Are normally open contactors virtually safe from failing closed?

Question

Quick question: are normally-open contactors (which I assume are simply high breaking capacity relays) virtually safe from failing closed?

I want to cut off a 400V 3-phase supply using an emergency stop, and I have 2 options:

1. Use a 3-pole emergency stop, and wire the three phases to that button. I don't like the idea of 400V being so close to the user's hands.
2. Wire the contacts of a 3-pole normally-open contactor on the supply line, and wire the emergency stop on the 230V coil.

Three phase is used for heating, not for a giant chainsaw, but the emergency button should still do its job should it be pressed. So is option 2 commonly accepted, and safe enough for an end product? Any norms stating this on which I could rely?

Edit implementing the answer

I am quite keen on the idea of forcing the user to fix a failure in the redundant system, but I'm trying to limit the number of components as well. Is this a good comromise? I found this contactor, which has 1NC and 1NO auxiliary contacts that we can use.

Since the current in the coils is already very small compared to the switches capability, I made them single pole, if that is acceptable.

In particular, I'm not sure whether there is a possibility that the auxiliary contacts do not follow the main contacts (meaning the main contacts may fail closed or welded without the auxiliary contacts staying open when normally closed), could you confirm?

Answer 1

No, they are not safe from failing closed. No switch is, mechanical or solid-state.

Therefore, an E-STOP or other safety switch requires at least two overrated contacts that operate independently, so that one getting welded does not prevent the other from operating.

For your option #1, you would wire these in series, but it's not recommended because of the reason you stated and because there's no way to tell that one has failed until they both go.

For your option #2, you would wire these as part of two identical circuits, with all relevant safety switches wired in series, and the two channels wired in parallel and kept separate electrically. (no crossover wiring) Then each channel drives the coil of its own contactor, and the contactors are wired in series to control the load.

Also with option #2, you can now create a latching/lockout circuit using the two safety channels and the contactors' auxiliary contacts so that a separate button is required to turn it back on once the safeties are satisfied, and only if both have dropped out. This forces you to fix a stuck contactor before they both become stuck.

Per a comment, here's one possible version of option #2:

^{simulate this circuit – Schematic created using CircuitLab}

Or, if you have sufficiently deep pockets, you could buy a safety rated PLC and do all of this in software with even more fault-checking and detailed diagnostics.

Please note that I am in a different industry now, and so there may have been some legal changes since I left. Check the latest electric codes, OSHA regulations, etc., before trusting this (or anything else really) to an operator.

Answer 2

EDIT - the original question referred to relays and not contactors. It might be confusing to see the question now referring to contactors with my answer suggesting the use of a contactor!

People normally use a contactor for this sort of job: -

Found here. Here's what wiki says about contactors and relays: -

Unlike general-purpose relays, contactors are designed to be directly connected to high-current load devices. Relays tend to be of lower capacity and are usually designed for both normally closed and normally open applications. Devices switching more than 15 amperes or in circuits rated more than a few kilowatts are usually called contactors. Apart from optional auxiliary low current contacts, contactors are almost exclusively fitted with normally open ("form A") contacts. Unlike relays, contactors are designed with features to control and suppress the arc produced when interrupting heavy motor currents.

Here is what Rockwell say about safety contactors (you may decide on this as a preferred product): -

Safety Contactors and 700S Safety Control Relays provide mechanically linked, positively-guided contacts up to 97 A which are required in feedback circuits for modern safety applications. 100S-D Safety Contactors provide safe isolation of hazardous motion loads, using mirror contact performance. Mirror contacts provide reliable indication about the open or closed status of the main power poles.

And finally, the EU machinery directive implies that hazards be assessed and appropriate safety measures taken. The impact of this is that equipment/installations can be categorized with a letter/number and appropriate equipment purchased to maintain that level of safety. I would recommend that you look into this. Here is a website related to safety relays that discusses the relevant safety categories. Incidentally you may need to use a category 3 contactor.

Answer 3

Whatever the manufacturer may or may not say, I would strongly urge you to limit the consequences of such a failure by adding redundant safety features such as a thermal cutoff or mechanical stop so that injuries and intolerable property damage are prevented. Even if the relay is 100.000% reliable from that kind of failure, the driving circuitry could fail or something could jam the contactor test button or whatever.

Some products have three safety devices- one electrical, one hydraulic and one purely mechanical, because a failure could result in severe injury to an operator.