E-Stop Circuits In US Food and Beverage Industry

E-Stop Circuits In US Food and Beverage Industry.


My Colleague and I are new to the food and beverage industry.


We want to know if it is common practice to only have the PLC monitor one NC from the E-Stop and nothing else to determine if a safety circuit is tripped. In the Automotive industry, it is more common to Monitor at least 3 things.

• Safety Circuit, power right after the fuse
• E-Stop NC (E-Stop Output)
• E-Stop NO going only to the PLC

This way the PLC can determine if there is an issue in the safety circuit, and we can signal the HMI to display a message telling the operator what the problem is, and why the machine won't start.


We have been met with bafflement from 2 different controls engineer that came up in the Food and Beverage industry.



Thoughts?

I used to work on sheeting and baking lines.
50 to 100 foot long.
The e-stops always had the NO contact back to the PLC to identify which on was pressed.

In previous jobs, when I traveled to different plants, it was not uncommon to see e-stop circuits like you described. Bear in mind, many of these were dairy plants so product was moving around inside SS pipes. Many didn't see the need to pay for the extra hardware, I/O & indication. Places that had equipment which could chop, grind, etc. usually had more elaborate E-stop circuits, closer to what you saw in automotive plants. In general, food plants didn't seem to have uniformity or complexity in their safety circuitry like some other industries (metals, automotive, etc.).

I've worked in automotive on both the assembly side and process side (currently) so I understand where you are coming from. Most of the automotive plants I've worked for demand a cat 3 at a minimum - even if the risk assessment doesn't require it. It's kind of a CYA thing from what I can tell.

I can't speak to any of the lines/etc on the food and beverage side, but I know many of the systems I build (environmental processes) for the food and beverage industry are very similar.

Yes, I typically just have a wire through a single e-stop to a PLC (or no PLC in some cases - just relay logic). No other safety relays or aux relays.

HOWEVER, I would NEVER just use the E-stop into the PLC and allow the PLC to process the E-stop and start/stop outputs. Use a NC contact to supply the sourced power to the output card / embedded I/O and use a NO contact to monitor that the E-stop is / isn't tripped.

This is essentially a really basic category B system. It is acceptable if all of your motion / heaters / etc are guarded or enclosed and there is no risk to the operator or anyone walking by.

As a side note - I personally make sure I use self-monitoring contacts (they make sure the contacts don't come of the E-stop). The people in my position previously stopped using them because they caused issues in the field if the contacts came off the Estop (Imagine that! A safety device serving it's purpose!). They probably aren't necessary for something so simple, but they help me sleep better at night.

^ That's been pretty much my experience with food and bev. Generally very lax safety since most things are enclosed. I do often include a safety relay after the e-stop button to break output power and disable drives though.

Why would the basic E-stop safety requirements be different in the food industry than in other industries? A pinch point is a pinch point. Same for electrical hazards, etc.

These days an E-stop button needs to be run through a safety relay.

dogleg43 said:

Why would the basic E-stop safety requirements be different in the food industry than in other industries? A pinch point is a pinch point. Same for electrical hazards, etc.

These days an E-stop button needs to be run through a safety relay.

Click to expand...

Most of the equipment I make is a fan enclosed in a box. There is no way to get into it.

I get what you are saying. We have some customers that require a safety relay, but for what we do, most of the time there isn't a pinch point.

N.O. contact to the I/O. channel A&B to your safety relays. so 3 contact sets in a safety switch.

I've been in the cheese and dairy business for over 10 years now, and I have seen a wide variation to how e-stops are handled even inside the same facility. The plant I currently work at has a mixed bag of "proper e-stops" with stand alone controllers or safety rated PLC's, and safety rated contactors. We also have single contact e-stop buttons that run back to standard AB contactors to break the control power to only motor starters. You will also find single contact e-stops that only run to an input of non-safety rated PLC's. Generally, it depends on how old the equipment is, and if it was an in-house job, or purchased from an OEM. The OEM stuff is usually pretty good about having the safety circuit done the "right" way, while our in house work is usually the most lacking.
So having controls guys or gals that have never heard of the concept of three contact e-stop doesn't really surprise me if they have spent all their time working in a plant and not out in the "real world".

Bubba.

I would follow your gut feeling. If you want your machines safer than the industry norm, do it.



On the side, for the reason to put in a proper E-stop circuit that removes the power to the line I have by my desk a SLC5/03 that when put in program mode or when the CPU faults does not turn off any of the outputs that were on. It doesn't turn all the outputs on, just leaves them on. If it faulted and the motor/valve driven objects on can now go past any hard limit switches or other sensors it will keep going, and pressing all the E-stops in the plant wouldn't stop it.



Have your E-stop circuit control the output power and put in the second loop to determine problems. Plus, if there are E-stops in various places, use illuminated E-stops that the N.O. contact lights it see the one pressed can be seen. This is common on automated stamping presses and their feed lines.

I'm in the food and beverage industry for a large nation wide company, our PLCs monitor the condition of each of the E-stop switches, safety relays or MCR, our E-Stop circuits are all hard wired and remove power from motor starters/servos/vfds. Even our production lines that are 30 years old have proper hard wired E-Stop circuits.

When the production line is 200 feet long, with safeties and E-Stops from one end to the other, it's a must to know which safety is the issue.

We also remove source power from the PLC outpot modules, this ensures that valves and solenoids are also powered off for an E-stop event.

I have no idea why these two "controls engineers" would be baffled by equipment safety standards, we get no exemptions from safety sandards.

Safety is safety, we should not differentiate between food industry and the rest. Already I read statements in regards to the same industry. One post said, in general , safety is very lax in food industry and the other post said the opposite thing.

side note, I tend to follow my heart and mind, but not wanting to expose my gut too much :=), the plant safety guy do not buy into that stuff. I certainly will not use any SLC line to do anything safety related. I think what you are trying to do is having different stop categories.
Another post seemed to mingle between safety stop categories with safety integrity levels.

I think some of you are miss understanding. This is not about the function of the safety circuit for actually stopping the machine. I am asking about indicators to the PLC to tell it what is going on. So that it can display detail and correct message to the Operator.

Let's call the PLC monitoring inputs
Safety Power: SP
ESTOP NO: ESNO
ESTOP NC: ESNC

For example
If the SP is ON, and the ESNO is ON, and the ESNC is OFF we know the E-STOP is pressed.

If the SP is ON, ESNO is Off, and the ESNC is ON we know the E-STOP is not pressed.

If the SP is ON, and the ESNO is OFF and the ESNC is OFF, We know there is an ESTOP Contact issue. (PLC won't let the process continue)

If the SP is ON, and the ESNO is ON and the ESNC is ON, We know there is an ESTOP Contact issue. (PLC won't let the process continue) (HMI displays message why)

If the SP is off then we know that the SP is off, without that separate monitoring input we could only assume the E-STOP is pressed.

If the SP is ON then we know that the SP is off, without that monitoring input we could only assume the E-STOP is pressed.

Really the purpose of the NO is as an extra layer of protection so that if the NC on the E-STOP welds at least the PLC can stop the process. There are no pinch points on these machines that we are doing, they are just pumping liquids, so safety requirements are low. Actually, our E-STOP now has 2 NCs in series and we monitor after each one, for a total of 4 inputs but I figured that info would convolute the question.


I'm asking about level of detail giving to the operator/maintenance. Pretty much there is 2 thought processes here first is "safety circuit bad" figure it out yourself. Second option is "problem with the safety circuit here is what is wrong.

What a confusing mess.

The norm is 2x NC or 1x NO & 1x NC (as a pair) to the safety relay to do the job of monitoring the safety circuit and optionally an additional contact of NO to the plc if you want to report which one is pressed.

All you need to do is monitor all the extra NO contacts and if they are all made and the safety relay isn't on after a reset is pressed, pop up an alarm to check the status of the safety relay.

Keep it simple.

I agree with Janner, I have been in automation for over 40 years and worked on many different plants food, air, steel, Gas, Oil, beverage & many other manufacturing industries. I have seen the progressive improvements on safety and in my opinion no matter what the process use dual channel as a minimum with a safety relay that has guided contacts, switch off any outputs that could cause injury by moving parts and on larger systems use the 3rd contact as an indicator. Another important thing to remember is try to ensure that any e-stop that caused a stop situation that the process cannot be re-started on release of the stop and needs to be re-started by a reset or re-start action.