Two-Hand Control (THC) under ISO 13851 is a deliberate anti-tie-down safeguard that demands the operator press two spaced buttons within a 500 ms synchronisation window to release a single machine cycle [S1].
It was designed for press brakes, hydraulic punches and similar stationary machinery where a single hand on a start button is not enough proof that the operator's other hand is clear of the die [S1]. Applying it to confined-space entry requires separating the act of moving a heavy cover or hatch from the act of authorising a person to descend, and that is a distinction most safety memos muddle.
When THC Actually Fits a Confined Space Task
THC is a fit where the confined space is also a machine hazard: e.g. a hydraulic clamp on a vessel head, a powered davit cover, a robot-cleaned reactor manhole, or a press-style actuator that must close only when both hands of a single operator are confirmed away from the line of travel [S1]. ISO 13851 defines four Type I/II/III categories and requires Category I as the minimum (single fault tolerance) for any new installation after the standard's publication [S1].
For a non-mechanical confined space (a tank, pit, sump, sewer) the hazard is atmospheric and engulfment, not actuation; THC buys nothing because the operator's hand position does not change the risk profile. Permit-Required Confined Space (PRCS) rules under OSHA 29 CFR 1910.146 drive the access decision, with mandatory pre-entry atmospheric testing for oxygen, flammables and toxics in that order before any entrant crosses the plane of the opening [S2][S5].
ISO 13851 Thresholds and What They Mean in Practice
The synchronisation window of 0.5 s maximum between the two actuator signals is the headline figure engineers get wrong, and it is the difference between a Type III (synchronous control) device and a Type II (asynchronous) variant [S1]. Buttons must be physically spaced so they cannot be operated by one hand or one forearm, which on a typical control console translates to a minimum centre-to-centre distance around 550 mm with shrouds or guards to defeat tying [S1].
Output must re-energise only on a fresh release-and-press cycle, so a stuck button cannot be re-used as a restart. This single-cycle reset, plus the requirement that any single internal fault (relay weld, contact short) prevents a new cycle, is what pushes most modern THC implementations from discrete relays to a dual-channel safety relay or a PLC-based safety logic solver [S1].
Confined Space Categories Drive the Access Decision, Not THC
OSHA splits confined spaces into non-permit and permit-required, and the trigger is whether the space has any of: a hazardous atmosphere; an engulfment hazard; an internal configuration that could trap or asphyxiate; or any other recognised serious safety or health hazard [S2]. A permit-required space always needs a written programme, an attendant, a rescue plan and atmospheric monitoring regardless of how the cover is opened [S2][S5].
The DAFMAN 91-203 (24 February 2026) manual, superseding the 25 March 2022 issue, codifies the same hazard inventory plus the Air Force-specific additions: lockout/tagout before opening, continuous atmospheric monitoring while occupied, and a dedicated rescue capability reachable within the documented response window [S3]. WorkSafe Western Australia sequences the management process as four steps, identify hazards, assess risk, control risk, review controls, and step 3 is where THC would appear if (and only if) the residual risk is mechanical actuation [S4].
Comparison: THC vs Hold-Down Pendant vs Permit Latch Sequence
Three realistic options for opening a powered hatch on a confined-space enclosure line up against four decision criteria: synchronisation requirement, single-fault tolerance, suitability for an unpowered failure state, and compatibility with an attendant-controlled permit [S1][S2].
THC per ISO 13851: synchronisation required (≤0.5 s between two channels), single-fault tolerance mandatory (Category I minimum), safe state is typically power-off, and it can integrate with a control valve or safety relay tied to the permit-release interlock [S1]. Hold-down pendant (single pushbutton maintained): no synchronisation check, single-fault tolerance depends on wiring, safe state is operator-released, and it is usually not acceptable for a PRCS gate because a tied button defeats the safeguard [S2]. Permit latch sequence (key-trapped, multi-step authorisation): synchronisation not applicable, single-fault tolerance achieved by key exchange, safe state is mechanical lock, and it is the conventional fit where the cover itself is not a hazard, only the entry is [S2][S5].
Atmospheric and Ventilation Constraints Override the THC Decision
Pre-entry testing under OSHA 1910.146(c)(5)(ii)(C) requires a calibrated direct-reading instrument to check oxygen, then flammable gases/vapours, then toxic air contaminants, in that order, before any employee breaks the plane of the opening [S5]. The list of contaminants named in the source material covers acetic acid, acetone, acetylene, alcohols, ammonia, arsine, benzene, CO₂, CO, chlorine, chlorine dioxide, combustible gases, formaldehyde, hydrogen and its compounds (H₂S, HCN, HCl), mercury, NO₂, ozone, phosgene, phosphine, SO₂, toluene, vinyl chloride, VOCs and xylene, which is essentially the audit checklist a confined-space competent person carries into a process control environment [S5].
Ventilation is the second override: a properly sized blower with a duct run that sweeps the entire volume can drop a toxic or oxygen-deficient atmosphere below its entry threshold, in which case the permit-required classification may drop to non-permit for the duration of the task [S6]. A two-hand control switch wired to the blower starter would be a misuse of the standard, because ISO 13851 is not a ventilation interlock and the synchronisation window has no meaning for a fan [S1][S6].
Selection Criteria: When THC Is the Right Spec
Specify THC per ISO 13851 when the confined-space opening is a powered motion (swing, lift, slide) and the residual risk after lockout/tagout is a mechanical pinch, crush, or strike against the operator; in that case add it to the same access control chain that already enforces the entry permit [S1]. Use a Category III (synchronous, 0.5 s) device with two normally open mechanically independent contacts per button, wired through a safety relay or safety PLC rated to PL e / SIL 3, and never source the actuator signal from a non-safety output [S1].
Do not specify THC where the cover is manually lifted (no power, no synchronisation, no protection added), where the hazard is purely atmospheric, or where one operator cannot physically reach both buttons with two hands clear of the hazard zone (a long reach or a guard that prevents it). In those three cases the correct fix is a control cable-interlocked permit-release, a gas monitor with a defined alarm-and-evacuate action, or a mechanical key-trapped sequence, not a two-hand station [S1][S2].
Trackable Signals for the Next Review
Watch the 2026 update cycle for the OSHA 1910.146 revision track, any addendum to DAFMAN 91-203 (the 24 February 2026 issue is the current baseline, superseding the 25 March 2022 edition), and any Western Australia Code of Practice amendment that would shift the four-step sequence's step 3 controls [S2][S3][S4].
Background reading: High-Rise Waterproofing Membrane Selection: Spec Map for Towers, Podiums, and Deep.