american national standard - results...

AMERICAN NATIONAL STANDARD ANSI/PMMI B155.1-201x

© Copyright 2016 PMMI All rights reserved 1

AN

SI/P

MM

I B15

5.1-

201x

Am

eric

an N

atio

nal

Sta

nd

ard

ANSI/PMMI B155.1-201x 24 February 2016 Draft 1.0 B155.1-201X 5 April 2016 Draft 1.3 includes changes from first meeting and subgroup works 2 June 2016 Draft 2 Changes made by committee 23 June 2016 Draft 2.1 Various formatting changes (not tracked) 29 June 2016 Draft 2.2 Adding list of harmonized type C standards 1 July 2016 Draft 2.3 Draft for ballot and public comment

Safety Requirements for Packaging and Processing Machinery

PMMI The Association for Packaging and Processing Technologies



AMERICAN NATIONAL STANDARD

By approving this American National Standard, the ANSI Board of Standards Review confirms that the requirements for due process, consensus, balance and openness have been met by the Association for Packaging and Processing Technologies (PMMI), the ANSI-accredited standards developing organization. American National Standards are developed through a consensus process. Consensus is established when substantial agreement has been reached by directly and materially affected interests. Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus requires that all views and objections be considered, and that a concerted effort be made toward resolution. This process brings together volunteers or seeks out the views of persons who have an interest in the topic covered by this standard. While PMMI administers the process and establishes procedures to promote fairness in the development of consensus, it does not write the document and it does not independently test, evaluate or verify the accuracy or completeness of any information or the soundness of any judgments contained in its standards or guidelines. American National Standards are promulgated through ANSI for voluntary use; their existence does not in any respect preclude anyone, whether they have approved the standards or not, from manufacturing, marketing, purchasing, or using products, processes, or procedures not conforming to the standards. However, users, distributors, regulatory bodies, certification agencies and others concerned may apply American National Standards as mandatory requirements in commerce and industry. The American National Standards Institute does not develop standards and will in no circumstances give an interpretation of an American National Standard. Moreover, no person shall have the right or authority to issue an interpretation of an American National Standard in the name of the American National Standards Institute. Requests for interpretations should be addressed to the Secretariat (PMMI). NOTICE: This American National Standard may be revised or withdrawn at any time. The procedures of the American National Standards Institute require that action be taken periodically to reaffirm, revise, or withdraw this standard. You may contact the Secretariat for current status information on this standard. Individuals interested in obtaining up-to-date information on standards can access this information at www.nssn.org (or by contacting ANSI). NSSN - A National Resource for Global Standards provides a central point to search for standards information from worldwide sources and can connect those who seek standards to those who supply them. PMMI makes no warranty, either expressed or implied as to the fitness of merchantability or accuracy of the information contained within this standard, and disclaims and makes no warranty that the information in this standard will fulfill any of your particular purposes or needs. PMMI disclaims liability for any personal injury, property or other damages of any nature whatsoever, whether special, indirect, consequential or compensatory, directly or indirectly resulting from the publication, use of, application or reliance on this standard. PMMI does not undertake to guarantee the performance of any individual manufacturer or seller’s products or services by virtue of this standard, nor does it take any position with respect to the validity of any patent rights asserted in connection with the items which are mentioned in or are the subject of this standard, and PMMI disclaims liability for the infringement of any patent resulting from the use of or reliance on this standard. Users of this standard are expressly advised that determination of the validity of any such patent rights, and the risk of infringement of such rights, is entirely their own responsibility.



In publishing or making this standard available, PMMI is not undertaking to render professional or other services for or on behalf of any person or entity, nor is PMMI undertaking to perform any duty owed by any person or entity to someone else. Anyone using this standard should rely on his or her own independent judgment, or as appropriate, seek the advice of a competent professional in determining the exercise of reasonable care in any given circumstances. In addition to performing the risk assessment described by this standard, the responsible personnel should also make an independent determination as to whether a machine, activity or condition complies with the applicable legal requirements in the relevant jurisdiction(s). PMMI has no power, nor does it undertake to police or enforce conformance to the requirements of this voluntary standard. PMMI does not certify, test or inspect products, designs, or installations for safety or health purposes. Any certification or other statement of conformance to any health or safety-related information in this standard shall not be attributable to PMMI and is solely the responsibility of the certifier or maker of the statement. This standard is available from www.pmmi.org.

Published by: PMMI The Association for Packaging and Processing Technologies 11911 Freedom Drive, Suite 600 Reston, VA 20190-5629, USA

© Copyright 2016. Association for Packaging and Processing Technologies All rights reserved.

No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written permission of the publisher.



This page is intentionally blank



ANSI/PMMI B155.1-201x

Revision of ANSI/PMMI B155.1-2011

American National Standard

Safety Requirements for Packaging and Processing Machinery

Secretariat and Standards Developing Organization PMMI The Association for Packaging and Processing Technologies 11911 Freedom Drive, Suite 600 Reston, VA 20190-5629, USA American National Standards Institute, Inc 1899 L Street, NW, 11th floor Washington, DC 20036



CONTENTS

0 FOREWORD .................................................................................................................................................................. 9

1 SCOPE AND PURPOSE ................................................................................................................................................. 12

1.1 SCOPE ............................................................................................................................................................................... 12 1.2 PURPOSE ........................................................................................................................................................................... 12

2 NORMATIVE REFERENCES ........................................................................................................................................... 12

3 DEFINITIONS .............................................................................................................................................................. 14

4 RESPONSIBILITIES ....................................................................................................................................................... 19

4.1 GENERAL ........................................................................................................................................................................... 19 4.2 COLLABORATIVE EFFORTS ...................................................................................................................................................... 22 4.3 RESPONSIBILITIES OF THE COMPONENT SUPPLIER, MACHINE SUPPLIER AND THE MACHINE USER ........................................................... 22 4.4 RESPONSIBILITIES OF THE COMPONENT USER / MACHINE SUPPLIER ................................................................................................ 22 4.5 QUALIFIED PERSONS ............................................................................................................................................................ 23 4.6 SPECIFICATIONS .................................................................................................................................................................. 23 4.7 DESIGN, CONSTRUCTION AND INFORMATION FOR OPERATION AND MAINTENANCE ........................................................................... 23 4.8 INSTALLATION, COMMISSIONING AND START‐UP ........................................................................................................................ 24 4.9 SAFEGUARDING .................................................................................................................................................................. 24 4.10 OPERATION AND MAINTENANCE ............................................................................................................................................. 24 4.11 TRAINING OF USER PERSONNEL .............................................................................................................................................. 24 4.12 CLEANING AND SANITIZATION ................................................................................................................................................ 24 4.13 OPERATIONAL WORKING SPACE .............................................................................................................................................. 25 4.14 EXISTING (LEGACY) EQUIPMENT ............................................................................................................................................. 25 4.15 MODIFYING OR REBUILDING MACHINERY.................................................................................................................................. 25 4.16 SUPPLIERS OF USED MACHINERY ............................................................................................................................................. 25 4.17 DECOMMISSIONING AND OTHER LIFE CYCLE ACTIVITIES ................................................................................................................ 25 4.18 PERSONNEL RESPONSIBILITY .................................................................................................................................................. 26

5 REQUIREMENTS FOR DESIGN, CONSTRUCTION, RECONSTRUCTION, MODIFICATION, INSTALLATION, OPERATION AND MAINTENANCE OF MACHINERY ......................................................................................................................................... 26

5.1 GENERAL ........................................................................................................................................................................... 26 5.2 SUPPLIER ........................................................................................................................................................................... 26 5.3 USER ................................................................................................................................................................................ 26 5.4 INSTALLATION ..................................................................................................................................................................... 26 5.5 INTEGRATOR / MODIFIER / REBUILDER ..................................................................................................................................... 26

6 THE RISK ASSESSMENT PROCESS ................................................................................................................................. 26

6.1 GENERAL ........................................................................................................................................................................... 26 6.2 PREPARE FOR/SET LIMITS OF THE ASSESSMENT .......................................................................................................................... 28 6.3 IDENTIFY HAZARDS ............................................................................................................................................................... 28 6.4 ASSESS INITIAL RISK .............................................................................................................................................................. 30 6.5 REDUCE RISK ...................................................................................................................................................................... 32 6.6 ASSESS RESIDUAL RISK .......................................................................................................................................................... 35 6.7 ACHIEVE ACCEPTABLE RISK .................................................................................................................................................... 36 6.8 VALIDATE RISK REDUCTION MEASURES ..................................................................................................................................... 36



6.9 DOCUMENT THE RESULTS ...................................................................................................................................................... 36

7 SPECIFIC RISK REDUCTION METHODS ......................................................................................................................... 37

7.1 ACCESS TO MACHINERY ........................................................................................................................................................ 37 7.2 CONTROL SYSTEMS PERFORMING A SAFETY FUNCTION ................................................................................................................ 37 7.3 CONTROL SYSTEMS DESIGN REQUIREMENTS .............................................................................................................................. 39 7.4 MATERIAL CONVEYANCE ....................................................................................................................................................... 41 7.5 ELECTROMAGNETIC COMPATIBILITY (EMC) .............................................................................................................................. 41 7.6 ELECTRICAL ........................................................................................................................................................................ 41 7.7 EMERGENCY STOP ............................................................................................................................................................... 41 7.8 ERGONOMICS / HUMAN FACTORS ........................................................................................................................................... 41 7.9 SAFEGUARDING .................................................................................................................................................................. 41 7.10 LIFTING OF MACHINES, COMPONENT PARTS AND MATERIALS ........................................................................................................ 42 7.11 HYDRAULIC AND PNEUMATIC (INCLUDING VACUUM) SYSTEMS ...................................................................................................... 42 7.12 PRESSURE VESSELS ............................................................................................................................................................... 44 7.13 LADDERS AND PLATFORMS .................................................................................................................................................... 44 7.14 LASERS .............................................................................................................................................................................. 44 7.15 LUBRICATION...................................................................................................................................................................... 44 7.16 MECHANICAL POWER TRANSMISSION ...................................................................................................................................... 44 7.17 MODIFIED ATMOSPHERES ..................................................................................................................................................... 45 7.18 NOISE ............................................................................................................................................................................... 45 7.19 INDUSTRIAL ROBOTS ............................................................................................................................................................ 45 7.20 RADIATION AND MAGNETIC FIELDS .......................................................................................................................................... 45 7.21 SANITIZATION AND HYGIENE .................................................................................................................................................. 46 7.22 STABILITY ........................................................................................................................................................................... 46 7.23 THERMAL SYSTEMS .............................................................................................................................................................. 47 7.24 VISIBILITY .......................................................................................................................................................................... 47 7.25 VENTILATION OF AIRBORNE CONTAMINANTS ............................................................................................................................. 47

8 INFORMATION FOR OPERATION, CLEANING AND MAINTENANCE OF MACHINERY ...................................................... 47

8.1 GENERAL ........................................................................................................................................................................... 47 8.2 MANUALS .......................................................................................................................................................................... 47 8.3 MACHINERY SAFETY SIGNS AND LABELS .................................................................................................................................... 48 8.4 NAMEPLATE ....................................................................................................................................................................... 48 8.5 INFORMATION FOR PERSONAL PROTECTIVE EQUIPMENT (PPE) ..................................................................................................... 48 8.6 INFORMATION FOR VERIFICATION ........................................................................................................................................... 48

9 TRAINING ................................................................................................................................................................... 48

9.1 GENERAL ........................................................................................................................................................................... 48 9.2 TRAINING ELEMENTS ............................................................................................................................................................ 49 9.3 OPERATOR TRAINING ........................................................................................................................................................... 51 9.4 MAINTENANCE PERSONNEL TRAINING ..................................................................................................................................... 51 9.5 CLEANING AND SANITIZATION PERSONNEL TRAINING .................................................................................................................. 51 9.6 SUPERVISOR TRAINING ......................................................................................................................................................... 51 9.7 RETRAINING ....................................................................................................................................................................... 52

10 PERSONAL PROTECTIVE EQUIPMENT ...................................................................................................................... 52

ANNEX A DECISION TREE FOR SAFETY OF PRODUCT AND PERSONNEL (INFORMATIVE) .................................................. 53



ANNEX B (INFORMATIVE) GUIDANCE FOR THE RISK ASSESSMENT PROCESS ................................................................ 54

ANNEX C (INFORMATIVE) LIST OF PACKAGING AND PROCESSING MACHINERY HAZARDS ............................................ 57

ANNEX D (INFORMATIVE) SHARING INFORMATION ABOUT RESIDUAL RISK................................................................. 61

ANNEX E (INFORMATIVE) OTHER RISK SCORING SYSTEMS .......................................................................................... 66

ANNEX F (INFORMATIVE) SAMPLE RISK ASSESSMENT DOCUMENTATION ................................................................... 72

ANNEX G (INFORMATIVE) REFERENCES ....................................................................................................................... 73

ANNEX H (INFORMATIVE) LIST OF EN (EUROPEAN NORM) PACKAGING MACHINERY STANDARDS ................................ 75

ANNEX I (INFORMATIVE) LIST OF SOME OF THE “TYPE C” HARMONIZED STANDARDS UNDER THE “EU MACHINERY DIRECTIVE” FOR FOOD PROCESSING, PLASTIC AND PAPER MANUFACTURING. ................................................................... 76

ANNEX J (INFORMATIVE) STANDARDS REFERENCES USEFUL IN DESIGN: ...................................................................... 80

ANNEX K (INFORMATIVE) INFORMATION FOR USE – MANUAL CONTENT OUTLINE ...................................................... 89

ANNEX L (INFORMATIVE) SUGGESTED INFORMATION FOR USE ................................................................................... 90

ANNEX M (INFORMATIVE) SAMPLE STATEMENT OF CONFORMITY ............................................................................... 91

ANNEX N (INFORMATIVE) ANNEX B FROM ISO 14159 .................................................................................................. 92

ANNEX O (INFORMATIVE) STANDARDS VISUAL MAPPING (FROM ANSI B11.0 ANNEX K) ........................................... 107



0 Foreword (This foreword is not part of the requirements of American National Standard ANSI/PMMI B155.1-2011)

This standard was promulgated by The Association for Packaging and Processing Technologies (PMMI) as a voluntary standard to establish safety requirements for machinery.

The first version of this standard was approved by the PMMI membership on 27 September 1972. It was approved as an American National Standard by ANSI on 6 August 1973. The standard has been reviewed and revised with subsequent approvals by the ANSI Board of Standards Review in 1979, 1986, 1994, 2000 2006, and 2011.

This version of the standard has been harmonized with international (ISO) and European (EN) standard ISO 12100. … Suppliers meeting the requirements of ANSI/PMMI B155.1-2016 may simultaneously meet the requirements of ISO 12100.

The B155.1 standard can be associated with the ISO “A-B-C level” structure as described immediately below, and as shown in Figure 1 below.

Type-A standards (basis standards) give basic concepts, principles for design, and general aspects that can be applied to machinery.

Type-B standards (generic safety standards) deal with one or more safety aspects or one or more types of safeguards that can be used across a wide range of machinery.

Type-C standards (machinery safety standards) deal with detailed safety requirements for a particular machine or group of machines.

This B155.1 standard on general safety requirements common to packaging and processing machines is primarily an “A-level” standard in that it applies to a broad array of packaging and processing machines and contains very general requirements. However, in many areas it also contains very specific requirements typical of a type-C standard.

Figure 1 - A / B / C Organization of Standards

This standard is intended for readers with differing levels of familiarity with standards and the risk assessment process. The requirements of the machine specific ANSI standards are grouped according to those that apply to the supplier

C

B

AGeneral B155.1 Requirements

B11.19, B11 Technical Reports

Machine-specific standards



(i.e., manufacturer, rebuilder, modifier) and user. Some are shared between the supplier and user and are so indicated.

The objective of the B155.1 standard is to eliminate injuries to personnel packaging and processing systems by establishing requirements for the design, construction, reconstruction, modification, installation, set–up, operation and maintenance packaging and processing machinery systems. Responsibilities have been assigned to the supplier, the user and the user personnel to implement this standard. This standard is not intended to replace good judgment and personal responsibility. Personnel skill, attitude, training and experience are safety factors that should be considered by the user.

“Safe” is the state of being protected from recognized hazards likely to cause serious physical harm. There is no such thing as being absolutely safe, that is, a complete absence of risk, and therefore there is no machinery, including packaging and processing machinery, that is absolutely safe in the sense of being completely devoid of all conceivable risks. All machinery contains hazards, and some level of residual risk. However, the risk associated with those hazards should be reduced to an acceptable level. To achieve this goal, senior management should allocate appropriate personnel, time and resources to permit the risk assessment process to be successfully completed. Senior management holds the ultimate responsibility to determine the level(s) of acceptable risk.

This standard guides packaging and processing machinery suppliers and users through a risk assessment process designed to ensure that reasonably foreseeable hazards are identified and corresponding risks are reduced to an acceptable level. In this standard the terms “acceptable” and “tolerable” are used as synonyms. Although engineers have long applied an informal risk assessment framework, this standard introduces a formal method to conduct and document the risk assessment process.

This standard identifies some preparations that need to be made before a risk assessment begins, and presents the basic risk assessment process in a step by step approach to assist in achieving this goal.

The outcome of completing the risk assessment process should be: Packaging and processing machinery ready to ship, install or use with risks reduced to an acceptable

level; Awareness devices, warning labels, instruction manual(s) and information for operation and maintenance; Documentation of the risk assessment.

This standard does not use the term “and/or” but instead, the term “or” is used as an inclusive disjunction, meaning one or the other or both.

Effective Date

The following information on effective dates is informative guidance only, and is not a normative part of this standard. The committee recognizes that suppliers and users will need some period of time, after the approval date on the title page of this document, to develop new designs, or modify existing designs or manufacturing processes in order to incorporate the new or revised requirements of this standard into their product development or production system.

The committee recommends that suppliers complete and implement design changes for new packaging and processing machinery within 6 months of the publication of this standard.

The committee also recommends that users confirm that packaging and processing machinery has acceptable risk within 6 months of the publication date of this standard. If the risk assessment shows that modification(s) is necessary, refer to the requirements of this standard to implement risk reduction measures for appropriate risk reduction.



PMMI B155.1 Standard Committee Members

Chair John Uber

Mettler Toledo, NY

Vice Chair Jerry Barnes

The Babb Group

Secretary Fred Hayes

PMMI The Association for Packaging and Processing Technologies VA

Delegates Blackowiak, Steve Buhler Group Brubaker, Stanford Liberty Mutual Insurance Caudle, Tim Sealed Air Cotton, Randall Big Heart Pet Brands Cummings, Eric Ross Controls (NFPA) Deighton, Danny Eli Lilly Dela, Sonny Nestle USA Estes, Mick FANUC Robotics America, Corp Felinski, David B11 Standards Inc Halprin, Lawrence Keller and Heckman LLP Kirby, Joseph Intelligrated Larue, Karen Proctor & Gamble Luciano, Larry Luciano Packaging Technologies Main, Bruce design safety engineering inc Silver, Carla Merck Sharp and Dohme Corp Solberg, Wayne Rockwell Automation Squires, Pete Schneider Packaging Equipment Steele, Michael R.A Jones Covington Swanson, Matt Campbell Soup Vigdorovich, Alex MGS Machine Corporation Wittnebel, Robert Krones Alternates Buck, Bill Schneider Packaging Mayer, Doris Krones Inc Yacoub, John Mettler Toledo Rockhill, Denise National Fluid Power Association (NFPA) Lewandowski, Mark Proctor & Gamble Bradley, Scott Nestle Ney, Eric Big Heart Pet Brands



1 Scope and Purpose

1.1 Scope This standard specifies basic terminology, principles and a methodology for achieving safety in the design and the use of machinery. It specifies principles of risk assessment and risk reduction to help designers, integrators and users of machinery in achieving this objective. These principles are based on knowledge and experience of the design, use, incidents, accidents and risks associated with machinery. Procedures are described for identifying hazards and estimating and evaluating risks during relevant phases of the machine life cycle, and for the elimination of hazards or the provision of sufficient risk reduction. Guidance is given regarding the documentation and verification of the risk assessment and risk reduction process.

Informative Note: As used in this standard, ‘machinery’ includes both machinery as defined in clause 3.

The requirements of this standard apply to new, modified or rebuilt industrial and commercial:

- processing machinery used to produce food, beverage and pharmaceutical products; - packaging machinery that performs packaging functions for primary, secondary, and tertiary (transport /

distribution) packaging; - coordination of the packaging functions that take place on the production line; and - packaging-related converting machinery.

The standard does not include packaging or processing machinery used by retail consumers.

1.2 Purpose This standard describes procedures for identifying hazards, assessing risks, and reducing risks to an acceptable level over the life cycle of the machinery. These procedures include requirements for documenting conformance to this standard and the risk assessment results.

Informative Note: See clause 6 for additional information on risk assessment.

Deviations from the requirements of this standard shall be based on a documented risk assessment demonstrating acceptable risk. The requirements of this standard shall not inhibit innovation provided acceptable risk is achieved.

2 Normative References

The following standards contain provisions which constitute additional requirements of this American National Standard and are incorporated into this standard by reference. At the time of publication, the editions indicated were valid. All standards are subject to revision, and parties to agreements based on this American National Standard are encouraged to investigate the possibility of applying the most recent editions of the standards indicated below.

ANSI B11.19-2010 Performance Criteria for Safeguarding

NFPA 70-2014 National Electrical Code

NFPA 79-2015 Electrical Standard for Industrial Machinery

ANSI Z136.1-2014 Standard for Safe Use of Lasers

ANSI A1264.1-2007 Safety Requirements for Industrial Fixed Stairs, Floor and Wall Openings and Industrial Railings and Toe Boards

ANSI A14.3-2008 Safety Requirements for Fixed Ladders

ANSI Z535.4-2011 American National Standard for Product Safety Signs and Labels

ANSI Z535.6-2011 Product Safety Information in Product Manuals, Instructions and Other Collateral Materials

ANSI/ASSE Z244.1-2016 Control of Hazardous Energy – Lockout/Tagout and Alternative Methods



ANSI/ASME B20.1-2012 Safety Standards for Conveyors and Related Equipment

ISO 13850 2015 Safety of machinery. Emergency stop. Principles for design (EN ISO 13850 2008)

ISO 4413 2010 Hydraulic Fluid Power. General Rules Relating To Systems

ISO 4414 2010 Pneumatic Fluid Power. General Rules Relating To Systems

NFPA 61‐ 2013 Standard for the Prevention of Fires and Dust Explosions in Agricultural and Food Processing Facilities

NFPA 86 ‐ 2015 Standard for Ovens and Furnaces

ASME 31 Standards of Pressure Piping

BPVC 2015 ASME Boiler and Pressure Vessel Code

UL 508A 2015 Industrial Control Panels



3 Definitions

3.1 acceptable risk - risk that is accepted for a given task or hazard. For the purpose of this standard the terms “acceptable risk” and “tolerable risk” are considered synonymous.

Informative Note 1: The decision to accept (tolerate) a risk is influenced by many factors including the culture, technological and economic feasibility of installing additional risk reduction measures, the degree of protection achieved through the use of additional risk reduction measures, and the regulatory requirements or best industry practice. The expression “acceptable risk” usually, but not always, refers to the level at which further risk reduction measures or additional expenditure of resources will not result in significant reduction in risk.

Informative Note 2: The user and supplier may have different level(s) of acceptable risk.

3.2 accumulator - a vessel containing fluid under pressure used as a source of stored energy.

3.3 affected person (or personnel) - an individual who operates, services or maintains machinery, or others who are in proximity to the machinery.

3.4 awareness device - a barrier, signal or sign that warns individuals of an impending, approaching or present hazard.

3.5 cleaning – the removal of soil (any unwanted biological, chemical or physical matter) B155 TR3 3.6 commissioning - activities which ensure that equipment has been correctly installed, is operational, and will perform as designed. The objective is to demonstrate that systems will produce quality product and operate at design rate and conditions.

Informative Note: Commissioning may involve testing the machinery, systems or process, with or without product, to validate against production requirements.

3.7 control system - sensors, manual input and mode selection elements, interlocking and decision-making circuitry and output elements to the machine actuators, operating devices and mechanisms. (see 3.49 Safety-Related Part of a Control System (SRP/CS).

3.8 enabling device - a manually operated control device, that when continuously activated and used in conjunction with a separate actuating control, will allow the machine to function.

3.9 fail-to-safe - a control system response that after one or multiple failures lapses into a predictable safe condition.

3.10 fixed guard - a guard that requires tool(s) for opening or mounting and removal. These guards may incorporate hinges, pins or other means to attach them to the machinery.

3.11 guard - a barrier that prevents exposure to an identified hazard (see ANSI B11.19).

3.12 harm - physical injury or damage to health of people.



Informative Note: This may be a result of direct interaction with the machinery, or indirectly as a result of damage to property or to the environment.

3.13 hazard - a potential source of harm.

Informative Note: Hazards can also be associated with product handling, preparation and processing and can arise from:

biological causes such as pathogens, spoilage micro-organisms or toxins (e.g. ingress or retention of bacteria, spores, viruses, yeasts/molds);

chemical causes including those from cleaning and disinfection substances (e.g. lubricants, cleaning fluids, allergens);

physical causes such as foreign materials arising from raw materials, equipment or other sources (e.g. allergens, pests, metals, materials used in the construction of the machine/equipment). See ISO 14159

3.14 hazardous event - an event that can cause harm.

Informative Note: A hazardous event can occur over a short period of time or over an extended period of time.

3.15 hazardous situation - circumstance in which a person is exposed to at least one hazard.

Informative Note 1: The exposure can result in harm immediately or over a period of time.

Informative Note 2: A hazardous situation is also referred to as a task/hazard pair (combination).

3.16 hazard zone - any space within or around a machine in which a person can be exposed to a hazard. Also referred to as hazard area or hazard space.

3.17 hygiene taking of all measures during product handling, preparation and processing to ensure its suitability for use by humans or domestic animals

3.18 hygienic design A system of design that meets standards, specification, codes, regulatory and industrial guidelines, and acceptable engineering design methods to reach a degree of sanitization required by food, pharmaceutical, and cosmetics processing

Informative Note: For the purpose of this standard the terms hygienic design and sanitary design are considered synonymous.

3.19 industrial robot - an automatically controlled, reprogrammable multipurpose manipulator programmable in three or more axes which may be either fixed in place or mobile for use in industrial automation applications (see ANSI RIA R15.06).

3.20 in-running nip point - any location where a part of the body could be drawn in and injured, between a rotating machine member and another rotating or fixed member, or the material. Also known as in-going nip point.

3.21 installer - an individual, partnership or corporation responsible for placement and preparation for use of a machine.

Informative Note: Responsibility for installation of the machine usually depends on the terms of the purchase agreement.



3.22 integrator - an entity that designs, provides, manufactures or assembles a machine, its associated machines or equipment, the safeguarding, control interfaces, interconnections or the control system into a machinery system. See also, supplier; user.

Informative Note: Under certain circumstances (i.e., acting as a builder, modifier, integrator), the user is a supplier.

3.23 intended use (of a machine) - the use for which a machine is suited according to the information provided by the supplier or which is deemed usual according to its design, construction and function.

Informative Note: Intended use also involves compliance with the supplier’s instructions, which should take into account reasonably foreseeable misuse. The intended use may be determined by the user.

3.24 interlock - a safety device that connects a guard directly with either the control system or the power system of the machinery.

3.25 interlocked guard - a guard that can be opened or removed, with or without tools, that incorporates an interlock.

3.26 life cycle (of machinery) - the phases of a machine’s existence including:

design and construction; transport and commissioning, re-assembly, installation, initial adjustment, relocation; operation and maintenance (e.g., setting, teaching/programming, process changeover, cleaning, planned

or unplanned maintenance, trouble-shooting); de-commissioning, dismantling and, as far as safety is concerned, disposal.

Informative Note: See Clause 4.1

3.27 maintenance personnel - qualified persons who have been authorized by the user to inspect, maintain and repair processing and packaging machinery.

3.28 manufacturer - see supplier.

3.29 modification - change to the machine or machinery system that alters its original purpose, function, capacity, operation or safeguarding requirements.

3.30 monitoring - the checking of system components to detect a failure of a component, subassembly or module that affects machinery safety, including the safety-related functions.

3.31 operator - any qualified person whose duties include starting, stopping or supporting the normal operation of packaging, processing machinery or packaging related converting machinery.

3.32 packaging machinery - any machinery that is used to produce, decorate, identify, fill, weigh, inspect, close, or seal a container or package, or used to convey or coordinate the packaging functions, which take place in sequence on a production line.

3.33 packaging related converting machinery - any machinery that is used to prepare packaging materials with decoration or identity, or with coatings that imparts mechanical functions or protective characteristics.



3.34 person - an individual, corporation, partnership, or other legal entity or form of business operation.

3.35 personnel - individuals who are employed by or on behalf of the user or supplier.

Informative Note: Personnel include subcontractors, consultants, or other contract workers, under the direct or indirect control of the supplier or user.

3.36 primary (first) packaging - the first wrap or containment of a product (e.g., wrapped candy bar, a can containing liquid soup, a corrugated case containing a desk top printer, tablets in a bottle, vaccine in a vial, etc.).

3.37 processing machinery - any machinery that is used to convert raw material into finished form for the food, beverage or pharmaceutical industries. 3.38 qualified person - an individual who understands, is trained on, and demonstrates competence with the construction, operation or maintenance of the machinery and the hazards involved.

3.39 reasonably foreseeable misuse - the use of machinery in a way not intended by the supplier or user, but which may result from readily predictable human behavior such as:

the reflexive behavior of a person in the case of malfunction, incident, failure, etc., during the use of the machinery;

the behavior resulting from taking the “path of least resistance” in carrying out a task; the foreseeable behavior of certain persons (e.g., those who are either unauthorized or untrained).

3.40 rebuilder (reconstructor) - an entity who rebuilds or reconstructs a machine or machinery system. See also, rebuilding; supplier.

3.41 rebuilding / reconstruction - restoring the machine or the machinery system to its original or updated design, purpose, capacity and function. Also referred to as remanufacture or retool.

Informative Note: Rebuilding involves the restoration or replacement of major components of the machine or the machinery system and is not considered a maintenance or repair activity.

3.42 redundancy - the use of multiple independent means to perform the same function.

3.43 repair - to restore a machine by replacing a part or putting together that which is broken without altering its original purpose, function, capacity, operation or safeguarding requirements.

3.44 residual risk - risk remaining after risk reduction measures have been taken.

3.45 risk - the combination of the probability of occurrence of harm and the severity of that harm.

3.46 risk assessment - the entire effort of identifying hazards, assessing risk, reducing risk, and documenting the results (See Figure 4).



3.47 risk reduction - that part of the risk assessment process involving the elimination of hazards or selection of other appropriate risk reduction measures to reduce the probability of harm or its severity.

3.48 risk reduction measure (protective measure) - any action or means used to eliminate hazards or reduce risks.

Informative Note: Risk reduction measures can include but are not limited to: inherently safe design; guards; safeguarding devices; complementary equipment; awareness devices including warnings; safe work practices / procedures, training or other administrative controls, and personal protective equipment (PPE).

3.49 safe work procedure(s) - formal written instructions which describe how a task is to be performed.

3.50 safeguarding – the systematic process used to reduce risks, e.g., protection of personnel from hazards by the use of guards, safeguarding devices, awareness devices, safeguarding measures, or safe work procedures.

3.51 safeguarding device - a device that detects or prevents inadvertent access to a hazard.

Informative Note: This does not include personal protective equipment; (e.g., hand tools, safety glasses/goggles, face shields, safety shoes).

3.52 safeguarding measure - safeguarding by the physical arrangement of distance, restraining devices, openings, or positioning of the machinery to ensure that a hazard cannot be reached.

3.53 safety function - function of a machine whose failure can result in an immediate increase of the risk.

3.54 safety-related part of a control system (SRP/CS) - part of a control system that responds to safety-related input signals and generates safety related output signals.

Informative Note 1: The combined safety-related parts of a control system start at the point where the safety-related input signals are initiated (including, for example, the actuating cam and the roller of the position switch) and end at the output of the power control elements (including, for example, the main contacts of a contactor).

Informative Note 2: If monitoring systems are used for diagnostics, they are also considered as SRP/CS.

3.55 sanitization – the application of cumulative heat, chemicals, or other approved agents on clean surfaces that is sufficient to reduce the population of disease organisms by at least 99.999% (5 log reduction). B155 TR3

3.57 secondary (second) packaging - packaging of a product already in a primary package (e.g., case of soup cans, carton of 10 candy bars, bottled tablets / vial in a carton, etc.).

3.58 set-up - the process of changing over or adjusting the machine work holding devices, tooling and safeguarding including verifying the initial part quality, running test parts and ensuring proper and safe operation of the machine or machinery system.

3.59 supervisor - an individual authorized to act on behalf of the user and to direct the activities of other personnel.

3.60 supplier - an individual, corporation, partnership or other legal entity or form of business who provides equipment or services. A supplier can be any of the following; the manufacturer; manufacturer’s agent, representative or distributor,



reseller, installer, modifier, rebuilder or integrator. When the user provides any of the above equipment or services, the user is considered a supplier.

3.61 task - any specific activity that is done with, on or around the machine during its lifecycle.

3.62 tertiary (third) packaging - packaging of a product already in a secondary package (e.g., stretch wrap pallet of cases of soup cans, a corrugated case filled with 24 cartons of candy bars, cartons of vials placed in a case).

3.63 tolerable risk - see acceptable risk.

3.64 two-hand control - an actuating control or device that requires the concurrent use of the operator’s hands to initiate or control the machine during the machine cycle. See ANSI B11.19.

Informative Note: When a two-hand control is utilized as a safeguarding device, it has additional requirements.

3.65 unexpected start - any start-up which, because of its unexpected nature, generates a risk to persons.

Informative Note: Machine start-up during normal sequence of an automatic cycle is not unintended, but can be considered to be unexpected from the point of view of the operator.

3.66 user - an individual, corporation, partnership or other legal entity or form of business that utilizes a machine, machine production system or related equipment.

Informative Note: Under certain circumstances (i.e., acting as a builder, modifier or integrator), the user is a supplier.

3.67 validation - the assurance that a machine, system or process meets the needs of the end-user and other identified stakeholders.

Informative Note 1: Validation can include but is not limited to: testing and verifying operation of safety devices and circuits, review of training, presence of warning labels, presence of lockout procedures and safe job procedures, and functioning of complementary equipment.

Informative Note 2: Validation can involve answering two questions:

1. Are we doing the right things? 2. Are we doing things right?

Informative Note 3: “Validate” as used in this standard means to check and test, to confirm and document, but does not imply formal validation as used in the pharmaceutical industry

3.68 verification – The evaluation re-evaluation of whether or not a machine, system or process complies with a regulation, requirement, specification or imposed condition. It is often an internal process.

Informative Note: Verification is intended to check that a machine, system or process meets a set of design specifications initially and throughout the lifecycle of a machine, system or process.

4 Responsibilities

4.1 General Machinery suppliers and users have responsibilities for defining and achieving acceptable risk. The supplier and the user either separately or jointly shall identify hazards, assess risks and reduce risks to an acceptable level within the scope of their respective work activities as described in this standard. Although the responsibilities of the supplier and the user differ over the life cycle of the machinery, each uses the same risk assessment process (see clause 6).



Informative Note 1: In general, the machinery supplier is responsible for the design, construction and information for operation and maintenance of the machinery, while the user is responsible for the operation and maintenance of the machinery. Responsibility for installation and information for installation of the machinery usually depends on the terms of the purchase agreement.

Informative Note 2: The machinery lifecycle progression from concept through decommissioning is shown in Figure 2.

Figure 2 – Machinery and equipment lifecycle stages

Suppliers and users shall involve qualified persons in meeting their respective responsibilities.

The supplier and user shall use the related codes and standards applicable to their work activity.

Informative Note 1: This may include regulations and standards for a specific location and/or for a specific application.

Informative Note 2: Figure 3 presents a general overview of the lifecycle responsibilities for machinery. This figure is only illustrative and is not prescriptive. The risk assessment process is not a single event that occurs separate from the machinery development. Risk assessment should begin early in the concept design and be updated and validated as the design matures.

Informative Note 3: Figure 3 illustrates that in some instances suppliers and users interact during the development of an application as implied by the dashed line between the ovals. In an off-the-shelf purchase of a machine, there is often very little interaction between the supplier and user. In turn-key situations the interaction can be extensive. Figure 3 illustrates only the situation where some interaction occurs.

2 3 4 5 6

DesignConcept Preliminary

DesignDetailed Design

Build or Purchase

Commission ProductionMaintenance

Decommission2 3 4 5 6

1 7

Machinery and Equipment Lifecycle Stages



Figure 3- Example Machinery Life Cycle Responsibilities Informative Note: “Validate” as used in Figure 3 means re-evaluate and confirm, but does not imply formal validation as used in the pharmaceutical industry.

User Supplier

Preliminary risk assessment

Preliminary risk assessment

Potential Collaboration

Concept – Design of Machine

Concept – Design of Workplace


Design of Workplace Detailed risk assessment

Design of Machine Detailed risk assessment


Build / Integrate Risk assessment

Build - Risk Assessment


Installation assistance Install / commissioning Validate risk assessment

Training

Retrofit Target Risk assessment

Rework

Decommission Risk assessment

Run Operate maintain Ongoing risk assessment



4.2 Collaborative efforts Suppliers and users should collaborate to attain the goal of acceptable risk through the risk assessment process. Effective communication between supplier(s) and user(s) is recommended where possible, but the success of the risk assessment process is not dependent on this relationship.

When the supplier does not attain acceptable risk, the supplier shall advise the user of that determination and the user shall apply additional risk reduction measures. Responsibility for additional risk reduction that is transferred from the supplier to the user shall be documented and communicated by identifying hazards or associated tasks – see clause 8.

Informative Note: For example, if risks from hazards are not adequately reduced during the engineering design of a machine, the machinery user should evaluate residual risks to determine if further risk reduction is required or that the risk is acceptable. Residual risk may require the user of the system or process to implement further risk reduction measures based on the use of the machine.

When the supplier is not available to participate in the risk assessment for the machinery, the user assumes this responsibility.

The supplier shall advise the user of the residual risk that may exist at the conclusion of its risk assessment and risk reduction. The user shall then apply additional risk reduction measures as determined by its risk assessment. Risk that is transferred between the supplier and user shall be documented and communicated by identifying tasks and their associated hazards – see clause 8 and Annex G.

Informative Note: Suppliers and users should collaborate on the risk assessment process, to attain the goal of acceptable risk. Effective communication between suppliers and users is recommended where possible.

4.3 Responsibilities of the component supplier, machine supplier and the machine user The component supplier, machine supplier and the machine user shall be responsible for achieving acceptable risk within the scope of their work activity.

Informative Note 1: In general the component supplier is responsible for the component it supplies, but not for how the component is integrated in a machine or how it is used / maintained.

Informative Note 2: In general, the machine supplier is responsible for the machine it supplies and for the integration of the component parts it selects, but not for the components themselves or for how the machine is used.

Informative Note 3: In general, the machine user is responsible for how the machine is operated and maintained, but not for the design or construction of the machine or the components.

Informative Note 4: If more than one entity is involved in the design, construction, integration or installation of the machine, each entity is responsible for the scope of its work activity.

4.4 Responsibilities of the component user / machine supplier

4.4.1 Integration

The machine supplier shall determine what risk reduction measures, if any, are required to achieve acceptable risk with any components it integrates into the machine.

Informative Note: Particular attention should be paid to instances where safeguards are removed from individual components in order to achieve the desired integration.

4.4.2 Documentation

The machine supplier shall obtain documentation from the component supplier as required for the component(s), including installation requirements, operating instructions, and maintenance requirements.

Informative Note 1: The documentation should include the following, where applicable:



performance specifications; electrical or fluid power schematics and diagrams; physical environment for which the component was designed; function and location of the operator controls, indicators, and displays; schedules for periodic maintenance, lubrication and inspection; signs and warnings.

Informative Note 2: See also, ANSI Z535.6 for additional guidance.

The component part supplier shall furnish documentation as required for the safeguarding, including installation requirements, operating instructions, and maintenance requirements.

Informative Note 3: The documentation should include the following, where applicable: performance specifications; electrical or fluid power schematics and diagrams; physical environment for which the device was designed; function and location of the operator controls, indicators, and displays; schedules for periodic maintenance, lubrication and inspection; signs and warnings.

Informative Note 4: See also, ANSI Z535.6 for additional guidance.

4.4.3 Safeguarding When safeguarding is supplied with the component, the component user / machine supplier shall be responsible for ensuring that it is integrated, and installed in accordance with the requirements of this standard.

Informative Note: The component user / machine supplier should consider the component supplier’s performance specifications, schematics, and diagrams, operating and maintenance instructions and warnings when installing, operating, and maintaining the component.

When components are ordered/purchased without safeguards, the component user / machine supplier shall provide safeguarding based on a risk assessment and as determined by this standard and any applicable base B11 standard.

4.5 Qualified persons Suppliers and users shall involve qualified persons/subject matter experts in meeting the requirements of this standard. Qualified persons shall be knowledgeable in the applicable standards and codes for the specific application and location of the installation.

Informative Note: Although an individual may be responsible for coordinating the analysis, a team of contributors (e.g.,

operators, maintenance or engineering personnel) should participate in the risk assessment and reduction effort(s).

4.6 Specifications The user shall communicate its specific safety requirements as part of the machinery purchase. The supplier and user shall develop an agreed upon set of specifications suited to the location and application specifics of the machinery.

Informative Note 1: Users should inform the machine supplier if the material to be processed can create an explosive, combustible or hazardous atmosphere or products, or if the machine will be operated in a hazardous (classified) location. See clause 2 and Bibliography for additional information.

Informative Note 2: Users should inform the machine supplier of hygienic design requirements. See ANSI/PMMI B155TR3 and ISO 14159.

4.7 Design, construction and information for operation and maintenance

The supplier shall use the risk assessment process in designing, constructing and developing the information for operation and maintenance of the machinery.



4.8 Installation, commissioning and start-up Within the scope of their respective work activities, the user and supplier shall ensure that the risks associated with the installation, commissioning and start-up of the machinery are reduced to an acceptable level.

The installation, commissioning and start-up shall be accomplished in accordance with, but not limited to, the following: supplier instructions; appropriate regulatory standards (e.g., 21 CFR 1910.147 Control of Hazardous Energy), accepted industry practices as detailed in applicable standards; user installation instructions.

The user shall verify all safety functions of the machinery during commissioning.

4.9 Safeguarding The supplier shall provide risk reduction measure(s) as determined in the supplier risk assessment. The user shall ensure that additional risk reduction measure(s) are provided and installed as determined in the user risk assessment. The user shall ensure that risk reduction measure(s) are properly used, maintained and functional.

4.10 Operation and maintenance The user shall ensure that the risk level is maintained at an acceptable level during the operation and maintenance of the machinery. The user shall operate and maintain the machinery within the established operating limits and consistent with the supplier instructions for operation and maintenance, except as provided in the 3rd paragraph of sub clause 4.10.

Informative Note: Operation includes, but is not limited to activities such as startup, shutdown, clearance, unexpected fault (power outage, shutdown under load)

The user shall establish and follow a program of periodic and regular inspection and maintenance to ensure that all parts, auxiliary machinery, and safeguards are in a safe operating condition, adjusted and repaired in accordance with the supplier instructions for operation and maintenance except as provided in the 3rd paragraph of sub clause 4.10.

If the user deviates from the supplier instructions for operation and maintenance or the established operating limits, the user should consult with the supplier or component supplier(s) and shall use the risk assessment process to maintain risk at an acceptable level.

4.11 Training of user personnel The user shall ensure that personnel who work on, with or around machinery are trained in the proper installation, adjustment, operation and maintenance of the machinery. The training should follow the supplier’s information for operation and maintenance. If the user deviates from the supplier’s information, the user shall use the risk assessment process to provide the training needed to maintain risk at an acceptable level. The user shall ensure that safe work methods are being used throughout the machine lifecycle.

Different levels of training (basic, intermediate, advanced) may be required based on different tasks (installation, adjustment, operation and maintenance) and different levels of risk. Training effectiveness shall be verified in order to ensure that the risk reduction effect of the training is maintained.

The training shall be documented. See clause 9 for additional information. Informative Note 1: The training should be consistent with the supplier’s information for use. Informative Note 2: Different levels of training can be required based on tasks (installation, adjustment, operation and maintenance) and levels of risk.

4.12 Cleaning and sanitization The user shall ensure that the risk is maintained at an acceptable level during the cleaning or sanitization of the packaging machinery. Except as provided in this sub clause, the user shall clean or sanitize the machinery in accordance with the established procedures and supplier information for operation, maintenance and hygiene.

If the equipment requires some level of hygienic design, the user shall establish the appropriate hygienic zone and cleaning method.



Informative Note: Examples include but are not limited to: radius corners rather than sharp joints; no level surfaces to avoid pooling of fluids; opening or removal of guards to improve access; slip resistant walking/working surfaces; etc.

Informative Note: Refer to Annex A B155TR3 - Figure 4

The user shall establish and follow a program of periodic and regular cleaning or sanitizing to ensure that all parts, auxiliary machinery and safeguards are in a safe operating condition and except as provided below, in accordance with the supplier information for operation and maintenance.

If the user deviates from the supplier information for operation and maintenance or the established cleaning or sanitizing procedures, the user shall use the risk assessment process to maintain risks at an acceptable level.

4.13 Operational working space The user shall provide and maintain sufficient access and working space about the machinery to permit safe operation and maintenance of such machinery.

4.14 Existing (legacy) equipment When evaluating existing machinery, the risk assessment process shall include but not be limited to the following:

experience in the field; history of past incidents; similar machines and processes; reports of near misses; number of machines in the field; lifespan of the equipment; new information regarding hazards; internal safety audits or regulatory visits.

Informative Note: The supplier and/or user should decide when and what existing machinery should be evaluated..

4.15 Modifying or rebuilding machinery A modifier or rebuilder of machinery shall use the risk assessment process to ensure that risks are reduced to an acceptable level. See also the definition of “supplier.”

When non-standard uses or modifications of the machine, machine control system or the risk reduction measures can create additional hazards, a modifier and/or rebuilder of machinery shall use the risk assessment process to ensure that risks are reduced to an acceptable level.

Modifiers and/or rebuilders shall, where practicable, solicit the original supplier’s recommendations regarding any proposed modification to a machine that may affect the safe operation prior to making any such changes.

Where modifications are made to the machine/system (e.g., intended use, tasks, hardware, and software), a risk assessment shall be repeated for those parts of the machine/system being modified or affected.

The user shall ensure that acceptable risk is maintained after modifying and/or rebuilding is complete, and maintain updated risk assessment documentation for both historical purpose as well as future use for potential additional modifications to the machine (see 6.9.1 and 6.9.2).

4.16 Suppliers of used machinery A supplier of used machinery shall fulfill the requirements of a supplier as defined in this standard. See also the definition of “supplier.”

4.17 Decommissioning and other life cycle activities Within the scope of their respective work activities, the supplier and user shall ensure that the risk is maintained at an acceptable level during other life cycle activities of the machinery.

The supplier shall consider decommissioning during the design of the machinery and provide information on known hazardous components regarding dismantling and disposal of machinery.



4.18 Personnel responsibility Personnel shall not circumvent, remove or otherwise disable an existing safeguard or device required on the machine without alternate risk reduction measures as identified in the risk assessment. The user shall ensure that appropriate policies, procedures, training, and instructions are in place in order to reduce risk to personnel to an acceptable level.

Personnel shall not wear clothing, jewelry, or unrestrained hair styles that will be hazardous to personal safety.

The user shall ensure that appropriate policies, procedures, and instructions are in place in order to minimize risk to personnel.

5 Requirements for Design, Construction, Reconstruction, Modification, Installation, Operation and Maintenance Of Machinery

5.1 General Risks associated with the use, operation and maintenance of machinery shall be reduced to an acceptable level.

5.2 Supplier To meet the requirements of 5.1, machinery suppliers shall use a risk assessment process such as described in clause 6 in the design, construction, reconstruction and modification of machinery to meet the specific requirements of clause 7.

Informative Note: A Collaborative process, between the user and supplier, should be employed to determine the hygienic design requirements and should be based on the supplier’s risk assessment. See Annex A, ISO14159, and ANSI/PMMI B155TR3.

5.3 User To meet the requirements of 5.1, machinery users shall use a risk assessment process such as described in clause 6 in the operation, maintenance and hygiene/sanitization of machinery to meet the specific requirements of clause 7.

5.4 Installation To meet the requirements of 5.1, machinery users and suppliers shall, jointly, separately or contractually, use a risk assessment process such as described in clause 6 in the installation, commissioning and start-up of machinery to meet the specific requirements of clause 7.

5.5 Integrator / modifier / rebuilder An integrator, modifier or rebuilder of machinery shall meet the requirements of 5.2. See the definition of supplier in clause 3.

6 The Risk Assessment Process

6.1 General This clause presents the basic process for conducting a risk assessment and illustrates its implementation using (one of many) available methods for implementing that process. The presentation style mixes both informative and explanatory text with normative requirements and was chosen to enhance the readability of the information.

This standard also provides other examples of risk assessment methods that can be adopted by large or small organizations. Flexibility (scalability) can be built into the process so it fits into a particular organization and its culture, whether the organization conducting the risk assessment is a supplier (modifier, rebuilder etc.) or user. Variables related to scalability may include but are not limited to:

size / complexity of the project; conducted on-location vs. off-site; formal (multi-discipline) vs. informal; cultural norms potential hazards related to product contamination.



6.1.1 Fundamentals

The risk assessment process is a series of logical steps to systematically examine the hazards associated with machinery. The fundamentals of the risk assessment process include:

identify hazards; assess risk; reduce risk to an acceptable level; and validate and document the results.

Informative Note 1: The risk assessment process starts with assuming no safeguarding measures are in place.

Application-specific risk assessments for machinery shall include the fundamental steps in the overall risk assessment process as shown in Figure 4.

Informative Note 2: “Application-specific” refers to the particular process, hygienic design requirements, use, installation or integration of the machinery. See also Figure 2 in Annex A.

6.1.2 Goal The goal of risk assessment is to reduce risks to acceptable level(s). The risk assessment process is not completed until acceptable risk is achieved. Clauses 6.2 through 6.9 present a process of assessing risk in a step-by-step approach to assist in achieving this goal.

Informative Note 1: Iterations of the risk assessment process may be required over time. Acceptable risk is achieved by implementing the risk reduction measures as defined during the risk assessment process.

Informative Note 2: Obtaining management support can be a critical factor in achieving acceptable risk decisions.

6.1.3 Risk assessment methods There are a number of methods available to conduct a risk assessment and many companies and industries use different risk assessment methods. One acceptable method appears in 6.1.4. Any other method that includes the fundamentals of 6.1.1 and prescribes risk reduction measures equivalent to, or more stringent than, the requirements of this standard is acceptable.

6.1.4 Basics steps of the risk assessment process This clause lists the seven basic steps in the overall risk assessment process as shown in Figure 4.

1. Prepare for/set limits of the assessment (see 6.2) 2. Identify tasks and hazards (see 6.3) 3. Assess initial risk (see 6.4) 4. Reduce risk (see 6.5) 5. Assess residual risk (see 6.6) 6. Achieve acceptable risk (see 6.7) 7. Validate risk reduction measures (see 6.8) 8. Document the results (see 6.9)

Informative Note 3: For more detailed information on the risk assessment process for machines with hygienic considerations, see the process flow chart in Annex A.



Figure 4 - The Risk Assessment Process

6.2 Prepare for/set limits of the assessment Suppliers and users either jointly or separately shall adequately prepare for, set limits on and document the parameters of the assessment, and establish the level(s) of acceptable risk.

There are no strict requirements on preparations or setting limits. Annex B provides guidance on preparations and setting limits.

6.3 Identify hazards The reasonably foreseeable hazards shall be identified for the applicable phases of the life cycle of the machinery. See Annex C for a list of hazards potentially applicable to machinery.



Identifying hazards is a critically important part of the risk assessment process because hazards not identified can result in unacceptable risks. There are many different approaches to identifying hazards. Depending on the complexity of the machinery, some or all of the following may be useful:

use intuitive operational and engineering judgment; examine system specifications and expectations; review codes, regulations, and consensus standards; interview current or intended system users or operators; consult checklists; review studies from other similar systems; consider the potential for unwanted energy releases and exposures to hazardous environments; review historical data – industry experience, incident investigation reports, OSHA and National Safety

Council data, manufacturer’s literature; brainstorm.

Informative Note: The risk assessment process includes identifying hazards regardless of the existence of risk reduction measures. The machine should not be considered harmless as shipped and guarded. To assure that all hazards are included, hazard identification should be conducted with all safeguards conceptually removed. This is to assure that hazards are not ignored due to an assumption that the safeguard supplied is adequate for all tasks, including reasonably foreseeable misuse. Existing safeguards that help meet the risk reduction objectives can be retained after evaluating their performance. This decision will be confirmed during the validation/verification portion of the risk assessment (see clause 6.8). If a thorough risk assessment is delivered with the machine it may be used as a starting point for the user’s risk assessment.

Identifying hazards shall take into account the different operating modes and intervention procedures, in particular when the machinery does not perform the intended function (i.e. it malfunctions) due to a variety of reasons, such as:

variation of a property or of a dimension of the processed material or of the product; failure of one (or more) of its component parts or services; external disturbances (e.g., shocks, vibration, electromagnetic interference); interruption of its power source.

Sub clauses 6.3.1 and 6.3.2 present methods that can be used separately or in combination to identify hazards. Regardless of the method used, the purpose is to ensure that reasonably foreseeable hazards are identified.

6.3.1 Hazard-based A hazard-based approach identifies the hazards associated with the machinery, its functions, and its immediate surroundings. A hazard-based approach identifies hazards such as mechanical hazards, energy sources, unexpected start, slip and fall, hot surfaces, operational hazards, contamination, etc.

6.3.2 Task-based A task-based approach identifies the affected persons, the tasks they perform, and the hazards associated with those tasks (see 6.3.2.1 – 6.3.2.2). This method focuses on how people interact with the machine to identify how they could be harmed.

6.3.2.1 Identify affected persons In a task-based approach, persons who interact with the machinery should be identified. These may include but are not limited to:

cleaning crew; contract/service personnel; technical personnel; installation and removal personnel; supervisor; maintenance personnel; materials handler; operator;



passer-by/non-user; set-up person

Informative Note: The anticipated level of training, experience, skill of the persons, and their capacity to be aware of risks in a given situation may need to be considered (e.g., a novice operator may perform tasks differently than an experienced person).

6.3.2.2 Identify tasks In a task-based approach, tasks associated with the intended use and reasonably foreseeable misuse of the machinery should be identified. This includes the incentive to defeat or circumvent risk reduction measures. Examples of task categories include but are not limited to:

packing and transportation; unloading/unpacking; systems installation and assembly; start up/commissioning; set up/changeover; operation (all modes); maintenance/repair; recovery from jams; troubleshooting; assembly/disassembly; cleaning/sanitizing; decommissioning, dismantling, and disposal.

Identifying tasks shall include modes of operation and work methods during which it is necessary to suspend or modify one or more risk reduction measures.

Reasonably foreseeable hazards that are not related to tasks shall also be identified. Examples include an explosive environment, noise, instability, equipment failures or operational errors such as using an inappropriately sized workpiece, mechanical failure of a chuck, operating at incorrect speed, etc. Some hazards may impose risk beyond a simple contact point; for instance, gaseous exposure, electrical discharge, explosion or fire.

Information from risk assessments on similar machines may be used as a starting point when tasks and hazards are comparable. Using this information does not eliminate the need to follow the risk assessment process as described in this standard for the specific conditions of use (e.g., when a shear used for cutting plastic is compared with a shear used for cutting metal, the risks associated with the different material should be assessed).

6.4 Assess initial risk The risks associated with each hazard shall be assessed. The elements of risk are shown in Figure 6. Additional information appears in Annex C.

Figure 6 - Elements of risk

There are three sub-steps involved in assessing risk:

Select a risk scoring system (6.4.1); Assess risk using the risk factors of the risk scoring system (6.4.2); Derive risk level (6.4.3).

Risk Related to the

considered hazard

Severity of harmThat can result from the

considered hazard

Probability of Occurrence

of that harm is a function of and



6.4.1 Select a risk scoring system Risks shall be assessed using a risk scoring system. A risk scoring system is simply the qualitative or quantitative factors used to assess risk and how these factors combine to obtain a risk level. The risk factors typically considered are the severity of harm and the probability of occurrence of that harm.

Informative Note 1: In selecting a risk scoring system one of the following may be used: one developed for the industry application; one that best suits the safety / health objectives of the organization; one published by an industry, trade organization in the technical literature; one specified by the customer.

Informative Note 2: An example of a two-factor risk scoring system using severity and probability is shown in Table 1. Other risk scoring systems may be used (see Annex E).

Table 1 – Example Risk Scoring System (from ANSI B11.0)

Severity of harm Catastrophic Serious Moderate Minor

Probability of occurrence of harm

Very Likely High High High MediumLikely High High Medium Low

Unlikely Medium Medium Low NegligibleRemote Low Low Negligible Negligible

6.4.2 Assess risk The risks shall be assessed for each hazard or task/hazard pair using the selected risk scoring system.

Assessing risk should occur both before and after risk reduction measures are implemented (see 6.6). These risk levels are referred to as the initial risk level and the residual risk level, respectively.

Informative Note: Risk assessment relies on subjective decisions. These decisions should be supported by qualitative methods complemented, as far as practicable, by quantitative methods. Quantitative methods are particularly appropriate when useful data are available. In most applications only qualitative risk assessment will be possible.

As an example, sub clause 6.4.2.1 – 6.4.2.3 explain the risk scoring system from Table 1.

6.4.2.1 Assess severity For each hazard or task/hazard pair, the severity of harm or consequences that could result shall be assessed. Severity of harm addresses the degree of injury or illness that could occur.

The severity of harm resulting from exposure to a hazard as used in Table 1 includes:

Catastrophic – death or permanently disabling injury or illness (unable to return to work); Serious – severe debilitating injury or illness (able to return to work at some point); Moderate – significant injury or illness requiring more than first aid (able to return to same job); Minor – no injury or slight injury requiring no more than first aid (little or no lost work time).

Informative Note 1: When estimating severity the highest credible level of severity (and its corresponding probability) should be selected.

Severity may be semi-quantitatively estimated by correlating measurable energy to a resulting degree of harm that may occur.

Informative Note 2: Events with consequences that have wide-spread impacts or effects may require more specialized risk assessments.

6.4.2.2 Assess probability For each hazard or task/hazard pair, the probability of occurrence of harm shall be assessed.



Occurrence probability is estimated taking into account the frequency, duration and extent of exposure, speed of occurrence, human errors, training and awareness, and the characteristics of the hazard.

The probability of harm occurring used in Table 1 includes: Very likely – near certain to occur; Likely – may occur; Unlikely – not likely to occur; Remote – so unlikely as to be near zero.

Informative Note 1: Predicting the probability of an incident occurring is difficult. Unless empirical data are available, the process of selecting the probability of an incident occurring will be subjective.

Informative Note 2: When estimating probability, the highest credible level of probability (and its corresponding severity) should be selected.

Specialized training alone shall not be used as a means of reducing the probability of a hazardous event if it cannot be assured that all individuals exposed to the hazard will have that level of training/knowledge (see clause 6.5).

6.4.2.3 Derive risk level For each hazard or task/hazard pair, an initial risk level shall be derived using the risk scoring system. Once the initial risk is estimated, the risk level can be compared to acceptability levels. If the risk is not acceptable, the next step is to reduce the risk.

6.5 Reduce risk If the level of risk is not acceptable, risk reduction measures shall be implemented to reduce that risk (see clause 7 for specific risk reduction methods). Risk reduction measures shall be selected to provide the desired degree of risk reduction.

Risk reduction measures are a combination of the measures taken by the supplier or the user. Measures which can be incorporated at the design stage are preferable to, and generally more effective than, those which are implemented by the user.

Risks shall be reduced using the hazard control hierarchy described in 6.5.1, and applied as described in 6.5.2 and 6.5.3.



6.5.1 Use the hazard control hierarchy In selecting the most appropriate risk reduction measure, apply the following principles in the order that they appear in Table 2.

Table 2 - The Hazard Control Hierarchy

Risk reduction

measure Examples Influence on Risk Factors Classification

Most Preferred

Least Preferred

Elimination

or

Substitution

Eliminate pinch points

(increase clearance) Intrinsically safe

(energy containment) Automated material

handling (robots, conveyors, etc.)

Redesign the process to eliminate or reduce human interaction

Reduced energy Substitute less

hazardous chemicals

Impact on overall risk

(elimination) by affecting severity and probability of harm

May affect severity of harm, frequency of exposure to the hazard under consideration, or the possibility of avoiding or limiting harm depending on which method of substitution is applied.

Design Out

Guards and Safeguarding

Devices

Barriers Interlocks Presence sensing

devices (light curtains, safety mats, area scanners, etc.)

Two hand control and two hand trip devices

Greatest impact on the probability of harm (Occurrence of hazardous events under certain circumstance)

Minimal impact on severity of harm

Engineering Controls

Awareness Devices

Lights, beacons, and strobes

Computer warnings Signs and labels Beepers, horns, and

sirens

Potential impact on the probability of harm (avoidance)

No impact on severity of harm

Administrative Controls

Training and Procedures

Safe work procedures

Safety equipment inspections

Training Lockout / Tagout /

Tryout

Potential impact on the probability of harm (avoidance or exposure)

No impact on severity of harm

Personal Protective Equipment

(PPE)

Safety glasses and face shields

Ear plugs Gloves Protective footwear Respirators

Potential impact on the probability of harm (avoidance)

Some impact on severity of harm



6.5.1.1 Eliminate or reduce risk by design Where practicable, hazards shall be eliminated by design. Eliminating the hazard or reducing the risk by design provides the highest degree of risk reduction.

Informative Note 1: Example methods to eliminate or reduce hazards by design include: eliminate dangerous parts, conditions and events; substitute less hazardous materials and substances (e.g., toxicity); modify physical features (e.g., sharp edges, shear points); reduce or dissipate energy; alter task or process reduce the frequency of the task or hazard; eliminate areas that can trap particles

Informative Note 2: see Annex G, H, I, and Annex X.

6.5.1.2 Guards and safeguarding devices Where practical, guards and safeguarding devices should be provided to safeguard dangerous parts and conditions that cannot practically be eliminated. See ANSI B11.19 for additional details on guards and safeguarding devices.

Informative Note: Where hazards cannot be eliminated, guards and safeguarding devices and administrative controls are usually used together to reduce risk to an acceptable level.

6.5.1.3 Awareness devices Awareness devices should be used where appropriate to inform affected personnel of hazards and residual risks that have not been eliminated by design or protected by guards or safeguarding devices. Awareness devices include signs, lights, alarms, awareness barriers and other devices. Visual signals, such as flashing lights, and audible signals such as a horn may be used to warn of an impending hazardous event such as machinery start-up or over speed. Such signals may also be used to warn the operator before initiating automatic risk reduction measures.

Informative Note – an example would be to push and hold a start button for 4 seconds while horn sounds before machine start.

These signals, if used, shall be: emitted before the occurrence of the hazardous event; unambiguous; clearly perceived and differentiated from all other signals used; clearly recognized by the operator and other persons.

6.5.1.4 Training and procedures Training and procedures shall be used in conjunction with existing guards, safeguarding and awareness devices. Training and procedures shall be used to explain:

the potential hazards the purpose and function of safeguards safe work procedures to avoid hazards

The machine supplier shall inform the user of specialized procedures and training necessary for using the machine. See clause 8 and clause 9

Informative Note: Procedures and training may include, but are not limited to: formal or informal training, standard operating procedures, checklists, and personnel certifications. Implementing procedures and training involves:

information for operation and maintenance (e.g., instruction manual(s), signage); safe work practices and other administrative controls; training (e.g., periodic, hands–on, certification); supervision (e.g., close, qualified).



6.5.1.5 Personal protective equipment PPE shall be used in conjunction with other risk reduction measures or when no other control method is available or feasible. Personal protective equipment (PPE) includes safety glasses, hearing protection, gloves, non-slip footwear, etc.

6.5.2 Select practical risk reduction measures Suppliers and users shall select practical risk reduction measures to reduce risk to an acceptable level.

Informative Note: Not all potential risk reduction measures are practical. Many factors determine if the risk reduction measures are practical. It is necessary to evaluate the application of the risk reduction measures against the following factors:

effectiveness; durability and maintainability; ergonomic impact; introduction of new hazards; productivity/machinery performance; technological feasibility; usability; cost; ability to clean or sanitize.

6.5.3 Check for new hazards Suppliers and users shall determine if risk reduction measures introduce new hazards, and if so, reduce those risks to an acceptable level.

New task/hazard combinations introduced during the risk reduction process are to be assessed by repeating the risk assessment process for the task/hazard combinations being evaluated.

6.6 Assess residual risk Once practical risk reduction methods have been selected, the residual risk shall be assessed as shown in Figure 4 and discussed in 6.4.

In assessing the residual risk, the risk factors are estimated assuming that the selected risk reduction measures are in place. The residual risk should be assessed to validate that the selected measures effectively reduce the risk.

Severity and probability are assessed and combined to obtain a residual risk level using the selected risk scoring system.

The incentive to defeat or circumvent risk reduction measures shall be considered when assessing residual risk. Incentive to defeat or circumvent risk reduction measures depends on both the circumstances considered and the design details of the risk reduction measure(s).

Incentives to defeat or circumvent a risk reduction measure may include but are not limited to: the risk reduction measure prevents the task from being performed; the task was not identified and assessed for hazards and risks; the risk reduction measure slows down production or interferes with any other activities or preferences of

the user; the risk reduction measure is difficult to use; personnel other than the intended operator(s) are needed to perform the task:

operator resets safeguard while maintenance is inside the hazard area; safeguards intended to protect an individual are inappropriately used for multiple personnel;

the risk reduction measure or its associated hazard is not recognized as such by personnel; the risk reduction measure is not accepted as suitable, necessary or appropriate for its function.

The use of programmable systems introduces an additional possibility to defeat or circumvent provisions for access to programmable systems if not properly applied or supervised. This is particularly important when remote access for



diagnostic or process correction purposes is required. The organizational culture towards safety has bearing on the tendency to defeat or circumvent risk reduction measures.

6.7 Achieve acceptable risk Once the residual risk is known for each hazard, a decision shall be made to accept or further reduce the residual risk.

Risk reduction is complete when risk reduction measures are applied and acceptable risk has been achieved for the identified hazards.

Informative Note 1: In all machinery applications some level of residual risk exists.

Achieving acceptable risk will depend on:

the application of the hierarchy of controls (6.5.1.1 through 6.5.1.6); the feasibility of the selected risk reduction measure(s).

Informative Note 2: Risk assessment should facilitate a consistent decision making process. Qualified personnel are particularly important in decision making about acceptable risk.

Informative Note 3: Acceptable risk is fundamentally a decision made by each supplier or user in the context of their own unique circumstances. The following structure (from ANSI B11.0 (B11.TR3)) is one example of a practical application of acceptable residual risk to relevant stakeholders:

High risk – only acceptable when all reasonable alternatives/options (risk reduction measures) have been reviewed and formally deemed impracticable or infeasible. It is recommended that the group performing the risk assessment seek advice from additional safety or subject matter experts.

Medium – undesirable and permissible only when all reasonable alternatives/options (risk reduction measures) have been formally deemed infeasible.

Low – usually acceptable. Negligible – acceptable.

6.8 Validate risk reduction measures After the risk reduction measures have been implemented, their effectiveness shall be validated. Validation can include but is not limited to: testing and verifying operation of safety devices and circuits, review of training, presence of warning labels, presence of lockout procedures and safe job procedures, and functioning of complementary equipment.

Testing of the safeguarding means shall not expose an individual to potential harm should the safeguard not provide the protection expected.

Informative Note: For additional information about the process of validation, see IEC 61508, IEC 62061, and ISO 13849-2.

6.9 Document the results

6.9.1 Content The outcome of a risk assessment shall be documented. The documentation shall demonstrate the procedure that has been followed, the hazards identified, and the risk reduction methods employed to reduce risks to an acceptable level.

Informative Note: The risk assessment documentation is not the same as Information for Operation and Maintenance (e.g., manuals, see clause 8). The risk assessment documentation should be used to help create the Information for operation and maintenance.

Supplier and user documentation of the risk assessment should include: the machinery for which the assessment has been made (e.g. manufacturer, model, specifications, limits,

intended use), (see 6.2); any relevant assumptions which have been made (e.g., loads, strengths, safety [design] factors); the information on which the risk assessment was based (see 6.2);



names of the members of the risk assessment team; date of the risk assessment; the tasks and hazards identified (see 6.3); initial risks associated with the machinery (see 6.4); the risk reduction measures implemented to eliminate identified hazards or to reduce risk (e.g., from

standards or other specifications) (see 6.5); residual risks associated with the machinery (see 6.6). the validation of risk reduction measures (see 6.8).

An example risk assessment documentation is shown in Annex F.

In addition to the above, the supplier documentation shall include recommendations for additional risk reduction measures to be implemented by the user, system integrator or other entity involved in machine utilization.

6.9.2 Document retention The risk assessment documentation shall be retained as required by government regulations, for the life of the machinery, or as provided by an organization’s document retention policy.

7 Specific Risk Reduction Methods

This clause identifies specific risk reduction methods for machinery and machinery systems to help achieve acceptable risk. Not all methods will apply to a particular machine. These risk reduction methods should be used as part of the risk assessment process. Conformance with these methods will generally yield acceptable risk. However, achieving acceptable risk should be verified for each application using the risk assessment process. Deviations from the risk reduction requirements of this section shall be based on a documented risk assessment demonstrating acceptable risk. In this clause, normative requirements are interspersed with informative and explanatory text.

7.1 Access to machinery Machinery shall be designed, constructed and used to allow access to the machine in order to enable all tasks to be carried out with acceptable risk. Where personnel are required to enter the machine, one or more means of protection shall be provided.

7.2 Control systems performing a safety function Some risk reduction measures involve safety functions which are performed/executed by a system of controls. The control system elements responsible for the safety function are considered the safety-related parts of the control system (SRP/CS).

Informative Note 1: SRP/CS can be electrical, electronic, hydraulic, and/or pneumatic or any combination thereof (see ISO 13849-1). The SRP/CS may be composed of sensors, logic solvers and actuators.

Informative Note 2: Not all control systems are safety-related (e.g. a position sensor, unit counter, vision system, etc.). This clause only addresses safety-related aspects of control systems.

For each safety function identified as part of the risk assessment, a design specification shall be determined. The design specification indicates both how the function is to work, and the required performance level needed to execute the safety function to an appropriate level of reliability for the situation.

Informative Note 3: Design specifications for control systems usually specify the architecture or structure of the system (Category), the performance level required (PLr), or a combination of these.

For additional information on categories see EN 954-1 (ISO 13849-1 (1999)). For additional information on performance levels see ISO 13849-1 (2006).

Informative Note 4: The design specification for a control system is not the same as a risk assessment for a machine.



The design of control systems performing a safety function shall comply with the principles and methods presented in 7.2.1 through 7.2.4 and 7.3. These principles and methods shall be applied singly or in combination as appropriate to the circumstances. 7.2.1 General The design and performance of the safety-related parts of the control system (SRP/CS) shall be commensurate with the risk reduction provided by the safety function (see clause 6). The SRP/CS shall be appropriate for the intended use. The integrity of the safety components and/or systems shall be determined by the appropriate product, system, and/or application safety standard/technical report.

Informative Note 1: Control system standards and technical reports include: ANSI B11.26, ANSI B11.TR4, ANSI B11.TR6, ANSI B11.19, NFPA 79, ISO 13849-1, ISO 13849-2, ISO 13849-100, ISO 13850, IEC 62061, IEC 60204-1, and IEC 61508.

Informative Note 2: Examples of methods used to increase reliability in designing SRP/CS include one or more of the following:

certified components or systems suitable for the application; fail-to-safe components or systems; redundant components or systems; diverse components or systems; equipment and devices with an appropriate probability of failure on demand (PFD) and safe failure fraction

(SFF) (For additional information, see IEC 61508); automatic monitoring (For additional information, see IEC 62061).

The SRP/CS functions shall be verified at the time of manufacturing and commissioning to ensure that the specified performance has been achieved. The SRP/CS shall be installed and validated to ensure that the specified performance for each safety function has been achieved.

Informative Note 3: Validation can include, but not be limited to, the following: the circuit was designed and implemented correctly; the wiring was checked after installation and before commissioning; the functionality of the safety system(s) was validated by the integrator and/or the user; the safety device was functionally tested before commissioning.

Testing of the SRP/CS shall also occur periodically by the user in order to ensure that it is functioning according to the manufacturer’s specifications as determined by the risk assessment.

7.2.2 Stop functions When pneumatic, hydraulic, or mechanical elements are incorporated into a safety stopping function, the circuit design and component selection shall be appropriate for the required level of safety performance.

The control system, programmable electronic system, and input devices that may remain energized during a stop function shall not create a hazardous situation(s) as a result of their energized state.

Informative Note 1: Retention of power for certain portions of the system may be necessary to prevent hazardous motion, to maintain program logic, or to provide braking during stopping.

Informative Note 2: Stop functions should comply with NFPA 79 (IEC 60204-1) definitions for stops.

7.2.3 Reset Resetting a safeguard of the SRP/CS in or of itself shall not restart the machinery or cause a hazardous situation. The integrity of the safety reset function shall be consistent with the risk assessment for single or multiple reset devices.



The reset device shall be located such that the SRP/CS cannot be reset from within the safeguarded space. Reset of the SRP/CS shall only be performed after the safeguarded space is clear of all individuals.

The entire safeguarded space shall be visible from the reset device location, or other means shall be provided to reduce risk to an acceptable level. The means of resetting shall be protected from inadvertent actuation.

In the presence of a failure, the user shall ensure that repetitive manual reset of the system or device is not used for production operation.

7.2.4 Protective stop Where required by the risk assessment, the SRP/CS of the machine shall have one or more protective stop circuits. The protective stop circuit design shall be appropriate for the required level of safety performance, as determined by the risk assessment.

Informative Note 1: Protective stops are typically actuated by interlocked guards, safeguarding (protective) devices and where applicable, complementary equipment (see NFPA 79 and ANSI B11.19).

The protective stop shall safely control the hazard or hazardous situation.

Informative Note 2: The intent here is to separate the safeguarding function from the emergency stop function due to differing safety performance requirements.

7.3 Control systems design requirements

7.3.1 Operator interaction Control systems shall be designed to enable the operator to interact with the machine safely.

Informative Note: Example solutions include but are not limited to one or more of the following: systematic analysis of start and stop conditions; provision for specific operating modes (e.g., start-up after normal stop, restart after cycle interruption

or after emergency stop, removal of the product contained in the machine, operation of a part of the machine in case of a failure of a machine element);

clear display of the faults (e.g., diagnostic measures to aid troubleshooting); measures to prevent unexpected start and/or operation; delayed start or restart with audible or visible annunciator; cycle on demand indicator(s) and/or safeguard(s).

7.3.2 Operator interface / controls Operator interfaces shall be:

designed, located and shall function according to the relevant ergonomic principles (see 7.8 for additional information on operator interfaces and controls and see also, ANSI B11.TR1);

designed to accommodate the foreseeable use of personal protective equipment (such as footwear and gloves);

located out of reach of the hazard zones except for certain controls which may be located within a hazard zone, such as some emergency stop or set-up controls;

located so that the operator is able to observe the working area and/or hazard zone, or other means shall be provided to reduce risk to an acceptable level;

located, positioned or safeguarded to prevent unintentional activation; located so that access to the operator interface is not impeded by the machinery or other equipment; functionally grouped and permanently identified; mounted in a location(s) that affords the operator safe operation and optimum visibility of the machinery and

workpiece from his/her normal position.

Operator interfaces that can impact safety-related functions and can be changed (e.g., via keyboards or displays), shall be subject to the risk assessment process and may require restrictions, confirmation, limitation, and/or security access.



A stop control device shall be placed near each start control device. Where the start/stop function is performed by means of a hold-to-run (jog) control, a separate stop control device shall be provided (see also, NFPA 79, 9.2.5.5).

7.3.3 Zones The machine and controls in different zones shall be defined and identified. The control requirements shall be based on the operational requirements and on the risk assessment.

Informative Note: A machine or an assembly of machines may be divided into several control zones (e.g., for emergency stopping, stopping as a result of safeguarding devices, start-up, isolation or energy dissipation). Controls for machines in zones can be local for each machine, across several machines in a zone, or globally for machines across zones.

The interfaces between zones, including synchronization and independent operation, shall be designed such that a function in one zone does not create a hazard(s)/hazardous situation in another zone.

7.3.4 Energy sources Activating an internal or external energy source, including re-energizing after a power interruption, shall not result in a hazardous condition.

7.3.5 Interruption or dissipation of energy sources Machinery shall be designed to prevent hazardous conditions resulting from interruption or excessive fluctuation of the energy sources (e.g., electrical, pneumatic, hydraulic). In the event of loss of energy, the following minimum requirements shall be met:

the stopping function of the machine shall remain available; all devices whose permanent operation is required for safety shall operate in an effective way to maintain

safety (e.g., locking, clamping devices, cooling or heating devices, braking); hazardous energy shall be safely controlled or dissipated.

Informative Note: Machinery should be designed to prevent hazardous conditions resulting from processing energy sources (e.g., electrical, pneumatic, hydraulic, steam, dust, thermal, chemical, gravity).

7.3.6 Control of hazardous energy (lock out / tag out)

The machinery or machinery system shall be provided with adequate means to control hazardous energy in accordance with NFPA 79 and ANSI / ASSE Z244.1. See also, 8.3.

Informative Note 1: For information on gas energy, see NFPA 86.

Informative Note 2: The control of stored energy can include relieving, disconnecting, restraining or otherwise rendering to a level of acceptable risk.

7.3.7 Selection of operating modes If the control system has multiple operating modes, the selection of the operating mode shall:

by itself, not generate hazardous situations; require a deliberate action to initiate operation; automatically group operational capabilities with risk reduction measures; be accomplished outside the hazard area; be clearly indicated; be indicated in a consistent manner.

Informative Note: Each mode may require restrictions, confirmation, and/or security access.

7.3.8 Wireless control Wireless (“cableless”) control systems shall comply with the requirements of NFPA 79 and other applicable standards.



7.4 Material conveyance Material conveyance systems that interface with machinery shall be designed, constructed, installed, integrated, maintained, inspected and operated in accordance with risk reduction measures resulting from the risk assessment.

Informative Note 1: For conveyors, see ANSI/ASME B20.1

Informative Note 2: See EN 415-10 for additional information on material conveyance and guard openings.

7.5 Electromagnetic compatibility (EMC) Electromagnetic compatibility of a machine and controls shall meet the requirements of the applicable sections of NFPA 79.

7.6 Electrical The electrical design and construction of a machine and a machinery system shall conform to NFPA 79, the applicable sections of NFPA 70 and UL508A.

Electrical work on machinery shall be performed in accordance with NFPA 70E.

7.7 Emergency stop Electrical, pneumatic and hydraulic emergency stops shall conform to ISO 13850 and NFPA 79.

7.8 Ergonomics / human factors Risks associated with ergonomic/human factors of machines and material handling equipment shall be reduced to an acceptable level.

Informative Note 1: For informative guidance, see ANSI B11.TR1, the annexes of this standard, or other appropriate materials.

Informative Note 2: Users and suppliers should collaborate in conducting an ergonomic hazard analysis.

7.9 Safeguarding

7.9.1 General The guards, safeguarding devices, awareness devices, and safeguarding measures on machinery shall conform to ANSI B11.19.

7.9.2 Additional considerations The specific safeguarding requirements shall be based on the risk assessment. Where safeguarding is employed, the requirements of 7.9.2.1 through 7.9.2.6 shall be applied where applicable.

Informative Note: See 7.2.8.3 for requirements for resetting SRP/CS.

7.9.2.1 Removing, disabling, bypassing or suspending safeguards When tasks such as start-up, set-up, repair, adjustment or maintenance require removing, disabling, bypassing or suspending one or more safeguards, alternative risk reduction measures shall be required. Only properly trained and authorized personnel shall be allowed access to a hazard area. The bypass process shall be documented and shall include specific procedures and appropriate training of personnel.

Informative Note: See also, 7.2.6.1, NFPA 79 chapter 9.2.4, ANSI B11.19 and ANSI / ASSE Z244.1.

Removed, disabled, bypassed or suspended safeguards shall be restored to full operational status prior to the resumption of normal operation.

Informative Note: For information on gas energy, see NFPA 86

7.9.2.2 Visibility Guards, safeguarding devices, awareness devices, and safeguarding measures shall not cause undue obstruction to the view of the production process.

Informative Note: Polycarbonate or other plastic materials often used for viewing panels may be subject to loss of mechanical strength due to the operating environment. The speed and amount of degradation of polycarbonates is



dependent upon the environment, cleaning compounds, etc., and the conditions of use. Further, such degradation is not always visible. See also, ANSI B11.19 Annex E.

7.9.2.3 Creating hazards Guards, safeguarding devices, awareness devices, and safeguarding measures should not create additional hazards but if they do, then appropriate risk reduction measures shall be implemented to attain acceptable risk.

7.9.2.4 Space between safeguards If sufficient space exists between the safeguard and a hazard such that personnel could enter behind the safeguard and have the safeguard replaced, reinstalled or re-enabled, additional safeguarding shall be used to eliminate this space or additional risk reduction measures shall be used to reduce risk to an acceptable level. See 7.8 and 7.9.2.1. See also, requirements for perimeter safeguarding in ANSI B11.19.

7.9.2.5 Reach-in time If personnel can reach a hazard by opening, adjusting or removing a safeguard, the safeguard shall remain closed and secured in place until the risk of injury from the hazard has passed. Where this is not practical, additional safeguarding measures shall be used to eliminate access to the hazard or otherwise reduce risk to an acceptable level.

7.9.2.6 Stopping time When the performance of safeguarding relies on machine stopping time, the supplier shall provide information concerning the stopping time of the machine. See also, ANSI B11.19.

7.10 Lifting of machines, component parts and materials When a lifting hazard has been identified, a means that reduces risk to an acceptable level shall be provided for loading, removing or replacing machinery, component parts or materials.

Informative Note: Means can include lifting point features such as: swivel hoist ring / eye–bolt attachment holes; permanent hook(s); other suitable component features to which lifting equipment can be attached; instructions in the operation, maintenance and safety manual for the machine. See also, Annex J, K.

Where applicable, a lifting point(s) on the load shall be identified. Transport personnel shall be able to reach the attachment devices safely. Weight and, where applicable, center of gravity details shall be given on the machine, in operations manuals, on its packaging, or on transportation documents.

7.11 Hydraulic and pneumatic (including vacuum) systems All components and piping of the machinery shall be selected or specified to operate within their rated limits when the machinery is put to its intended use. They shall be protected against abrasion, contamination, ultraviolet radiation, mechanical or other damage.

Hydraulic systems shall conform to the applicable sections of ISO 4413 Hydraulic fluid power. Pneumatic systems shall conform to the applicable sections of ISO 4414 Pneumatic fluid power. All system components shall be selected to be in accordance with the manufacturer’s specifications and instructions.

Informative Note 1: See also ANSI B11.TR6.

When pressure (vacuum) adjustments can lead to unacceptable risk, pressure control components shall be permanently marked to indicate the allowable pressure range and should prevent unauthorized change. Components with an adjustable range that is within the allowable pressure range of the system are preferred. If appropriate, fixed pressure relief valves are preferred.

Machinery design shall minimize potential hazards from: over pressure; pressure surges or pressure increase; pressure loss or under pressure;



fluid jet; stored energy; sudden hazardous movement of a hose resulting from leakage or component failures.

Over pressure protection (e.g., regulator, relief valve, switch, bypass) shall be provided on all hydraulic power sources. The pressure adjustment on a pressure compensated pump shall not be considered the over protection device. An additional relief valve downstream from the pump shall be provided.

Pressure relief valves shall operate in such a way so as to reduce risk to an acceptable level.

Informative Note 2: No comments here are meant to circumvent or supersede those requirements of the ASME Boiler Pressure Vessel Code, or other applicable pressure requirements.

7.11.1 Safety shut-off and exhaust valve An energy isolating device shall be provided to shut off and release pressure from the various systems and shall:

be capable of being locked in the OFF (closed) position only; be easy to operate (e.g., a simple pull/push action for pneumatics); have a properly sized exhaust port to exhaust pressure in an acceptable period of time as determined by

the risk assessment; have a pressure indicator (i.e., a gauge), that is visible to the operator to indicate that the line is relieved

of pressure.

Informative Note 1: See also, 7.7.

Informative Note 2: Digital (electric) pressure indicator requires a specific lockout sequence to indicate if pressure is not relieved.

Informative Note 3: Energy isolation devices should be located outside of the hazardous area(s).

7.11.2 Air valve mufflers Air valve mufflers for safety systems and air dumps shall have sufficient capacity so as not to restrict the exhausting of the system and shall not be prone to clogging over time.

Informative Note: Clogging will increase back pressure and could increase the exhaust time and detrimentally impact the integrity of the safety circuit.

7.11.3 Air preparation components The air supply shall be sized so that, during the operation of various components, there is not a hazardous pressure drop in the system.

Informative Note 1: Hazards generated due to either inadequate pressure or flow rate should be minimized. Pneumatic systems including air preparation components should be designed such that minimum specified air flow rate and air pressure requirements are maintained. Minimum system flow rate and pressure requirements should be based on the maximum cumulative demands and limitations of the pneumatic components.

Lubricators shall be set so as to provide sufficient lubrication but not so as to over lubricate, thereby causing excessive oil to be discharged into the atmosphere or create valve malfunction.

Informative Note 2: Lubricated systems should have a reclassifier installed into the exhaust port of the valve controlling the lubricated actuator.

7.11.4 Pressure intensification Hydraulic and pneumatic circuits shall be designed so as to avoid hazardous effects of pressure intensification.

7.11.5 Hydraulic accumulators Accumulators shall be charged with inert gas (such as nitrogen). Provision shall be made to discharge pressurized hydraulic fluid when necessary and within parameters for acceptable risk. A pressure indicator shall be provided to allow for verification of the release of the hydraulic pressure.



7.11.6 Actuators If rapid system pressurization causes hazardous movement, additional risk reduction measures shall be provided such as:

soft start type valving; counter weights; springs; open centered valve; flow restrictions; rod brakes and catchers; shot pins and slide locks.

7.12 Pressure vessels

All pressure vessels with an inside diameter larger than 150 mm (6 inches) shall conform to ASME Boiler and Pressure Vessel Code Section VIII Division 1 and be equipped with a pressure relief valve in the event of over pressurization.

Informative Note 1: A pressure vessel is a storage tank or container for a fluid (gas or liquid) under pressure above 100 kPa (15 psig) intended as a means of energy storage or control, and has a cross section larger than the system tubing or piping. In most cases, the machinery supplier will not actually manufacture the pressure vessel. However, the machinery supplier should procure a pressure vessel that has been manufactured according to the ASME Boiler and Pressure Vessel Code Section Code Section VIII Division 1, and which should contain a permanent marking or label identifying it as being in conformance with the ASME code.

Informative Note 2: A pressure vessel smaller than 150 mm (6 inches) in diameter should be evaluated using NFPSA/T2.6.1.

7.13 Ladders and platforms Fixed ladders shall be constructed in accordance with ANSI A14.3.

Platforms shall be constructed in accordance with ANSI A1264.1 and A1264.2.

7.14 Lasers

Lasers used with machinery shall comply with, ANSI Z136.1 and 21 CFR Parts 1000-1005, 1010, 1040.10 and 1040.11. Informative Note 1: The use of lasers may generate hazardous vapors that require ventilation or exhaust systems.

Informative Note 2: In most cases, the machinery supplier will not actually manufacture the laser. However, the supplier should procure a laser that has been manufactured according to the above standards and specifications.

Informative Note 3: Lasers on package marking machinery and similar applications should be enclosed with no openings other than those required to allow product to enter and exit. Openings to allow product to enter and exit should be designed to prevent personnel from reaching into the normal beam path and so that a single incidental reflection will not create a hazardous condition outside the enclosure. See 21CFR 1040.10(b)(15) Laser products

7.15 Lubrication Where practicable, lubrication points shall be located so that individuals are not exposed to unacceptable risks during access. Where access is difficult, remote or self-lubrication methods should be considered.

Informative Note: On machines where an automatic lubrication system failure could cause a hazard, the system should incorporate an indication of its correct functioning or a warning of a malfunction.

7.16 Mechanical power transmission Hazards associated with the operation of mechanical power transmission apparatus shall be eliminated by design of the equipment or safeguarded by a guard, device or safe location See B11.19 for additional information on safeguarding.

For requirements applicable to tasks that necessitate the bypassing of the safeguarding for mechanical power transmission apparatus, see 7.9.2.1.



Safeguarding may not be required for certain mechanical power transmission apparatus based on the results of a documented risk assessment.

Informative Note: Certain power transmission apparatus may lack sufficient energy to create a hazardous situation.

7.17 Modified atmospheres Machinery that uses modified atmospheres (enriched oxygen levels, nitrogen, carbon dioxide, etc.) shall prevent accumulation, provide for detection of unsafe levels or provide adequate ventilation.

7.18 Noise Machines shall be so designed and constructed that risks from noise emission produced by the machines are reduced to the extent practical. This could include sound absorption materials, covers, silencers, vibration damping or selection of component materials or other methods.

Exposure to the noise level of a machine or machinery system shall be reduced to an acceptable level. Informative Note 1: The noise level should be measured in accordance with ANSI B11.TR5.

Informative Note 2: OSHA requires a hearing conservation program if the noise level exceeds the equivalent of 85dbA (8-hour Time Weighted Average (TWA)). OSHA requires feasible administrative or engineering controls be utilized to reduce the noise level below the equivalent of 90dbA (8-hour TWA).

Informative Note 3: Noise levels of individual machines can increase the noise level of the area or system to an unacceptable level when combined into a machinery system or co-located.

Table 5 presents some sources of machine noise and corresponding examples of noise reduction methods.

Table 5 – Noise Source and Reduction Methods

Source Noise reduction method

Product to product contact Spacing, dampening guards/enclosures

Vibration Enclosures, isolation

Pneumatic actuators End of stroke cushions, internal bumpers, external shock absorbers, replace with deceleration valves

Transmission noise Gearbox dampening, enclosures

Pneumatic exhaust Silencers

Power generation source Dampening, absorber, enclosure

7.19 Industrial robots Industrial robots as part of, or incorporated into, machinery should be constructed in accordance with the requirements of ANSI/PMMI B155.1 and the applicable requirements of ANSI/RIA R15.06.

7.20 Radiation and magnetic fields Where practical, hazardous radiation emissions from a machinery system shall be reduced at the source.

Informative Note 1: Radiation emissions may include ionizing radiation sources (e.g., X-rays and gamma rays) or non-ionizing radiation sources (e.g., ultraviolet, infrared, microwave and laser emissions), induction heating and sealing.

If the measures for the reduction of emissions at the source are not practical or adequate, the machine shall be provided with additional risk reduction measures.

Informative Note 2: Examples of risk reduction measures include: use of filtering or absorption; use of attenuating screens or guards;



avoiding the use of hazardous radiation sources; limiting the radiation power to the lowest level sufficient for the proper functioning of the machine; designing the source so that the beam is concentrated on the target; increasing the distance between the source and the operator; providing for remote operation of the machine; labeling or instructions.

Informative Note 3: standard for radiation –Ionizing Radiation 29 CFR 1910.1096, Nonionizing Radiation (29 CFR 1910.97) lasers – see clause 7.14

The supplier of components or machinery that generates electromagnetic hazards shall advise users of the strength of the electromagnetic field at a given distance(s).

Informative Note 4: For additional guidance see EN 50527-2-1, EN 50499, or IEEE C95.1.

7.21 Sanitization and hygiene Machines used in certain industries with sanitization requirements (e.g., food and pharmaceuticals) shall provide means to allow ready cleaning/sanitization with acceptable risk.

Informative Note 1: Guidance for the hygienic design of machinery may be found in ANSI/ASB Z50.2, ISO 14159, ISO 21469, EN 1672 part 2 and the American Meat Institute Sanitary Equipment Design Principles. See also ANSI PMMI B155.TR3.

Informative Note 2: For more detailed information on the risk assessment process for machines with hygienic considerations, see the process flow chart in Annex A.

For machines used in certain industries, lubricants from machine elements such as gears, bearings, hydraulics, pneumatics, compressors, slideways and chains shall not contaminate the product or the packaging. In all cases where product and lubricant contact cannot be fully prevented, lubricants that are acceptable for that particular use shall be used.

7.22 Stability A machine shall have sufficient stability to allow it to be used safely under the conditions of use and reasonably foreseeable misuse.

Informative Note: A machine may become unstable due to one or more of the following: geometry of the base; weight distribution, including loading; dynamic forces due to movements of parts of the machine, of the machine itself or of elements held by the

machine which may result in an overturning moment; vibration; oscillation of the center of gravity; characteristics of the supporting surface in case of traveling or installation on different sites (e.g., ground

conditions, slope); external forces (e.g., air movement, manual forces, seismic, mishandled loading, worker bumping, cart

incidents, other near equipment or work operations not directly related), etc.

If stability cannot be achieved by design, other risk reduction measures shall be used. Risk reduction measures for improved stability may include:

anchorage bolts; locking devices; movement limiters or mechanical stops; acceleration or deceleration limiters; load limiters; load balancing, etc.

Means shall be provided to ensure stability of a machine during transport.



7.23 Thermal systems Where applicable, a machine shall be designed and used to minimize hazards from hot and cold temperatures.

Informative Note 1: Contact with a hot (above 60°C (140°F)) or cold (below 0°C (32°F)) surface may result in injury due to physical harm or reflexive reaction causing falls or unintended movement into a hazard.

Informative Note 2: Additional information may be found at ISO 13732-1 (hot) and ISO 13732-3 (cold). Risk reduction measures for thermal hazards may include:

venting or air movement; insulation; guarding; location or isolation; warnings or other labeling; training; personal protective equipment (e.g., gloves, face shield).

A machine shall be designed and used to minimize hazards from process thermal hazards.

Informative Note 3: Example machines include but are not limited to spray dryers, ovens, freezers, etc.

7.24 Visibility Visibility required for the safe operation or adjustment of the machine shall be provided.

Machines shall be designed and used to minimize hazards from the lack of visibility of portions of the machine. See also, 7.9.2.2 for safeguarding visibility.

Informative Note: Risk reduction measures may include:

audible or visual alarms; remote vision systems or cameras; use of transparent materials; mirrors; external or remote adjustments or lubrication access.

7.25 Ventilation of airborne contaminants For machinery and production systems that generate particles, mists, vapors, fumes or dust, appropriate control technology or where necessary, the means to connect to a user’s fume/dust collection system, shall be provided. The user shall ensure that particles, mists, vapors, fumes or dust are appropriately controlled.

8 Information for Operation, Cleaning and Maintenance of Machinery

8.1 General Information for operation, cleaning and maintenance consists of documents, signs, signals, symbols or diagrams used to convey information to the user.

The supplier shall provide information to the user about the intended use of the machinery during the applicable phases of the life cycle of the machinery. Operation, cleaning and maintenance information shall inform and warn the user about residual risk. Information for operation and maintenance shall be based on a risk assessment.

The user shall provide information to personnel for operation, cleaning and maintenance. The user shall determine the need for required information in an additional language(s).

The supplier shall indicate the need for additional safeguarding due to expected installation or integration activities. See also clause 4.2.

8.2 Manuals Machinery shall include one or more manuals addressing as applicable, the subjects of Safety, Installation, Operation, Cleaning, Maintenance, Parts, Validation/testing of the safety related systems describing the intended use(s) of the machinery. The manual(s) shall also inform or warn personnel about the residual risks, and conform to ANSI Z535.6.



Informative Note: The manual should include the sections shown in Annex J, as applicable. The order of the information shown in Annex J is recommended but not required. A checklist of suggestions for a manual from ISO 12100 appears in Annex K. The manual should be written for the intended audience. Safety information should appear prominently and be easy to read.

8.3 Machinery safety signs and labels Machinery (product) safety signs and labels shall:

conform to the requirements of ANSI Z535.4 or ISO 3864; conform to the applicable requirements of NFPA 79; be suitable for the conditions of use; appear and be explained in the manual.

Machinery (product) safety signs and labels placement and means of attachment shall not increase the risks of hygienic contamination.

Energy isolating devices should be adequately labeled or marked to indicate their function.

Informative Note: See ANSI/ASSE Z244.1.

8.4 Nameplate The machinery shall have a nameplate that complies with NFPA 79 and includes but is not limited to:

name and address or location of the manufacturer; designation of series or type; serial number, if any.

The nameplate should be permanent and remain legible throughout the expected life of the machinery.

Namplate placement and means of attachment shall not increase the risks of hygienic contamination.

8.5 Information for personal protective equipment (PPE) The machinery supplier shall inform the users of any machinery specific PPE requirements.

8.6 Information for verification The machinery supplier shall inform the users of any need and methods to verify or re-verify the risk reduction measures of the machinery.

9 Training

The supplier shall provide materials or information in the manual for the user to incorporate into its training program(s) (see clause 8). Where training materials or information are not available, the user shall develop appropriate training materials or obtain them from other sources.

9.1 General All personnel shall be trained to perform the functions for which they are responsible.

Users shall ensure that personnel working with machines are properly trained in safe working procedures and are qualified to perform the functions to which they are assigned.

Informative Note: The user should refer to the supplier’s recommendations when establishing a training program. Examples of training program elements include:

description of the assigned task; hazards associated with the assigned task; designated method of safeguarding; function of operator controls to be encountered in performing the assigned task; methods of function-testing or otherwise assuring the proper function of safeguarding means.



As required by assigned functions, personnel shall be trained in the safe working procedures for lockout/tagout/verify of hazardous energy sources. See ANSI Z244.1.

Informative Note: See Annex C for additional guidance on training. See also, 29 CFR 1910.147 and 1910.333.

9.2 Training elements

9.2.1 General Training shall include identification of hazards associated with tasks performed in the installation, set-up, operation, cleaning, and maintenance of machines or machinery systems.

Informative Note: The training should focus on hazards associated with personnel actions necessary to perform required tasks on the machinery. Some tasks are more hazardous than others.

Training shall include the identification and proper use of appropriate risk reduction measures necessary to reduce the risk of injury to personnel.

The requirements for personal protective equipment shall be determined. Personnel shall be trained in the proper donning/doffing, use and maintenance of this equipment and such use shall be enforced by the user.

Training shall include the following as appropriate: the functions and locations of manually operated controls; safe methods for installing, removing, and adjusting tooling; the location of all emergency stop devices; the location and method for installation and adjustment of all protective devices and guards; the use of safety procedures (e.g., fire prevention equipment); procedures for maintaining a safe work area; procedures for inspecting and maintaining machinery systems; procedures for sanitizing machinery systems; the proper method for each production set–up; procedures to safely perform necessary tasks that require personnel to be inside the machine envelope with the

energy enabled; require that all operators demonstrate their knowledge of the proper operation of the machine.

Informative Note 1: The user should place particular emphasis on the training, instruction, and supervision of workers who are inexperienced in the operation of the machine or have difficulty communicating.

Informative Note 2: Instructions should include guidelines to ensure that: all personnel are in a safe location before operating the machine; operators know and understand the startup and stopping procedures; operators know and understand the safe working procedures established by the user; operators know the safeguarding required for the operation and understand its function; operators know they should report to their supervisor any apparent defect, damage, malfunction or

inconsistent or unpredictable performance of the machine.

9.2.2 Training program(s) A training program(s) shall be developed for machines.

Training shall be in the English language or in the official, native or predominant language as determined by the user.

Aspects of the training program shall include:

a) Information on the risk reduction measures used;

Informative Note: Topics include but are not limited to: types of safeguarding devices; capabilities/options of safeguarding devices; description of devices selected for a specific application; function of the selected devices;



functional test of the device; limitations of the selected device.

b) Task/hazard combinations associated with the system;

c) System set-up; Informative Note: Topics include but are not limited to:

procedures for all set-ups; procedures for changing, replacing and adjusting fixtures/tooling; transport, and storage of fixtures/tooling; hazards associated with alternate means of safeguarding.

d) System operation; Informative Note: Topics include but are not limited to:

machine tasks; hazards related to each task; response to abnormal/unexpected events; recovery of operation; use of auxiliary equipment.

e) System maintenance; Informative Note: Topics include but are not limited to:

applicable system training; emergency operations; hazards associated with:

– preventive maintenance/calibrations; – troubleshooting; – repair; – operational checks; – malfunctioning safety devices; – malfunctioning communication systems; – process variables; – process materials; – procedures on live systems versus systems disabled by lockout / tagout / verify, e.g., alternative means

of safeguarding; – auxiliary equipment.

f) the supplier safety recommendations; g) procedures that contain steps related to safety actions; h) lockout/tagout/verify procedures; i) emergency procedures;

Informative Note: These should include span of control for emergency stop devices.

j) general workplace safety procedures; k) following all recommended safety practices and procedures; l) proper safeguarding means and methods; m) proper sanitizing methods; n) removal, transport, and storage of fixtures/tools.

9.2.3 Trainer qualifications The trainer shall have proficient knowledge of the:

training elements listed in clause 10.2; machine hazards; machine functions; machine safety systems; limitations of machine safety systems.



The trainer shall also: be able to communicate effectively to the trainee(s); have relevant experience and proficiency in the subject(s) of the training.

Informative Note: To train a new machine operator, the trainer should be experienced in operating the machine. A maintenance trainer should have maintenance experience.

9.3 Operator training Operator training shall include assessment of knowledge and proficiency through written testing on how to operate the machine safely.

Informative Note: The training should include time spent working with one or more experienced operators of machines to enhance learning.

Operators of machines shall demonstrate their proficiency and knowledge of safe procedures by practical / actual demonstrated performance and proficiency.

Informative Note: Demonstration of proficiency is necessary in order to check the effectiveness of training.

Operators of a machine shall be trained in cross-discipline specializations as necessary to safely perform the tasks associated with a particular machine.

Informative Note: For example, machining and rigging, material handling, fork truck operation.

Where necessary, certification in certain skills shall be required.

Informative Note: In some instances certification(s) of operators of machines may be necessary, e.g., crane or rigging operations, fork truck operation, etc.

Completion of the training shall be documented.

Informative Note: See Annex B for a sample quiz for operator certification.

9.4 Maintenance personnel training Maintenance personnel shall be sufficiently trained so that they are aware of the hazards associated with both routine and non-routine maintenance of the machine.

Informative Note: The user should make the supplier(s) instructions and recommendations readily available to maintenance personnel. If maintenance personnel install additional equipment, it should be done in accordance with the instructions of the supplier(s) of the additional equipment.

Training shall cover the workings of the machine, sub-components and ancillary components, even if these sub-components and ancillary components were supplied by other than the Original Equipment Manufacturer (OEM).

Training shall include safe work procedures and practices.

9.5 Cleaning and sanitization personnel training Cleaning and sanitization personnel shall be sufficiently trained so that they are aware of the hazards associated with cleaning and sanitization of the machine.

9.6 Supervisor training Supervisors shall be trained in safe working procedures for inspecting and maintaining machines and machinery systems.

Supervisors shall be trained in the use, function, and operation of all safety equipment, administrative requirements and systems.



9.7 Retraining Periodic retraining shall be provided to ensure the continued competence of individuals responsible for the supervision, set-up, operation, maintenance and inspection of the machine or machinery system on safety issues related to assigned tasks.

Informative Note 1: Reasons for retraining may include, but are not limited to: system changes (i.e., reconfiguring or reprogramming the system); after an incident; refreshment / enhancement.

Informative Note 2: This training is best presented when integrated with operational training.

10 Personal Protective Equipment

When the risk assessment(s) of the machinery indicates that personal protective equipment (PPE) is necessary the user shall meet the requirements of 29 CFR 1910.132 through 138.



Annex A Decision tree for safety of product and personnel (informative)

The risk assessment process applicable to hygienic design is shown in Figure A1.

Figure A1 — Schematic risk assessment procedure for hygienic design



Annex B (informative) Guidance for the risk assessment process

The following information may assist in preparing for the risk assessment (see 6.3).

General Preparations

The purpose of risk assessment is to identify hazards in order to facilitate risk reduction through either elimination of the hazard or reducing the risk, as well as provide information regarding residual risk. There are many methods and tools available for this purpose and several are described in this document. Which method(s) or tool(s) chosen is largely a matter of industry, company or personal preference.

The choice of a specific method or tool is less important than the process itself. The benefit of risk assessment comes from the discipline of the process rather than the precision of the results. A systematic approach using due diligence should be used to proceed from identifying hazards to reducing risk. Risk assessment can focus on the system or process as a whole, or the individual elements within that system or process. Application-specific risk assessments for the machine address the particular process, use, installation or integration of the machine.

Changes to machinery are generally less expensive and more effective at the design stage, so risk assessment should be initiated during the machinery design. The individuals conducting the risk assessment should use due diligence throughout the process in order to achieve a high level of confidence in the results. Confidence can be improved by consulting others with the appropriate knowledge and expertise, and by having other competent persons review the risk assessment.

Set the scope of the assessment

Before the team begins a risk assessment, the scope or boundaries of the project should be clearly understood. The project scope can be set by management with input from the risk assessment team who examine the machinery functions and the tasks associated with using the machinery.

In addition to personnel safety, the scope of the risk assessment can be expanded or narrowed to include: operational states (e.g., shut down); specific tasks; a specific portion of the life cycle; who can be harmed (e.g., public, personnel); what can be damaged (e.g., property, equipment, productivity, the environment).

Where appropriate, foreseeable uses of the machinery by persons identified by sex, age, culture or language, dominant hand usage or limiting physical abilities (e.g., visual or hearing impairment, size, strength) may be included.

Setting the scope of the risk assessment also includes determining the limits and intended use of the machine. This step can include describing the purpose of the machine, its use(s), reasonably foreseeable misuse(s), human factors and the type of environment in which it is likely to be used and maintained. See also ANSI B11.TR1. The limits of the assessment need not have a physical constraint, such as a machine floor plan, but may also have virtual constraints such as: processes, methods, programs, logic diagrams and electrical systems.

Depending on the timing of the risk assessment within the machine life cycle, the limits can include, but are not limited to:

use limits (such as the intended use of the machine; operating modes; number of persons involved) space limits (such as floor plan; maintenance access; material flow); time limits (such as production rates; cycle times; maintenance and wear of components); environmental limits (such as temperature; noise; lighting; corrosion); interface limits (such as other machines or auxiliary equipment; energy sources); human factors limits (ergonomics; cognitive capabilities; time requirements).

When setting the scope of the assessment, the team may focus on one or more of the following: a single machine;



part of a machine; the operators/immediate workers at a single machine; a system of multiple machines; the interactions with nearby machines; the interactions with the overall plant site/other buildings; the interactions with local community

Although the risk assessment is generally limited to the machine, the interaction of other machines, architectural walls and hazards from other systems in the areas should also be considered.

Form a team

Assessing risk relies on the reasoned judgment and expertise of individuals familiar with the tasks and hazards associated with machinery. To minimize individual biases (e.g., an individual attuned to noise hazards), a team approach is recommended. However, a team that is too large can lead to difficulty remaining focused or reaching consensus.

The size of a team varies according to: the stage in the lifecycle (see Figure 2 in 4.1); the complexity of the machine/system; the process within which the machine is utilized.

Team members should be selected according to the skills and expertise required for the risk assessment. The team should include those people who:

can answer technical questions about the design and functions of the machinery; have actual experience operating, setting-up, maintaining, servicing, etc. the machinery; have knowledge of processes and other dependent hardware/items; have knowledge of the incident history of this type of machinery; have a good understanding of the relevant regulations, standards, and any specific safety issues

associated with the machinery; understand human factors (see ANSI B11.TR1).

For best results, risk assessments should be conducted by a team of as many affected functions as reasonably practical. The team members may include:

workers, customers or end users; maintenance or field service; team leaders; engineers; safety practitioners; management; representatives from component suppliers or machinery users; legal counsel; consultants; insurers and others.

Gather appropriate information

To conduct the risk assessment, the team should obtain necessary resource information. The information for risk assessment should include, but not be limited to, the following:

function or purpose of the machinery; the agreed set of specifications for the particular application of the machinery; list of affected persons and their interaction(s) with the machinery (see 6.3.2.1 and 6.3.2.2); limits of the machinery; requirements for the lifecycle of the machinery;



design drawings, sketches, system descriptions or other means of establishing the nature of the machinery;

design layout and proposed system(s); information concerning energy sources; any accident and incident history; information on product materials to be used; system layout and proposed building/existing system(s); integration of subsystems and other equipment; applicable local regulations for the machinery and process.

The information shall be updated throughout the lifecycle of the system or process, and a new risk assessment may be necessary as this information changes.

Information on accident / incident history can be very useful in identifying hazards. A “near miss” recording system that captures details surrounding these events should be deployed as an integral part of an accident / incident reporting program. “Close Calls” and “Near Misses” should be included in the risk assessment process. While not leading directly to an injury, they are indicative of the presence of a hazardous situation(s) which, with continued exposure, will likely lead to an injury.

For quantitative analysis, information from sources such as databases, handbooks, laboratories and suppliers' specifications may be used, provided that there is confidence in the suitability of the data. Uncertainty associated with this data should be indicated in the documentation. Quantitative data for the frequency of occurrence of a hazardous event or for the reliability of components may not be available, but the qualitative assessment process should provide value.

Expert opinion can be used to supplement other data to increase the confidence in the accuracy and completeness of the risk assessment.

Before beginning a new assessment, the risk assessment team should identify any existing risk assessment conducted on prior version(s) of the machine or process, or for a similar machine or process that might be applicable.

Risks of one machine can be compared with risks of a similar machine provided the following criteria apply: the similar machinery has risks reduced to an acceptable level; the intended use and the operational characteristics of the machinery are comparable; the hazards and the elements of risk are comparable; the technical specifications are comparable; the conditions for use are comparable.

These comparisons are often possible for different types of systems or processes (across various industries). The use of this comparison method does not eliminate the need to follow the risk assessment process as described in this standard for the specific conditions of use (e.g., when an auger used for grinding meat is compared with an auger used for grinding grain, the risks associated with the different material shall be assessed). In some cases, one risk assessment may identify hazards whose effects continue beyond a single machine; these identified hazards can be included in other risk assessments as inputs. Ultimately, the risk assessment will focus on identifying hazards and reducing risk.



Annex C (informative) List of packaging and processing machinery hazards

This Annex identifies specific hazards that should be considered when designing, constructing, reconstructing, modifying, using or maintaining machinery. (see 6.4) The list is in alphabetical order. Not all hazards will apply to a particular packaging machine. This list is not all-inclusive.

Hazard category Potential hazards Notes Biological / health bacteria (e.g., listeriosis, E. coli)

blood borne pathogens mold viral alergens

Chemical, material or substance hazards

acute health affects (e.g., ammonia) chemical emissions / splash chronic health affects delayed affects of chemical exposure found in or used by the machinery (e.g.,

mercury, alcohol) generated by the machinery (e.g.,

emissions, radiation, mist) handled by the machinery (e.g.,

flammable, toxic, flour dust) mixing incompatible chemicals

Chemical hazards can result from the product being handled, the machinery, or machinery nearby.

Container breakage or product spillage

container breakage product spillage

Control systems dropping or ejection of a mobile part of the machinery or of a workpiece clamped by the machinery

failure to stop moving parts machinery action resulting from

defeating or failure of safeguarding devices

uncontrolled speed change unintended / unexpected start-up

The correct design of machinery control systems can avoid unforeseen and potentially hazardous machinery behavior. Typical causes of hazardous machinery behavior are:

an unsuitable design or modification (accidental or deliberate) of the control system logic

a temporary or permanent defect or failure of one or several components of the control system

a variation or a failure in the power supply of the control system

inappropriate selection, design and location of the control devices



Electrical / electronic hazards

direct contact with normally energized machinery (direct contact) (e.g., direct contact from normally live parts)

electrical noise electrostatic discharge arc flash hazard improper wiring/grounding inadvertent contact insulation failure (e.g., from vibration or

thermal cycling) jumpered switches liquid/wet locations overvoltage/overcurrent parts live from fault condition (indirect

contact) shorts/arcing/sparking software errors undervoltage (e.g., unpredictable

machinery operation) unexpected start up/motion

Electric hazards can also cause falls of persons (or of objects dropped by persons) as a result of the surprise induced by electric shock.

Environmental asphyxiants carcinogens corrosives emissions hazardous waste /by-product ozone depleting substances poisons solvents trace metals

Ergonomics / human factors

controls difficult to read/understand/operate (e.g.,: confusing displays, hard to operate)

excessive reach language/cultural difficulties (e.g.,

translations, communications) lifting/bending/twisting (e.g., dynamic

movements to do work, excessive exertion)

poor access/clearance repetition/personnel fatigue static posture (e.g., static standing

positions, awkward to get to) vibration (whole body or hand/arm)

Ergonomics/human factors should be considered by the supplier and user during the design phase and in developing work practices. Operator and maintenance personnel activities required for normal operation change over, setting up and routine maintenance should be considered. See also ANSI B11 TR1 for additional information on ergonomic hazards.

Fire and explosion

dust electrical arcs explosion/implosion flames flammable vapors/gas hot surfaces



smoke sparks spontaneous combustion static electricity

Fluids

hydraulics fluid injection liquid/vapor hazards pneumatics rupture/leakage surges/sloshing

Glue systems

cleaning of the glue system filling the glue system hot melt glue the release of glue

Handling of container, product or material

handling of product and material

Heat / temperature / thermal

burns/scalds cold material/severe cold cold work environment hot material/severe heat hot work environment refrigeration

Lasers

eye exposure laser generated air contaminants

(LGAC’s) UV skin exposure

See also Radiation

Material handling

high speed operations lifting/moving equipment robot movements unstable stacking/storage

Mechanical hazards

broken or falling machinery components (e.g., breakage, loosening, and falling, or the release of mechanical energy)

component fatigue/wear crushing/impact cutting/severing entanglement friction/abrasion head bump in-running nip points Intermittent/on demand cycle

(machinery that cycles automatically) machinery instability magnetic attraction/movement pinch points stabbing/puncture unexpected start stored eneergy

Mechanical hazards associated with machinery can include machinery parts or surfaces, tools, workpieces, loads, or projected solid or fluid materials such as:

gears chains belts handcranks power-driven handwheels grippers projecting shaft ends knives, shears and cutters power driven rollers starwheels turntables augers feedscrews



Natural hazards / Environment of use

humidity loss of power/control/lighting moving/overturning equipment seismic

Noise

continuous or intermittent noise level instantaneous/impulse noise level interference with communications or

awareness devices noise level over 8 hour work day

Measure according to ANSI B11.TR5

Radiation

infrared radiation interference from other equipment (e.g.,

implantable medical devices)) non-ionizing other uncontained ionizing particles radio frequency/microwave energy ultraviolet light uncontained x-rays visible light α, ß, rays, electron or ion beams,

neutrons

See also Lasers

Slips / trips / falls / egress

debris fall hazard from elevated work floor/wall openings poor lighting slippery surface

Ventilation / confined space

air contaminants/smoke inadequate ventilation lack of oxygen wrong airflow direction (e.g., back

drafts, under pressure, recalculating air)

See also Chemical hazards



Annex D (informative) Sharing information about residual risk Packaging and processing machinery is made of components from various sources, and packaging and processing production lines are generally assembled with machinery from a variety of machine suppliers. In the life cycle of machinery, information about residual risk should be communicated from one entity to another. Residual risks of machinery Some examples of sharing information about residual risks include, but are not limited to:

from supplier to user instruction manuals safety labels information about point of operation safeguarding

from supplier to integrator instruction manuals assembly sequence temporary construction risk reduction measures

from user to third party service providers (cleaning, maintenance, rigging, etc.) special cleaning procedures information on lockout / tagout procedures preventative maintenance requirements

from user to decommissioning personnel special disposal and recycling requirement notifying affected parties safety data sheets (SDS) on materials in the equipment

Risk introduced through integration at transfer areas In addition, risks can be introduced through the integration of machinery. Packaging and processing equipment commonly provides openings or connection points at various locations of machinery to allow product to move from one machine to another. It is also common to extend package or product transfer mechanisms from one machine into, through, or onto, another machine. This can be to maintain the stability or speed of a package, or carry product. Three examples help illustrate this situation.

As an example with process implications, a slurry of hot macaroni and cheese from a large horizontal mixer is piped to a depositor on a ready meal line. The piping connections become the 'transfer point'. The transfer of the material into open containers on another party's conveyor is another transfer where integration safety must be considered. In a process application, a depositor provided by one supplier, places hot material into a tray that is carried on a conveyor, supplied by another supplier (Figure D1). The material is stored in a hopper and connected with the deposit head by a transfer pipe, supplied by a third party

Figure D1 Process application example



An example of a common packaging machine transfer device is shown below.

A common packaging machine transfer device is a side conveyor that engages a package on opposite sides (Figure D2). The supplier of machine A provides the side conveyor device, a conveyor supporting the package from below, and guarding to the midpoint of the side conveyors. Machine B is a simple conveyor. The principal hazard is a draw-in between the two opposing side conveyors, but when this assembly extends into another machine, the integration guarding must consider the interfacing equipment, the means to support any guarding, and the control of the interacting machines.

Figure D2. Packaging machine transfer example

Figure D3 Conveyor to conveyor transfer In the simplest form of transfer, the pulley of one supplier's conveyor interfaces to the pulley of another supplier's conveyor (Figure D3). These transition points are often points of contention for safeguarding responsibility. With the simplest case, two conveyors provided by suppliers A and B, the interaction between the two pulleys can create a draw-in hazard through:

- difference in speed (A faster than B), or stopping B

‐ difference in belt friction (A greater friction than B)

‐ mis-direction of one belt (B reverses direction)

‐ difference in pulley diameter (A larger than B)

‐ relative position (gap between pulleys)

The integrator for machines A and B should consider the risks at the transfer between conveyors and provide appropriate safeguarding (Figure D4). When the choice is a movable guard, it is necessary to consider the safety circuits of the two constituent machines, and the suitability of the interlock(s). The suppliers of both machines should provide interfaces to their safety circuits for this integration, and advise the integrator of the preferred forms and quantities of added safety components.

B

A B



Figure D4 Example of machine safeguarding transfer

Unless one supplier has complete control over both conveyors, neither machine supplier should take responsibility for safeguarding this interface. This is the responsibility of the user. The party providing safeguards at integration areas, should:

‐ have control of the design of all devices involved in the integration, or authority to change the design ‐ have control of the operation of the devices, including start, stop, speed changes, and other factors that can

introduce risk ‐ produce a risk assessment of the integration area to identify the hazards and risks introduced through

integration that properly directs the selection of safeguards and the safety circuit design (if required). Because the integration of constituent machines into an assembly of machinery is typical in packaging and processing, each machine supplier should plan for, and provide the user with, sufficient information to facilitate these safe integration actions. Machine builders should provide interface information for their machines, and plan for additional inputs and outputs in the machine's safety circuit, that may be used by the integrator. Hygienic and Sanitization Considerations Where hygienic risk applies in the overall risk assessment, risk transfer also occurs with machinery used in the production of consumable products. Where sanitization of equipment is required to maintain a hygienic production environment, the user has ultimate responsibility to maintain that environment but often needs the supplier's support. Because the supplier has the best knowledge of the construction of its machine or component, the supplier should provide the following information:

‐ the materials of construction, so the user can assess compatibility with, and resistance to, the product and any cleaning materials;

‐ the form and finish of all product contact surfaces to assess the cleanability of the design; ‐ details of the fabrication to assess the suitability of the design for access during cleaning, and ability to avoid

infestation; ‐ the ingress protection provided to assess the ability to withstand solid and liquid penetration;



‐ temperature ratings of all devices to assess the susceptibility when temperature is used as a means for sanitization;

‐ information on ‘Clean-in-place’ (CIP) systems or special sanitization operating modes, where provided; ‐ information on how to disassemble, and re-assemble after cleaning.

Only the user has the knowledge of the specific cleaning agents (chemicals and chemical combination used, and concentrations, etc.), and methods (sequence of application, temperatures, preparation of surface, durations etc.) that are required for adequate sanitization. The user should define appropriate cleaning and sanitization processes that maintain an acceptable level of hygienic risk. Risk transfer information Packaging and processing machinery and production lines are composed of components and machinery from a variety of sources. This presents three overarching responsibilities for effective communication of characteristics and risks of the components or machinery:

• from component or machinery supplier to the next downstream supplier or end-user; • from end-user to personnel (operators, maintenance, etc); • from/to either source above to the integrator, installer or other personnel needed to combine the individual

parts into machines, and the individual machines into a functioning system.

At the end of the chain, the users of the machinery should conduct a risk assessment of the assembly of machinery for the tasks their personnel will perform.

To facilitate improved communication between entities, each supplier in the above chain should provide to the next downstream supplier, information to guide the proper application and use of the item(s) supplied. This information also assists the end-user with meeting legal and regulatory requirements, and may include:

Subject Risk transfer The intended use How to use the machine

safely hazards of the machine residual risks

The capabilities of the item Not to exceed capabilities The limitations of the item Not to exceed limitations The materials of construction Incompatibility The method of construction Assembly / disassembly

for cleaning Safeguards provided (with identification of the risks they mitigate, and the extent of the safeguard)

Need to have safeguards in place and operational

The susceptibilities of the item (e.g., electromagnetic, caustic, vibration, temperature, humidity, etc.)

incompatibilities

The interfaces to the item (e.g., machine, power, line control, communications, safety measures, product flow, safety circuit, etc.)

Combining / interfacing machines

Apertures in guards to permit passage of products or packages, the hazard areas, and the distances

Integration safeguarding necessary openings that cannot be closed



to hazard areas accessible through those apertures

The information may be provided through different forms, such as:

Quotes, orders or other contractual documents, user requirements specifications (URS) Instructions Risk assessment(s) Drawings, diagrams, photos, graphic media Data sheets



Annex E (informative) Other risk scoring systems E1 Introduction One of the major concerns of safety and design engineers is developing a risk reduction strategy which is appropriate for the risk. This strategy may include both physical guarding techniques as well as the topography and performance of the safety related part of the control system when an engineered control, such as an interlocked guard, is selected as the risk remediation means. Mechanical safeguards are primarily rated by their fastening methods and physical robustness. In a control system safety strategy, the concern is primarily with the performance and response of the system when a component fails. There is an level of design robustness appropriate for a given level of required risk reduction. The risk assessment matrix facilitates a systematic means to identity and select those safeguarding strategies most appropriate for the level of reduction required. When this relative risk is paired with a series of potential remediation strategies for a risk level, each may be evaluated and the most applicable solution applied. There are many different risk rating systems but no universally accepted approach. Some systems contain both the risk matrix as well as remediation strategies, while others may not. It is left to the organization to choose a technique which fits its business model and risk tolerance. Some organizations have chosen to take the matrix from one source and the remediation from another. Others have taken a system which has both, as presented, or have modified it to suit their specific needs or concerns. Again, it should be emphasized that the ultimate value of the risk assessment is in the structure and discipline of the process and not in the absolute accuracy of the results. It has been shown that various instruments lead to very similar results both in risk levels as well as in remediation performance requirements. E2 Risk Assessment Scoring Systems E2.1 MIL-STD-882 and ANSI B11.TR3 Risk Scoring Systems The risk scoring systems in Tables 5 and 6 define the probability and the severity in a two factor chart. The majority of rating systems result in either four or five risk categories. In most cases, the remediation design variations between the lowest and next higher risk level in a five category system are slight and are frequently lumped together with only minor discretionary design variations into what ultimately becomes a four category stratification.

Table 1 — MIL-STD-882 Two-Factor Risk Scoring System [4x5] Severity

Probability Catastrophic Critical Marginal Negligible

Frequent High High Serious MediumProbable High High Serious Medium

Occasional High Serious Medium Low Remote Serious Medium Medium Low

Improbable Medium Medium Medium Low

Table 2 — ANSI B11.TR3 Two-Factor Risk Model [4x4] Severity of harm

Probability of Occurrence of Harm

Catastrophic Serious Moderate Minor

Very Likely High High High MediumLikely High High Medium Low

Unlikely Medium Medium Low NegligibleRemote Low Low Negligible Negligible

For the TR3 model, the risk terms are correlated to the level of risk reduction required. High Risk demands the highest degree of risk reduction, while negligible risk may be managed by the lowest. Both guarding and engineering controls are appropriate.



E2.2 ANSI / RIA R15.06 and RIA TR R15.306 Three- Factor Risk Scoring Systems Table 7 shows the risk scoring method used in the robotics industry as contained in the ANSI / RIA R15.06 (1999) standard.

Table 3 — ANSI / RIA R15.06-1999 Risk Rating System (prior to safeguard selection) SEVERITY OF INJURY EXPOSURE AVOIDANCE RISK REDUCTION

CATEGORY

S2 Serious Injury More than first aid

E2 Frequent exposure A2 Not Likely R1 A1 Likely R2A

E1 Infrequent exposure A2 Not Likely R2B A1 Likely R2B

S1 Slight Injury

First-aid

E2 Frequent exposure A2 Not Likely R2C A1 Likely R3A

E1 Infrequent exposure A2 Not Likely R3B A1 Likely R4

Tables 8 and 9 show the risk scoring method developed in the robotics industry as contained in the RIA TR R15.306 technical report (an informative document). Both the 1999 and 2015 risk scoring methods of Tables 7 and 8 remain viable for use with robotics systems. See also, RIA TR R15.506.

Table 8 —RIA TR R15.306-2015 Risk level decision matrix

Severity of Injury

Exposure to the Hazard

Avoidance of the Hazard

Risk Level

NEGLIGIBLE E0 - Prevented A1 - Likely

S1 - Minor E1 - Low

A2/A3 - Not

likely/possible

LOW E2 - High E0 - Prevented E1 - Low

MEDIUM S2 - Moderate

A1 - Likely E2 - High A2/A3 - Not likely/possible

HIGH E0 - Prevented

LOW E1 - Low

HIGH S3 - Serious

A1/A2 - Likely/Not likely E2 - High A3 - Not possible

VERY HIGH



Table 9 —RIA TR R15.306-2015 Injury severity, exposure, and avoidance categories

Factor Rating Criteria (Examples) – choose most likely Read criteria from the top for each factor

Injury Severity

Serious S3

Normally non-reversible; likely will not return to the same job after recovery from incident:

– fatality – limb amputation – long term disability – chronic illness

If any of the above are applicable, the rating is SERIOUS

Moderate S2

Normally reversible; likely will return to the same job after recovery from incident:

– broken bones – severe laceration – short hospitalization – short term disability – loss time (multi-day) – fingertip amputation (not thumb)

If any of the above are applicable, the rating is MODERATE

Minor S1

First aid; no recovery required before returning to job: – bruising – small cuts – no loss time (multi-day) – does not require attention by a medical doctor

If any of the above are applicable, the rating is MINOR

Exposure

Prevented E0

– Exposure to hazard(s) is effectively mitigated by design. – Use of guards prevents exposure or access to the hazard(s) (see Part

2, 5.10). If an interlocked guard is selected, the third bullet must also be met.

– If functional safety is used as a risk reduction measure, the functional safety performance (PL) meets or exceeds the required functional safety performance (PLr). See Part 2, 5.2.

If any of the above are applicable, the rating is PREVENTED

High E2

– Typically more than once per hour – Frequent or multiple short duration – Durations/situations which could lead to task creep and does not

include teach If any of the above are applicable, the rating is HIGH

Low E1

– Typically less than or once per day or shift – Occasional short durations If either of the above are applicable, the rating is LOW

Avoidance

Not possible A3

– Insufficient clearance to move out of the way and safety-rated reduced speed control is not used

– The robot system layout causes the operator to be trapped, with the escape route toward the hazard

– Safeguarding is not expected to offer protection from the process hazard (e.g. explosion or eruption hazard)

If any of the above are applicable, the rating is NOT POSSIBLE

Not likely A2

– insufficient clearance to move out of the way and safety-rated reduced speed control is used

– obstructed path to move to safe area

– hazard is moving faster than reduced speed (250 mm/sec) – inadequate warning/reaction time – might not perceive the hazard exists If any of the above are applicable, the rating is NOT LIKELY



Likely A1

– sufficient clearance to move out of the way

– hazard is incapable of moving greater than reduced speed (250

mm/sec) – adequate warning/reaction time – positioned in a safe location away from the hazard If any of the above are applicable, the rating is LIKELY

There are other rating and evaluation systems, which may meet the need of the organization. Some practical examples of real risk assessments using these are given in Annex E. E2.3 Risk scoring matrix from NFPA 70E (Annex F, 2015) [5 x 5]

Table 10 — NFPA 70E Risk Scoring Matrix Severity of the injury (consequences)

Likelihood of occurrence Slight Minor Medium Critical Catastrophic Unlikely L L L M M Seldom L L M M H

Occasional L M M H E Likely M M H E E

Definite M H E E E

Severity of the injury (consequences) Likelihood of occurrence in period Slight Minor Medium Critical Catastrophic

Unlikely 1 2 3 4 5 Seldom 2 3 6 8 10

Occasional 3 6 9 12 15 Likely 4 8 12 16 20

Definite 5 10 15 20 25 Notes:

1) Extreme equal 25 through 15 2) High equals 12 through 9 3) Moderate equals 8 through 4 4) Low equals 3 through 1



E2.4 Risk scoring matrix from ANSI / ASSE Z10 [4 x 5] Example of a Risk Assessment Matrix Combining Event Probability and Severity Indicators with Risk and Action Levels

Table 11 — ANSI / ASSE Z10 Risk Scoring Matrix Or Activity --------Severity of Injury or Illness Consequence------ Likelihood of OCCURRENCE or EXPOSURE for selected Unit of Time or Activity

NEGLIGIBLE

MARGINAL

CRITICAL

CATASTROPHIC Frequent MEDIUM SERIOUS HIGH HIGH Probably MEDIUM SERIOUS HIGH HIGH Occasional LOW MEDIUM SERIOUS HIGH Remote LOW MEDIUM MEDIUM SERIOUS Improbable LOW LOW LOW MEDIUM

Likelihood: Frequent: Likely to occur repeatedly Probable: Likely to occur several times Occasional: Likely to occur sometime Remote: Not likely to occur Improbable: Very unlikely – may assume exposure will not happen Severity/Consequence: Negligible: First Aid or Minor Medical Treatment Marginal: Minor injury, lost workday accident Critical: Disability in excess of 3 months Catastrophic: Death or permanent total disability Risk Level: LOW: Risk Acceptable, Remedial Action Discretionary MEDIUM: Take Remedial action at appropriate time SERIOUS: High priority remedial action HIGH: Operation not permissible Note: These definitions are provided for illustrative purposes only and each organization will need to define these terms for their own process.



E2.5 Risk scoring matrix from SEMI S10-0307 Tables 10 and 11 present risk ranking tables for the groups of severity and likelihood.

Table 12 — Risk Ranking Table; Severity Groups Severity Group People (see Note) Equipment/Facility Property 1 - Catastrophic System or facility loss. Chemical release with lasting

environmental or public health impact

2 - Severe Disabling injury/illness. Major subsystem loss or facility damage

Chemical release with temporary environmental or public health impact

3 - Moderate Medical treatment or restricted work activity (OSHA recordable).

Minor subsystem loss or facility damage.

Chemical release triggering external reporting requirements

4 - Minor First aid only. Non-serious equipment or facility damage.

Chemical release requiring only routine cleanup without reporting

NOTE: This number is if 1-2 people are exposed to the risk. The severity group should be reconsidered to a more severe severity group when 3 or more people are involved.

Table 4 — Risk Ranking Table; Likelihood Groups

Likelihood Group Frequency (% of Unit-Years there was/is expected to be an occurrence)

A – Frequent More than 1% B – Likely More than 0.2%, but no more than 1% C – Possible More than 0.04%, but no more than 0.2% D – Rare More than 0.02%, but no more than 0.04% E – Unlikely More than 0.002%, but no more than 0.02% F – Not reasonably foreseeable Not more than 0.002%

The frequency (in % per unit year) is calculated by dividing the number of (observed/expected) occurrences of harm by the number of unit-years that the unit has existed (for observed occurrences of harm).

Table 14 — SEMI Risk Ranking Matrix

RISK RANKING MATRIX

Likelihood

FREQUENT A

LIKELY

B

POSSIBLE

C

RARE

D

UNLIKELY

E

NOT REASONABLY FORESEEABLE

F S E V E R I T Y

Catastrophic 1

Very High Very High High Medium Low Very Low#1

SEVERE 2

Very High High Medium Low Low Very Low#1

MODERATE 3

High Medium Low Low Very low Very Low #1

MINOR 4

Low Low Low Very Low Very Low Very Low #1

The Severity group does not need to be determined for outcomes of Likelihood group F, because the Risk is Very Low for all of the Severity Groups.



Annex F (informative) Sample risk assessment documentation



Annex G (informative) References

Informative Note: - ISO, IEC and most EN standards are available from the ANSI Standards Store at http://webstore.ansi.org.

ANSI B11 TR1 (2016) Ergonomic Guidelines for the Design, Installation and Use of Machine Tools

ANSI B11.0 (B11.TR3) (2000) Risk Assessment and Risk Reduction - A Guideline to Estimate, Evaluate, and Reduce Risks Associated with Machine Tools

ANSI B11 TR4 (2004) Selection of Programmable Electronic Systems (PES/PLC) for Machine Tools

ANSI B11 TR5 (2006) Sound Level Measurement Guidelines: A Guide for Measuring, Evaluating and Documenting Sound Levels Emitted by Machinery

ANSI B11.26 (2016) Functional Safety for Equipment (Electrical/Fluid Power Control Systems) – Application of ISO 13849-1 General Principles for Design

ASME A13.1‐2015 Scheme for Identification of Piping Systems

ANSI/RIA 15.06 – 2012 Industrial Robots and Robots Systems – Safety Requirements

MIL-STD-882E (2012). Standard practice for system safety. Department of Defense, U.S.A.

NFPA 652‐2016 Standard on the Fundamentals of Combustible Dust

NFPA 654‐2013 Standard for the Prevention of Fire and Dust Explosions from the Manufacturing, Processing and Handling of Combustible Particulate Solids

IEC 60204-1 2009 Safety of machinery - Electrical equipment of machines - Part 1: General requirements

IEC 60825-1 2014 Safety of laser products - Part 1: Equipment classification, requirements and user's guide

IEC 61000-6 2003 Electromagnetic compatibility (EMC) - Part 6: Generic standards - Section 4: Emission standard for industrial environments

IEC 61496-1 2015 Safety of machinery - Electro-sensitive protective equipment - Part 1: General requirements and test

IEC 61496-2 2013 Safety of machinery - Electro-sensitive protective equipment - Part 2: Particular requirements for equipment using active opto-electronic protective devices (AOPDs)

IEC 61508-1 2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 1: General requirements

IEC 61508-3 2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 3: Software requirements

IEC 61508-5 Ed. 2.0 b:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 5: Examples of methods for the determination of safety integrity levels

IEC 62061 2012 Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems

EN 619:2002+A1:2010 Continuous Handling Equipment And Systems - Safety Requirements For Equipment For Mechanical Handling Of Unit Loads

EN 954-1:1997 Safety of Machinery - Safety Related Parts of Control Systems - Part 1: General Principles for Design

EN 1672-2:2005+A1:2009 Food processing machinery - Basic concepts - Part 2: Hygiene requirements

EN ISO 13849-1:2015 Safety of machinery - Safety-related parts of control systems -- Part 1: General principles for design

EN ISO 13849-2:2008 Safety of machinery - Safety-related parts of control systems - Part 2: Validation (ISO 13849-2:2003)



EN ISO 13850 2015 Safety of machinery - Emergency stop -- Principles for design

EN ISO 13855 2010 Safety of machinery - Positioning of safeguards with respect to the approach speeds of parts of the human body

EN ISO 13732-1 2009 Ergonomics of the thermal environment. Methods for the assessment of human responses to contact with surfaces. Hot surfaces

EN ISO 13732-3 2009 Ergonomics of the thermal environment. Methods for the assessment of human responses to contact with surfaces. Cold surfaces

EN ISO 14159:2008 Safety of machinery - Hygiene requirements for the design of machinery (ISO 14159:2002)

ISO 12643-1:2007 Graphic technology. Safety requirements for graphic technology equipment and systems. General requirements

ISO 14118 2000 Safety of machinery - Prevention of unexpected start-up

ISO 14119 2013 Safety of machinery - Interlocking devices associated with guards - Principles for design and selection - Amendment 1: Design to minimize defeat possibilities

ISO 3864-1:2011 Graphical symbols - Safety colors and safety signs - Part 1: Design principles for safety signs in workplaces and public areas

ISO 3864-2/AMD1: 2011 Graphical symbols - Safety colors and safety signs - Part 2: Design principles for product safety labels

ISO 3864-3:2012 Graphical symbols - Safety colors and safety signs - Part 3: Design principles for graphical symbols for use in safety signs

ISO 21469:2006 Safety of machinery - Lubricants with incidental product contact - Hygiene requirements



Annex H (informative) List of EN (European Norm) packaging machinery standards

The following European Norms (standards) or clauses within the standards may apply to packaging machinery if the supplier chooses to use them. This is consistent with the EU interpretation of clause 6.3.2 of ISO Guide 78:2008:

“When requirements of this type-C standard are different from those which are stated in type-A or B standards, the requirements of this type-C standard take precedence over the requirements of the other standards for machines that have been designed and built according to the requirements of this type-C standard.”

The key wording is “that have been designed and built according to the requirements of this type-C standard”. Compliance to the EU machinery directive 2006/42/EC does not require the supplier to use type-C standards. However if a type-C standard is used and listed on the Declaration of Conformity the machine must be compliant to the listed standards. The EU machinery directive requires the supplier to meet the essential health and safety requirements contained in Annex 1 of the directive.

EN 415-1:2014 - Packaging machines safety - Part 1: Terminology and classification of packaging machines and associated equipment

EN 415-2:1999 Packaging machines safety - Part 2: Pre-formed rigid container packaging machines

EN 415-3:1999+A1:2009 Safety of packaging machines - Part 3: Form, fill and seal machines

EN 415-4:1997 Safety of packaging machines - Part 4: Palletizer and Depalletizer

EN 415-5:2006+A1:2009 Safety of packaging machines - Part 5: Wrapping machines

EN 415-6:2013 Safety of packaging machines - Part 6: Pallet wrapping machines

EN 415-7:2006+A1:2008 - Safety of packaging machines - Part 7: Group and secondary packaging machines

EN 415-8:2008 - Safety of packaging machines - Part 8: Strapping machines

EN 415-9:2009 - Safety of packaging machines - Part 9: Noise measurement methods for packaging machines, packaging lines and associated equipment, grade of accuracy 2 and 3

EN 415-10:2014 Safety of packaging machines – Part 10: General requirements

Informative Note: - ISO, IEC and most EN standards are available from the ANSI Standards Store at http://webstore.ansi.org.

ISO Committee CEN Committee

ISO TC 199 Safety of Machinery CEN TC 114 Safety of Machinery

NO = ISO Technical Committee CEN TC 146 Packaging Machinery

NO = ISO Technical committee CEN TC 153 Hygiene

Link to the EU directives

http://ec.europa.eu/growth/single-market/european-standards/harmonised-standards/machinery/index_en.htm



Annex I (Informative) List of some of the “type C” Harmonized standards under the “EU machinery directive” for food processing, plastic and paper manufacturing.

Source http://ec.europa.eu/growth/single-market/european-standards/harmonised-standards/machinery/index_en.htm as of 2016-05-01

Food Processing

EN 453:2014 Food processing machinery - Dough mixers - Safety and hygiene requirements

EN 454:2014 Food processing machinery - Planetary mixers - Safety and hygiene requirements

EN 1539:2009 Dryers and ovens, in which flammable substances are released - Safety requirements

EN 1672-2:2005+A1:2009 Food processing machinery - Basic concepts - Part 2: Hygiene requirements

EN 1673:2000+A1:2009 Food processing machinery - Rotary rack ovens - Safety and hygiene requirements

EN 1674:2015 Food processing machinery - Dough sheeters - Safety and hygiene requirements

EN 1678:1998+A1:2010 Food processing machinery - Vegetable cutting machines - Safety and hygiene requirements

EN 12041:2014 Food processing machinery - Moulders - Safety and hygiene requirements

EN 12042:2014 Food processing machinery - Automatic dough dividers - Safety and hygiene requirements

EN 12043:2014 Food processing machinery - Intermediate provers - Safety and hygiene requirements

EN 12267:2003+A1:2010 Food processing machinery - Circular saw machines - Safety and hygiene requirements

EN 12268:2014 Food processing machinery - Band saw machines - Safety and hygiene requirements

EN 12355:2003+A1:2010 Food processing machinery - Derinding-, skinning- and membrane removal machines - Safety and hygiene requirements

EN 12463:2004+A1:2011 Food processing machinery - Filling machines and auxiliary machines - Safety and hygiene requirements

EN 12505:2000+A1:2009 Food processing machinery - Centrifugal machines for processing edible oils and fats - Safety and hygiene requirements

EN 12852:2001+A1:2010 Food processing machinery - Food processors and blenders - Safety and hygiene requirements

EN 12853:2001+A1:2010 Food processing machinery - Hand-held blenders and whisks - Safety and hygiene requirements

EN 12854:2003+A1:2010 Food processing machinery - Beam mixers - Safety and hygiene requirements

EN 12855:2003+A1:2010 Food processing machinery - Rotating bowl cutters - Safety and hygiene requirements

EN 12984:2005+A1:2010 Food processing machinery - Portable and/or hand-guided machines and appliances with mechanically driven cutting tools - Safety and hygiene requirements

EN 13208:2003+A1:2010 Food processing machinery - Vegetable peelers - Safety and hygiene requirements

EN 13288:2005+A1:2009 Food processing machinery - Bowl lifting and tilting machines - Safety and hygiene requirements

EN 13289:2001+A1:2013 Pasta processing plants - Dryers and coolers - Safety and hygiene requirements

EN 13378:2001+A1:2013 Pasta processing plants - Pasta presses - Safety and hygiene requirements

EN 13379:2001+A1:2013 Pasta processing plants - Spreader, stripping and cutting machine, stick return conveyor, stick magazine - Safety and hygiene requirements



EN 13389:2005+A1:2009 Food processing machinery - Mixers with horizontal shafts - Safety and hygiene requirements

EN 13390:2002+A1:2009 Food processing machinery - Pie and tart machines - Safety and hygiene requirements

EN 13570:2005+A1:2010 Food processing machinery - Mixing machines - Safety and hygiene requirements

EN 13591:2005+A1:2009 Food processing machinery - Fixed deck oven loaders - Safety and hygiene requirements

EN 13621:2004+A1:2010 Food processing machinery - Salad dryers - Safety and hygiene requirements

EN 13732:2013 Food processing machinery - Bulk milk coolers on farms - Requirements for performance, safety and hygiene

EN 13870:2015 Food processing machinery - Portion cutting machines - Safety and hygiene requirements

EN 13871:2014 Food processing machinery - Cubes cutting machinery - Safety and hygiene requirements

EN 13885:2005+A1:2010 Food processing machinery - Clipping machines - Safety and hygiene requirements

EN 13886:2005+A1:2010 Food processing machinery - Cooking kettles equipped with powered stirrer and/or mixer - Safety and hygiene requirements

EN 13954:2005+A1:2010 Food processing machinery - Bread slicers - Safety and hygiene requirements

EN 14655:2005+A1:2010 Food processing machinery - Baguette slicers - Safety and hygiene requirements

EN 14957:2006+A1:2010 Food processing machinery - Dishwashing machines with conveyor - Safety and hygiene requirements

EN 14958:2006+A1:2009 Food processing machinery - Machinery for grinding and processing flour and semolina - Safety and hygiene requirements

EN 15774:2010 Food processing machinery - Machines for processing fresh and filled pasta (tagliatelle, cannelloni, ravioli, tortellini, orecchiette and gnocchi) - Safety and hygiene requirements

Bulk Storage

EN 617:2001+A1:2010 Continuous handling equipment and systems - Safety and EMC requirements for the equipment for the storage of bulk materials in silos, bunkers, bins and hoppers

EN 618:2002+A1:2010 Continuous handling equipment and systems - Safety and EMC requirements for equipment for mechanical handling of bulk materials except fixed belt conveyors

EN 619:2002+A1:2010 Continuous handling equipment and systems - Safety and EMC requirements for equipment for mechanical handling of unit loads

EN 620:2002+A1:2010 Continuous handling equipment and systems - Safety and EMC requirements for fixed belt conveyors for bulk materials

Thermoprocessing

EN 746-1:1997+A1:2009 Industrial thermoprocessing equipment - Part 1: Common safety requirements for industrial thermoprocessing equipment

EN 746-2:2010 Industrial thermoprocessing equipment - Part 2: Safety requirements for combustion and fuel handling systems

EN 746-3:1997+A1:2009 Industrial thermoprocessing equipment - Part 3: Safety requirements for the generation and use of atmosphere gases

EN 1547:2001+A1:2009 Industrial thermoprocessing equipment - Noise test code for industrial thermoprocessing equipment including its ancillary handling equipment



Converting Machinery - Paper

EN 1010-1:2004+A1:2010 Safety of machinery - Safety requirements for the design and construction of printing and paper converting machines - Part 1: Common requirements

EN 1010-2:2006+A1:2010 Safety of machinery - Safety requirements for the design and construction of printing and paper converting machines - Part 2: Printing and varnishing machines including pre-press machinery

EN 1010-3:2002+A1:2009 Safety of machinery - Safety requirements for the design and construction of printing and paper converting machines - Part 3: Cutting machines

EN 1010-4:2004+A1:2009 Safety of machinery - Safety requirements for the design and construction of printing and paper converting machines - Part 4: Bookbinding, paper converting and finishing machines

EN 1034-1:2000+A1:2010 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 1: Common requirements

EN 1034-2:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 2: Barking drums

EN 1034-3:2011 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 3: Rereelers and winders

EN 1034-4:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 4: Pulpers and their loading facilities

EN 1034-5:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 5: Sheeters

EN 1034-6:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 6: Calender

EN 1034-7:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 7: Chests

EN 1034-8:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 8: Refining plants

EN 1034-13:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 13: Machines for de-wiring bales and units

EN 1034-14:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 14: Reel splitter

EN 1034-16:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 16: Paper and board making machines

EN 1034-17:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 17: Tissue making machines

EN 1034-21:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 21: Coating machines

EN 1034-22:2005+A1:2009 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 22: Wood Grinders

EN 1034-26:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 26: Roll packaging machines

EN 1034-27:2012 Safety of machinery - Safety requirements for the design and construction of paper making and finishing machines - Part 27: Roll handling systems



Converting Machinery Plastic and Rubber

EN 1114-1:2011 Plastics and rubber machines - Extruders and extrusion lines - Part 1: Safety requirements for extruders

EN 1114-3:2001+A1:2008 Plastics and rubber machines - Extruders and extrusion lines - Part 3: Safety requirements for haul-offs

EN 1612-1:1997+A1:2008 Plastics and rubber machines - Reaction moulding machines - Part 1: Safety requirements for metering and mixing units

EN 12012-1:2007+A1:2008 Plastics and rubber machines - Size reduction machines - Part 1: Safety requirements for blade granulators

EN 12012-3:2001+A1:2008 Plastics and rubber machines - Size reduction machines - Part 3: Safety requirements for shredders

EN 12301:2000+A1:2008 Plastics and rubber machines - Calenders - Safety requirements

EN 12409:2008+A1:2011 Plastics and rubber machines - Thermoforming machines - Safety requirements

EN 13418:2013 Plastics and rubber machines - Winding machines for film or sheet - Safety requirements



Annex J (informative) Standards references useful in design:

This annex includes general information on certain hazards and risk reduction methods from several sources which may be useful in the design of packaging machinery . The information presented here is not complete. The source document should be consulted for complete information. Source documents can be obtained from the ANSI Standards Store at http://webstore.ansi.org.

General Hazard Diagrams ISO 12643-1:2007 Graphic technology. Safety requirements for graphic technology equipment and systems. General requirements



ASME B15.1-2000 has been withdrawn. The information below can be found in ANSI B11.19



EN415-3 1999: Safety of packaging machines - Part 3: Form, fill and seal machines



EN 619 - Continuous handling equipment and systems. Safety and EMC requirements for equipment for mechanical handling of unit loads



Annex K (informative) Information for use – manual content outline The following headings are generally applicable to machinery manuals. Manuals should contain the following or similar headings, where applicable. The order of the information shown below is recommended but not required.

Introduction

Title page Table of contents Introduction to this manual

Safety

General safety information and general safety instructions

Machine overview

Warranty Machine description Programmed hardware and software overview (if applicable) System hardware and software security Floor plan

Transportation

Transporting the machine

Installation

Positioning the machine Mechanical, pneumatic and electrical installation Verification of safety systems Installation check

Integration Machine interfaces Safeguarding Transfer points Controls

Operation

Operating safety considerations Controls description System set up, start-up and shut-down Sequence of operations Other operating instructions (if applicable)

Factory settings

Mechanical timing Pneumatic and vacuum settings Other factory settings

Changeover

General changeover information Product-specific set-up information

Maintenance

General maintenance instructions Machine-specific maintenance instructions

Cleaning Cleaning / Sanitization of the machine Troubleshooting and repair

General troubleshooting and repair information Troubleshooting chart (electrical engineering) Replacement parts identification Troubleshooting of electrical sensors Troubleshooting of vacuum systems Troubleshooting of pneumatic systems Sequence of operations Timing chart

Decommissioning

Decommissioning the machine

Documents and Drawings

How to use attachments, with hyper-links to documents and drawings list

Validation Information for the operation, maintenance, and verification / validation / testing of the safety related systems



Annex L (informative) Suggested information for use The manual should include but not be limited to the following, where applicable:

performance specifications; appropriate schematics and diagrams; physical environment for which the machinery is designed; function and location of the operator controls, indicators, and displays; schedules for periodic maintenance, lubrication, and inspection; application of safeguarding and other risk reduction measures; auxiliary equipment.

The manual or other written instructions (e.g., on the packaging) may contain among others:

Information relating to transport, handling and storage of the machine, e.g., storage conditions for the machine; dimensions, mass value(s), position of the center(s) of gravity; indications for handling (e.g., drawings indicating application points for lifting equipment).

Information relating to installation and commissioning of the machine, e.g.: fixing / anchoring and vibration dampening requirements; assembly and mounting conditions; space needed for use and maintenance; permissible environmental conditions (e.g., temperature, moisture, vibration, electromagnetic

radiation); instructions for connecting the machine to power supply (particularly about protection against

electrical overloading); advice about waste removal / disposal; if necessary, recommendations about risk reduction measures which have to be taken by the user;

e.g., additional safeguards, safety distances, safety signs and signals.

Information relating to the machine itself, e.g. detailed description of the machine, its fittings, its guards or safeguarding devices; range of applications for which the machine is intended; diagrams (especially schematic representation of safety functions); data about noise and vibration generated by the machine, about radiation, gases, vapors, dust

emitted by it, with reference to the measuring methods used; technical documentation about electrical equipment (see IEC 60204 series); documents attesting that the machine complies with mandatory requirements.

Information relating to the use of the machine, e.g. intended use; description of manual controls (actuators); setting and adjustment; modes and means for stopping (especially emergency stop); risks which could not be eliminated by the risk reduction measures taken by the designer; particular risks which may be generated by certain applications, by the use of certain fittings, and

about specific safeguards which are necessary for such applications; reasonably foreseeable misuse and prohibited applications; fault identification and location, for repair, and for re-starting after an intervention; personal protective equipment which needs to be used and the training required.

Information for maintenance, e.g., nature and frequency of inspections for safety functions; instructions relating to maintenance operations which require a definite technical knowledge or

particular skills and hence should be carried out exclusively by skilled persons (e.g., maintenance staff, specialists);

instructions relating to maintenance actions (e.g., replacement of parts) which do not require specific skills; and hence may be carried out by users (e.g., operators);

drawings and diagrams enabling maintenance personnel to carry out their task rationally (especially faultfinding tasks).

Information for emergency situations, e.g.: type of fire-fighting equipment to be used; warning about possible emission or leakage of harmful substance(s), and if possible, indication of

means to fight their effects.

Information relating to de-commissioning, dismantling and disposal.



Annex M — (Informative) Sample Statement of Conformity

Contractual Language: When ordering primary machines the contractual specifications should include a contractual expectation that states:

“The machine supplier shall issue with each machine a statement of conformity to the specific codes and standards followed in the design and manufacture of the machine, and bear a signature of the company’s representative legally accountable for the machine.”

A reference can be made to ANSI B11.0 for an example statement. If this language is in the contract, then the supplier is obligated to provide a Statement of Conformity. This approach should drive improvements in machine supplier capabilities and performance in meeting the standards.

Proposed Action:

The end user of the machine should file and retain the Statement of Conformity or the Declaration of Conformity letter for each machine. The Statement should be retained for the useful life of the machine or until the machine is decommissioned, sold or otherwise disposed of.

Implication:

If machine supplier does not want to provide a Statement of Conformity and this becomes known during the contract phase, then the refusal or hesitation should be considered a significant negative that casts doubt on the supplier’s knowledge of the applicable standards and/or the supplier’s ability to meet them.

Statement of Conformity:

The following text is a sample Statement of Conformity. The wording can be adjusted as appropriate to meet the needs of a particular machine supplier or application. The machine supplier should list only the standards that the supplier is confident that compliance is complete. Some standards can be incorporated by reference (for example, B20.1 is referenced in B11.0 thus, listing B11.0 may be sufficient). In general, less is better.

STATEMENT OF CONFORMITY (example) Manufacture Company name Address etc. The product covered by this statement

Model: yyy Serial Number: xxx Description of the Machine: Model xxx, Serial # xxx is a

The XYZ Company, declares that the above machine conforms to the provisions of the following Standards and Regulations: (include minimally the regulations and standards specifically included in the contract and add any other applicable ANSI standards. Standards likely applicable and in the contract include the following:

ANSI/PMMI B155.1-2016 Safety Requirements for Packaging and Processing Machinery

ANSI B11.19 – 2010 Performance criteria for safeguarding

NFPA 79 – 2015 Electrical Standard for Industrial Machinery, 2015 Edition

ISO 13949-1 Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design

Based on the application of these standards an acceptable level of risk has been achieved.

Name

Company

Date

Title Address

Declaration Signature/Date: _______________________________

(Company Authority for Declaration of Machine)



Annex N (Informative) Annex B from ISO 14159

Examples of good and bad hygienic design features

Figures B.1 to B.14 show examples of a solution to an example of a particular problem with the objective of enhancing and illustrating the text of 5.2 and clause 7. In many cases, alternative solutions, which are equally as hygienic, could be found. Poor examples of hygienic design are illustrated on the left hand side of the page (hygiene risk) and good examples on the right hand side (acceptable).

NOTE Figures B.1 to B.14 have been derived from references [1] to [6] in the Bibliography.

a) Not drainable design b) Drainable design

Key

1 Hinge

Figure B.1 — Drainage of vessels

Hygiene risk Acceptable



b) Eccentric reducer

a) Concentric reducer

Figure B.2 — Drainage of pipelines




a) Mounting of sensors

b) Conveyor roller construction

Key

1 Dead space

2 Welds

3 Shaft

Figure B.3 — Dead space




Continuously welded lap joint Continuously welded butt

Intermittently welded lap joint

a) Welded joints




b) Bonded joints

Key

1 Product

Figure B.4 — Permanent joints




a) Pipe couplings

b) Stirrer in product contact

Key

1

Metal

3

Shaft

5 Crevice

7

Sealed joint

2 Rubber seal 4 Metal to metal joint 6 Exposed screw head 8 Sealed cap

Figure B.5 — Dismountable joints




Figure B.6 — Internal angles and corners




It is important to limit the compression to prevent damage to the elastomer structure, resulting in loss of contact pressure.

The same problem will occur when, due to ageing, resilience is lost.

When compressed by 15 %, 70° shore hardness rubber gaskets will provide a bacteria- tight seal

Non-resilient gasket materials “flow” under pressure. Temperature cycling will cause permanent leakage due to large differences between thermal expansion rates of metal and plastic (e.g. PTFE).

(Gap is not shown to scale.)

Key

1 High temperature

2 Low temperature

Figure B.7 — Controlled compression and thermal expansion of elastomers and polymers




Key

1 Metal to metal contact 8 Elastomer 2 Product area 9 Domed 3 Dead area 10 Hexagon 4 Gap 11 Sloped 5 Crevice 12 Circular collar

6 Domed head 13 Well designed nut or screw head 7 Metal 14 Reverse of product area welded stud

Figure B.8 — Design of fasteners




Key

1 Product side

2 Break to atmosphere

Figure B.9 — Shaft entry design




a) Unsealed shaft without grooves b) Shaft with grooves

Key

1 Small clearance

2 Groove

3 Foot

4 Bearing

Figure B.10 — Product lubricated bearings




Key

1 Pivoted cover

2 Hinge

3 Head area

4 Detachable cover

5 Hinged cover

Figure B.11 — Openings and covers




a) Open cross-section

b) Cross-section

d) With cladding

c) Without cladding

Key

1 Soil

2 Closed

3 Open

Figure B.12 — Framework (supports)




Key

1 Small clearance feet without radius and sealing

2 Rounded pedestal

3 Sealed to the floor

4 Soil, dust

5 Small clearance

6 Radius

7 Slope

8 Sealing

9 Clearance

Figure B.13 — Floor and wall mountings




Key

1 Condensate

2 Motor

3 Pump

4 Clearance

5 Valve

Figure B.14 — Accessibility of equipment




Annex O —(Informative) Standards Visual Mapping (from ANSI B11.0 annex K) There are many standards that apply to the safety of machinery. This Annex contains a visual presentation of many of the more common Type-B standards used in the safe design and use of machinery across various world regions. The reader is cautioned that this listing is not comprehensive, nor is it intended to imply a direct correlation between similar standards in different regions. Other standards may apply to a specific machine or application. The information contained in this annex was current as of the date of publication.

Figure 1 — ANSI standards applicable in the United States



Figure 2 — EN Norms (EU standards) applicable in the European Union



Figure 3 — International standards (ISO & IEC only; other international standards may apply)



PMMI The Association for Packaging and Processing Technologies 11911Freedom Drive, Suite 600 Reston, VA 20190-5629, USA