Hoists, holding loads and the safety chain
One question decides almost everything in this subject: is there a person under the load? A hoist lifting a truss into position with the room clear and a hoist holding that truss over a performer are, legally and mechanically, different machines — and the words D8, D8 Plus and C1 exist to say which one you are holding.
An explanation written so that everybody around a rigging conversation — designers, programmers, production managers, students — can follow what is being said and ask a better question. It is not a design authority, a substitute for training, or a basis for deciding what may be flown. Those belong to a competent rigger, the governing standards, and the person who signs.
Start here
The layers, and the rule that holds them together
Every serious machinery incident in this industry has the same shape: a layer that was quietly relying on the layer above it. So it is worth naming them in order, because the order is the argument.
1 — Mechanics. Chain, brakes, design factor, the load path from the fixture to the building. Physics, and it does not care what anybody intended.
2 — Classification. What this machine is permitted to do at all: lift only, hold over people, move over people. This is where D8, D8 Plus and C1 live.
3 — The safety function. Emergency stop, limits, overload and slack detection, speed monitoring. Rated to a Performance Level, and electrically independent of the show.
4 — The control system. The console, the network, the cue list, the operator. This is where the show lives, and it is advisory.
5 — Procedure. Who is competent, who checks, who watches, what the exclusion zone is, who signs.
And the rule: each layer must remain valid when the layer above it is wrong. That is the same claim as the pyro arming chain and the separate safety channel on a PLC, stated in full — and it is why a cue file can never be the reason a machine is safe.
The words everybody uses
D8, D8 Plus and C1
These come from German accident-prevention regulation — BGV C1, now DGUV Vorschrift 17 — and they became the international shorthand because nothing else was as short. They describe what a hoist and its control system are permitted to do, not simply what is inside the motor.
D8
standard hoist · single brake
An ordinary electric chain hoist. It lifts a load into position and then the load is secured by other means — steels, safeties, a dead-hang — before anybody works underneath.
A single brake means a single failure can release the load. That is the whole reason for the restriction.
D8 Plus
second, independent brake
The same machine with redundancy in the thing that holds: a second brake, independent of the first, so that a single brake failure does not drop the load.
That permits a static load to be suspended above people. It does not permit that load to move while they are there — nothing is monitoring the motion.
C1
full compliance · monitored motion
Redundant braking plus a monitored, rated control system: position and speed feedback, overload and slack-chain detection, and safety functions assessed to a Performance Level.
Only at this point may a load be moved above people — because only at this point is something independent of the operator watching whether the movement is doing what it was asked to.
- The name of the country is part of the answer. Germany reaches for DGUV, the UK for BS 7906, the US for the ANSI E1.6 family, and Europe increasingly for EN 17206. They are answering the same question and none of them uses the others' words for it.
- Performer flying is its own discipline. It is not rigging with a person on the end — see ANSI E1.43 — and the whole risk assessment is different.
- Inspection intervals are part of the classification. A compliant hoist with an expired inspection is not a compliant hoist.
- "Over people" includes the crew. The exclusion zone is not an audience-only concept, and load-in is when most of the exposure actually happens.
The two letters everybody swaps
WLL, SWL, and the design factor underneath both
These get used interchangeably in conversation and they are not interchangeable, and the difference is exactly the kind of thing that decides an argument on a loading dock.
WLL — Working Load Limit. A property of the equipment, assigned by the manufacturer and marked on the item. It is derived from the minimum breaking load divided by a design factor, and it does not change with how you use the thing. A shackle stamped 3.25 t has a WLL of 3.25 t on Monday and on Friday.
SWL — Safe Working Load. Historically, the maximum load in a particular configuration and application, as assessed by a competent person. It can be — and often is — lower than the WLL: a sling at an angle, a beam clamp near an edge, a shackle side-loaded, an unusual environment.
The important part is what happened to the term. SWL has been largely retired from modern standards and legislation, because it implied a guarantee that could not be given and because it blurred a manufacturer's rating with a situational judgement. Current equipment standards and UK lifting legislation use WLL. Plenty of people still say SWL out of habit, and that is fine — as long as everybody in the conversation knows which of the two things is being claimed.
Underneath both sits the design factor: WLL is the minimum breaking load divided by it. Entertainment work commonly uses higher factors than general industry, because a load is over people and because the equipment lives in a truck.
- Angle eats capacity. A two-leg sling does not share the load evenly at any angle other than vertical, and a wide included angle multiplies the tension in each leg dramatically. The bridle geometry tool shows the shape of it; the actual selection belongs to a rigger.
- A rating is for the intended loading direction. A shackle side-loaded, a hook tip-loaded or an eyebolt pulled at an angle is outside what the marking describes.
- The weakest component sets the assembly. A 3.25 t shackle on a 1 t sling is a 1 t assembly, and the shackle marking is the number people will quote.
- Unmarked is unusable. If the marking is illegible the item has no rating you may rely on, whatever it looks like.
The bit nobody explains
What a safety relay does that a stop button does not
This is the single most useful thing on the page, because once you have seen it you can never again read "emergency stop fitted" as a specification.
A plain stop circuit is one wire through one button to one contactor. Press it and the circuit opens and the machine stops. It works — right up until one of three things happens. The button's contact welds shut. A cable chafes and shorts the two sides together. Or the contactor itself welds, which is what contactors do at the end of their lives.
In all three cases the machine keeps running, the button does nothing, and nothing in the system knows. It will look completely normal at the next pre-show check, because the check is somebody pressing the button on a machine that then stops for an entirely different reason, or not checking at all.
So a safety relay does five things instead
Two channels. The button carries two independent circuits, and the relay expects both to open. One channel failing does not defeat the function.
Discrepancy monitoring. If one channel opens and the other does not within a short window, that is not a stop — it is a fault. The relay latches out and refuses to reset. A welded contact or a broken wire is now visible instead of silent.
Cross-fault detection. Each channel carries a distinct pulsed test signal, so a short between the two channels — which would otherwise defeat the redundancy completely — is detected as the two channels reading each other's pulses.
Positively guided contacts. Inside the relay, the normally-open and normally-closed contacts are mechanically tied together. If a normally-open contact welds closed, the normally-closed one physically cannot close. The relay reads that back and knows.
A feedback loop. The relay watches the mirror contacts of the contactors it is switching. A welded contactor downstream means the relay will not permit a reset — which is the one that catches the failure the plain circuit could not see at all.
Add a monitored manual reset — requiring both a rising and a falling edge, so a taped-down reset button cannot arm anything — and you have a function where a single fault does not cause loss of safety, and the fault is detected. That sentence is the definition of Category 3 and 4 in ISO 13849-1.
The device itself
What the standards actually require of an e-stop
The physical requirements come mostly from ISO 13850 and IEC 60947-5-5, and they are more specific than most people expect.
| Requirement | The rule | Why it is that way |
|---|---|---|
| Colour | red on yellow | Reserved for emergency stop. Using red-on-yellow for anything else — a house-light kill, a convenience stop — dilutes the one signal a stranger will recognise under pressure. |
| Shape and size | palm or mushroom head | It has to be operable by the flat of a hand, without looking and without accuracy. The common 40 mm head follows from that requirement rather than the other way round. |
| Latching | stays in when pressed | The stop persists without anybody holding it, and releasing takes a deliberate twist, pull or key. |
| Release behaviour | must not restart the machine | Releasing only permits a restart. A separate, deliberate reset is required, so that clearing a fault cannot itself set something moving. |
| Contacts | directly opening | A rigid mechanical link forces the contact apart, so a welded contact still opens when you push. An ordinary relay contact offers no such guarantee. |
| Wiring | normally closed | The circuit is held closed by the healthy button. A cut cable, an unplugged connector or a corroded terminal is therefore a stop — a fault fails toward safe rather than toward silence. |
| Reach | from every operating position | And along access routes, unobstructed, at every position from which somebody could start the machine or be exposed to it. |
| Span of control | the whole hazard zone | One button must stop everything in the zone it covers. A machine that stops while the one beside it keeps moving means the zones were never actually defined. |
| Stop category | 0 or 1, never 2 | From IEC 60204-1. Category 0 removes power immediately — correct for a hoist, because the brake is spring-applied and losing power applies it. Category 2 keeps power on and is not permitted. |
- An emergency stop is a complementary measure, not a protective one. ISO 13850 says so explicitly. It does not make a machine safe; it is the last resort after safe design, guarding and limits have done their work.
- It cannot be the reason people are allowed to be there. If the safety case depends on somebody noticing and reacting in time, there is no safety case.
- Test it as a function, not as a button. Pressing it and watching the machine stop proves the happy path. It proves nothing about the second channel, the feedback loop or a welded contactor.
- Never fit a stop that only tells software to stop. If the path from the button runs through the control system, the control system is now part of the safety function — and it was not assessed as one.
How much protection is enough
The risk graph, and what PL and SIL actually mean
Before you can say whether a safety function is good enough, you have to say what it has to achieve. ISO 13849-1 answers that with three binary questions, asked in a fixed order, and a graph with eight leaves.
The output is a required Performance Level, PL a through e — a target expressed ultimately as a probability of dangerous failure per hour. IEC 62061 answers the same question through SIL instead, and both derive from IEC 61508. They correspond roughly, and a specification quoting both without saying which was assessed is quoting marketing.
Try the three questions on a real case.
This determines what the function must achieve. Whether a given design achieves it is a separate calculation from architecture, MTTFd, diagnostic coverage and common-cause failure — and that calculation is the competent person’s, not this page’s.
The number that surprises people
How far it travels after you press the button
A safety relay responds in tens of milliseconds. That is a true fact and it answers the wrong question, because nothing has started slowing down yet. The number that matters is the total travel: the distance covered during the reaction time, plus the distance covered while actually decelerating.
Reaction is detection plus logic plus output switching — and on a networked safety system, plus the watchdog timeout, which is why the watchdog is a design decision rather than a default. Deceleration is mass and brake torque, and it dominates.
Safety on the same wire
The black channel, and why it works
Modern machinery does not run a parallel loop of hard wiring to every emergency stop. The safety function travels over the same industrial network as everything else — PROFIsafe on PROFINET, Safety over EtherCAT on EtherCAT, CIP Safety on EtherNet/IP.
The idea that makes this legitimate is the black channel. The safety layer assumes the network underneath it is completely untrustworthy and protects itself: its own CRC over the safety payload, its own sequence numbering, its own device identifiers, and its own watchdog. Corruption, loss, duplication, delay, resequencing and messages arriving at the wrong device are each detected by the layer above, so the network itself never has to be safety-rated.
That should look familiar. It is precisely the toolkit from how a one gets down a wire — checksums, sequence numbers, timeouts — applied with the assumption that everything below has failed. And the consequence lands back in the previous section: the watchdog timeout is part of the stopping time, and therefore part of how far away the barrier has to be.
Where the show sits
Layer four, and what it is allowed to be
A cue file can ask a machine to move. It can sequence, monitor, report and integrate with lighting, sound and video. It is where the artistry of automation actually happens, and none of that is diminished by the next sentence.
It cannot be the reason anybody is safe. Not the console, not the network, not the timecode, not the operator's attention. The safety function must hold when the control system is running the wrong file, has crashed, has been updated by somebody helpful, or is being driven by a laptop that should not have been plugged in.
Which is also why the automation operator has a dead-man and the lighting operator does not — and why an automation cue is called and confirmed rather than simply fired. The procedure at layer five exists because layers three and four are known to be insufficient on their own.
- Nobody has ever been hurt by a machine that was not moving. The classifications, the zones and the procedures are all versions of that sentence.
- The competent person is a role, not a compliment. It has a definition in the standards and it comes with responsibility somebody has accepted in writing.
- Ask which layer a claim belongs to. "It has a safety relay" is layer three. "It is D8 Plus" is layer two. "The cue list checks the position" is layer four, and is not a safety claim at all.
- If the answer to "can we fly that during the show" is yes, ask what makes it yes. There is a correct answer with a document behind it, and everybody in the room benefits from hearing it out loud.
This page exists so that more people in a production can follow a rigging conversation, ask a sharper question, and understand why an answer is what it is. Deciding what may be flown, over whom, and on what equipment belongs to a competent rigger working to the standards for the territory you are in — and to the person whose signature is on it.
This is the area where the gap between what is written down and what practitioners know is widest, and where regional practice diverges most. The standards index lists the governing documents with access links. If a description here does not match how it works in your territory, open an issue — corrections from riggers are the ones worth having.
2 questions on the mechanism rather than the trivia. Nothing is scored and you can answer again — the explanation under a wrong answer is the point of it.
-
1Somebody hands you a shackle with no markings. What is its working load limit?
-
Right. A WLL is a property the manufacturer marks on the item. Unmarked is unusable — not because of a paperwork rule, but because nothing about the object tells you what it will hold.
-
An assumption about a load-bearing component is the thing this discipline exists to prevent.
-
Destructive testing tells you about the one you destroyed, not the one you were about to use.
-
A table tells you what a compliant shackle of that size should be. It tells you nothing about this one.
-
-
2Two legs of a bridle at a wide angle carry the same load as two legs at a narrow angle. True or false?
-
It is the other way round. Spreading the legs increases the tension in them.
-
Length matters because it sets the angle. The angle is what governs the tension.
-
The vertical component is shared, but each leg carries more than its share of the vertical as the angle opens.
-
Right. As the angle from vertical increases, each leg needs more tension to produce the same upward force. At 120° between legs, each leg carries the full load rather than half of it.
-
Answers are kept in this browser on this device. Nothing is sent anywhere.
- What may hang over people?
- How is a safety relay different?
- What does SIL 3 mean?
Where to go next
These pages are a chain rather than a library — the next one along usually answers the question this one raised.
Everything on this page, in the index
Each of these has its own entry with sources, ports, gotchas and an open gap where a field is missing.