Two-Hand Control Devices

What is a Two-Hand Control Device

A two-hand control device (the abbreviation THCD appears throughout ISO 13851) is a safeguard that requires the simultaneous and sustained operation of two separate control actuating devices, one for each hand, to start and maintain a hazardous machine function. The defining behavior is simple: if either hand is removed from its actuator during the dangerous motion, the output signal ceases and the machine must stop or reverse. Because both hands are committed to the controls, and the controls are placed at a verified distance from the hazard, the operator physically cannot have a hand at the point of operation while the machine is dangerous.

The device is a complete system, not just a pair of buttons. A two-hand control consists of three functional parts: (1) the two control actuating devices, which may be mushroom or guarded pushbuttons, palm buttons, capacitive or optical touch buttons, or in some legacy presses mechanical valves; (2) the wiring and contact arrangement that carries the two independent signals; and (3) the logic unit, almost always a dedicated two-hand control safety relay or a safety controller, that evaluates synchronism, monitors for faults, and switches the machine actuator. The most common point of confusion on a purchase order is treating the buttons and the relay as separate unrelated parts. They form one certified safety function and must together meet the required type and performance level.

Two-hand control has a long industrial history tied to the mechanical power press. In the early twentieth century, amputation injuries on full-revolution clutch presses were among the most severe in manufacturing, and requiring both hands on widely spaced controls was the first practical engineering answer. In the United States, OSHA codified two-hand trip and two-hand control concepts in 29 CFR 1910.211 and 1910.217. In Europe, the function was standardized as EN 574, which the international community replaced in 2019 with ISO 13851, harmonizing the type definitions and aligning the control-system requirements with the modern ISO 13849-1 performance-level framework rather than the older category-only approach.

It is important to be honest about the limits of the device, because misuse is common. A two-hand control protects only the operator whose hands are on the buttons. It offers no protection to a second worker reaching into the machine, no protection once the cycle becomes automatic, and no protection during the return stroke of a press that rises on its own. For these reasons ISO 13851 and the press-specific standards treat two-hand control as one element in a layered safeguarding strategy, frequently paired with a safety light curtain or fixed guarding on the sides that the operator's body does not block.

The engineering value of a well-specified two-hand control is that it converts a behavioral rule, keep your hands out, into a physical interlock that cannot be satisfied any other way, as long as the device resists defeat. The entire body of standards around two-hand controls is, in effect, a catalogue of the ways operators have historically defeated them: tying down one button, wedging a stick across both, holding both with one forearm, or operating a second person's controls. Synchronous actuation, minimum actuator separation, anti-repeat, and fault monitoring all exist to close those specific gaps.

ISO 13851 Type Classification

ISO 13851 defines three types of two-hand control, with Type III subdivided into A, B, and C, giving five practical options. The types are distinguished by which functional characteristics they enforce. Five characteristics apply to every type: use of both hands, a defined relationship between the input actuation and the output signal, cessation of the output signal when either actuator is released, prevention of inadvertent operation and defeat, and re-generation of the output signal only after both actuators have first returned to the off position. Two further characteristics separate the types: synchronous actuation within 0.5 s, and single-fault tolerance in the control system. The table below maps the characteristics to the types.

Type I is the simplest. It requires both hands and stops on release, but it does not mandate synchronous actuation and is built as a single channel without fault tolerance. ISO 13851 specifically warns that when a Type I device is being selected, the designer must carefully judge whether the absence of synchronous actuation and the basic re-generation behavior are acceptable, which in practice limits Type I to very low-risk applications established by a rigorous risk assessment.

Type II adds the synchronous-actuation requirement, the 0.5 s window between the two buttons. This is the feature that defeats the classic tie-down, because a permanently held button can never fall within 0.5 s of a fresh press. Type II remains a single-channel architecture, so a single component fault could still leave the safety function impaired without being detected.

Type III is the family used in the overwhelming majority of modern machines. All three sub-types enforce both hands, synchronous actuation within 0.5 s, and release-before-restart. They differ only in control-system structure, which is where the link to ISO 13849-1 becomes decisive. Type IIIA is effectively single-channel with basic measures, suited to lower-risk duty. Type IIIB introduces redundancy and monitoring so that a single fault does not cause loss of the safety function, although fault accumulation is a consideration. Type IIIC is the most robust, with redundant channels and continuous cross-monitoring so that a single fault is detected, typically at the next actuation, and never results in a dangerous failure of the safety function.

The selection logic is risk-driven: the higher the severity, frequency, and difficulty of avoidance of the hazard, the higher the type required. For a small bench riveter a Type IIIA device may be appropriate, while a large mechanical power press with severe amputation risk will demand Type IIIC. Manufacturers reflect this directly in their catalogues. Pilz, for example, offers the PNOZ s6 safety relay for Type IIIC monitoring and the PNOZ s6.1 for Type IIIA, the difference lying entirely in the diagnostic depth of the channel monitoring rather than in the buttons themselves.

Control Architecture and Performance Level

The 2019 edition of ISO 13851 made an important change from its predecessor EN 574: the safety-related parts of the control system are now expressed as a Performance Level (PL) per ISO 13849-1, or as a Safety Integrity Level (SIL) with an allocated hardware fault tolerance per IEC 62061, instead of being described only by the older categories. In practice both descriptions coexist on datasheets, because the categories of ISO 13849-1 still define the architecture, and the PL is the achieved safety performance derived from that architecture together with component reliability and diagnostics. The table below shows the typical correspondence engineers use when matching a two-hand control type to a control-system architecture.

The Performance Level scale runs from PL a (lowest) to PL e (highest), each band corresponding to a range of average probability of dangerous failure per hour. The required PL for a given machine is determined by the risk graph in ISO 13849-1, weighing severity of injury, frequency and duration of exposure, and possibility of avoiding the hazard. The achieved PL of the implemented two-hand control must equal or exceed the required PL. For a two-hand control intended to prevent severe, frequent, hard-to-avoid hazards, the risk graph typically points to PL e, which is why Type IIIC and Category 4 are the default for serious press applications.

Category 4 architecture, the structure behind Type IIIC, requires two independent channels arranged so that a single fault does not lead to loss of the safety function, and so that the single fault is detected at or before the next demand on the safety function. In a two-hand control this means each button feeds an independent channel, the two channels are continuously compared, and any discrepancy, a welded contact, a short between channels, a stuck button, latches the output off and prevents a new cycle until the fault clears. This is what distinguishes Type IIIC from Type IIIA, where the buttons may share a simpler series contact arrangement that cannot reveal certain faults.

The monitoring logic is realized by the safety relay or safety controller, not by the buttons. Dedicated two-hand control modules implement the synchronicity timer, the channel comparison, the anti-repeat lockout, and the output switching as a tested, certified function block. Examples in current production include the Pilz PNOZ s6 and PNOZ s6.1 (PNOZsigma range), Schneider Electric Preventa XPS-U two-hand monitoring modules, Rockwell Automation Guardmaster two-hand control monitoring relays paired with Bulletin 800Z Zero-Force Touch Buttons, DOLD safety modules from the SAFEMASTER range, and Comitronic-BTI COM3C. Buying the buttons and the module from a coordinated product family is the simplest way to guarantee that the declared type and PL are valid as a system.

One subtle point engineers miss is that the achieved PL depends on the full safety function, from the buttons through the monitoring module to the final switching element such as a contactor. A Category 4 two-hand module wired to a single non-monitored contactor cannot deliver PL e at the machine, because the output stage becomes the weak link. Mirror contacts or feedback monitoring of the contactors, the external device monitoring (EDM) input on most safety modules, must be wired and used for the full safety function to reach the rated level.

Safety Distance and Placement

A two-hand control only works if the actuators are far enough from the hazard that a released hand cannot reach the danger zone before the machine stops. This is governed by ISO 13855, the standard for positioning safeguards with respect to the approach of the human body. The minimum distance is calculated with the general formula S = (K x T) + C, where S is the minimum distance in millimetres from the danger area to the actuators, K is the approach speed, T is the total stopping time of the whole system, and C is an additional distance.

For a two-hand control, the approach speed K is taken as 1600 mm/s, the value the standard associates with hand and body movement at walking speed in this context. The total time T is not just the relay reaction time: it is the sum of the control system response time and the machine run-down time, the worst-case interval from releasing a button to the dangerous motion actually stopping. The additional distance C accounts for reaching toward the danger zone; for a two-hand control without intrusion masking, C must be at least 250 mm. The table below works the formula for representative stopping times to show how sensitive placement is to machine run-down.

The lesson from the table is that a slow-stopping machine forces the controls a long way back. A press with a 0.5 s total stopping time needs its buttons more than one metre from the dies, which can make a two-hand control awkward to use and pushes designers toward improving the machine's stopping performance (a brake upgrade, a faster valve) before relocating the controls. Measuring the real stopping time on the installed machine, not trusting a catalogue value, is a basic commissioning step, because brake wear and hydraulic temperature lengthen run-down over the machine's life.

Placement involves more than the calculated distance. ISO 13851 requires the actuators to be arranged, by separation and by guarding such as shrouds or recessed rings, so that one person cannot operate both with a single hand, a forearm, or other parts of the body, and so that two people cannot share the operation. The operator must also have a clear line of sight to the danger area while operating the controls. For portable or repositionable two-hand control stations, additional care is needed: the station must be stable in normal use, fitted with means to prevent it being moved during operation such as a heavy base or lockable casters, and provided with a way to maintain the required safety distance, for instance a spacer that fixes its position relative to the machine.

North American power presses carry their own placement rule. OSHA 29 CFR 1910.217 specifies a safety distance for two-hand controls and two-hand trips based on the stopping time, expressed in imperial units, and additionally requires anti-repeat and the release of all hand controls before an interrupted stroke can be resumed. Where a machine is built for both markets, the more demanding of the ISO 13855 result and the OSHA result should govern, and the device type should satisfy both ISO 13851 and the applicable press standard such as ISO 16092-1.

Key Specification Parameters

When comparing two-hand control modules and button stations across vendors, most differences come down to a handful of parameters. The same module may list 20 lines on a datasheet, but the ones that drive selection are: type and PL/SIL rating, synchronicity time, supply voltage, output configuration and contact rating, response time, external device monitoring, terminal style, and enclosure rating. Each is explained below.

Type and PL/SIL rating is the headline specification. A module is certified for a specific ISO 13851 type, commonly IIIA or IIIC, with a declared maximum achievable Performance Level and SIL. Some modules are selectable, offering Type IIIC in one wiring configuration and a simpler type in another. Confirm that the certified type and PL meet, and ideally exceed, the value derived from the machine's risk assessment, and that the certificate covers the actual button technology you intend to pair with it.

Synchronicity time is fixed by the standard at a maximum of 0.5 s between the two button actuations, but the module enforces it, and some modules let you confirm or read back the configured value. If both buttons are not closed within this window, no output is produced and both must be released and re-pressed. This single parameter is the anti-tie-down mechanism, so it is never adjustable beyond the 0.5 s ceiling.

Supply voltage and output configuration determine wiring. Typical two-hand modules run on 24 V DC, with wide-range variants accepting 24 to 240 V AC/DC. Outputs are commonly two or three redundant normally-open safety contacts that switch the machine actuator, plus one normally-closed auxiliary contact for signaling or PLC feedback. Mechanical relay outputs are typically rated around 6 A in AC1 (resistive) duty per contact and require an external short-circuit protective device such as a 4 A fuse. For high cycle counts, solid-state semiconductor outputs avoid contact wear at the cost of lower current and DC-only switching.

Response time and external device monitoring affect both safety distance and achieved PL. The module response time, the delay from a button release to the safety outputs opening, feeds directly into the stopping-time term T in the safety-distance formula, so a faster module allows the controls to sit closer. The external device monitoring (EDM) or feedback input lets the module watch the actual state of the downstream contactors through their mirror contacts; using it is what allows the complete safety function, not just the module, to reach Category 4 and PL e.

Two further hardware parameters round out a specification: terminal style (fixed screw terminals versus pluggable spring-cage terminals, the latter speeding panel wiring and replacement) and enclosure and environment. Panel-mounted modules are typically narrow DIN-rail devices around 22.5 mm wide for single-width formats, while pre-assembled two-hand control stations carry an ingress-protection rating, commonly IP65, for the button housing. The list below summarizes the parameters worth tabulating in any RFQ:

• ISO 13851 type: I, II, IIIA, IIIB, or IIIC, matched to the required PL.
• Performance Level / SIL: achieved PL per ISO 13849-1 and SIL per IEC 62061 for the full safety function.
• Synchronicity time: maximum 0.5 s, enforced.
• Supply voltage: 24 V DC, or wide-range 24 to 240 V AC/DC.
• Safety outputs: number and type of N/O safety contacts plus auxiliary N/C; contact rating in A AC1; semiconductor option.
• Response time: button-release to output-open delay, feeding the stopping-time T.
• EDM / feedback loop: contactor monitoring for full-function PL.
• Terminals and enclosure: screw or spring-cage terminals; station IP rating.

Selection Decision Factors

To turn the preceding chapters into a specific bill of materials, follow the decision sequence below. Most selection mistakes are not single wrong parts but decisions taken in the wrong order, for example fixing on a button style before the risk assessment has fixed the required type. These steps can serve as a fixed RFQ template for two-hand control devices.

1. Risk assessment first: Run the ISO 13849-1 risk graph for the specific hazard to derive the required Performance Level, and confirm that a two-hand control is the right safeguard at all, given that it protects only the operator holding the buttons. If a second person or an automatic stroke is in scope, plan complementary guarding before going further.
2. Map PL to ISO 13851 type: Translate the required PL into a type. Lower risk (PL c) maps to Type IIIA; single-fault-tolerant duty (PL d) to Type IIIB; severe, frequent, hard-to-avoid hazards (PL e) to Type IIIC and Category 4. Specify the type explicitly on the purchase order.
3. Measure stopping time and compute safety distance: Determine the worst-case total stopping time T on the actual machine, then apply S = (K x T) + C with K = 1600 mm/s and C of at least 250 mm without masking. The result fixes where the actuators must sit and may force a stopping-performance upgrade before the layout works.
4. Choose button technology and ergonomics: Select mushroom, palm, guarded, or zero-force capacitive/optical touch buttons. For high daily cycle counts, zero-force touch buttons such as Rockwell 800Z reduce repetitive-strain injury because no pressing force is required, while still enforcing synchronous actuation and anti-tie-down through the module.
5. Specify actuator arrangement and guarding: Set the separation and shrouding so the controls cannot be operated with one hand, a forearm, or by two people, and ensure a clear line of sight to the hazard. For portable stations, specify a stable base and a means to maintain the safety distance.
6. Select the monitoring module: Choose a safety relay or controller certified for the required type, with adequate safety outputs and contact rating, a fast enough response time for your safety distance, EDM/feedback for contactor monitoring, and convenient terminals. Prefer a coordinated button-plus-module family so the system certification is valid as supplied.
7. Verify the full safety function: Confirm the achieved PL across the whole chain, buttons to module to contactors, including EDM feedback, so the output stage does not become the weak link. Document the calculation for the technical file.
8. Plan validation and serviceability: Commission with functional tests for synchronous actuation, single-button stop, anti-repeat, and anti-tie-down, and schedule periodic re-validation. Account for spare-parts availability and field service over the machine's life.

One last commonly overlooked dimension is manufacturer serviceability and certification depth: availability of EC type-examination certificates, validity of the declared type and PL for the exact button-plus-module combination, local spare-parts inventory, and clear functional-test instructions for periodic re-validation. These seem peripheral at purchase but determine whether the machine stays compliant after years of contact wear and brake degradation. Pilz, Schmersal, Schneider Electric, Rockwell Automation, DOLD, Banner Engineering, and Comitronic-BTI all publish certified two-hand control product families with documented type and PL ratings, which makes them dependable choices for projects that must withstand audit.