Health and safety when using plc

[bin952]

I am surprised with all these great replies, no one mentioned forces.
* You should not have a Force installed longer than 24 hours.
* Everything to do with forces is dangerous and should be treated with normal safety procedures. (Installing, activating, removing, forcing on, forcing off, etc. should be approached cautiously)
In our training, we focus on many other safety issues in addition to the ones mentioned above. Many people in our training can't explain how "verify file" and "verify project" are safety risk, for example. not even those who have been working with PLCs for many years. We find most people have no idea of the safety risk they are taking and/or don''t give it much thought. so I thank you bungouk for bringing up the topic to give me the importunity to mention a couple.

 

[wimpiesplc]

I could agree if the statement was changed to say somethig like this:
You should supply a switch (or master control relay) which can remove the power from all PLC Output-CONTROLLED equipment (but not from the PLC itself).

Maybe for safety conditions in a working/running production environment. But for save (electrical) maintenance for example, I want a switch to turn the whole machine off.

 

[iant]

Maybe for safety conditions in a working/running production environment. But for save (electrical) maintenance for example, I want a switch to turn the whole machine off.

We call that an Isolator
however you always test your tester and test for voltage in case the isolator fails -
in some faults - as soon as you cut the power you loose the fault.
- nothing worse when you have one of those faults that happen once every few days.
- so mechanical interlocking of isolators are good
but being able to bypass that is also good.
I mentioned in another post - you need to be suitably qualified in Australia to access voltages higher than 50V

 

[iant]

Additionaly
where possible FORCES should not be left in a program.
Maybe fix it is the best option - Production demands usually prevent you from ever fixing it - so dont be sucked in to fast fixes as it is
not a good practice.

I concede, Some times you have no choice

 

[Geospark]

Describe the importance of health and safety when working with programmable controlled equipment

Bungouk, I'm glad you asked this question, as it appears there are many that need to learn how to answer it.

Above all else, I hold health and safety highest in the workplace. I'm well trained in this area, so listen well.

A lot of assumptions and mistakes are being made here.
The question is not about programmable PLC controller equipment. It's about the importance of health and safety when working in and around equipment controlled by a program, not necessarily even a PLC. Even if we work on the assumption of it meaning a PLC controlled environment, it's still all about the importance of health and safety with regard to the equipment within that environment, not how it's controlled.

Health and Safety is roughly defined as protecting the health, safety and welfare of people engaged in work or employment.

The question is not about PLC controlled equipment, but about your understanding of health and safety. Once you know health and safety, even a little, you can then apply it to any situation where people are involved in any activities. Until you do, you are nowhere near ready to answer this question.

With all due respect, I'm pleased by some, but shocked by others at the level of ignorance displayed with regard to health and safety. I don't use the word ignorance in a derogatory fashion, I mean lack of understanding. Also, the OP didn't say who they're doing this for or why. It could be school/college/PLC training, who knows. No mention of the assumed wise instructor.

This person has come to the wrong forum because they misunderstood the question. A lot of you are thinking with your coding caps on. You are not controlling the environment referred to in the question. You are describing the importance of health and safety within it.
One of the statements listed mentioned something about isolating PLCs or outputs and now that's the topic of discussion. You are, with the exception of a few, missing the point though. You're blinkered by the controls world we live in. It's not another best coding topic, or best wiring practices guide. To force or not? latch or not? need messages on HMI? good grounding? surge protection? damage to the PLC? Forget the PLC!

The trick with this question is to just base your answer on "Describe the importance of health and safety" Once you decide that, just apply situations where it relates to progam controlled environments.
Eg. Health and safety is important in preventing the risk of injury to a person...from a machine restarting while clearing a jam-up...changing a part...greasing a shaft.

You've stated a reason it's important, the rest is irrelevant.
What they are looking for in the answer is your understanding of it's importance, nothing else. Once you understand that, you apply it the same way every time, just in different environments.

Now you know it's important to human welfare what are you going to do about it?
Assess the hazards/risks involved in the tasks.
Task: Clear a jam-up.
Risks/Hazards: Can the machine start once I've opened the guard? Try it. Yes it can. Fit safety guard interlock and dual channel safety, with double redundant safety contactors. Can it start with guard open? No.
Will there be a significant risk or definite hazard from other potential sources? Yes vacuum pressure. Is vacuum pressure dissipated with guard open? No. Fit lockable safety isolation valve on vacuum line. Is vacuum pressure dissipated? Yes.
Any PPE required. Yes. Safety glasses and correct gloves.
Will the task take significant time to carry out? Yes. LOTO.
Can the guard be closed behind me? Yes. LOTO.
Train personnel. Record accidents/near misses. Re-assess. Re-train.

And so on. Nowhere in this assessment is a PLC or anything it's doing mentioned. It's not safe to assume it can provide the necessary isolation/dissipation. Only in the course of a risk assessment, if a PLC or a function there of it, is deemed a risk or hazard will it, or a part of it, require isolation.
The only exception to disregarding the PLC I'll make, when it comes to health and safety, is where it is sustaining a life dependant system. The hazard here is if it turns off?

Some of you are the best in the world at what you do and I have the up most respect for many people here, but no coding, however clever, is going to do any of that, period.

The PLC is not the enemy anyway, the EQUIPMENT is!
If assessed as a hazard it can happen. If assessed as a risk it might happen. Kill it at the source, close to the hazard.

Once my lock is on that isolator, and I've checked it can't start, you can do whatever you like with the PLC. Interpose/interface/interlock/isolate, knock yourself out. The PLC is no harm to me now. Let all the inputs switch and outputs latch retentively. Force all your I/O. As long as you have assessed and controlled the potential hazard that they may present, they are now no longer a threat.

So with all that in mind, lets assess these:

You should make sure the PLC has a single point of ground, this improves the electrical noise protection. The ground wires used should be kept short as possible and adequate wire size use, such as 2mm2 (14AWG)

PLC protection. Good wiring practices. Nothing to do with H&S.

Also each input/outputs could each have their own fuse for protection.

PLC protection. Nothing to do with H&S.

Some kind of anti surge protection should also be fitted to stop any lighting surges from damaging any of the PLC equipment

PLC protection. Nothing to do with H&S.

Care must be taken to avoid placing low-voltage signal wires and communications cable next to AC cables as could lead to potential interference.

PLC protection. Good wiring practices. Nothing to do with H&S.

All wires should be adequate to carry the correct current for all DC/AC cables, If wrong cable used then this could end catching on fire. Also try to keep all wires as short as possible.

Good wiring practices. 1st mention of a risk assessment.

All connectors should be wired correctly and fitted securely, Avoid over tightening of screws in the connector to prevent damage to the connector.

Good wiring practices. Nothing to do with H&S.

Should make sure there are switches to isolate the PLC or individual modules so trained personnel can work on them item without electrocution

First mention of people, training, competency. Also first mention of a hazard assessment to a person, electrocution, and control of it isolation.
Further risk/hazard assessment would be needed here to ascertain whether there are any risks to persons as a result of isolating the PLC or parts of it.

Double check all connections before powering on as incorrect wiring, build? could lead to physical injury to people, or damage to equipment.

Good wiring practices. 2nd mention of people. 2nd hazard assessment. Protecting equipment again.
Installation work should have a prior risk assessment done. Test environment should be controlled.

Bungouk, I don't know where you're getting your references from, but most of the above has nothing at all to do with health and safety. They are more good wiring practices in and around PLCs. Your based in the UK. Look at Wikipedia http://en.wikipedia.org/wiki/Health_and_Safety_at_Work_etc._Act_1974

In particular "Objectives" and "Duties of Employers/Employees"

Good/bad coding only comes into health and safety when it is the only method being used to implement safety measures. Eg. E-Stop to an input. Release E-Stop process starts again.

It's not up for discussion as to why it does that, and how you would normally code it! In any event, it is merely a badly coded stop button, not an E-Stop.

A proper assessment here would cease and desist this practice immediately, if a risk or hazard was found.

Remember...the "Importance of Health and Safety" never changes, wherever it goes.

So with all that in mind, go back up and see how does that question read to you now?

G.

 

[Lancie1]

in some faults - as soon as you cut the power you loose the fault.

Exactly right. If the machine is controlled by a PLC, and you kill power to the "whole machine" (desirable for a mechanical tech or someone else working on it) then the electrical and controls guys will lose some valuable information in the PLC that could save days of hair pulling. Kill all power EXCEPT the PLC, check out the PLC for faults, test the inputs and outputs, and then maybe kill the PLC if needed.

Bungouk, I don't know where you're getting your references from, but most of the above has nothing at all to do with health and safety.

Come on, he is a student, spent his life in schools, never been in a plant except maybe for a tour. He will learn, and has to start somewhere.

 

[Geospark]

OK, Take two...

Lancie1, my statement is to the point, but it bears no evidence of criticism towards Bungouk. It states a fact. Nothing more.
If you had posted it complete, its context is much clearer in that it's a helpful statement, followed by helpful info.
All that preceded it to analyse why the references are incorrect info. I didn't go to all that trouble, just to put him down at the end!
I'm here to try educate those I feel are way off the mark with this topic.
I might seem very serious about it all, but it is a very serious subject. It's life or death! I'll stress it again.

Health and Safety is paramount. Its sole purpose is the prevention of harm, injury or death to persons.
Health and safety is indiscriminate. It does whatever is deemed necessary to safeguard human life.
It is a selfish discipline. It does not care who or what it inconveniences in the pursuit of its goal.
As long as the methods used to achieve it's goal, of protecting persons, are safe and suitable.

Health and safety dictates whether or not a PLC, or part of it, should stay on or not, not anyone else.
I love a debate, as much as the next, but there is none when it comes to health and safety, all else is secondary to it.
I'm not picking on you here Lancie1, but you are still missing the point. This is directed at anyone who thinks different.

Once the topic contains health and safety in it, it's all about personnel safety, not the PLC or anything else.
Anything you discuss in this topic that does not relate to health and safety with regard to protecting human life, does not belong here.
There are valid ideas and points being made about good PLC practices when dealing with safety triggered events and maintaining PLC power for fault indication. But these discussions belong elsewhere. If health and safety has deemed it safe to leave a PLC powered on during a hazard assessment, this is merely a convenience. Health and safety protocol does not consider if someone wants it on to show faults or message remotely.

It could say ....health and safety when driving a car, discuss.
You have to assess the risks and hazards that exist to persons involved.
Can you remove, reduce, or control the hazards?
If a risk assessment deemed it necessary to remove the engine management system to perform a task, so be it.
The mechanics can whine all they like about having no diagnostics, human life comes first, always!
You don't then start discussing all sorts of controls you would alter to get the faults some other way!
You discuss the risks and possible hazards to persons and measures to protect them, period.
Of course common sense has to play a part, Health and safety cannot be implemented to a level that inhibits a process to run efficiently.

Most posts here are just directed at the PLC, and parts of it.
No mention of people, persons, operators, risks/hazards to them and control of them.
Please remove yourself from the PLC world for a minute.

I'm going to demonstrate a couple of examples.

in some faults - as soon as you cut the power you loose the fault.

What have process faults got to do with H&S? Different topic.

Exactly right. If the machine is controlled by a PLC, and you kill power to the "whole machine"
(desirable for a mechanical tech or someone else working on it) then the electrical and controls guys
will lose some valuable information in the PLC that could save days of hair pulling. Kill all power EXCEPT the PLC,
check out the PLC for faults, test the inputs and outputs, and then maybe kill the PLC if needed.

If the power to the "whole machine" was switched off intentionally as a H&S requirement, in order for a "mechanical tech" or "someone else" to carry out a risky or hazardous task, then the needs of the "electrical and controls guys" are irrelevant.
If they were turned off as a result of something other than a H&S requirement, it's a different topic.
If steps are required by tech dept to retrieve valuable info before the manual switchout, then they need to setup an SOP(standard operating procedure) to be carried out in parallel with the H&S switchout. This SOP is not the H&S Dept's responsibility , but it would be included in the documentation of the H&S switchout procedure.

Leaving the PLC on for any period is not your call. Again if H&S requires it off, off it goes. You cannot override H&S and leave it on for a period to suit your needs, "then maybe kill the PLC". How about "then maybe kill" someone?
I'm not saying H&S doesn't allow PLCs to remain on. But that the decision lies within H&S, no one else.
If your talking about keeping PLCs on after faults, then its a different topic.

I've chosen this as it's from a PLC trainer.

I am surprised with all these great replies

Some replies are good, not great. Only a couple mentioned the human aspect of the question, no one actually defined health and safety.

no one mentioned forces

Why mention forces? What have they to do with personnel safety?

You should not have a Force installed longer than 24 hours

Why? What risk?

Everything to do with forces is dangerous and should be treated with normal safety procedures. (Installing, activating, removing, forcing on, forcing off, etc. should be approached cautiously)

Dangerous? why?...treated with normal safety procedures...why?...approached cautiously? Why?

In our training, we focus on many other safety issues in addition to the ones mentioned above

Name them and their relevance to personnel safety?

Many people in our training can't explain how "verify file" and "verify project" are safety risk

What's the risk?

I'm not saying your contributions are not valid, just you need to provide more detail as to their relevance.


Understand the human aspect of health and safety first, then look at the environment your assessing in detail.

If assessing health and safety with a running machine where a PLC faults, I/O fails, outputs latch on, forces exist, file or project is verified, gremlins, fairy dust, whatever. Stop discussing whether they are possible, or to be used with caution.
They can(risk) or will(hazard) happen. Now it's up to you to decide if they are a risk or hazard to personnel safety.
If some or all are, then how can you remove/reduce or control the risk/hazard. If none are a risk or hazard to personnel safety, then they are also irrelevant.

Remember, just because something can happen because of an involuntary action or inaction, does not necessarily make it a risk or hazard to personnel safety. It may just damage raw material or plant machinery. This is not relevant here!

I'm really getting worried now that professionals are operating in these potentially dangerous environments without the necessary awareness to ensure their own safety and the safety of others.

PLCs , and their code, are an unpredictable, lethal weapon, even in the hands of people who know what they are doing. That's why H&S does not accept it as even a remote possibilty of a safety intervention method.

Please think about this.

G.

 

[Lancie1]

I'm really getting worried now that professionals are operating in these potentially dangerous environments without the necessary awareness to ensure their own safety and the safety of others.

I agree with that 100%. The "necessary awareness" of unsafe conditions is usually provided by those very same PLCs and operator panels that you want to shut down willy-nilly. Often a PLC is monitoring some dangerous process inputs, ones that indicate whether a process is producing dangerous gases or other materials. If you kill the PLC power (and not simply kill the power to the PLC OUTPUTS), then you definitley will loose the valuable process information from the PLC INPUTS (that feed the operator control panels) that could be used to save lives or simply keep the working environment safe and people healthy.

Leaving the PLC inputs active adds very little danger (most are low-voltage 24 VDC anyway), but certainly could add a lot of safety in other ways. It depends on the process to some extent, but I have personal experience with Army materiel processing for lead azide and other such volatile and explosive compounds. I don't know of ANY person experienced in this area that would suggest shutting off the process inputs to a lead azide plant, a TNT process, or similar explosives plant, until the explosive materiels have been cleaned out of all vessels and pipelines. Otherwise you are flying blind and unsafe conditions may develop with no way for the operators to monitor the condition. It would be like the operators at the Japanese nuclear plant that lost all of their process inputs. Sometimes so much is piled on the safety bandwagon that it becomes a hazard by its own actions.

It is like killing the fire alarm before a fire, so that the place will be electrically safe if firefighters are needed.

 

[Geospark]

Another reason to be worried.

http://www.plctalk.net/qanda/showthread.php?t=6514

No one replied him in 2004 or since? Zero. Assignment material yet again I'm sure. I'm not around here as long as that but it shows how far back this ignorance may go?

Where is Health and Safety being taught and practiced at the level I'm suggesting??? Ireland for 1. UK as well. Anywhere else guys? US feedback, and all others most welcome.


#Good Lancie1, Now your starting to think about it in the right way. More to do though...

Don't shoot the messenger!

...those very same PLCs and operator panels that you want to shut down willy-nilly...

Careful now, I don't want to shut anything down. H&S may want to shut them down. The reality is they most likely don't pose a threat, but risk assessment will decide this, not me.

If I do decide this, it's because I'm a trained and designated Health and Safety Officer. I have been, am, and always will be an Electrician at heart. I'm a Programmer. I'm an Automation Integrator. I'm a Fault Finder. I'm a Modifier. I'm an Innovator. I'm a Maintenance Implementor. I'm all the things you are all trying to defend against the awkwardness and inconvenience of H&S. I'm in your shoes and understand your position. I don't want my HMIs and PLCs to shut down any more than you do. I have screens developed that show graphical representation of the safety devices and their states. If called to a machine problem I am faced with the same issues as most. Is the information available? Why is the program stopped? Who did it? Why? Damn them! The difference is I am also a H&S trained, competent, person who understands that all these features are auxiliary functions to the main safety philosophy of the prevention of harm, injury or death to persons, including me!

Often a PLC is monitoring some dangerous process inputs, ones that indicate whether a process is producing dangerous gases or other materials.

Good. Keep breaking it down. Are the unsafe levels of gases or other materials unsafe to personnel? Let them leak if no harm to persons, it's not important. It's a process fault. Shutting the PLC down was more important. If other way round, what can you do to reduce the risk to persons when shutting down the PLC inputs and losing the monitoring of gas levels? Use secondary measures to monitor the gas levels and use safety rated slam-shut gas valves. just one option. You can't answer correctly until you actually know the application itself. But this is the way to think it out.

If you kill the PLC power (and not simply kill the power to the PLC OUTPUTS), then you definitely will loose the valuable process information from the PLC INPUTS (that feed the operator control panels) that could be used to save lives or simply keep the working environment safe and people healthy.

No. Wrong way of thinking. The implemented automation features are supplementary to the main functions of the process. Do not rely on the PLC, implicitly, to maintain a safe environment or the awareness of a safe environment.

Think? What do you need to see from the PLC/HMI/SCADA that is detremental to human safety? Nothing. They are visual aids. You assess the real word dangers of the process.

Can I see it stopped? Dissipated? Isolated? Shut-off? Locked Off? Mechanically de-coupled? In the home position? etc. There are many visual indicators beyond the the auxiliary world of readouts, guages, HMI and SCADA. They are important, useful and verbose, but not essential.

Leaving the PLC inputs active adds very little danger (most are low-voltage 24 VDC anyway), but certainly could add a lot of safety in other ways. It depends on the process to some extent, but I have personal experience with Army materiel processing for lead azide and other such volatile and explosive compounds. I don't know of ANY person experienced in this area that would suggest shutting off the process inputs to a lead azide plant, a TNT process, or similar explosives plant, until the explosive materials have been cleaned out of all vessels and pipelines. Otherwise you are flying blind and unsafe conditions may develop with no way for the operators to monitor the condition. It would be like the operators at the Japanese nuclear plant that lost all of their process inputs. Sometimes so much is piled on the safety bandwagon that it becomes a hazard by its own actions.

Whether to leave 24VDC inputs on or not is irrelevant, unless they are a risk or hazard to human persons. It gets monotonous, but just keep apply the same rule, no matter what the circumstances.

OK now we're getting into specialized industries. And outside my area of expertise. But, the same rules apply. The only difference here is I don't yet know the industry standards of practice for the particular hazard. Specialized higher safety rated equipment will most likely be used here, but only if risks or hazards to persons are indentified.

Do you really think the inputs would have prevented the inevitable meltdown at Fukushima?
The only difference it made was they were blind to watching it happen.

It is like killing the fire alarm before a fire, so that the place will be electrically safe if firefighters are needed.

I understand your analogy with this example, but in reality it doesn't happen that way. Why? It's a health and safety issue! The fire alarm is detremental to persons being alerted to the fire hazard, so as to assist in the safe egress from the building. It should not be intentionally powered off under any circumstances where it is in the fire alarm state. It's battery backed. The cabling is fire rated for at least one hour. The firefighters then use a fireman's switch on the outside of the building to isolate the entire building from any electrical potential.
No, you can't keep the power on your PLC running the boiler and garden sprinkler system! Everything goes!

Get outside that box and stay there!
Don't accept anything as fact, even my ramblings.
Look it up, research it. Second guess the experts.

Keep it up Lancie1 your nearly there!
If I can convert one person here I'll be happy.

G.

 

[Ned_Flanders]

Perhaps the OP can let us know the "Correct" answers because I bet the College lecturer is not expecting any of Geosparks answers!!
(And I agree with them - as somebody who just passed his NEBOSH exams)

 

[Lancie1]

The firefighters then use a fireman's switch on the outside of the building to isolate the entire building from any electrical potential.

Not quite, at least in the US. I have designed and wired up enough circuits to know that the fire pumps here are on a separate circuit that bypass the building electrical system, coming straight from the utility transformer, so that firemen cannot accidently shut them down. PLCs that control critical systems should be treated the same way. I know that in nuclear plants (having worked in a couple), they are treated the same way. You would never shut off all the 3 redundant control systems for the reactor cooling water pumps, no matter how unsafe it might be for some poor smuck that has to work on them. When shutting off the power would create environmental conditions that are unsafe for a large number of people, then of course the answer is that you DO NOT shut off the power, but instead allow unsafe conditions only for a small number of trained technicians. Cookie-cutter safety rules are generally okay but cannot be applied equally to all situations.

 

[Geospark]

ACT III, PART I

Your getting even closer now!

...fire pumps here are on a separate circuit that bypass the building electrical system, coming straight from the utility transformer, so that firemen cannot accidently shut them down.

Why do you think this decision was made?
Why do you think you designed all those circuits to keep those pumps available? (besides the money!)
Because a fire risk assessment deemed it necessary, for the health and safety of the occupants of the building, to guarantee the fire pumps would be available in the event of the buildings electrical supply being cut off.

If this safety system was controlled by a PLC or relay logic, not only would it be essential to maintain its operation, but also failsafe and back it up.

...PLCs that control critical systems should be treated the same way...in nuclear plants...you would never shut off all the 3 redundant control systems for the reactor cooling water pumps, no matter how unsafe it might be for some poor smuck that has to work on them. When shutting off the power would create environmental conditions that are unsafe for a large number of people, then of course the answer is that you DO NOT shut off the power.

You're still thinking that I, or H&S, wants to always shut down every PLC when H&S measures are being carried out.
I have already stated earlier that the only exception, when it comes to PLCs and H&S, is the case where a PLC is controlling a system that is detrimental to human life.
What I should have made clearer about that statement was that the exception is about whether or not the PLC can be considered for shutdown during a H&S risk assessment, not that it always gets shutdown unless it is protecting life.

In a nuclear plant, or any other, you would never, or should never shut down all your redundancy measures where it would pose a risk to human life. Again these redundancy measures were put there after a risk assessment deemed it necessary to protect human life threefold!

The poor smuck should not exist! You do not sacrifice the few for the greater good. Good practice would duty cycle the redundancy measures in place to ensure their correct operation. This duty cycling would present opportunities to work on each system independently.
Working in a nuclear plant is a high risk environment. Personnel would be trained to the relevant high standards required. Safety procedures would be in place to protect employees.

PPE(personal protective equipment), shielding from the core, remote handling of highly radioactive materials, limit working times in certain areas, monitor employees and the plant for high radiation levels. The control and monitoring systems use defense in depth. No one system can take down another. Human error tolerant.
All these measures help to reduce or control the risks and hazards involved in their day to day tasks.

As I said, there is no debate when it comes to health and safety.
You're now debating with yourself. Which side will win?

The good thing here, Lancie1, is that you have gone from arguing why a PLC should be kept powered on to save valuable information, to why it should be kept powered on to save valuable lives.

Tell me when I'm preaching to the converted?

G.

 

[wimpiesplc]

We call that an Isolator

Ah, my bad, didn't know that. English technical terms are sometimes hard for me to follow


and to geospark, thanks for great food for thought

 

[iant]

you never need to appologise to me for english
I can assure you that my control of any other language is really poor

 

[mae]

PLCs , and their code, are an unpredictable, lethal weapon, even in the hands of people who know what they are doing.

I'll have to disagree with the unpredictable part... If done correctly you will know exactly what will happen in any situation, if you can't be assured of this, the PLC/program should never be commissioned. This is just my opinion.

I would bet the OP had no idea this is how the thread would turn out when he asked his original question!!