By Paul Malburg Facility Engineer / Controls Manager Madico, Inc.

Transcription

1 Abstract: Upgrading Machine Safety Devices and Interlocks By Paul Malburg Facility Engineer / Controls Manager Madico, Inc. In the context of safety, interlocks can prevent a user from making unsafe actions, or minimize the hazard by rendering the machine into a safe condition when an unsafe act occurs. While many often think an "interlock" is simply a safety method that relies on an electromechanical switch to perform the interlocking feature, modern interlocking mechanisms may take the form of many other types of devices. For example; the once standard series wiring configuration of a string of single contact emergency stop pushbuttons tied into standard control relay circuit is now classified as Non-Control Reliable by OSHA standards. This paper will discuss what is meant by the OSHA term General Duty Clause/ Best Practice in identifying hazards which may result in injury, along with looking at different variations of Risk Assessments and their associated hazard rating systems. It will explain how the proper risk assessment will determine what level of category control device is required for each hazard. It will also take a quick look at the various electronic safety devices that are available for machine guarding other than the standard unique-shaped keyed safety switch which is most commonly used in industry today. All machine interlocks are required by, but not limited to, the following standards: ANSI B11.19, "Performance Criteria for Safeguarding" ANSI/ RIA R15.06, "Safety Requirements for Industrial Robots and Systems ANSI/ASSE Z244.1, "Control of Hazardous Energy NFPA79, Electrical Standard for Industrial Machinery Upgrading Machine Safety Devices and Interlocks Page 1

2 Background: A little over two years ago one of our veteran machine operators was involved in an incident on one of our rewinding stations, which ended up as a lost time accident. It was decided at that time to have a 3 rd party safety advisor perform what is called a Job Hazard Assessment on the entire coating line to see if it would comply with all the updated safety regulations. After receiving the 63 page report listing out various concerns and deficiencies with the equipment and process tasks the Madico s Engineering Department took on the project of bringing this line up to meet the current safety regulations. Even though this machine was upgraded in the mid 1990 s the guarding, and electrical systems did not meet the safety standard that was laid out in the corresponding standards. We also found that right from the start of this project it was very easy to get lost in the numerous charts, rating systems, terminologies, and category listings. However, once we started breaking down the machine into sections a clear understanding of the OHSA & ANSI standards and how they directly apply was achieved. After the installation of numerous guards and various electrical safety devices, we transformed an automatic splicing re-winder into a hand splicer. After a complete analysis of the equipment and its capabilities as to how they relate to our current product line, it was decided to abandon the re-wind and unwind sections of the machine. This decision to upgrade the equipment became economically justified by considering all three of the following factors production rates, safety issues and product mix. The bidding process for this equipment took about three months of working with a group of our preferred vendors. During this process, Madico was upfront with all vendors in making sure that all the latest safety standards were being adhered to during the bidding and design stage of this project. Upon selecting a vendor several days of engineering meetings took place with discussions around safety issues and current OHSA & ANSI standards. It was very evident that Madico s interpretation/expectations of the regulations and standards were quite different from the Machine builders. The result was a change order greater than $12, worth of safety devices that were added to the machine. This did not include an additional cost of $7, for the added cost of a safety PLC. The project also included a complete risk assessment by a 3 rd party safety advisor to be done in two stages, after fabrication and again during commissioning of the equipment. In the end, Madico ended up with a highly productive state of the art laminating/coating machine that is safe for operators and technicians. Various Terminologies and How They Apply: There are many types of terms and phrases that are mentioned when you start to digging into the safety manuals and various regulations. The two that are most unknown and open ended that are referred to by OSHA would be the Best Practice" and General Duty Clause. The General Duty Clause as stated by OSHA refers to the fact that an employer shall furnish to each of his employees a place of employment of which are free from recognized hazards that are likely to cause death or serious physical harm. They shall also comply with occupational safety and health standards that are promulgated Upgrading Machine Safety Devices and Interlocks Page 2

3 under this act. In simple terms, this statement means that you, as an employer, may be obligated to protect your employees from recognized hazards in the workplace, even if there is not an OSHA standard which applies to that particular situation or possible hazard. In effect, the General Duty Clause obligates all employers to take additional steps toward safety if the well-being of their employees might be in jeopardy or at risk. When talking about Best Practice in the workplace as it relates to OSHA, this is not a written standard or regulation; it is intended to be a set of guide lines for employers in providing a safe and healthful workplace. The Occupational Safety and Health Administration currently have a mandate to provide guidance and set standards to protect workers from injury in the workplace. Safety practices in a manufacturing facility begin with a job safety analysis. The analysis results indicate areas where safety improvements are needed. OSHA recommends three ways to improve overall safety through engineering controls, administrative controls and use of personal protective equipment (PPE). A Job Safety Analysis also known as Job Hazard Analysis or Risk Assessment is a safety management tool in which the risks or hazards of a specific job in the workplace are identified, and then measures to eliminate or control those hazards are determined and implemented. More specifically, a job safety analysis is a process of systematically evaluating certain tasks or procedures with a goal of eliminating or reducing the risks or hazards to as low as reasonably practical in order to protect workers from injury or illness. This assessment is a quantitative calculation of two components of Risk: the magnitude of the potential loss and the probability that the loss will occur. Once the hazards have been identified, management should put in the proper type of controls to prevent, reduce or eliminate them. The benefits of a comprehensive hazard analysis are improved safety and increased productivity. It is important to remember that a job safety analysis is not simply a piece of paper; it is a working process. Whereas workers and management need to understand that a piece of paper will not make the job safe. Rather, workers and management must understand the risks and hazards associated with the job and know how to utilize the chosen controls such as Engineering, Administrative, or PPE in such a way as to eliminate or mitigate the defined risks. The first and the most preferred type of control method that is recommended by OSHA would be Engineering Controls. These are physical changes and improvements made to a machine or workstation. In a manufacturing facility, these include electrical control circuits, machine guards, isolation devices (like area scanners and light curtains), and hazard isolation (similar to safety switches and locking devices). Every machine today now has guards and safety devices to prevent operator or employee injuries, but these devices may not provide adequate protection due to machine location, equipment modifications/add-ons, or operator procedural changes. Administrative Controls include but are not limited to written procedures, exposure monitoring, alarms and training. Written procedures provide a reference for proper actions and safety practices in the workplace. Procedures include proper job performance, machine operations, actions taken during an emergency, protective equipment, maintenance and inspection criteria. Training is the main tool that ties all safety practices together. All workers and managers are required to be trained on engineering and administrative controls and PPE, and include both classroom and on-the-job training. The finale control method is Personal Upgrading Machine Safety Devices and Interlocks Page 3

4 Protective Equipment (PPE) which includes eye and face protection, hearing protection, gloves, ergonomic hand tools and respirators if required. In a manufacturing plant, safety glasses or goggles provide additional eye protection even when machine guards are used. Hearing protection is required when noise levels exceed 85 decibels. Exposure to loud noise can cause long-term hearing loss. Gloves will reduce cuts/abrasion hazards. Ergonomic hand tools reduce worker fatigue. Respirators are generally not needed, but they can be used in lieu of an effective ventilation system. According to OSHA, personal protective equipments are devices designed to protect employees from serious workplace injuries or illnesses resulting from contact with chemical, physical, electrical, mechanical, and other workplace hazards. Meanwhile, in terms of hazard control methods, usage of personal protective equipment is the last hazard control. After completing risk assessment you will end up with Risk Reduction Category and an Electrical Rating Category as shown in the two tables below. It is important not to confuse these two charts because the ratings are inversely proportional in severity. Once the correct rating is known you can follow across the table to determine the minimum requirements to safeguard performance and circuit performance, which relates to the proper electrical rating. The goal in overall risk reduction must always be accomplished by hazard elimination or hazard substitution, of which does not create an equal or greater hazard. When hazard elimination or substitution is impossible, all provisions of a category R2 risk reduction shall apply the provisions of categories R3 and R4 for electrical safeguarding requirements. RISK REDUCTION CATEGORY Risk Reduction Category SAFEGUARD PERFORMANCE CIRCUIT PERFORMANCE R1 Hazard elimination or hazard substitution Control reliable R2A Control reliable R2B Engineering controls preventing access to the hazard, or stopping the hazard interlocked barrier guards, light curtains, safety mats, or other presence sensing devices Single channel with monitoring R2C Single channel R3A R3B Non-interlocked barriers, clearance, procedures and equipment Single channel Simple R4 Awareness means Simple Upgrading Machine Safety Devices and Interlocks Page 4

5 Explanation of Electrical Ratings by Category SUMMARY OF REQUIREMENTS BY CATEGORY SYSTEM BEHAVIOUR Notes CATEGORY B Safety related parts of machine control systems and/or their protective equipment, as well as their components, shall be designed, constructed, selected, assembled and combined in accordance with relevant standards so that they can withstand the expected influence. CATEGORY 1 The requirements of category B apply together with the use of well tried safety components and safety principles. CATEGORY 2 The requirements of category B and the use of well tried safety principles apply. The safety function(s) shall be checked at machine startup and periodically by the machine control system. If a fault is detected a safe state shall be initiated or if this is not possible a warning shall be given. CATEGORY 3 The requirements of category B and the use of well tried safety principles apply. The system shall be designed so that a single fault in any of its parts does not lead to the loss of safety function. CATEGORY 4 The requirements of category B and the use of well tried safety principles apply. The system shall be designed so that a single fault in any of its parts does not lead to the loss of safety function. -The single fault is detected at or before the next demand on the safety function. If this detection is not possible then an accumulation of faults shall not lead to a loss of safety function. When a fault occurs it can lead to a loss of the safety function. As described for category B but with higher safety related reliability of the safety related function. (The higher the reliability, the less the likely hood of a fault.) The loss of safety function is detected by the check. The occurrence of a fault can lead to the loss of safety function between the checking intervals. When the single fault occurs the safety function is always performed. Some but not all faults will be detected. An accumulation of undetected faults can lead to the loss of safety function. When the faults occurs the safety function is always performed. The faults will be detected in time to prevent the loss of safety functions. Category B in itself has no special measures for safety but it forms the base for the other categories. Multiple faults caused by a common cause or as inevitable consequences of the first fault shall be counted as a single fault. The fault review may be limited to two faults in combination if it can be justified but complex circuits (e.g. microprocessor circuits) may require more faults in combination to be considered Different Types of Risk Assessments: The following are examples of two types of risk assessments that can be used to evaluate a piece of equipment or process within the machine. The first one is directly from the ANSI RIA standard for Industrial Robot Systems Safety Requirements. The second set of tables uses a point system that is derived from the same standard and is a little easier to understand and interpret. There is no wrong system, it just depends on what you are more comfortable using. Risk Evaluation Table prior to risk reduction (From ANSI RIA15.06) The risk reduction category is defined by evaluating the severity of injury, exposure duration and likelihood of avoiding the hazard. The safety circuit performance and safeguard performance as defined by the table below. Once the risk reduction category has Upgrading Machine Safety Devices and Interlocks Page 5

6 been determined, the safety circuit performance and safeguard performance can be determined by using the Risk Reduction Table as shown below: SEVERITY OF INJURY Serious Injury More than First-Aid Slight Injury Less than First-Aid EMPLOYEE EXPOSURE Frequent Infrequent Frequent Infrequent AVOIDANCE TO HAZARD Not Likely Likely Not Likely Likely RISK REDUCTION CATEGORY R1 R2A R2B SAFEGUARD PERFORMANCE Hazard elimination or hazard substitution Engineering controls preventing access to the hazard, or stopping the hazard CIRCUIT TYPE Control Reliable Single channel with monitoring Not Likely R2C Single Likely R3A Non-Interlocked barriers, clearance, channel Not Likely R3B procedures and equipment Simple Likely R4 Awareness means Severity Exposure Avoidance Serious injury an injury requiring more than plant applied first aid. Slight injury an injury able to be treated by plant first aid. Frequent Exposure to the hazard more than once per hour. Infrequent Exposure to the hazard less than once per eight hours. Not Likely Speed of hazard greater than 10 per second or other factors. Likely Speed of hazard 10 per second or less and other factors. Risk Evaluation Using Point System (Derived from ANSI RIA15.06) The risk level identification (point) method used in the table below addresses each of the risk factors and assigns a risk score based on the inherent hazards of the equipment. The scores are determined assuming that a safeguarding system has not been installed or has failed to an unsafe condition. By doing so, the assessment will produce a risk level which will more accurately identify the proper safeguarding methods to help reduce the risk of existing hazards. This is a key component in determining the safeguarding methods required to maintain desired levels of productivity while still effectively reducing the risk. Once a hazard has been identified, the scoring system in Table 1 is used to identify the level of risk. The points in each category are then combined to establish the Risk Level Score. The score assigned to the risk level by this point system can then be used to determine the actual risk level using Table 2. Upgrading Machine Safety Devices and Interlocks Page 6

7 Table 1 (Derived from ANSI RIA15.06) RISK FACTOR DESCRIPTION POINTS PER CATEGORY Points 1 = Minor - (Requiring no more than first aid) Severity Bruising, cuts and abrasions. The most severe 3 = Serious - (Normally reversible) Loss of injury that can be consciousness, burns, breakage etc. Reasonably 6 = Major - (Normally irreversible) Permanent conceived. disability, loss of sight, amputation, etc. 10 = Fatal Frequency Probability Adjustments Table 2 Risk Level Identificatio n Number High 12 + Medium 7-11 Low 1-6 The frequency of exposure to hazard The probability or likelihood that an Injury will occur. Consideration of additional factors. 1 = Seldom - Weekly or less 2 = Occasional - Daily 4 = Frequent - Several times per day 1 = Unlikely - Remote 2 = Possible - Not likely to occur 4 = Probable - May occur 6 = Certain - Near certain to occur More than one person exposed = Multiply SEVERITY by number of people exposed >15 min. in danger zone = add 1 point Unskilled/untrained operator = add 2 points Required Safeguard Performance Risk Level Identification Number Barrier guard or safety-rated protective device (e.g. interlocked barrier guards, light curtains, safety mats, laser area scanners, or other presence sensing devices) preventing intentional exposure of any part of the body to the hazard by preventing access to the hazard or stopping the hazard. The guard or device shall be secured with special fasteners or a lock. Barrier guard or safety-rated protective device (e.g. interlocked barrier guards, light curtains, safety mats, laser area scanners, or other presence sensing devices) preventing unintended exposure of any part of the body to the hazard by preventing access to the hazard or stopping the hazard. The guard or device shall not be removable or adjustable by unauthorized persons. This may also include physical devices that do not require adjustment or other operator intervention for use. Barrier guard or safety-rated protective device (e.g. interlocked barrier guards, light curtains, safety mats, laser area scanners, or other presence sensing devices) providing simple guarding against inadvertent exposure to the hazard. Examples include a fixed screen, chuck guard, or movable barrier. This may include physical devices that require adjustment for use. Required Circuit Performance from ANSI/RIA R15.06 Control Reliable Single Channel with Monitoring Single Channel Upgrading Machine Safety Devices and Interlocks Page 7

8 What is Control Reliability and Why? In this typical emergency stop circuit the weakest link is relay CR1. The contacts of CR1 can weld closed or, since this relay is spring applied, it can fail mechanically. If this failure occurred, energy to the load would continue resulting in an unsafe Condition. According to the definition of control reliability we need to guard against failure of CR1. It is one source for a single component failure. Redundancy is not sufficient. If one of the two relays fail you are back to square one with redundancy lost, the second relay could fail on a subsequent machine cycle. We must monitor the condition of the redundant relays. Force or positive guided relays provide the best solution to accomplish monitoring. This circuit is control Reliable and has redundancy and cross-monitoring defined by ANSI standard B The electrical interface shall be designed, constructed and installed such that a single component failure within the device, interface or system shall not prevent normal stopping action from taking place but shall prevent a successive machine cycle. This definition is accepted for use in the United States and while there is not an exact correlation between ANSI standards and European standards, the ANSI definition corresponds most directly with Category 3. Upgrading Machine Safety Devices and Interlocks Page 8

9 But the negative side to this type of circuitry is as follows: No safety approvals 38 wiring points High chance of wiring errors Installation is labor intensive More costly Larger in overall size (panel space) Easy to tamper with and bypass connections No short circuit protection on the inputs Reset is not monitored Difficult to troubleshoot Types of Safety Components that are Available: Guards Fixed in Place - can always be used when the access to the danger zone is not required during the normal operation. This type of guard would include protective fences, meshed barriers, and fixed covers. It also requires that fixed guards be firmly held in their place with constructive measures such as being permanently welded or with fixing elements (nuts, bolts) that require the use of a tool. If possible, it should not be possible to keep them in their protective position after the fixing elements have been loosened. Safety distances to prevent danger zones from being reached can easily be measured by using a specialized tool known as a Gotcha Stick." Based on revised anthropometric data, the "Gotcha Stick" is a three-segment safe distance scale used to verify that openings in machine guards and will not allow the point-of-operation to be accessed by the operator. Although not officially adopted by OSHA, the "Gotcha Stick" is based on data from "A Review of Machine-Guarding Recommendations," by Donald R. Vaillancourt and Stover H. Snook of the Liberty Mutual Research Center for Health & Upgrading Machine Safety Devices and Interlocks Page 9

10 Safety. This data redefines the dimensions of the human arm for the purposes of machine guarding. The resulting new stick has been modified to include openings of less than ¼ inch over the first ½ distance. Gotcha Stick E-Stops and Cable Pulls - are offered with 2-position push-pull/twist release with multiple contact configurations. For machinery such as conveyors, it is often more convenient and effective to use a cable pull device along the hazard area as the emergency stop device. These devices use a steel wire rope connected to latching pull switches so that pulling on the rope in any direction at any point along its length will trip the switch to cut off the machine power. This device has to have some type of tensioning system integrated into the trip mechanism to meet Category 3 criteria. Tongue Interlock Switches - are the most commonly used technology for door interlocking. They detect the movement of a guard using a key fitted to an opening in the switch body. Available in a variety of packages, contact configurations and degrees of holding force, these switches are generally the lowest-cost solution. The use of flexible keys also enhances tolerance to misalignment to address an even broader range of applications. Pressure-sensitive safety edges - are flexible strips that can be mounted to the edge of a moving part such as a machine table or powered door that poses a crushing or shearing hazard. Contact of the edge with an object or personnel will switch off the machine hazard. Safety edges are a cost-effective solution for constant safety monitoring in smaller areas, especially those applications requiring physical flexibility and a tight turn radius. These devices can carry possible ratings as high as Category 3 depending on manufacturer. E-Stop Safety Relay a safety relay connects between the emergency stop switch and the machine emergency stop control elements. The emergency stop switch becomes an input to the safety relay. The safety relay monitors the condition of both contacts of the Upgrading Machine Safety Devices and Interlocks Page 10

11 emergency stop switch. The output of the safety relay consists of two redundant output switching channels, each of which is the series connection of two safety relay contacts. Programmable Safety Controllers are stand-alone safety controllers for small and mid-sized machinery. They provide safety stop and start functions for machines with hazardous motion. The Safety Controller can replace multiple safety relay modules in applications that include such safety input devices as E-stop buttons, gate interlocking switches, safety light curtains, and other safeguarding devices. It also can be used in place of safety PLCs and other safety logic devices when they are excessive for the application. Safety Programmable Logic Controller (Safety PLC) - is a dual processor solution, its major benefit is that it s still a single project, safety and standard together. The safety partner controller is a part of the system, is automatically configured, and requires no user setup. With this level of integration, safety memory can be read by standard logic and external devices, like HMIs or other controllers, eliminating the need to condition safety memory for use elsewhere. The result is easy system-wide integration and the ability to display safety status on displays Pressure sensitive safety mats - provide constant guarding and monitoring of a floor area around a machine < 60 +/- pounds or more of pressure on the mat which causes the mat controller unit to switch off power to the hazard. A safety mat is an ideal solution for relatively small areas; safety mats also offer a high degree of application flexibility. Area Scanner - are opto-electronic devices that create a user-configurable scanning field with one or more safety zones. If a person or object enters the warning field, the area scanner switches a single output that can be used to initiate a warning signal, such as an optical or acoustic alarm. If the inner safety field is breached, the scanner switches two independent safety outputs initiating a machine stop signal to halt dangerous machine motion. Light Curtain - are placed close to the hazard, at the point of operation where personnel may frequently interact with the machine as part of a process. Light curtains are designed for partial-body detection finger, hand, and arm detection and are offered in multiple resolutions and protective heights. An easy-to-install for a category 4 or category 3 solutions, these light curtains are easily connected to other safety systems, but usually do not require a separate controller and can therefore be operated as standalone units. Calculating the Safeguarding Distance for Presence Sensing Devices: The formula shown below should be used when using presence sensing devices like area scanners, safety mats, and light curtains for signaling the hazard to cease with an interlocked device (including access points in fixed barrier guarding). By using this calculated value it will determine the minimum safe between the rotating equipment can be mounted from the area sensing device. Remember, all rotating and moving equipment Upgrading Machine Safety Devices and Interlocks Page 11

12 must come to a complete stop before the operator is in reach of the hazard to prevent entanglement or injury. Ds = [K x (Ts + Tc + Tr)] + Dpf Where: Ds = minimum safe distance between safeguarding device and the hazard K = speed constant: 1.6 m/sec (63 inches/sec) minimum based on the movement being the hand/arm only and the body being stationary NOTE A greater value may be required in specific applications and when body motion must also be considered. Ts = worst stopping time of the machine/equipment Tc = worst stopping time of the control system Tr = response time of the safeguarding device including its interface NOTE Tr for interlocked barrier may include a delay due to actuation. This delay may result in Tr being a deduct or negative value Dpf = maximum travel towards the hazard within the presence sensing safeguarding devices (PSSD) field that may occur before a stop is signaled. Depth penetration factors will change depending on the type of device and application. Summary: It is very important to have a clear understanding with equipment vendors on what your company s expectations are relating to the safety standards and regulations. This needs to happen in the preliminary project meetings and be well documented so that all parties understand that safety is a priority. The use of a Safety PLCs can produce bottom-line benefits for manufacturers in a variety of ways just as standard PLCs emerged as programmable replacements for hardwired relay logic in the 1970s. The saving in reduced wiring and engineering costs from a Safety PLCs promise to do the same for safety relays. Moreover, Safety PLC-based systems are less prone than hardwired safety systems to nuisance trips that can unnecessarily shut down a factory operation. And they are much easier and faster to troubleshoot, resulting in less machine or process downtime. It is also important that a machine manufacturer ensures that his machine is capable of being used safely. The risk assessment should be started at the machine design phase, and it should take account of all the foreseeable tasks that will need to be performed on the machine. This task-based approach at the early iterations of the risk assessment is very important. For example, there may be a regular need for adjustment of moving parts at the machine. At the design phase, it should be possible to design in measures that will allow this process to be carried out safely. If it is missed at the early stage, it may be difficult or impossible to implement at later stage. The result could be that the adjustment of moving parts still has to be performed but must be done in a manner that is either unsafe or inefficient or both. A machine on which all tasks have been taken in an account of during the risk assessment will be a safer machine and a more efficient machine. In turn the end user needs to ensure that the machines in their facility are safe. Even if a machine has been declared safe by the manufacturer, the machine user should still Upgrading Machine Safety Devices and Interlocks Page 12

13 perform a risk assessment to determine whether the equipment is safe in their environment. Machines are often used in circumstances unforeseen by the manufacturer. In closing machine safety has become an even more important part in machine design and must provide responsible protection for all employees not just the machine operators. This is especially true when upgrading or modifying equipment that was designed and fabricated over years ago. This older equipment was typically fabricated with ether Category B or Category 1 electrical control scheme, which at best was a singlechannel circuit with no monitoring systems. Going forward machine fabricators should be designing equipment in a manner that keeps the machines running to the fullest degree possible with an intelligent use of light curtains, interlock switches, safety relays, programmable safety controllers, and other essential machine safety devices to monitor, and react to machine upsets. All these devices have become an important part in preventing an employee injures in the workplace. To date, the best ways to determine the usage of the proper safety equipment is to conduct a job hazard or risk assessment analysis. Either of these analyses will be one of the main components of the larger commitment of a safety and health in your facility. You will find this whole process as a critical tool now that the Occupational Safety and Health Administration (OSHA) have started using the General Duty Clause, found in the Act of 1970, to begin using this clause in more and of its penalty and enforcement actions. DISCLAIMER Although it is believed that the information in this paper is factual, no warranty or representation, expressed or implied, is made with respect to any or all of the content thereof, and no legal responsibility is assumed therefore. The examples shown are simply for illustration, and, as such, do not necessarily represent any company s guidelines. The reader should use data, methodology, formulas, and guidelines that are appropriate for their own particular situation. Upgrading Machine Safety Devices and Interlocks Page 13