Safety Norms: Industrial Automation and Smart Manufacturing

1Purpose, Scope, and Safety Principles

These norms protect workers, contractors, visitors, and the surrounding public from harm arising from automated equipment, control systems, and smart manufacturing data flows. The main principle is that hazards are removed or engineered out first, then controlled by safeguards, then managed through procedures, and only then addressed with personal protective equipment. Warnings and training are necessary but never sufficient on their own.

Scope covers programmable logic controller cells, robot work envelopes, collaborative robots, conveyors, palletizers, automated guided vehicles, human machine interfaces, industrial networks, sensors, manufacturing execution systems, and the installation, commissioning, maintenance, and engineering work performed on them. It also covers releases of oil, coolant, solvents, and wastewater that can occur when process automation fails or is serviced incorrectly.

• Mandatory: no person enters a hazardous machine zone while stored or electrical energy is live unless a documented exception procedure applies.
• Mandatory: safety functions are never bypassed, defeated, or left inactive to keep production running.
• Recommended: review designs for hazard elimination before relying on signs, guards, or training alone.

2Roles, Competence, and Accountability

The plant manager owns safety performance and provides budget, staffing, and time for safe work. Automation engineers own control logic, safety-rated configuration, validation test records, and change documentation. Maintenance supervisors own isolation, lockout, permit issue, and return to service. Operators own pre-start checks, stopping work when conditions change, and reporting abnormal motion or alarms. Site safety professionals own hazard assessment review and incident investigation. Information technology and operational technology teams own network segmentation, remote access control, and patch approval.

Contractors remain accountable for their crews. Before work starts, the site host must confirm that contractors have received the site induction, hold the required authorizations, and understand the permit system. Competence is demonstrated, not assumed, and it must be refreshed after incidents, long absences, or significant changes to equipment.

• Only trained and authorized persons may program, modify, or reset safety-related controllers or safety network devices.
• Authorization records list the scope of each person's authority, such as robot teach mode, electrical work, or network changes, and expire when competence lapses.
• Qualified electrical workers perform live electrical work only where local rules permit it and only under approved procedures.

3Hazards, Activities, and Risk Assessment

Smart manufacturing combines mechanical, electrical, software, chemical, and digital hazards in the same space. Typical activities include teaching robots, clearing jams, changing tooling, commissioning new cells, updating firmware, calibrating vision systems, replacing sensors, charging or handling batteries in mobile robots, and acting on dashboards that drive production or maintenance decisions. Each activity must appear in the risk assessment with the people involved, the equipment used, and the environment where the work occurs.

Risk assessment should consider severity of harm, frequency of exposure, likelihood of occurrence, and whether controls are engineered, administrative, or personal. A simple likelihood and severity matrix is acceptable where the local procedure defines its scales. The assessment must be reviewed after any change to the cell, program, network, or task, and it must be repeated when an incident reveals a gap.

• Unexpected motion: robot or servo movement during teach, restart, or fault recovery. High risk. Requires safeguarded envelope, enabling device, reduced speed, and lockout.
• Stored energy: pneumatic, hydraulic, spring, gravity, and capacitor energy. High risk. Requires bleeding, blocking, and verification of zero energy before work.
• Crushing and pinching: conveyor transfers, press tooling, gantry axes, and pallet shuttles. High risk. Requires fixed guards, interlocked gates, and presence sensing.
• Arc flash and electric shock: control cabinets, drives, and battery systems. High risk. Requires qualified electrical workers, arc-rated clothing where the assessment calls for it, and approved electrical procedures.
• Cyber intrusion causing unsafe behavior: remote access, unpatched controllers, and shared plant networks. High risk. Requires segmentation, authentication, and change control.
• Slips, trips, and ergonomics: cable runs, reaching into cells, and repetitive tooling changes. Medium risk. Requires cable management, housekeeping, and task rotation.
• Chemical and environmental releases: coolant, hydraulic fluid, cleaning agents, and wastewater. Medium to high risk depending on quantity. Requires containment, drip trays, and spill response.
• Light, laser, and noise hazards from vision, marking, and cutting systems. Medium risk. Requires assessment, eye protection rated for the source, and hearing protection where noise levels are assessed as excessive.

4Preventive Controls and Safe Work Practices

Controls follow the hierarchy of elimination, substitution, engineering controls, administrative controls, and personal protective equipment. Engineering safeguards such as fixed guards, interlocked doors, light curtains, safety mats, safe torque off functions, and safety-rated controllers are the primary defense. Administrative controls such as procedures, permits, and supervision support these safeguards but do not replace them.

Lockout tagout, often shortened to LOTO, means isolating energy sources, applying a lock and tag to each isolation point, and verifying that energy is released. Each worker who enters the hazard zone applies a personal lock. Keys remain with the person who holds the lock. Shift changes do not remove locks without a documented transfer step.

Commissioning and changes follow a controlled sequence. Simulation or offline testing comes first, then supervised testing at reduced speed, then full production release only after safety validation records are signed. Temporary wiring, jumpers, and unlabeled overrides are not permitted outside the documented test plan.

• Mandatory: apply lockout tagout before entering any guarded area for maintenance, clearing, adjustment, or tool change.
• Mandatory: verify zero energy by attempting a controlled start from the operator station and testing the isolation point with a suitable meter.
• Mandatory: restart after an emergency stop, guard opening, or fault requires a documented reset check confirming hazards are cleared and all persons are outside the envelope.
• Mandatory: teach mode uses reduced speed and an enabling device, and only the operator is inside the cell unless a two-person plan is approved in writing.
• Mandatory: safety functions, interlocks, and muting configurations must not be bypassed. Temporary bypass requires written approval, a stated time limit, compensating measures, and a removal record.
• Mandatory: program and parameter changes follow management of change, including request, risk review, test in a non-production environment, approval, backup of the existing version, and signed release.
• Mandatory: work at height, entry into process vessels, and energized work require a site permit issued by an authorized person who checks conditions before work starts.
• Mandatory: mobile robots and automated guided vehicles operate only within marked routes, with verified area scanners and floor markings.
• Recommended: pre-shift functional checks of emergency stops, gates, and indicator lights, recorded on a checklist at each station.
• Recommended: visual management, such as status lights or floor signs, showing which cells are in maintenance state.

5Protective Equipment, Environment, and Information Safeguards

Personal protective equipment is the last line of defense and must match the hazard assessment. Typical items include safety glasses with side shields for machine areas, hearing protection where noise is assessed as excessive, cut-resistant gloves when handling sharp sheet metal, arc-rated clothing for specified electrical work, and face protection for chemical handling. Loose gloves must not be worn near rotating spindles, conveyor rollers, or pinch points because they can be drawn into moving parts.

Production data, recipes, and worker records can reveal sensitive business information and personal data. Access follows least privilege, and passwords and remote access credentials must be unique to each person. Shared accounts are prohibited for safety-related controllers. Privacy laws and data retention rules vary by jurisdiction and should be verified with the privacy officer and legal counsel before new data collection begins.

• Inspect PPE before each shift and remove damaged items from service immediately.
• Keep ventilation, lighting, and floor conditions within site limits. Report leaks, puddles, and obstructed walkways to the supervisor at once.
• Store lithium batteries, compressed gases, and chemicals in designated areas with labels, secondary containment, and separation from ignition sources.
• Map floor drains and keep spill kits at each cell that uses fluids, with absorbent sized for the largest likely release.
• Keep remote access disabled unless a named person has an approved, logged session for a defined task.

6Incident Reporting, Emergency Response, and Escalation

Every injury, near miss, equipment damage event, unexpected motion, cyber alarm, or release must be reported to the supervisor immediately and logged before the end of the shift. Near misses matter because they show where controls are failing before someone is hurt. Reporting must never lead to blame for honest reports, and the site should protect reporters from reprisal under its own policy and applicable law.

Emergency response starts with stopping the process safely, calling the site emergency number, and protecting people before attempting recovery. Only trained responders may enter a hazardous area during an emergency, and they must confirm isolation first. The escalation path runs from the operator to the supervisor, then to the automation engineer and site safety lead, and to emergency services when life or health is at risk.

• Mandatory: press the nearest emergency stop or use the documented stop sequence if a person is at risk, then call the site emergency number.
• Mandatory: do not attempt to free a person trapped in machinery until power is isolated and a trained person has approved the rescue plan. Call emergency services when needed.
• Mandatory: do not reset a tripped safety circuit to clear an alarm. Escalate to the automation engineer and the site safety lead.
• Mandatory for suspected cyber incidents: isolate the affected cell from the network, preserve logs, and notify IT security. Do not power off devices unless the procedure says so, because volatile evidence may be lost.
• Mandatory for spills: stop the source if safe, contain with absorbent, cover drains, notify environmental staff, and follow the spill response plan.
• Recommended: investigate near misses within the timeframe set by local procedure and use root cause analysis rather than blaming individuals.

7Documentation, Training, Inspection, and Review

Records show that controls exist and that they work. Keep current drawings, risk assessments, safety validation test results, lockout procedures, permit logs, training records, bypass registers, and change approvals. Inspect safeguards, emergency stops, and emergency equipment on a documented schedule. Verification of safety functions after any change is mandatory, and the results must be signed by a competent person.

Training must happen before first unsupervised work. It covers machine hazards, lockout tagout, robot teach procedures, cyber hygiene, emergency stop response, and the local spill plan. Refresher training follows the schedule in local procedure and also occurs after any incident or significant change. Reviews of these norms should take place after incidents, technology changes, audit findings, and at the scheduled review interval. Key indicators may include near misses reported, overdue inspections, active bypasses, open cyber findings, and training currency.

These norms are educational guidance and do not replace professional authorization, formal training, approved procedures, supervision, or emergency services. Verify applicable machine safety, robot safety, functional safety, electrical, and environmental requirements, along with manufacturer instructions, with competent authorities or qualified professionals.

• Confirm training records before anyone is granted access to robot, PLC, or network systems.
• Review the bypass register at the start of each shift and remove expired entries.

Implementation checklist

• Confirm the risk assessment covers every automated cell, mobile robot, and network connection.
• Verify lockout tagout and zero energy before entering any guarded area.
• Test emergency stops and interlocks at the start of each shift and record results.
• Confirm the person doing the work holds a current authorization for that specific task.
• Obtain a signed permit for energized, height, or confined space work.
• Confirm change approval and a backup of the current version before any program change.
• Keep bypasses approved, time limited, and removed as soon as they are no longer needed.
• Isolate suspect network devices and report cyber alarms to IT security without delay.
• Report every near miss, injury, and release before the end of the shift.
• Check spill kits, drains, and battery storage areas for containment and labeling.