GB 4943.23-2012Information technology equipment - Safety - Part 23: Large data storage equipment (English PDF)

1 Scope

The requirements of this part of GB 4943 apply to information technology equipment that has its own data storage system and that carries hazardous moving parts. Such data storage systems are typically large enough to allow a person to enter them completely; they also include similar large equipment that allows a whole limb or the head to enter an area where hazardous moving parts are present. The requirements of this part are additional to the relevant requirements of IEC 60950-1. The storage assembly typically moves through a three-dimensional space of 0.75 cubic metres or more.

Such equipment shall be installed in a restricted access area, for example a data centre. The exceptions of 2.1.3 and 4.5.4 mentioned in the note to 1.2.7.3 of IEC 60950-1:2005 do not apply to this part.

NOTE 1 Examples of the equipment covered by this part: automatic mass information storage and retrieval systems that use hazardous moving parts to handle recorded media (for example magnetic tape drives, film cartridges, optical discs) and that have similar functions.

This part does not apply to equipment that does not itself contain hazardous moving parts, for example robot equipment installed in an industrial environment.

NOTE 2 For the relevant standards on robot equipment in industrial environments see GB 5226.1, GB 5226.3 and GB 11291.1.

2 Normative references

The following documents are indispensable for the application of this document. For dated references only the edition cited applies; for undated references the latest edition, all amendments included, applies.

GB/T 14048.14-2006 Low-voltage switchgear and controlgear — Part 5-5: Control circuit devices and switching elements — Electrical emergency stop device with mechanical latching function (IEC 60947-5-5:1997, IDT).

IEC 60950-1:2005 Information technology equipment — Safety — Part 1: General requirements.

IEC 60073:2002 Basic and safety principles for man-machine interface, marking and identification — Coding principles for indicators and actuators.

IEC 61058-1 Switches for appliances — Part 1: General requirements.

3 Terms and definitions

The terms and definitions given in IEC 60950-1 and the following apply to this document.

3.1 work cell. The space inside the equipment where a mechanical hazard is present, whose dimensions are such that the human body can enter it in whole or in part (for example a whole limb or the head).

NOTE A work cell may include more than one compartment. A compartment may be used for working or for maintenance purposes.

4 Protection of persons inside the work cell

During normal use, the hazards within the meaning of IEC 60950-1 shall not be accessible on the outer surface of the enclosure of the equipment.

The equipment shall be provided with safeguards that reduce the risk of injury caused inside the work cell by hazardous moving parts. In order to prevent other hazards, the work cell shall be regarded as an operator access area.

NOTE 1 Safeguards include interlock devices, baffles and explicit signals, together with the necessary procedures and training.

NOTE 2 The design should take account of the case where some authorities may require a flame detection and extinguishing system to be installed inside the work cell.

Access to the work cell or to any of its compartments should be controlled by one of the following methods. Method 1: no key or tool is needed to enter the work cell. An interlock device meeting the requirements of 2.8 of IEC 60950-1:2005 shall be provided to prevent access to the work cell while hazardous moving parts inside the compartment are energised. Power to the moving parts may be restored only after the door has been closed and locked. Method 2: a key or tool is needed to enter and control access to the work cell. Access to the work cell while hazardous moving parts inside the compartment are energised shall be prevented. Suitable instructions shall be given in the operating and maintenance manual, and the key or tool must be carried by the person entering the work cell.

NOTE 3 A key or tool may be used as a means of removing power before the work cell or the compartment is accessed.

When the interlock device of the door of any compartment of a work cell containing hazardous moving parts is opened, or the interlock device of the door between a compartment containing hazardous moving parts and one that does not, the drive power of those moving parts shall be cut off automatically and they shall come to a complete stop within 3 s without the need for software control.

Except in the case permitted by 5.1, it shall not be possible to start or restart the system unless all the relevant doors have been closed and locked.

If complete entry into a work cell is possible, a mechanical interlock device that can be triggered automatically shall be provided so that the door cannot be closed unintentionally. If the closing system is allowed to be restarted, it shall be possible to open the door from inside the work cell without using a key or a tool. Whether the door is open or closed, and whatever the operating state of the equipment, the way of opening the door from inside the work cell shall be easy to identify and conspicuous.

Compliance is checked by inspection.

5 Interlock override function

5.1 Basic requirements. If it is necessary for maintenance personnel to override the safety interlock function in order to enter the work cell or a compartment, an override system meeting the requirements of 2.8.6 of IEC 60950-1:2005 shall be provided. Moreover, when that override system is used, an emergency stop system shall be provided in accordance with the requirements of clause 6, and that system shall meet the endurance test requirements for the operation given in clause 7. Compliance is checked by inspection.

5.2 Visual indicators. A device made up of a set of two or more bright flashing indicators meeting the requirements of IEC 60073:2002 shall operate in the following cases: a) for a work cell or compartment that can be entered completely, to indicate that the equipment is returning to normal operation and that movement is in progress; or b) for any equipment, if the interlock device has been overridden and the drive power of the hazardous moving parts is still present.

The indicators shall be conspicuous at any position inside the work cell or the relevant compartment and at the position where it is entered. For case a), the indicators shall flash for at least 10 s before the hazardous moving parts move along the most unfavourable axis. If case a) also occurs when case b) occurs, the flashing frequency of the indicators shall be changed so that the change of state is conspicuous to persons inside the work cell or entering it.

NOTE The direction of the most unfavourable axis is usually the horizontal (X) axis.

Compliance is checked by inspection and test.

6 Emergency stop system

This clause applies only where the function of overriding the safety interlock laid down in clause 5 is provided.

The emergency stop system shall be able to override all other controls, remove the drive power of the hazardous moving parts and engage the automatic braking device and, where necessary, bring all moving parts to a stop.

The components of the emergency stop system shall be electromechanical components. The control device of the emergency stop system may be made up of the following: a switch meeting the requirements of IEC 61058-1 and also satisfying 2.8.4, 2.8.7 and 2.8.8 of IEC 60950-1:2005, that switch having a latching mechanical device meeting GB/T 14048.14 or an equivalent requirement; or an emergency stop system meeting the requirements of GB/T 14048.14.

NOTE 1 In the United Kingdom, where a risk of personal injury exists, the emergency stop system shall meet the requirements of GB 5226.1 and GB 16754.

The mechanical system may be restarted only after the emergency stop control has been reset by hand and an initial start-up control procedure has then been initiated.

For equipment that the human body can enter completely, the emergency stop system shall include at least two emergency stop control devices, one outside the work cell and one inside it. The system start-up procedure shall include a non-hazardous method of making sure that nobody is inside the work cell at that moment. After the single fault test of clause 8 has been applied to the motion control circuit or to other sensing means, if it can be shown that the test will not bypass the non-hazardous start-up procedure, the emergency stop distance test of this clause is not carried out.

For equipment that the human body can enter only in part, whether the work cell or a compartment, at least one emergency stop control device shall be provided outside the work cell. The emergency stop system shall be operable by the person who has to enter the work cell.

The emergency stop control device outside the work cell shall be easy to see and shall be mounted on the equipment so that the operator can see whether the work cell is occupied. The installation instructions shall indicate that space is to be left around the control device so that operating or maintenance personnel can reach it easily and actuate it.

The emergency stop control device inside the work cell shall be easy to reach from any place inside the work cell and shall be provided with illumination that makes it easy to identify. It shall consist of a red palm-operated or mushroom-head button, or an indirect arrangement shall be provided (such as an easily identifiable red safety cable that actuates the emergency stop system).

Compliance is checked by inspection and, where necessary, by the following test. When the mechanical system is running at its maximum kinetic energy (bearing the maximum load at maximum speed), the emergency stop system is actuated and the stopping distance is measured. The result of the distance measurement shall show that the subsequent movement in any direction after the emergency stop system has been actuated will not give rise to a risk of injury.

Along the most important axis, the maximum stopping distance from the point of actuation shall be not greater than 1 m. In addition, if there is an end point along the most important axis beyond the position that the hazardous moving parts cannot reach, there shall be a space of at least 150 mm between that end point and the nearest fixed mechanical part, so as to leave enough space for a person not to be injured. The requirements of clause 8 apply.

NOTE 2 The direction of the most unfavourable axis is the direction with the longest travel distance. It is usually the horizontal (X) axis.

7 Endurance test

Apart from what is mentioned in clause 6, this clause applies only to the function of overriding the safety interlock laid down in clause 5, or to the case where cables accessible to the operator carry a hazardous voltage.

The moving cable assemblies are examined to make sure that mechanical damage that could lead to any of the following situations will not occur: failure of the safety interlock system; damage to the separating partition of a compartment or to the mechanical enclosure; exposure of persons to other hazards.

If, under normal operating conditions or after a single fault, the voltage of the cables and of the motion control circuit exceeds the limit values of an SELV circuit, a mechanical endurance test shall be carried out to make sure that there is no risk of electric shock.

If it can be shown that a single open-circuit or short-circuit fault test on the cables and on the motion control circuit does not give rise to a hazard, the mechanical endurance test is not carried out on cables that only carry circuits meeting the requirements for SELV circuits.