EN ISO 11161:2007

SLOVENSKI STANDARD
01-september-2007
Varnost strojev - Integrirani proizvodni sistemi - Osnovne zahteve (ISO
11161:2007)
Safety of machinery - Integrated manufacturing systems - Basic requirements (ISO
11161:2007)
Sicherheit von Maschinen - Integrierte Fertigungssysteme - Grundlegende
Anforderungen (ISO 11161:2007)
Sécurité des machines - Systemes de fabrication intégrés - Prescriptions fondamentales
(ISO 11161:2007)
Ta slovenski standard je istoveten z: EN ISO 11161:2007
ICS:
13.110 Varnost strojev Safety of machinery
25.040.01 Sistemi za avtomatizacijo v Industrial automation
industriji na splošno systems in general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN ISO 11161
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2007
ICS 13.110; 25.040.01
English Version
Safety of machinery - Integrated manufacturing systems - Basic
requirements (ISO 11161:2007)
Sécurité des machines - Systèmes de fabrication intégrés - Sicherheit von Maschinen - Integrierte Fertigungssysteme -
Prescriptions fondamentales (ISO 11161:2007) Grundlegende Anforderungen (ISO 11161:2007)
This European Standard was approved by CEN on 13 April 2007.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as the
official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36  B-1050 Brussels
© 2007 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 11161:2007: E
worldwide for CEN national Members.

Foreword
This document (EN ISO 11161:2007) has been prepared by Technical Committee ISO/TC 199
"Safety of machinery" in collaboration with Technical Committee CEN/TC 114 "Safety of
machinery", the secretariat of which is held by DIN.

This European Standard shall be given the status of a national standard, either by publication of
an identical text or by endorsement, at the latest by November 2007, and conflicting national
standards shall be withdrawn at the latest by November 2007.

According to the CEN/CENELEC Internal Regulations, the national standards organizations of
the following countries are bound to implement this European Standard: Austria, Belgium,
Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United
Kingdom.
Endorsement notice
The text of ISO 11161:2007 has been approved by CEN as EN ISO 11161:2007 without any
modifications.
INTERNATIONAL ISO
STANDARD 11161
Second edition
2007-05-15
Safety of machinery — Integrated
manufacturing systems — Basic
requirements
Sécurité des machines — Systèmes de fabrication intégrés —
Prescriptions fondamentales
Reference number
ISO 11161:2007(E)
©
ISO 2007
ISO 11161:2007(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

©  ISO 2007
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO 2007 – All rights reserved

ISO 11161:2007(E)
Contents Page
Foreword. v
Introduction . vi
1 Scope .1
2 Normative references .1
3 Terms and definitions .2
4 Strategy for risk assessment and risk reduction .6
4.1 General.6
4.2 Specification of the limits of the IMS.6
4.3 Determination of the task.6
4.4 Identifying hazardous situations.8
4.5 Risk estimation and risk evaluation.8
4.6 Risk reduction.8
5 Risk assessment.10
5.1 Specifications of the IMS .10
5.2 Identification of hazards and hazardous situations.12
5.3 Risk estimation .13
5.4 Risk evaluation.14
6 Risk reduction.14
6.1 Protective measures.14
6.2 Validation of the protective measures.14
7 Task zone(s) .14
7.1 General.14
7.2 Determination.15
7.3 Design .15
7.4 Functional analysis.16
8 Safeguarding and span of control .16
8.1 Safeguarding of task zones .16
8.2 Span of control.17
8.3 Electrical equipment requirements.17
8.4 Modes.17
8.5 Safeguards .18
8.6 Protective measures when safeguards are suspended.18
8.7 Muting and blanking.20
8.8 Control .20
8.9 Reset of perimeter safeguarding devices .21
8.10 Start/restart.21
8.11 Emergency stop.22
8.12 Measures for the escape and rescue of trapped persons.22
9 Information for use .22
9.1 General.22
9.2 Marking .23
10 Validation of the design .23
10.1 Validation that the design meets the requirements .23
10.2 Validation of the protective measures.23
Annex A (informative) Examples of integrated manufacturing systems (IMSs).24
Annex B (informative) Flow of information between the integrator, user and suppliers.27
ISO 11161:2007(E)
Annex C (informative) Span of control examples within an IMS . 28
Annex D (informative) Temporary observation of the automatic process . 32
Bibliography . 36

iv © ISO 2007 – All rights reserved

ISO 11161:2007(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 11161 was prepared by Technical Committee ISO/TC 199, Safety of machinery, in accordance with the
Agreement on technical cooperation between ISO and CEN (Vienna Agreement).
This second edition cancels and replaces the first edition (ISO 11161:1994), which has been technically
revised.
ISO 11161:2007(E)
Introduction
The structure of safety standards in the field of machinery is as follows:
a) Type-A standards (basic safety standards) giving basic concepts, principles for design, and general
aspects that can be applied to all machinery.
b) Type-B standards (generic safety standards) dealing with one safety aspect or one type of safeguard that
can be used across a wide range of machinery:
⎯ type-B1 standards on particular safety aspects (e.g. safety distances, surface temperature, noise);
⎯ type-B2 standards on safeguards (e.g. two-hand controls, interlocking devices, pressure sensitive
devices, guards).
c) Type-C standards (machine safety standards) dealing with detailed safety requirements for a particular
machine or group of machines.
This International Standard is a type-B1 standard as stated in ISO 12100-1.
An integrated manufacturing system (IMS, see 3.1) can be very different in terms of size and complexity, and
can incorporate different technologies that require diverse expertise and knowledge.
An integrated manufacturing system should be considered to be a whole new and different machine rather
than simply its parts combined. The integrator (see 3.10) needs the cooperation of entities who individually
know only a part of the whole. Where there are requirements for frequent manual interventions to parts of the
IMS, e.g. inspections, maintenance, set-up, it can be impractical or unnecessary to stop the whole IMS. This
International Standard gives requirements to provide for the safety of individuals who perform these tasks.
Safeguarding for these tasks relates to the concept and use of “task zones”.
The aim of this International Standard is to describe how to apply the requirements of ISO 12100-1:2003,
ISO 12100-2:2003 and ISO 14121 in this specific context.
A general configuration of an integrated manufacturing system is shown in Figure 1.
Some examples of integrated manufacturing systems are included in Annex A.
vi © ISO 2007 – All rights reserved

ISO 11161:2007(E)
Key
1 control 6 hazard zone B
2 operator pendant 7 hazard zone C
3 safeguarded space 8 scrap and expendables flow
4 local controls 9 raw material flow
5 hazard zone A 10 finished goods
Figure 1 — Configuration of an IMS
INTERNATIONAL STANDARD ISO 11161:2007(E)

Safety of machinery — Integrated manufacturing systems —
Basic requirements
1 Scope
This International Standard specifies the safety requirements for integrated manufacturing systems (IMS) that
incorporate two or more interconnected machines for specific applications, such as component manufacturing
or assembly. It gives requirements and recommendations for the safe design, safeguarding and information
for the use of such IMSs (see Figure 1 for the basic configuration of an IMS).
NOTE 1 In the context of this International Standard, the term system refers to an integrated manufacturing system.
NOTE 2 In the context of this International Standard, the term machine refers to the component machines and
associated equipment of the integrated manufacturing system.
This International Standard is not intended to cover safety aspects of individual machines and equipment that
may be covered by standards specific to those machines and equipment. Therefore it deals only with those
safety aspects that are important for the safety-relevant interconnection of the machines and components.
Where machines and equipment of an integrated manufacturing system are operated separately or
individually, and while the protective effects of the safeguards provided for production mode are muted or
suspended, the relevant safety standards for these machines and equipment apply.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO 12100-1:2003, Safety of machinery — Basic concepts, general principles for design — Part 1: Basic
terminology, methodology
ISO 12100-2:2003, Safety of machinery — Basic concepts, general principles for design — Part 2: Technical
principles
ISO 13849-1:2006, Safety of machinery — Safety-related parts of control systems — Part 1: General
principles for design
ISO 13849-2:2003, Safety of machinery — Safety-related parts of control systems — Part 2: Validation
ISO 13850:2006, Safety of machinery — Emergency stop — Principles for design
ISO 14120:2002, Safety of machinery — Guards — General requirements for the design and construction of
fixed and movable guards
ISO 14121:1999, Safety of machinery — Principles of risk assessment
ISO 14122-1:2001, Safety of machinery — Permanent means of access to machinery — Part 1: Choice of a
fixed means of access between two levels
ISO 11161:2007(E)
ISO 14122-2:2001, Safety of machinery — Permanent means of access to machinery — Part 2: Working
platforms and walkways
ISO 14122-3:2001, Safety of machinery — Permanent means of access to machinery — Part 3: Stairways,
stepladders and guard-rails
ISO 14122-4:2004, Safety of machinery — Permanent means of access to machinery — Part 4: Fixed ladders
IEC 60204-1:2005, Safety of machinery — Electrical equipment of machines — Part 1: General requirements
IEC 62061:2005, Safety of machinery — Functional safety of safety-related electrical, electronic and
programmable electronic control systems
3 Terms and definitions
For the purposes of this document, the following definitions apply:
3.1
integrated manufacturing system
IMS
group of machines working together in a coordinated manner, linked by a material-handling system,
interconnected by controls (i.e. IMS controls), for the purpose of manufacturing, treatment, movement or
packaging of discrete parts or assemblies
NOTE See also Annex A.
3.2
detection zone
zone within which a specified test piece will be detected by the electro-sensitive protective equipment (ESPE)
[IEC/TS 62046:2004, 3.1.3]
3.3
emergency stop
function which is intended:
⎯ to avert arising or to reduce existing hazards to persons, damage to machinery or to work in progress;
⎯ to be initiated by a single human action
NOTE ISO 13850 gives detailed provisions.
[ISO 12100-1:2003, 3.37]
3.4
enabling device
additional manually operated device used in conjunction with a start control and which, when continuously
actuated, allows a machine to function
NOTE IEC 60204-1:2005, 9.2.5.8 gives provisions on enabling devices.
[ISO 12100-1:2003, 3.26.2]
2 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
3.5
guard
physical barrier, designed as part of the machine, to provide protection
NOTE 1 A guard may act:
⎯ alone; it is then only effective when it is “closed” for a movable guard or “securely held in place” for a fixed guard;
⎯ in conjunction with an interlocking device with or without guard locking; in this case, protection is ensured whatever
the position of the guard.
NOTE 2 Depending on its construction, a guard may be called e.g. casing, shield, cover, screen, door, enclosing guard.
NOTE 3 See ISO 12100-2:2003, 5.3.2, and ISO 14120 for types of guards and their requirements.
[ISO 12100-1:2003, 3.25]
3.6
harm
physical injury or damage to health
[ISO 12100-1:2003, 3.5]
3.7
hazard
potential source of harm
NOTE 1 The term hazard can be qualified in order to define its origin (e.g. mechanical hazard, electrical hazard) or the
nature of the potential harm (e.g., electric shock hazard, cutting hazard, toxic hazard, fire hazard).
NOTE 2 The hazard envisaged in this definition:
⎯ either is permanently present during the intended use of the machine (e.g. motion of hazardous moving elements,
electric arc during a welding phase, bad posture; noise emissions; high temperature);
⎯ or may appear unexpectedly (e.g. explosion, crushing hazard as a consequence of an unintended/unexpected start-
up, ejection as a consequence of a breakage, fall as a consequence of acceleration/deceleration).
[ISO 12100-1: 2003, 3.6]
3.8
hazard zone
danger zone
any space within and/or around machinery in which a person can be exposed to a hazard
[ISO 12100-1:2003, 3.10]
3.9
hazardous situation
circumstance in which a person is exposed to at least one hazard
NOTE The exposure can immediately or over a period of time result in harm.
[ISO 12100-1:2003, 3.9]
ISO 11161:2007(E)
3.10
integrator
entity who designs, provides, manufactures or assembles an integrated manufacturing system and is in
charge of the safety strategy, including the protective measures, control interfaces and interconnections of the
control system
NOTE The integrator may be a manufacturer, assembler, engineering company or the user.
3.11
interlocking device
interlock
mechanical, electrical or other type of device, the purpose of which is to prevent the operation of hazardous
machine functions under specified conditions (generally as long as a guard is not closed)
[ISO 12100-1: 2003, 3.26.1]
3.12
local control
state in which the control of a task zone can only be performed at that task zone
3.13
muting
temporary automatic suspension of a safety function(s) by safety-related parts of control systems
[ISO 13849-1:2006, 3.1.8]
3.14
operator
person or persons given the task of installing, using, adjusting, maintaining, cleaning, repairing or transporting
machinery
3.15
protective measure
measure intended to achieve risk reduction, implemented
⎯ by the designer (inherently safe design, safeguarding and complementary protective measures,
information for use) and
⎯ by the user (organization: safe working procedures, supervision, permit-to-work systems; provision and
use of additional safeguards; use of personal protective equipment; training)
[ISO 12100-1:2003, 3.18]
3.16
protective device
safeguard other than a guard
[ISO 12100-1:2003, 3.26]
3.17
risk
combination of the probability of occurrence of harm and the severity of that harm
[ISO 12100-1:2003, 3.11]
4 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
3.18
safeguard
guard or protective device
[ISO 12100-1:2003, 3.24]
3.19
safeguarded space
space determined by the protective measures such that the hazard(s) covered by these measures cannot be
reached
3.20
safeguarding
protective measure using safeguards to protect persons from the hazards which cannot reasonably be
eliminated or risks which cannot be sufficiently limited by inherently safe design measures
NOTE ISO 12100-2:2003, Clause 5, deals with safeguarding.
[ISO 12100-1:2003, 3.20]
3.21
safety function
function of a machine whose failure can result in an immediate increase of the risk(s)
[ISO 12100-1:2003, 3.28]
3.22
safe working procedure
specified procedure intended to reduce the possibility of injury while performing an assigned task
3.23
span of control
predetermined portion of the IMS under control of a specific device
3.24
supplier
entity (e.g. designer, manufacturer, contractor, installer, integrator) who provides equipment or services
associated with the IMS or a portion of the IMS
NOTE The user may also act in the capacity of a supplier.
3.25
task zone
any predetermined space within and/or around the IMS in which an operator can perform work
NOTE See also hazard zone and safeguarded space.
3.26
trouble shooting
fault finding
act of methodically determining the reason that the IMS, or portions of the IMS, has failed to perform the task
or function as intended
3.27
user
entity who utilizes and maintains the IMS
ISO 11161:2007(E)
4 Strategy for risk assessment and risk reduction
4.1 General
The strategy for risk assessment and risk reduction of an IMS shall be in accordance with ISO 12100-1,
ISO 12100-2 and ISO 14121.
The integrator shall consult with the user and the suppliers (see Annex B) of the component machines and
associated equipment to achieve adequate reduction of risk. The integrator shall review the technical aspects
and develop the information for use of the IMS in accordance with Clause 9.
The IMS shall be designed to facilitate safe manual interventions, including maintenance. For some manual
interventions, it can be impractical to stop the whole IMS, in which case the IMS shall be segregated into
zone(s) where operators can perform their tasks safely. Clause 5 applies to the risk assessment, including
⎯ specification of the IMS (5.1),
⎯ identification of hazards and hazardous situations (5.2),
⎯ risk estimation (5.3), and
⎯ risk evaluation (5.4).
Clause 6 applies to risk reduction including
⎯ protective measures (6.1), and
⎯ validation of protective measures (6.2).
IMS risk assessment and risk reduction is an iterative process described in the following steps (see Figure 2
of ISO 12100-1:2003).
4.2 Specification of the limits of the IMS
In order to perform an adequate risk assessment, the following basis IMS parameters shall be defined:
⎯ functionalities;
⎯ limits;
⎯ interfaces between the different parts of the IMS.
See Figure 2.
4.3 Determination of the task
The integrator shall determine the foreseeable tasks (for the IMS multiple configurations) and their associated
requirements of location and access. See Figure 3.

6 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
Key
1 machine A – robot 3 machine C – material handling system (conveyor)
2 machine B – machine tool 4 IMS
Figure 2 — Specification of the limits of the IMS

Key
1 task 1: tool changing
2 task 2: cleaning
3 access to task 1 and task 2
Figure 3 — Determination of tasks (requirements, location, access)
ISO 11161:2007(E)
4.4 Identifying hazardous situations
The IMS risk assessment shall cover hazardous situations resulting from
⎯ integration of the component machines and associated equipment,
⎯ any alterations to the protective measures of the machine(s), or
⎯ change of use of the machine(s).
See Figure 4.
Key
1 IMS
2 hazard zones
Figure 4 — Identification of hazards/hazard zones and associated hazardous situations
4.5 Risk estimation and risk evaluation
The integrator shall estimate and evaluate risk for each identified hazard and hazardous situation within each
task zone.
4.6 Risk reduction
The integrator shall eliminate the hazard or reduce the risks associated with the hazard by the hierarchy of
protective measures according to ISO 12100-1:2003, as follows:
⎯ elimination of the hazard by design;
⎯ risk reduction by design requirements and determination of task zone(s);
⎯ risk reduction by safeguarding and complementary measures, including span of control;
⎯ risk reduction by providing information for use (see Clause 9).
See Figures 5 and 6.
8 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
Key
1 task zone A
2 task zone B
Figure 5 — Determination of the task zone(s)

Key
1 span of control of light control
2 span of control of interlocking device
Figure 6 — Determination of the safeguarding including the span of control
ISO 11161:2007(E)
5 Risk assessment
5.1 Specifications of the IMS
5.1.1 Limits
The risk assessment of an IMS begins with the specification of its limits, including determination of the IMS
use, space requirements and the lifecycle (see also ISO 12100-1:2003, 5.2). The integrator should consider:
a) description of functions;
b) layout including access and configuration capabilities;
c) description of the interaction of different working processes and manual activities;
d) analysis of process sequences, including manual interaction;
e) description of the interfaces;
f) process flow charts;
g) foundation plans;
h) plans and space for material handling;
i) utility service connections;
j) available accident records of similar operations or systems;
k) study of similar system installations;
l) environmental characteristics.
5.1.2 Functionality
The specification of the functionality of the IMS shall include, but not be limited to:
a) production rates that take into account work tasks and IMS efficiency(ies);
b) level of automation, technologies and manufacturing processes;
c) modes [e.g. manual mode, automatic mode, modes related to a zone or part of a zone, observation mode
(see also Annex D)];
d) machine/IMS multiple configuration requirements;
NOTE Multiple configurations (the designed regrouping and re-zoning of machinery within the IMS) can allow the
use of portions of the IMS while other portions are not used or are being used as a stand-alone machine. Multiple
configurations can also provide added production flexibility (e.g. the number or variety of parts being produced at the
same time).
e) control functions, including safety-related control functions (see 8.8);
f) spans of control;
g) inspection requirements.
10 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
5.1.3 Determination of work task(s)
The integrator shall identify and document the human interactions with the IMS. The specification of the work
task(s) of the IMS shall include:
a) the specific work to be performed or accomplished;
b) location of the work task(s);
c) frequency and duration of human intervention, including but not limited to quality checks, preventative
maintenance, correction of malfunctions;
d) spans of control of the safeguards to accomplish the work task(s) (e.g. full speed, reduced speed,
stopped);
e) modes needed for work task(s) (e.g. manual mode, automatic mode, modes related to a zone or part of a
zone for specific functions or operations, such as setting mode, programming, test mode);
f) the need for personal protective equipment (e.g. gloves, goggles);
g) the need for auxiliary equipment (e.g. hand tool, lifting equipment);
h) ergonomic aspects associated with the task(s) (e.g. posture, mass, size, complexity);
i) environmental issues that relate to the task(s) (e.g. fresh air, exhaust air and ventilation, lighting, noise
and vibration, temperature, humidity, solid waste, liquid waste);
j) phases of the IMS operation shall be considered, including reasonably foreseeable misuse, when
determining work tasks, such as
1) installation,
2) teaching and setting,
3) production (e.g. manual operation by the operator, work piece loading, process control and
monitoring),
4) maintenance,
5) correction, trouble shooting and recovery from malfunctions, and
6) dismantling and disposal of the IMS.
The integrator shall also take into account the presence of passers-by not directly concerned with the
operation.
5.1.4 Space requirements of the IMS
5.1.4.1 General
The integrator shall specify the space requirements for the IMS, including layout and access requirements.
5.1.4.2 Layout
The design of the IMS layout shall take into account:
a) access (i.e. ingress and egress paths) and escape paths;
ISO 11161:2007(E)
b) foreseeable human intervention;
c) work task(s);
d) work flow;
e) spans of control of the safeguards to provide safe access to accomplish the work tasks identified in 5.1.3;
f) traffic and passers-by.
The layout of the IMS shall be validated to ensure compatibility with the expected use.
5.1.5 Access to the IMS
There shall be safe and easy access to the IMS and shall include paths for:
⎯ operators;
⎯ materials (e.g. raw materials, parts, sub-assemblies, product and scrap);
⎯ mobile equipment (e.g. forklift trucks, trolleys);
⎯ access for maintenance and adjustment;
⎯ access to workstation(s).
NOTE Floor marking may be needed, especially where mobile equipment is used and/or protective devices are
installed that can cause a stop. Door swing and direction should be considered.
Access paths and means shall not expose operators to hazards, including falling hazards. Permanent means
of access shall be provided, taking into account the frequency and the ergonomic aspects of the task.
Selection and design of platforms, walkways, stairs, stepladders, and fixed ladders shall be in accordance with
the relevant part of ISO 14122.
5.2 Identification of hazards and hazardous situations
5.2.1 General
After having determined the IMS limits in accordance with 5.1.1 and a preliminary layout, the integrator shall
identify hazard and hazardous situations for each work task, related to:
a) the machine on which the intervention is performed;
b) the location of the machine inside the IMS, including hazards from adjacent zones;
c) the path through the IMS to reach the location to perform the task(s).
5.2.2 Hazards and hazardous situations due to the machine(s) and associated equipment
The assumption of this International Standard is that the suppliers deliver machines that comply with the
requirements of ISO 12100-1 and ISO 12100-2 and other safety standards for the machine(s) and associated
equipment. The integrator shall determine whether the protective measures implemented by the suppliers are
valid for its integration with the IMS. This should be carried out in consultation with the supplier. For each
machine, the integrator shall verify whether the conditions of use of the machine due to its integration inside
the IMS are consistent with the intended use foreseen by its supplier. A risk assessment shall be carried out
on any point of difference. These analyses should be carried out in consultation with the supplier. For
example:
12 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
a) The location of the machine inside the IMS exposes it to special environmental constraints not foreseen
by its supplier (e.g. a machine can be exposed to an electromagnetic field not foreseen by its supplier).
b) Due to the location of the machine inside the IMS, interventions cannot be carried out as foreseen by the
supplier (e.g. due to the presence of a conveyor, there is no longer access to the machine).
c) The protective measures taken by the suppliers are no longer valid (e.g. the height of the fixed guard of
the machine is no longer enough because of the presence of stairs, from which the hazard zone can be
accessed).
d) Residual risk reduction measures, as described in the information for use for component machines,
cannot be followed due to the IMS design or use (e.g. the warning sign cannot be used because it would
be obstructed; the guard cannot be used because other machinery is installed).
When a machine is modified (e.g. by removing a guard to enable an automatic feeding by a robot), the
integrator shall determine whether new hazardous situations have been created. This should be carried out in
consultation with the supplier. When equipment is intended for incorporation into an IMS, the integrator shall
determine whether all hazardous situations have been addressed. This should be carried out in consultation
with the supplier.
NOTE An example of this kind of equipment may be a sub-assembly of machinery such as a conveyor with its power
drive. The conveyor itself normally does not meet all requirements of ISO 12100-2:2003, Clause 4. Other standards may
be applicable (e.g. IEC 60204-1).
5.2.3 Hazardous situations due to the location of the equipment
For each machine, the integrator shall assess whether new hazardous situations have been created due to
the location of the machine within the IMS. For example:
a) interaction of individual machines and equipment of the IMS itself;
b) work in the vicinity of another part of the IMS which is still running;
c) work at height with a risk of falling;
d) interfaces between machines and/or zone(s);
e) the zoning applied to the IMS.
5.2.4 Hazardous situations due to the path
Hazardous situations shall be identified and assessed for paths to each task zone.
5.3 Risk estimation
After the hazards are identified, risk estimation shall be carried out for each hazardous situation by
determining the elements of risk, which are derived from a combination of the following elements:
a) the severity of harm;
b) the probability of occurrence of that harm, which is a function of
⎯ the exposure of person(s) to the hazard,
⎯ the occurence of a hazardous event,
⎯ the technical and human possibilities of avoiding or limiting the harm.
ISO 11161:2007(E)
5.4 Risk evaluation
Risk evaluation shall be carried out to determine whether adequate safety is reached or if further risk
reduction is required.
6 Risk reduction
6.1 Protective measures
Eliminate the hazard or reduce the risks associated with the hazard by the following hierarchy of protective
measures:
a) design requirements of the IMS and zoning (see Clause 7);
b) safeguarding and span of control (see Clause 8);
c) information for use (see Clause 9).
NOTE See Figures 5 and 6.
6.2 Validation of the protective measures
Validate that the protective measures adequately reduce the risk.
7 Task zone(s)
7.1 General
Inherently safe design measures are the first and most effective step in the risk reduction process. They are
achieved by eliminating hazards or reducing risks by a suitable choice of design features of the component
machines or the IMS.
In addition to the measures described in ISO 12100-2:2003, Clause 4, the following inherently safe design
measures shall be applied, in order to eliminate or reduce risk:
a) modify IMS specifications or limits;
b) change or modify parts of the equipment in order to suppress or reduce hazardous situation(s) or modify
some interventions;
c) modify the layout (e.g. equipment locations, equipment interaction, access paths and means);
d) limit interventions;
e) create additional modes of operation.
Before applying other protective measures, repeat the applicable portions of Clauses 5 and 6.
The IMS shall be designed to facilitate safe manual interventions, including maintenance. For some manual
interventions, it can be impractical to stop the whole IMS, in which case the IMS shall be segregated into
zone(s) where operators can perform their tasks safely.
The primary issue at the IMS level is to determine the best breakdown (or segregation) of the IMS into task
zones where the operator(s) can perform work tasks safely. These task zones shall be in a safe condition (e.g.
stopped – see also Annex D) while other portions of the IMS continue in automatic operation.
14 © ISO 2007 – All rights reserved

ISO 11161:2007(E)
NOTE Task zoning is a measure to create an IMS that is fitted for its function. That means it can achieve its level of
production, and can be adjusted and maintained without putting operators at risk when these operations are carried out
under the conditions foreseen at the IMS design stage. When this requirement is fulfilled, it should prevent operators from
being induced to use unintended operating modes and intervention techniques.
7.2 Determination
Determination of the task zones is an iterative process consisting of the following:
a) determine tasks: requirements, location, access;
b) determine hazards/hazards zones and associated hazardous situations (see Figure 4 and Clause 4 of
ISO 12100-1:2003);
c) determine task zone(s).
The following aspects shall be identified on the layout:
⎯ the location(s) for performing tasks;
⎯ the access route through the IMS to reach the servicing point(s) or operating point(s);
⎯ the parts of the IMS that are required to be stopped for safe intervention, and the rest of the IMS that may
continue to function;
⎯ the parts of the IMS which, when stopped, will prevent the rest of the IMS from operating and will
therefore have an immediate impact on production levels;
⎯ ways to allow the foreseen adjustment, maintenance, repair, cleaning, servicing operations and other
tasks to be performed under safe conditions;
⎯ ways to allow the overall IMS to perform its function, (e.g. to achieve its level of production) when these
operations are carried out under the conditions foreseen at the IMS design stage.
NOTE See Figure 5.
7.3 Design
To determine the task zone(s), an analysis shall be carried out on the layout of the IMS in order to have an
overall understanding of the impact of the foreseen task zones on the functional performance of the IMS.
A task zone can include:
a) one or several machines and/or equipment;
b) the space within and/or around the IMS in which an operator performs tasks;
c) the path(s) to task locations.
Each task zone shall be designed so that the operator is able to easily recognize:
⎯ the perimeter of the task zone;
⎯ the equipment related to the task zone;
⎯ the spans of control of the various control and protective devices (e.g. protective devices, reset of
protective devices, enabling devices, emergency stops, control stations, disconnecting means);
...