­ment­ary Pro­tect­ive Meas­ures” as described in [2].

How Many and Where?

Where? “With­in easy reach”. Con­sider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Any­where you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e-stop device. “Easy Reach” I inter­pret as with­in the arm-span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). The “easy reach” require­ment trans­lates to 500 – 600 mm either side of the centre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/start ana­lys­is. Identi­fy all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Con­sider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Auto­mat­ic, Manu­al, Teach, Set­ting, etc. Identi­fy all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hier­archy of Con­trols), look at what risks you might con­trol with an Emer­gency Stop. Remem­ber that e-stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can’t just default down to an emer­gency stop. IF the e-stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stand­ard for Canada and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tric­al stand­ard for machinery, CSA C22.2 #301 [5]. This stand­ard is inten­ded for cer­ti­fic­a­tion of indus­tri­al machines. My opin­ion is that this stand­ard has some sig­ni­fic­ant issues. You can find very sim­il­ar elec­tric­al require­ments to this in [4] in IEC 60204 – 1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines and is tech­nic­ally identic­al to [6].

Down­load NFPA stand­ards through ANSI
Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reli­ab­il­ity is not addressed in these sec­tions. Quot­ing from the stand­ard:

9.2.2 Stop Func­tions

Stop func­tions shall over­ride related start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ard­ous con­di­tions. The three cat­egor­ies of stop func­tions shall be as fol­lows:

(1) Cat­egory 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actu­at­ors.

(2) Cat­egory 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then power is removed when the stop is achieved.

(3) Cat­egory 2 is a con­trolled stop with power left avail­able to the machine actu­at­ors.

This E-Stop Button is correct.
Photo 4 – This E-Stop but­ton is CORRECT. Note the Push-Pull-Twist oper­at­or and the YELLOW back­ground.

A bit later in the stand­ard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Cat­egory 0, Cat­egory 1, and/or Cat­egory 2 stops shall be provided as determ­ined by the risk assess­ment and the func­tion­al require­ments of the machine. Cat­egory 0 and Cat­egory 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Cat­egory 0 shall take pri­or­ity.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tect­ive devices and inter­locks shall be provided. Where applic­able, the stop func­tion shall sig­nal the logic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­egor­ies are aligned with sim­il­ar terms used with motor drives. You may want to read this art­icle if your machinery uses a motor drive.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Photo 5 – Dis­con­nect with E-Stop Col­ours indic­ates that this dis­con­nect­ing device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the func­tion­al safety require­ments. In Canada, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Cana­dian machinery into har­mon­iz­a­tion with the Inter­na­tion­al Stand­ards.

Emer­gency stop func­tions are required to provide a min­im­um of ISO 13849 – 1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that great­er reli­ab­il­ity is required, the sys­tem can be designed to meet any high­er reli­ab­il­ity require­ment that is suit­able. Essen­tially, the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required.

I’ve writ­ten extens­ively about the applic­a­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in Photo 5 above is

a) upside down, and

b) using a non-stand­ard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­ested, here is the cor­rect ISO elec­tric­al haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Photo 6 – Elec­tric Shock Haz­ard – IEC 60417 – 5036

You can find these labels at Clari­on Safety Sys­tems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emer­gency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-stop) CANNOT be used for energy isol­a­tion in an HECP – Haz­ard­ous Energy Con­trol Pro­ced­ure (which includes Lock­out). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 [10] for more on that sub­ject.

Read our Art­icle on Using E-Stops in Haz­ard­ous Energy Con­trol Pro­ced­ures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Photo 7 – Pneu­mat­ic E-Stop/Isol­a­tion device.

References

[1]  Indus­tri­al robots and robot sys­tems (Adop­ted ISO 10218 – 1:2011, second edi­tion, 2011-07-01, with Cana­dian devi­ations and ISO 10218 – 2:2011, first edi­tion, 2011-07-01, with Cana­dian devi­ations). Cana­dian Nation­al Stand­ard CAN/CSA Z434. 2014. 

[2]  Safe­guard­ing of Machinery, CSA Stand­ard Z432. 2016

[3]  DIRECTIVE 2006/42/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machinery, and amend­ing Dir­ect­ive 95/16/EC (recast). Brus­sels: European Com­mis­sion, 2006.

[4]  Elec­tric­al Stand­ard for Indus­tri­al Machinery. ANSI/NFPA Stand­ard 79. 2015.

Down­load NFPA stand­ards at ANSI

[5] Indus­tri­al elec­tric­al machinery. CSA Stand­ard C22.2 NO. 301. 2016. 

[6] Safety of machinery – Elec­tric­al Equip­ment of machines – Part 1: Gen­er­al require­ments. IEC Stand­ard 60204 – 1. 2016.  

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.

[7] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 1: Gen­er­al prin­ciples for design. ISO Stand­ard 13849 – 1. 2015.

[8] Safety of machinery — Safety-related parts of con­trol sys­tems — Part 2: Val­id­a­tion. ISO Stand­ard 13849 – 2. 2012.

[9] Safety of machinery – Func­tion­al safety of safety-related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems. IEC Stand­ard 62061+AMD1+AMD2. 2015.

[10] Safety of machineryEmer­gency Stop — Prin­cipals for design. ISO Stand­ard 13850. 2015.

Down­load IEC stand­ards, Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion stand­ards.
Down­load ISO Stand­ards

[11] Con­trol of haz­ard­ous energy — Lock­out and oth­er meth­ods. CSA Stand­ard Z460. 2013.

 

 

Checking Emergency Stop Systems

This entry is part 2 of 14 in the series Emer­gency Stop

This short art­icle dis­cusses ways to test emer­gency stop sys­tems on machines.

A while back I wrote about the basic design require­ments for Emer­gency Stop sys­tems. I’ve had sev­er­al people con­tact me want­ing to know about check­ing and test­ing emer­gency stops, so here are my thoughts on this pro­cess.

Fig­ure 1 below, excerp­ted from the 1996 edi­tion of ISO 13850, Safety of machinery — Emer­gency stop — Prin­ciples for design, shows the emer­gency stop func­tion graph­ic­ally. As you can see, the ini­ti­at­ing factor in this func­tion is a per­son becom­ing aware of the need for an emer­gency stop. This is NOT an auto­mat­ic func­tion and is NOT a safety or safe­guard­ing func­tion.

Down­load ISO Stand­ards

ISO 13850 1996 Figure 1 - Emergency Stop Function
ISO 13850 1996 Fig­ure 1 – Emer­gency Stop Func­tion

Down­load ISO Stand­ards

I men­tion this because many people are con­fused about this point. Emer­gency stop sys­tems are con­sidered to be ‘com­pli­ment­ary pro­tect­ive meas­ures’, mean­ing that their func­tions com­ple­ment the safe­guard­ing sys­tems, but can­not be con­sidered to be safe­guards in and of them­selves. This is sig­ni­fic­ant. Safe­guard­ing sys­tems are required to act auto­mat­ic­ally to pro­tect an exposed per­son. Think about how an inter­locked gate or a light cur­tain acts to stop haz­ard­ous motion BEFORE the per­son can reach it. Emer­gency stop is nor­mally used AFTER the per­son is already involved with the haz­ard, and the next step is nor­mally to call 911.

All of that is import­ant from the per­spect­ive of con­trol reli­ab­il­ity. The con­trol reli­ab­il­ity require­ments for emer­gency stop sys­tems are often dif­fer­ent from those for the safe­guard­ing sys­tems because they are a backup sys­tem. Determ­in­a­tion of the reli­ab­il­ity require­ments is based on the risk assess­ment and on an ana­lys­is of the cir­cum­stances where you, as the design­er, anti­cip­ate that emer­gency stop may be help­ful in redu­cing or avoid­ing injury or machinery dam­age. Fre­quently, these sys­tems have lower con­trol reli­ab­il­ity require­ments than do safe­guard­ing sys­tems.

Before you begin any test­ing, under­stand what effects the test­ing will have on the machinery. Emer­gency stops can be par­tially tested with the machinery at rest. Depend­ing on the func­tion of the machinery and the dif­fi­culty in recov­er­ing from an emer­gency stop con­di­tion, you may need to adjust your approach to these tests. Start by review­ing the emer­gency stop func­tion­al descrip­tion in the manu­al. Here’s an example taken from a real machine manu­al:

Emergency Stop (E-Stop) Button

Emergency Stop Button
Fig­ure 2.1 Emer­gency Stop (E-Stop) But­ton

A red emer­gency stop (E-Stop) but­ton is a safety device which allows the oper­at­or to stop the machine in an emer­gency. At any time dur­ing oper­a­tion, press the E-Stop but­ton to dis­con­nect actu­at­or power and stop all con­nec­ted machines in the pro­duc­tion line. Fig­ure 2.1 shows the emer­gency stop but­ton.

There is one E-Stop but­ton on the pneu­mat­ic pan­el.

NOTE: After press­ing the E-Stop but­ton, the entire pro­duc­tion line from spread­er-feed­er to stack­er shuts down. When the E-Stop but­ton is reset, all machines in the pro­duc­tion line will need to be restar­ted.

DANGER: These devices do not dis­con­nect main elec­tric­al power from the machine. See “Elec­tric­al Dis­con­nect” on page 21.

As you can see, the gen­er­al func­tion of the but­ton is described, and some warn­ings are giv­en about what does and doesn’t hap­pen when the but­ton is pressed.

Now, if the emer­gency stop sys­tem has been designed prop­erly and the machine is oper­at­ing nor­mally, press­ing the emer­gency stop but­ton while the machine is in mid-cycle should res­ult in the machinery com­ing to a fast and grace­ful stop. Here is what ISO 13850 has to say about this con­di­tion:

4.1.3 The emer­gency stop func­tion shall be so designed that, after actu­ation of the emer­gency stop actu­at­or, haz­ard­ous move­ments and oper­a­tions of the machine are stopped in an appro­pri­ate man­ner, without cre­at­ing addi­tion­al haz­ards and without any fur­ther inter­ven­tion by any per­son, accord­ing to the risk assess­ment.
An “appro­pri­ate man­ner” can include

  • choice of an optim­al decel­er­a­tion rate,
  • selec­tion of the stop cat­egory (see 4.1.4), and
  • employ­ment of a pre­de­ter­mined shut­down sequence.

The emer­gency stop func­tion shall be so designed that a decision to use the emer­gency stop device does not require the machine oper­at­or to con­sider the res­ult­ant effects.

The inten­tion of this func­tion is to bring the machinery to a halt as quickly as pos­sible without dam­aging the machine. How­ever, if the brak­ing sys­tems fail, e.g. the servo drive fails to decel­er­ate the tool­ing as it should, then drop­ping power and poten­tially dam­aging the machinery is accept­able.

In many sys­tems, press­ing the e-stop but­ton or oth­er­wise activ­at­ing the emer­gency stop sys­tem will res­ult in a fault or an error being dis­played on the machine’s oper­at­or dis­play. This can be used as an indic­a­tion that the con­trol sys­tem ‘knows’ that the sys­tem has been activ­ated.

ISO 13850 requires that emer­gency stop sys­tems exhib­it the fol­low­ing key beha­viours:

  • It must over­ride all oth­er con­trol func­tions, and no start func­tions are per­mit­ted (inten­ded, unin­ten­ded or unex­pec­ted) until the emer­gency stop has been reset;
  • Use of the emer­gency stop can­not impair the oper­a­tion of any func­tions of the machine inten­ded for the release of trapped per­sons;
  • It is not per­mit­ted to affect the func­tion of any oth­er safety crit­ic­al sys­tems or devices.

Tests

Once the emer­gency stop device has been activ­ated, con­trol power is nor­mally lost. Press­ing any START func­tion on the con­trol pan­el, except POWER ON or RESET should have no effect. If any aspect of the machine starts, count this as a FAILED test.

If reset­ting the emer­gency stop device res­ults in con­trol power being re-applied, count this as a FAILED test.

Press­ing POWER ON or RESET before the activ­ated emer­gency stop device has been reset (i.e. the e-stop but­ton has been pulled out to the ‘oper­ate’ pos­i­tion), should have no effect. If you can turn the power back on before you reset the emer­gency stop device, count this as a FAILED test.

Once the emer­gency stop device has been reset, press­ing POWER ON or RESET should res­ult in the con­trol power being restored. This is accept­able. The machine should not restart. If the machine restarts nor­mal oper­a­tion, count this as a FAILED test.

Once con­trol power is back on, you may have a num­ber of faults to clear. When all the faults have been cleared, press­ing the START but­ton should res­ult in the machine restart­ing. This is accept­able beha­viour.

If you break the machine while test­ing the emer­gency stop sys­tem, count this as a FAILED test.

Test all emer­gency stop devices. A wir­ing error or oth­er prob­lems may not be appar­ent until the emer­gency stop device is tested. Push all but­tons, pull all pull cords, activ­ate all emer­gency stop devices. If any fail to cre­ate the emer­gency stop con­di­tion, count this as a FAILED test.

If, hav­ing con­duc­ted all of these tests, no fail­ures have been detec­ted, con­sider the sys­tem to have passed basic func­tion­al test­ing. Depend­ing on the com­plex­ity of the sys­tem and the crit­ic­al­ity of the emer­gency stop func­tion, addi­tion­al test­ing may be required. It may be neces­sary to devel­op some func­tion­al tests that are con­duc­ted while vari­ous EMI sig­nals are present, for example.

If you have any ques­tions regard­ing test­ing of emer­gency stop devices, please email me!

Down­load ISO Stand­ards

Guarding Emergency Stop Devices

This entry is part 3 of 14 in the series Emer­gency Stop

Can emer­gency stop devices that a prone to unin­ten­ded oper­a­tion be guarded? Find out!

Much con­fu­sion exists when it comes to Emer­gency Stop sys­tems, and cli­ents often ask me if it is ‘OK’ to guard emer­gency stop devices like e-stop but­tons, foot ped­als, pull-cords, etc. Without get­ting into a ton of reg­u­lat­ory details, this art­icle will look at the require­ments in for emer­gency stop devices in three key jur­is­dic­tions: Canada, the USA and the European Uni­on.

If you need inform­a­tion on the func­tion­al aspects of emer­gency stop sys­tems, see “Emer­gency Stop – What’s so con­fus­ing about that?

Why Guard an Emergency Stop?

Gen­er­ally, emer­gency stop devices, or e-stop devices as they’re often called, need to be pro­tec­ted from unin­ten­tion­al use. This prob­lem occurs because e-stop devices have to be loc­ated close to where people work in order to be use­ful. An e-stop you can’t reach when you need it may as well not be there in the first place, so emer­gency stops are loc­ated at ‘nor­mal oper­at­or sta­tions’. This often means they are loc­ated under the edge of a machine table, or on an oper­at­or con­trol bar like that used on power presses, put­ting the e-stop with­in reach, but also in the ‘line-of-fire’ when it comes to the operator’s nor­mal move­ments.

To pre­vent unin­ten­ded oper­a­tion, people often want to put rings, col­lars, or worse – cov­ers – on or around the e-stop device to keep people from bump­ing the device. Some of these can be done and should be done, and oth­ers are nev­er per­mit­ted for good reas­on.

Regulatory Requirements

Let’s take a look at the key require­ments from the reg­u­la­tions world wide:

  1. Emer­gency Stop devices must be clearly iden­ti­fied. The tech­nic­al stand­ards require that emer­gency stop devices be col­oured RED with a YELLOW back­ground [1].
  2. They must be loc­ated with­in easy reach of the oper­at­or. This applies to all nor­mal work­sta­tions where oper­at­ors inter­act with the machine. For main­ten­ance and ser­vice activ­it­ies where work­ers may be in loc­a­tions oth­er than nor­mal work­sta­tions, a pendant or oth­er port­able con­trol must be used to cause machine motion. This device must include an emer­gency stop con­trol along with oth­er com­ple­ment­ary safe­guard­ing devices such as enabling devices and hold-to-run con­trols. Where access is only allowed under lock­out con­di­tions, this is not required [2], [3].
  3. But­tons must be palm or mush­room-shaped devices.
  4. Devices must require manu­al reset­ting. This means that the device must latch in the oper­ated pos­i­tion and require a delib­er­ate action to reset the device. This includes actions such as: pulling put a pressed but­ton, twist­ing a but­ton to release the latched con­di­tion, press­ing a reset but­ton on a pull-cord to reset the tripped con­di­tion, etc [1].
  5. Unguarded. This means that easy access to the device may not be impeded, con­sid­er­ing the per­son­al pro­tect­ive equip­ment (PPE) that work­ers are required to wear. Devices that would be con­sidered to be guards would include:
  • Close fit­ting rings or col­lars that require a work­er to insert a fin­ger inside the ring or col­lar to reach the device and activ­ate it,
  • cov­ers that close over the device to pre­vent access,
  • lock­ing device that pre­vent access to the device, etc.

So, con­sid­er­ing point 5 above, isn’t this the end of the dis­cus­sion? Not at all! There are a few factors to con­sider first.

An import­ant con­sid­er­a­tion is the poten­tial for acci­dent­al oper­a­tion. Depend­ing on the machine or pro­cess, unin­ten­tion­al oper­a­tion of emer­gency stop devices may res­ult in sig­ni­fic­ant lost pro­duc­tion and/or dam­age to equip­ment. In cases like this, it is reas­on­able to pro­tect the device from inad­vert­ent oper­a­tion as long as the meas­ures taken to pro­tect the device do not impede the oper­a­tion of the device in emer­gency con­di­tions.

ISO 13850 [4] sup­ports this idea in Clause 4.4 Emer­gency stop device:

4.4.2 An emer­gency stop device shall be loc­ated at each oper­at­or con­trol sta­tion, except where the risk assess­ment indic­ates that this is not neces­sary, as well as at oth­er loc­a­tions, as determ­ined by the risk assess­ment. It shall be posi­tioned such that it is read­ily access­ible and cap­able of non-haz­ard­ous actu­ation by the oper­at­or and oth­ers who could need to actu­ate it. Meas­ures against inad­vert­ent actu­ation should not impair its access­ib­il­ity. (Author’s Note: Bold text added for emphas­is.)

Summing Up

The key dif­fer­ence between North Amer­ic­an think­ing and International/EU think­ing is in the term “unguarded” as used in the North Amer­ic­an stand­ards, versus [4, § 4.2.2], where the design­er is reminded, “Meas­ures against inad­vert­ent actu­ation should not impair its access­ib­il­ity.”

In my opin­ion it is reas­on­able to pro­tect an emer­gency stop device from inad­vert­ent oper­a­tion by pla­cing a ring or oth­er sim­il­ar struc­ture around an emer­gency stop device as long as the struc­ture does not impair easy access to the device by the oper­at­or.

I know this opin­ion appears ini­tially to go against the estab­lished North Amer­ic­an stand­ards, how­ever it can be logic­ally argued, based on the defin­i­tion of the word “guard”.

A guard is a device that pre­vents access to some­thing, usu­ally a haz­ard. Con­sid­er­ing that we are talk­ing about a con­trol that is designed to reduce or lim­it harm, any struc­ture that does not pre­vent access to the emer­gency stop device asso­ci­ated with the struc­ture should be con­sidered to be accept­able.

That said, devices like:

  • hinged cov­ers;
  • doors;
  • lock­ing devices;
  • nar­row col­lars; and
  • any oth­er device or struc­ture

that unduly lim­its access to the emer­gency stop device can­not be con­sidered accept­able.

Effects of PPE

The phrase ‘unduly lim­its access’ has spe­cif­ic mean­ing here. If work­ers are expec­ted to be wear­ing PPE on the body part used to activ­ate the emer­gency stop device, such as gloves or boots for example, then the design of the struc­ture placed around the emer­gency stop device must take into account the added dimen­sions of the PPE, the reduc­tion in tact­ile cap­ab­il­ity that may occur (e.g. heavy work gloves make it hard to feel things eas­ily), and must com­pensate for the effects of the PPE. Big gloves/boots = Big open­ing in the struc­ture.

Light­ing and pro­tect­ive eye­wear can also play a part. You may need to use reflect­ive or lumin­es­cent paint, or illu­min­ated e-stop devices, to high­light the loc­a­tion of the device in low light envir­on­ments or where very dark eye­wear is required, like that needed by weld­ers or used by work­ers around some infrared lasers with open beam paths.

Effects of State-of-Mind

It’s also import­ant to con­sider the likely state-of-mind of a work­er need­ing to use an emer­gency stop device. They are either urgently try­ing to stop the machine because,

  1. anoth­er safe­guard has failed an someone is involved with a haz­ard, includ­ing them­selves, or
  2. the machine is dam­aging itself or the product and they need to lim­it the dam­age.

Both scen­ari­os have a high level of urgency attached to them. The human mind tends to miss obvi­ous things includ­ing train­ing, when placed under high levels of stress. Struc­tures placed around emer­gency stop devices, such as cov­ers, that com­pletely block access, even though they may be eas­ily opened, may be enough to pre­vent access in an emer­gency.

The answer you’ve all been waiting for!

So in the end, can you put a struc­ture around an emer­gency stop to reduce inad­vert­ent oper­a­tion of the device:

YES!

Just make sure that you con­sider all the factors that may affect it’s use, doc­u­ment your ana­lys­is, and don’t unduly restrict access to the device.

Need more help? Feel free to email me!


References

IEC – Inter­na­tion­al Elec­tro­tech­nic­al Com­mis­sion

ISO – Inter­na­tion­al Organ­iz­a­tion for Stand­ard­iz­a­tion

[1]  Safety of machinery – Elec­tric­al equip­ment of machines – Part 1: Gen­er­al require­ments, IEC 60204 – 1, 2005

[2]  Con­trol of Haz­ard­ous Energy ­– Lock­out and Oth­er Meth­ods, CSA Z460, 2005.

[3]  Con­trol of Haz­ard­ous Energy – Lockout/Tagout and Altern­at­ive Meth­ods, ANSI ASSE Z244.1, 2003.

[4]  Safety of machinery — Emer­gency stop — Prin­ciples for design, ISO 13850, 2006.