Five reasons you should attend our Free Safety Talks

Reason #1 — Free Safety Talks

You can’t argue with Free Stuff! Last week we part­nered with Schm­er­sal Cana­da and Franklin Empire to put on three days of Free Safe­ty Talks. We had full hous­es in all three loca­tions, Wind­sor, Lon­don and Cam­bridge, with near­ly 60 peo­ple par­tic­i­pat­ing.

We had two great pre­sen­ters who helped peo­ple under­stand Pre-Start Health and Safe­ty Reviews (PSRs) [1], CSA Z432-2016 [2], Inter­lock­ing Devices [3] and Fault Mask­ing [4].

Mr Vashi at Franklin Empire Cambridge
Mr Vashi at Franklin Empire Cam­bridge

Franklin Empire pro­vid­ed us with some great facil­i­ties and break­fast to keep our minds work­ing. Thanks, Franklin Empire and Ben Reid who orga­nized all of the reg­is­tra­tions!

Mr Nix discussing injury rates in machine modes of operation
Mr Nix dis­cussing injury rates in machine modes of oper­a­tion

Reason #2 — Understanding Interlocking Devices

A portrait of Mr Kartik Vashi
Mr Kar­tik Vashi, CFSE

Mr Kar­tik Vashi, CFSE, dis­cussed the ISO Inter­lock­ing Device stan­dard, ISO 14119. This stan­dard pro­vides read­ers with guid­ance in the selec­tion and appli­ca­tion of inter­lock­ing devices, includ­ing the four types of inter­lock­ing devices and the var­i­ous cod­ing options for each type. Did you know that ISO 14119 is also direct­ly ref­er­enced in CSA Z432-16 [2]? That means this stan­dard is applic­a­ble to machin­ery built and used in Cana­da as of 2016. If you don’t know what I’m talk­ing about, you can con­tact Mr Vashi to get more infor­ma­tion.

ISO 14119 Fig 2 showing some aspects of different types of interlocking devices.
ISO 14119 Fig 2 show­ing some aspects of dif­fer­ent types of inter­lock­ing devices [3]

Reason #3 — Understanding Fault Masking

Mr Vashi also talked about fault mask­ing, an impor­tant and often mis­un­der­stood sit­u­a­tion that can occur when inter­lock­ing devices or oth­er electro­mechan­i­cal devices, like emer­gency stop but­tons, are daisy-chained into a sin­gle safe­ty relay or safe­ty input on a safe­ty PLC. Mr Vashi drew from ISO/TR 24119 to help explain this phe­nom­e­non. If you don’t under­stand the impact that daisy-chain­ing inter­lock­ing devices can have on the reli­a­bil­i­ty of your inter­lock­ing sys­tems, Mr Vashi can help you get a han­dle on this top­ic.

A part of ISO 24119 Fig 2 showing one method of daisy-chaining interlocking devices.
A part of ISO 24119 Fig 2 show­ing one com­mon method of daisy-chain­ing inter­lock­ing devices [4]

Reason # 4 — Pre-Start Health and Safety Reviews

Portrait of Doug Nix, C.E.T.
Mr Doug Nix, C.E.T.

Mr Nix opened his pre­sen­ta­tion with a dis­cus­sion of some com­mon­ly asked ques­tions about Pre-Start Health and Safe­ty Reviews (PSRs). There are many ways that peo­ple become con­fused about the WHY, WHAT, WHEN, WHERE, WHO and HOW of PSRs, and Mr Nix cov­ered them all. This unique-to-Ontario process requires an employ­er to have machines, equip­ment, rack­ing and process­es reviewed by a Pro­fes­sion­al Engi­neer or anoth­er Qual­i­fied Per­son when cer­tain cir­cum­stances exist (see O. Reg. 851, Sec­tion 7 Table). If you are con­fused by the PSR require­ments, con­tact Mr Nix for help with your ques­tions.

Reason #5 — Understanding the changes to CSA Z432

CSA Z432 [2] was updat­ed in 2016 with many changes. This much-need­ed update came after 12 years expe­ri­ence with the 2004 edi­tion and many changes in machin­ery safe­ty tech­nol­o­gy. Mr Nix briefly explored the many changes that were brought to Cana­di­an machine builders in the new edi­tion, includ­ing the many new ref­er­ences to ISO and IEC stan­dards. These new ref­er­ences will help Euro­pean machine builders get their prod­ucts accept­ed in Cana­di­an mar­kets. Both Mr Vashi and Mr Nix sit on the CSA Tech­ni­cal Com­mit­tee respon­si­ble for CSA Z432.

Reason #6 — Hot Questions

We like to over-deliv­er, so here’s the bonus rea­son!

We had some great ques­tions posed by our atten­dees, two of which we are answer­ing in video posts this week. If you have ever con­sid­ered using a pro­gram­ma­ble safe­ty sys­tem for lock­out, our first video explains why this is not yet a pos­si­bil­i­ty. Mr Nix gets into some of the reli­a­bil­i­ty con­sid­er­a­tions behind the O.Reg. 851 Sec­tions 75 and 76 and CSA Z460 require­ments.

Mr Nix post­ed a sec­ond video dis­cussing ISO 13849–1 [5] Cat­e­go­ry 2 archi­tec­ture require­ments and par­tic­u­lar­ly Test­ing Inter­vals. This video explains why it is not pos­si­ble to meet the test­ing require­ments using a pure­ly electro­mechan­i­cal design solu­tion.

Edit: 16-May-18

A case in the UK illus­trates the dan­gers of bypass­ing inter­lock­ing sys­tems. A work­er was killed by a con­vey­or sys­tem in a pre-cast con­crete plant when he was work­ing in an area nor­mal­ly pro­tect­ed by a key-exchange sys­tem. Here’s the link to the arti­cle on OHSOnline.com. Allow­ing work­ers into the dan­ger zone of a machine with­out oth­er effec­tive risk reduc­tion mea­sures may be a death sen­tence.

References

[1]     Ontario Reg­u­la­tion 851, Indus­tri­al Estab­lish­ments

[2]     Safe­guard­ing of Machin­ery. CSA Z432. 2016.

[3]     Safe­ty of machin­ery — Inter­lock­ing devices asso­ci­at­ed with guards — Prin­ci­ples for design and selec­tion. ISO 14119. 2013.

[4]     Safe­ty of machin­ery — Eval­u­a­tion of fault mask­ing ser­i­al con­nec­tion of inter­lock­ing devices asso­ci­at­ed with guards with poten­tial free con­tacts. ISO/TR 24119. 2015.

[5]     Con­trol of haz­ardous ener­gy — Lock­out and oth­er meth­ods. CSA Z460. 2013.

[6]     Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design. ISO 13849–1. 2015.

Digiprove sealCopy­right secured by Digiprove © 2018
Acknowl­edge­ments: Kar­tik Vashi, ISO, Franklin Empire, S more…
Some Rights Reserved

Q & A: Can Safety PLCs be used for Lockout?

This entry is part 2 of 2 in the series Q&A

The ques­tion of lock­out and the use of safe­ty PLCs as a means to meet the lock­out require­ments comes up more and more fre­quent­ly these days. Can Safe­ty PLCs be used for lock­out? Safe­ty pro­fes­sion­als don’t always agree on this con­tro­ver­sial top­ic!

Dur­ing the Free Safe­ty Talks that we did with Schm­er­sal Cana­da and Franklin Empire, this hot ques­tion came up, so I thought I’d cov­er it off in a video. If you need some spe­cif­ic help with an appli­ca­tion like this, please get in touch with Doug direct­ly.

There is a lot to say, and in this video I try to cov­er off the rea­sons why Safe­ty PLCs and Lock­out don’t always mix well.

Notes

Ontario Reg­u­la­tion 851, Indus­tri­al Estab­lish­ments

CSA Z432, Safe­guard­ing of Machin­ery

CSA Z460, Con­trol of haz­ardous ener­gy – Lock­out and oth­er meth­ods

ISO 13849–1, Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 1: Gen­er­al prin­ci­ples for design

ISO 13849–2, Safe­ty of machin­ery — Safe­ty-relat­ed parts of con­trol sys­tems — Part 2: Val­i­da­tion

IEC 62061, Safe­ty of machin­ery — Func­tion­al safe­ty of safe­ty-relat­ed elec­tri­cal, elec­tron­ic and pro­gram­ma­ble elec­tron­ic con­trol sys­tems

IEC TR 62061–1:2010, Guid­ance on the appli­ca­tion of ISO 13849–1 and IEC 62061 in the design of safe­ty-relat­ed con­trol sys­tems for machin­ery

Ques­tions? Leave a com­ment below or email Doug.

Using E-Stops in Lockout Procedures

This entry is part 6 of 13 in the series Emer­gency Stop

Emer­gency stop devices are some­times, incor­rect­ly, used as part of a lock­out pro­ce­dure for machin­ery. Learn more about how to cor­rect­ly used these devices as part of Haz­ardous Ener­gy Con­trol Pro­ce­dures for indus­tri­al machin­ery.

Disconnect Switch with Lock, Tag, and Gang-hasp
An elec­tri­cal rotary dis­con­nect­ing device han­dle with a typ­i­cal lock, tag, and gang-hasp.

Con­trol of haz­ardous ener­gy is one of the key ways that main­te­nance and ser­vice work­ers are pro­tect­ed while main­tain­ing indus­tri­al equip­ment. Not so long ago we only thought about ‘Lock­out’ or ‘Lockout/Tagout’ pro­ce­dures, but there is much more to pro­tect­ing these work­ers than ‘just’ lock­ing out ener­gy sources. Inevitably con­di­tions come up where safe­guards may need to be removed or tem­porar­i­ly bypassed in order to diag­nose prob­lems or to make crit­i­cal but infre­quent adjust­ments to the equip­ment, and this is where Haz­ardous Ener­gy Con­trol Pro­ce­dures, or HECP, come in.

One of the ques­tions I often get when help­ing clients with devel­op­ing HECPs for their equip­ment is, “Can we use the emer­gency stop cir­cuit for lock­out?” As usu­al, there is a short answer and a long answer to that sim­ple ques­tion!

The Short Answer

The short answer to this ques­tion is NO. Lock­out requires that sources of haz­ardous ener­gy be phys­i­cal­ly iso­lat­ed or blocked. Con­trol sys­tems may be able to meet parts, but not all of this require­ment. Read on if you’d like to know why.

The Long Answer

Lockout

Lock­out pro­ce­dures are now grouped with oth­er adjust­ment, diag­nos­tic and test pro­ce­dures into what are called Haz­ardous Ener­gy Con­trol Pro­ce­dures or HECP. In the USA, OSHA pub­lish­es a lock­out stan­dard in 29 CFR 1910.147, and ANSI pub­lish­es ANSI Z244.1.

Down­load ANSI stan­dards

In Cana­da, we didn’t have a stan­dard for HECP until 2005 when CSA Z460 was pub­lished, although all the Provinces and Ter­ri­to­ries have some lan­guage in their leg­is­la­tion that at least alludes to the need for con­trol of haz­ardous ener­gy. In the Province of Ontario where I live, this require­ment shows up in Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

In the EU, con­trol of haz­ardous ener­gy is dealt with in ISO 14118:2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up.

Down­load ISO Stan­dards

If you have a look at the sec­tions of the Ontario reg­u­la­tions, they don’t tell you how to per­form lock­out, and they make lit­tle men­tion of what to do with live work for trou­bleshoot­ing pur­pos­es. The US OSHA reg­u­la­tions read more like a stan­dard, but because they are in leg­is­la­tion they are pre­scrip­tive. You MUST meet this min­i­mum require­ment, and you may exceed it.

Let’s look at how “lock­out” is defined in the stan­dards.

Cana­da (Ontario) USA (OSHA) Euro­pean Union
Lock­out — place­ment of a lock or tag on an ener­gy-iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, there­by indi­cat­ing that the ener­gy-iso­lat­ing device is not to be oper­at­ed until removal of the lock or tag in accor­dance with an estab­lished pro­ce­dure.

CSA Z460, 2005

Lock­out. The place­ment of a lock­out device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, ensur­ing that the ener­gy iso­lat­ing device and the equip­ment being con­trolled can­not be oper­at­ed until the lock­out device is removed.

Tagout. The place­ment of a tagout device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.14 lockout/tagout: The place­ment of a lock/tag on the ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, indi­cat­ing that the ener­gy iso­lat­ing device shall not be oper­at­ed until removal of the lock/tag in accor­dance with an estab­lished pro­ce­dure. (The term “lockout/tagout” allows the use of a lock­out device, a tagout device, or a com­bi­na­tion of both.)

ANSI Z244.1–2003

 

3.3 iso­la­tion and ener­gy dis­si­pa­tion

pro­ce­dure which con­sists of all of the four fol­low­ing actions:

a) iso­lat­ing (dis­con­nect­ing, sep­a­rat­ing) the machine (or defined parts of the machine) from all pow­er sup­plies;

b) lock­ing (or oth­er­wise secur­ing), if nec­es­sary (for instance in large machines or in instal­la­tions), all the iso­lat­ing units in the “iso­lat­ed” posi­tion;

c) dis­si­pat­ing or restrain­ing [con­tain­ing] any stored ener­gy which may give rise to a haz­ard.

NOTE Ener­gy con­sid­ered in c) above may be stored in e.g.:

  • mechan­i­cal parts con­tin­u­ing to move through iner­tia;
  • mechan­i­cal parts liable to move by grav­i­ty;
  • capac­i­tors, accu­mu­la­tors;
  • pres­sur­ized flu­ids;
  • springs.

d) ver­i­fy­ing by using a safe work­ing pro­ce­dure that the actions tak­en accord­ing to a), b) and c) above have pro­duced the desired effect.

ISO 14118–2000

As you can see, the def­i­n­i­tions are fair­ly sim­i­lar, although slight­ly dif­fer­ent terms may be used. The ISO stan­dard actu­al­ly pro­vides the best guid­ance over­all in my opin­ion. Note that these excerpts are all tak­en from the def­i­n­i­tions sec­tions of the rel­e­vant doc­u­ments.

One of the big dif­fer­ences between the US and Cana­da is the idea of ‘tagout’ (pro­nounced TAG-out for those not famil­iar with the term). Tagout is iden­ti­cal to lock­out with the excep­tion of the device that is attached to the ener­gy iso­lat­ing device. Under cer­tain cir­cum­stances, the US per­mits the use of a tag with­out a lock to secure the ener­gy iso­la­tion device. This is not per­mit­ted in Cana­da under any cir­cum­stance, and the term ‘tagout’ is not offi­cial­ly rec­og­nized. In Cana­da, the term is often tak­en to mean the addi­tion of a tag to the lock­ing device,  a manda­to­ry part of the pro­ce­dure.

Use of Controls for Energy Isolation

This is where the ‘rub­ber meets the road’ — how is the source of haz­ardous ener­gy iso­lat­ed effec­tive­ly? To under­stand the require­ments, let’s look at the def­i­n­i­tion of an Ener­gy Iso­lat­ing Device.

Cana­da USA EU
Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).

CSA Z460, 2005

Note — Bold added for empha­sis — DN

Ener­gy iso­lat­ing device. A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: A man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors, and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy. Push but­tons, selec­tor switch­es and oth­er con­trol cir­cuit type devices are not ener­gy iso­lat­ing devices.

Note — Bold added for empha­sis — DN

Tagout device. A promi­nent warn­ing device, such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.8 ener­gy iso­lat­ing device: A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er, a dis­con­nect switch, a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy.

2.20.1 tagout device: A promi­nent warn­ing means such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

ANSI Z244.1–2003

4.1 Iso­la­tion and ener­gy dis­si­pa­tion

Machines shall be pro­vid­ed with means intend­ed for iso­la­tion and ener­gy dis­si­pa­tion (see clause 5), espe­cial­ly with a view to major main­te­nance, work on pow­er cir­cuits and decom­mis­sion­ing in accor­dance with the essen­tial safe­ty require­ment expressed in ISO/TR 12100–2:1992, annex A, 1.6.3.

Note — ISO/TR 12100–2 was with­drawn in Oct-10 and replaced by ISO 12100–2010. — DN Read more on this.

5.1 Devices for iso­la­tion from pow­er sup­plies
5.1.1
Iso­la­tion devices shall:

  • ensure a reli­able iso­la­tion (dis­con­nec­tion, sep­a­ra­tion);
  • have a reli­able mechan­i­cal link between the man­u­al con­trol and the iso­lat­ing element(s);
  • be equipped with clear and unam­bigu­ous iden­ti­fi­ca­tion of the state of the iso­la­tion device which cor­re­sponds to each posi­tion of its man­u­al con­trol (actu­a­tor).

NOTE 1 For elec­tri­cal equip­ment, a sup­ply dis­con­nect­ing device com­ply­ing with IEC 60204–1:1997, 5.3 “Sup­ply dis­con­nect­ing (iso­lat­ing) device” meets this require­ment.

NOTE 2 Plug and sock­et sys­tems (for elec­tri­cal sup­plies), or their pneu­mat­ic, hydraulic or mechan­i­cal equiv­a­lents, are exam­ples of iso­lat­ing devices with which it is pos­si­ble to achieve a vis­i­ble and reli­able dis­con­ti­nu­ity in the pow­er sup­ply cir­cuits.

For elec­tri­cal plug/socket com­bi­na­tions, see IEC 60204–1:1997, 5.3.2 d).

NOTE 3 For hydraulic and pneu­mat­ic equip­ment, see also EN 982:1996, 5.1.6 and EN 983:1996, 5.1.6.

ISO 14118–2000

 

BRADY Small Plug Lockout Device
BRADY Small Plug Lock­out Device

As you can see from the above def­i­n­i­tions, all the juris­dic­tions require that devices used for ener­gy iso­la­tion are reli­able, man­u­al­ly oper­a­ble, mechan­i­cal devices. While elec­tri­cal con­trol sys­tems that meet high lev­els of design reli­a­bil­i­ty may meet the reli­a­bil­i­ty require­ments, they do not meet the require­ments for phys­i­cal, mechan­i­cal dis­con­nec­tion of the source of haz­ardous ener­gy. Oper­a­tor devices are specif­i­cal­ly exclud­ed from this use in Cana­da and the USA. Note that plug and sock­et com­bi­na­tions are per­mit­ted in all juris­dic­tions. Lock­out devices such as Brady 65675 Large Plug Lock­out Device, like the Brady Small Plug Lock­out Device shown here and sim­i­lar devices, can be used for this pur­pose. With some plugs, it is pos­si­ble to put a small lock through a hole in one of the blades or pins. In some juris­dic­tions, even the sim­ple act of putting the plug in your back pock­et while con­duct­ing the work is suf­fi­cient.

BRADY Button Locking Device
BRADY But­ton Lock­ing Device

In addi­tion, the ener­gy iso­la­tion device is required to be able to be locked in the off, iso­lat­ed, or blocked posi­tion. There are emer­gency stop but­ton oper­a­tors that can be pur­chased with an inte­grat­ed lock cylin­der, and there are some con­trol oper­a­tor acces­sories avail­able that will allow con­trol push­but­tons and selec­tor switch­es to be locked in one posi­tion or anoth­er, but these do not meet the require­ments of the above stan­dards. They can be used in addi­tion to an ener­gy iso­la­tion device as part of the pro­ce­dure, but not on their own as the sole means of pre­vent­ing unex­pect­ed start-up.

Conclusions

Each machine or piece of equip­ment is required to have a HECP that is spe­cif­ic to that piece of equip­ment. ‘Glob­al’ HECP’s are sel­dom use­ful except as a tem­plate doc­u­ment. Devel­op­ment of HECPs takes some care­ful thought and a thor­ough under­stand­ing of the kinds of work that will need to be done to main­tain and ser­vice the machin­ery. Indi­vid­ual juris­dic­tions have some dif­fer­ences in the details of their reg­u­la­tions, but ulti­mate­ly the require­ments come down to the same thing: Pro­tect­ing work­ers.

Con­trol sys­tem devices such as stop but­tons and emer­gency stop devices are not accept­ed as ener­gy iso­lat­ing devices and can­not be used for this pur­pose, although they may be used as part of the HECP shut­down pro­ce­dure lead­ing up to the phys­i­cal iso­la­tion of the haz­ardous ener­gy sources.

Excel­lent stan­dards exist that cov­er devel­op­ment of these pro­ce­dures and should be ref­er­enced as spe­cif­ic HECP are devel­oped.

5% Dis­count on All Stan­dards with code: CC2011

References

Canada

Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

CSA Z460-05 (R2010) — Con­trol of haz­ardous ener­gy — Lock­out and oth­er meth­ods

USA

29 CFR 1910.147The con­trol of haz­ardous ener­gy (lockout/tagout).

ANSI Z244.1 — 2003 (R2008) — Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods

Down­load stan­dards

Allen-Bradley 8579
Allen-Bradley 8579

International

ISO 14118 2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up

Down­load ISO Stan­dards