User-Friendly Guards

It's important to recognize that safeguards – even interlocked guards – are always willingly accepted and are not manipulated when they do not obstruct but actually support or even simplify the workflow. Faults in the safety concept which force operators to manipulate safeguards are genuine design faults, for which the machine manufacturer is liable in some circumstances. Safety-related solutions with an acceptable residual risk must be put in place, not just for fault-free normal operation, but also for setup, testing, fault removal and troubleshooting.

Simply to make manipulation attempts more difficult on a technical level, as laid out in the supplement to EN 1088 for example, only appears to solve the problem. For if there is enough pressure, a “solution” will be found. It's more important to eliminate the reason for manipulation. What's needed is not excessive functionality (even in terms of safety technology), but user friendliness. If there's any doubt as to whether the safety concept is adequate, it's recommend that you seek expert advice from the relevant employer's liability insurance association or from the safety component manufacturer.

Guards use physical barriers to stop people and hazardous situations coinciding in time and space. Their essential design requirements are stated in EN 953 and EN 1088. Safety-related and ergonomic aspects must be taken into account alongside questions regarding the choice of materials and consideration of mechanical aspects such as stability. These factors are decisive, not just in terms of the quality of the guard function but also in determining whether the safeguards, designed and constructed at considerable expense, will be used
willingly by employees or be defeated and even manipulated.

Experience shows that despite all the protestations, almost every safeguard has to be removed or opened at some point over the course of time. When safeguards are opened, it's fundamentally important that hazards are avoided where possible and that employees are protected from danger. The reason for opening, the frequency of opening and the actual risk involved in carrying out activities behind open safeguards (see the following illustrations) will determine the procedures used to attach and monitor safeguards.

Where safeguards are opened as a condition of operation or more frequently (for example: at least once per shift), this must be possible without using tools. Where there are hazardous situations, use of an interlock or guard locking device must be guaranteed. Further protective measures must be adjusted to suit the resulting risk and the drive/technological conditions, to ensure that the activities
which need to be carried out while the safeguards are open can be performed at an acceptable level of risk. This procedure conforms to the EC Machinery Directive. It allows work to be carried out while the safeguards are open as a special operating mode and gives this practice a legal basis.

Just some final words in conclusion for all designers: Designing interlocks so that absolutely no movement of the machine or subsections is possible once the safeguard has been opened actually encourages the type of conduct which is contrary to safety and, ultimately, leads to accidents. Nevertheless it is the causes you have to combat, not the people. If a machine does not operate as intended, users will feel they have no choice but to intervene. In all probability, the machine will “reciprocate” some time with an accident. Which is not actually what is was designed to do!

Manipulation of Safe Guards: What can designers do?

Designing safety-related machinery means more than simply complying with regulations and other legal stipulations. Consulting the relevant regulations and standards, dismissively asking “Where does it say that?!” – to ensure that only those safety measures that are strictly necessary are implemented – is no substitute for deep consideration of solutions that are not only right for safety and right for people, but are also fit for purpose.

Most of all, designers must be more sensitive to operators' demands for operability of machines and safety devices and provide a serious response, because their demands are based on practical experience. This does not make the safety-related design more difficult, but is the basis on which to build user-friendly, safety-related machinery. It's essential that the actual development and design is preceded by a detailed, candid analysis of the operational requirements, the results of which are recorded in a binding requirement specification. If not the situation may arise in which the machine and its incorporated safety measures may not be accepted. What's more they could provoke users into creating "new ideas", which are mostly not in the spirit of health and safety. These in turn could conjure up a whole new set of hazards, which were far from the minds of the original designers.

Experience shows that the fi rst part of this challenge can be met at reasonable cost and with a sufficient level of success through systematic troubleshooting, using function structures and signal flow paths. As for the second part of the task, counteracting manipulation attempts, designers must rely on their tried and trusted methods, as with any other design task. After all, safety related design is hardly a dark art!

Nonetheless: Manipulation rarely occurs voluntarily; it usually indicates that machine and operating concepts are not at their optimum. Conduct contrary to safety should always be anticipated when:

• Work practices demand actions which do not have a direct, positive impact on outcomes
• Work practices enforce constant repetition of the same work steps, or fresh approaches are always required in order to achieve work targets
• Safeguards restrict the line of vision and room for maneuvering required to perform the activity
• Safeguards impede or even block the visual/auditory feedback required to work successfully
• Troubleshooting and fault removal are impossible when the safeguards are open

In other words: Manipulations must always be anticipated when restricted machine functions or unacceptable difficulties tempt, even force, the machine user to “improve” safety concepts. Manufacturers must design protective measures so that the functionality and user friendliness of the machine are guaranteed at a tolerable, acceptable level of residual risk: predict future manipulation attempts, use design measures to counteract them
and at the same time improve machine handling.

The obligations of machine manufacturers are threefold:

1. Anticipate reasons and incentives for manipulation, remove the temptation to defeat interlocks by creating well thought-out operating and safety concepts for machinery.
2. Make manipulation difficult by design, e. g. by installing safety switches in accessible areas, using hinged switches, attaching safety switches and their actuators with non-removable screws, etc.
3. Under the terms of the monitoring obligation specified in the Geräte- und Produktsicherheitsgesetz [German equipment and product safety law], systematically identify and rectify any deficiencies through rigorous product monitoring with all operators (reports from customer service engineers and spare part deliveries are sometimes very revealing in this respect!).

The client who places the order for a machine can also help to counteract manipulation by talking to the machine manufacturer and candidly listing the requirements in an implementation manual, binding to both parties, and by talking openly about the faults and deficiencies within the process, then documenting this information.

Movable or fixed guarding? Which is right for you?

Movable Guarding

If access is required to the danger zone, a movable guard can be used, e.g. a safety gate.

The frequency with which access is required will determine whether the guard needs to be fixed or movable. The standards can help you make this decision.

EN 953

Where access is required only for machine setting, process correction or maintenance, the following types of guard should be used:

1. Movable guard if the foreseeable frequency of access is high (e.g. more than once per shift), or if removal or replacement of a fixed guard would be difficult. Movable guards shall be associated with an interlock or an interlock with guard locking (see EN 1088)
2. Fixed guard only if the foreseeable frequency of access is low, its replacement is easy, and its removal and replacement are carried out under a safe system of work.

Note: In this case, the term “interlock” means the electrical connection between the position of the safeguard and the drives to be shut down. In safety technology, the commonly understood mechanical “interlock”, meaning a lock is called a “guard locking device”.

EN 1088

7.5 Frequency f access (frequency of opening the guard for access to the danger zone)

7.5.1 For applications requiring frequent access, the interlocking device shall be chosen to provide the least possible hindrance to the operation of the guard.

A clear distinction should be made between the following:

o    The concept of frequent access required by the normal operation of the machine, as e.g. once per cycle to feed raw products to the machine and remove finished products

o    The concept of occasional access, e.g. to carry out adjustment or maintenance interventions, or for random corrective actions in danger zones

Each of these concepts is associated with an order of magnitude differing greatly as to the frequency of human intervention in the danger zone (e.g. One hundred times per hour in the case of one access per cycle, and several times per day in the case of occasional access for adjustment or maintenance during an automatic production process).

7.5.2 For applications using interlocking devices with automatic monitoring, a functional test can be carried out every time the device changes its state, i.e. at every access. If, in such a case, there is only infrequent access, the interlocking device should be used with additional measures such as conditional guard unlocking (e.g. separate approval), as between consecutive functional tests the probability of occurrence of an undetected fault is increased.

EN 62061

Frequency and duration of exposure

Consider the following aspects to determine the level of exposure:

o    Need for access to the danger zone based on all modes of use, for example normal operation, maintenance

o    Nature of access, for example, manual feed of material, setting

It should then be possible to estimate the average interval between exposures and therefore the average frequency of access.

Where the duration is shorter than 10 min, the value may be decreased to the next level. This does not apply to frequency of exposure ≤ 1 h, which should not be decreased at any time.

Select the appropriate row for frequency and duration of exposure (Fr) from the following table. 

 

Fixed Guarding

Fixed guards are permanently attached to the machine. This type of safeguard is suitable when it is unnecessary to remove the guard under normal operating conditions or when access is not required during the work process. Examples would be chain covers or grills in front of motor fans. 

Further aspects on the design of safeguards

Once the decision has been made to use a movable guard, the next step is to perform a risk assessment in accordance with EN 62061, EN ISO 13849-1 or, for a transitional period, even 954-1, to determine the safety level (category, safety integrity level SIL or performance level PL). The corresponding control system is then designed and validated.

These control systems will include sensors in the form of switches, when then detect the position of the guard. Via this detection feature, hazardous movements can be stopped as a result of the guard being opened. An additional safety function can prevent drives starting up unexpectedly when a safety gate is opened. The drive’s stopping time will need to be considered. When a safety gate is opened, if it can be assumed that a drive with a long stopping time will generate a hazardous movement, this gate will require a guard locking device. The guard locking device must be unlocked by actively operating a release. This is the only way to guarantee that the safety gate is not released unintentionally as the result of a power failure. In this case it’s also important to note that a person who is in the danger zone at the time of the power failure and has shut the safety gates behind him cannot be released by an unlock command on the machine control system. Such a case may be rare, but it is conceivable, so any guard locking devices that are considered will have a mechanical release function. However, operating staff must be sure to have the appropriate actuation tool available.