Interlock Architectures – Pt. 1: What do those categories really mean?

This entry is part 1 of 8 in the series Circuit Architectures Explored

In 1995 CEN pub­lished an import­ant stand­ard for machine build­ers – EN 954 – 1, Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design. This stand­ard set the stage for defin­ing con­trol reli­ab­il­ity in machinery safe­guard­ing sys­tems, intro­du­cing the Reliability cat­egor­ies that have become ubi­quit­ous. So what do these cat­egor­ies mean, and how are they applied under the latest machinery stand­ard, ISO 13849 – 1?

This entry is part 1 of 8 in the series Circuit Architectures Explored

It all started with EN 954 – 1

In 1996 CEN pub­lished an import­ant stand­ard for machine build­ers – EN 954 – 1, “Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design” [1]. This stand­ard set the stage for defin­ing con­trol reli­ab­il­ity in machinery safe­guard­ing sys­tems, intro­du­cing the Reliability cat­egor­ies that have become ubi­quit­ous. So what do these cat­egor­ies mean, and how are they applied under the latest machinery func­tion­al safety stand­ard, ISO 13849 – 1 [2]?

Download ISO Standards 

Circuit Categories

The cat­egor­ies are used to describe sys­tem archi­tec­tures for safety related con­trol sys­tems. Each archi­tec­ture car­ries with it a range of reli­ab­il­ity per­form­ance that can be related to the degree of risk reduc­tion you are expect­ing to achieve with the sys­tem. These archi­tec­tures can be applied equally to elec­tric­al, elec­tron­ic, pneu­mat­ic, hydraul­ic or mech­an­ic­al con­trol sys­tems.

Historical Circuits

Early elec­tric­al ‘master-​control-​relay’ cir­cuits used a simple archi­tec­ture with a single con­tact­or, or some­times two, and a single chan­nel style of archi­tec­ture to main­tain the con­tact­or coil cir­cuit once the START or POWER ON but­ton (PB2 in Fig. 1) had been pressed. Power to the out­put ele­ments of the machine con­trols was sup­plied via con­tacts on the con­tact­or, which is why it was called the Master Control Relay or ‘MCR’. The POWER OFF but­ton (PB1 in Fig. 1) could be labeled that way, or you could make the same cir­cuit into an Emergency Stop by simply repla­cing the oper­at­or with a red mushroom-​head push but­ton. These devices were usu­ally spring-​return, so to restore power, all that was needed was to push the POWER ON but­ton again (Fig.1).

Basic Stop/Start Circuit
Figure 1 – Basic Stop/​Start Circuit

Typically, the com­pon­ents used in these cir­cuits were spe­cified to meet the cir­cuit con­di­tions, but not more. Controls man­u­fac­tur­ers brought out over-​dimensioned ver­sions, such as Allen-Bradley’s Bulletin 700-​PK con­tact­or which had 20 A rated con­tacts instead of the stand­ard Bulletin 700’s 10 A con­tacts.

When inter­locked guards began to show up, they were integ­rated into the ori­gin­al MCR cir­cuit by adding a basic con­trol relay (CR1 in Fig. 2) whose coil was con­trolled by the inter­lock switch(es) (LS1 in Fig. 2), and whose out­put con­tacts were in series with the coil cir­cuit of the MCR con­tact­or. Opening the guard inter­lock would open the MCR coil cir­cuit and drop power to the machine con­trols. Very simple.

Start/Stop Circuit with Guard Relay
Figure 2 – Old-​School Start/​Stop Circuit with Guard Relay

Ice-​cube’ style plug-​in relays were often chosen for CR1. These devices did not have ‘force-​guided’ con­tacts in them, so it was pos­sible to have one con­tact in the relay fail while the oth­er con­tin­ued to oper­ate prop­erly.

LS1 could be any kind of switch. Frequently a ‘micro-​switch’ style of lim­it switch was chosen. These snap-​action switches could fail shor­ted intern­ally, or weld closed and the actu­at­or would con­tin­ue to work nor­mally even though the switch itself had failed. These switches are also ridicu­lously easy to bypass. All that is required is a piece of tape or an elast­ic band and the switch is no longer doing it’s job.

Micro-Switch style limit switch used as an interlock switch
Photo 1 – Micro-​Switch style lim­it switch used as a cov­er inter­lock switch in a piece of indus­tri­al laun­dry equip­ment

The prob­lem with these cir­cuits is that they can fail in a num­ber of ways that aren’t obvi­ous to the user, with the res­ult being that the inter­lock might not work as expec­ted, or the Emergency Stop might fail just when you need it most.

Modern Circuits

Category B

These ori­gin­al cir­cuits are the basis for what became known as ‘Category B’ (‘B’ for ‘Basic’) cir­cuits. Here’s the defin­i­tion from the stand­ard. Note that I am tak­ing this excerpt from ISO 13849 – 1: 2007 (Edition 2). “SRP/​CS” stands for “Safety Related Parts of Control Systems”:

6.2.3 Category B
The SRP/​CS shall, as a min­im­um, be designed, con­struc­ted, selec­ted, assembled and com­bined in accord­ance with the rel­ev­ant stand­ards and using basic safety prin­ciples for the spe­cif­ic applic­a­tion to with­stand

  • the expec­ted oper­at­ing stresses, e.g. the reli­ab­il­ity with respect to break­ing capa­city and fre­quency,
  • the influ­ence of the pro­cessed mater­i­al, e.g. deter­gents in a wash­ing machine, and
  • oth­er rel­ev­ant extern­al influ­ences, e.g. mech­an­ic­al vibra­tion, elec­tro­mag­net­ic inter­fer­ence, power sup­ply inter­rup­tions or dis­turb­ances.

There is no dia­gnost­ic cov­er­age (DCavg = none) with­in cat­egory B sys­tems and the MTTFd of each chan­nel can be low to medi­um. In such struc­tures (nor­mally single-​channel sys­tems), the con­sid­er­a­tion of CCF is not rel­ev­ant.

The max­im­um PL achiev­able with cat­egory B is PL = b.

NOTE When a fault occurs it can lead to the loss of the safety func­tion.

Specific require­ments for elec­tro­mag­net­ic com­pat­ib­il­ity are found in the rel­ev­ant product stand­ards, e.g. IEC 61800 – 3 for power drive sys­tems. For func­tion­al safety of SRP/​CS in par­tic­u­lar, the immunity require­ments are rel­ev­ant. If no product stand­ard exists, at least the immunity require­ments of IEC 61000−6−2 should be fol­lowed.

The stand­ard also provides us with a nice block dia­gram of what a single-​channel sys­tem might look like:

Category B Designated Architecture
ISO 13849 – 1 Category B Designated Architecture

If you look at this block dia­gram and the Start/​Stop Circuit with Guard Relay above, you can see how this basic cir­cuit trans­lates into a single chan­nel archi­tec­ture, since from the con­trol inputs to the con­trolled load you have a single chan­nel. Even the guard loop is a single chan­nel. A fail­ure in any com­pon­ent in the chan­nel can res­ult in loss of con­trol of the load.

Lets look at each part of this require­ment in more detail, since each of the sub­sequent Categories builds upon these BASIC require­ments.

The SRP/​CS shall, as a min­im­um, be designed, con­struc­ted, selec­ted, assembled and com­bined in accord­ance with the rel­ev­ant stand­ards and using basic safety prin­ciples for the spe­cif­ic applic­a­tion…

Basic Safety Principles

We have to go to ISO 13849 – 2 to get a defin­i­tion of what Basic Safety Principles might include. Looking at Annex A.2 of the stand­ard we find:

Table A.1 — Basic Safety Principles

Basic Safety Principles Remarks
Use of suit­able mater­i­als and adequate man­u­fac­tur­ing Selection of mater­i­al, man­u­fac­tur­ing meth­ods and treat­ment in rela­tion to, e. g. stress, dur­ab­il­ity, elasti­city, fric­tion, wear,
cor­ro­sion, tem­per­at­ure.
Correct dimen­sion­ing and shap­ing Consider e. g. stress, strain, fatigue, sur­face rough­ness, tol­er­ances, stick­ing, man­u­fac­tur­ing.
Proper selec­tion, com­bin­a­tion, arrange­ments, assembly and install­a­tion of components/​systems. Apply manufacturer’s applic­a­tion notes, e. g. cata­logue sheets, install­a­tion instruc­tions, spe­cific­a­tions, and use of good engin­eer­ing prac­tice in sim­il­ar components/​systems.
Use of de – ener­gisa­tion prin­ciple The safe state is obtained by release of energy. See primary action for stop­ping in EN 292 – 2:1991 (ISO/​TR 12100 – 2:1992), 3.7.1. Energy is sup­plied for start­ing the move­ment of a mech­an­ism. See primary action for start­ing in EN 292 – 2:1991 (ISO/​TR 12100 – 2:1992), 3.7.1.Consider dif­fer­ent modes, e. g. oper­a­tion mode, main­ten­ance mode.

This prin­ciple shall not be used in spe­cial applic­a­tions, e. g. to keep energy for clamp­ing devices.

Proper fasten­ing For the applic­a­tion of screw lock­ing con­sider manufacturer’s applic­a­tion notes.Overloading can be avoided by apply­ing adequate torque load­ing tech­no­logy.
Limitation of the gen­er­a­tion and/​or trans­mis­sion of force and sim­il­ar para­met­ers Examples are break pin, break plate, torque lim­it­ing clutch.
Limitation of range of envir­on­ment­al para­met­ers Examples of para­met­ers are tem­per­at­ure, humid­ity, pol­lu­tion at the install­a­tion place. See clause 8 and con­sider
manufacturer’s applic­a­tion notes.
Limitation of speed and sim­il­ar para­met­ers Consider e. g. the speed, accel­er­a­tion, decel­er­a­tion required by the applic­a­tion
Proper reac­tion time Consider e. g. spring tired­ness, fric­tion, lub­ric­a­tion, tem­per­at­ure, iner­tia dur­ing accel­er­a­tion and decel­er­a­tion,
com­bin­a­tion of tol­er­ances.
Protection against unex­pec­ted start – up Consider unex­pec­ted start-​up caused by stored energy and after power “sup­ply” res­tor­a­tion for dif­fer­ent modes as
oper­a­tion mode, main­ten­ance mode etc.
Special equip­ment for release of stored energy may be neces­sary.
Special applic­a­tions, e. g. to keep energy for clamp­ing devices or ensure a pos­i­tion, need to be con­sidered
sep­ar­ately.
Simplification Reduce the num­ber of com­pon­ents in the safety-​related sys­tem.
Separation Separation of safety-​related func­tions from oth­er func­tions.
Proper lub­ric­a­tion
Proper pre­ven­tion of the ingress of flu­ids and dust Consider IP rat­ing [see EN 60529 (IEC 60529)]

Download ISO Standards 
As you can see, the basic safety prin­ciples are pretty basic – select com­pon­ents appro­pri­ately for the applic­a­tion, con­sider the oper­at­ing con­di­tions for the com­pon­ents, fol­low manufacturer’s data, and use de-​energization to cre­ate the stop func­tion. That way, a loss of power res­ults in the sys­tem fail­ing into a safe state, as does an open relay coil or set of burnt con­tacts.

…the expec­ted oper­at­ing stresses, e.g. the reli­ab­il­ity with respect to break­ing capa­city and fre­quency,”

Specify your com­pon­ents cor­rectly with regard to voltage, cur­rent, break­ing capa­city, tem­per­at­ure, humid­ity, dust,…

…oth­er rel­ev­ant extern­al influ­ences, e.g. mech­an­ic­al vibra­tion, elec­tro­mag­net­ic inter­fer­ence, power sup­ply inter­rup­tions or dis­turb­ances.”

Specific require­ments for elec­tro­mag­net­ic com­pat­ib­il­ity are found in the rel­ev­ant product stand­ards, e.g. IEC 61800 – 3 for power drive sys­tems. For func­tion­al safety of SRP/​CS in par­tic­u­lar, the immunity require­ments are rel­ev­ant. If no product stand­ard exists, at least the immunity require­ments of IEC 61000−6−2 should be fol­lowed.”

Probably the biggest ‘gotcha’ in this point is “elec­tro­mag­net­ic inter­fer­ence”. This is import­ant enough that the stand­ard devotes a para­graph to it spe­cific­ally. I added the bold text to high­light the idea of ‘func­tion­al safety’. You can find oth­er inform­a­tion in oth­er posts on this blog on that top­ic. If your product is destined for the European Union (EU), then you will almost cer­tainly be doing some EMC test­ing, unless your product is a ‘fixed install­a­tion’. If it’s going to almost any oth­er mar­ket, you prob­ably are not under­tak­ing this test­ing. So how do you know if your design meets this cri­ter­ia? Unless you test, you don’t. You can make some edu­cated guesses based on using sound engin­eer­ing prac­tices , but after that you can only hope.

Diagnostic Coverage

…There is no dia­gnost­ic cov­er­age (DCavg = none) with­in cat­egory B sys­tems…”

Category B sys­tems are fun­da­ment­ally single chan­nel. A single fault in the sys­tem will lead to the loss of the safety func­tion. This sen­tence refers to the concept of “dia­gnost­ic cov­er­age” that was intro­duced in ISO 13849 – 1:2007, but what this means in prac­tice is that there is no mon­it­or­ing or feed­back from any crit­ic­al ele­ments. Remember our basic MCR cir­cuit? If the MCR con­tact­or wel­ded closed, the only dia­gnost­ic was the fail­ure of the machine to stop when the emer­gency stop but­ton was pressed.

Component Failure Rates

…the MTTFd of each chan­nel can be low to medi­um.”

This part of the state­ment is refer­ring to anoth­er new concept from ISO 13849 – 1:2007, “MTTFd”. Standing for “Mean Time to Failure Dangerous”, this concept looks at the expec­ted fail­ure rates of the com­pon­ent in hours. Calculating MTTFd is a sig­ni­fic­ant part of imple­ment­ing the new stand­ard. From the per­spect­ive of under­stand­ing Category B, what this means is that you do not need to use high-​reliability com­pon­ents in these sys­tems.

Common Cause Failures

In such struc­tures (nor­mally single-​channel sys­tems), the con­sid­er­a­tion of CCF is not rel­ev­ant.”

CCF is anoth­er new concept from ISO 13849 – 1:2007, and stands for “Common Cause Failure”. I’m not going to get into this in any detail here, but suf­fice to say that design tech­niques, as well as chan­nel sep­ar­a­tion (impossible in a single chan­nel archi­tec­ture) and oth­er tech­niques are used to reduce the like­li­hood of CCF in high­er reli­ab­il­ity sys­tems.

Performance Levels

The max­im­um PL achiev­able with cat­egory B is PL = b.”

PL stands for “Performance Level”, divided into five degrees from ‘a’ to ‘e’. PLa is equal to an aver­age prob­ab­il­ity of dan­ger­ous fail­ure per hour of >= 10-5 to < 10-4 fail­ures per hour. PLb is equal to >= 3 × 10-6 to < 10-5 fail­ures per hour or once in 10,000 to 100,000 hours, to once in 3,000,000 hours of oper­a­tion. This sounds like a lot, but when deal­ing with prob­ab­il­it­ies, these num­bers are actu­ally pretty low.

If you con­sider an oper­a­tion run­ning a single shift in Canada where the nor­mal work­ing year is 50 weeks and the nor­mal work­day is 7.5 hours, a work­ing year is

7.5 h/​d x 5 d/​w x 50 w/​a = 1875 hours/​a

Taking the fail­ure rates per hour above, yields:

PLa = one fail­ure in 5.3 years of oper­a­tion to one fail­ure in 53.3 years

PLb = one fail­ure in 1600 years of oper­a­tion

If we go to an oper­a­tion run­ning three shifts in Canada, a work­ing year is:

7.5 h/​shift x 3 shifts x 5 d/​w x 50 w/​a = 5625 hours/​a

Taking the fail­ure rates per hour above, yields:

PLa = one fail­ure in 1.8 years of oper­a­tion to one fail­ure in 17 years

PLb = one fail­ure in 533 years of oper­a­tion

Now you should be start­ing to get an idea about where this is going. It’s import­ant to remem­ber that prob­ab­il­it­ies are just that – the fail­ure could hap­pen in the first hour of oper­a­tion or at any time after that, or nev­er. These fig­ures give you some way to gauge the rel­at­ive reli­ab­il­ity of the design, and ARE NOT any sort of guar­an­tee.

Watch for the next post in this series where I will look at Category 1 require­ments!

References

[1] Safety of Machinery – Safety Related Parts of Control Systems – Part 1: General Principles for Design. CEN Standard EN 954 – 1. 1996.

[2] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. ISO Standard 13849 – 1. 2006.

[3] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 2: Validation, ISO Standard 13849 – 2. 2003.

[4] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 100: Guidelines for the use and applic­a­tion of ISO 13849 – 1. ISO Technical Report TR 100. 2000.

[5] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. CEN Standard EN ISO 13849 – 1. 2008.

Download ISO Standards 

Emergency Stop – What’s so confusing about that?

This entry is part 1 of 12 in the series Emergency Stop

I get a lot of calls and emails ask­ing about emer­gency stops. This is one of those decept­ively simple con­cepts that has man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user, which can lead to injury if they don’t under­stand the haz­ards involved. Some product-​specific stand­ards

This entry is part 1 of 12 in the series Emergency Stop

Editor’s Note: Since we first pub­lished this art­icle on emer­gency stop in March of 2009, it has become our most pop­u­lar post of all time! We decided it was time for a little refresh. Enjoy, and please com­ment if you find the post help­ful, or if you have any ques­tions you’d like answered. DN-​July, 2017.

The Emergency Stop func­tion is one of those decept­ively simple con­cepts that have man­aged to get very com­plic­ated over time. Not every machine needs or can bene­fit from an emer­gency stop. In some cases, it may lead to an unreas­on­able expect­a­tion of safety from the user. Some product-​specific stand­ards man­date the require­ment for an emer­gency stop, such as CSA Z434-​14 [1], where robot con­trol­lers are required to provide emer­gency stop func­tion­al­ity, and work cells integ­rat­ing robots are also required to have emer­gency stop cap­ab­il­ity.

Defining Emergency Stop

Old, non-compliant, E-Stop Button
Photo 1 – This OLD but­ton is def­in­itely non-​compliant.

So what is the Emergency Stop func­tion, or E-​stop func­tion, and when do you need to have one? Let’s look at a few defin­i­tions taken from CSA Z432-​14 [2]:

Emergency situ­ation
an imme­di­ately haz­ard­ous situ­ation that needs to be ended or aver­ted quickly in order to pre­vent injury or dam­age.
Emergency stop
a func­tion that is inten­ded to avert harm or to reduce exist­ing haz­ards to per­sons, machinery, or work in pro­gress.
Emergency stop but­ton
a red mushroom-​headed but­ton that, when activ­ated, will imme­di­ately start the emer­gency stop sequence.

One more [2, 6.3.5]:

Complementary pro­tect­ive meas­ures
Protective meas­ures which are neither inher­ently safe design meas­ures, nor safe­guard­ing (imple­ment­a­tion of guards and/​or pro­tect­ive devices), nor inform­a­tion for use, could have to be imple­men­ted as required by the inten­ded use and the reas­on­ably fore­see­able mis­use of the machine.

Modern, non-compliant e-stop button.
Photo 2 – This more mod­ern but­ton is non-​compliant due to the RED back­ground and spring-​return but­ton.

An e-​stop is a func­tion that is inten­ded for use in Emergency con­di­tions to try to lim­it or avert harm to someone or some­thing. It isn’t a safe­guard but is con­sidered to be a Complementary Protective Measure. Looking at emer­gency stop func­tions from the per­spect­ive of the Hierarchy of Controls, emer­gency stop func­tions fall into the same level as Personal Protective Equipment like safety glasses, safety boots, and hear­ing pro­tec­tion. 

So far so good.

Is an Emergency Stop Function Required?

Depending on the reg­u­la­tions and the stand­ards you choose to read, machinery is may not be required to have an Emergency Stop. Quoting from [2, 6.3.5.2]:

Components and ele­ments to achieve the emer­gency stop func­tion

If, fol­low­ing a risk assess­ment, a machine needs to be fit­ted with com­pon­ents and ele­ments to achieve an emer­gency stop func­tion for enabling actu­al or impend­ing emer­gency situ­ations to be aver­ted, the fol­low­ing require­ments apply:

  • the actu­at­ors shall be clearly iden­ti­fi­able, clearly vis­ible and read­ily access­ible;
  • the haz­ard­ous pro­cess shall be stopped as quickly as pos­sible without cre­at­ing addi­tion­al haz­ards, but if this is not pos­sible or the risk can­not be reduced, it should be ques­tioned wheth­er imple­ment­a­tion of an emer­gency stop func­tion is the best solu­tion;
  • the emer­gency stop con­trol shall trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments where neces­sary.

Note For more detailed pro­vi­sions, see ISO 13850.

Later in [2, 7.15.1.2]:

Each oper­at­or con­trol sta­tion, includ­ing pendants, cap­able of ini­ti­at­ing machine motion and/​or auto­mat­ic motion shall have an emer­gency stop func­tion (see Clause 6.3.5.2), unless a risk assess­ment determ­ines that the emer­gency stop func­tion will not con­trib­ute to risk con­trol.

Note: There could be situ­ations where an e-​stop does not con­trib­ute to risk con­trol and altern­at­ives could be con­sidered in con­junc­tion with a risk assess­ment.

The bold text in the pre­ced­ing para­graph is mine. I wanted to be sure that you caught this import­ant bit of text. Not every machine requires an E-​stop func­tion. The func­tion is only required where there is a bene­fit to the user. In some cases, product fam­ily stand­ards often called “Type C” stand­ards, includ­ing spe­cif­ic require­ments for the pro­vi­sion of an emer­gency stop func­tion. The require­ment may include a min­im­um PLr or SILr, based on the opin­ion of the Technical Committee respons­ible for the stand­ard and their know­ledge of the par­tic­u­lar type of machinery covered by their doc­u­ment.

Note: For more detailed pro­vi­sions on the elec­tric­al design require­ments, see CSA C22.2 #301, NFPA 79 or IEC 60204 – 1.

Download NFPA stand­ards through ANSI

This more modern button is still wrong due to the RED background.
Photo 3 – This more mod­ern but­ton is non-​compliant due to the RED back­ground.

If you read Ontario’s Industrial Establishments Regulation (Regulation 851), you will find that prop­er iden­ti­fic­a­tion of the emer­gency stop device(s) and loc­a­tion “with­in easy reach” of the oper­at­or are the only require­ment. What does “prop­erly iden­ti­fied” mean? In Canada, the USA and Internationally, a RED oper­at­or device on a YELLOW back­ground, with or without any text behind it, is recog­nized as EMERGENCY STOP or EMERGENCY OFF, in the case of dis­con­nect­ing switches or con­trol switches. I’ve scattered some examples of dif­fer­ent com­pli­ant and non-​compliant e-​stop devices through this art­icle.

The EU Machinery Directive, 2006/​42/​EC, and Emergency Stop

Interestingly, the European Union has taken what looks like an oppos­ing view of the need for emer­gency stop sys­tems. Quoting from the Machinery Directive [3, Annex I, 1.2.4.3]:

1.2.4.3. Emergency stop
Machinery must be fit­ted with one or more emer­gency stop devices to enable actu­al or impend­ing danger to be aver­ted.

Notice the words “…actu­al or impend­ing danger…” This har­mon­ises with the defin­i­tion of Complementary Protective Measures, in that they are inten­ded to allow a user to “avert or lim­it harm” from a haz­ard. Clearly, the dir­ec­tion from the European per­spect­ive is that ALL machines need to have an emer­gency stop. Or do they? The same clause goes on to say:

The fol­low­ing excep­tions apply:

  • machinery in which an emer­gency stop device would not lessen the risk, either because it would not reduce the stop­ping time or because it would not enable the spe­cial meas­ures required to deal with the risk to be taken,
  • port­able hand-​held and/​or hand-​guided machinery.

From these two bul­lets it becomes clear that, just as in the Canadian and US reg­u­la­tions, machines only need emer­gency stops WHEN THEY CAN REDUCE THE RISK. This is hugely import­ant and often over­looked. If the risks can­not be con­trolled effect­ively with an emer­gency stop, or if the risk would be increased or new risks would be intro­duced by the action of an e-​stop sys­tem, then it should not be included in the design.

Carrying on with [3, 1.2.4.3]:

The device must:

  • have clearly iden­ti­fi­able, clearly vis­ible and quickly access­ible con­trol devices,
  • stop the haz­ard­ous pro­cess as quickly as pos­sible, without cre­at­ing addi­tion­al risks,
  • where neces­sary, trig­ger or per­mit the trig­ger­ing of cer­tain safe­guard move­ments.

Once again, this is con­sist­ent with the gen­er­al require­ments found in the Canadian and US reg­u­la­tions. [3] goes on to define the func­tion­al­ity of the sys­tem in more detail:

Once act­ive oper­a­tion of the emer­gency stop device has ceased fol­low­ing a stop com­mand, that com­mand must be sus­tained by engage­ment of the emer­gency stop device until that engage­ment is spe­cific­ally over­rid­den; it must not be pos­sible to engage the device without trig­ger­ing a stop com­mand; it must be pos­sible to dis­en­gage the device only by an appro­pri­ate oper­a­tion, and dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.

The emer­gency stop func­tion must be avail­able and oper­a­tion­al at all times, regard­less of the oper­at­ing mode.

Emergency stop devices must be a back-​up to oth­er safe­guard­ing meas­ures and not a sub­sti­tute for them.

The first sen­tence of the first para­graph above is the one that requires e-​stop devices to latch in the activ­ated pos­i­tion. The last part of that sen­tence is even more import­ant: “…dis­en­ga­ging the device must not restart the machinery but only per­mit restart­ing.” That phrase requires that every emer­gency stop sys­tem has a second dis­crete action to reset the emer­gency stop sys­tem. Pulling out the e-​stop but­ton and hav­ing power come back imme­di­ately is not OK. Once that but­ton has been reset, a second action, such as push­ing a “POWER ON” or “RESET” but­ton to restore con­trol power is needed.

Point of Clarification: I had a ques­tion come from a read­er ask­ing if com­bin­ing the E-​stop func­tion and the reset func­tion was accept­able. It can be, but only if:

  • The risk assess­ment for the machinery does not indic­ate any haz­ards that might pre­clude this approach; and
  • The device is designed with the fol­low­ing char­ac­ter­ist­ics:
    • The device must latch in the activ­ated pos­i­tion;
    • The device must have a “neut­ral” pos­i­tion where the machine’s emer­gency stop sys­tem can be reset, or where the machine can be enabled to run;
    • The reset pos­i­tion must be dis­tinct from the pre­vi­ous two pos­i­tions, and the device must spring-​return to the neut­ral pos­i­tion.

The second sen­tence har­mon­izes with the require­ments of the Canadian and US stand­ards. The last sen­tence har­mon­izes with the idea of “Complementary Protective Measures” as described in [2].

How Many and Where?

Where? “Within easy reach”. Consider the loc­a­tions where you EXPECT an oper­at­or to be. Besides the main con­trol con­sole, these could include feed hop­pers, con­sum­ables feed­ers, fin­ished goods exit points, etc. You get the idea. Anywhere you can reas­on­ably expect an oper­at­or to be under nor­mal cir­cum­stances is a reas­on­able place to put an e-​stop device. “Easy Reach” I inter­pret as with­in the arm-​span of an adult (pre­sum­ing the equip­ment is not inten­ded for use by chil­dren). The “easy reach” require­ment trans­lates to 500 – 600 mm either side of the centre line of most work­sta­tions.

How do you know if you need an emer­gency stop? Start with a stop/​start ana­lys­is. Identify all the nor­mal start­ing and stop­ping modes that you anti­cip­ate on the equip­ment. Consider all of the dif­fer­ent oper­at­ing modes that you are provid­ing, such as Automatic, Manual, Teach, Setting, etc. Identify all of the match­ing stop con­di­tions in the same modes, and ensure that all start func­tions have a match­ing stop func­tion.

Do a risk assess­ment. Risk assess­ment is a basic require­ment in most jur­is­dic­tions today.

As you determ­ine your risk con­trol meas­ures (fol­low­ing the Hierarchy of Controls), look at what risks you might con­trol with an Emergency Stop. Remember that e-​stops fall below safe­guards in the hier­archy, so you must use a safe­guard­ing tech­nique if pos­sible, you can’t just default down to an emer­gency stop. IF the e-​stop can provide you with the addi­tion­al risk reduc­tion then use it, but first, reduce the risks in oth­er ways.

The Stop Function and Functional Safety Requirements

Finally, once you determ­ine the need for an emer­gency stop sys­tem, you need to con­sider the system’s func­tion­al­ity and con­trols archi­tec­ture. NFPA 79 [4] has been the ref­er­ence stand­ard for Canada and is the ref­er­ence for the USA. In 2016, CSA intro­duced a new elec­tric­al stand­ard for machinery, CSA C22.2 #301 [5]. This stand­ard is inten­ded for cer­ti­fic­a­tion of indus­tri­al machines. My opin­ion is that this stand­ard has some sig­ni­fic­ant issues. You can find very sim­il­ar elec­tric­al require­ments to this in [4] in IEC 60204 – 1 [6] if you are work­ing in an inter­na­tion­al mar­ket. EN 60204 – 1 applies to the EU mar­ket for indus­tri­al machines and is tech­nic­ally identic­al to [6].

Download NFPA stand­ards through ANSI
Download IEC stand­ards, International Electrotechnical Commission stand­ards.

Functional Stop Categories

NFPA 79 calls out three basic cat­egor­ies of stop func­tions. Note that these cat­egor­ies are NOT func­tion­al safety archi­tec­tur­al cat­egor­ies, but are cat­egor­ies describ­ing stop­ping func­tions. Reliability is not addressed in these sec­tions. Quoting from the stand­ard:

9.2.2 Stop Functions

Stop func­tions shall over­ride related start func­tions. The reset of the stop func­tions shall not ini­ti­ate any haz­ard­ous con­di­tions. The three cat­egor­ies of stop func­tions shall be as fol­lows:

(1) Category 0 is an uncon­trolled stop by imme­di­ately remov­ing power to the machine actu­at­ors.

(2) Category 1 is a con­trolled stop with power to the machine actu­at­ors avail­able to achieve the stop then power is removed when the stop is achieved.

(3) Category 2 is a con­trolled stop with power left avail­able to the machine actu­at­ors.

This E-Stop Button is correct.
Photo 4 – This E-​Stop but­ton is CORRECT. Note the Push-​Pull-​Twist oper­at­or and the YELLOW back­ground.

A bit later in the stand­ard, we find:

9.2.5.3 Stop.

9.2.5.3.1* Category 0, Category 1, and/​or Category 2 stops shall be provided as determ­ined by the risk assess­ment and the func­tion­al require­ments of the machine. Category 0 and Category 1 stops shall be oper­a­tion­al regard­less of oper­at­ing modes, and Category 0 shall take pri­or­ity.

9.2.5.3.2 Where required, pro­vi­sions to con­nect pro­tect­ive devices and inter­locks shall be provided. Where applic­able, the stop func­tion shall sig­nal the logic of the con­trol sys­tem that such a con­di­tion exists.

You’ll also note that that pesky “risk assess­ment” pops up again in 9.2.5.3.1. You just can’t get away from it…

The func­tion­al stop cat­egor­ies are aligned with sim­il­ar terms used with motor drives. You may want to read this art­icle if your machinery uses a motor drive.

Functional Safety

Disconnect with E-Stop Colours indicates that this device is intended to be used for EMERGENCY SWITCHING OFF.
Photo 5 – Disconnect with E-​Stop Colours indic­ates that this dis­con­nect­ing device is inten­ded to be used for EMERGENCY SWITCHING OFF.

Once you know what func­tion­al cat­egory of stop you need, and what degree of risk reduc­tion you are expect­ing from the emer­gency stop sys­tem, you can determ­ine the func­tion­al safety require­ments. In Canada, [2, 8.2.1] requires that all new equip­ment be designed to com­ply with ISO 13849 [7], [8], or IEC 62061 [9]. This is a new require­ment that was added to [2] to help bring Canadian machinery into har­mon­iz­a­tion with the International Standards.

Emergency stop func­tions are required to provide a min­im­um of ISO 13849 – 1, PLc, or IEC 62061 SIL1. If the risk assess­ment shows that great­er reli­ab­il­ity is required, the sys­tem can be designed to meet any high­er reli­ab­il­ity require­ment that is suit­able. Essentially, the great­er the risk reduc­tion required, the high­er the degree of reli­ab­il­ity required.

I’ve writ­ten extens­ively about the applic­a­tion of ISO 13849, so if you are not sure what any of that means, you may want to read the series on that top­ic.

Extra points go to any read­er who noticed that the ‘elec­tric­al haz­ard’ warn­ing label imme­di­ately above the dis­con­nect handle in Photo 5 above is

a) upside down, and

b) using a non-​standard light­ing flash.

Cheap haz­ard warn­ing labels, like this one, are often as good as none at all. I’ll be writ­ing more on haz­ard warn­ings in future posts. In case you are inter­ested, here is the cor­rect ISO elec­tric­al haz­ard label:

Yellow triangular background with a black triangular border and a stylized black lighting-flash arrow travelling from top to bottom.
Photo 6 – Electric Shock Hazard – IEC 60417 – 5036

You can find these labels at Clarion Safety Systems.

Use of Emergency Stop as part of a Lockout Procedure or HECP

One last note: Emergency stop func­tions and the sys­tem that imple­ment the func­tions (with the excep­tion of emer­gency switch­ing off devices, such as dis­con­nect switches used for e-​stop) CANNOT be used for energy isol­a­tion in an HECP – Hazardous Energy Control Procedure (which includes Lockout). Devices for this pur­pose must phys­ic­ally sep­ar­ate the energy source from the down­stream com­pon­ents. See CSA Z460 [10] for more on that sub­ject.

Read our Article on Using E-​Stops in Hazardous Energy Control Procedures (HECP) includ­ing lock­out.

Pneumatic E-Stop Device
Photo 7 – Pneumatic E-​Stop/​Isolation device.

References

[1]  Industrial robots and robot sys­tems (Adopted ISO 10218 – 1:2011, second edi­tion, 2011-​07-​01, with Canadian devi­ations and ISO 10218 – 2:2011, first edi­tion, 2011-​07-​01, with Canadian devi­ations). Canadian National Standard CAN/​CSA Z434. 2014. 

[2]  Safeguarding of Machinery, CSA Standard Z432. 2016

[3]  DIRECTIVE 2006/​42/​EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL  of 17 May 2006  on machinery, and amend­ing Directive 95/​16/​EC (recast). Brussels: European Commission, 2006.

[4]  Electrical Standard for Industrial Machinery. ANSI/​NFPA Standard 79. 2015.

Download NFPA stand­ards at ANSI

[5] Industrial elec­tric­al machinery. CSA Standard C22.2 NO. 301. 2016. 

[6] Safety of machinery – Electrical Equipment of machines – Part 1: General require­ments. IEC Standard 60204 – 1. 2016.  

Download IEC stand­ards, International Electrotechnical Commission stand­ards.

[7] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design. ISO Standard 13849 – 1. 2015.

[8] Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 2: Validation. ISO Standard 13849 – 2. 2012.

[9] Safety of machinery – Functional safety of safety-​related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems. IEC Standard 62061+AMD1+AMD2. 2015.

[10] Safety of machineryEmergency Stop — Principals for design. ISO Standard 13850. 2015.

Download IEC stand­ards, International Electrotechnical Commission stand­ards.
Download ISO Standards 

[11] Control of haz­ard­ous energy — Lockout and oth­er meth­ods. CSA Standard Z460. 2013.