1 of 15 AUTOMATION SAFEGUARDING REQUIREMENTS FOR DESIGN, CONSTRUCTION, MANUFACTURING AND INSTALLATION OF AUTOMATED SYSTEMS I. SCOPE AND PURPOSE A. Scope To provide guidelines for Design, construction, identification, installation and safeguarding of automated systems. B. Purpose The purpose of this instruction is to provide methods for the design and construction of automated system installations and for the safeguarding of personnel who maintain and operate automation systems. Existing installations must be retrofitted sufficiently to meet the intent of this instruction through the use of comparably effective means, appropriate to individual equipment layout and design characteristics. Where retrofitting is necessary, time phase planning shall reflect realistic funding availability. The corporate safety/health function will decide all questions regarding the intent of this publication. II. REFERENCES ANSI/RIA R15.06 (1999) Industrial Robots and Robot Systems Safety Requirements Federal and State Occupational Safety and Health Acts National Electric Code/NFPA 79, Electrical Standard for Industrial Machinery (1987) MTI SMI-107, "Control of Hazardous Energy (Lockout)" MTI SMI-109, "Safeguarding of Robots & Robot Systems" MTI SMI-126, "Safety and Maintenance of Secondary Electrical Distribution Systems" DAIMLERCHRYSLER Corporation Tool and Design Standards Vol. IV III. FUNCTIONS AFFECTED Advance Manufacturing Engineering Facilities Engineering Production Engineering Material Handling Engineering
2 of 15 Employee Safety Industrial Hygiene Procurement & Supply IV. OPERATIONS AFFECTED DAIMLERCHRYSLER Corporation and Subsidiaries V. INFORMATION AND INSTRUCTIONS This information is intended to assist Manufacturing Engineering personnel in providing proper safeguarding for automated equipment. This information is not intended to supersede any local, state, federal or Manufacturers Rules and regulations. The major areas covered in this MTI are as listed below: - Construction and Modification - Installation - Safeguarding Equipment - Safeguarding the Operator - Safeguarding Maintenance Personnel - Inspection - Testing and Start-up - Training - Documentation VI. DEFINITIONS A. Automatic: Is the mode in which continuous or repeating operations can be initiated. B. Automatic Operations: The period of time during which machinery/equipment are performing programmed tasks through unattended, repetitive program execution. C. Awareness Barrier: A barrier constructed and installed so that a person cannot approach a hazardous condition or zone without sensing the presence of the barrier. The awareness barrier shall be located so as to prevent inadvertent entry into the hazardous condition or zone and nuisance tripping of presence sensing devices. The use of such a barrier will require additional safeguarding be used. (Also known as a Low Barrier). The barrier shall be low enough to not create additional pinch points. D. Awareness Device: An audible, visual or physical device used to alert personnel of a potentially hazardous area, and to prevent inadvertent exposure.
3 of 15 E. Barrier: A physical means of separating persons from hazardous conditions or zones. F. Cycle Stop: A controlled shut down of a device, station, or zone that de-energizes the automatic mode and removes power to all robot and transfer drives while permitting selected local manual operations including robot teach. G. Drive Power: The energy source or sources for the machinery, actuators, and related equipment that produce motion. H. Emergency Stop: A "control state" that overrides system or stand alone equipment controls resulting in the immediate removal of all drive power and I/O power except I/O power used for status monitoring. This removal shall cause all moving mechanisms to stop. **I. Enabling Device: See SMI-109 (Pendent) J. Hazardous Motion: Unintended or unexpected motion that may cause injury. K. Low Barrier: See Awareness Barrier L. Restricted Area: A location inside the perimeter of a barrier or in the path of moving process equipment. M. Industrial Automation System: A system that includes machinery, robotics, and any equipment, devices, and sensors required for the automation to perform its tasks, including communication interfaces for sequencing or monitoring the system. N. Modular Guarding: A method of isolating selected components of automated systems, by restricting access to and from adjacent equipment. O. Pendant: A control device, either portable or station mounted, which is remote from the process control console or panel. **P. Pinch Point Protection: Any method of protecting. Q. Presence Sensing Device: A control device designed, constructed and installed to create a sensing field to detect intrusion into a restricted area by personnel, machinery components, or other objects. R. Programming: To provide the application instructions required for automated systems to perform intended tasks. S. Proximity Detector: A device that can sense objects near equipment, or measure how far objects are from equipment. T. Safeguard: A guard, device or procedure designed for the protection of personnel.
4 of 15 U. Safety Mat: A Pressure Sensitive device used to detect entry into a restricted or hazardous area. V. Secondary Presence Sensing: The sensing of an operator entering the restricted area, of a cell or system, during a clear to enter load condition. These sensing devices are active at all times and when activated will drop drive power to Robot(s) and part transfer system(s). W. Teach Mat: See Pinch Point Safety Mat. X. Vision Safety System: A device, such as a video camera, that is designed, constructed and installed to detect intrusion by objects or personnel into a restricted area. VII. APPLICATION A. Design Construction, Modification The Manufacturing Engineering function shall ensure that the design, construction and/or modification of automated systems and equipment, is in accordance with this instruction. B. Hazards 1. Automated equipment shall be designed, constructed, or contained so that hazards caused by moving parts are minimized. Remaining hazards associated with moving parts shall be eliminated by providing approved protection systems. 2. A means of isolating all sources of hazardous energy to the automated equipment, with lockout capability, shall be provided. 3. All machinery and equipment having long stroke movements (6" or greater) shall be provided with circuitry and devices designed to drop power to drive activators and to mechanically immobilize, in order to prevent potential hazardous movement. a. Mechanical immobilization is most often achieved by pinning or blocking. b. Interlocked pinning/blocking capability must be provided on both sides of major lines at regular intervals (max. 60 ft.) to allow convenient and efficient isolation of energy when access to the automation is required. c. Pinning/blocking devices shall be accessible without exposure to hazardous motion. 4. Machinery equipped with air counter balancing systems must utilize blocking valves, dynamic braking, and latching devices as prescribed in DAIMLERCHRYSLER Corporations Tool and Design Standards.
5 of 15 5. Clearance between moving parts and obstacles such as fences, barriers, columns, conduit pipes, junction boxes, directional control valves, and structural supports, shall be provided to reduce the likelihood of injury from pinch, shear, or trapping points. Minimum hand clearance at employee workstations shall be 4", between obstacles and the path of moving parts. Minimum obstacle clearance in areas less than 24 to the floor or work surface shall be 12. Minimum obstacle clearance in areas between 24 and 72 shall be 18. Minimum obstacle clearance in areas between 72 and 84 shall be 12. 6. Tunnel/silhouette style guarding that prevents a reach in or walk in hazard shall be used for conveyor entrance or exit openings measuring less than 36 inches high or 36 inches wide. 7. All major lines (multiple station) shall be provided with automatically functioning horns (not to exceed 15 dba above ambient) to signal initiation of the automatic mode. Such signals shall last for a duration of five seconds and not allow the movement of machinery or system components until seven seconds. 8. A means shall be provided to release stored energy, except where this may cause a hazard. Stored energy may be present in hydraulic, pneumatic, electrical, or mechanical machinery and equipment. Appropriate lockout/energy control labels shall be affixed at each energy retention source. 9. Electromagnetic interference and radio frequency interference. The design and construction of automated systems shall include effective engineering practices of shielding, filtering, suppression and grounding to eliminate the effects of electromagnetic interferences (EMI) and radio frequency (RFI). 10. Hazards associated with exposure to internal electrical components when maintaining, installing or inspecting electrical service or distribution (dist. panels, I/O panels, junction boxes, switch gear, motor control, main consoles, buss ducts/trays, etc.) must be minimized by providing sufficient system and machine disconnects to achieve total isolation of hazardous energy and lockout capability. C. Emergency Stop 1. All automated equipment shall have an emergency stop circuit. The emergency stop shall override all other controls, remove drive power from the equipment actuators, and cause all moving parts of the systems to stop. 2. Each operator control station shall have an emergency stop device (button or cord). 3. Push buttons that activate an emergency stop device shall be red, unguarded, and unobstructed. In addition, they shall be palm or mushroom head type. 4. Red palm or mushroom head type push buttons shall not be used for any function except emergency stop.
6 of 15 5. Provision shall be made within the emergency stop circuit to include additional stop devices in large or multiple station processes. 6. Following the use of the emergency stop device, restarting the system shall require at least two deliberate actions by the operator to initiate a prescribed start-up procedure. In multiple unit installations, such deliberate action may be accomplished by resetting the single emergency stop push button (maintained contact type only) that was operated, in addition to resetting the main process control panel or a remote restart panel. 7. All emergency stop devices shall have manual reset (push/pull) characteristics. Such devices shall be equipped with lockable hasps. 8. Emergency stop palm buttons shall be readily accessible and located on both sides of multi-station process lines and within 48 of each operator station. E-Stop Cable devices may be used in lieu of E-Stop Buttons. D. Controls 1. Protection from Unintended Operation Actuating controls that initiate power or motion shall be constructed or mounted so as to prevent inadvertent operation. For example, a guarded push button, key selector switch or two-hand controls could be used. 2. Labeling Actuating controls shall be labeled to clearly indicate their function. 3. Remotely Located Controls Part/product transfer equipment shall not function in the auto or manual mode until all safety circuits, devices, or interlocked access faults are restored. 4. Electrical connectors shall be keyed to avoid mismating if such mismating would cause a hazard. Connectors shall be designed and constructed so as to guard against separation, if such separation could cause a hazard. 5. Cycle stop circuitry must be provided at each station (accessible on each side) in multi-station processes to accomplish the following: A. De-energize the automatic mode B. Remove power from all part transfer drives C. Remove power from all robot drives
7 of 15 6. All cycle stop devices shall have manual reset (push/pull) characteristics. Such devices, if equipped with lockable hasps, may be used to disable moving equipment during periods of employee access which require personnel presence in the path of automated equipment. 7. All valves located in employee workstations that cause component movement when activated (ex. opening/closing of clamps), shall be three position valves. This feature is necessary to preclude delayed or unexpected movement. 8. Operator stations may be equipped with single palm buttons and emergency stop switches, when presence-sensing devices are employed. 9. Dual palm buttons shall be provided at manual (off line) operations when presence-sensing devices are not required. The operator must maintain button contact for the duration of all hazardous movement. 10. Automated systems shall be designed and constructed so that loss of electrical power, voltage surges, or changes in oil or air pressure, will not result in hazardous motion. 11. Fixtures that cannot be visually managed by the operator(s) must be guarded to protect against pinch/shear points. The maximum reasonable area that can be visually managed by an operator is about six feet by six feet on each side of the operator. In addition, the proximity of clamps, slides or other such devices to walk paths or aisles and passageways used by other employees must be considered when determining guarding requirements. 12. The use of a Cycle Start (Slap) Button(s) and Presence Sensing Device(s) is required for the following reasons: A. Whenever the hold down time of Dual Palm Buttons would exceed (4) four seconds. B. When there is more than (1) one operator to perform the process. C. Whenever visual management of the fixture is in question. E. Required Information The following information shall be provided to the user, for all automated machines and equipment: 1. Function and location of all controls 2. Specifications 3. Precautionary information 4. Operating instructions
8 of 15 5. Maintenance information 6. Information required for installation 7. Special environmental requirements - including EMI and RFI 8. Lockout/Energy Control (Graphics) information. VIII. INSTALLATION A. Group and Plant Manufacturing Production Engineering shall ensure that automated systems are installed in accordance with this instruction and manufacturer's specification. B. Electrical ground shall be provided in accordance with manufacturer s specification and/or applicable codes. C. Electrical power provided shall meet the robot manufacturer's specifications and any applicable codes and standards. D. Automated process controls, and associated equipment requiring access during automatic operation, shall be located outside barrier guards, or otherwise easily accessible. Such controls and equipment may include but is not limited to: 1. Valve stands 2. Gauges 3. Lubrication points 4. Sight glasses 5. Stop check valves, etc. 6. Station control panels E. Control stations shall be positioned so that the automated function is in full view. Placement of control stations in positions that reduce visibility of the unit and its function must be avoided. Control Stations shall not be used as barriers in place of barrier guard panels. F. The system shall be installed to avoid interference with buildings, structures, utilities, other machines, and equipment.
9 of 15 G. Each installation shall have a means to shut off power located outside the barrier guard or enclosure. This means shall have a lockout/tagout capability. H. All environmental conditions, including but not limited to explosive mixtures, corrosive conditions, humidity, dust, temperature, EMI and RFI, shall be evaluated to ensure compatibility of the automated system with the anticipated operational conditions. I. Each operator station shall be provided with an emergency stop device located within 48 of the operator. E-Stop Cable devices may be used in lieu of E-Stop Buttons. J. When a component of an automated system is located in an area of reduced visibility a Manual Control Device (enabler or HMI), that is the sole manual manipulator of that component, must be located in an area of good visibility and outside any hazardous motion. IX. SAFEGUARDING A. Responsibility Group and Plant Manufacturing/Production Engineering shall ensure that safeguards are provided and used in accordance with Sections IX, X and XI of this instruction. The means and degree of safeguarding including and redundancies shall correspond directly to the type and level of hazard presented by the system consistent with the automated application. Safeguarding may include, but not be limited to, warning signs or devices, barriers, and presence-sensing devices or procedures. B. Safeguarding Devices Access by personnel to the automation, while in automatic, shall be prevented by one or more of the following: 1. Presence Sensing Devices Presence sensing devices are safeguarding devices that use a sensing field and may include but are not limited to light curtains, mats, capacitance systems, proximity detectors or vision safety systems. A failure of the presence sensing devices shall interrupt the operation of the system. The presence-sensing device shall be designed and constructed so that its proper operation is not adversely affected by ambient factors. The presence sensing device shall be designed and installed so that automatic operation and all hazardous motion of the system, ceases or is inhibited when the sensing field is violated. Resumption of motion shall require removal of the sensing field violation.
10 of 15 Where entry does not cause a continuous violation of the sensing field, the deliberate activation of the controls shall be required to resume motion. 2. Barrier Guard A barrier shall prevent personnel from reaching a hazardous position in the restricted area by reaching over, under, around or through the barrier. It shall be necessary to use tools to remove the barrier or its section in order to gain entrance to the restricted area. A barrier shall be a maximum of eight (8) inches from the floor/work surface at the bottom edge and a minimum of sixty-eight (68) inches from the floor/work surface at the top edge. 3. Interlocked Barrier Guard An interlocked barrier guard shall prevent access to the hazard zone except by opening an interlocked gate. Opening of the interlocked gate shall: a. Stop motion and remove power to all drive actuators that could initiate hazardous motion. b. Prevent automatic operating of the system. c. Deny entry until all hazardous motion has stopped. Returning to automatic operation shall require both closing the interlocked gate and deliberately activating the controls used to restart the automatic operation. 4. Awareness Barrier An awareness barrier shall be constructed and installed so that a person cannot approach a hazard or restricted area without sensing the presence of the barrier. The awareness barrier shall be located so as to prevent inadvertent entry to a hazard zone. The barrier must be constructed and located so no additional pinch points are created. Use of such a method will require the installation of additional safeguarding. 5. Awareness Signal An awareness signal device shall be constructed and located such that it will provide a recognizable audible or visual signal to individuals of an approaching or present hazard. Audible awareness devices shall have a distinctive sound of greater intensity than the ambient noise level. Use of such a method will require the installation of additional safeguarding. 6. Modular Guarding
11 of 15 When it becomes necessary to service a system component while adjacent equipment and process machinery continue to operate normally; access to the operating components of the system must be prevented. Modular guarding (isolation of individual or small groups of units) may be accomplished by combining interlocked barrier guarding and presence sensing devices. 7. Secondary Presence Sensing Devices Secondary presence sensing is required behind low barriers when there is more than one process in the cell. Re: Sealer Apply, Pedestal Welding, Etc. C. Safeguarding the Operator Operators of automated systems are personnel who initiate the intended production operation. The users of automated systems shall ensure that safeguards are established for each operation associated with the system. Safeguards shall prevent the operator from being in a hazardous position during motion or prevent motion when any part of an operator s body is within the restricted area. 1. Operators shall be trained to recognized known hazards associated with each assigned task involving automated processes. Operators shall be instructed in the proper operation of the control actuators for the system and shall be instructed in how to respond to recognized hazardous conditions. 2. Manual Back-Up of Loaders, Unloaders, Robots, Transfer Equipment in Automated Processes In line replacement of disabled equipment by personnel in or near the restricted area is acceptable only if the necessary manual work stations have been planned and installed in a manner consistent with maximum operator safety. The following minimum requirements must be met in the establishment of in line manual back-up workstations. a. The operator must have full control of each cycle of the machinery from the back-up workstation. b. Drive power must be interrupted to the equipment being backed up. c. Workstations must be bordered with frontal and side barriers sufficient to prevent the operator from inadvertently becoming exposed to machine movements or adjacent operating machinery/equipment. d. Care must be taken during design to ensure that manual back-up stations are free of unnecessary obstacles that could impede operator movement in the workstation. Protruding junction boxes, transformers, drive mechanism, hoses, electrical cables, etc. are examples of such potential obstacles.
12 of 15 e. Presence sensing devices shall be incorporated with manual controls unless the task can be accomplished safely without placing any part of the body in the movement path of the machinery or parts in process. f. A combination of hard wire circuitry and presence sensing devices, or other equally effective means, must be provided in order to prevent any automatic equipment that services more than one work station, from entering an occupied station. 3. Automatic Loading/Unloading When feasible, loading or unloading devices shall be designed and installed to allow the completion of necessary manual functions, from a point entirely outside the restricted area. 4. Manual Loading/Unloading When loading or unloading must be accomplished by reaching into the restricted area, the following conditions must be met: a. The operator shall have full control of each cycle. b. Workstations shall be bordered with frontal and side barriers sufficient to prevent an operator from inadvertently becoming exposed to machine movement. c. Presence sensing devices shall be utilized in conjunction with cycle controls. These devices shall be installed in work stations in a manner that will prevent access to the interior of a system through a work station, without crossing the barriers indicated in item (IX,C,2), and activating the presence sensing devices. Such devices must be positioned to ensure that presence sensing occurs before any part of the body enters a restricted area. D. Safeguarding Maintenance Personnel 1. Personnel who perform maintenance on automatic machinery or automated systems shall be trained in the procedures necessary to safely perform the required tasks. 2. Personnel who repair and maintain automated systems shall be safeguarded from injury due to unexpected or unintended motion or both. The means and degree of safeguarding, including any redundancies, shall correspond directly to the type and level of hazards presented by automatically cycling machinery and automated systems. a. The most effective means of safeguarding is to shut the machinery off. A procedure shall be followed that includes lockout/tagout of sources of power and releasing or blocking of stored energy.
13 of 15 b. When it is not feasible to lockout/tagout, alternate safeguarding shall be provided to prevent injury. Personnel performing maintenance tasks within the restricted area when drive power is available shall have total control of the machine or system. This shall be accomplished by the following: 1) The control of the machinery and equipment shall be removed from the automatic mode. 2) Control shall be isolated from any remote signals that could initiate motion. 3) Movement of other equipment in an automated system shall be under the control of the person in the work envelope if such movement would present a hazard. 4) All emergency stop devices shall remain functional. 5) The automated system shall be reset for automatic operation only after personnel leave the restricted area enclosure, and all safety circuits and devices are restored. 6) If, during maintenance, it becomes necessary to bypass safeguards required for automatic mode operation, alternative safeguards shall be provided and written notification shall be posted at the bypassed device (reference troubleshooting procedure section of SMI-107). The bypassed safeguards shall be returned to their original effectiveness when the maintenance task is completed. 4. Inspection Prior to entering the hazard zone enclosure to perform maintenance tasks while power is available, a visual inspection of the system shall be performed to determine if any damage condition exists which is likely to cause malfunction. Manual controls shall be function tested to ensure their proper operation. If any damage or malfunction is found required corrections and retesting shall be made before personnel enter the restricted area enclosure with the power on. The function testing shall be performed from a location outside the hazard zone. X. CARE Plant Manufacturing/Production Engineering shall establish a regular and periodic inspection and maintenance program to assure the continued safe operation of the automated system. The inspection and maintenance program should be in accordance with the manufacturer's recommendations. XI. TESTING AND STARTUP A. This section defines the procedures that shall be followed during the testing of automated systems after installation or relocation. It also applies to automated systems after software-hardware changes and after maintenance or repairs which could affect their safe operation.
14 of 15 During this testing and startup, no personnel shall be allowed in the restricted area enclosure of the systems until safeguards and proper operations are verified. The manufacturer's recommendations for testing and startup should be followed. B. An initial startup inspection shall include but not necessarily be limited to the following: Before applying power, verify: Mechanical mounting and stability Electrical connections Utility connections Communications connections Peripheral equipment and systems After applying power, verify that: Emergency stop devices are functional Drive power disconnects are functional Program executes as intended Interlocks function Safeguards are functional C. An inspection prior to restart after hardware or program modification, repair, or maintenance shall include but not necessarily be limited to the following: Check anything rewired or added to the hardware system prior to applying power. Function test for proper operation. XII. TRAINING Plant Manufacturing/Production Engineering, along with the Plant Safety function shall ensure that: Training is provided before any personnel are assigned to program, maintain, or operate automated systems. Training shall include applicable safety procedures and the safety recommendations of the manufacturers. General safety precautions and specific safety procedures that are germane to the installation and application of the particular machines and equipment in use shall be integrated into every phase of the training.
15 of 15 XIII. Documentation Up to date Hardwired Control Diagrams and Programmable Controller logic printouts shall be readily available for maintenance personnel.