GB/T 20867.1-2024Robotics - Application specification for safety requirements - Part 1: Industrial robot (English PDF)

3 Terms and definitions

The terms defined in GB 11291.1-2011 apply, together with three terms restated in this part.

3.1 Risk assessment: the overall process comprising risk analysis and risk evaluation. The definition is taken from GB/T 15706-2012, 3.17.

3.2 Collaborative operation: the state in which a purposely designed robot works directly with a person within a defined workspace. The definition is taken from GB 11291.1-2011, 3.4.

3.3 Safeguarded space: the space defined by the perimeter safeguarding. The definition is taken from GB 11291.1-2011, 3.25.4.

4 Risk assessment and risk reduction

4.1 Risk assessment shall be carried out in accordance with GB/T 15706-2012 for setting, commissioning, teaching, operation and maintenance over the whole life cycle of the robot, and the necessary risk reduction measures shall be taken. A worked example is given in Annex A. A note points to Annex B of GB/T 15706-2012 for examples of common machine hazards, hazardous situations and hazardous events.

4.2 Hazard identification shall be performed for any robot and is described as the most important step of the risk assessment: only once hazards have been identified can matching risk reduction measures be taken. Its purpose is to produce a list of hazards, hazardous situations and/or hazardous events describing the accident scenarios by which a hazardous situation may lead to harm, and when. A list of typical industrial robot hazards is given in Annex B.

4.3 Risk estimation determines the highest risk of each hazardous situation, usually expressed as a grade, an index or a score, and is based on two risk elements: the severity of the harm and the probability of its occurrence. Severity is estimated in accordance with GB/T 15706-2012, 5.5.2.2; the example given divides it into catastrophic harm causing death or permanent disability with no return to work, serious harm causing severe debilitation with return to some jobs only, moderate harm requiring medical attention with return to the same job, and minor harm needing at most first aid. Probability is estimated by considering exposure of persons to the hazard, the probability of occurrence of the hazardous event, and the possibility of avoiding or limiting harm by technical or human means, each with a cross reference to GB/T 15706-2012.

4.3.4 To support the process, one of the risk assessment tools given in GB/T 16856-2015 may be selected: the risk matrix method, the risk graph method or the numerical scoring method. Hybrid tools combining these approaches may also be used.

4.4 The aims of risk evaluation are to determine which hazardous situations, if any, call for further risk reduction, and to determine whether the required risk reduction has been achieved without introducing further hazards or increasing other risks. Where protective and/or risk reduction measures have been adopted, the iterative risk assessment process is repeated to verify that the risk has in fact been reduced.

4.5 On the basis of the risk assessment result, the three-step iterative method of Figure 1 of GB/T 15706-2012 shall be followed, applying the risk reduction measures of Clause 5 to Clause 9 to bring the risk of the robot down to an acceptable level.

5 Design requirements and protective measures

5.1 The design of the general parts of the robot body shall meet the basic safety requirements of GB 11291.1-2011.

5.2.1 Robot motion is produced by power transmission parts such as motor shafts, gears, belts and chains. Where these are guarded individually and/or as a whole by fixed guards, for instance the arm housing, the clearances between guards in relative motion shall meet GB/T 12265. Where interlocking guards are used, for instance a housing carrying a contact sensing device or sensor, the safety control circuit shall reach performance level PL d as defined in GB/T 16855.1-2018 or safety integrity level SIL 2 as defined in GB 28526. Table 1 sets out the application scenarios and typical features of the two guard types: a fixed guard is used where persons are not required to enter the danger zone during normal operation and where body parts must not reach it for operating or maintenance reasons, protects persons near the safeguarded danger zone and can be removed only with a special tool; an interlocking guard prevents persons from reaching the danger zone during normal operation and, when opened, immediately interrupts or prevents the hazard.

5.2.2 Loss of or change in power covers both electrically and non-electrically supplied power such as mechanical, hydraulic, pneumatic, vacuum and magnetic power. Component selection shall take the failure rate into account and give priority to keeping the safety function of the whole circuit intact. A change in or loss of electrical power shall not cause damage to electrical components through unstable supply, functional defects caused by damaged components, a change in the posture of the arm or in the state of associated items caused by sudden interruption of supply, or any hazardous motion on restoration of supply, whether momentary or normal. Loss of or change in non-electrical power shall not cause movement, motion or tilting of the arm and its related parts, nor the falling of tools, fixtures or workpieces from the end effector. A note refers the safety design of end effectors to GB/Z 43065.1-2023.

5.2.3 All components shall be designed so as to prevent or reduce hazards arising from degradation or sudden failure during assembly, storage, transport, use and maintenance. Power transmission parts such as motors, reducers, timing belts and drive shafts shall be guarded by fixed or movable guards; the example given is an adjustable mechanical stop that prevents an axis from continuing to move in one direction when a brake fails or a drive shaft breaks. Mechanical energy storage parts such as balance cylinders, springs and balance flywheels shall carry conspicuous marking of the hazard class and hazard level together with maintenance instructions. Balance cylinders shall carry a hazard label and a pressure gauge so that the pressure can be observed, shall be maintained promptly when the pressure leaves the normal range, and shall be accompanied by instructions for the controlled release and storage of energy during maintenance.

5.2.4 The design shall prevent or reduce damage to the robot and harm to persons and surrounding equipment when the power source is lost or fails. When a motor brake is selected, its engaged torque in the de-energised state shall be less than the maximum instantaneous torque permitted for the motor and greater than the holding torque at maximum load, so that a sudden loss of supply does not subject the motor and reducer to an excessive instantaneous torque, while still braking effectively.

5.2.5 Warning markings on the robot shall state the location of stored energy devices, the type of stored energy, which may be shown graphically for capacitors, batteries, hydraulic, pneumatic and spring energy, and a text prompt. The instructions for use shall identify the stored energy devices and the measures for controlled release, with matching drawings where necessary.

5.2.6 The robot and its control system shall pass electromagnetic compatibility testing to GB/T 17799.2 and GB/T 17799.4. After passing, the design shall not be modified and shall be kept consistent with the design that was tested, failing which the tests shall be repeated.

5.2.7 The electrical design shall meet GB/T 5226.1 and shall take account of abnormal communication faults caused by electromagnetic interference, electrostatic discharge, radio frequency interference, surges and leakage in the environment of use, since such faults can burn out components, corrupt data transmission, cause abnormal shutdown and produce other hazardous motion. The example given is a controller that, for lack of interference protection, sends or omits target position data to the drive, causing a servo alarm and shock damage or an erroneous motion leading to collision.

5.3 Actuating controls that start power or motion shall be designed and constructed to meet the requirements of GB 11291.1-2011, 5.3, for protection against unintended operation, status indication, labelling and single point of control.

5.4 Safety-related parts of the control system, also called the safety control system (SRP/CS), include mechanical, electrical, programmable electronic, hydraulic, pneumatic and software parts. Their performance is expressed either by the PL and category of GB/T 16855.1-2018 or by the SIL and hardware fault tolerance of GB 28526, and where these alternative standards are used the design shall achieve an equivalent level of risk reduction. The safety-related control system shall at least meet GB 11291.1-2011, 5.4.2, corresponding to PL d and category 3 of GB/T 16855.1-2018. Alternative criteria of equivalent performance may be adopted on the basis of the risk assessment as allowed by GB 11291.1-2011, 5.4.3, in which case the corresponding category requirements of GB/T 16855.1-2018, 6.2, shall be met.

5.5 Every robot shall have a protective stop function and an independent emergency stop function, both with means of connection to external protective devices. Every control station able to initiate robot motion or another hazardous situation shall have a manual emergency stop that meets GB 11291.1-2011, 5.4, for safety performance; is placed where it is easy to reach, such as the teach pendant, the control cabinet and other control stations; uses a palm or fist operated actuator such as a mushroom head button, a pull cord switch or an unguarded foot pedal, without being limited to those types; is red against a yellow background; performs a category 0 or category 1 stop chosen on the basis of the machine risk assessment; overrides all other robot controls; stops all hazardous operation as quickly as possible and removes any other hazard under the control of the robot; removes drive power from the robot drives; remains effective until manually reset, with the circuit not restored until every actuator has been reset and with direct opening of the contacts of the actuator; does not itself start any robot motion on reset, and, if a logic error or loss of stored state is caused by the emergency stop or by a power failure, generates an emergency stop signal and permits operation only after the stored or logic sequence has been reset; and, where an emergency stop output is provided, meets Annex D of GB 11291.1-2011. A note refers to GB/T 16754 for further information.

5.5.3 The robot shall have one or more protective stop circuits meeting GB 11291.1-2011, 5.4, providing one or more means of external connection, following the manufacturer's safety distance rules when external devices are installed, performing a category 0 or category 1 stop, stopping all robot motion as quickly as possible, removing drive power, and stopping any other hazard controlled by the robot system. Reset may be manual or automatic through the control logic, and no robot motion shall occur before reset. Where the robot also offers an additional protective stop of category 2, which does not remove drive power, the stopped state shall be monitored, and any unexpected motion detected in the stopped state or any detected failure of the protective stop function shall cause a category 0 stop; detection of the stopped state shall meet GB 11291.1-2011, 5.4, and the electrical drive system shall meet the safe operating stop (SOS) requirement of GB/T 12668.502-2013.

5.6 The robot shall provide a reduced speed control function. In reduced speed mode the speed of the mounting flange of the end effector and of the tool centre point shall be not more than 250 mm/s, a means and a command shall be available for selecting a speed not exceeding 250 mm/s during operation or programming, the function shall be designed and built so that no single reasonably foreseeable fault allows the flange or tool centre point to exceed the limited speed, exceeding it shall trigger a protective stop, and the safety performance of the circuit shall meet GB 11291.1-2011, 5.4.

5.7 Operating modes comprise automatic mode, manual reduced speed mode and manual high speed mode, and the robot shall provide at least automatic mode and manual reduced speed mode, in accordance with GB 11291.1-2011, 5.7. In automatic mode an emergency stop, a servo alarm or the triggering of safeguarding shall stop automatic operation; a running program shall be paused or stopped and shall not restart until the alarm has been cleared. In manual mode automatic operation is inhibited and the robot cannot be enabled or a program started other than through the three-position enabling device.

5.8 Teach control shall meet GB 11291.1-2011, 5.8. The enabling device shall be effective in manual reduced speed mode and manual high speed mode and shall be connected to the stop circuit of the safety control system or to an equivalent safe stop circuit.

5.9 A single teach pendant may be connected to the controller of one or more robots; in manual mode all functions of the robot system shall be under the control of that single pendant, in accordance with GB 11291.1-2011, 5.9.1 and 5.9.2. All robots under one pendant shall be in the same operating mode and in the same state, for example power on or power off. The pendant shall be able to place one or more robots in the servo-off state for testing, fault finding and error recovery, and a robot in that state is not included in simultaneous motion. Robots included in simultaneous motion shall be selected individually before being activated, shall all be in the same operating mode when selected, shall be indicated clearly on the pendant, the control cabinet or the robot body, shall be the only ones allowed to move, and shall offer a means of deactivation once activated.

5.10 Collaborative operation is a state in which persons and robots share the same workspace. A robot designed for collaborative operation shall give a visible indication when in that state and shall meet one or more of the following: stop; hand guiding; speed and position monitoring; limitation of power and reaction force by design or by the control system. Under the stop requirement the robot shall stop while a person is in the collaborative workspace and may resume automatic operation once the person has left; the safety-rated monitored stop shall meet GB/T 36008-2018, 5.5.2, the robot shall be fitted with safety-rated equipment able to detect the operator in the collaborative workspace, it shall switch to the safety-rated monitored stop before the operator enters and hold that state until the operator leaves, and entry before that state has been reached shall cause a protective stop of category 0. Where hand guiding is provided, the guiding device shall be near the end effector and shall meet GB/T 36008-2018, 5.5.3; the operator may approach only after a safety-rated monitored stop has been triggered, failing which a protective stop is caused, unless the system meets the power and force limiting requirements, and the hand guiding speed shall be not more than 250 mm/s. Under speed and position monitoring a protective separation distance shall be maintained at all times and the robot shall perform a protective stop when the distance falls below it, in accordance with GB/T 36008-2018, 5.5.4.

5.10.4 The protective separation distance is evaluated by Formula (1), whose symbols are: Sp, the protective separation distance; Sh, the contribution of the change in operator position; Sr, the contribution of the reaction time of the robot system; Ss, the contribution of the stopping distance of the robot system; C, the intrusion distance defined in GB/T 19876, being the distance a body part travels into the sensing field before being detected; Zd, the position uncertainty of the operator in the collaborative workspace arising from the measurement error of the sensing equipment; and Zr, the position uncertainty of the robot system arising from the accuracy of its position measuring system.

5.10.5 Under power and force limiting the robot shall be designed so that the hazards of the system stay below the threshold set in the risk assessment. The threshold may be taken either as a maximum dynamic power of 80 W or a maximum static force of 150 N at the flange or tool centre point, or as the limits given in Annex A of GB/T 36008-2018; exceeding the threshold shall start a protective stop, and the function shall meet GB/T 36008-2018, 5.5.5. Contact risk may be further reduced by the methods of GB/T 36008-2018, 5.5.5.4, and the safe design methods listed are limiting force or torque, limiting the speed of moving parts, limiting momentum, mechanical power or energy as a function of mass and speed, safe software limits on axes and space, safety-rated monitored stop, and sensors that predict or detect contact such as approach and contact detection to reduce quasi-static forces. Testing of power and force limiting follows four rules: the applicable end effector shall be identified and its surface shall be free of sharp or keen edges, and where the end effector may itself endanger a person, for instance in welding or grinding, no collision with the operator is allowed; the robot shall run at 100 percent of the safety limited speed and the transient or clamping force simulated on body parts shall not exceed the threshold, the safety speed being reducible to keep the force below it and the speed being tested from slow to fast to avoid damaging equipment; the test point shall be the point of maximum speed on the path, the maximum speed shall be held as long as possible, and the maximum running speed shall be measured and confirmed with external equipment; and the direction of the collision force shall be perpendicular to the surface of the instrument.

5.11 In manual reduced speed mode the control shall satisfy one of the following: when coordinated motion is activated from the teach pendant, robot motion is stopped and the programmer warned before the robot passes through or corrects a singularity; an audible or visible warning is given and motion continues through the singularity with all axis speeds not more than 250 mm/s; or no additional protection is needed where the singularity can be controlled without any hazardous motion.

5.12 Means shall be provided for limiting devices that establish a restricted space around the robot, and means shall be provided for fitting adjustable mechanical stops that limit the motion of the main axis, that is the axis with the largest displacement. The manufacturer shall follow the requirements for mechanical and electromechanical axis limiting devices, for safe software limits on axes and space, or both; a note observes that this may be achieved by providing engineering information and instructions for obtaining and fitting external mechanical stops, and that safe software limits also satisfy the requirement. Mechanical and electromechanical axis limiting devices shall meet GB 11291.1-2011, 5.12.2; the limiting devices of axes 2 and 3 shall be checked before installation and use and adjustable mechanical and non-mechanical limiting devices shall be fitted; motion shall stop when the robot strikes a mechanical stop at rated load, maximum speed and maximum or minimum arm length. Safe software limits on axes and space shall meet GB 11291.1-2011, 5.12.3, and dynamic limiting devices shall meet GB 11291.1-2011, 5.12.4; where dynamic limiting devices are fitted their effectiveness shall be checked at different loads and speeds and they shall meet PL d and category 3 of GB/T 16855.1-2018 unless the safety assessment calls for another category.

5.13 Movement without drive power shall meet GB 11291.1-2011, 5.13. The instructions for use should include local drawings of the gravity and brake release devices, operating instructions and the requirement that the operation be carried out by trained or qualified persons. The warning marking shall include a graphic or symbol for the possible secondary hazard, a description of where that secondary hazard can arise, and a simple operating prompt.

5.14 Lifting provisions shall meet GB 11291.1-2011, 5.14. The lifting points shall be marked on the arm body and at the related positions and provided with warning markings, which may be graphic and shall be consistent with the instructions for use.

5.15 Electrical connectors shall meet GB 11291.1-2011, 5.15. Where separation or breakage of a connector could cause hazardous robot motion, protective measures such as binding, keying and latching shall be taken in the design.

6 Installation, commissioning and functional testing

6.1 The robot shall be installed as required by the manufacturer's instructions for use, with GB/T 12644 as supplementary guidance during installation, and the safeguarding measures shall be determined after hazard identification and risk assessment. Before use the user shall re-check the safety requirements to make sure the safeguards work reliably: all safeguards shall be tested under the intended conditions of use and any shortcomings corrected; the work tasks shall be reviewed so that safeguarding does not obstruct their completion; and the action of the safeguards shall be reviewed so that they cannot easily be defeated or bypassed.

6.2 The provisions for start-up, including first start-up, and testing after installation or repositioning apply equally after software or hardware has been replaced and after repairs affecting operation. All robots shall be fitted with safeguards; where the planned safeguards are not yet in place before commissioning and functional testing, temporary means of establishing the restricted space, such as chains, light panels and warning barriers, shall be provided before operation. Persons shall not be allowed into the safeguarded space during commissioning and functional testing until the safeguards are effective.

6.2.4 Commissioning and functional testing shall follow the manufacturer's instructions for use, with preparation in two stages. Before power-up it shall be checked that the robot is correctly installed to the instructions and is stable; that the electrical connections are correct and the supply parameters such as voltage, frequency and interference level are within the specified range; that other services such as water, air and gas are correctly connected and within their limits; that the communication connections are correct; that peripheral equipment and systems are correctly connected; that the limiting devices establishing the restricted space are fitted; that safeguarding measures have been adopted; and that the surrounding environment, including lighting, noise level, humidity, temperature and atmospheric pollution, complies. After power-up it shall be checked that the control functions such as start, stop and mode selection, including the key lock switch, work as intended and that the robot moves on the expected system commands; that each axis moves within its expected limits; that the emergency stop and safe stop circuits and devices are effective; that the robot can be disconnected and isolated from the external supply; that the teach device works normally; that safeguards and interlocks work normally and that other safeguards such as fences and warning devices are in place; that the robot runs normally and can perform work at slow speed; and that in automatic mode it runs normally and can perform the intended task at rated load and required speed.

6.2.5 When restarting after replacement of software, hardware or task programs, or after repair or maintenance, the hardware shall be checked for any change or addition before power-up, and a functional test shall be carried out for normal operation.

7 Programming

7.1 Programming shall be carried out from outside the safeguarded space. Where the programmer has to enter the safeguarded space to program, the necessary additional safeguarding measures shall be taken and the protective effect of safeguards such as interlocked gates and presence sensing devices shall be suspended through the operating state selection requirements of 5.6.

7.2 Before programming, additional safeguarding measures are required: the programmer shall be trained as required and shall practise on the actual robot until familiar with the recommended programming steps including all safeguarding measures; the programmer shall visually inspect the robot and the safeguarded space to make sure no external condition creates a hazard; the motion controls and emergency stop of the teach pendant shall be functionally tested to confirm normal operation; faults and failures shall be cleared before teaching starts; all safeguards shall be in place and effective in the intended teaching mode before the programmer enters the safeguarded space; and the programmer shall be required to perform programming operations only, not automatic operation, before entering.

7.3 During programming, additional safeguarding measures are required: only the person doing the teaching is allowed in the safeguarded space; the programmer shall have and use a teach pendant with sole control of robot motion; robot motion shall be controlled only by the teach device and the robot shall not respond to remote commands from elsewhere; the programmer shall have sole control of the motion of other equipment in the safeguarded space and that control shall be separate from the robot control; where several robots share the safeguarded space, none shall operate automatically while the safety gate of the fence is open or a presence sensing device is defeated; all emergency stop devices in the robot system shall remain effective; the robot speed during teaching shall be not more than 250 mm/s, chosen so that in the event of a hazard the programmer has time to move clear or stop the motion; and unnecessary drive power shall be switched off during programming, with any necessary balancing device kept effective.

7.4 Before starting automatic operation the programmer shall restore the functions of the safeguards that were suspended.

7.5 Records of task programs and maintenance programs shall be kept. When not in use, program data shall be stored on transferable media such as paper or disk and kept in a suitable protected environment.

7.6 Program verification confirms that the programmed path and processing performance of the robot match those expected in the application, and may cover the whole of the path or a segment. Verification shall be performed from outside the safeguarded space wherever possible. Where a person must be inside, verification shall be carried out at a robot speed of not more than 250 mm/s and, unless motion is controlled solely by a hold-to-run device or an enabling device, the safeguarding requirements for programming shall also be met. Where a speed above 250 mm/s is required so that the programmed task and its interaction with other equipment can be checked from inside the safeguarded space, the first cycle shall be run at not more than 250 mm/s and the speed then increased step by step by the programmer alone, using a key switch and proceeding with care; persons inside the safeguarded space shall use an enabling device or another device of equivalent safety level; and safe working procedures shall be established to keep the risk to persons inside the safeguarded space to a minimum.

8 Use and maintenance

8.1 Safety requirements shall be met whenever the robot is in use, including teaching and programming, program verification, automatic operation, fault finding and maintenance, and safeguarding shall be provided for every operator during use and maintenance.

8.2 Automatic operation may be started only when the intended safeguards are in place and effective, when nobody is inside the safeguarded space, and when the safe operating procedures are observed.

8.3 Fault finding shall be carried out from outside the safeguarded space. Where that is not practicable and the robot has been designed for fault finding to be done inside, the persons concerned shall be specially approved and trained for that work, persons entering shall use an enabling device to move the robot, and safe operating procedures shall be established to keep exposure to the hazard to a minimum.

8.4 Inspection and maintenance procedures shall be established, taking the manufacturer's recommendations into account, so that the robot goes on running safely. To avoid harm to maintenance personnel, safeguarding and safety training shall be provided in accordance with the manufacturer's instructions for use, and work should be done from outside the safeguarded space wherever possible, for example by moving the robot to a predetermined position. Where maintenance has to be completed inside the safeguarded space, the safeguarding measures are selected on the basis of the risk assessment. The power isolation procedure shall be used to shut the robot down and to release the stored energy in a controlled way or lock out the energy sources. Where the robot has to remain energised while maintenance personnel enter, the following steps shall be completed before entry: a visual inspection of the robot to judge whether any condition could cause a malfunction; a functional test of the teach pendant before use to confirm normal operation; and clearing or repairing of any fault or malfunction found. Once inside, maintenance personnel shall have overall control of the robot: the control shall be out of automatic operation, the robot shall not respond to any remote control signal, and all emergency stop devices shall remain effective. The functions of suspended safeguards shall be restored before automatic operation is started again.

9 Information for use

9.1 The instructions for use shall meet Clause 6 of GB 11291.1-2011; the manufacturer shall supply markings such as marks and symbols and instructions such as operating and maintenance manuals, and the instructions shall be drafted in accordance with GB/T 42598.

9.2.1 Users shall make sure that their programming, operating and maintenance personnel attend safety training and become competent for the work, and the training should be combined with the operating site.

9.2.2 The objectives of training are that participants understand the purpose and function of the safety devices, the procedures specific to health and safety, the various hazards created by robot operation, the tasks and applications associated with the particular robot, and the basic concepts of safety.

9.2.3 Training shall cover the applicable safety procedures and the safety recommendations of the robot manufacturer; a clear understanding of the assigned tasks; the identification and explanation of all control devices and their functions used to carry out the assigned task, such as slow speed control, teach pendant operation, emergency stop procedures, isolation procedures and single point of control; the identification of hazards associated with the work, including those from auxiliary equipment; the identification of safeguarding measures, including the types of safeguard, their capability or selection options, the function of the selected devices, the methods of testing those functions, the limitations of the selected devices, the safe working steps starting from hazard identification, and personal protective equipment; and the test methods that confirm the correct functioning of safeguards and interlocks.

9.2.4 Safety retraining shall be given to the persons concerned after a change to the system, a change of personnel or an accident, so that safe operation is maintained.

A Annex A (informative) Example of robot risk assessment

A.2 The example is a welding robot operated by trained personnel in continuous production for 16 h a day. During normal production the operator does not need to enter, but the process requires the operator to approach the welding robot area for work on the robot body and for maintenance, normally entering the danger zone 4 to 6 times every 8 h for 5 min each time.

A.3 The hazard identified is impact or cutting of the upper limbs or body of the operator inside the restricted space, caused by the motion of the welding robot mechanism and by the forward and backward movement of the turntable. A note states that Annex B of this document, based on Annex A of GB 11291.1-2011, gives the main hazards of typical industrial robots.

A.4 The risk graph method of GB/T 16856-2015, 6.3, is selected. Severity of harm is divided into S1, slight harm that is normally reversible, such as abrasions, lacerations and scratches needing first aid, and S2, severe harm that is normally irreversible, including death, amputation, tearing or crushing of limbs, fractures, injuries needing sutures and severe skeletal damage. Frequency and/or duration of exposure is divided into F1, rare to frequent exposure of short duration, meaning not more than twice per shift or a cumulative exposure of not more than 15 min per shift, and F2, frequent to continuous exposure of long duration, meaning more than twice per shift or a cumulative exposure of more than 15 min. Probability of occurrence of the hazardous event is divided into O1, low, meaning improbable and assumed not to occur, with proven and recognised technology of established safety and rugged construction; O2, medium, meaning possible and occasional, with technical faults observed within the last 2 years, or inappropriate operation by well trained personnel aware of the risks with more than 6 months of experience in the post; and O3, high, meaning frequent, with technical faults observed every 6 months or less, or inappropriate operation by untrained personnel with less than 6 months of experience. Possibility of avoiding or limiting harm is divided into A1, possible in certain circumstances, for instance where the welding robot moves at not more than 250 mm/s and the exposed operator is familiar with the risk and with the signs of an imminent hazardous event and can perceive and react to the hazardous situation, subject to conditions such as temperature, noise and ergonomics, and A2, not possible.

A.4.2 In the example the parameters are set as follows. Severity is S2, because operators moving inside the restricted space during robot operation risk being struck in the event of a wrong operation, with fatal or crushing injuries and more than 2 d of lost working time. Frequency is F2, because entry 4 to 6 times per shift at 5 min each exceeds a cumulative 15 min. Probability is O2, because the safety product function parts around the robot are not functionally safety certified and a safety failure was recorded within 3 months, while frequent shift changes and rapid turnover of new operators increase the chance of error. Possibility of avoidance is A2, because the robot is fast, the danger zone is large, operators can easily approach the range of motion, and a safety distance is required when the safety device triggers the stop.

A.4.2.5 In the risk graph each node stands for a risk parameter and each branch for a level of that parameter; for every hazardous situation a level is assigned to each parameter, the path runs from the starting point along the branch chosen at each node, and the final branch points to the risk level or risk value associated with that combination. The result is a qualitative risk level or risk value expressed in words, numbers or letters, for example low, medium and high, or 1 to 6, or A to F.

A.5 The risk evaluation notes that the up and down movement of the welding robot mechanism can crush or draw in the hands of personnel and at worst cause death, and that the operator is exposed because the welding wire has to be changed and the cell cleaned every 2 h. Without any protective measure the risk index is 5 and the risk level is high, which is not acceptable.

A.6 Risk reduction follows the three-step method in order. The first step, inherently safe design, keeps the welding robot speed at not more than 250 mm/s while the operator is commissioning in manual mode. The second step, safeguarding and complementary protective measures, encloses the robot body with a fence to reduce direct contact, uses an interlocking device on the safety gate to stop the robot immediately when the operator enters the danger zone of the robot body, and adds presence detection such as an area scanner or an artificial intelligence warning device to prevent unexpected start-up while the operator is working in the danger zone; where SRP/CS measures are chosen, the safety level shall reach at least SIL 2 or category 3 with PL d, as required by 5.4. The third step, information for use, includes safety markings warning of the residual risks at the different life cycle stages, operating instructions and related training, and administrative and regulatory measures.

A.7 After the measures have been taken the risk assessment is repeated until an acceptable level is reached. With a safety gate switch on the opening of the fence, controlled through the safety circuit, the welding robot stops, and an area scanner or artificial intelligence warning device can determine that a person is inside the area so that the equipment cannot start on a safety reset. This combination reduces the frequency of exposure in the danger zone from F2 to F1 and the possibility of avoidance from A2 to A1; with the probability parameter unchanged, the risk becomes acceptable, with a risk index of 2 and a low risk level. The same process is applied to every risk point identified by the risk analysis.

B Annex B (informative) List of typical industrial robot hazards

Annex B is based on the list of main hazards in Annex A of GB 11291.1-2011 and uses the hazardous situations and hazardous events of a welding robot application as its example. Table B.1 is laid out in columns for the hazard category, the life cycle task, the danger zone, the hazard, the hazardous event and the accident scenario.

The hazard categories listed are mechanical hazards, electrical hazards, thermal hazards, noise hazards, ergonomic hazards, unexpected start-up and unexpected overtravel or overspeed, and combined hazards. The life cycle tasks named are teaching, maintenance, setting, operation, 5S cleaning, dismantling, packing and transport, and setting and running.

The mechanical hazards named are impact, cutting or severing, entanglement, drawing-in or trapping, crushing, shearing, stabbing or puncture, roll-over, and slipping, tripping or falling. The electrical hazards named are contact with live parts, indirect contact with live parts and electromagnetic interference; the thermal hazards named are fire, burns or scalds and harm from radiated heat sources. The ergonomic hazards named include unhealthy posture or overexertion through repeated effort, insufficient allowance for the anatomy of arms and legs, poor design, location or marking of manual controls, and poor design or location of visual display units.

The danger zones named include the robot area and the restricted space, the area between the robot and fixed objects, the electrical control cabinet, terminal boxes and control panels on the machine, the distribution cabinet, the robot system, the operating area, the teach pendant, the loading and unloading and tool setting positions, and positions at or near the robot cell.