Looking for some help on when is isolation required. 

Firstly let me explain the equipment it is a small cup forming machine with hinged interlock doors on both sides. The interlocks are to a standard where a single fault would not lead to loss of the safety function. Operators running the machine would use the interlock doors to clear blockages and complete cleaning activities. Engineers feel they should be able to reply on the same interlocks to complete their engineering activities, these activities would be completing a tool change where they would need to unbolt and remove the mandrills from the machine, they would need to inch the machine around to remove each mandrill so they feel the need the leave the power on. There is no chance of the machine starting or parts moving with the interlock doors open. 

The PUWER regs and the guidance to this dont seem to leave a lot of room for work without isolation unless we interpert the wording on guarding as meaning fixed guarding only. 

Our risk assessment would deem the risk from contact with moving parts low if we rely on the interlocks to complete the work. 

Edited by user 06 April 2021 09:14:08(UTC)  | Reason: Not specified

Random fact: - I work in H&S due to me being injured by a machine that was "e-stopped" off but not isolated. I reached into a cog and the machine started up, taking my finger through it. I have lost all feeling in my right index finger from the last knuckle when it was stripped bare practically to the bone.. There was a fault in the machine that meant the machine tried to reset even though the e.stop button was in. When the company refused to believe me I sued. When they asked why I replied that unless I showed them liable they wouldn't repair the machine, and therefore it could happen again. The found the fault, repaired the machine and I dropped the case. They then put me in charge of H&S. (long story short)

A few issues I foresee with not isolating, based on experience.

1. Interlocks leave the machine live. There is an increased risk of electric shock should they be working near any exposed electrical parts.
2. They may be tempted to "by-pass" interlocks so that they can jog the machine with the interlocks open. If this is a machine that a person can be inside whilst the doors are closed it is a huge risk
3. The machine is less likely to be "tagged off" if it is not isolated, meaning that it could be restarted before the work is finished.

However if the machine has been designed correctly, with the proper interlocks etc (as Paul expertly says) you may be ok.

I for one consider that the only safe way to work on a machine is to isolate all sources of power to it then run a test system to ensure that it does not operate.  We can all look for excuses thats it ok to do minor works using the interlocks to prevent the machine operating, but you just have to look through a few court cases where people have been injured or killed whilst doing work on machines.  I personally have seen a number of cases where people have put themselves at risk "for the sake of speed or I was doing the right thing for the company".  In one case I was doing an insurance survey at a plastic box manufacturer where the moulding machine did not eject a box as part of the normal production cycle.  I was amazed that the operator opened the gate in the enclosure, walked in, pulled the box out and walked out again.  On questioning he said that he didn't have time to isolate the machine as this was a normal occurance and he wouldn't hit his target for the day.  In a second case, again on an insurance survey, we rounded a corner and found an operator laying inside a press used to form aluminum sections into curved panels, again he was working with only an interlock to protect him.  I was surprised that they both didn't appear to fully understand the consequences of their actions and that a helpful employee could have just closed the interlocked gate and the machine would have gone through a cycle with them in it.  

So for me if a machine requires remedial work to clear a blockage or if minor maintainance work is required.  The machine should be fully isolated and tested to ensure that it cannot start.  Remember Try, Lock, Test and Try. Then proceed. 

How are the interlock doors controlled to prevent them being inadvertally closed and starting the machine up unexpectedly?

BS EN 60204‑1:2018

5.4 Devices for removal of power for prevention of unexpected start-up

"Devices for removal of power for the prevention of unexpected start-up shall be provided where a start-up of the machine or part of the machine can create a hazard (for example during maintenance). Such devices shall be appropriate and convenient for the intended use, be suitably placed, and readily identifiable as to their function and purpose. Where their function and purpose is not otherwise obvious (e.g. by their location) these devices shall be marked to indicate the extent of removal of power."

ISO 14118:2017 specifies requirements for designed-in means aimed at preventing unexpected machine start-up to allow safe human interventions in danger zones

Dai - I would be inclined to follow the advice given by Paul Skyrme rather than that of an American manufacturer.

OSHA Regulations in the US might tell you that any intervention must be done under LOTO, but in reality this probably doesn't happen much of the time, but OSHA Regulations do not recognise the concept of doing what is "reasonably practicable". If the legislation is impractical to comply with it is likely to be breached. That might help to explain why US reported accident rates are MUCH higher than those in most of Europe.

This is NOT me arguing that isolation and lock off is not often necessary! UK legislation reflects this but recognises that there are exceptions.

Where do the "multi-skilled" fit in to your vision of a workforce? As we have no legal differentiation within the UK an operator/fitter/engineer can be all of the above OR none of the above.

In the old Trades Union days everyone hade their demarcated activity at an employer and woe betide the employer if anyone crossed the invisible lines. Nowadays we come back time and again to the concept of competence relative to the task being undertaken.

In the main, just as beauty is in the eye of the beholder, so competence is in the eye of the employer.

If I can point the open end of a spanner at a nut am I an engineer? At least four previous employers considered me so despite no apprenticeship, NVQ or degree.

Originally Posted by: DaiJones

cat 2 and cat 3, performance rating  b for low and d for medium for the cat 3 machines and b for low c for medium for the cat 2 machines.

I am not quite sure about the way you have used the terms here so I will interpret this as best as I can.

Lets's say you have PLb (Performance Level b), I am guessing that the low relates to the diagnostic coverage?  Though that rolls into the PL.

Category 2, (Cat 2) relates to the architecture of the safety function, i.e. circuit design (generally speaking).

A Cat 2 architecture requires that the machine automatically checks the safety function operation upon start up, and if it is incorrect then the machine must fail to start.

It also must be checked at every change of state (effectively).

PLb is only suitable where a reversible injury could be sustained.

The chance of a dangerous failure, that is a failure in the safety function, which goes undetected and may cause harm, must only be able to happen at the most frequent once every 10,000 hours.  The machine must also have a 20 year mission life on the safety functions, so it should fo 20 years without any manual interventions and not suffer one failure, after that it may suffer a failure in the next 10,000 hours that goes undetected.  So even the lowest level of functional safety on the machine is pretty damn safe.

PLc is at worst one undetected dangerous failure every 33,333 hours.

PLd is at worse one undetected dangerous failure every 100,000 hours.

Category 3 requires that dangerous failures are detected prior to the demand on the safety function too.

Pd Cat 3 is pretty damn safe.

PLe Cat 4 would be the ultimate and that would be on a whole body access zone whereby a failure would result in a death or multiple deaths, and, would be completely unavoidable should the thing fail.

Without knowing what the actual details of the interlocks on the guard protecting the area are, the details fo the circuit and having access to the 945/13849 checks and validations I would not be able to comment further on the suitability of the interlocks.

The issue as has been suggested which stems from the USA is the insistence on LOTO, which in itself encourages the defeating of safety systems.  The motivation to defeat safety systems and functions such as guarding and guard interlocks is going to become a big topic soon as it is being looked at by the relevant standards bodies to roll into the product standards so manufacturers of equipment will have to design such that tasks can be undertaken safely without there being protracted procedures to get the machine into a safe state. So functional safety is likely to increase its role.

Because LOTO takes effort from the "operator", they have to get permission to LOTO, sort out any permits, get a lock, isolate the machine, lock it off, do the job and reverse the procedure, which takes time.

Additionally, the act of shutting down the machine might have knock-on effects elsewhere in the plant/on the line, so this will be unpopular with management.

Ergo, people take risks, it's easier to grab a hex key out of your pocket and remove a fixed guard with the power on and just do the job, stick the guard back on after with just one screw, loose.  Makes it easier for next time.

Also, LOTO is procedural safety it is lower down the hierarchy of control than engineering controls which is what correctly implemented functional safety is.

I find the issue is that unfortunately, and I don't think that this statement is going to be popular here.

Many H&S practitioners do not understand the engineering behind functional safety and thus look at it as dangerous.  Whereas a safety engineer who designs, validates and advises on such things sees it as much safer than procedures because it happens without human intervention and is self-diagnosing.  It will prevent a machine from operating if it detects a failure.

This, however, does rely on the functional safety being done correctly, which relies on the end-user ensuring that the machine OEM does this correctly, which I why I ALWAYS advise end-users to verify the existence of the Technical File for the machine they are buying and to insist, by means of the contract if necessary to have a copy of the ISO 13849-2 validation on paper and in the native software method used to do the validation if any software is used.

The paper validation is great, but the software file can be sent to people like me to check if the validation is done correctly and advise you whether the safety functions have been designed correctly.

Also, to insist on the safety matrix used to derive the safety functions so that this can be looked at with the physical machine to ensure that the appropriate devices are having their energy removed.

Then the PLr needs to be checked to see that an appropriate PLr has been selected, this needs the PLr assessment to ISO 13849-1.

This is an important part of compliance with PUWER Reg 10.  Without this, how can you be sure that the machine is safe?

Functional safety is a fundamental part of the safety built into the machine, its correct operation and suitability need to be verified by a competent safety engineer because it is the end-user whose personnel will get injured, and it is the end-user who suffers the losses in downtime from injuries or protracted LOTO procedures if they don’t accept the machine design is fundamentally safe.

We won’t even go into the controls over machinery electrical enclosures which are encroaching from the NEC world to the IEC world when the NEC designs are in my experience 20 years behind the IEC designs as far as safety and accessibility of exposed live parts.

Are you comfortable putting your body parts into the machine when it is not fully isolated? 

How practical are your LOTO procedures?

Regardless of what all the standards and regulations say, is there, in your opinion a significant risk of harm?