Emergency stops, stopping performance and safe restart

Every safeguarding measure eventually depends on one thing: stopping the hazard. A light curtain detects a hand, an interlock senses a door opening, an operator hits an emergency stop button. In each case the machine must then come to a safe state quickly and stay there until someone deliberately restarts it. This lesson covers how machines stop, how stopping performance is measured, how emergency stops work, and how to prevent unexpected start-up.

Stop categories

NFPA 79, Electrical Standard for Industrial Machinery, which the NEC references for industrial machinery, and IEC 60204-1 define three stop categories:

An emergency stop must be Category 0 or Category 1. Category 2 leaves power on the actuators, so a fault could restart motion, and it is not permitted for emergency stops. Choosing between Category 0 and Category 1 is an engineering decision: cutting power immediately can let a heavy spindle coast for a long time, while a controlled stop using the drive's braking can stop it much faster before removing power.

Emergency stop devices

An emergency stop is a complementary protective measure, not a substitute for guarding. It is for situations where something has already gone wrong: a person caught, a part flying, a fire starting. ISO 13850 sets the requirements. The key points are:

• The actuator is red, on a yellow background where practicable, usually a mushroom-head push button, a pull cord or a foot pedal designed for emergency use.
• It latches when operated, so the stop command is maintained until the device is deliberately reset by hand.
• Resetting the emergency stop must not by itself restart the machine; a separate start command is needed.
• Emergency stop devices are placed at each operator station and other places where they may be needed, readily accessible and not hidden behind guards.
• The emergency stop function overrides all other functions and operating modes, and it must be available and operational at all times.
• The emergency stop function must meet the performance level required by the risk assessment; PL c or higher is common, and many machines need PL d.

Pull-cord or rope-pull switches along conveyors let a person stop the conveyor from anywhere along its length. They must be tensioned correctly, detect both a pull and a broken or slack cord, and be tested regularly. On roll mills and calenders, body bars and trip wires at the front of the rolls allow an operator who is being drawn in to stop the machine, and standards set how quickly the rolls must stop.

Stopping performance

The time and distance a machine takes to stop decide whether a safeguarding device can protect anyone. They also change over time. Brakes wear, hydraulic valves slow down, clutches slip, loads change and settings are adjusted. A machine that stopped in 120 ms when it was commissioned may take 200 ms after years of use, and a light curtain positioned for 120 ms is then too close.

Stopping time is measured with a stop-time measurement device. A probe or beam break triggers the stop, and an encoder or sensor records how long and how far the hazardous part travels before it stops. Measurements are repeated several times in the worst-case condition, for example at maximum speed with the heaviest tooling, and the longest time is used. Presses with presence-sensing devices need brake monitors that warn or stop the press if stopping time increases beyond a set limit.

Preventing unexpected start-up

Many serious injuries happen when a machine starts while someone is inside it: a co-worker presses a start button not knowing a maintainer is behind the guard, an automatic cycle resumes when a sensor clears, stored pneumatic pressure moves a cylinder, or a control fault energizes a motor. ISO 14118 covers the prevention of unexpected start-up. The main measures are:

• Isolating and locking out energy sources before entering a hazard zone, covered in HSE-210 and Lesson 10.
• Designing controls so that closing a guard, resetting an emergency stop or clearing a sensor does not restart the machine by itself; a separate deliberate start command is needed.
• Placing reset and start buttons where the person pressing them can see the whole hazard zone and confirm no one is inside, and outside the zone so they cannot be pressed from inside.
• Using trapped-key or personal lock systems on walk-in cells so the machine cannot start while a key is with the person inside.
• Releasing or blocking stored energy: bleeding air and hydraulic pressure, lowering or blocking raised parts, discharging capacitors.
• Providing start-up warnings, such as horns or lights before an automatic machine starts, where people could be near it.

Reset, restart and operating modes

Machines often have several modes: automatic production, manual or jog for setup, maintenance and cleaning modes. Each mode can change which safeguards are active. For example, a setup mode might allow the machine to run at limited speed with a guard open, using an enabling device held by the setter. Standards require that mode selection be controlled, for example by a key switch, that the selected mode override other modes, that only the safeguards appropriate for that mode are suspended, and that reduced speed, hold-to-run or enabling devices replace them. A common cause of injury is a machine left in a mode in which guards are muted.

Emergency stop placement and testing

Emergency stop devices are only useful if a person can reach them when needed. They are typically placed at each operator station, at each entry to a cell, along conveyors at intervals so a person is never far from one, and on portable teach pendants. A good test is to stand where a person could be trapped and ask whether they, or someone nearby, could reach an emergency stop. Emergency stops should be tested regularly, often at the start of each shift on high-risk machines and at least as often as the manufacturer recommends. A test confirms that all hazardous motion stops, that the device latches, and that resetting it does not restart the machine.

Records matter here too. Keep a log of measured stopping times for each safeguarded machine, with the date, conditions and the safety distance they support. A rising trend is an early warning that brakes, clutches or valves need attention, long before the stopping time becomes dangerous.

A final point concerns power failures. When power returns after an outage, machines must not restart by themselves. Controls should require a deliberate start command after power is restored, so that people who entered the machine during the outage are not caught when it resumes.