Two-hand control is a presence-sensing safeguard classified into Type I, Type II, and Type III under EN 574 / ISO 13851, where Type I requires only concurrent actuation, Type II adds anti-tie-down and anti-repeat logic, and Type III adds a synchronous actuation window of no more than 0.5 s between the two operators' hands, making it the configuration most resistant to defeat [S2][S3].
Type III is further divided into IIIA, IIIB, and IIIC, with the sub-class defining the implementation: IIIA and IIIB are typically realised with a dedicated safety relay wired to mechanical contacts, while IIIC uses position-based pneumatic or hydraulic valve logic on a single valve body. All Type III variants share the same ≤ 0.5 s synchronicity requirement and the requirement that releasing either hand during the hazardous motion stops the machine [S3][S7].
EN 574 / ISO 13851 Type Definitions and Logic Requirements
Type I requires only that both operators' hands actuate their respective pushbuttons concurrently during the hazardous motion; if either hand releases, the machine stops, but the implementation does not need to detect synchronisation timing or defeat attempts [S3].
Type II builds on Type I by adding anti-tie-down (the buttons cannot be tied, wedged, or otherwise mechanically held down to fake an operator's hands) and anti-repeat (a new cycle cannot be initiated by simply releasing and re-pressing one button while the other stays pressed). Anti-tie-down is verified at power-up and at every release-restart transition; anti-repeat is verified by requiring both buttons to release before the next cycle can be armed [S3].
Type III adds a synchronous actuation window: both buttons must close within 0.5 s of each other, and both must remain closed for the full hazardous portion of the cycle. The Type III synchronous requirement is the practical reason Type III is specified for new European and North American press builds, where risk assessments under ISO 12100 and EN ISO 13849-1 typically land at Performance Level e (PLe), Category 4 [S2][S3][S4].
Type IIIA, IIIB, IIIC: Implementation Differences
Type III is not a single product; EN 574 splits it into three sub-types based on the electromechanical or fluid-power realisation. IIIA uses a single-channel input device with a control logic that detects the synchronism via the safety relay; IIIB is the dual-channel equivalent with redundant input devices and cross-monitored logic; IIIC is the purely pneumatic or hydraulic version, where the synchronism is enforced by mechanically interlinked 3/2 valves that vent downstream air if either hand is released or the actuation timing is exceeded [S3][S7].
Type IIIC pneumatic two-hand safety valves, as documented by SFS Fluid Systeme, are typically 3/2 poppet or spool valves with mechanical interlock, requiring both pilot signals within the 0.5 s window to shift the valve; loss of either signal returns the valve to the fail-safe vented state. The advantage of IIIC is intrinsic safety (no electrical power at the operator station), which is why IIIC is common on injection moulding and die-casting cells, on plastic-film sealing presses, and in any ATEX zone where the operator console must be inert [S7].
Type IIIA and IIIB implementations pair the palm buttons with a safety monitoring relay such as the Allen-Bradley MSR125, Eaton ESR5, or Schmersal SRB201ZH, which enforces the 0.5 s window, anti-tie-down, and anti-repeat in firmware. A typical reference design from Rockwell Automation uses 800Z zero-force palm buttons plus an MSR125 and achieves PLe / Category 4 per EN ISO 13849-1:2008 when wired to dual 100S safety contactors [S4].
Selection Criteria: Risk Level, Performance Level, and Environment
Pick Type I only when the hazard is reversible by de-energising the machine (Category 0 stop per EN 60204-1) and the risk assessment under ISO 12100 yields a required Performance Level of PL a or PL b. Type I controls are still seen on small hand-fed assembly presses, arbor presses, and manual loading stations where the operator is not exposed to a single-stroke hazard. Schmersal's two-hand control panel product family explicitly notes that Category 0 stop per EN 60204-1 can be achieved with downstream signal evaluation, provided the relay chain meets the PLr of the risk assessment [S5].
Pick Type II when the risk assessment demands PL c or PL d and the application has high cycle rates where operator fatigue could produce accidental defeat attempts. Type II's anti-tie-down and anti-repeat logic defeat the most common bypass methods (tape, zip-ties, mechanical clamps) without requiring the precise 0.5 s window that Type III imposes. This makes Type II acceptable on light-duty pneumatic presses and PCB punch presses where the hazard is moderate but the cycle count is high [S2][S3].
Pick Type III for any mechanical or hydraulic power press in single-stroke mode under OSHA 29 CFR 1910.217, for press brakes where the operator's fingers can enter the die, for spot-weld guns, and for any cell where the risk assessment lands at PLe / Category 4. OSHA's eTool on press safeguarding explicitly lists two-hand controls as acceptable safeguarding for part-revolution clutch presses in single-stroke mode, with the synchronous, anti-repeat requirements implicit in the recognised industry standards [S1][S3][S4].
Criteria-Based Comparison of Type I, II, and III
The four decision criteria that consistently separate the types are: synchronism enforcement, anti-defeat coverage, achievable Performance Level, and typical integration effort. Type I enforces synchronism not at all, has no anti-defeat logic, can reach PL c at best with careful relay design, and integrates in roughly 1-2 hours of panel wiring. Type II adds anti-tie-down and anti-repeat, can reach PL d, and adds 0.5-2 hours of relay configuration. Type III adds the 0.5 s synchronicity window on top of the Type II logic, can reach PLe / Category 4 (the maximum under EN ISO 13849-1), and adds 1-4 hours of safety-relay configuration plus SISTEMA calculation to verify the achieved PL matches the PLr [S3][S4].
A typical Type IIIA system built around 800Z buttons plus an MSR125 relay, as documented in Rockwell's safety function application note, reaches PLe / Category 4 with a single MSR125 module and dual 100S contactors. A comparable Type II system uses fewer contactors and can land at PL d. A Type I system built around generic pushbuttons plus a standard contactor relay typically lands at PL c and is rarely accepted for new press installations in regulated jurisdictions [S4].
Wiring and Integration: MSR125, SRB201ZH, and Pneumatic IIIC
For Type IIIA / IIIB electrical installations, the canonical reference design is two normally-open contact blocks per operator button, wired in a dual-channel configuration to a safety monitoring relay. The relay enforces the 0.5 s window by comparing the two input edges; a difference greater than 0.5 s locks out the output. Anti-tie-down is implemented by pulsing the output contactors and verifying the input contacts open and close in the expected sequence; anti-repeat is implemented by requiring both input contacts to open before the next cycle can be armed [S3][S4].
For pneumatic Type IIIC installations, the wiring reduces to two 3/2 pilot-operated valves plumbed in series, with mechanical interlocks that vent the downstream air if either pilot signal is missing or arrives more than 0.5 s after the other. The Eaton blog and the SFS Fluid Systeme documentation both confirm that the 0.5 s synchronism is preserved across the IIIC sub-types, with sub-classification distinguishing valve-port count and reset behaviour rather than the timing requirement [S2][S7].
For hybrid cells, where the operator station is electrical but the machine is pneumatic, the same Type IIIA logic is enforced electrically upstream of a Type IIIC valve. This is the most common configuration on modern plastic-film sealing presses and on small hydraulic press benches, and it is the configuration that standardises on a single safety relay for the logic and a single pneumatic valve for the fail-safe actuator [S2][S7].
Failure Modes and What Each Type Does Not Catch
Type I does not catch tape or zip-tie defeat, does not catch anti-repeat bypass, and does not enforce synchronous actuation. In practice this means a single operator could tape down one button, press the other to cycle the machine, and reach in with a free hand before the next cycle. This is why Type I is now rarely accepted on full-revolution or part-revolution clutch presses in OSHA-regulated jurisdictions [S1][S3].
Type II catches the most common defeat methods (mechanical tie-down, single-button repeat) but does not enforce the 0.5 s synchronous window, so a coordinated two-handed release and re-press could in theory initiate a second cycle before the operator is fully clear. Type II is therefore not the right choice for high-injury-severity hazards where the operator's hands must be visibly committed to the control for the full cycle [S3].
Type III catches tie-down, anti-repeat, and out-of-window actuation, but it does not catch a second operator pressing the buttons for the first, and it does not by itself protect bystanders. EN 574 and the OSHA eTool both require that two-hand controls be placed far enough apart (typically 550 mm centre-to-centre minimum, with protective shrouds) that a single hand, elbow, or knee cannot bridge both actuators, and that the hazard zone itself be guarded against third-party access [S1][S5]. For a deeper comparison of how two-hand control stacks against light curtains and fixed guards in a real cell layout, the related spec work on industrial press line safeguard selection covers the broader machine-guard decision framework.
Standards, Performance Level, and Verification
EN 574 (the European implementation of ISO 13851) defines the three types; EN ISO 13849-1 defines the Performance Level and Category that the chosen type must achieve; EN 60204-1 defines the stop category (Category 0, 1, or 2) that the two-hand control must enforce downstream; and EN ISO 13850 defines the emergency stop that is always integrated into the two-hand control panel alongside the two actuation buttons [S3][S5].
For a Type III installation to be defensible, the safety function must be calculated in SISTEMA (or an equivalent tool) with the actual part numbers, the actual wiring topology, and the actual diagnostic coverage. The Rockwell MSR125 + 800Z + 100S reference design, for example, calculates to PLe / Category 4 in SISTEMA with a mean time to dangerous failure per hour (MTTFd) high, DCavg high, and a category-4 structure; substituting a single-channel contactor block would drop the structure to Category 1 or 2, even with the same relay [S4].
For pneumatic Type IIIC installations, the verification shifts from SISTEMA to the valve manufacturer's B10d data and the ISO 13849-1 calculation for fluid-power components, with the same PLe / Category 4 outcome achievable if the dual-valve mechanical interlock is properly qualified [S7].
When Two-Hand Control Is the Wrong Safeguard
Two-hand control is not the right safeguard when the cycle is long enough that the operator needs to remove a hand to manipulate a workpiece, when multiple operators share a single hazard zone, or when the hazard is not bound to a single point of operation. In those cases, light curtains, area scanners, or interlocked guards are the right call. Two-hand control is also not the right safeguard when the operator can brace a button against a fixed surface to free a hand; the EN 574 spatial-separation and shroud requirements are designed to defeat that, but the practical answer is to choose a different safeguard in the risk assessment [S1][S3].
For cells where a two-hand control is part of a larger press line that includes conveyors, accumulating conveyors, and downstream assembly, the safeguard choice must be coordinated with the upstream and downstream equipment. The geometry of the operator's reach into the hazard zone during the conveyor index cycle, not just the press stroke, is what drives the final Type III vs light-curtain decision, and that broader selection logic is covered in the comparison of accumulating conveyor types for paint lines and in the pipe conveyor spec guide for curved routes for upstream material handling.
Trackable signals to watch: the next revision of EN 574 (the standard is in active maintenance under CEN/TC 114), any change to OSHA 29 CFR 1910.217 wording on two-hand trip in single-stroke mode, and the next-generation safety relays from the major vendors that combine Type III logic with IO-Link safety for diagnostics. A more immediate action item for any specifier is to confirm the SISTEMA calculation file for the installed two-hand control system, with the actual part numbers, has been signed off within the last 12 months.
Spec-level background on the components involved: two hand control, dry type transformer, and hand tools.