Two-Hand Control Explained: Types, Standards, and Wiring

Two-hand control is a machine safety device that requires an operator to press and hold two separate actuators simultaneously — one for each hand — before and during a hazardous machine motion. Because both hands are occupied on the control device, they cannot be inside the danger zone when the machine strokes, stamps, or cuts.

The defining logic is straightforward: if either hand releases its button, the machine stops or cannot initiate a new cycle. The actuators must be placed far enough apart, and recessed or guarded enough, that a single hand or other body part cannot bridge them. That spatial separation, combined with the electronics that enforce simultaneous actuation, is what makes two-hand control a presence-sensing safeguard rather than just a start interlock.

What Two-Hand Control Is and Why Both Hands Must Be Occupied

A two-hand control device does not merely start a machine — it holds the operator's hands away from the hazard zone for the duration of the dangerous portion of the cycle. This is the key distinction from a simple two-button start sequence, where an operator could press both buttons and then reach into a die before it closes.

A properly designed two-hand control enforces three conditions simultaneously:

• Concurrent actuation: Both buttons must be pressed (and held) at the same time.
• Synchronous actuation: The two buttons must be pressed within a defined time window (typically no more than 0.5 seconds of each other).
• Continuous hold: If either button is released before the hazardous motion is complete, the machine stops and cannot restart without resetting the control.

These three conditions together mean the operator's hands are positively committed to the control station throughout every stroke or cycle. The moment a hand is free — to reach toward a tool, adjust a workpiece, or any other reason — the machine either stops immediately or cannot initiate.

Two-hand control is classified as a safeguarding device under ISO 12100 (risk reduction hierarchy) because it limits exposure by occupying the operator's hands, not by physically guarding the hazard zone. It is often used in combination with other safeguards, and it protects only the operator at that station — bystanders require separate protection.

Where Two-Hand Control Is Used

Two-hand control is most common on machines where:

• The tooling closes with enough force or speed to cause serious injury before a light curtain or presence-sensing device could react.
• The hazard zone is small and well-defined, making hand-occupation a practical safeguard.
• A single operator performs repetitive cycling close to the point of operation.

Typical applications include:

• Mechanical and hydraulic power presses — stamping, blanking, piercing, forming
• Press brakes — bending sheet metal, where fingers can enter the die space
• Riveting and staking machines
• Spot welding guns (hand-held or fixed)
• Injection moulding machines during mould-change operations
• Assembly presses and arbor presses
• Cold-forming and heading machines

In many press applications, two-hand control is used alongside — or as an alternative to — physical guards and light curtains. The choice depends on the risk assessment and whether the operator needs frequent access to the point of operation between cycles. See our guide to machine guarding explained for how these safeguards are selected and layered.

The Types: ISO 13851 / EN 574 Type I, II, and III

The governing standard for two-hand control devices is ISO 13851:2019 (which replaced EN 574). It defines three types of two-hand control, distinguished by the defeat-resistance and synchronous-actuation features they provide.

Type	Concurrent actuation required	Synchronous actuation window	Anti-tie-down	Anti-repeat
I	Yes — both hands simultaneously	No fixed window	No	No
II	Yes — both hands simultaneously	No fixed window	Yes	Yes
III	Yes — both hands simultaneously	Yes (≤ 0.5 s)	Yes	Yes

Type I is the most basic level. Both buttons must be pressed at the same time, but there is no time window, no anti-tie-down, and no anti-repeat logic. A Type I device can be defeated by taping down one button. It is suitable only for low-risk applications with additional safeguards.

Type II adds anti-tie-down (an actuator that is held down from a previous cycle cannot initiate a new one — it must be released and re-pressed) and anti-repeat (the machine cannot re-stroke while both buttons are held; they must be released and re-pressed for each cycle). This prevents some common defeat attempts but still lacks a synchronous window.

Type III is the highest and most commonly specified level. It adds the synchronous actuation requirement: both buttons must be pressed within 0.5 seconds of each other. If one button is pressed more than 0.5 s before the other, the control does not initiate a cycle. Type III is further divided into two sub-categories:

• Type IIIA: The output signal is maintained only while both actuators are held. Release either button and the output drops immediately. This is used when the machine can be stopped mid-cycle.
• Type IIIC: The output signal is maintained until the end of the hazardous portion of the machine cycle, even if both buttons are released. This is used on full-revolution clutch presses that cannot be stopped mid-stroke — the control prevents a second stroke but cannot stop the current one.

For most modern press applications with partial-revolution (friction) clutches, Type IIIA is specified because the machine can stop at any point in the cycle. Full-revolution mechanical clutch presses that cannot stop mid-stroke require Type IIIC and additional design attention to the stop categories achievable by the drive.

Synchronous Actuation: Why the 0.5-Second Window Matters

The 0.5-second synchronous window is not arbitrary. It is derived from the safety distance calculation in ISO 13855: the formula S = K × (T_s + T_c) relates the minimum distance between the two-hand control station and the hazard zone to the stopping time of the machine.

The 0.5-second window is the maximum additional time ISO 13851 allows between the first and second button presses before the device refuses to initiate. If the window were longer — say, 2 seconds — an operator could press one button, then reach toward the hazard zone, then press the second button with the other hand, and still initiate a stroke with one hand dangerously close to the tooling.

In practice, 0.5 seconds is short enough that a deliberate attempt to bridge both buttons with one hand and then reach in will fail: the window expires before a hand can travel from the control station to a typical hazard zone placed at the correct safety distance.

What happens when the window is violated:

1. Operator presses button A.
2. More than 0.5 seconds pass without button B being pressed.
3. The two-hand relay or safety PLC detects the timeout and latches a fault condition.
4. The machine cannot initiate a cycle.
5. The operator must release both buttons and re-press them concurrently within the window to reset.

This reset requirement — releasing both buttons and starting fresh — is central to the anti-repeat function described below.

Anti-Tie-Down and Anti-Repeat

Anti-tie-down and anti-repeat are related but distinct defeat-prevention mechanisms. Both are required for Type II and Type III devices.

Anti-Tie-Down

Anti-tie-down prevents a cycle from being initiated if one or both actuators is held continuously from a previous cycle. The most common defeat attempt on a two-hand control is to tape, clamp, or wedge one button down so that only the free hand needs to press and hold the other. The operator then has one hand available to enter the hazard zone.

Anti-tie-down works by monitoring whether each actuator was released (returned to the de-energised state) between the end of the last cycle and the start of the next. If button A was never released, the device will not allow a new stroke even when button B is also pressed.

Anti-Repeat

Anti-repeat prevents multiple machine cycles from occurring from a single press-and-hold of the actuators. Without anti-repeat, an operator could hold both buttons down, and the machine could cycle repeatedly without the operator consciously initiating each stroke.

Anti-repeat requires that both actuators be released at the end of each cycle before a new cycle can be initiated. On a Type IIIA device this is enforced by monitoring the return of both buttons to their de-energised positions after the output signal drops.

Together, anti-tie-down and anti-repeat ensure that every machine cycle corresponds to a deliberate, fresh actuation of both buttons — and that neither button can be held in the actuated state between cycles to reduce the operator's conscious effort.

Safety Distance

Knowing that the synchronous window is 0.5 seconds is only part of the picture. The two-hand control station must also be placed far enough from the hazard zone that a hand cannot reach the danger point during the machine's stopping time plus the 0.5-second window.

The formula from ISO 13855 for two-hand control is:

S = K × (T_s + T_c)

Where:

• S = minimum safety distance (mm)
• K = hand speed constant (typically 1,600 mm/s per ISO 13855, conservative value)
• T_s = stopping time of the machine at the point of maximum stopping time (seconds)
• T_c = response time of the two-hand control device itself (seconds)

The standard adds an additional allowance for the synchronous time window when calculating the overall response time. In practice, the safety distance for a two-hand control is often larger than for a light curtain on the same machine, because the synchronous window adds to the effective response time.

Key installation requirements:

• The actuators must be spaced far enough apart (minimum 260 mm center-to-center per ISO 13851) that both cannot be actuated by one hand.
• Actuators must be guarded or recessed so that accidental actuation by leaning, elbow contact, or a single fist is prevented.
• The control station must be fixed — not hand-held — unless the design specifically prevents defeat through mobility.
• The station must be positioned so that the operator cannot release the actuators and reach the hazard zone before the machine has stopped.

Wiring: Dual-Channel, Normally-Open / Normally-Closed Architecture

The electrical architecture of a two-hand control follows the same dual-channel principle used for all safety-rated interlocks. Understanding this wiring is essential for controls engineers specifying or commissioning the safety circuit.

Button Contact Configuration

Each actuator in a two-hand control station has both a normally-open (NO) and a normally-closed (NC) contact, wired into separate channels of the safety relay or safety PLC. This dual-channel arrangement detects:

• Short-circuits between channels — if the two channels are bridged externally, the NC contacts will show an inconsistent state.
• Welded (stuck) contacts — if a NO contact welds closed, the NC contact on the same button will not open when the button is released, allowing the safety relay's cross-monitoring to detect the fault.
• Single-channel failures — loss of one channel generates a fault rather than a dangerous output.

Simplified wiring architecture:

Button A (Left hand):
  Channel 1: A_NO → Safety Relay Input 1+
  Channel 2: A_NC → Safety Relay Input 2+

Button B (Right hand):
  Channel 1: B_NO → Safety Relay Input 1+  (series with A_NO)
  Channel 2: B_NC → Safety Relay Input 2+  (series with A_NC)

The NO contacts from both buttons are in series on Channel 1 — both must be closed (both pressed) for the channel to be energised. The NC contacts from both buttons are in series on Channel 2 — both must be open (both pressed) for Channel 2 to show the correct state.

Two-Hand Relay vs Safety PLC

Dedicated two-hand safety relays (from manufacturers such as Pilz, Schmersal, SICK, Jokab/ABB, and Banner) implement the synchronous window, anti-tie-down, anti-repeat, and dual-channel monitoring in a single certified module. They are a common choice for stand-alone machines with a simple safety architecture. See our what is a safety relay guide for a detailed breakdown of how these modules work.

Safety PLCs (such as Siemens F-CPU, Allen-Bradley GuardLogix, Pilz PSS 4000, or B&R SafeLogic) implement the two-hand control function in software using certified safety function blocks. The wiring is the same dual-channel architecture, but the synchronous window timer, anti-tie-down logic, and anti-repeat logic are implemented in the safety program rather than in discrete relay hardware.

The safety PLC approach is preferred when:

• The machine has multiple safety functions that would require many individual safety relays.
• The two-hand control must interact with other safety devices (light curtains, interlocked guards, e-stops) in a coordinated, mode-dependent way.
• Diagnostic data from the safety function must be available to a SCADA or HMI system.
• The safety integrity level requirement is SIL 2 or SIL 3, where a safety PLC's proof-test interval and diagnostic coverage are better documented.

For the safety PLC implementation, the two-hand control function block typically takes the following inputs:

• S_Button_A_NO: Normally-open contact from left actuator, Channel 1
• S_Button_A_NC: Normally-closed contact from left actuator, Channel 2
• S_Button_B_NO: Normally-open contact from right actuator, Channel 1
• S_Button_B_NC: Normally-closed contact from right actuator, Channel 2
• Activation: Enable input from the safety program (e.g., guarded mode active)

And it produces:

• Q: Safe output — TRUE only when concurrent + synchronous + held conditions are met
• Fault: Diagnostic output indicating which condition was violated
• DiagCode: Enumerated fault code for HMI display

The safety PLC enforces the same logical conditions as a dedicated relay but logs every fault event with a timestamp and fault code, which is valuable for incident investigation and proof-test documentation. The e-stop wiring for the machine should also be reviewed alongside the two-hand control circuit — see our guide to e-stop safety circuit PLC ladder logic for the complete picture.

How the Safety System Prevents Defeat

The combination of dual-channel wiring and the relay/PLC logic prevents the most common defeat attempts:

Defeat attempt	How the system detects or prevents it
Tape one button down	Anti-tie-down: button must be released between cycles
Press both buttons with one hand	Minimum 260 mm spacing; actuation guard geometry
Press button A, wait, press button B	Synchronous window (0.5 s max) expires; fault latched
Hold both buttons for multiple cycles	Anti-repeat: both must be released after each cycle
Bridge both channels with a jumper	NC contacts show inconsistent state; relay/PLC faults
Weld a NO contact closed	NC contact remains closed when button released; cross-monitoring detects
Remove one channel wire	Single-channel loss detected as fault; output drops

The safety relay or safety PLC achieves a Performance Level (PL) up to PLd or PLe (ISO 13849) or SIL 2/3 (IEC 62061) when properly specified, wired, and programmed. The achieved PL depends on the architecture category (Cat 3 or Cat 4), the diagnostic coverage of the monitoring logic, and the MTTFd values of the components used.

---

Frequently Asked Questions

What is two-hand control?

Two-hand control is a machine safety device that requires an operator to press and hold two physically separated actuators simultaneously — one with each hand — to initiate and maintain a hazardous machine motion. Because both hands are occupied on the control, they cannot be inside the danger zone during the stroke. The device enforces concurrent actuation, synchronous actuation (both buttons pressed within ~0.5 s of each other), and continuous hold, so the machine stops if either hand is released.

What are the types of two-hand control?

ISO 13851 defines three types. Type I requires concurrent actuation of both buttons but has no synchronous window and no anti-tie-down. Type II adds anti-tie-down and anti-repeat to Type I. Type III adds a synchronous actuation window (≤ 0.5 s) to Type II, and is the most defeat-resistant level. Type III is subdivided into Type IIIA (output maintained only while both buttons are held) and Type IIIC (output maintained to end of cycle, for full-revolution clutch presses). Most modern press safety specifications require Type IIIA.

What is anti-tie-down?

Anti-tie-down is a feature that prevents a machine cycle from being initiated if one or both actuators was not released (returned to de-energised state) after the previous cycle. It defeats the common tactic of clamping or taping one button down so the operator has a free hand to reach into the hazard zone. The safety device monitors whether each button returned to its rest position between cycles; if not, it blocks the next cycle regardless of how the other button is pressed.

Why must both buttons be pressed within 0.5 seconds?

The 0.5-second synchronous window prevents an operator from pressing one button, moving a hand toward the hazard zone, and then pressing the second button with the remaining hand to initiate a stroke with one hand already partially inside the danger zone. ISO 13855 safety distance calculations show that 0.5 seconds is the maximum additional time window that can be permitted while still keeping a hand, moving at 1,600 mm/s, out of a correctly distanced hazard zone. If the two buttons are not both pressed within 0.5 seconds, the device locks out and requires both buttons to be released and re-pressed from rest.