Emergency Stop Testing

[eric9822]

Are there any requirements for periodic testing of emergency stop circuits for industrial machinery? I have done some poking around on OSHA's website and looked in NFPA79 and I can't find anything. We found an e-stop this morning that had been electrically bypassed and since it was at a location operators rarely use we have no idea how long it has been this way. Fortunately the person that discovered it was attempting to stop the machine for a jam and not because he was entangled in the machine. We will never find out who did this but they will be looking for another job if we do. Any hints would be appreciated.

 

[petersonra]

Are there any requirements for periodic testing of emergency stop circuits for industrial machinery? I have done some poking around on OSHA's website and looked in NFPA79 and I can't find anything. We found an e-stop this morning that had been electrically bypassed and since it was at a location operators rarely use we have no idea how long it has been this way. Fortunately the person that discovered it was attempting to stop the machine for a jam and not because he was entangled in the machine. We will never find out who did this but they will be looking for another job if we do. Any hints would be appreciated.

I don't know if there are any such requirements.

I am also pretty sure you can't claim an estop is there to prevent someone from being sucked into the machine. Thats what proper guarding and/or other safeguards are for.

 

[eric9822]

I agree that proper guarding is the first step in preventing injuries and the machine I am speaking of is properly guarded. I have also seen some pretty nasty injuries that were the result of operators reaching around guards and/or defeating interlocks. Thanks

 

[polak]

Not sure if there are any OSHA standards on this but most OEMs state in the operating procedures that e stops and any other safety features should be tested each time the machinery is started for production. I personaly add the check to the operator start up sheet and also add it to a 30 day pm.

 

[VinceS]

Is your E-stop system monitored?

Is your E-stop system monitored?

If you are using a safety monitoring relay, rated for such, each e-stop or e-stop zone will report a failure. This also meets the independent reset specified in NFPA 79. You might design your e-stop locations with tamper seals, No requirement and extra work, which might cause an inspection and testing if missing. This will not fix the issue of the correct person changing the function of your system; but if a seal is replaced and system is modified it will surely narrow the field. My only issue with tamper seals is your operators may learn that a missing seal means a shutdown or BREAK...


PS.... We conduct electrical inspection semiannually, operators are required to test operate at shift startup.

 

[pfalcon]

There is no formal requirement known to me. As suggested earlier, it should be a part of an at least annual check of the machine. At our site we have not found a need for more frequent audits.

From past experience of bringing in many material handling systems you might consider the possibility that the Estop has been this way since installation. We have never had an Estop intentionally bypassed that was not flagged three ways as requiring repair. Most ELs are paranoid about Estops; the rest are merely conscientious.

Consider this:
Our runoff squad checks the functionality of every Estop. But not every Estop is installed at the runoff. In addition several are unwired prior to shipment. In addition most vendors add the Estops to the PLC program as a "redundancy". On installation on our floor every material handling system has a minimum of one improperly wired Estop. Every third system has several incorrectly wired Estops.

Consider this also:
When I go to a runoff, install a machine, or take over care of a new area then I retest all the Estops. I go in the PLC and force all the Estop contacts ON and then test the Estops. If I haven't been in the area before then I expect that every second machine will fail the check. The PLC hides bad wiring practices on the Estops. Where I've been able to determine the source of the bad wiring it has always been bad since installation or before.

 

[pfalcon]

PLC Programming of Estops

PLC Programming of Estops

... I go in the PLC and force all the Estop contacts ON and then test ...

I can't really overemphasize this. And yes it is a pet peeve of mine.

At one time at my site it was forbidden to use a safety contact inside a PLC program for any purpose other than annunciation. The clause was continually violated and rarely checked.

Now the clause states that electronic devices may be used if properly designed. Something which most PLCs are not. It is still continually violated and rarely checked.

Adding safety devices to a normal PLC for any purpose other than annuciation is UNSAFE. It masks wiring errors in the safety circuits. It does not provide redundancy; the safety circuit is supposed to be designed for failure modes in the first place.

Testing your Estops without forcing the PLC inputs ON is not testing your Estop circuitry.

 

[petersonra]

If you are using a safety monitoring relay, rated for such, each e-stop or e-stop zone will report a failure. This also meets the independent reset specified in NFPA 79. You might design your e-stop locations with tamper seals, No requirement and extra work, which might cause an inspection and testing if missing. This will not fix the issue of the correct person changing the function of your system; but if a seal is replaced and system is modified it will surely narrow the field. My only issue with tamper seals is your operators may learn that a missing seal means a shutdown or BREAK...


PS.... We conduct electrical inspection semiannually, operators are required to test operate at shift startup.

A monitoring relay will not detect an estop PB with contacts jumpered out. Only testing will detect that.

 

[VinceS]

You are correct, but...

You are correct, but...

Yes when a person qualified or not decides to conduct an unsafe modification to a system the monitoring relay will not catch it... That is why I mentioned the use of tamper seals. I also mentioned they are not required, will cause extra work, and a possible loophole for slackers seeking downtime. Under all normal conditions a properly monitored tamper seal will eliminate unauthorized modifications. The word normal is used because a irate qualified person with access to proper seals could make a modification.

 

[zog]

Are there any requirements for periodic testing of emergency stop circuits for industrial machinery? I have done some poking around on OSHA's website and looked in NFPA79 and I can't find anything. We found an e-stop this morning that had been electrically bypassed and since it was at a location operators rarely use we have no idea how long it has been this way. Fortunately the person that discovered it was attempting to stop the machine for a jam and not because he was entangled in the machine. We will never find out who did this but they will be looking for another job if we do. Any hints would be appreciated.

Look in NFPA 70B

 

[petersonra]

Consider this also:
When I go to a runoff, install a machine, or take over care of a new area then I retest all the Estops. I go in the PLC and force all the Estop contacts ON and then test the Estops. If I haven't been in the area before then I expect that every second machine will fail the check. The PLC hides bad wiring practices on the Estops. Where I've been able to determine the source of the bad wiring it has always been bad since installation or before.

The PLC is not hiding anything. There should be a hard wired "master on" light that you can use to test the estop circuits that is completely independent of the PLC. Its not a requirement, AFAIK, but I have not seen many machines wthout one.

 

[pfalcon]

The PLC is not hiding anything. There should be a hard wired "master on" light that you can use to test the estop circuits that is completely independent of the PLC. Its not a requirement, AFAIK, but I have not seen many machines wthout one.

Per the book "Master On" and the "Estop" circuit are not necessarily the same circuit though it is a common practice. We receive controls where the "Master On" brings in the Inputs and Indicators separately from the "Estop" reset that permits the hazardous motions.

When the Estop is separately wired in this manner the "Master On" remains lit when the Estop trips. When the program uses inputs from the safety circuits in the logic, other than for indication, it usually does so by kicking the machine out of "Automatic Cycle" or similar. The motion stops and will not resume due to the logic until the Estop is reset. I am finding 15% to 20% of the new machines have the hardwire Estop jumpered out for runoff and not enabled for production. The software input gets landed and masks the hardwire error.

 

[petersonra]

Per the book "Master On" and the "Estop" circuit are not necessarily the same circuit though it is a common practice. We receive controls where the "Master On" brings in the Inputs and Indicators separately from the "Estop" reset that permits the hazardous motions.

When the Estop is separately wired in this manner the "Master On" remains lit when the Estop trips. When the program uses inputs from the safety circuits in the logic, other than for indication, it usually does so by kicking the machine out of "Automatic Cycle" or similar. The motion stops and will not resume due to the logic until the Estop is reset. I am finding 15% to 20% of the new machines have the hardwire Estop jumpered out for runoff and not enabled for production. The software input gets landed and masks the hardwire error.

What book is that?

 

[pfalcon]

What book is that?

SAE HS-1738:2002 Standard for Electrical Equipment for Automotive Industrial Machinery. 9.1.5.1 Master control relay circuits

Admittedly this applies only to those automotive industries that have adopted the HS-1738 but there is no mention of MCR in NFPA79 for general industry. But see NFPA79:2007:9.2.7.3 Stop Function (Cableless Control Functions.) where Estop is required to be a separate device.

Maybe this just dates my age but "Master On", for our industry, has always been used for the "Master Control Relay" and the "Master On PL" shows the relay pulled in. Estop on the other hand is not required to disable the MCR but only to disable hazardous motion. On many machines it is a bad thing to disable the MCR for an Estop.

From the other older posterior wind-sources working here the history of the MCR is pretty simple: Only ELs are supposed to touch the disconnect as a regular part of their job. Therefore we need a "master" start/stop on the front of the machine to turn the power on/off in a proper, non-grievable, fashion. Estops are not permitted to share the same pushbuttons and lights even when they are the same circuit.