EN 13557 Crane Safety: Control Devices & Operating Positions
Standard Overview: EN 13557 Cranes — Control devices and operating positions is the EU crane safety standard published by CEN/TC 147. It defines ergonomic design, safety function configuration, and reliability requirements for crane control stations, including operator cabs, pendant pushbutton stations, and remote controls. As a harmonized standard under the EU Machinery Directive 2006/42/EC, any crane bearing the CE mark must have its control devices compliant with EN 13557.
Crane control devices are the critical interface between the operator and the machine — the placement of a single button or the reset method of an emergency stop can mean the difference between a near-miss and a serious accident. EN 13557 is built around a three-tier safety architecture (emergency stop → limit protection → control logic redundancy) and sets out comprehensive requirements for the design, installation, and verification of control stations. This article breaks down the standard's safety design logic layer by layer.
Emergency Stop Devices: The First Line of Defense
EN 13557 requires at least one emergency stop device at every operating position on the crane — operator cab, floor pendant station, and remote transmitter. The emergency stop button must be a red mushroom-head type (diameter ≥ 40 mm) on a yellow background. When pressed, it latches in the open position and can only be reset manually by twisting or pulling — automatic reset is not permitted. The electrical design of the emergency stop circuit uses a series-connected normally-closed contact arrangement: all emergency stop NC contacts are wired in series within the safety relay circuit, so pressing any single button de-energizes the main contactor coil and achieves a Category 0 stop (immediate removal of power from the drive).
The emergency stop device must be mounted at a height where the operator's palm naturally reaches in either a standing or seated position — for floor pendant stations, the button center should be 900–1100 mm above the floor; in the operator cab, it is installed on a 45° angled panel at the upper left of the control console. The protection rating of the emergency stop button must be at least IP65 for outdoor use or IP54 for indoor use, and cable entries must be sealed with waterproof cable glands.
Limit and Protection Devices: The Second Layer
EN 13557 mandates that the hoisting mechanism be equipped with both upper and lower limit switches in a dual-redundant configuration — one deceleration limit switch and one final limit switch. When the deceleration limit switch is triggered, high-speed operation is cut off and the drive automatically switches to low speed. When the final limit switch is triggered, the main circuit is interrupted and locked out — it can only be reset via a manual key switch or by operating a reverse-direction button. The Lifting Capacity Limiter and Load Moment Limiter (LML) must be set to trip at no more than 1.1 times the rated load — at 10% overload, an alarm sounds and hoisting and luffing motions in the raising direction are cut off.
For cranes where two or more mechanisms operate in combination, EN 13557 requires interlock functions in the control logic to prevent dangerous combined motions. For example, on a Gantry Crane, simultaneous high-speed operation of both the bridge travel and trolley travel can cause severe machine oscillation — the control logic must restrict simultaneous high-speed operation. Similarly, combining hoisting with luffing-down on a luffing boom could cause uncontrolled acceleration of the boom — a prohibition logic must be programmed into the PLC.
Control Logic and Safety PLC: The Third Layer
EN 13557 requires that the control circuits for crane safety functions — emergency stop, limit switches, and overload protection — achieve Performance Level d (PLd) as defined in ISO 13849-1 (average probability of dangerous failure per hour between 10⁻⁶ and 10⁻⁷) or Safety Integrity Level 2 (SIL2) per IEC 62061. The implementation path uses a safety PLC with redundant input modules: emergency stop and limit switch signals are fed into two independent input channels, and the signal is only considered valid when both channels produce identical logic results. If a channel conflict is detected — for instance, one channel closed while the other is open — the system declares a fault condition, the safety PLC cuts the output, and the fault code is latched for diagnostics.
Contactors in the safety relay circuit must feature a positively driven (force-guided) contact mechanism per IEC 60947-4-1 Annex A. Even if contacts weld together due to overcurrent, the mechanical lever of the positively driven design forcibly separates them, eliminating the fatal failure mode where the circuit cannot be de-energized after contact welding.
Ergonomic Requirements for Control Stations
EN 13557 sets detailed ergonomic requirements for the layout and labeling of control devices. Button spacing must be at least 15 mm for finger operation and 25 mm for gloved operation to prevent accidental actuation. Hoist up/down buttons must be arranged vertically — up on top, down on bottom — matching the operator's intuitive vertical spatial mapping. On multi-function pendant stations, panel zones are delineated with silkscreened lines or color blocks: hoisting zone (yellow or green border), bridge travel zone (blue border), and trolley travel zone (gray border).
Remote transmitters must be equipped with an enabling switch (commonly known as a dead-man switch) — the operator's fingers rest naturally on the enabling switch while holding the transmitter. If the operator releases it — due to a fall or loss of consciousness — the switch springs back, cutting all function outputs and bringing the crane to an immediate stop. This serves as the final line of personal protection against uncontrolled crane movement after loss of remote control.
| Safety Level | Function | Implementation Method | safety level |
|---|---|---|---|
| L1 Emergency Stop | Immediate Power Disconnect | Red Mushroom-Head Button NCSeries Contact Wiring | PLd |
| L2 Limit Switch | Travel Protection | Deceleration+Dual Limit (Over-Travel)redundancy | PLc |
| L3 Logic | Controlredundancy | safety PLCdual channel | SIL2 |
FAQ
Q: Why must the Emergency Stop Button be self-locking rather than auto-resetting?
A: Two reasons: ① Safety traceability — a self-locking E-stop maintains its "pressed" physical state even after the operator leaves. Maintenance personnel arriving on site can clearly see that "someone pressed the E-stop," making it easier to trace the cause of the shutdown. ② Prevention of inadvertent restart — an auto-resetting E-stop may reset itself when the operator releases it or under vibration, causing the crane to suddenly re-power after an unexplained stoppage. EN 13557 Cranes — Control devices and operating positions explicitly requires that resetting the E-stop be a deliberate, separate manual action (twist or pull), and must not occur simultaneously with any other operation such as re-powering.
Q: What's the difference between a safety PLC and a standard PLC? Can one PLC handle all control functions?
A: They cannot be used interchangeably. A safety PLC (e.g., Siemens F-CPU, Pilz PSS series) uses two independent processors that cross-compare their computation results, with a self-test cycle of ≤10 ms and a fault response time of ≤100 ms. A standard PLC (e.g., Siemens S7-1200 standard model) uses a single-processor architecture and lacks hardware-level redundant self-checking capability. EN 13557 requires that safety functions rated at PLd/SIL2 be implemented with a safety PLC, while non-safety functions (e.g., lighting, ventilation) may use a standard PLC. The typical architecture is "safety PLC for the safety circuit + standard PLC for process control," with data exchanged between them via safety communication protocols such as PROFIsafe or CIP Safety.
Q: Is a Radio Remote Control as safe as a wired pendant station?
A: From the perspective of EN 13557, the two are equivalent when they achieve the same safety level, but they differ in implementation. With a wired pendant, the E-stop signal travels through a physical cable directly to the Safety Relay — the signal path is a metallic conductor, and the primary failure mode is cable breakage, which is detectable. With a Radio Remote Control, the E-stop signal is transmitted over radio — the signal path passes through five stages: encoding, modulation, transmission, demodulation, and decoding. A fault at any one of these stages could result in loss of the E-stop command. EN 13557 therefore requires that safety communication for radio remote control achieve SIL2 or PLd — meaning the remote-control system itself must incorporate redundant communication channels and a periodic "heartbeat" self-check (the transmitter and receiver exchange a status verification signal every 50 ms; if no heartbeat is received within 200 ms, an emergency stop is triggered).
Q: What items are included in the periodic inspection of a control station?
A: The periodic inspection items required by EN 13557 include: ① Monthly — manually test every Emergency Stop Button one by one (press to confirm the main contactor disengages; reset to confirm re-powering is possible). Record the test result for each E-stop button. ② Quarterly — test all Limit switches (including deceleration limit switches and limit switches). Use a multimeter to verify the resistance change at the contact (≤0.5 Ω when closed, ≥1 MΩ when open). ③ Annually — full verification testing of all safety functions, including overload limiting calibration using test weights (error ≤±5%), comparison of calculated vs. measured torque values for the Load moment limiter (LML), and fault-injection testing of the safety PLC (simulating an input channel fault to verify the PLC correctly identifies it and shuts down safely). ④ Every 5 years — replace all Emergency Stop Buttons and Safety Relays (proactive replacement of life-limited components), regardless of their current condition.
