Smart and adaptive interfaces for INCLUSIVE work environment€¦ · users, related to the ... The...

Smart and adaptive interfaces for INCLUSIVE work environment

Grant Agreement N°723373

_______________________________________________________________________________________

Deliverable 1.2 - Summary of all safety, health and ethics recommendations for the working environments

Contractual delivery date: 2017-02-28

Actual delivery date: 2017-02-28

Responsible Partner: CIOP-PIB

Author(s):

CIOP-PIB: Marek Dźwiarek, Andrzej Dąbrowski, Mariusz Dąbrowski, Dariusz Kalwasiński, Tomasz Strawiński

RWTH: Julia Czerniak, Alexander Mertens

WP n°: 1

WP leader: UNIMORE

Project Coordinator: Prof. Cesare Fantuzzi

Project Coordinator Organisation: UNIMORE

Dissemination level: Public

The research leading to these results has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement N723377.

The author(s) is/are solely responsible for its content, it does not represent the opinion of the European Commission and the Commission is not responsible for any use that might be made of data appearing therein.

Executive Summary

This deliverable is split into two parts. The first part describes the safety and health recommendations for the smart and adaptive human-machine interfaces (HMI) used in ACCORD 40 FX, Robot bender and INNOKET Neo 80/145-40 LM GT machines.

These recommendations have been developed based on the analysis of the user manuals and the standards for these machines. First, the safety-related functions which are activated through the HMI have been identified for each machine. Then, the health and safety requirements have been assigned to each identified function. If the requirements were not available in the above standards, the risk assessment was carried out using the method developed in the TeSaMa project. A developed set of requirements can be used to confirm that the introduction of a new smart and adaptive HMI results in no loss of conformity with the essential health and safety requirements of the Machinery directive.

The second part provides a collection of relevant aspects that need to be considered developing a smart interaction system able to measure the operators strain while interacting with HMI and able to adapt to the situation. The system includes three specific target user groups: elderly, disabled and inexperienced, who have different skills and capabilities and therefore tend to show differences in perception, cognition and motor skills. Thus, a system, which processes sensitive personal data, which discloses barriers of human capabilities, has to take into account different ethical, social and legal (ELSI) requirements to protect the user against harm and disadvantages. Resulting barriers of human capabilities will be discussed in detail in Task 2.1. For specific user needs of target groups, see Deliverable 1.1.

Based on the MEESTAR approach, which is an instrument for identifying ethical problems, we develop an ELSI concept, including legal requirements according to EU regulations as well as sensitive treatment for target users, related to the development of smart interaction systems for automated production machines.

In order to assess these aspects, on the one hand we analyse the status quo in companies according to ELSI relevance, measures, and need for action; on the other hand, we give an outlook regarding potentials and risks of the INCLUSIVE scenario.

Design recommendations are then derived that include relevant ethical, social and legal aspects, which address a user-centred safe, ergonomic, ethical and legal implementation of the INCLUSIVE system adapting to interaction barriers. This way, we aim at offering fair requirements, independent of individual skills and capabilities.

Table of contents 1. Identification of safety and health specifications for the industrial systems ....................................... 1

1.1. Research methodology _________________________________________________________ 1

1.2. Specification of HSR for HMI used in ACCORD 40 FX machine (Use case 1) ________________ 1

1.2.1. Identification of safety-related functions activated by HMI ..................................................... 3

1.2.2. Normative references ................................................................................................................ 3

1.2.3. List of HSR concerning HMI for identified functions ................................................................. 3

1.3. Specification of HSR for HMI used in Robot bender machine (Use case 2) _________________ 5

1.3.1. Identification of safety-related functions activated by HMI ..................................................... 7

1.3.2. Normative references ................................................................................................................ 7

1.3.3. List of HSR concerning HMI for identified functions ................................................................. 7

1.4. Specification of HSR for HMI used in INNOKET Neo 80/145-40 LM GT machine (Use case 3) _ 10

1.4.1. Identification of safety-related functions activated by HMI ................................................... 12

1.4.2. Normative references .............................................................................................................. 12

1.4.3. List of HSR concerning HMI for identified functions ............................................................... 13

1.5. Conclusions concerning the health and safety specification ___________________________ 15

2. Ethical, social and legal aspects ........................................................................................................... 16

2.1. MEESTAR Model _____________________________________________________________ 16

2.2. Legal requirements ___________________________________________________________ 16

2.2.1. Occupational Safety and Health .............................................................................................. 16

2.2.2. Data Protection ........................................................................................................................ 17

2.3. Target users ________________________________________________________________ 17

2.4. Concept for ethical, social and legal aspects _______________________________________ 18

2.5. Questionnaire _______________________________________________________________ 19

2.5.1. Results ..................................................................................................................................... 19

2.5.1.1. Status Quo ............................................................................................................................... 19

2.5.1.2. INCLUSIVE Scenario ................................................................................................................. 22

2.5.2. Design recommendations ........................................................................................................ 24

2.6. Conclusion _________________________________________________________________ 25

3. Summary .............................................................................................................................................. 25

4. Annexes ............................................................................................................................................... 26

4.1. Annex A - Risk assessment sheets _______________________________________________ 26

4.2. Annex B – Questionnaire ______________________________________________________ 32

1

1. Identification of safety and health specifications for the industrial systems

1.1. Research methodology

The objective of Task 1.2 was to identify the essential health and safety requirements (HSR) which should be met in the design of the smart and adaptive HMI for 3 machines selected as the project use cases, i.e.:

• ACCORD 40 FX (Use case 1), • Robot bender machine (Use case 2), • INNOKET Neo 80/145-40 LM GT (Use case 3).

The first step was to determine the safety-related functions of the machines activated by the operator using the HMI. This was carried out by analysing the tasks of the machine operator described in the user manuals and descriptions provided by the industrial partners. Then, the safety-related functions activated by the operator through the HMI were selected. The selection was made according to EN ISO 13849-1:2016 “Safety of machinery – Safety-related parts of control systems – Part 1: General principles for design” p. 5.1 “Specification of safety functions”. Next, the health and safety requirements were assigned to each identified safety-related function. These requirements were established on the basis of the standards for particular kinds of machines, following the principle of conducting the analysis first based on the C-type standards. If type C standard did not include the requirements for the given function, then type B standard was used and finally - type A standard (for the definition of type A, B and C standards see EN ISO 12100:2010. Introduction). Afterwards, the required performance level (PLr) according to EN ISO 13849-1:2015 for each function was determined. Typically, the relevant information can be found in the type C standard. In the absence of such information, the risk assessment was done. This assessment was conducted according to the methodology and with the use of the software developed in the project “TeSaMa – Technical Safety Maintenance System in Mechanical Engineering”.

The doubts that emerged in the course of determining the health and safety requirements were resolved during the study visit and on the basis of the descriptions set out in Deliverable 1.1. As a result, the health and safety requirements for the HMI of the individual machines were collected and presented in this deliverable in the form of a list.

1.2. Specification of HSR for HMI used in ACCORD 40 FX machine (Use case 1)

The ACCORD 40 FX machine is a numeric control boring - routing machine for working with wood and other materials with similar physical characteristics. The overall view of the machine is shown in figure 1.1.

The structure of the machine has two main elements:

• the load-bearing base A, • the single-piece upright B which moves along the X-axis.

Machining unit C is mounted on a slide D which is moved on the upright B mobile along the Y-axis and includes movement along the Z1 - Z2 - axis. The base is fitted with the worktables E and the reference stops for workpiece positioning. The suction cups F are fitted in the worktables, to secure the workpieces by means of vacuum. The control unit of the machine is installed on the electrical cabinet G and a console G1.

2

Fig. 1.1: Overall view of ACCORD 40 FX machine.

Fig. 1.2: Arrangement of the controls in ACCORD 40 FX machine.

3

1.2.1. Identification of safety-related functions activated by HMI

To identify the safety-related functions activated by the HMI of the ACCORD 40 FX machine, the following documents have been analysed:

• “accord 40 fx INSTRUCTION MANUAL” Rel. 8.0 / 10-2015 s.n. AA2/003498, • “User Guide for the Machine Panel (PanelMac) by Xilog Plus”, v. 2.0 – March 2008, code

0000571272H SCM GROUP. The machine controls are on:

• electrical cabinet A, • mobile control panel B, • worktables C, • console D (also called “remote control panel”), • software control panel (paddle screen).

The arrangement of the machine control elements is shown in figure 1.2.

The tasks conducted by the machine operator have been analysed in detail from the point of view of safety. As a result, the following safety-related functions have been identified as those activated by the machine operator using the HMI:

1. Emergency stop. 2. Normal (operational) stop. 3. Start. 4. Reset. 5. Mode selection. 6. Two-hand control function. 7. Guard locking function. 8. Locking – unlocking of the panel. 9. Indications and alarms.

The selection of the functions was verified during the study visit to SCM GROUP SPA on 15 December 2016, where the tasks of the machine operator were demonstrated and the HMI was observed.

1.2.2. Normative references

For each of the identified safety-related functions the health and safety requirements for the HMI have been determined, taking into account the following standards:

1. EN 848-1:2007+A2:2012. Safety of woodworking machines - One side moulding machines with rotating tool - Part 1: Single spindle vertical moulding machines.

2. ISO/DIS 19085-3:2016. Woodworking machines - Safety - Part 3: NC boring and routing machines. 3. EN ISO 13849-1:2015. Safety of machinery - Safety-related parts of control systems - Part 1: General

principles for design. 4. EN ISO 12100:2010. Safety of machinery - General principles for design - Risk assessment and risk

reduction. 5. EN 60204-1:2016. Safety of machinery - Electrical equipment of machines - Part 1: General

requirements.

1.2.3. List of HSR concerning HMI for identified functions

1. Emergency Stop • The emergency stop functions of the emergency operations shall be initiated by a single human

action. • The emergency stop device shall be provided at each working station and in particular:

a) at the main control panel, b) at the portable control panel hand-held control set, (if provided)

4

c) adjacent to all hold-to-run control devices, d) at the workpiece loading and unloading station, e) close to or inside the tool magazine, where this is separated from the machining area and the

magazine is under power during loading and unloading of the tools, f) inside any enclosure fitted with access door and adjacent to all cycle start control devices.

• Machines with more than one machine actuator or where provision is made for use with more than one machine actuator (e.g. with a socket for a demountable power feed) shall be fitted with an emergency stop control. Emergency stop actuators shall be at any time of self-latching type.

• The emergency stop actuators shall be clearly identifiable, clearly visible and readily accessible. • The hazardous process shall be stopped as quickly as possible without creating additional hazards. • Once active operation of the emergency stop device has ceased following an emergency stop

command, the effect of this command shall be sustained until it is reset. This reset shall be possible only at the location where the emergency stop command has been initiated. The reset of the device shall not restart the machinery, but shall only permit restarting.

• The safety-related part of the control systems (SRP/CS) for emergency stop shall achieve at least performance level PLr = c according to EN ISO 13849-1:2015.

2. Normal (operational) stop • A stop control device shall be placed near each start control device. • Where the start/stop function is performed by means of a hold-to-run control, a separate stop

control device shall be provided when a risk can result from the hold-to-run control device failing to deliver a stop command when released.

• The SRP/CS for normal stopping shall achieve at least PLr = c. 3. Start

• Start functions shall operate by energizing the relevant circuit. • The control devices for start shall be located at the operator’s position adjacent to the control

display (at the main control panel). • The start control device shall be protected against unintended actuation, e.g. by shroud. • Cycle start or restart shall only be possible after actuation of a control device provided for that

purpose, and after start control device activation. • It should not be possible to start the machine from the dangerous zone. These requirements do not

apply in the special mode of operation, for example calibration of the machine. • For each restart, a deliberate action of the operator is required, i.e. safeguard reset. • The SRP/CS for start function shall achieve PLr = c.

4. Reset • Reset devices, if fitted, shall be situated outside the danger zone and in a position from which there

is good visibility for checking that no person is within the danger zone. It shall be prevented to initiate the reset function when standing inside a danger zone.

• A control device to reset the interlocking of the door shall be provided outside the enclosure, not reachable from inside the enclosure (with a clear view of the inside of it).

• Reset of the control for brake shall not initiate a start-up of the machine. • The SRP/CS for manual reset function shall achieve at least PLr = c.

5. Mode selection • The mode selector shall be lockable in any position e.g. by a key-operated switch.

5.1. Machining mode [MODE 1] • The selected speed of spindle shall be indicated prior to spindle start. The selected speed value shall

be displayed to be read easily by the operator. • Because the tool characteristics are not automatically read from the tool, the maximum rotational

speed of the tool needs to be set by the operator after loading of the tool changing system or after manual insertion of the tool. These stored data shall be displayed, and confirmed by the operator. Alternatively, tool ID can be confirmed if already associated with tool maximum rotational speed. When tool ID is edited, tool maximum rotational speed shall be confirmed.

5

• It shall not be possible to select a speed value higher than the maximum rotational speed of the tool stored in the memory of the control system.

5.2. Machine setting mode [MODE 2] • In machine setting mode of operation, when moveable guards are opened and/or protective

devices disabled, any dangerous movement shall only be possible when all following requirements are met: a) spindle rotation, if provided, shall only be possible by a jog control together with an enabling

control; the jog control need not to achieve any PLr; b) only one powered (physical or virtual) axis movement shall be possible at a time; The SPR/CS

for the selection of the axis shall achieve PLr = b; c) any physical or virtual axis movement shall be controlled by a jog control together with an

enabling; d) unexpected movement of the automatic tool change mechanism shall be prevented by SRP/CS

achieving PLr = c; e) the SRP/CS for prevention of unexpected start up shall achieve PLr = c.

6. Two-hand control • Two-hand control device used for controlling hazardous movement of the tool magazine shall be

minimum of type I as defined in ISO 13851:2001 “Safety of machinery - Two-hand control devices - Functional aspects and design principles” and the danger zone shall be completely visible from the place of the operator.

• The safety-related part of control circuits for two-hand control function shall achieve at least PLr = c.

7. Guard locking • Because entering the enclosure is necessary for setting, tool changing, cleaning or

loading/unloading, the door is provided with guard locking by key. The following requirements apply: a) the key must be removed and remain in the possession of the operator; b) audible or visual warning (e.g. a yellow light) of impending start up shall be given if the operator

does not have a complete view of the machining area from the control position; c) emergency stop device shall be placed inside the enclosure if the operator does not have a

complete view of the machining area from the control position. 8. Locking – unlocking of the panel

• Because powered clamping is provided, crushing hazard is prevented by a sequential pedal button/Enables lifting of the stops and locking – unlocking of the panel.

9. Indications and alarms • Safety-related signals and alarms should have pictograms structure according to EN ISO 61310 -

1:2007. Safety of machinery - Indication, marking and actuation - Part 1: Requirements for visual, acoustic and tactile signals.

1.3. Specification of HSR for HMI used in Robot bender machine (Use case 2)

Robot bender machine represents typical machinery designed by Debbache-Lagios EE (GIZELIS). The machine is a combination of a robot and a panel bender. The panel benders work in a different way from traditional press brakes. The sheet metal is inserted into the holding beam which grips the part securely and a moving beam is used for making the bend in the excessive material. The universal tool system enables greater bending precision than conventional bending machines. Bending is performed in both directions, positive and negative, which translates into a great reduction in part cycle time and less operator intervention. The schematic solution of the robot bender machine is shown in figure 1.3 and an example of the machine is shown in figure 1.4.

6

Fig. 1.3: Schematic solution for robot bender machine.

Fig. 1.4: Example of robot bender machine.

7


The project assumes that the robot bender solution will be one of the project outputs, which will be developed by the project partners within the upcoming work packages. That is why, the user manual for it has not been elaborated and available during Task 1.2 implementation. As a consequence, the safety-related functions have been identified in this case on the basis of the information gathered in the following documents:

• Robot in bending application Use case, • D1.1. Summary of all the requirements of the project – v4.

As a result, the following safety-related functions have been identified as those activated by the machine operator using the HMI:

1. Emergency stop. 2. Start/actuating. 3. Mode selection. 4. Enabling. 5. Reset.



1. ISO 10218-1:2011. Robots and robotic devices - Safety requirements for industrial robots - Part 1: Robots.

2. ISO 10218-2:2011. Robots and robotic devices - Safety requirements for industrial robots - Part 2: Robot systems and integration.

3. EN ISO 13849-1:2015. Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design.

4. EN ISO 12100:2010. Safety of machinery - General principles for design - Risk assessment and risk reduction.

5. EN 60204-1:2016. Safety of machinery - Electrical equipment of machines - Part 1: General requirements.


1. General requirements • Operational controls and equipment (e.g. weld controller, pneumatic valves, etc.) requiring access

during automatic operation shall be located outside the safeguarded space forcing a person using the control actuators to be outside the safeguarded space. Controls and equipment should be placed and constructed so as to allow a clear view of the robot restricted space.

• Means of selecting and deselecting local control shall be in close proximity to the robot or machine or sub-assembly being placed under local control. If local control can be deselected from within the safeguarded space, a separate confirmation from outside the safeguarded space shall be necessary prior to any hazardous conditions being present.

• When cableless or detachable teach pendants are used with the robot system, the following shall apply: a) the possibility of unintentionally controlling a robot system shall be avoided by unambiguous

means to indicate connection continuity (e.g. screen display); b) an unambiguous means shall be provided to disconnect robot control from the pendant (e.g. a

positive action by the operator), and when devices are logged out, it shall be clearly recognizable that the relevant safety functions are not active anymore.

2. Emergency stop • Every robot, robot system or cell shall have one or more independent emergency stop functions.

8

• The respective functions shall have the ability for the connection of additional protective or emergency stop devices.

• Each control station capable of initiating robot motion or other hazardous situation shall have a manually initiated emergency stop function that: a) remains active until it is reset; and b) shall only be reset by manual action that does not cause a restart after resetting, but shall only

permit a restart to occur. • The pendant or teaching control device shall have an emergency stop function. • Once active operation of the emergency stop device has ceased following an emergency stop


• In addition the emergency stop function has the following requirements: a) it shall override all other functions and operations in all modes; b) it shall stop the hazardous motion as quickly as practicable without creating other hazards.

• The safety-related part of the control systems (SRP/CS) for emergency stop shall achieve at least PLr = d.

3. Start/ actuating • Actuating controls shall be constructed or located so as to prevent unintended operation. • The robot control system shall be designed and constructed so that when the robot is placed under

local pendant control or other teaching device control, initiation of robot motion or change of local control selection from any other source is prevented.

• The status of the actuating controls shall be clearly indicated. • Actuating controls shall be labeled to clearly indicate their function. • The safety-related part of the control systems (SRP/CS) for start function shall achieve at least PLr

= d. 4. Mode selection

• Operational modes shall be selectable with a mode selector which can be locked in each position. Each position of the selector shall be clearly identifiable and shall exclusively allow one control or operating mode.

• Unauthorized and/or inadvertent mode selection shall be prevented by suitable means. • The selector can be replaced by another selection means which restricts the use of certain functions

of the robot. These means shall: a) unambiguously indicate the selected operating mode; and b) by themselves not initiate robot motion or other hazards.

• An optional output(s) may be provided to indicate the mode selected. When provided for safety-related purposes, the output(s) shall achieve at least PLr = d.

4.1. Automatic mode • Automatic operation shall only be initiated from outside the safeguarded space. • A visual indication that safety devices are suspended shall be provided at the mode selection device,

the cell entrance(s) and any affected operator stations. • Where safeguards are to be suspended machinery and equipment required for the task shall be

under the direct control of the operator. • It shall not be possible to activate robot automatic operation using the pendant or teaching control

device exclusively. There shall be a means for a separate confirmation action located outside the safeguarded space prior to activating the automatic mode.

4.2. Manual reduced-speed control • Manual reduced-speed mode actuators shall be labeled to clearly indicate their function and shall

allow a robot to be operated by human intervention. • Manual control of the robot from inside the safeguarded space shall be performed with a reduced

speed in conjunction with either of the following: a) hold-to-run controls in conjunction with an enabling device, or

9

b) for programme verification only, a start/stop control in conjunction with an enabling device. • Where safeguards are to be suspended machinery and equipment required for the task shall be

under the direct control of the operator. 4.3. Manual high speed control • If this mode is provided, speeds greater than 250 mm/s can be achieved. This mode is used for

programme verification only. In this case, the robot shall: a) have a means to select manual high-speed mode which requires a deliberate action and an

additional confirming action; b) provide a pendant with a hold-to-run function in addition to the enabling device that permits

robot motion to continue; c) set an initial speed limit of up to, but not exceeding, 250 mm/s upon selection of manual high-

speed mode; d) provide on the pendant a means for the operator to incrementally adjust the speed from the

initial value to the full programmed value in multiple steps; e) provide on the pendant an indication of the adjusted speed; f) ensure that:

f.1. its speed is limited to the initial speed limit when the enabling device is re-initiated by placing the switch in the centre-enabled position after either having been released or fully compressed, and

f.2. a separate deliberate action is required to return to the higher speed that was selected before the enabling device switch was released or compressed, and

f.3. the option to resume the higher speed using the separate action shall become inoperative after no more than five minutes after the release of the enabling device.

• Where safeguards are to be suspended machinery and equipment required for the task shall be under the direct control of the operator.

• When provided, safety-related speed control shall achieve at least PLr = d. 5. Enabling

• When more than one person is required to be protected within the safeguarded space, an enabling device shall be provided to each person. Interlocked hazardous machine functions shall require a separate act to restart after being controlled (stopped) by the enabling device.

• The pendant or teaching control device shall have a three-position enabling device. When continuously held in a centre-enabled position, the enabling device shall permit robot motion and any other hazards controlled by the robot. The enabling device shall have the performance characteristics outlined below. a) The enabling device may be integral with, or physically separate from, the pendant control and

shall operate independently from any other motion control function or device. b) Release of or compression past the centre-enabled position of the device shall stop hazards.

This function shall achieve at least PLr = d. c) After compression past the centre-enabled position of the enabling device, the enabling device

needs to be fully released. Going from fully compressed to the centre position shall not permit robot motion.

d) When two or more enabling switches are provided on a single enabling device/pendant to allow alternating left- or right-handed operation, any or all switches can be in the centre-enabled position: d.1. when only one of the switches is being used and is in the centre-enabled position it shall

function as described in b); d.2. when the enabling device design allows both switches to be held in the centre-enabled

position to allow changing from left- to right-hand operation, releasing one switch shall not cause a protective stop but fully depressing either switch shall override the control of the other switches and cause a protective stop.

10

e) When more than one enabling device is in operation (i.e. more than one person is in the safeguarded space with an enabling device), motion shall only be possible when each device is held in the centre (enabled) position at the same time.

• The safety-related part of the control systems (SRP/CS) for enabling shall achieve at least PLr = d. 6. Reset

• After a stop command has been initiated by a safeguard e.g. light curtain, the stop condition shall be maintained until safe conditions for restarting exist.

• The manual reset function shall: - be provided through a separate and manually operated device within the SRP/CS, - be by deliberate action, - enable the control system for accepting a separate start command.

• The reset actuator shall be situated outside the danger zone and in a safe position from which there is good visibility for checking that no person is within the danger zone.

• Where the visibility of the danger zone is not complete, a special reset procedure is required. • When presence sensing is not practicable to detect the operator in the shared workspace, a

restart interlock shall be provided. Other measures shall be provided to prevent inadvertent resetting of the restart interlock, so preventing the robot system from moving into the workspace while the operator remains in the workspace. Such measures can include the provision of a separate manual reset.

• When manual reset is provided, the whole of the shared workspace shall be visible from the reset device. If this is not possible, further measures shall be applied.

• The safety-related part of the control systems (SRP/CS) for reset shall achieve at least PLr = d.

1.4. Specification of HSR for HMI used in INNOKET Neo 80/145-40 LM GT machine (Use case 3)

The machine INNOKET Neo 80/145-40 LM GT is designed to paste labels on bottles. Its construction is modular and consists of a sliding table, a rotating table and labeling stations. The overall view of the machine is shown in figure 1.5. The arrangement of the control devices on the machine INNOKET Neo is shown in figure 1.6. Figure 1.7 and figure 1.8 present the control devices on the operator console and the additional control devices for jog mode of operation.

1 Rotating table 2 Safety guards 3 Sliding table 4 Electrical cabinet 5 Control panel for dating 6 Operator console 7 Labeling station KL 8 Labeling station SK

Fig. 1.5: Overall view of INNOKET Neo machine.

11

Emergency stop button

START button

STOP button

Acknowledge message

RFID card reader

Fig. 1.7: Operator console.

1 Operation console 2 Buttons area 3 Key switches (jog mode) 4 Acceptation switch

Fig. 1.6: Control devices on INNOKET Neo machine.

12


To identify the safety-related functions activated by the HMI of the INNOKET Neo 80/145-40 LM GT machine the following documents have been analysed:

1. Instrukcja Etykieciarka Neo 2080 / 145-40 LM GT, Numer maszyny: 1306, Zlecenie: 89404953, Pozycja: 000300.

2. Setup work plan. Labeling machine Neo 90 / 120-60 RM PT, Machine number: 1234, Order: 12345678, Item: 123456.

3. Standard operating procedure. 4. One-point lesson. Labeling machine Neo 90 / 120-60 RM PT, Machine number: 1234, Order:

12345678, Item: 123456. 5. Isolation. Labeling machine Neo 90 / 120-60 RM PT, Machine number: 1234, Order: 12345678, Item:

123456. 6. Operating instructions. Direct Print 5cCD-4. Direktdruckmaschine. Machine number: 10329602,

Order: 89405269, Item: -. As a result, the following safety-related functions have been identified as those activated by the machine operator using the HMI:

1. Emergency stop. 2. Start/Restart. 3. Manual Reset. 4. Mode selection/muting. 5. Hold-To-Run. 6. Enabling Device Function. 7. Locking of the machine.



1. EN 415-10:2014. Safety of packaging machines. General Requirements. 2. EN ISO 13849-1:2015. Safety of machinery - Safety-related parts of control systems - Part 1: General

principles for design. 3. EN ISO 12100:2010. Safety of machinery - General principles for design - Risk assessment and risk

reduction. 4. EN 60204-1:2016. Safety of machinery - Electrical equipment of machines - Part 1: General

requirements.

1 Acceptation switch 2 Jog mode button 3 Emergency stop button

Fig. 1.8: Control device used in jog mode of operation.

13

5. ISO/PWI TR 22100-4. Safety of machinery – Relationship with ISO 12100 – Part 4: Guidance and consideration of security-related aspects (Working title).

6. IEC/CD 63074:2017. Safety of machinery – Security aspects related to functional safety of safety-related control systems.

7. “The development of the principles for RFID technology application in the safety of machinery domain and for the conformity assessment of these solutions with the essential requirements. Final report”. CIOP-PIB. 2016.


1. Emergency stop • Each control station shall be provided with an emergency stop actuator. • Emergency stop actuators and emergency switching off actuators on packaging machines shall not

be fitted with any mechanical means for protection against unintended actuation or for other reasons. The actuator shall be readily accessible without any obstacle. Unintentional actuation shall be prevented by the suitable positioning of the actuator.

• Emergency stop actuators on packaging machines shall not have any additional function, e.g. means for locking. Because of the risk of injuries no emergency stop actuators with a front key lock shall be used on packaging machines.

• The emergency stop actuators shall be clearly identifiable, clearly visible and readily accessible. • Once active operation of the emergency stop device has ceased following an emergency stop


• Emergency stop function shall override all other functions and operations in all modes. • It shall stop the hazardous motion as quickly as practicable without creating other hazards. • The safety-related part of the control systems (SRP/CS) for emergency stop shall achieve at least

PLr = c. 2. Start/Restart function

• Actuating controls shall be constructed or located so as to prevent unintended operation. • A restart shall take place automatically only if a hazardous situation cannot exist. In particular, for

interlocking guards with a start function. • Where safety functions and/or protective measures cannot be applied for certain operations,

starting of such operations shall be by hold-to-run controls, together with enabling devices, as appropriate.

• There are no requirements for PL of this function in EN 415-10:2014, so the risk assessment has been conducted (see Annex A). According to its results, the safety-related part of the control systems (SRP/CS) for start function shall achieve at least PLr = c.

3. Manual reset function • After a stop command has been initiated by a safeguard, the stop condition shall be maintained

until safe conditions for restarting exist. • The manual reset function shall:

- be provided through a separate and manually operated device within the SRP/CS, - be by deliberate action, - enable the control system for accepting a separate start command,

• The reset actuator shall be situated outside the danger zone and in a safe position from which there is good visibility for checking that no person is within the danger zone.

• Where the visibility of the danger zone is not complete, a special reset procedure is required. • There are no requirements for PL of this function in EN 415-10:2014, so the risk assessment has

been conducted (see Annex A). According to its results, the safety-related part of the control systems (SRP/CS) for manual reset function shall achieve at least PLr = c.

14

4. Machine locking (RFID card reader) The standards providing HSR for a machine locking system based on RFID device are not available yet. Therefore, the HSR for this function have been established based on the results of the research project “The development of the principles for RFID technology application in the safety of machinery domain and for the conformity assessment of these solutions with the essential requirements” conducted in CIOP-PIB.

• Identification code placed in the RFID transponder (RFID card) shall not be adjustable. It shall not be possible to update the database of identification codes implemented in the RFID card reader without the use of a special tool or key-word dedicated for this purpose. Recommendation of ISO/PWI TR 22100-4 and IEC/CD 63074:2017 concerning security aspects should be observed.

• The time of identification remaining shall be not greater than specified by the risk assessment. The adjustment of this time shall not be possible without the use of a special tool or key-word dedicated for this purpose. Recommendation of ISO/PWI TR 22100-4 and IEC/CD 63074:2017 concerning security aspects should be observed.

• RFID identification function shall be effective over the identification zone situated outside the danger zone. The adjustment of the identification zone shall not be possible without the use of a special tool or key-word dedicated for this purpose. Recommendation of ISO/PWI TR 22100-4 and IEC/CD 63074:2017 concerning security aspects should be observed.

• If it is possible, the RFID safety equipment shall detect the faults related to improper operation of the transponder and/or reader including the wrong identification code, transmission errors, the failures of the reader, antenna, database computing system and reasonably others.

• In the fault state the OSSD of RFID safety equipment shall go to the OFF state and the OFF state shall be kept until the fault is removed. After the power supply is switched ON, the RFID safety equipment shall perform a testing procedure to detect the detectable faults. If the fault occurs, the RFID safety equipment shall not go to the normal operation state.

• The safety-related part of the control systems (SRP/CS) for machine locking function shall achieve at least PLr = a.

5. Mode selection/Muting • Machinery shall be fitted with a mode selector which can be locked in each position (e.g. key

operated switch). Each position of the selector shall be clearly identifiable and shall correspond to a single operating or control mode.

• The selector may be replaced by another selection method which restricts the use of certain functions of the machinery to certain categories of operator (e.g. access code).

• Indication of the selected operating mode shall be provided (e.g. the position of a mode selector, the provision of an indicating light, a visual display indication).

• Mode selector shall be placed outside the danger zone and not reachable from there. • There are no requirements for PL of this function in EN 415-10:2014, so the risk assessment has

been conducted (see Annex A). According to its results, the safety-related part of the control systems (SRP/CS) for mode selection shall achieve at least PLr = a.

In jog mode with open guards the reduced risk conditions shall be provided subject to all of the requirements below.

• Use an enabling device such as a hold-to-run control, an electronic hand wheel or a joy stick. • At least two-position hold-to-run control shall be used. • An emergency stop device shall be placed in the proximity of the hazard. • Mobile control devices shall be fitted with an emergency stop device. • The enabling control device shall be positioned so that the operator has a clear view of all the parts

of the machine where the hazardous functions are possible. 6. Hold-To-Run (in jog mode)

• Hold-to-run controls shall require continuous actuation of the control device(s) to achieve operation.

• Hold-to-run function shall only be available after a lockable mode selectors operated. • A stop control device shall be placed near each hold-to-run control device.

15

• There are no requirements for PL of this function in EN 415-10:2014, so the risk assessment has been conducted (see Annex A). According to its results, the safety-related part of the control systems (SRP/CS) for emergency stop shall achieve at least PLr = a.

7. Enabling Device • Enabling control is a manually activated control function interlock in jog mode. • Enabling control shall be so arranged as to minimize the possibility of defeating. • There are no requirements for PL of this function in EN 415-10:2014, so the risk assessment has

been conducted (see Annex A). According to its results, the safety-related part of the control systems (SRP/CS) for enabling function shall achieve at least PLr = a.

1.5. Conclusions concerning the health and safety specification

This part of the deliverable specifies the health and safety requirements of the EU directives and the standards harmonised with those directives. The requirements have been collected separately for each of the identified safety-related functions for each of the three use cases. They constitute a set of all the requirements for a traditional HMI. If any changes are made to the HMI, then for obvious reasons, some of these requirements will have to be amended as well depending on the HMI design. However, a designer must ensure that the modification of the HMI will not entail the loss of any of the safety-related functions.

The HMI designer should carefully analyse which of these functions will have to be activated through the classical HMI and which will be activated by the smart and adaptive HMI. Under exceptional circumstances, the designer can opt out from some functions. He must, however, explicitly demonstrate that the operator’s safety is still ensured by other means.

While planning changes to the HMI, it is necessary to consider the effects of both an accidentally initiated function as well as the lack of the system response to the signal initiating the function brought by an operator.

Therefore, different priorities should be applied to functions such as START and CHANGE the OPERATING MODE where accidental activation may trigger a dangerous situation. Also, other priorities should be used in the case of such functions as EMERGENCY STOP where no or too slow reaction can be especially dangerous. As a result, in the case of such functions as START and CHANGE the OPERATING MODE the lack of response of the control system to a signal sent by an operator will not cause dangerous situations. Similarly, in the case of the EMERGENCY STOP the accidental activation of the function will not lead to hazardous conditions. Therefore, the efforts of the HMI designer should primarily focus on the application of solutions designed to prevent dangerous situations related to the activation or the lack of the activation of the function.

Thus, the HMI designer should use the following procedure:

1. Analyse the above safety-related functions activated by the HMI.

2. Specify which functions will be activated by traditional means and which by the adaptive HMI.

3. In the case of functions activated by a traditional interface, make sure that all of the health and safety requirements are fulfilled.

4. In the case of functions activated by an adaptive interface, determine which measures will be applied to ensure the operator’s safety, as in the case of the traditional interface.

5. Indicate which design measures will be applied in order to achieve the required PLr.

Before starting the tests involving a group of machine operators, it should be confirmed that the application of the new smart and adaptive HMI does not result in the loss of the conformity of machinery with the essential requirements of the Machinery directive 2006/42/EC. This deliverable can be used to draw up checklists to make sure that the above conformity is observed.

16

2. Ethical, social and legal aspects

2.1. MEESTAR Model

The MEESTAR Model is an analytical instrument which guides the process of reflecting on the use of technology (see figure 2.1). It was originally developed for socio-technical arrangements in the field of age appropriate assisting systems (Manzeschke, 2015). The Model aims at identifying ethically problematic effects in a structured way.

Fig. 2.1: MEESTAR: x-axis: dimensions of ethical evaluation; y-axis: stages of ethical evaluation; z-axis: levels of ethical evaluation.

Working with MEESTAR involves the systematic consideration of three axes. The x-axis consists of seven ethical dimensions: care, autonomy, safety, justice, privacy, participation and self-conception. The y-axis describes stages of ethical evaluation, allocating problems among four levels of ethical sensitivity. The z-axis provides three points of view (individual, organizational, social).

2.2. Legal requirements

2.2.1. Occupational Safety and Health

The European Union distinguishes occupational safety and health into two main areas:

principles for the creation of a unified internal market specifically binding uniform product requirements for all EU Member States,

as well as minimum requirements on working conditions and obligations to the employer, according to safety, hygiene and health by the Social Charta.

Regarding both areas, the EU has issued guidelines which must be implemented by every EU Member State within a certain period of time into national law.

SocialLeve

l

Stage I: Its use is completely harmlessfrom an ethical viewpoint

Stage II: Its use is ethically sensitive but this can in practise becompensated for

Stage III: Its use is ethically extremly sensitive and requires either permanent moni-toring or its introduction should bequestionned

Stage IV: Its use should be opposed from an ethical viewpoint

Organ

isation

al Level

Ind

ividu

al Level

17

Fig. 2.2: Systematics of legal requirements of the European Union

The EU regulations are founded on the legal basis of Article 153 (for the working environment) and 114 (for products) of the Treaty on the Functioning of the European Union (TFEU1). The legal foundations are concretized in regulations such as European directives and standards. The main directives in the context of production machines are the Machinery Directive 2006/42/EC2 about construction of safety-related products and the Council Directive on the introduction of measures to encourage improvements in the safety and health of workers at work 89/391/EEC3 about organization of work for the safety and health of workers. The discussed systematics of legal requirements of the European Union is shown in figure 2.2.

2.2.2. Data Protection

According to Directive 95/46/EC4 (Data Protection Directive), the European Parliament and the European Council have laid down minimum standards for data protection in EU Member States. All EU Members must translate these minimum standards in national law, what still leads to differences in implementation. In May 2018, the General Data Protection Regulation5 (GDPR) becomes effective and thus a uniform data protection right is established for the entire European Union. The objectives of the EU-GDPR are the protection of the fundamental rights and freedom of persons. The above objectives are to be achieved by the following principles: legality, good faith, transparency, specified purpose, data minimization, correctness, storage limitation, integrity and confidentiality, accountability. Above all, the new transparency and information requirements of the companies lead to a considerably stronger protection of the affected parties, than the current regulations of the Federal Data Protection Act.

2.3. Target users

The INCLUSIVE system will be used by the following three target user groups: elderly disabled and inexperienced. All of these persons have special characteristics (see table 2.1) and therefore differences in perception, cognition and motor skills. Resulting barriers of human capabilities will be discussed in detail in Task 2.1. For specific user needs of target groups, see Deliverable D1.1.

1 TFEU: Treaty on the Functioning of the European Union, http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012E/TXT (26 January 2017) 2 http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32006L0042 (access on 13 February 2017) 3 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:01989L0391-20081211 (access on 13 February 2017) 4 http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:31995L0046 (access on 14. February 2017) 5 http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.DEU&toc=OJ:L:2016:119:TOC (access on 14.Febrary 2017)

European UnionTreaty of Lisbon (1st December 2009)

Principles for creation of a unified internal market

Products (Machines, Devices, construction Products)

Harmonization of technical regulations and standards

(obligatory requirements)

Social ChartaPrinciples for Safety, Hygiena, Health

at work

Work environmentSaftey and Health at work

(Minimum regulations)

EU directives and regulationsArticle 114 TFEU*

EU directives and regulationsArticle 153 TFEU*

=

http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012E/TXT

http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012E/TXT

http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32006L0042

http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:01989L0391-20081211

http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:31995L0046

http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.DEU&toc=OJ:L:2016:119:TOC

http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.DEU&toc=OJ:L:2016:119:TOC

18

Table 2.1: Target user characteristics

Elderly Disabled Inexperienced

People in the last years of their work life. Generally, these workers have a large experience in the traditional industrial processes, but are not familiar with modern computerized devices and, then, have difficulties in utilizing modern automatic machines that come with complex HMIs.

People with physical impairment and limited cognitive abilities. Such limitations introduce difficulties in the use of complex automatic machines. Therefore, in order to reduce these difficulties it is important to take into account their special needs.

This class of users includes people with low level of education, limited expertise in the use of automatic machines and/or computerized HMI, and lack of experience in the industrial processes.

2.4. Concept for ethical, social and legal aspects

Matching the MEESTAR dimensions show several intersections with legal requirements and target users (see figure 2.3):

caring for users with skills and capabilities, limited different in forms due to personal background,

giving these users possibility for an autonomous interaction with automated production systems,

fulfilling standards for safety and justice, addressing employers corporate duties by law, as well as

sensitively approaching the employees right to privacy according to legal requirements, by treating personal data with dignity and respect

The following technical terms can be derived from these intersecting aspects according to an industrial engineering context:

− Occupational Health − Occupational Safety − Data protection − Ergonomic Workplace Design − Equal Opportunities − Reintegration

Fig. 2.3: ELSI concept

MEESTAR

Target Users

Legal requirements

ParticipationSelf-

conception

Elderly

Disabled

Unskilled

PrivacyData

Protection Safety & JusticeOccupational

Safety & Health

ErgonomicWorkplace Design

Care & Autonomy

EqualOpportunities

ReintegrationCouncil Directive

89/391/EEC

Machine Directive2006/42/EC

General Data Protection Regulation

(GDPR) 2016/679

19

2.5. Questionnaire

To assess the discussed dimensions of ethical, social and legal issues, a questionnaire was developed, concerning of questions to all six dimensions (see Appendix B). The questionnaire is divided into two main parts. One part includes questions to the status quo in the companies and should give a clue to actual measures and need for actions. The second part includes questions regarding the following scenario:

“The working machines are equipped with sensors that are able to track strain of a working person by real-time measurement of his/her physiological parameters, e.g. heartrate, blood pressure, etc. If the measured strain indicators are too high, the human-machine-interface adapts to the situation resulting in a lower stress level.”

The questionnaire was distributed to all members of the consortium, to consider all relevant stakeholders that are affected. Seven partners from Italy, Germany, Turkey and Greece participated in the study. Part one was completed only by six participants. Participants were employed at companies in the following sectors:

IT,

Technology Transfer,

Industrial Automation,

White Goods,

Packaging and

Bottling.

2.5.1. Results

2.5.1.1. Status Quo

1) Does your company have a [dimension] management system/division or something comparable? If yes, how many people are employed in this field?

Results show that amongst participants, most commonly implemented management systems are occupational safety & health management systems and data protection divisions (see figure 2.4). In these sections companies also use to employ more people on average. Ergonomic workplace design is conducted by 3 of 7 companies. Figure 2.5 shows that management systems for discussed dimensions do exist in nearly every participant’s company with 1-5 employees. Though, large management divisions with more than 10 people only exist for occupational health, safety and data protection. Hence, neither equal opportunities nor reintegration management is well implemented, for only one participant each reported to employ 1-5 experts in this field. Table 2.2 shows concrete answers to implemented measures and need for action in the companies.

20

Fig. 2.4: Implemented management systems per dimension; n=6

Fig. 2.5: Number of persons working in management system per dimension; n=6

Table 2.2: Implemented successful measures and need for action per dimension; n=6

Dimension Successful Measures Need for action

Occupational Health

Employee participation in OHS

Health monitoring

Psychological support

Emergency Teams & First Aid Kits

Personal protective devices

Periodic air measure & dust absorption

Promote safe behavior & responsible work practices

Training and work scheduling

Drive continuous improvement

Identify hazards and take preventive actions

OHSAS18001, to increase robotic applications, to assume qualified person

0

1

2

3

4

5

6

7

OccupationalHealth

OccupationalSafety

Dataprotection

ErgonomicWorkplace

Design

EqualOpportunities

Reintegration

n/a

no

yes

0

0,5

1

1,5

2

2,5

3

3,5

1-5 6-10 >10

Occupational Health

Occupational Safety

Data protection

Ergonomic Workplace Design

Equal Opportunities

Reintegration

21

Occupational Safety

Safety reports, trainings & preventions

Personal protective devices

Technical safety requirements

Communication, education and training

OHSAS18001, to increase robotic applications, to assume qualified person

More personal protective devices

Data protection

Database

Software & knowhow protection

USI 27001

Hotspot system for Wi-Fi safety & firewall

Anonymization

Arrangement of Confidentiality (customer data)

Domain name protection

Use of FLOSS software

More attention to trade dress


Ergonomics trainings

Internal physiotherapists

Fitness programs

Workplaces built according to law requirements

Workstations, lifting tables, pallet conveyor, ergonomic chairs, additional monitors

Workplace assessments, ergonomic risk assessments, tool testing

Hanging of torque controlled tools, minor/major material box used in conveyor

Equal Opportunities

Definition of workplace harassment procedures, promotion of multi-ethnical work

Anti-discrimination campaigns

Employees sensitization

Reintegration Reintegration of handicapped people

Reintegration after long illness

Anti-discrimination campaigns

Employees sensitization

2) On a scale from 1 “very little” to 10 “very high”, how do you access the overall relevance of this topic in your company?

Figure 2.6 shows the mean value of the estimated overall relevance of each dimension for the company. Occupational safety (7.2 points), Data protection (7 points on average) and Occupational health (6.7 points on average) were assessed most relevant. The relevance of Ergonomic workplace design still was assessed above mean (6.2 points). The relevance of equal opportunities as well as Reintegration (4.7 points) were rated below mean.

22

Fig. 2.6: Mean of estimated overall relevance for company per dimension

2.5.1.2. INCLUSIVE Scenario

1) According to [dimension], do you see a potential of improvement/risks in measuring strain of a working person as described in the scenario above?

Regarding the results, most participants (6 out of 7) see potential of improvement in Occupational health as well as Ergonomic workplace design by means of the INCLUSIVE system. Hence, both dimensions were also rated with the highest potential risks, besides data protection and equal opportunities (4 mentions). In the case of two dimensions, namely data protection and equal opportunities, the assessed risk overcomes the potential of improvement. While relations of Equal opportunities are balanced (4 to 3), only one participant estimated a potential of improvement for Data protection due to measuring of strain of a working person. Reintegration was only assessed as risky by two participants. Table 2.3 shows concrete mentioned aspects for improvements and risks of the system.

Fig. 2.7: Number of estimated potential of improvement and risk per dimension; n=7

0

1

2

3

4

5

6

7

8

9

10

po

ints

Ocupational Health

Occupational Safety

Data Protection

Ergonomic Work Design

Equal Opportunities

Reintegration

0

1

2

3

4

5

6

7

OccupationalHealth

OccupationalSafety

Data protection ErgonomicWorkplace

Design

EqualOpportunities

Reintegration

Potencial of improvement Risks

23

Table 2.3: Potential of improvement and risk per dimension; n=7

Dimension Potential of improvement Risks

Occupational Health

health detection

HMI can adapt to tasks hard to accomplish

Avoid injuries or dangerous operation

Qualified personal improvement

Less mistakes in production

- Intrusive measures - Strain through dynamic changing

processes - put more strain to the worker

instead of helping him due to production capacity needs

Occupational Safety

prevention from dangerous procedures through HMI

Higher level of attention avoiding dangerous operations

Improvement of working conditions

Less strain results in more safety

Limitation of potential injuries

Predict and estimate risk & strain becomes complex operation

System reassures user

obstacles in operation (for example risk of stumble in cables

Data protection

Record all parameters and control the personal machine conformity

Easy adaption according to person’s capacities

Physical improvement by improvement of transferring tools

Risk about sharing the related information with the personal machine

Personal background can be responsible for strain

Data confidentiality must be guaranteed

Operator could feel monitored, controlled ( measurement has to be acknowledged)


Also workplace adaption according to measured strain possible

Rigid postures

Incorrect adaption could result in higher strain levels

Obstacles in safe movement

Dependency of ergonomic design on strain

Equal Opportunities

Strain level could be indicator for continuous harassment

Increase self-confidence

increase expectation of working quality

adaption to disparate capabilities

HMI is not usable equally for users with different requirements

false impression of safety could occur

Reintegration HMI can report, if an operator loses ability to accomplish a task

potentiation of skills

compensation of deficits

monitoring to strain caused by illness

operator could feel monitored & controlled about capabilities, resulting in higher strain levels

24

2) On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to [dimension]?

According to these findings, the impact of strain measurement according to each dimension is mostly rated positively above 6 points, except two dimensions: data protection (5.1) and Equal opportunities (5.3). The influence of strain measurement on Reintegration (6.9) and occupational health (6.8) was rated highest. The impact of stress measurement on occupational safety (6.3) and ergonomic workplace design (6.4) was rated second highest.

Fig. 2.8: Mean impact of strain measurement per dimension; n=7

2.5.2. Design recommendations

Against the background of INCLUSIVE, to make the system accessible to special user groups with special needs and requirements regarding an adaptive and efficient work support, the aspects equal opportunities and reintegration also build important parameters.

When designing the HMI, it has to be taken into account, that the complexity resulting from the adaptive HMI behavior prevents inducing strain itself. In addition, the system should consider effective anonymization of personal user data. Otherwise, there would be the risk that performance assessment for instance leads to a termination of employment. Moreover, the system should depict all relevant user requirements and ensure that nobody is discriminated. According to respondents’ answers the supporting system should also ensure that the users do have to respect safety regulations. Here, the system should on the one hand, meet relevant safety criteria, and despite of weighting the user in false security, call his attention. The measuring system should also take into account that the user is not distracted while working and that there is not a risk of stumbling. According to doubts of participants, the system should in no case cause injury to health by means of inductive measuring technology.

The following design recommendations for ethical, social and legal aspects can be derived regarding the consortiums estimates (table 2.3):

[DR1] The system prevents inducing strain itself [DR2] The system considers anonymized personal data [DR3] The system uses collected data not for any disadvantage for the employer [DR4] The system depicts relevant user requirements and prevents discrimination [DR5] The system should meet all relevant safety criteria [DR6] The system should not distract the operator [DR7] The system should not cause injuries by means of inductive measuring technology

0

1

2

3

4

5

6

7

8

po

ints

Ocupational Health

Occupational Safety

Data Protection

Ergonomic Work Design

Equal Opportunities

Reintegration

25

2.6. Conclusion

Responses to the questions on the status-quo suggest that the company's objectives are on occupational safety & health management systems and data protection divisions, as well as on ergonomic workplace design (see figure 2.4). The topic relevance is also reflected in the number of employees in each management division (figure 2.5). In these fields, most measures have been implemented successfully by now. The fact that many aspects are mentioned as requiring actions reflects the comprehensive critical analysis of these issues (table 2.2). Equal opportunities and reintegration are less focused on the average and, at the same time, less measures haven been implemented. With regard to the required action, fewer measures are mentioned. Only one company maintains reintegration management: they employ five people in the equal opportunities division and have defined harassment procedures and promotions of multi-ethnical work. These circumstances are also reflected in topic’s relevance assessment, resulting in a focus on the four topics mentioned above (figure 2.6).

Regarding potentials and risks arising from strain measurement in working machines, the participant’s perspective is displayed in figure 2.7. The dimensions occupational health and ergonomic workplace design are considered as providing the greatest potential for improvement Hence, according to the assessment of the respondents, these fields at the same time represent the highest risks. A comparable risk is seen in data protection and equal opportunities. However, these dimensions are perceived riskier than having potential for improvement.

Besides project objectives, such as increasing production efficiency and quality, early recognition of safety risks and supporting deficits in capabilities, potentials of improvement are considered as an improvement for the operator’s health by continuously monitoring and recognizing health risks. The respondents also assumed that stress level can be regarded as an indicator of continuous discrimination. Furthermore, the positive effect on self-confidence in the handling of the machine is regarded as a potential improvement for users with limited skills. Risks are mainly seen in the facts that dynamic adaptive systems can increase the operator’s strain level and personal data is not treated confidentially. In addition, one concern was that the system will have different requirements and thus cannot be used equally well by all users, regardless of its objectives.

3. Summary

This deliverable presents both:

- safety and health specifications for the industrial systems, and - ethical, social and legal aspects for the working environments.

The first part describes in detail the safety and health recommendations for the smart and adaptive human-machine interfaces (HMI) used in ACCORD 40 FX, Robot bender and INNOKET Neo 80/145-40 LM GT machines. These recommendations are presented as a set of requirements for safety-related functions activated using HMI. They can be used to draw up checklists to make sure that the application of the new smart and adaptive HMI does not result in the loss of the conformity of machinery with the essential health and safety requirements of the Machinery directive 2006/42/EC. It should be confirmed before starting the tests involving a group of machine operators.

The second part provides a collection of relevant aspects that need to be considered developing a smart interaction system able to measure the operators strain while interacting with HMI and able to adapt to the situation. The system includes three specific target user groups: elderly, disabled and inexperienced, who have different skills and capabilities and therefore tend to show differences in perception, cognition and motor skills. Thus, a system, which processes sensitive personal data, which discloses barriers of human capabilities, has to take into account different ethical, social and legal (ELSI) requirements to protect the user against harm and disadvantages. Resulting barriers of human capabilities will be discussed in detail in Task 2.1. For specific user needs of target groups, see Deliverable 1.1.

26

Design recommendations are then derived that include relevant ethical, social and legal aspects, which address a user-centred safe, ergonomic, ethical and legal implementation of the INCLUSIVE system adapting to interaction barriers. This way, we aim at offering fair requirements, independent of individual skills and capabilities.

All results of this deliverable can be used to develop tools and programs that assist users through simple, intuitive presentation and continuous simulation options taking into account safety matters.

4. Annexes

4.1. Annex A - Risk assessment sheets

32

4.2. Annex B – Questionnaire

Country of company Click here to insert text.

Sector of company Click here to insert text.

Please answer the following questions concerning the status quo in your company.

I. Occupational Health

1 Does your company have an occupational health management system or something comparable? If yes, how many people are employed in this field?

☐ yes ☐ no

Number of persons: Select number.

2 Please name three examples for most successful measures according to that topic in your company.

Click here to insert 3 examples.

3 Where do you still see a need for actions according to that topic? Please name up to three measures, your company is planning to implement in the near future.

Click here to insert 3 measures.

4 On a scale from 1 “very little” to 10 “very high”, how do you access the overall relevance of this topic in your company?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐

very little very high

II. Occupational Safety

1 Does your company have an Occupational safety Division or something comparable? If yes, how many persons are employed in this field?

☐ yes ☐ no







☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


III. Data Protection

1 Does your company have Data protection Division or something comparable? If yes, how many people are employed in this field?

☐ yes ☐ no







☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


IV. Ergonomic Workplace Design

1 Does your company have an Ergonomic workplace design or something comparable? If yes, how many people are employed in this field?

☐ yes ☐ no


33






☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


V. Equal Opportunities

1 Does your company have an Equal opportunities Division or something comparable? If yes, how many people are employed in this field?

☐ yes ☐ no







☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


VI. Reintegration

1 Does your company have a Reintegration Management or something comparable? If yes, how many people are employed in this field?

☐ yes ☐ no







☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


Please answer the subsequent questions considering the following scenario: The working machines are equipped with sensors that are able to track strain of a working person by real-time measurement of his/her physiological parameters, e.g. heartrate, blood pressure, etc. If the measured strain indicators are too high, the human-machine-interface adapts to the situation resulting in a lower strain level.

1. Occupational Health

1 According to health, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no

Please explain your answer:

Click here to insert text.

2 According to health, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to health?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐very negative very positive

2. Occupational Safety

34

1 According to occupational safety, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



2 According to occupational safety, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to safety?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐

very negative very positive

3. Data Protection

1 According to data protection, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



2 According to data protection, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to data protection?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


4. Ergonomic Workplace Design

1 According to ergonomic workplace design, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



2 According to ergonomics, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to ergonomic workplace design?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


5. Equal Opportunities

1 According to equal opportunities, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



2 According to equal opportunities, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no

Please explain your answer


3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to equal opportunities?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


6. Reintegration

1 According to reintegration, do you see a potential of improvement in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



2 According to reintegration, do you see risks in measuring strain of a working person as described in the scenario above?

☐ yes ☐ no



35

3 On a scale from 1 “very negative” to 10 “very positive”, how do you access the impact of strain measurement according to reintegration?

☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐


Smart and adaptive interfaces for INCLUSIVE work environment€¦ · users, related to the ... The...

Documents

Transcript of Smart and adaptive interfaces for INCLUSIVE work environment€¦ · users, related to the ... The...