Handbook

Machine Safety
 This handbook is supporting the procedure:

“Machine safety” – HMESC: 01.40.04.711

has a complimentary content and gives guidance to implement the

procedure in a proper way.

Note:
♦ Always refer to the procedure for mandatory items and check for the latest versions.
♦ Many countries have specific laws or regulations regarding this subject – always check those
requirements in your country.

2
 Contents

♦ Introduction

♦ Machine risks

♦ Machines at Heineken
♦ Assuring safety for existing machines
♦ Assuring safety for new machines
♦ Modifications
♦ Emergency Stop requirements for
(SCALE) packaging lines
♦ Performance Levels
♦ Relation with TPM safety pillar

3
 Introduction

♦ Machine safety is a complex subject!

♦ Standards and guidelines differ for (nearly) each country.

♦ This handbook gives a basic introduction on machine safety in

general and information on how to apply the Heineken procedure
“machine safety”.

4
 Machine definition

♦ An assembly of linked parts or components, at least one of which

moves, with the appropriate actuators, control, and power circuits,
etc., joined together for a specific application, in particular for the
processing, treatment moving or packaging of a material.

♦ Source: Machine directive 2006/42/EC

5
 Machine risks (1/2)
Thermal hazards (contact
with hot steam/water, hot
surface)

Electrical hazards
(contact of non-
isolated life electrical
wires or open electrical
cabinets)

Mechanical hazards (puncturing,

stabbing, shearing, severing,
cutting, catching, entanglement,
drawing in, trapping, impact,
crushing)

6
 Machine risks (2/2)

♦ Hazards due to noise

♦ Hazards due to vibration
♦ Hazards due to radiation
♦ Hazards due to materials and substances
♦ Hazards due to neglecting ergonomic principles during the design
of a machine
♦ Hazards due to slipping, tripping and falling
♦ Hazards related to surroundings in which the machine is used
♦ Hazards due to sudden release of energy (pressure,
defragmentation of grinder, potential energy, etc.)

7
 Machine risks example
Electrical
hazard

Electrical
hazard

Mechanical
hazard
Mechanical
hazard

8
 Mechanical
hazard
Machines at Heineken
Examples of hazards

Electrical
hazard

Mechanical
hazard

Release of energy
(pressure)

9
 Accidents in the past
In 2010 (Madrid) an operator died in a depalletizer.

The deadly accident in Madrid showed a non-safe design of the depalletizer. After this accident
all depalletizers were improved. During the improvement of the depalletizer in Vialonga in 2011
another operator died.

10
 Accidents in the past
Manchester, UK 2013

Zoeterwoude, Netherlands 2012

Every year there are multiple

incidents with machines,
leading to amputations, lost
work days, etc. Massafra, Italy 2012

11
 Machines at Heineken
♦ Within Heineken we defined the machines with the highest risk based on
the different types of hazards. These machines are marked as Heineken
critical safety machine and has a high priority in implementing measures.
Critical safety machines are:

■ (De-)palletizer (s) ■ Pallet conveyor turning station

■ Automatic empty crate / pallet (de-) stacking
buffer ■ Pallet shrink (de-)foil machine
■ Pallet lift ■ Can seamer
■ Labeller ■ Rotating bottle - can - keg:
■ Crate (un)packer filler/rinser
■ Bottle washer ■ Blow moulder

♦ Note: cooling and steam installations, are covered via other procedures

12
 Assuring safety
for existing machines
♦ The following 6 steps shall be
taken (each step is described
afterwards):
1. Check inventory of machinery

2. Check completeness of
inventory list
3. Check compliance of machinery

4. Take corrective actions in case

of non-compliance
5. Determine the effectiveness of
corrective actions
6. Update and re-issue inventory
list

13
 Assuring safety for existing machines
Step 1: Check inventory of machinery

♦ All machinery shall be identified, on an

inventory list and tagged
♦ Every year the inventory list shall be checked

14
 Assuring safety for existing machinery
Step 2: Check completeness of inventory list
♦ The following information has to be present for each machine:
■ Machine type ■ Year of manufacturing
■ Identification (tag) ■ Year of installation
■ Location ■ Relevant requirements
■ Functionality ■ Conformity status per relevant
■ Heineken Critical safety machine requirement (j)
(yes/no) ■ Declaration of Conformity (yes/no,
■ Brand including date)
■ Supplier ■ Modifications (if yes, including date)
■ Date of last inventory check
Inventory list
Location
Date Document number:

General
Identification

Declaration of Modifications?
Location

Critical safety Year of Year of Relevant Conformity conformity If yes include Date of last
Machine type Functionality machinery? Brand Supplier manufacturing installation requirements status date? the date inventory check

15
 Assuring safety for existing machinery
Step 3a: Check compliance of machinery
♦ Determine if all existing machinery is compliant with relevant
requirements. The following requirements apply:
1. Local legal requirements (non-EU)
2. Legal requirements (Work Equipment Directive 89/655/EC)
3. Legal requirements (Machine Directive 98/37/EC)
4. Legal requirements (Machine Directive 2006/42/EC)

♦ The compliance check can be done by using third party or internal experts
if available and capable.

16
 Local requirements
♦ To meet local requirements, perform a compliance check on local law
for instance:
■ within Europe by using guides and directives http://ec.europa.eu/
and http://www.newapproach.org/Directives/DirectiveList.asp.
■ in Mexico: regulation DOF 21.10.1997.

■ in Brazil: NR-12 (new and used machines)

17
 Assuring safety for existing machinery
Step 3b: Check compliance of machinery
♦ Determine if all existing machines are compliant with additional
Heineken safety requirements:
Existing machines Scope Local Legal Critical safety
compliance machine
(appendix A checklist
procedure) compliance

Non-critical safety
X
machines

Critical Safety X X
Machines

■ Critical safety machines has to comply with the Critical Safety Machine checklist
(HMESC 01.40.04.723). The compliance checks on (de-)palletizers executed
before 1st of November 2014, based on the (de-)palletizer checklist, are
considered valid.

■ Every existing critical safety machine (including (de-)palletizers not being

assessed before the 1st of November 2014) need to meet the requirements of
critical safety machine checklist (HMESC 01.40.04.723).

18
 Assuring safety for existing machinery
Step 3b: Check compliance of machinery
♦ Critical Safety Machine checklist (HMESC 01.40.04.723) is
mandatory to use for all critical safety machines.

♦ The safety check of (de-)palletizer

should be done by third party
(in example TÜV).

♦ Any other existing critical safety

machine can be checked by third party
or internal experts if available and
capable, by using the checklist.

Critical Machine
Safety Checklist

19
 Assuring safety for existing machinery
Step 3b: Check compliance of machinery

♦ The Critical Safety Machine checklist consists of seven main items:

1. Documentation

2. Electrical hazards

3. Mechanical hazards

4. Other hazards

5. Lockout tagout

6. Access to danger zone

7. Additional safety requirements for specific machine

Appendix A. Additional safety requirements for CE compliance

(optional)

♦ Based on the checklist an action plan shall be drawn showing how

and when the non-compliances are solved.

20
 Heineken Critical safety machines checklist
Examples
5.4 Are lock-out devices
and tag-out devices
available?
 Yes, complaint (score 8)

2.2 Control Panels / Electrical

Cabinets shall be tidy and
clean.  Non-compliance
(score 1)
3.1.2 EMO / EMS devices:
♦ are marked with EMO/EMS
♦ are red with yellow background
♦ are in a good condition
(conductors, seals, strain
relief,…)
 Compliance (score 8)

21
 Check compliance of machinery
Examples

♦ De-palletizer bought in 1998 in Austria (entry date EU: January 1995):

■ This de-palletizer shall meet the local legal requirements, at least the Work
Equipment Directive 89/655/EC and the Machine Directive 98/37/EC shall be
followed.

♦ De-palletizer bought in 1998 in Austria (entry date EU: January 1995) and
assessment with Heineken requirements done before 1st November 2014:
♦ To comply with Heineken requirements the (de)palletizer shall be assessed using
the (de-)palletizer checklist (HMESC 01.40.04.722).

♦ De-palletizer bought in 1998 in Austria (entry date EU: January 1995) and
assessment with Heineken requirements done after 1st November 2014:
♦ To comply with Heineken requirements the (de)palletizer shall be assessed using
the Heineken Critical Safety Machine checklist (HMESC 01.40.04.723).

22
 Check compliance of machinery
Examples

♦ De-palletizer bought in 1998 in Nigeria:

■ This de-palletizer shall meet the local legal requirements

♦ De-palletizer bought in 1998 in Nigeria and assessment with

Heineken requirements done before 1st November 2014:
♦ To comply with Heineken requirements the (de)palletizer shall be
assessed using the (de-)palletizer checklist (HMESC 01.40.04.722).

♦ De-palletizer bought in 1998 in Nigeria and assessment with

Heineken requirements done after 1st November 2014:
♦ To comply with Heineken requirements the (de)palletizer shall be
assessed using the Heineken Critical Safety Machine checklist (HMESC
01.40.04.723).

23
 Assuring safety for new machinery
Step 3c: Check compliance of machinery
♦ Heineken requirements for new machines (2013-2014 changes):

■ As of January first 2014 every new SCALE-machine shall meet

the requirements as indicated in previous procedure (HMESC
01.40.04.711 version November 2013). These requirements
haven’t changed and are the same in the current version of the
procedure (HMESC 01.40.04.711 version November 2014).

■ In the previous procedure (HMESC 01.40.04.711 version

November 2013), requirements for new non-SCALE-machines
was limited only to local legal requirements. As of November
first 2014 based on the current version of the procedure
(HMESC 01.40.04.711 version November 2014) for every new
non-SCALE-critical safety machine CE is mandatory while for
any other non-SCALE new machine the requirements didn’t
change.

24
 Assuring safety for new machinery
Step 3c: Check compliance of machinery

New Category Local Legal CE Safe Testing Noise Performance

machines compliance Conformity interventions safety map level
(including (LOTO) devices
assemblies)
SCALE X X X X X X

non- SCALE
critical safety X
X X X X
machines
(EU and non-EU)
non- SCALE
non- critical safety
X X X
machines (non-
EU)

25
 Assuring safety for new machines
(Non-SCALE, critical and non-critical)
The machines are prepared for Lock Out to lock energy sources:
 Electrical energy (conductors, motors, generators)
 Mechanical energy
 kinetic energy (moving objects)
 or potential energy (springs, weights, suspended loads)
 Hydraulic energy (water, oil, other fluids)
 Pneumatic energy (compressed air and gases)
 Chemical energy (energy from flammable, combustible or corrosive
substances)
 Thermal energy (steam, hot water, fire) and
 Other sources like radiation (lasers, X-rays)

A description of Lock Out instructions should be included in the Operation

and Maintenance instructions.

♦ For more information see procedure and handbook Safe interventions

(including Lockout Tagout) HMESC 01.40.01.702.

26
 Assuring safety for new machinery
(Non-SCALE, critical and non-critical)

♦ During installation the

supplier shall demonstrate
that all installed
equipment (including
safety devices) have been
tested, for instance by
following an installation
completed protocol.

27
 Assuring safety for new machines
(SCALE, critical and non-critical)

♦ Next to all requirements for non-SCALE equipment, the following

additional requirements apply:
■ Noise map

■ Safety during installation

■ Quality assurance

■ Risk assessment

28
 Assuring safety for new machines
(SCALE, critical and non-critical)
♦ Noise map
Machines shall not exceed noise limits of 85 dB(A). Supplier
delivers a noise map in the engineering phase. In case of
extraordinary noise (> 85 dB(A)) approval is requested from
Heineken and additional noise protection measures are taken.
Heineken is taking responsibility for the acoustics of the building
(reverberation time < 1.0 s).

29
 Assuring safety for new machines
(SCALE, critical and non-critical) Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting
See checklist Critical
Safety Machines
See checklist (C.S.M.) § 4. In case guard with
(De)palletizer
Critical Safety of use of light Mechanical block key in pocket,

Performance level: The performance level

green level
Machines curtains, see ESPE with read out plus or see Critical Safety

♦
(C.S.M.) § 3.7 light curtains green access release of transponder One hand, PLe, Machine checklist See C.S.M. § 4. PLd,
PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 §6.6 to 6.9. PLd, cat 3 cat 3
See C.S.M. § 4. In guard with
case of use of light Mechanical block key in pocket,

(PL) is a value used to define the ability of

curtains, see ESPE with read out plus or see Critical Safety
Automatic empty See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
crate buffer 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 4 cat 3
See C.S.M. § 4. In guard with

safety-related parts of control systems to

case of use of light Mechanical block key in pocket,
curtains, see ESPE with read out plus or see Critical Safety
See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
Pallet lift 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 5 cat 3
See C.S.M. § 4. In

perform a safety function under foreseeable

case of use of light with access
curtains, see ESPE via control
See C.S.M. § light curtains green panel, PLc, One hand, PLe,
Labeller 3.7. PLd, cat 3 level N.A. cat. 2 cat 3 N.A. N.A.
depending on

conditions.
layout of the
machine type
a guard with See C.S.M.
key in pocket, checklist §6.8.
(Un)packer
See C.S.M. § 4. In or For robotic arm

Required performance level to be

case of use of light Mechanical block transponder (un)packer,

♦
curtains, see ESPE with read out plus (PLd, cat 3), One hand or
See C.S.M. § light curtains green access release of dual channel two hand, PLe, See C.S.M. § 3. PLd,
3.7. PLd, cat 3 level door. PLd cat 3 with I-L-O cat 3 N.A. cat 3

determined; with access

via control
For robotic arm
(un)packer,
One hand or

Apply checklist “Determination Safety

See C.S.M. § panel, PLc, two hand, PLe, See C.S.M. § 3. PLd,
Bottle washer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 3 N.A. cat 3

♦ Pallet conveyor
turning station /
See C.S.M. § 4. In
case of use of light
curtains, see ESPE
Mechanical block
with read out plus
guard with
key in pocket,
or
ESPE, light curtain,
light curtains

Functions”;
pallet (de-) See C.S.M. § light curtains green access release of transponder pallet/product entry See C.S.M. § 3. PLd,
stacking 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. with muting cat 3
See C.S.M. § 4. In guard with For robotic arm
case of use of light Mechanical block key in pocket, (un)packer, see Critical Safety
curtains, see ESPE with read out plus or One hand or Machine checklist

Reference: EN-ISO 13849-1 Safety of

Pallet shrink (de-) See C.S.M. § light curtains green access release of transponder two hand, PLe, §6.2, §6.5 and § 6.10. See C.S.M. § 3. PLd,

♦
foil machine 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 PLd, cat 3 cat 3

For robotic arm

with access (un)packer,

machinery - Safety-related parts of control

via control One hand or
See C.S.M. § panel, PLc, two hand, PLe,
Can seamer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 4 N.A. N.A.

For robotic arm

systems - Part 1: General principles for

key in pocket, (un)packer,
or One hand or
Rotating bottle - See C.S.M. § transponder two hand, PLe,
can -filler 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 5 N.A. N.A.

design;
For robotic arm
with access (un)packer,
via control One hand or
Rotating - keg: See C.S.M. § panel, PLc, two hand, PLe,
filler/rinser 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 6 N.A. N.A.

For robotic arm

key in pocket, (un)packer,
or One hand or
See C.S.M. § transponder two hand, PLe,
Blow moulder 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 7 N.A. N.A.

30
 Assuring safety for new machines
(SCALE, critical and non-critical)
Supplier requirements
♦ Safety during installation: the supplier have to provide a project
specific Health and Safety plan (see contractor safety procedure,
HMESC 01.40.01.512) before the works starts.

♦ Quality assurance
The supplier will ensure that safety is integrated in
his quality assurance system according to ISO 9001
certified by accredited third party. At all times
Heineken/OpCo shall have the right to initiate incidental
audits of the supplier’s quality assurance system.

♦ Risk assessment
(Pre) Engineering phase: Supplier agrees to cooperate in risk
assessment studies. The type of risk assessment depends on the
risks, use for instance HAZOP or workplace risk assessment.
31
 Integration of new machinery into existing
installations
(SCALE, critical and non-critical)
When a machine is going to be integrated as part of the installation the following applies:
Declaration of conformity of the new assembly:
When the new machine is integrated into existing installation that before that integration was
meeting requirement of CE (as a result this line is located within EU) the supplier of this new
machine shall declare that after integrating this new machine into the existing installation the
safety is assured and be confirmed by Declaration of Conformity for the new assembly.
Risk assessment for the new assembly
When a new machine is integrated into an existing installation that was not CE compliant (for
example an existing line located outside EU), the supplier of this new machine shall perform a
risk assessment of the new assembly and make it available to the owner of the installation.
New machines Location Declaration of conformity of Risk assessment for the new
new assembly assembly

Within EU X X

Outside EU X

32
 Assuring safety for new machinery
Commissioning Documents (all machines)

♦ The following documents will be supplied to Heineken before

commissioning for all machines:
■ Instruction (Operations and Maintenance) Manual for every single
machine, according to European Machinery Directive (including S&H
requirements) provided in the local language. Within EU an O&M Manual
for the whole installation is required which describes the risks of the
interaction of machines. Outside EU only residual risk report is
required.
■ Description of all installed safety equipment and devices (e.g.
emergency stops, interlocks, light barriers, etc.).
■ Report of the Supplier demonstrating that all installed equipment
(including safety devices) have been tested according to supplier
instructions with positive results.

33
 Assuring safety for new machinery
Commissioning Documents (critical safety
machines and SCALE machines)
♦ The following additional documents will be supplied to Heineken
before commissioning for all non-SCALE critical safety machines
and all SCALE machines:
■ CE Declarations of Conformity.

34
 Assuring safety for new machinery
Commissioning Documents (SCALE machines)

♦ The following additional documents will be supplied to Heineken

before commissioning for all SCALE machines:

■ Conformity assessment (report) for every of Heineken Critical

Safety Machines
■ Within EU: Declaration of conformity whole installation and
O&M Manual for the whole installation where the new machine
has been installed (which describes the risks of the interaction
of machines)
■ Outside EU: Risk assessment report for the whole installation
where new machine has been installed

35
 Conformity assessment
Examples

♦ Bottle washer (SCALE critical

safety machine) to be installed
in Congo:
■ Type approval available at GSC
(no remaining gaps)
■ To be commissioned at the
brewery

♦ The following document are

present
after successful commissioning:
■ CE documents for bottle
washer
■ Conformity assessment report
(no remaining gaps)

36
 Assuring safety for existing machines
Step 4: Take corrective actions in case of non-
compliance
♦ When non-compliance of any part of a machinery is detected this
machinery shall be upgraded and improved by means of corrective
actions to meet all relevant requirements as mentioned in the
inventory list.

♦ An improvement plan is to be drafted:

■ Based on checklists, like the checklist
for critical machine safety checklist;
■ A due date is given for each action;
■ All corrective actions shall follow the principle of the Hierarchy of
Control:
● First eliminate the hazard

● If not possible, substitute

● If then not possible (re-)engineer

● If then not possible put procedures/training in place, etc.

37
 Example of corrective actions:
Elimination

♦ The reset button is moved to a safe place.

♦ Before there were obstacles with a risk of

stumbling, after there are no obstacles and
the risk is eliminated.

38
 Example of corrective actions:
Substitution
♦ Automatic lubrication system instead of manual
lubrication.
♦ Before risk on entrapment, after substitution this risk is
no longer there.

39
 Example of corrective actions:
Engineering

♦ Before there was a mechanical hazard, by taking engineering

measures this hazard is not longer there.

40
 Example of corrective actions:
Engineering control

♦ Two hand control (only used in

specific cases)

♦ Preventing access by physical

guards

41
 Example of corrective actions:
Engineering control

♦ Define the required performance level of safety functions

♦ Apply checklist “Determination safety functions” and flowchart
“Upgrade critical safety machines”
Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting
See checklist Critical
Safety Machines
See checklist (C.S.M.) § 4. In case guard with
(De)palletizer
Critical Safety of use of light Mechanical block key in pocket,
green level
Machines curtains, see ESPE with read out plus or see Critical Safety
(C.S.M.) § 3.7 light curtains green access release of transponder One hand, PLe, Machine checklist See C.S.M. § 4. PLd,
PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 §6.6 to 6.9. PLd, cat 3 cat 3
See C.S.M. § 4. In guard with
case of use of light Mechanical block key in pocket,

Determination
curtains, see ESPE with read out plus or see Critical Safety
Automatic empty See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
crate buffer 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 4 cat 3
See C.S.M. § 4. In guard with
case of use of light Mechanical block key in pocket,

safety functions
curtains, see ESPE with read out plus or see Critical Safety
See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
Pallet lift 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 5 cat 3
See C.S.M. § 4. In
case of use of light with access
curtains, see ESPE via control
See C.S.M. § light curtains green panel, PLc, One hand, PLe,
Labeller 3.7. PLd, cat 3 level N.A. cat. 2 cat 3 N.A. N.A.
depending on
layout of the
machine type
a guard with See C.S.M.
key in pocket, checklist §6.8.
(Un)packer
See C.S.M. § 4. In or For robotic arm
case of use of light Mechanical block transponder (un)packer,
curtains, see ESPE with read out plus (PLd, cat 3), One hand or
See C.S.M. § light curtains green access release of dual channel two hand, PLe, See C.S.M. § 3. PLd,
3.7. PLd, cat 3 level door. PLd cat 3 with I-L-O cat 3 N.A. cat 3

For robotic arm

with access (un)packer,
via control One hand or
See C.S.M. § panel, PLc, two hand, PLe, See C.S.M. § 3. PLd,
Bottle washer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 3 N.A. cat 3
See C.S.M. § 4. In guard with
Pallet conveyor case of use of light Mechanical block key in pocket, ESPE, light curtain,
turning station / curtains, see ESPE with read out plus or light curtains
pallet (de-) See C.S.M. § light curtains green access release of transponder pallet/product entry See C.S.M. § 3. PLd,
stacking 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. with muting cat 3
See C.S.M. § 4. In guard with For robotic arm
case of use of light Mechanical block key in pocket, (un)packer, see Critical Safety
curtains, see ESPE with read out plus or One hand or Machine checklist
Pallet shrink (de-) See C.S.M. § light curtains green access release of transponder two hand, PLe, §6.2, §6.5 and § 6.10. See C.S.M. § 3. PLd,
foil machine 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 PLd, cat 3 cat 3

For robotic arm

with access (un)packer,
via control One hand or
See C.S.M. § panel, PLc, two hand, PLe,
Can seamer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 4 N.A. N.A.

For robotic arm

key in pocket, (un)packer,
or One hand or
Rotating bottle - See C.S.M. § transponder two hand, PLe,
can -filler 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 5 N.A. N.A.

For robotic arm

with access (un)packer,
via control One hand or
Rotating - keg: See C.S.M. § panel, PLc, two hand, PLe,
filler/rinser 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 6 N.A. N.A.

For robotic arm

key in pocket, (un)packer,
or One hand or
See C.S.M. § transponder two hand, PLe,
Blow moulder 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 7 N.A. N.A.

42
 Example of corrective actions:
Administrative measures

♦ Marking of hazardous places

♦ Training of operators

43
 Safety devices Marking

Light screens Shielding

Zoning

Emergency stops
(easy to reach and clear,
no tags/labels hanging on the button) Signs (local language and
in good condition)

44
 Example of corrective actions:
Behaviour and PPE

♦ Behaviour Based Safety program

♦ Use of ear plugs in areas with noise >

85dB

45
 Assuring safety for existing machinery
Step 5: Determine the effectiveness of
corrective actions
♦ The effectiveness of the outcome of any corrective action is
evaluated (preferably by a safety specialist).

♦ This effectiveness check can be done by a risk assessment

showing the risk score before and after actions taken.

♦ If the outcome of the corrective action is considered to be non-

effective, the machine remains non-compliant with the relevant
requirements and new or alternative corrective actions have to be
considered (use ORR).

46
 Assuring safety for existing machinery
Step 6: Update and re-issue inventory list

♦ When the outcome of the upgrade and improvement action is

considered effective, the machine is compliant with the relevant
requirements and the inventory list shall be updated and re-
issued.

47
 Modifications
♦ A Management Of Change (MOC) procedure shall be applied on all
modifications.  HMESC 01.40.01.708

♦ A risk assessment shall be performed for each change.

♦ If possible contact the supplier for additional support or advice

♦ Declaration of conformity shall be sustained

when changes are implemented!

♦ When modifications are implemented, the

inventory list shall be updated afterwards.

48
 Emergency Stop requirements for (SCALE)
packaging lines

♦ Types of E-stop
■ Machine E-stop

■ Conveyor E-stop
♦ Execution of E-stop

49
 For the (SCALE) packaging lines, two types of
Emergency stops are applicable:
1. Machine E-stop.
2. Conveyor E-stop.

Emergency stop shall be installed as per Machinery Directive 2006/42/EC say).

Emergency stop shall be installed for person safety (prevent injuries) as well as
equipment safety (prevent equipment damage).

Requirements are indicated in EN 415:10 (2014) and NEN-EN-IEC 60204.

Emergency stop installation shall based on a risk assessment of the supplier

50
 1) Machine E-stop

 The machine E-stop shall stop the complete machine when the E-stop of
that machine will be activated. The machine shall be stand still in a safe
mode. This also includes the conveyors inside the machine. Infeed and
outlet will be stopped based on risk assessment of the supplier.

 Multiple machine inside one fence must be considered as one machine.

51
 2) Conveyor E-stop
 The E-stop push buttons will be installed at the conveyor.

 Activating this E-stop results that the applicable conveyor and all conveyors
in the same area shall be stopped. As a starting point, an area contains all
conveyors in sight of a E-stop pushbutton in that packaging line.

 The machines in the same area can be stopped by means of a controlled stop
or emergency stop based on the risk assessment of the supplier.

 The conveyor E-stop in an area does not have to stop other areas. The final
areas shall be defined by the supplier based on a risk assessment. Conveyors
can be part of multiple areas.

 The supplier shall issue an E-stop layout indicating the different areas as part
of the detail engineering for review. Review will take place in a joint meeting
between the supplier and Supply Chain Team (Packaging Engineer and Safety
specialist)

 Different packaging lines will not be combined if separated by a corridor.

52
 Example Machine E-Stop

Activate

Filler

Labeller

Bottle
washer Pasteurizer

Packer

Palletizer

De-
Palletizer

53
 Example-1 - Conveyor E-Stop

Filler

Activate Labeller

Bottle
Pasteurizer
washer

Packer

Palletizer Pasteurizer action based on

risk assessment of supplier
De-
Palletizer

54
 Example-2 - Conveyor E-Stop
Filler action based on risk
Activate assessment of supplier

Filler

Labeller

Bottle
Pasteurizer
washer

Bottlewasher action based on

risk assessment of supplier
Packer

Palletizer

De-
Palletizer

55
 Example-1 Palletizer / Depalletizer.

Filler

Labeller

Bottle
washer Pasteurizer

Packer

Activate

Palletizer
Palitizer and depalitizer are in
De-
one zone. E-stop stops both
Palletizer
machines

56
 Example-2 Palletizer / Depalletizer.

Filler

Labeller

Bottle
washer Pasteurizer

Packer

Activate

Palletizer
Palitizer and depalitizer are
De-
not in one zone. E-stop stops
Palletizer
only one machines

57
 Execution Emergency Buttons

58
 Execution Emergency Buttons: Operating
Conditions

59
 Execution Emergency Buttons: Emergency
Stop Device

60
 Execution Emergency Buttons: Location

61
 Execution Emergency Buttons: Only Symbol

62
 Execution Emergency Buttons: Execution with
Shroud

63
 Performance Levels

Safety devices in control systems of Critical Safety Machines should

be reliable and available when needed. The Performance Level of a
safety device specifies the ability of safety-related parts of control
systems to perform a safety function under foreseeable conditions.

For critical safety machines, the required PL is defined in “Overview

Determination Safety Functions”

Reference: ISO 13849

64
 Purpose

History:
♦ After the fatal accidents in Madrid and Vialonga assessments of
packaging machines against the Machinery directive were
performed by TüV and several gaps were identified on safety
devices.
♦ Countermeasures where taken and it was discovered that these
countermeasures were not always First Time Right.
♦ Due to this, it has been decided by the Centre of Excellence of
Machine Safety to setup a guidance document how to upgrade
existing machines which is called the Technical Service Document
(included in this ppt).
♦ Prior to the TSD, the safety circuits per Critical Safety Machines
were identified (Excel file) and a flowchart was setup
♦ Per identified safety circuit the Performance Level was determined

65
 Purpose & Content of TSD

The TSD provides detailed safety related information to design,

engineering and implementation of the solution of Critical Safety
Machines at Heineken, in order:
♦ To define safety functions and safety related parts of control systems
♦ To select modern safety solutions and technologies
♦ To be able to address the applicable Performance Level
♦ Prescribe safety solutions/components and different architectures
which fulfil the requirements
♦ To provide standardized solutions as guidance for other Heineken
production units
♦ Key technical data
♦ Validation guideline to make sure the upgrade is meeting the
required PL
♦ Necessary maintenance activities in relation to the solution

66
 Safety circuits & Performance Levels (PL)

♦ A safety circuit can exist of a component like an E-stop connected

via wiring (a single channel (wire) or a dual channel) and by a
single relays, a multi-relay or a Safety PLC
♦ The ‘robustness’ of a safety circuit depends on the strength of the
circuit and is expressed in Performance Level (PL) or Probability of
Failure per Hour (PFH).
♦ PLa is of the lowest category and PLe of the highest safety level
♦ Other identified safety circuits are:
♦ Light curtains
♦ Interlock
♦ Key-in-pocket
♦ Jog mode
♦ Pneumatic pins

67
 How is a PL determined?

♦ For the determination of the PL a risk estimation is done according

to the method shown below
♦ When we determine the PL of a (de)palletizer in Heineken using
historic information we would come to: S2 x F2 x P1 = PLd

68
 ALARP

♦ As explained for the improvement of existing machines we agree

to consider the ALARP (As Low As Reasonable Practical) approach
to avoid over investment of machines. To understand the level
needed per safety circuit of Critical Safety machines you can find
in the Excel file a tab with highest level (for new machines) and a
tab sheet with ALARP for existing machines. The third tab sheet
shows the table with architecture.

69
 Decision of the architecture (ISO 13849)
Category = architecture of controls:
Cat. B = Industrial components
Cat. 1 = Cat. B + proven components & principles
Cat. 2 = Cat. 1 + test moments by machine control
system
Cat. 3 = Cat. 2 + 1 error does not lead to loss of
safety function and individual error
detected
Cat. 4 = Cat. 3 + blockage after detection

Mean Time To dangerous Failure (MTTFd) of each

channel:
MTTFd low = 3 to < 10 years
MTTFd medium = 10 to < 30 years
MTTFd high = 30 to 100 years

DC = Diagnostic Coverage
Those Categories require some form of diagnostic
testing to check whether the safety function is still
working. The term
"diagnostic coverage" [usually abbreviated to DC] is
used to characterise the effectiveness of this testing.
DCavg <60% = none
DCavg 60% to < 90% = low
DCavg 90% to < 99% = medium
DCavg ≥99% = high

♦ For Heineken the requirement of a block (input, logic & output) is

determined as: PLd, cat. 3, DC low, MTTFd high

70
 Safety function determined per Critical Safety
Machine (1of 4)
Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting
See checklist Critical
Safety Machines
See checklist (C.S.M.) § 4. In case guard with
(De)palletizer
Critical Safety of use of light Mechanical block key in pocket,
green level
Machines curtains, see ESPE with read out plus or see Critical Safety
(C.S.M.) § 3.7 light curtains green access release of transponder One hand, PLe, Machine checklist See C.S.M. § 4. PLd,
PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 §6.6 to 6.9. PLd, cat 3 cat 3
See C.S.M. § 4. In guard with
case of use of light Mechanical block key in pocket,
curtains, see ESPE with read out plus or see Critical Safety
Automatic empty See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
crate buffer 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 4 cat 3
See C.S.M. § 4. In guard with
case of use of light Mechanical block key in pocket,
curtains, see ESPE with read out plus or see Critical Safety
See C.S.M. § light curtains green access release of transponder Machine checklist See C.S.M. § 4. PLd,
Pallet lift 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. §6.6 to 6.9. PLd, cat 5 cat 3
See C.S.M. § 4. In
case of use of light with access
curtains, see ESPE via control
See C.S.M. § light curtains green panel, PLc, One hand, PLe,
Labeller 3.7. PLd, cat 3 level N.A. cat. 2 cat 3 N.A. N.A.

71
 Safety function determined per Critical Safety
Machine (2 of 4)
Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting
depending on
layout of the
machine type
a guard with See C.S.M.
key in pocket, checklist §6.8.
(Un)packer
See C.S.M. § 4. In or For robotic arm
case of use of light Mechanical block transponder (un)packer,
curtains, see ESPE with read out plus (PLd, cat 3), One hand or
See C.S.M. § light curtains green access release of dual channel two hand, PLe, See C.S.M. § 3. PLd,
3.7. PLd, cat 3 level door. PLd cat 3 with I-L-O cat 3 N.A. cat 3

For robotic arm

with access (un)packer,
via control One hand or
See C.S.M. § panel, PLc, two hand, PLe, See C.S.M. § 3. PLd,
Bottle washer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 3 N.A. cat 3
See C.S.M. § 4. In guard with
Pallet conveyor case of use of light Mechanical block key in pocket, ESPE, light curtain,
turning station / curtains, see ESPE with read out plus or light curtains
pallet (de-) See C.S.M. § light curtains green access release of transponder pallet/product entry See C.S.M. § 3. PLd,
stacking 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. with muting cat 3

72
 Safety function determined per Critical Safety
Machine (3 of 4)
Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting

For robotic arm

with access (un)packer,
via control One hand or
See C.S.M. § panel, PLc, two hand, PLe, See C.S.M. § 3. PLd,
Bottle washer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 3 N.A. cat 3
See C.S.M. § 4. In guard with
Pallet conveyor case of use of light Mechanical block key in pocket, ESPE, light curtain,
turning station / curtains, see ESPE with read out plus or light curtains
pallet (de-) See C.S.M. § light curtains green access release of transponder pallet/product entry See C.S.M. § 3. PLd,
stacking 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) N.A. with muting cat 3
See C.S.M. § 4. In guard with For robotic arm
case of use of light Mechanical block key in pocket, (un)packer, see Critical Safety
curtains, see ESPE with read out plus or One hand or Machine checklist
Pallet shrink (de-) See C.S.M. § light curtains green access release of transponder two hand, PLe, §6.2, §6.5 and § 6.10. See C.S.M. § 3. PLd,
foil machine 3.7. PLd, cat 3 level door. PLd cat 3 (PLd, cat 3) cat 3 PLd, cat 3 cat 3

For robotic arm

with access (un)packer,
via control One hand or
See C.S.M. § panel, PLc, two hand, PLe,
Can seamer 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 4 N.A. N.A.

73
 Safety function determined per Critical Safety
Machine (4 of 4)
Safety circuit

ESPE, light curtain,

light curtains pallet/ ESPE, light curtain,
Critical Safety Pneumatic or product entry with light curtains
Machine (new) E-stop Guarding hydraulic blocking Interlock/KIP Jog mode muting without muting

For robotic arm

key in pocket, (un)packer,
or One hand or
Rotating bottle - See C.S.M. § transponder two hand, PLe,
can -filler 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 5 N.A. N.A.

For robotic arm

with access (un)packer,
via control One hand or
Rotating - keg: See C.S.M. § panel, PLc, two hand, PLe,
filler/rinser 3.7. PLd, cat 3 See C.S.M. § 4. N.A. cat. 2 cat 6 N.A. N.A.

For robotic arm

key in pocket, (un)packer,
or One hand or
See C.S.M. § transponder two hand, PLe,
Blow moulder 3.7. PLd, cat 3 See C.S.M. § 4. N.A. (PLd, cat 3) cat 7 N.A. N.A.

74
 Technical Service Document

♦ Version (ISG15-566-041-01 TSD Packaging Equipment Rev 0)

Adobe Acrobat
Document

75
Testing of safety devices (interlocks, EMS, K-I-P,
etc.)
Often the question is put forward what the right frequency should be to test safety devices like
emergency stops or other safety devices. Depending on the local legislation we see different
approaches. In some countries 1/year testing of Emergency Stops is required in other countries
there are no requirements and in some operations in Heineken we see daily testing.
Given the fact that safety devices need to have a certain robustness (e.g. Performance Level) as
required in the document ‘01.40.04.711 Determination of Safety functions’ were the robustness is
expressed in Performance Levels (Performance Failure per Demand (PFD) or even per Hour (PFH)).
The required PL of the safety devices does not require frequent testing.
The CoE Machine Safety together with the advise of TüV came to the conclusion to test quarterly
when safety devices with PLc or PLd are used. Also a test is highly recommended after power cuts,
overhauls or modifications. Of course if local legislation requires more testing, that should be
followed. For safety devices with lower PL (no PL, PLa or PLb), more frequent testing is required
(weekly). Test means for instance opening a door with KIP or interlock and the machine should
stop with safety stop information. Next step is to reset the door and after the machine is reset
another door or safety component can be tested. When reset is not possible, most likely a fault is at
hand in the system and countermeasures shall be taken to start up safely.

76
 References
♦ Critical safety machine checklist (HMESC 01.40.04.723);
♦ Safe interventions (LOTO) (HMESC 01.40.01.702);
♦ Management of Change (Safety) (HMESC 01.40.01.708);
♦ Contractor safety (HMESC 01.40.01.512);
♦ Overview Determination Safety Functions; Directive 2006/42/EC – of the
European parliament and of the council of 17 May 2006 on machinery, and
amending Directive 95/16/EC;
♦ Directive 89/655/EC – of the European parliament and of the council 30
November 1989 concerning the minimum safety and health requirements
for the use of work equipment by workers at work (second individual
Directive within the meaning of Article 16 (1) of Directive 89/391/EEC);
♦ Guide to the implementation of directives based on the New Approach and
the Global Approach, EC, 2000;
♦ Guide to application of the Machinery Directive Edition 2.1, July 2017, EC;
♦ Appendix G-Annex 7 doc 01 General Technical Specification (dated 13 01
2017 version 5.2.

77
78