Emergency Stop Design Coordination

Emergency Stop design coordination gives the PLC Pro an opportunity to communicate with the design team about how the finished installation’s operation, sequencing, loads, products, process conditions, and stored energy may affect the Emergency Stop response before the mechanical, electrical, controls, and safety-system designs become difficult or costly to change.

During commissioning, the PLC Pro observes the completed installation’s actual Emergency Stop response, reports any safety risk or other unacceptable installation behavior, and uses that observed behavior to implement the E-Stop Mode response in the PLC Pro’s ordinary control program (the control program).

The PLC Pro should be included while the mechanical, electrical, controls, and safety-system designs can still be coordinated and changed. His or her knowledge of installation operation, sequencing, and motion control may identify hazards, interactions, or required stopping behavior before hardware is selected and installed. Addressing those issues during design can avoid costly rework during commissioning and prevent the control program from being expected to compensate for an unsuitable physical or safety-system design.

The PLC Pro may recognize interactions that are not apparent when each device is considered separately. Removing power from one device may change the load on another device, release stored energy, remove a holding function, interrupt a required controlled stop, or create motion elsewhere in the installation. The PLC Pro should bring those interactions to the design team so they can be evaluated as part of the complete Emergency Stop response.

For example, a wide gantry may be driven by separate motors and drives on its two sides. If torque is removed from one drive while the other side continues moving or decelerating, the powered side may pull the gantry out of square, bind its guides, and place unexpected loads on the other drive and the mechanical structure. The PLC Pro may recognize that both drives must be treated as one coordinated motion system and help the design team define the required synchronization, stopping behavior, and timing of torque removal. The safety-system design must then implement those requirements using appropriate safety-related controls and drive functions.

The PLC Pro is sometimes brought into a project after the mechanical, electrical, controls, and safety-system designs are substantially complete. Whether involved during design or brought in later, he or she must understand the intended Emergency Stop response and observe and verify how the completed installation actually responds when that response is invoked.

The PLC Pro should observe the response under representative operating conditions, including active motion, applied loads, retained product, stored energy, and coordinated equipment. This may reveal interactions, continued movement, loss of a holding function, or other behavior that was not anticipated during design.

For example, a vertical axis may rely on drive torque to hold its load while a spring-applied brake is released. During Emergency Stop testing, the PLC Pro may observe that drive torque is removed before the brake is fully applied, allowing the axis to drop. That behavior must be reported and corrected through changes to the drive, brake, controls hardware, or safety-system design before the installation is placed into service.

After observing the completed installation’s safety-system response, the PLC Pro implements the control program’s E-Stop Mode response to coordinate with that behavior. The control program implementation must reflect the response the installation actually produces, including active functions (for example, drive stopping or braking functions) and the conditions that exist after the safety system is reset.

A safety PLC may execute part or all of the Emergency Stop response through validated safety-related application software. Those programmed actions are part of the safety system, not the control program’s E-Stop Mode response.

The PLC Pro must understand which actions are performed by the safety PLC, which functions may activate, what safety-system status is available to the control program, and what actuator states, retained commands, or process conditions may persist through the Emergency Stop response and affect operation after reset. He or she uses that information to coordinate the control program’s E-Stop Mode response with the safety-related response without interrupting, duplicating, or conflicting with it.

For example, a spring-return valve may retract a pneumatic carton reject pusher when electrical power to the valve solenoid is removed during an Emergency Stop. If the control program retains the reject command, resetting the safety system may immediately re-energize the valve and extend the pusher. The control program may therefore need to clear or inhibit the reject command when E-Stop Mode is entered so the pusher remains retracted after reset until a new reject operation is deliberately initiated.

The safety system places the hardware layer into its required safe condition during the Emergency Stop response. After the safety system is reset, the control program manages recovery by reconciling retained commands, actuator states, and operating modes so reset does not cause unintended operation and movement occurs only in response to a separate, deliberate request.

• It is best to include the PLC Pro throughout the installation design phase.
• During commissioning, the PLC Pro must observe and verify the completed installation’s actual Emergency Stop response.
• Report and correct any safety risk or other unacceptable installation behavior before the installation is placed into service.
• Validated safety-related application software is part of the safety system, not part of the control program’s E-Stop Mode response.
• The control program’s E-Stop Mode is used to manage recovery after the safety system is reset.