Safety Design Criteria for Facilities and Machines

Overview
Safety Design Criteria for Facilities and Machines sits within the BCSP CSP domain of Advanced Application of Safety Principles. It covers the engineering requirements, codes, standards, and decision logic used to design workplaces, buildings, equipment, and machinery so that hazards are eliminated or controlled before people are exposed to them. On the CSP exam this topic is tested through scenario-based questions that require you to select the most effective design control, apply a formula (such as safeguarding distance or egress capacity), or recognize which code or standard governs a given design feature.

Why It Is Important
Design decisions made early in a project lock in risk for the life of a facility or machine. The cost of correcting a hazard rises dramatically as a project moves from concept to construction to operation, which is the core argument behind Prevention through Design (PtD) and ANSI/ASSP Z590.3. A safety professional who can influence design criteria delivers far greater risk reduction than one who only manages hazards after the fact. In addition, facility and machine design is heavily codified: OSHA 29 CFR 1910 Subparts D (walking-working surfaces), E (exit routes), O (machinery and machine guarding), S (electrical), and standards such as NFPA 101, NFPA 70, NFPA 79, ANSI B11, ISO 12100, ISO 13849, and ANSI Z244.1 set enforceable or widely accepted expectations. Failure to meet them produces injuries, citations, liability, and production loss. The CSP is expected to translate these requirements into design specifications and to evaluate whether a proposed design is adequate.

What It Is
Safety design criteria are the measurable requirements a facility or machine must meet to be considered acceptably safe. They derive from three sources:
1. Hazard analysis and risk assessment (what could go wrong, how badly, how often).
2. Codes, regulations, and consensus standards (minimum legal and industry-accepted performance).
3. Design principles such as the hierarchy of controls, fail-safe design, redundancy, inherent safety, and human factors.

The guiding framework is the hierarchy of controls, applied in order of preference: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. Design criteria live at the top of this hierarchy. When a question asks for the most effective or preferred approach, the answer is nearly always the design-level option that removes or isolates the hazard rather than one that relies on worker behavior.

Inherently Safer Design (Kletz principles)
• Minimize: reduce the quantity of hazardous material or energy present.
• Substitute: use a less hazardous material, process, or energy source.
• Moderate: use less hazardous conditions (lower pressure, temperature, concentration).
• Simplify: eliminate unnecessary complexity that creates opportunities for error.

Core Design Principles
• Fail-safe: a component failure results in a safe state (e.g., spring-return valve closes on loss of air; de-energize to trip).
• Redundancy and diversity: duplicate critical safety functions, ideally using different technologies, so no single point of failure defeats protection.
• Control reliability: a single fault in the safety control system does not prevent the stop function and is detected before the next cycle.
• Positive mode operation: safety contacts are mechanically forced open (positive-opening) rather than relying on springs.
• Human factors: design for the user population (anthropometric percentiles, reach, visibility, controls that match expectations, error-tolerant interfaces).

How It Works: Machine Safety Design
Risk assessment process (ISO 12100 / ANSI B11.0): determine machine limits, identify hazards across all life-cycle phases (installation, operation, setup, maintenance, decommissioning), estimate risk (severity, exposure frequency, probability of avoidance), evaluate against tolerable risk, and reduce risk using the three-step method: (1) inherently safe design measures, (2) safeguarding and complementary protective measures, (3) information for use (warnings, training, PPE). Iterate until residual risk is acceptable.

Hazard locations: point of operation, power transmission apparatus (belts, pulleys, gears, shafts, couplings), and other moving parts (feed mechanisms, auxiliary components). Hazardous motions include rotating, reciprocating, transverse, and the actions of cutting, punching, shearing, and bending. Nip points and in-running nip points are classic exam items.

Safeguarding methods (OSHA 1910.212, ANSI B11.19):
• Guards: fixed (preferred, permanent barrier), interlocked (opens the circuit when removed or opened), adjustable, and self-adjusting.
• Devices: presence-sensing (light curtains, safety mats, laser scanners), pullback, restraint, two-hand control, two-hand trip, gate devices, and safety trip controls (pressure-sensitive body bars, trip wires).
• Location/distance: positioning the hazard so it cannot be reached (ANSI B11.19 and ISO 13857 reach tables).
• Feeding and ejection methods: automatic or semi-automatic feeds that keep hands out of the point of operation.
• Miscellaneous aids: awareness barriers, shields, hand tools; these are not substitutes for guarding.

A guard must prevent contact, be secure (not easily removed or defeated), protect from falling objects, create no new hazards (sharp edges, pinch points), and allow safe lubrication and maintenance without removal.

Safety distance formula (ANSI B11.19 / OSHA):
Ds = K × (Ts + Tc + Tr + Tbm) + Dpf
Where K = hand speed constant (63 in/s or 1.6 m/s), Ts = machine stopping time, Tc = control system response time, Tr = response time of the sensing device, Tbm = additional time allowed for brake monitor, and Dpf = depth penetration factor based on the minimum object sensitivity of the light curtain. For light curtains, Dpf (inches) = 3.4 × (S − 0.276) where S is the object sensitivity in inches.
Worked example: total stopping and response time = 0.25 s, light curtain resolution = 1.25 in. Ds = 63 × 0.25 + 3.4 × (1.25 − 0.276) = 15.75 + 3.31 ≈ 19.1 in minimum from the sensing field to the hazard.

ISO 13855 version: S = (K × T) + C, with K = 2000 mm/s for approach speed (1600 mm/s permitted if S exceeds 500 mm), T = overall stopping performance, and C = 8 × (d − 14) mm for detection capability d in mm (for d ≤ 40 mm).

Functional safety of control systems:
• ISO 13849-1: Performance Levels PL a through PL e (e is highest) built from Categories B, 1, 2, 3, and 4, mean time to dangerous failure (MTTFd), diagnostic coverage (DC), and common cause failure (CCF). Category 3 and 4 require redundancy; Category 4 requires that an accumulation of faults does not lead to loss of the safety function.
• IEC 62061 / IEC 61508: Safety Integrity Levels SIL 1 through SIL 4 (SIL 3 is typically the highest used in machinery).
• Higher severity, frequency, and lower possibility of avoidance drive the required PL/SIL upward.

Emergency stop (NFPA 79, IEC 60204-1, ISO 13850): red mushroom-head actuator on a yellow background, self-latching, manual reset, overrides all other functions. Stop categories: Category 0 (immediate removal of power, uncontrolled stop), Category 1 (controlled stop, then power removed), Category 2 (controlled stop with power maintained). An e-stop is a complementary measure, not a primary safeguard.

Hazardous energy control by design (ANSI/ASSP Z244.1, OSHA 1910.147): provide lockable energy-isolating devices, visible-break disconnects, bleed and vent points, blocking capability for gravity and stored energy, and verification points so that lockout/tagout can be performed safely. Alternative methods (e.g., controlled trapped-key systems) require a risk assessment.

Electrical design (NFPA 70, NFPA 70E, OSHA Subpart S): grounding and bonding, overcurrent protection, GFCI where required, working clearances in front of panels (36 in minimum for 0–150 V to ground), hazardous (classified) locations by Class (I gases/vapors, II dusts, III fibers/flyings) and Division (1 normally present, 2 abnormally present) or Zone system, arc flash labeling and incident energy analysis.

How It Works: Facility Design
Site and layout: separate incompatible processes, locate hazardous material storage away from occupied areas and ignition sources, design material flow to minimize travel and crossing of pedestrian and vehicle paths, provide designated pedestrian walkways, and plan for emergency vehicle access.

Means of egress (NFPA 101, OSHA 1910.34–.37): three components are exit access, exit, and exit discharge. Key criteria: at least two remote exits in most occupancies (more as occupant load rises), exit doors swing in the direction of egress travel when serving 50 or more occupants or high-hazard areas, no locks that require keys or special knowledge from the egress side, minimum ceiling height 7 ft 6 in, exit routes unobstructed and at least 28 in wide at all points, illuminated exit signs, emergency lighting, and travel distance limits that vary by occupancy and sprinkler protection. Egress capacity is calculated as occupant load multiplied by a capacity factor (NFPA 101 general factors: 0.3 in per person for stairs, 0.2 in per person for level components and ramps). Dead-end corridors and common path of travel are limited by occupancy.

Fire protection (NFPA 1, 13, 30, 72, 101): fire-resistance-rated construction and compartmentation, automatic sprinklers designed to hazard classification (light, ordinary, extra), detection and alarm, portable extinguishers (NFPA 10 travel distance 75 ft for Class A, up to 50 ft for Class B depending on rating), flammable liquid storage cabinets (maximum 60 gallons of Class I or II liquids per cabinet), and inside storage room limits.

Walking-working surfaces (OSHA 1910 Subpart D): guardrails with top rail 42 in (±3 in) capable of withstanding 200 lb, midrail, and toeboard at least 3.5 in high where objects could fall; fall protection required at 4 ft in general industry; floor holes covered or guarded; stairs with uniform riser height and tread depth, handrails on open sides, and adequate load capacity; fixed ladders over 24 ft require fall arrest or ladder safety systems (cages being phased out).

Ventilation (ACGIH Industrial Ventilation Manual, OSHA 1910.94): local exhaust ventilation is preferred over general dilution; design capture velocity, duct transport velocity, hood placement, and makeup air. Enclose the source where possible.

Lighting (IES, ANSI/IES RP-7): illuminance levels matched to task demands (higher footcandle values for fine assembly, inspection, and areas with hazardous equipment), uniformity, glare control, and emergency lighting of at least 1 footcandle average along egress paths (NFPA 101) for 90 minutes.

Emergency equipment (ANSI/ISEA Z358.1): emergency eyewash and shower within 10 seconds of travel (roughly 55 ft) on the same level with no obstructions, tepid water (60–100°F), 15-minute minimum flush, 0.4 gpm for eyewash and 20 gpm for showers.

Pressure systems and process safety: ASME Boiler and Pressure Vessel Code and B31 piping codes, relief devices sized for worst credible case, isolation and depressurization points, and compliance with OSHA 1910.119 process safety management where threshold quantities are exceeded.

Noise and ergonomics by design: specify equipment noise limits in purchase specifications (buy quiet), use enclosures, isolation, and damping; design workstations to accommodate the 5th to 95th percentile user with adjustable heights, neutral postures, and mechanical lifting aids to meet NIOSH lifting equation limits.

Design review and verification
Safety criteria are enforced through design reviews at defined stages: concept, preliminary (30 percent), detailed (60–90 percent), pre-startup safety review (PSSR), and commissioning. Tools include preliminary hazard analysis (PHA), failure mode and effects analysis (FMEA), HAZOP, fault tree analysis, what-if checklists, and job hazard analysis for operation and maintenance tasks. Management of change ensures later modifications are re-evaluated against the original criteria.

Exam Tips: Answering Questions on Safety Design Criteria for Facilities and Machines
1. Default to the hierarchy of controls. When asked for the best, most effective, or preferred control, choose elimination or an engineered design solution over training, procedures, warnings, or PPE. Distractors frequently offer administrative controls that sound reasonable but rank lower.
2. Distinguish guards from devices. A fixed guard is a physical barrier and is generally preferred when access is not needed. Presence-sensing devices and two-hand controls are devices, not guards, and are acceptable only on machines that can stop mid-cycle (never on full-revolution clutch presses).
3. Memorize the key constants and formulas. Hand speed constant K = 63 in/s (1.6 m/s; ISO uses 2000 mm/s), safety distance formula with Dpf, guardrail 42 in and 200 lb, fall protection at 4 ft, egress door swing threshold at 50 occupants, eyewash 10 seconds and tepid water, flammable cabinet 60 gal, and egress capacity factors 0.3 and 0.2 in per person. Expect calculation questions where you must add component times before multiplying by K and then add the penetration factor.
4. Watch units. Questions may mix seconds and milliseconds or inches and millimeters. Convert before calculating and check that the answer magnitude is plausible (a light curtain distance is typically 10 to 40 inches, not 2 or 200).
5. Know which standard governs which topic. NFPA 101 for egress, NFPA 70 and 79 for electrical and machine wiring, ANSI B11 series and ISO 12100 for machinery, ISO 13849 and IEC 62061 for control system performance, ANSI Z244.1 for hazardous energy, ANSI Z358.1 for emergency eyewash, ANSI Z590.3 for Prevention through Design, ACGIH for ventilation, and ASME for pressure vessels.
6. Read the scenario for life-cycle phase. A hazard during maintenance or setup often requires a different design answer (lockable isolation, inch or jog mode with enabling device, interlocked guard with guard locking) than the same machine in production mode.
7. Apply fail-safe logic. If an option describes a system that remains running or energized after a component failure, it is not fail-safe and is probably wrong. Look for de-energize-to-trip, positive-opening contacts, redundancy, and monitoring.
8. Recognize e-stop limitations. An emergency stop is a complementary protective measure; it does not count as a safeguard and never substitutes for guarding or presence sensing.
9. Interpret risk assessment terminology. Severity, exposure frequency, and avoidability determine required Performance Level or SIL. Higher required reliability means higher category and higher PL/SIL, with redundancy becoming mandatory at Category 3 and above.
10. Remember the cost-of-change curve. Questions on PtD or when to involve safety in a project are answered with the earliest feasible stage (concept or preliminary design), because changes are cheapest and most effective there.
11. Eliminate absolutes and new-hazard options. A guard that creates a pinch point, blocks visibility, or must be removed for routine lubrication fails the design criteria for guards.
12. Manage time. Calculation items on this topic are usually two or three steps. Write the formula, substitute, compute, and move on; do not second-guess a constant you have memorized.

Quick Review Checklist
• Hierarchy of controls and inherently safer design principles.
• Three-step risk reduction method (ISO 12100).
• Guard types, device types, and when each is permitted.
• Safety distance formula, K values, and Dpf.
• Performance Levels, Categories, and SIL concepts.
• E-stop requirements and stop categories.
• Egress components, number of exits, door swing, capacity factors, travel distance concepts.
• Guardrail, toeboard, stair, ladder, and fall protection trigger heights.
• Electrical classification and working clearance basics.
• Emergency eyewash and shower criteria.
• Flammable liquid storage limits and extinguisher travel distances.
• Design review stages, PtD, and management of change.

Mastering these criteria allows you to answer CSP questions by recognizing the governing principle, applying the correct standard or formula, and selecting the design-level control that provides the highest, most reliable level of protection.