Is the E-STOP a reduction measure?

Everyone working around stage machinery and equipment has seen the noticeable red-circular push button with a yellow background installed on machines, controllers, consoles and located on theatre walls. Normally, this red button is labelled as an EMERGENCY STOP — and if pressed — stops machinery or equipment in motion.

The Emergency Stop button, often called an E-STOP, is a well-known device designed to be pressed in case of an emergency, when a hazardous situation needs to be urgently ended or averted.

This article is not intended to argue the technical aspects of the emergency stop function or its design architecture. It will not provide guidance concerning the stop categories, emergency stop elements, equipment, actuators or the location of the emergency stop stations. We would like to explain to designers, system integrators and users: the intended use of the Emergency stop function, the requirements, and the safety purpose.

Emergency Situations vs Foreseen Situations

The E-STOP is a function intended to avert arising or reduce existing hazards to persons, damage to machinery or to work in progress and is intended to be initiated by a single human action¹. Access to an Emergency Stop button provides the user with a means to react to an immediate situation and ideally stop a hazardous action before the risks become a reality. The hazardous situation which might require the use of the Emergency Stop must be considered as an “emergency hazardous situation” rather than a “foreseen hazardous situation” and the difference between these two situations needs to be well understood.

A “foreseen hazardous situation” is an occurrence which can be reasonably predicted during the design phase, that can be assessed during the machinery risk analysis and the resulting risk should be adequately reduced in the machinery risk reduction phase.

When designing a machine it is important to assess and reduce the risks—when reasonably possible—by implementing the following hierarchical principles:

1) reduce hazards as far as possible (inherently safe machinery design),

2) implement complementary protective measures and safeguards in relation to hazards that cannot be reduced with inherently safe design,

3) inform the users of the residual risks that are still present and how to keep such residual risks under control.

However, there are hazards that cannot be reasonably foreseen. Also, they may have a complex number of variables that will impede an efficient or practicable risk reduction. The “un-foreseen hazardous situations“ can be addressed with the use of the Emergency Stop System. In fact, the purpose of the emergency stop function is to avert actual or impending emergency situations arising from the behaviour of persons or from an unexpected hazardous event.²

When people are exposed to hazards, we would underline that it is the unexpected behaviour of persons that can be addressed with the emergency stop rather than the foreseeable human misbehaviours.

The E-STOP is not a measure of prevention

The emergency stop function is a complementary protective measure and shall not be applied as a substitute for safeguarding measures and other functions or safety functions³.

Besides the fact that the Emergency Stop should be used only in the event of unforeseen hazardous situations, the harmonised standards of the Machinery Directive related to the principle of design for the emergency stop states the Emergency Stop function cannot be used as substitution for protective measures.

Functional safety protective measures are proactive measures, meaning that these are measures conceived to anticipate accidents and minimise response times with the intent of decreasing the number of injuries that may occur in a workplace.

On the contrary, the Emergency Stop function is a reactive measure, which “might“ be actioned when it is perceived that a hazard is about to turn into immediate source of injury. If nobody is pushing an E-STOP the injury will likely occur.

During the last 6 years, we’ve trained more than a hundred people in Stage Machinery Risk Assessment and have had many students from all over the world. In every training session, there was at least one trainee who experienced an “unintentional start“ of stage machinery. For example winches, hoists, lifts, turntables, or wagons that randomly initiate movement without the intervention of an operator. In all those events, “someone“ pushed the Emergency Stop.

The ISO 12100 standard state that the emergency stop function cannot be considered as measure of prevention of unexpected start up⁴. Consequently, relying on an Emergency Stop to halt unexpected movements not only is prohibited, but actually in many cases could even be an inappropriate protective measure.

Interpretations and the Court of Law

We know that the provisions contained in the standards are recommended requirements rather than compulsory measures and in some circumstances those requirements can be enforced through national law, although any deviation from such recommendations are difficult to sustain and argue.

Nevertheless, at the end of the day, the exact interpretation of a standard requirement does not exist.

Standard provisions are not expressed as absolute requirements, but as principles. These establish the basis on which common expectations can confidently be held, whilst allowing some flexibility in interpretation and application. The exercise of this flexibility has to be based on a soundly reasoned consideration of what is appropriate, reasonable, necessary and practicable in any particular context.

Responsibility for interpreting a standard rests with its user, informed where necessary by appropriate expert advice.

Ultimately, the only body with the power to give a definitive interpretation is a court of law⁵.

In 2014, Mr. Harrison Ford was injured by a hydraulic door whilst filming Star Wars: The Force Awakens. He was hit by a door which was designed to mimic the action of a door on the original set (1.2 x 2 m door, nominal speed 1.2 m/s) and could have been killed if someone had not pushed the Emergency Stop button since the operator did not have any visibility of the hazard zone.

The court said that the firm had failed to share its risk assessment with the person exposed to the risk and that if the wrong button had been pressed it would have continued to crush down on Mr. Ford.

Judge Francis Sheridan said it was “deplorable” that the door relied upon human intervention to stop it from closing.

The Star Wars production company was fined £1.6 million⁶.

Conclusions

Our recommendation for all control system manufacturers is to channel their efforts into the basic functional safety requirements—for example the integrity of the Hold-to-Run and stop on Deadman release—rather than designing and advertising SIL3 Emergency Stop systems as the key safety-related feature of their control systems.

Besides giving to the user a false perception of safety, there is no point whatsoever in having SIL3/PLe Emergency Stop architecture in place if the proactive measures and basic safety functions are either unreliable or based on unknown safety integrity. For more information, read Robin J Carver’s dissertation related to the Performance Level for an emergency stop⁷.

An unintentional machinery start or stop is not an emergency situation but a foreseeable recipe for a disaster.

It is a “deplorable“ design approach made even more disgraceful by the misleading impression that if there is a problem… you can push the Emergency Stop.

References
^{1. EN 13850-2015 – 3 – Terms and definitions – point 3.1 emergency stop (E-stop), emergency stop function}
^{2. EN 13850-2015 – 4 – Safety requirements – 4.1 General requirements – 4.1.1 Emergency stop function – point 4.1.1.1}
^{3. EN 13850-2015 – 4 – Safety requirements – 4.1 General requirements – 4.1.1 Emergency stop function – point 4.1.1.3}
^{4. EN 13850-2015 – 4 – Safety requirements – 4.1 General requirements – 4.1.1 Emergency stop function – point 4.1.1.2}
^{5. BSI-BS0 A standard for standards – Principle of Standardisation}
^{6. Chaplin, Chloe, “Star Wars production company to pay 1.6m…”, Evening Standard, 12 October 2016, https://www.standard.co.uk/news/uk/star-wars-production-company-ordered-to-pay-ps1-6m-after-harisson-ford-had-his-leg-crushed-on-set-a3367706.html}
^{7. The Emergency Stop Button – the button of last resort | Robin J Carver – Chartered Safety Practitioner}