Machinery Safety Survey Results: Safety Interlocks and Used Equipment

It is apparent that those responding generally knew that used industrial production equipment may not have all the safety whistles and bells.

• By Gary M. Hutter
• Mar 01, 2015

Ever wonder if your approach, or your safety manager's approach, to safety is like others responsible for safety? Does your experience match up well with that of others or are you in the minority in some issues of safety? Standards are pretty clear on the correct height range for a safety hand railing or the appropriate rise and run for a stairway, but what about compliance with procedural safety standards or those areas requiring more of a safety professional's judgment? These areas are explored based on the results of a survey of self-identified safety professionals.

In fall 2013, the National Safety Council's AMPS Committee, with the assistance of the National Safety Council (NSC), distributed a survey to more than 3,000 safety professionals concerning some issues of machine safety, safety interlocks (see the definition below), and used equipment safety. There were 111 respondents to the computer-based survey, all of whom were identified by the council's database, and by the individual respondents, as being responsible for some aspect of industrial safety.

The questions typically did not have hard and fast answers, but fell to some extent into a gray or professional judgment zone. Consultation with various occupational safety and health regulations, letters of interpretation, and other publications could provide more detailed and perhaps exact answers to the questions, but the range and diversity of answers shows that this may not be the case. The takeaway from the survey maybe that safety compliance still relies heavily on experience and good and poor workplace tradition.

Below is a summary of the results and a short discussion of these findings.

The survey was short, consisting of 11 questions that typically requested yes/ no responses, the frequencies of certain safety activities, and estimates of accident-related events. There also was an opportunity for comments concerning the issues in the survey. This author thanks all of those who participated.

Questions concerning machine safety, safety interlocks, and used equipment safety included the issues of:

• the testing and/or exercising of safety interlocks
• manufacturer's directions on the frequency of testing and/or exercising safety interlocks
• the need for testing of safety interlocks on used equipment
• the implementation of "alternative" means over more traditional lockout/tagout procedures
• the expectation that used equipment would have all of the necessary safety equipment
• the failure of an interlock causing and/or contributing to an injury

General Overview of Results

1. More than 95 percent of respondents indicated their facilities utilized more than 31 safety interlocks on their machinery.

2. Eighty, or 72 percent, of the respondents indicated that all safety interlocks got exercised/tested every time a machine is placed into production, and 31, or 28 percent, indicated safety interlocks do not get exercised/tested when machines are placed into production.

3. When asked on the frequency of safety interlocks being exercised/tested per shift, about 52 percent indicated that occurred less than once per shift, about 39 percent indicated once per shift, and 9 percent indicated more often than once per shift.

4. More than 77 percent indicated that the machine provider did not provide a frequency on which to test safety interlocks.

5. When asked whether a safety interlock might be used in the lockout/tagout activity, 17 percent indicated they would use an interlock in lockout/tagout.

6. Of the 111 respondents, 12 (~11 percent) indicated they knew of a safety interlock failure causing an injury.

7. When queried on the purchase of used equipment, it was almost unanimous that they would expect that safety devices on the used equipment that they acquire would be checked by their staff.

8. In addition, on used equipment, 97 percent of respondents indicated that they would not assume the reseller of the used equipment provided all the necessary safety features.

Safety Interlock Definition
A safety interlock is "a device or means that places a machine or machine component into a zero, or substantially reduce, danger-mode upon intent to access; or a device or means that will actively prevent access to a hazard upon intended access." (Example: an interlocked clothes dryer door that upon opening will quickly stop high-speed rotation of the drum, or a clothes dryer door that will not allow intended access during high-speed mode of operation.)¹

On The Issue of Safety Interlock Testing
The concept of interlocking for safety can be traced back several decades with perhaps electrical fuses and shear pins on power transmission shafts being two of the earliest widespread applications of some form of safety interlock. While these two early forms of interlocks did not necessarily prevent injuries, they may have mitigated some injuries and primarily were directed at preventing damage to equipment. Subsequent safety interlocks were more directed at reducing injuries by preventing behaviors that might cause an injury or by placing a machine in a safe status if inappropriate behaviors occur. Properly designed pull back devices on mechanical power presses prevented the bad behavior of reaching into a cycling machine; properly designed two-hand control would stop a part revolution clutch, making it safer if the operator detected a possible "reach in" situation. Of course, pull back devices and two-hand controls that were misadjusted and/or mis-positioned would not provide a consistent level of safety, hence the need to regularly examine their performance.

More effective and modern safety interlocks generally were being patented in the 1950s. They often used limit-switches or other linkages to detect the status of a guard, machine component, or machine operation to perform the safety interlock function. These mechanical elements required proper alignment, non-jamming features, and return devices (e.g., springs, gravity, counterweights) as basic elements of their design. To remain functional, their movements and performance needed to be verified in case a spring broke or due to something jammed, preventing gravity from resetting the interlock. Verification of the performance of safety interlocks did not guarantee future performance, but provided an opportunity to correct malfunctioning safety mechanisms, potentially before an accident.

In the 1960s and 1970s, the patent history indicates there was a marked increase in non-mechanical, non-limit-switch based interlocks, often in the forms of light curtains, proximity detectors, or other type of presence/motion detectors (invisible detection means). These devices may not have had the same mechanical switches, alignment, and/or jamming considerations of the prior generation of mechanically activated switching mechanisms of earlier designs, but they too require some sort of functional testing. For example, many providers of light curtains specify intervals for functional testing their performance and coverage. Rockford Systems (a provider of safety hardware and training) publishes a checklist for light curtain installations that states: “Light curtains should be function-tested at every set up, operator and shift change, as well as every time after maintenance is performed."²

To perform some testing of interlocks (e.g., during removal for electrical interlock testing), there may be a need to bypass the interlock mechanism or to perform some invasive action (e.g., reach beyond a guarded area). A functional evaluation for the earlier limit-switch interlock configurations and/or for the newer invisible detection means often required actually simulating behaviors that are hazardous; that is, simulating reaching into a moving machine, opening a hinged guard when the machine is on, or functioning on/off switches at what could be inappropriate times. Other interlock activities, such as those that do not allow a machine to restart by itself after a power outage and circuit reset, may be more difficult to simulate but still may have required some orchestrated performance testing.

Because all of these safety interlocks still required some surveillance to determine their functionality, it was often deemed useful to check these interlocks by exercising them and/or testing them on some time-based frequency. For example, some manufacturers of commercial lawn, yard, and garden equipment provided some guidance on the frequency of testing of their machine interlocks. They typically operate in dusty, wet, and high utility-rate environments that can frustrate the longevity of such an interlock.

A third wave of safety interlocks that are reportedly self-checking are documented in the patent literature, generally starting around the mid-1980s and into the 1990s. These schemes may use redundant electronic circuits³, movable safety interlock mounting elements to simulate operation without human involvement⁴, and/or mechanical redundancy and hardware⁵. There has been some criticism⁶ of the reliance on these attempts of self-checking as manifested on interlocks in the form of redundancies, interlock bypasses, and/or negative vs. positive failure mode monitoring⁷.

Regardless of the frequency of exercising and/or testing of safety interlocks, most of the subsequent results can only monitor past performance and often have little ability to determine future performance of a particular safety interlock. In many ways, it is like the "test button" on a smoke alarm: It tells you the horn and battery are functioning today and most likely yesterday but does not tell you whether the battery will be good at the end of the week.

Relevant Codes and Standards
Various codes and standards include safety interlock criteria. American National Standards Institute (ANSI) standards and National Electrical Code (NEC/NFPA 79) for industrial machinery generally have not mandated a specific frequency for interlock exercising and/or testing, but in a liberal reading of ANSI/ASSE Z244.1-2003 (R2008)⁸, it does address self-checking or monitoring to ensure the integrity and performance of control circuits (e.g., interlocks):

“Medium Risk Potential – Any exposure to serious injury. A dual channel circuit of industrial rated components that is self-checking or monitored through the use of a safety relay or safety PLC’s to ensure integrity and performance of the control circuit. These systems typically have redundant interlock switch safety contacts, redundant isolation through positively guided electro-mechanical relays and are monitored or self-checking" (page 26, para 5.4.3.2)

In ANSI/SPI B151.21-2003 (for certain plastic manufacturing equipment), there is added detail about self-monitoring interlocks:

“A monitoring device shall be provided to verify the operation of the safety interlock(s). When improper operation is detected, the cycle shall be inhibited and an alarm shall be activated."

This self-detection and self-stopping concept is repeated for electrical, hydraulic, pneumatic, and mechanical safety interlocks and devices.

More recent International Standards Organization (ISO) standards and criteria have begun to more specifically address these issues of testing equipment-mounted safety interlocks. In EN ISO 13849-1 (2009), this issues of testing interlocks and other safety components/systems is addressed in various forms, including the concept of "Mean Time To Failure" and "Mean Time Between Failures." The Rockford Automation summary of that standard states:

“Designated Architecture Category 2 must use basic safety principles {see index of EN ISO 13829-2}. There must also be diagnostic monitoring via a functional test of the system or subsystems. This must occur at startup and then periodically (underlining added for emphasis) with a frequency that equates to at least one hundred tests to every demand on the safety function."⁹

This standard language leaves the frequency of testing somewhat poorly defined, and this was confirmed through contact with one of the major interlock suppliers, who referenced ISO 13489, section 4 (design of safe machine control systems). That standard, for example, discusses a "Category 2" interlock architecture, para 4.1.3, wherein “The periodic test interval is depending on the application. . . .  The checking interval can be established or based on the operating cycle or the machine cycle. It is important that the interval is suitable for [the] application. The checking interval needs to be evaluated/determined during the risk assessment for the application."

For the above considerations, interlocks should be exercised and/or checked (monitored) for functionality. This may be due to possible mechanical, hydraulic, pneumatic, and/or electrical reasons. There appears to be a strong acknowledgement/ codification for the need for periodic monitoring, but it also appears that there is some latitude as to the exact frequency when using equipment that preceded recent applicable safety standards.

Using Safety Interlocks for Compliance with Control of Hazardous Energy (LOTO)
The concept of control of hazardous energy focuses on the elimination or control of hazards and hazardous energy for maintenance and certain servicing operations. ANSI published standards on that issue prior to 1980, and OSHA codified the criteria in the 1980s and early 1990s in at least two portions of its standards: OSHA 29 CFR 1910 subpart S-Electrical, 29 CFR 1910.333, and in 29 CFR 1910.147, "The Control of Hazardous Energy."

While the survey resulted in a rate of 17 out of 100 respondents indicating their approval of using an interlock for the control of hazardous energy under LOTO conditions, this is not the current policy of OSHA.

The published OSHA criteria are in 29 CFR 1910.333(b)(2)(ii)(B): “The circuits and equipment to be worked on shall be disconnected from all electric energy sources. Control circuit devices, such as push buttons, selector switches, and interlocks, may not be used as the sole means for de-energizing circuits or equipment. Interlocks for electric equipment may not be used as a substitute for lockout and tagging procedures."

This admonition is repeated in other OSHA publications, including "Safeguarding Equipment and Protecting Employees from Amputation," OSHA 3170-02R, 2007: “Interlock control circuitry may not be used for all maintenance and servicing work"¹⁰ and 29 CFR1910.333(b)(2()ii)(B): “Interlocks for electrical equipment may not be used as a substitute for lockout and tagout procedures."

While one might theoretically argue that if an interlock is good enough for safe assess during operations, why should it not be sufficient for other activities, there are several reasons. One rationale is contained in the NFPA 79 standard and is based on the concept that when an interlock may neutralize electrically powered components from movement (e.g., a motor will not be able to run), there is still a possibility of electrocution if the electrical power itself is not eliminated.¹¹

So, in general, following the traditional OSHA lockout and tagout procedures would not allow reliance on interlocks for worker safety.

The Issue of Safety and the Purchase and Reinstallation of Used Industrial Production Equipment
The terminology "Used Industrial Production Equipment" may have multiple connotations to different user groups. When we as non-industrial equipment purchasers go and buy a used car from a used car dealership, we generally expect that it is in reasonably good shape from a safety perspective. This does not mean that if we purchase a 1964 car, we expect it to have seatbelts (having been made prior to the mandatory seat belt requirement) or that even the purchase of a 2012 car will assure us the protection of airbags all around. But in either case, it would seem reasonable that the brakes have been tested, what airbags are there work, and the seat belts are compliant. If we buy a used mechanical item from a garage sale, we may have much lower expectations.

In an industrial setting, there are sellers of used equipment that advertise and warranty that the used equipment operates and/or that the safety components function as designed. Typically, they do not perform their own independent safety analysis, their own detailed destructive testing, or risk assessments. Often these sellers do not know of the past service life or intended service application of the used hardware, forcing them, to some extent, to rely on the integrity of the original design and the care of the new owner.

Other sellers of used equipment may sell equipment in an "as is" condition. That is, the equipment was more of a salvaged item, perhaps to be used for spare parts or significant modification and upgrading by the purchaser.

References
1. ANSI/SPI B151.21-2003 Defines an interlock as "An arrangement whereby the status of one control or mechanism allows or prevents the operation of another." ANSI B11.19 for Machine Tools–1990 uses similar language.
2. Rockford Systems, Inc., www.rockfordsystems.com/online/training/lightcurtain.cfm, 2/2014
3. U.S. Patent, Keese, 1/25/94, Self-checking Interlock Control System 5,281,857
4. Foreign Patent, Barnett, 7/5/2000, Remote and Proximal Guard and Interlock Testing Mechanism, EP 1015862 A2
5. U.S. Patent, Kneip, 7/5/83, Self-checking Safety Mat, 4,392,176
6. "Safety Interlocks--The Dark Side," F. Hall, Safety Brief, ISSN 1041-9489, June 1992, v7, No. 3
7. e.g., Negative Mode monitoring senses guard is closed and allows machine to operate; Positive Mode monitoring senses the guard is not closed and that prevents machine from operating.
8. Note this standard is written for the control of hazardous energy.
9. "Safety Performance Levels," EN ISO 13849-1, Rockwell Automation
10. Table 1 information on interlocks.
11. Safety Bulletin, "Primary vs Secondary Protection: Why Interlocks and Not an Acceptable Alternative to Lockout," W. Switalski, Triodyne Inc., 9/2000

This article originally appeared in the March 2015 issue of Occupational Health & Safety.