Jeff Russell has quite a challenge on his hands. Among his many safety tasks, Russell is helping to unify the safety standards of three major divisions of PepsiCo into a harmonized corporate safety system.
Russell, who spoke at last November's Rockwell Automation Fair, said the emphasis is clear: More automation engineers are being trained in machine safety standards as the company moves through EN 954-1 to EN ISO 13849-1 and more of a performance level-based evaluation process of its machine builders' designs, with emphasis on the safety aspects up front in that design process.
They don't all get it yet, said Russell. "Just because it comes from Europe with a CE-compliance stamp on it doesn't necessarily mean it's compliant with our internal standards," he explained.
The approach has been to establish a corporate minimum global standard regardless of location. Russell pointed out that machines "travel" and could be built for one region, but be relocated to another. The design standards have to be the same. Russell admitted the group had to work out the discrepancies in the early stages of standards-based assessments.
Working on the early stages of harmonization, a PepsiCo machine safety committee determined that all machines must be fully locked out/tagged out before clearing minor jams. Russell recalled objecting, "No, we can't do that. The ANSI spec doesn't require it, and many of the legacy machines aren't built for that. A full lock-out/tag-out will result in a 10-minute restart to clear a 30-second jam. What do you think the likelihood is that operators will comply with that?"
After several iterations, the committee decided to recognize reality and accept the ANSI approach that didn't dictate a full shutdown for legacy machines with infrequent faults. "But if you have a machine that has lot of faults that require manual intervention to clear the system, then we'll bring that machine up to Cat 4 safety."
Russell also spoke to the realities of getting suppliers and OEMs to comply with their internal standards. "Previously we said that machine builders had to provide their risk assessment to us," he recalled. "We got zero response to that from our machine builders. It all had to do with their lawyers and our lawyers."
The builders wanted to simply say that they deemed a particular level to be sufficient, and that's what they did. "So we changed the wording to make them provide us evidence that the machine builder had actually done a risk assessment, what standard they used and a statement of its thoroughness," stated Russell. "They had to tell us how it affected the HMI or the operator manual, for example." Russell realistically recognized this, too, is a work in progress.
Russell outlined a case study about a project he managed that he felt summarized the safety culture change process that accompanies any safety standards effort. An incident, which caused a non-serious injury on a Gatorade bottle depalletizer, was caused by an operator failing to lock out a machine before he entered it. "The operator wasn't intending to go into the machine, but during a washing operation a sensor was tripped, and a door closed, temporarily trapping him." The machine was designed to Category B integrity, and the investigation revealed other potentially dangerous operating procedures.
As he investigated this incident, he realized that another machine on the other side of the factory was the "cause" of this incident. "The older machine had servo drives and relays that required a two-hour restart after a power-off condition," said Russell. "There were other manual overrides that essentially created a "culture" to never power down the machine. This spread to other machine operators who assumed they had the same start-up problems and had better copy the required workarounds. We also had a culture fix to do."
The Gatorade machine was retrofit to Category 4, and Russell says the success criteria included no negative impacts on production. Rockwell Automation was the automation partner on this project after a series of competitive bids. Russell says Rockwell Automation made certain all safety systems were fully validated, that the technicians were trained on the SmartGuard programming software, even though the programs were locked down to require full review and approval before edits were made.
He was greatly impressed by the on-site operator training that was very interactive and incorporated the feedback of operators in many instances. "We were back in production after one week," reported Russell. "The line it was on hit 80 percent OEE the day of the restart, and there was no downtime related to the palletizer operation.
Russell closed with a cautionary phrase that has echoed through other presentations at the Safety Automation Forum to make the point about the need for safety vigilance and unbiased risk assessments that look at the details. "Don't accept the status quo," he stated. "A historical lack of incidents doesn't mean you have a safe plant."