Kill steppers on Estop/Kill

[InsanityAutomation]

By definition Estop needs to kill all motion power. Machine must be in a locked state.

Since the term emergency stop may also implicate electrical requirements depending on where its used, should we relabel this? I have yet to see a printer board compliant to PLd / Class 3 safety....

Note : what we have here is at BEST case PLb with a category 2 stop. With power cutoff to steppers and heaters we get closer to a category 0 stop but still PLb. Emergency stop needs to be category 0 or 1 and typically is PLd or e

ISO 13850 limits the selection of stop category to Category 0 or 1 and excludes Category 2. This exclusion can be found in NFPA 79, IEC 60204 – 1, and CSA C22.2 No. 301 as well. Category 2 may only be used for operational or “normal” stopping functions.

https://machinerysafety101.com/2010/09/27/emergency-stop-categories/?doing_wp_cron=1566846639.6410090923309326171875

One more critical paragraph to note :
Both ISO 13849 – 1 and IEC 62061 [8] base the initial requirements for reliability on the outcome of the risk assessment (PLr or SILr). If the stopping condition is part of normal operation, then simple circuit requirements (i.e. PLa, Category 1) are all that may be required. If the stopping condition is intended to be an Emergency Stop, then additional analysis is needed to determine exactly what may be required.

Note that PLa Category 1 is NOT considered an Emergency stop.

[thinkyhead]

Note that the kill stops all ISR processing and never returns to the main loop, so some of this stuff is pointless. Why empty a queue or stop a job timer that will never get processed?

cli(); // Stop interrupts

Note that M112 is known across several firmwares and defined in RepRap wiki as "Emergency Stop" and can be considered the command to attach to the big red button.

[InsanityAutomation]

Note that the kill stops all ISR processing and never returns to the main loop, so some of this stuff is pointless. Why empty a queue or stop a job timer that will never get processed?

cli(); // Stop interrupts

Note that M112 is known across several firmwares and defined in RepRap wiki as "Emergency Stop" and can be considered the command to attach to the big red button.

I will probably need to make a visit over there and open up a forum topic on changing it across multiple platforms at some point, it is something that needs to be addressed. last time anybody wants is legal liability opened up because of that terminology. Cuz I was visiting the lack of stepper power being removed based on an issue that was open not long ago I went over the minimum requirements PLa and b again as well as current allowed guidelines in the NFPA 79 and E annex and grabbed a few key points that note how important it is that we don't use that exact term.

[thinkyhead]

last [thing] anybody wants is legal liability opened up because of that terminology.

GPLv3 disclaims suitability for any purpose, and Marlin is just a starting-point for a firmware, not intended to be used by everyone in every situation "as-is." It is up to those who use Marlin to bring it up to standards before they sell units with Marlin on it. It is not our liability or even responsibility to know or adhere to industrial standards in every municipality.

[InsanityAutomation]

last [thing] anybody wants is legal liability opened up because of that terminology.

GPLv3 disclaims suitability for any purpose, and Marlin is just a starting-point for a firmware, not intended to be used by everyone in every situation "as-is." It is up to those who use Marlin to bring it up to standards before they sell units with Marlin on it. It is not our liability or even responsibility to know or adhere to industrial standards in every municipality.

Sure it's not ours, but why leave others open to it knowing that none of them meet the requirements of the term?

[thinkyhead]

Sure it's not ours, but why leave others open to it knowing that none of them meet the requirements of the term?

I'm just stating where the liability lies. Marlin is a hobbyist reprap project that "serious" manufacturers decided to adopt. They should certainly know better than to put it out there without passing rigorous testing. Maybe they can get away with this by selling as "kits" but AFAIK every product has to be certified and apparently Marlin is passing those tests.

[Roxy-3D]

last [thing] anybody wants is legal liability opened up because of that terminology.

GPLv3 disclaims suitability for any purpose, and Marlin is just a starting-point for a firmware, not intended to be used by everyone in every situation "as-is." It is up to those who use Marlin to bring it up to standards before they sell units with Marlin on it. It is not our liability.

I agree. Marlin does not claim to comply with any ISO or ANSII standard. However, it might be best to make sure nobody ignorantly jumps to the conclusion that it does. We should be able to find a wording or phrase that implies 'Emergency Stop' but doesn't use those exact words.

Perhaps something like 'Crisis Stop' or 'Immediate Stop' or 'Immediate Crisis Stop' would do that? I agree the GPL gives the Marlin Team a good shield against liability. But at the same time, when somebody's house burns down, it would be nice to remove any bogus arguments from their lawyer's quiver of arrows.

[InsanityAutomation]

Sure it's not ours, but why leave others open to it knowing that none of them meet the requirements of the term?

I'm just stating where the liability lies. Marlin is a hobbyist reprap project that "serious" manufacturers decided to adopt. They should certainly know better than to put it out there without passing rigorous testing. Maybe they can get away with this by selling as "kits" but AFAIK every product has to be certified and apparently Marlin is passing those tests.

You would think but not quite. This lands in electrical code outside what you would see in most areas. It's covered under CE, however that's a self cert and if the vendor is unaware of the regulation it skips through. Many times you end up with things certified simply because the parts individually are and not the application.

Even in the industrial world there is very little actual inspection on this type of thing until an accident or report has occured and OSHA is involved.

[thinkyhead]

The thing is, once you say "we will accept responsibility that this is perfect" then you really are putting yourself on the hook.

[InsanityAutomation]

The thing is, once you say "we will accept responsibility that this is perfect" then you really are putting yourself on the hook.

We're not, we are removing the terminology that may falsely give that impression!

[tpruvot]

what about some emergency gcode (optional config) to run whatever you want on printer halted state ?

I agree some boards might be dangerous in this state, like mosfets heating forever or such... even if this specific case seems handled...

[InsanityAutomation]

what about some emergency gcode (optional config) to run whatever you want on printer halted state ?

I agree some boards might be dangerous in this state, like mosfets heating forever or such... even if this specific case seems handled...

It's a hardware problem. Safety regulation calls for a fail safe fault tolerant circuit on an emergency stop. Software safety must have dual monitoring processors and a checksum compare. Hardware needs a time differential monitor. Safety commands over bus need to have checksum validation and handshaking (see rt-ethernet). I'd like to see us step back from this realm and not invite confusion.

Please keep in mind, my day job is industrial automation. I'm use to dealing with PLd and PLe category 3 and 4 safety every day. The requirements of a 3d printer barely make PLb . It's not as serve but I do think it needs to be addressed.

[tpruvot]

well, i imagine stopping Z stepper on some printers can be dangerous too :p

[AnHardt]

what about some emergency gcode (optional config) to run whatever you want on printer halted state ?

Strictly against that! The kids here will send "SOS" in Morse code via a GWatt Tesla coil while burning Micky Mouse patterns in steaks, just out of boredom. That's about that absurde as the games.

[AnHardt]

Some hardware designs are are simply to unsafe to sell them.
A gravity dropping Z-axis is a no go. You have to either to use a hardware brake or a flatter thread or a lifting bed.
PS_ON shouldn't simply cut the low voltage circuit, but separate main power. To switch the machine on you have to press a physical momentary button until the machine is powered and holds itselves.
All that AUTOPOWER options are a KO-criteria when used together with auto-start-files.
Shouldn't smoke detectors be a duty on all machines? (Maybe except from laser cutters witch have other more important safety problems)
Is a safe machine without door-switches possible?
Is the common use of one hardware switch possible for safety-axis-end-stops and home-detectors?

---

It's always a trade-off between the risk, cost and effort we are able/allowed to take.

There is always a saver option - but it will never be risk free.

[AnHardt]

If someone really wants to make Marlin driven machines safer, a door switch would be a step forward.
Here not't the switch itself and the detection is the problem, but what to do and how to recover.
At the moment we have two options to stop the printer.

• emergency stop - what is not recoverable but fast
• stop accepting new code - here it can take a while until the planer buffer is empty.

We do need a "fast deaccelerated recoverable stop".

[AnHardt]

An other good target for more safety would be to reduce the risk of someone switching of the heater_protection because of false positives. That's difficult to tune and most users don't understand how it works and whats the worst case they have to expect.
The problem lies mostly in the delays and the fact the heating curve gets flatter the heater already is.

If we could use Newtons Low of Cooling we'd get a temperature independent konstant describing how much energy is lost. That constant would only differ with the airflow over the heater and amount of extruded filament or for the bed, how much of the bed is covered by material. So the constant is not fix but will stay in a value range. To calculate you also need a environmental temperature ( or chamber). At the moment i have no idea how much these constants can differ, it needs experiments.

A autotune procedure for the conventional heater protection parameters would also be fine.

[comps]

What does the specification say about machines which are inherently unsafe when all power is cut?

If category 0 is "equivalent to pulling the plug", we could extend it to switch off the PSU (if PSU_CONTROL is enabled), but that could lead to a 300C extruder heat-creeping to plastic parts that hold it, Z axis falling down to bed, etc.

None of these would be a problem in proper industrial machinery as they would certainly be considered in evaluation of emergency situations and proper passive fall-backs would be in place, but we're often dealing with DIY built machines in RepRap.

OTOH; some people use Marlin with ballscrew-driven CNC routers / plasma cutters / other machines where cutting all power and freewheeling the motors makes sense (given that lead/ball screws can pinch really hard, ie.), so it's hard to say what should be the default.

[InsanityAutomation]

@AnHardt There are many ways which hardware / software can work together to make things much safer, I concur. The fast decelerated stop is also a good concept, closer to stop category 1 if we actually had a failsafe way to cut power. But without hardware and software matched we still cant call it a safety function and use the term Emergency stop.

Im all for the various methods of making it safer, but that goes beyond the scope of the immediate point of changing the verbiage to prevent the misconception that this is a safety method.

@comps You need to balance the dropping Z against the potential force held. For example, which is more dangerous, the bed of a CoreXY dropping down or the persons hand pinched between the hotend and build plate? Specification is that it must fail to the safe state whatever that may be. This is the same with power loss. In the case above, cutting power is still safer. The Z drop will be un-powered and just the portion of weight not held by the motion system. The bed locked on somebodies hand though leaves them stuck with power being returned required to get them out. Industrially, we only apply brakes on motors traveling vertically in most cases. We also have safe torque off functions in the drives.

@tpruvot given what can realistically be done by these machines in a safe state I would have to completely disagree as well. Any configurable action will be abused and will likely compromise the safe operation.

[thinkyhead]

I've applied changes so that if the kill is caused by M112 then the steppers will be disabled. This assumes that M112 is attached to a big red button. In all other cases, dropping the delta effector or the print bed is not "known to be safe" so the steppers are left powered for other kill events.

[dc42]

An other good target for more safety would be to reduce the risk of someone switching of the heater_protection because of false positives. That's difficult to tune and most users don't understand how it works and whats the worst case they have to expect.
The problem lies mostly in the delays and the fact the heating curve gets flatter the heater already is.

If we could use Newtons Low of Cooling we'd get a temperature independent konstant describing how much energy is lost. That constant would only differ with the airflow over the heater and amount of extruded filament or for the bed, how much of the bed is covered by material. So the constant is not fix but will stay in a value range. To calculate you also need a environmental temperature ( or chamber). At the moment i have no idea how much these constants can differ, it needs experiments.

A autotune procedure for the conventional heater protection parameters would also be fine.

This is what RepRapFirmware does. Auto tuning is used to establish the parameters of a first order plus dead time process to model the heater, which relies on Newton's law of cooling This model is used to calculate two sets of PID constants, and to compare actual with expected heater behaviour during the heating process.

[InsanityAutomation]

@repetier @MagoKimbra Figured id ping you guys on this one as well. I also edited the entry on the RepRap Wiki this morning.

[InsanityAutomation]

@thinkyhead Any opposition to also killing steppers on motion related faults for non deltas (eg homing failed where its likely that an axis is buried into the end of travel and the switch is bad, or TMC driver errors?

[dc42]

FWIW, RepRapFirmware has always killed power to all motors on all machine architectures when M112 is used. Nobody has complained that this is a bad thing. For deltas where the motors don't have enough detent torque to stop the effector falling when the motors are powered off, the usual solution is to use a retractor (constant-force spring device) to help support the effector or the Bowden tube - but not just to handle M112.

[InsanityAutomation]

@dc42 The last changes he pushed made M112 the only shutoff method that kills steppers. Homing failed, thermal runaway, min/max temp currently do not. Do you drop them on those events as well?

In my mind, on a kill it should kill everything. I understand his reservation on deltas, but personally I still want to kill steppers more frequently than what is done even now.

[dc42]

We don't kill the steppers on those other events, but we plan to change RRF to turn off power to the controller if possible if a heater fault occurs (similar to thermal runaway or under/over-temperature in Marlin-speak) and turning off the heater doesn't contain it.