ISO 13851:2019 — the second edition of the international standard for two-hand control devices (THCDs), published March 2019 and confirmed as the active version following its 2024 review [S1] — partitions every two-hand control into three numbered types (Type I, Type II, Type III) that differ in synchronous-actuation rules, output-signal logic, and tolerance to internal faults.
A THCD, in the scope of the standard, is any device requiring actuation by both hands of a single operator within a defined time window before a machine's output signal is released [S1]. The 2002 first edition of the same document has been formally withdrawn (stage 95.99) and should not be cited for new machinery designs [S2].
Scope of ISO 13851 and What the Standard Does Not Cover
ISO 13851:2019 applies to all THCDs regardless of energy source, including factory-assembled units and devices built up by the machine manufacturer or integrator from separate elements [S1]. The standard explicitly excludes devices intended as enabling devices, hold-to-run devices, or special control devices — those are governed by ISO 13849-1 and ISO 12100-2 instead [S1].
Note 2 in the standard is decisive for specifiers: "for specific machines, the suitability of a two-hand control as a suitable protective device can be defined in a type-C standard" [S1]. That means a press builder, for example, points to EN 692 (mechanical presses) or EN 693 (hydraulic presses) for the application rules; ISO 13851 supplies the device logic but not the hazard-zone distance or the machine-by-machine fit [S1].
The same clause warns that the standard "does not specify which types of two-hand-control device shall be used for a specific application" [S1] — selection is a risk-assessment outcome, not a default. Process engineers building safety circuits around a two-hand control station should therefore read ISO 13851 alongside ISO 13849-1 (safety-related parts of control systems, PL a–e) and the relevant type-C standard for the machine class.
The Three Functional Types: Type I, Type II, Type III
ISO 13851:2019 sets out "combinations of functional characteristics for three types" of THCD [S1]. The graded architecture means a higher-numbered type retains all requirements of the lower types plus additional fault-tolerance and re-initiation logic.
Type I — the baseline — provides the two-hand synchronous-actuation requirement (both operators within ≤ 500 ms, per the standard's published timing class) and gives a single output signal that releases only while both actuating devices remain actuated. A release of either input must drop the output; a new stroke cycle requires release-then-repress of both.
Type II adds the requirement that the output signal cannot be re-established by a single fault. Internal cross-faults, stuck contacts, or short circuits in one channel must not allow the machine cycle to restart on their own — a second, independent actuation path is required [S1].
Type III demands the tightest synchronism and the strongest fault coverage. It requires the output to drop on release of either actuating device, the prevention of defeat (bypassing by tying, wedging, or single-hand operation), and verification that a single fault does not lead to a loss of the safety function. Type III is the type specified where the hazard is irreversible — typical of full-revolution mechanical presses and similar dangerous machinery — and it dovetails with access control arrangements when the operator cannot remain inside the danger zone.
Selection Criteria: Risk Assessment, PL, and Type-C Mapping
Selection starts with the risk assessment in ISO 12100 and ends with a required Performance Level (PL a through PL e) under ISO 13849-1 [S1]. ISO 13851 supplies the device-type rules; ISO 13849-1 supplies the probability and diagnostic-coverage targets. A Type I THCD wired into a dual-channel logic block cannot by itself reach PL e; the safety-function architecture (muting, redundancy, cross-monitoring) determines that.
For a mechanical press with a full-revolution clutch, EN 692 typically forces the specifier to Type III plus PL e under ISO 13849-1 — the two-hand station must drop the clutch-engage signal on release and survive any single fault without an automatic re-start. For a low-risk workstation such as a small assembly fixture, Type I at PL c is often defensible.
The 2019 edition retained the "prevention of defeat" requirement at all three types but tightened the defeat-resistance expectations: devices must remain defeat-resistant throughout the device's lifetime, not only at commissioning [S1]. Practical implementations rely on mechanical guards around the actuators (collars, shrouds) plus synchronous-timing monitoring — a feature list common to the IDEM and Schmersal THCD lines stocked by automation distributors [S3][S4].
Comparison: Type I vs Type II vs Type III on Decision Criteria
The standard's three-type taxonomy maps cleanly onto four decision criteria a process engineer weighs at the panel-design stage: synchronous-actuation timing, output behaviour on release, tolerance to a single internal fault, and re-initiation rules. The table below compresses the published functional characteristics into a side-by-side comparison. [S2]
Type I: synchronous actuation within the standard's timing class; output drops on release of either hand; no single-fault coverage on its own; re-initiation requires release-then-repress of both. Type II: same synchronous-actuation and release behaviour as Type I; a single fault must not allow the output to re-establish on its own; re-initiation is permitted only after the fault is cleared and both actuators are released. Type III: synchronous-actuation plus a release-of-either requirement, single-fault tolerance equivalent to Type II, plus the strictest anti-defeat and re-initiation logic, normally paired with PL e under ISO 13849-1 [S1].
Cost and panel complexity scale with the type: Type I stations can be built from two momentary pushbuttons and a single safety relay; Type II requires dual-channel wiring with cross-monitoring; Type III typically adds a certified safety controller (e.g. Pilz PNOZ, Sick FX3, Allen-Bradley GuardLogix) and shielded cabling routed back to a control cable assembly sized for the safety-rated I/O count. Specifiers should never drop a Type III requirement to Type II to save relay cost; the type is set by hazard severity, not budget.
Actuator Hardware and Accessories
Physical THCD stations ship in several mechanical formats, but the standard is technology-agnostic: it applies to "all THCDs, independent of the energy used" [S1]. In practice four actuator families dominate industrial catalogues: mechanical momentary pushbuttons, zero-force touch switches, capacitive or palm buttons, and foot-pedal equivalents (which are not two-hand devices and are out of scope). Each accepts the standard's three-type logic; the type is set in the downstream logic, not at the button.
Distributor stock illustrates the form-factor split. AutomationDirect's two-hand accessories category lists pushbutton (3 SKUs), legend plate (1 SKU), and touch switch (1 SKU) accessories, with brands IDEM (2 SKUs) and Schmersal (3 SKUs) carrying the mix [S3][S4]. Replacement components commonly required during the device's service life include control pushbuttons, emergency-stop pushbuttons (typically twist-to-release or push-to-lock / twist-and-pull reset), and engraved legend plates for the actuator functions [S4].
E-stop integration is a frequent point of confusion: the E-stop on a THCD station is governed by ISO 13850 (emergency-stop devices), not by ISO 13851. The E-stop and the two-hand actuators are independent safety functions on the same pendant or panel; combining them on a single logic channel is a non-conformance that auditors will flag.
Limitations, Common Defects, and Audit Findings
Note 1 in ISO 13851:2019 is a single line that drives most field-failure modes: "A THCD only offers protection for the person using it" [S1]. The two-hand station does not protect a second operator, a bypasser, or a person who has entered the danger zone through a separate opening — that is a guarding problem solved by interlocks and control valve logic, not by adding buttons to the THCD.
The most common defeat attempt in the field is single-hand operation by tying down or wedging one actuator. Type I has no defence against this beyond the synchronous-timing check; Type II and Type III are required to defeat this scenario, and the standard's anti-defeat clause expects the device to remain defeat-resistant across its service life, not only at FAT [S1]. Maintenance procedures should include periodic verification of the synchronous timing (typically ≤ 500 ms between actuator inputs) and a documented pull-test on each actuator.
Programmable-electronic THCDs are covered in ISO 13851's body and require validation under IEC 61508 (functional safety) with the appropriate SIL target derived from the risk assessment. Vendors publishing a SIL claim alongside Type III should be cross-checked for the SIL claim's scope — a SIL 3 claim on the logic chip is not the same as SIL 3 on the complete safety function, which must include sensors, wiring, and the final-element actuator.
Verification and Test Method
ISO 13851:2019 section on verification requires the manufacturer or integrator to demonstrate that the THCD meets the published type's functional requirements before delivery, and that the integration into the host machine does not defeat any of the device's safety characteristics [S1]. For Type III stations that validation includes: simultaneous-actuation timing measurement, single-fault injection on each channel, release-of-either-actuator test, and an anti-defeat test using common field-impersonation methods (velcro strap, mechanical wedge, hand-tool substitute).
Re-verification is expected after any maintenance event that breaks a safety-relevant seal or replaces an actuator, and at the intervals set by the machine's type-C standard or by the site's safety-management plan. Recording the verification results in the machine's technical file (per the Machinery Directive 2006/42/EC) is mandatory for CE-marked machinery in the EU and equivalent regimes elsewhere.
Sourcing Checklist and Field Signal
When sourcing a Type III station, the specifier should demand: an ISO 13851:2019 third-party type-examination certificate (not a self-declaration), an ISO 13849-1 PL e rating on the complete safety function, an IEC 61508 SIL 3 claim scoped to the full subsystem, and a published synchronous-actuation timing figure in writing. For Type I and Type II stations, the same documentation trail is expected but the PL/SIL bar is lower, set by the risk assessment. [S2]
Two trackable signals for the next quarter: ISO/TC 199's periodic review of ISO 13851 is on the standard's 5-year cycle, with the 2024 review having confirmed the 2019 edition remains current [S1]; any committee-draft (CD) stage for a third edition would appear on the ISO/TC 199 work plan. Distributor-level signals worth watching include new IDEM and Schmersal Type III SKUs added to the automation parts channel [S3] and the next round of CE machinery-regulation guidance from the European Commission, which is the policy track that typically revises type-C standards in lockstep with ISO 13851.
See also our earlier report, Precision filter buying guide 2026: micron rating, media, and housing class.