The seat is empty. The site is not.
A machine with nobody in the seat is working next to people who used to read an operator's face. Five tools answer it: a way to ask a machine to stand down, a zone the machine watches for itself, a way for the machine to say what it is doing, a device in the truck driver's cab, and the paperwork that makes a machine a member of the crew.
The hardest safety problem is not the machine. It is everyone else.
A machine with nobody in the seat is not the difficult part. The difficult part is the rest of the site: the truck backing to a load-out point, the person walking behind the tracks, the grade checker who used to catch the operator's eye. A person in the seat gave all of that away for free, a glance, a pause before the swing, a tap on the horn. When the seat is empty those signals are gone, and nothing filed at seven in the morning replaces them at two in the afternoon.
So we took the problem apart into five pieces and engineered each one on its own, as five products rather than five features of one box.
The five, and the rule that shapes each one.
A hold a person can carry.
A handheld a person carries that asks a machine to stand down, and the request latches until somebody at the machine clears it. The one who first sees a problem is rarely the one at the console, and this is designed to give all of them a way to act without walking into the machine's reach.
A request, never an emergency stop, and its own legend says so. A device people believe is a stop, and is not, is worse than no device at all.
The machine holds, and a person clears it.
A zone around the machine, designed to be watched by the machine itself and wired to its safety side, so that all it can do is take authority away. A person inside the zone is designed to hold the machine, and the zone is drawn for the person carrying nothing at all.
Sensing is designed only to take authority away, never to create it. It is designed to be safety-grade, and we describe it as designed until it is assessed.
What a crew used to read off the operator's face.
Lights, sound and a swing-direction indicator, so a crew can read a machine with nobody in the seat from a distance and from a cab. It is designed to show white while the unit works, amber for a machine asked to stand down and red for a fault, so a stop on purpose never looks like a breakdown.
It is advisory and says so. It shows what the machine is doing, it stops nothing, and nothing on it means walk up.
The device in the other machine's cab.
A device in the other machine's cab, so the driver of the truck backing in to load out knows what our machine is doing. It is the one tool aimed at somebody who is not an operator of ours, and a set order of moves stands in for the eye contact two people used to trade.
Advisory, and labelled so on every screen. The unit reports its own state and never instructs a driver or authorizes an approach.
The unit on the roster.
The paperwork that makes a machine a member of the crew, accepted by a person's typed name. Each unit is designed to be registered the way a person is, so the signed tailgate your crew already produces becomes the day's limits.
A unit files; a person accepts. Only a typed human name turns ready to ask into cleared to work, and no unit can hand itself that authorization.
What we were asked for, and what we built instead.
The question that started this was a fair one: hand twenty people on a site twenty lanyards, each with a kill for the machine. We built the request and refused the kill. A stop that has to travel by radio can be late, jammed, flat or out of range, and the person holding it cannot tell which. Protection that people's lives rest on has to be local to the machine and wired to it. So the thing a person carries asks, and the thing on the machine is designed to be safety-grade, wired and local. We will not sell you the first as though it were the second.
Why there is no green light.
Every instinct in signage says put a green light on the tower. We did not, and we will not. A green light gets read as permission, and this tower cannot give permission: it knows what the machine is doing, not where you are standing. The decision to approach stays with your people and your procedures.
One set, and one order.
The five are designed as one set, so they agree with each other instead of each solving its own corner. What is sensed on the machine is designed to be safety-grade. What is carried is a request. The wired stop set on the machine is what stops a machine, and all five sit beside it.
Two different things get called a lanyard. The one at the machine is designed to be wired into that stop set, so that pulling it stops the machine. What is on the machine today is the three ways to take control away by hand, and we will demonstrate every one of them for you. The one a person carries asks over the air. We keep them apart in the hardware, in the legend and in the words we use, because nobody's safety should rest on being wrong about which is in their hand. The ranked stop set is on the safety page.
Where this stands.
The first thing you are told, because everything after it depends on it.
The five site tools are designed, specified and written down in full, and that design is what your safety people will read. The unit that sits in the seat is built, powered and cycling on the group's own machines at our Test Facility in Alberta, and we will demonstrate the three ways to take control away by hand for you. No assessment against ISO 13849 or ISO 17757, the standards we design against, has been performed. We would rather you read that here than find it out for yourself later. A person walks around the machine, completes the pre-start inspection, starts it and clears it for operation. Only then does Eddie engage the controls: every session, every machine, no exceptions. Eddie never starts, wakes or inspects a machine. Standing at the machine, this is what you pull: the machine's own pilot control lockout lever, the red manual release on any actuator, or the air vent. Each of the three works without the other two. We claim the design and nothing past it. Your machine's warranty, its conformity and your liability position are for your counsel.
The questions we are always asked.
It asks. The request latches until somebody at the machine clears it, and what stops the machine is the wired stop on the machine.
No, and there never will be. The tower knows what the machine is doing, not where you are standing, so it cannot give permission.
Sometimes the request. Sometimes the zone on the machine. Often both, and once in a while neither. A site with a carried device and no zone has a request and nothing watching the ground. We would rather say so than sell the easier half.