Safety Norms: Smart Manufacturing Systems

1Purpose, Scope, and Safety Principles

These norms apply to every activity involving the physical and digital parts of a smart manufacturing system. That includes machine cells, conveyors, automated guided vehicles (AGVs), collaborative robots, programmable logic controllers (PLCs), safety controllers, human machine interfaces (HMIs), sensors, edge gateways, and the network links between production equipment and enterprise software. They cover commissioning, setup, operation, changeover, maintenance, modification, and decommissioning. Operational technology (OT) means the control systems that run machines. Information technology (IT) means the business networks and servers around them. Both must be managed together.

Three principles govern every decision. People are protected before production is protected. A safeguard is only as reliable as its verification, so each control must be tested and recorded. Any change to hardware, control logic, network configuration, or process recipe is a change to the safety case and must be reviewed before it goes live.

• Mandatory: no person enters a hazardous zone unless that zone's defined safeguards are active and verified.
• Mandatory: where local law, a standard, or manufacturer instructions set a stricter requirement, the stricter requirement applies.
• Recommended: review this document at least annually and after any significant system change.

2Roles, Competence, and Accountability

Accountability must be named in writing. The plant manager provides budget, staffing, and authority to stop work. The safety lead maintains the risk assessment and confirms that controls are in place. Each machine or cell has a controls owner, usually an automation engineer, who keeps the safety function register, the approved program baseline, and the change history. Maintenance technicians, operators, process engineers, IT and OT security staff, and contractors each have defined duties under these norms.

Competence is demonstrated, not assumed. A person may work on a system only when trained for that task, assessed as competent, and authorized in writing. Authorization should be specific. An operator may be authorized to clear one defined fault on one cell, while a controls technician may edit safety logic only under an active permit. Authorization ends when the person changes role or when a change alters the hazard.

• Mandatory: only authorized persons may modify safety controller logic, safety relays, safety network settings, or interlock parameters.
• Mandatory: no operator may bypass, jumper, override, or disable an interlock, light curtain, or emergency stop.
• Mandatory: contractors complete site induction, show their qualifications, and work under the same permit system as employees.
• Recommended: supervisors confirm competence before reassigning staff to an unfamiliar cell.

3Course-Specific Hazards and Risk Assessment

Smart manufacturing hazards combine traditional machinery risks with digital failure modes. Mechanical hazards include pinch, crush, shear, and entanglement points on robot arms, conveyors, gantries, and indexing tables. Electrical hazards include stored energy in drives and capacitors, high voltage supplies, and arc flash during energized work. Unexpected motion can result from a software fault, a corrupted recipe, a delayed network message, a mistaken remote start, or a sensor that fails in the wrong direction. Other hazards include hot surfaces, coolant mist, compressed air, hydraulic pressure, elevated platforms, noise, and collisions between AGVs and pedestrians.

Risk assessment must be documented before work starts on any new or changed system. Identify each task, hazard, and exposed group, including operators, maintainers, visitors, contractors, emergency responders, and, near loading docks or vehicle routes, members of the public. Estimate severity and likelihood, then rank risk as high, medium, or low. High risk requires engineered safeguards and a permit. Medium risk requires guarding and defined procedures. Low risk is managed through routine procedures and monitoring. Reassess after any change in hardware, software, layout, staffing, or network connection.

• Example: a collaborative robot cell must address speed and separation monitoring, force limits, tool hazards, and the new risk created when a recipe changes the gripper or payload.
• Example: a machine connected to a remote dashboard must address unauthorized commands, delayed stop signals, and loss of communications.
• Example: AGV routes near walkways require floor marking, warning lights or sounds, speed limits, and a plan for blocked paths.

4Preventive Controls and Safe Work Practices

Apply controls in this order: eliminate the hazard where practical, guard it with fixed barriers, add safety functions such as interlocks, safe speed monitoring, and safe torque off, then add warnings, procedures, and personal protective equipment. Procedures alone are the weakest control and cannot replace guarding. Safety-related control functions must be designed, validated, and maintained to the performance level set by the risk assessment, using the current applicable machinery and functional safety standards. Confirm the current edition with the competent authority or a qualified safety engineer.

Energy isolation is the most important routine control. Before anyone enters a guarded zone, reaches into a machine, or works on an energized circuit, all energy sources must be identified, isolated, locked, tagged, and tested to prove zero energy. Stored energy such as pressurized air, springs, gravity-held loads, and capacitors must be released or blocked. The person doing the work applies and removes their own lock.

Software and network changes need the same discipline as mechanical work. Use a written change request that states what changes, why, who reviews it, how it is tested, and how to roll back. Test in a non-production environment where practical. Never download unverified logic to a live machine. After a fault, do not allow automatic restart. Confirm the cause, reset the controller, verify each safety function, and document the restart.

• Mandatory: apply individual lockout and tagout and verify zero energy before maintenance, clearing jams, or entering a guarded area.
• Mandatory: use a permit to work for energized electrical work, safety logic changes, robot teaching, and work on elevated platforms.
• Mandatory: test each emergency stop, interlock, and light curtain at the frequency set by the risk assessment and after any repair.
• Mandatory: save a verified backup of controller programs, recipes, and safety parameters before any change.
• Mandatory: for robot teaching, use only the enabling device and teach pendant specified by the manufacturer, with a trained second person at the controller where the assessment requires it.
• Recommended: post start-up checklists at each cell and use visual indicators to show lock status and open permits.

5Equipment, Environment, Information, and Protective Safeguards

Personal protective equipment (PPE) is the last line of defense and must be selected from the hazard assessment. Typical requirements include safety glasses or face shields for machining, grinding, and fluid mist; hearing protection where noise measurements or the assessment require it; safety footwear; high-visibility clothing in AGV and forklift areas; and fall protection for elevated work. Gloves must not be worn near rotating spindles or conveyors where they can be drawn in. Confirm PPE ratings against manufacturer data and local requirements.

Environmental controls protect workers and neighbors. Keep coolant, lubricants, and cleaning chemicals in labeled containers with current safety data sheets at the point of use. Maintain ventilation and mist extraction at levels set by the site assessment. Collect waste oil, spent coolant, batteries, and electronic waste through approved contractors. Never discharge process fluids to drains. Clean and inspect cameras and vision sensors on the maintenance schedule, since contamination causes false readings.

Information safeguards protect people and production. Segment OT networks from business networks, restrict remote access to named accounts with multifactor authentication where supported, change default credentials before commissioning, disable unused ports, and log all remote sessions. Worker monitoring through wearables or cameras must follow local privacy and labor law. Collect only data needed for stated safety purposes, restrict access, and set retention limits.

• Mandatory: remote access to a safety-relevant machine requires approval from the controls owner and must be logged.
• Recommended: keep offline backups of critical controller programs in a secured location separate from the production network.

6Incident Reporting, Emergency Response, and Escalation

Report every injury, near miss, unexpected motion, uncommanded restart, discovered bypass, ignored alarm, or suspected cyber intrusion within the same shift. Near misses are the cheapest source of learning. Anyone may stop work when a hazard appears immediate and uncontrolled, and no one may be penalized for stopping work in good faith.

In an emergency, the first action is to stop the hazard. Press the nearest emergency stop, isolate power at the local disconnect if trained and safe to do so, and call site emergency services. Do not enter a machine envelope to reach a trapped person until all energy is isolated and locked, unless trained rescuers judge it necessary to prevent immediate death. Do not repair faults, remove guards, or clear material while the system could move. Evacuate and account for personnel at the assembly point.

Cyber incidents follow a separate path. Isolate the affected network segment only after the security lead and controls owner agree that production can be held safely, because abrupt disconnection can leave machines in unsafe states. Preserve logs, controller images, and alarm histories. Chemical spills require evacuation of the immediate area, containment only by trained staff, and notification of the environmental coordinator.

• Mandatory: report any unexpected motion to the safety lead and keep the machine out of service until the cause is determined.
• Mandatory: post emergency contact numbers, shutdown procedures, and spill kit locations at each cell.
• Recommended: run a short drill for each high-risk cell at a frequency set by the safety lead.

7Records, Training, Inspection, and Review

Records prove that safeguards exist and work. Maintain an asset register, safety function register, risk assessments, permits, change requests, validation test results, calibration records, training and authorization records, incident reports, and controller backups. Retention periods depend on local law and company policy, so verify them with the competent authority or a records specialist. Records should be controlled documents with version numbers and named owners.

Training must match the task. Provide initial training before work, supervised practice, a documented competency assessment, and refresher training after equipment, software, or incident changes. Training covers lockout procedures, emergency stop locations, permit requirements, PPE selection, cyber hygiene, and spill response. Trainers must be qualified, and content should be checked against manufacturer instructions and current standards.

Inspections and reviews close the loop. Daily pre-start checks verify guards, emergency stops, indicator lights, and visible damage. Periodic functional tests confirm safety functions at intervals set by the risk assessment. Review leading indicators such as reported near misses, overdue functional tests, open permits, and failed backups. Use findings to improve controls rather than to assign blame.

• Mandatory: remove from service any machine with a failed safety function until a qualified person repairs and validates it.
• Recommended: hold a formal management review of this document and the risk assessments at least annually.

8Conclusion and Use of These Norms

These norms are educational guidance and a starting point for locally approved procedures. They do not replace formal training, qualified engineering review, supervision, manufacturer instructions, or requirements from competent authorities. Confirm current laws, safety standards, and manufacturer documents with qualified professionals in your jurisdiction before adoption. Where a rule here conflicts with a stricter local requirement, follow the stricter requirement and report the conflict to the safety lead.

Implementation checklist

• Confirm a current risk assessment exists for the cell before work begins.
• Verify each emergency stop, interlock, and light curtain against the functional test schedule.
• Apply individual lockout and tagout and prove zero energy before entry.
• Confirm a written permit covers every high-risk task, including software and network changes.
• Back up controller programs, recipes, and safety parameters before any change.
• Confirm only authorized persons are editing safety logic or remote access settings.
• Wear the PPE specified for the task and check that gloves cannot be drawn into moving parts.
• Report every near miss, unexpected motion, and suspected cyber event within the same shift.
• Keep spill kits, emergency numbers, and shutdown procedures available at the cell.
• Verify current laws, standards, and manufacturer instructions with qualified professionals before adoption.