Preface

The DKIST team performed Preliminary Hazard Analysis (PHA) per MIL-STD 882 on each of the subsystems and included all phases of the project: construction (CONST), integration testing and commissioning (IT&C), maintenance (MAINT) and operations (OPS). This specification focuses on controlling access when equipment is under fully automatic control and the design impacts of personnel access into hazardous areas. In fully automatic control, the telescope, enclosure, coudé rotator, cable wraps and other equipment will be able to track, slew and move under script control and remote means. Also, power and other hazardous energy sources can be introduced into equipment automatically. Hazardous zones most likely needing to be accessed during fully automatic control addressed herein include the telescope floor level, coudé rotator and the enclosure. By addressing the issue as fully automatic control access, it encompasses requirements for IT&C, maintenance and operations access. Formerly we utilized the term “operations” (vs. fully automated control) and it caused much confusion over the many definitions and uses of the word “operations.”

 Acknowledgements

The authors wish to thank Scott Bulau, Pat Eliason, Steve Hegwer, Rob Hubbard, Paul Jeffers, Heather Marshall, and LeEllen Phelps for participating in the hazard analysis and their efforts to shape the design and assistance in writing and editing this document. 

DKIST Hazard Zones

There are multiple hazardous areas in the DKIST and support facilities, this document address only areas of hazard during fully automated control. In particular, areas in current design that needed DKIST input on hazards requiring mitigation due to the presence of personnel. Most areas are simply too hazardous to allow personnel entry during fully automated control. Some areas such as the telescope enclosure floor level and Coudé rotator will have the need for personnel entry during under some circumstances. Starting from the upper enclosure moving down, we will discuss each area and the design conclusions for each. See the summary table section 13 at the end of this discussion. Section 14 contains a diagram that shows the major hazardous zone in a schematic format to aid in understanding access to the various hazardous areas.

Open

Figure 1 DKIST Hazardous Zones

Notes on regulations regarding personnel entry in to hazardous areas

OSHA requires protection of workers from harm in the workplace and has many regulations, standards and interpretations in place. Also, national standards such as NFPA, NEC, ANSI, IBC, ISA and ASME are required by OSHA by direct or inferred reference. Despite this plethora of laws and standards, nothing captures all specific hazard controls needed in a large, unique observatory.

Early on, the DKIST engineering team realized that the OSHA Lockout Tagout (LOTO), OSHA Machine Guarding regulations and the National Electric Code (NEC) standards did not provide enough direction and selected the ANSI/RIA R15.06, American National Standard for Industrial Robots and Robot Systems - Safety Requirements, as a key, nationally recognized standard for safety issues working inside a “giant robot” observatory.

Open

ANSI/RIA R15.06

The ANSI/RIA R15.06 standard provides us with, in some cases, more applicable direction than OSHA, and a key provision of which is slow speed control. This is a mode of robot motion control where the speed is limited to 250 mm/sec (10 in/sec) to allow persons sufficient time to either withdraw from hazardous motion or stop the equipment. Another key provision is clearance such that the equipment shall be installed to provide a minimum clearance from the operating space of 0.45 m (18 inches) from areas of building, structures, utilities, and other machines that may create trapping or a pinch point.

Note that for maintenance work, the slow speed control function in conjunction with a local control “hand paddle” will enable personnel to trouble shoot moving equipment such as the cable wraps. Other appropriate specific hazard controls such as temporary barriers, detailed procedures, specific training etc. would be required.

Also, note the OSHA Lockout Tagout standard is required for service and maintenance and the machine or equipment must be de-energized and all potentially hazardous energy rendered safe. Interlocks do not constitute LOTO unless the minor servicing exception to the OSHA standard is met. Minor tool changes and adjustments, and other minor servicing activities that take place during normal production operations, are not covered by the LOTO standard if they are routine, repetitive, and integral to the use of the equipment for production, provided that the work is performed using alternative measures which provide effective protection.

To prevent and/or control entry into hazardous areas during fully automated control several methods can be employed depending on the hazards and the frequency of access. The team has designed an interlocked trapped key system for the frequented areas. These are sophisticated interlocks to stop and/or slow motion before unlocking for entry. Other less frequented areas can be interlocked-locked to prevent or stop movement without a locked time delay and have a simple physical lock. Emergency exits would be interlocked-monitored to stop motion if opened but not locked to prevent exit, only locked for entry. See section 13. 

There are hazardous zones that are interlocked for access only during maintenance that require a daily inspection. During the preconditioning mode, before anything starts moving and the thermal systems are operating, an operator will perform a general inspection. For example, this would include a visual inspection of equipment in the enclosure service ring, enclosure cable wrap level and the Telescope Mount Assembly (TMA) cable wraps to verify that none of the hoses are leaking, etc. These inspections fall under the minor servicing exemption and alternative protection measures are provided through the use of interlock trap keys so there is no inadvertent motion.

Other hazards such as rotating floors have not made it into any standards that we’ve been able to locate. Moving walkways have a recommended maximum entry of about ½ walking speed or about 500 mm/sec.  Consultation with manufacturers of large rotating floors/turntables confirmed this max speed “rule of thumb” for walking into rotating floors.

In summary, for fully automated operational access by personnel into hazardous zones, the motion must be speed inhibited to <250 mm/sec, have  minimum clearance from the operating space of 0.45 m, and present no other severe hazard due to the equipment, or configuration of the space and moving items.

Enclosure – Upper Levels

The enclosure upper levels include:

• Valve Station Platform

• TEOA Platform

• Ventilation Gates Maintenance Platform

• Upper Vent Gates Platform

• Upper Platform

• Bridge Crane Platform

This does not include the enclosure floor on the telescope level (see Telescope Level Floor).

Entry to the upper levels is by stairs from the telescope level.

Hazards and controls

There are numerous serious hazards here to both personnel and equipment (including the primary mirror) so there is no personnel entry allowed during fully automated control. The stairs are protected by trapped keys bolt interlocks at the telescope level.

Access to the upper levels of the enclosure is controlled via two gates on the stairs leading upward from the telescope floor level. Both gates are be mechanically locked and access is possible only when enclosure azimuth motion is inhibited.

A trapped key that inhibits enclosure azimuth motion when removed will be located at Cabinet 001 on the utility level. This key is then inserted into a key exchange unit that frees several secondary keys. This secondary key is required to be inserted in either of the trapped key bolt interlock located on the gates at the bottom of the stairs. Insertion of this key unlocks the gate, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the gate is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit enclosure azimuth motion.

Telescope Level Zone

The telescope level floor hazardous zone includes:

• the fixed floor

• portions of the telescope azimuth floor

• the enclosure azimuth floor.

Entry to this level is through the LU/LA elevator or the stairway (doors 701A and 701B) on to the fixed floor from the “doghouse”. Two doors also provide access to the enclosure exterior that allow use of ladders to reach the catwalk.

Hazards and controls

Entry on to the fixed floor during fully automated control presents no serious hazards as the telescope movement envelope does not reach it and equipment on the rotating floors (telescope and enclosure) shall be kept at least ~500 mm from the edge of the fixed floor. Note that the stairway/elevator “doghouse” is close to the enclosure floor. Also, from the top of the “doghouse” the telescope movement envelope can be reached.

While no hazard is present immediately upon exiting either of the doors (701A and 701B), these doors represent the last barriers between personnel and various hazards. There is also a second means of egress from the enclosure and that is from doors that connect to the external ladders, (these doors only open from the inside). These doors will be monitored.   Access to the telescope floor level is controlled via doors 701A and 701B. Doors 701A and 701B will be electronically locked (controlled by the GIS) and access granted only when enclosure azimuth rotation is limited to a safe speed. The exterior enclosure doors will be mechanically locked and monitored by the GIS. The GIS will inhibit enclosure azimuth rotation if either of the exterior doors is opened. A trapped key that limits enclosure azimuth motion to a safe speed when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by enclosure azimuth motion. This secondary key is required to be inserted in either of two control panels located by Door 701A and 701B. Insertion of this key unlocks the corresponding door 701A or 701B, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and can be re-inserted into the main control panel to permit full-speed Enclosure Azimuth Drive motion.

Telescope azimuth floor motion speed analysis

[*]. No entry is allowed during fully automated control. This area is equipped with physical barriers to prevent entry. Entry is controlled by two gates (Gate “202” and Gate “257”).

For entry a trapped key that inhibits telescope motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by telescope motion, such as the telescope Nasmyth platforms, see Telescope Azimuth Floor to Telescope Nasmyth Platforms below). This secondary key is required to be inserted in to the gates that control access to the telescope motion envelope. Insertion of this key unlocks the gate and releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit telescope motion.

[†] on the Nasmyth platform from the movement of the altitude axis. These stairways shall be guarded and locked for fully automated control. A trapped key that inhibits telescope motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by telescope motion; see Telescope Azimuth Floor to Telescope Center Span above). This secondary key is required to be inserted in to the gates that control access to the telescope motion envelope. Insertion of this key unlocks the gate and releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit telescope motion.

it is imperative that no equipment on the enclosure shall be within 450 mm of the edge of the fixed floor.

Various means to reduce or eliminate this hazard were analyzed to include both procedural controls (disallow entry during slews) and engineering controls (slow speed control). Although slow speed control has the potential for cost and operations impact, engineering solutions are a more effective way to control hazards than procedures.

The operational impact of enclosure slow speed control was analyzed and documented in TN-0003, Alt-Azimuth Blind Spot and the DKIST. Maximum speed is used at noon to reposition the enclosure aperture for the afternoons observing. In summary of TN-0003, the operational impact of speed limiting the enclosure while personnel are on the telescope level is negligible. See TN-0003 in C:\DKIST File Vault\SysDocs\1.0 Tel\1.1 TMA\Docs & Images\Tech Notes & Reports\TN-0003-Zenith Blind Spot. The enclosure design has passed FDR and the contractor has included slow speed control under a category of Special Operations. Design and budget impacts to introducing a speed limiting device to the enclosure motors cannot be analyzed fully at this point.

Telescope Mount Zone

The Telescope Mount Hazardous Zone includes:

• Nasmyth Platforms

• Telescope Central Span

• Telescope End Stop Pit

Access to the Telescope Mount Hazardous Zone is controlled by several means. Access to the Nasmyth Platforms is controlled by mechanical trapped key bolt interlocks located on each access stairway. Access to the Telescope Central Span is controlled by mechanical trapped key bolt interlocks located at gates at the front and rear of the telescope.

Potential Hazards

• Telescope Altitude motion

• M1 Cover motion

Controls

Access to the

Service Ring Access

The Service Ring Hazardous Zone consists of:

• Enclosure Cable Wrap Level

• Service Ring Level

  • Service Ring Access Platforms

  • Enclosure Service Ring

  • Telescope Service Ring

No personnel shall be allowed entry during fully automated control.

The enclosure cable wrap level is accessed through doors 501A, 502A and two hatches (FH-01 and FH-02) to the outer utility level below.

The service ring access platforms are entered from two stairways in the enclosure cable wrap level.

Hazards

Controls

Entry to the Service Ring Hazardous Zone is controlled at door 501A and 502A by Guard Locking Switches which lock the door via power to unlock solenoids controlled by Rotary Trapped Key Interlock Switches. To enter the area both Telescope Azimuth and Enclosure Azimuth rotation is inhibited.

Entry can also be gained by two floor hatches (FH-01 and FH-02). The ladder way to reach each hatch is controlled via a Trapped Key Bolt Interlock.

Hazards and controls

TMA power and electronics racks hang down into this area creating serious fall, crush and pinch hazards. Entry to this level is controlled by enclosure cable wrap level doors 501A and 502A (see section 7 Enclosure Cable Wrap Level).

Catwalk Zone

General

The catwalk is affixed to the S&O building and personnel are exposed to the motion of the rotating enclosure. It provides access to the lower enclosure and weather stations. There are ladder ways down to the ground level with landings and exit doors at lower levels which can serve as means of emergency egress (Figure 10).

An exterior ladder way on the S&O building also provides access to the catwalk level from below (Figure 10).

Two exterior ladders on the rotating enclosure provide access to the catwalk from above.

impact hazard to personnel on the catwalk[SS5] . Access to the catwalk is controlled by door 402D from the vestibule on the utility level to the catwalk. Access is also possible from the landing near door 402B or by descending from ladders on the exterior of the enclosure, (see section 2) During fully automated control no personnel shall be allowed onto the catwalk and door 402D interlocked and emergency exit doors shall be alarmed and monitored. Access to the catwalk is controlled via door 402D. Door 402D will be electronically locked (controlled by the GIS) and access granted only when telescope azimuth motion is inhibited. The GIS will inhibit enclosure azimuth rotation if Door 402D is opened. The catwalk can also be accessed from the exterior ladder way through doors 210B, 308D, and 402B.  Doors 210B, 308D, and 402D will be mechanically locked and monitored by the GIS. The GIS will inhibit enclosure azimuth rotation if any of these three doors are opened. A trapped key that inhibits enclosure azimuth motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by enclosure azimuth motion. This secondary key is required to be inserted in a control panel located by Door 402D. Insertion of this key unlocks Door 402D, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit enclosure azimuth motion. Figure 9 Enclosure catwalk   Secure ladder way Door 308D Door 210B Door 402B                               Figure 10 Exterior ladder ways to the catwalk level

ENCLOSURE SERVICE RING

General

The enclosure service ring is only accessed from the Service Ring Access Platforms (see section 4 Service Ring Access Platform) which are accessed from the enclosure cable wrap level and no entry is allowed during fully automated control.

Enclosure Cable Wrap Level

General

Due to the numerous pinch and crush hazards of the enclosure cable wrap and enclosure equipment no operational entry is allowed. Doors and hatches shall be interlocked to prevent entry during fully automated control.[SS6] 

Access to the enclosure cable wrap is controlled via doors 501A and 502A as well as floor hatches FH-01 and FH-02. Door 501A and Door 502A will be electronically locked (controlled by the GIS) and access granted only when enclosure azimuth motion is inhibited. The GIS will inhibit enclosure azimuth rotation if either Door 501A or 502A is opened. Floor hatches FH-01 and FH-02 will be mechanically locked and monitored by the GIS. The GIS will inhibit enclosure azimuth rotation if either floor hatch FH-01 or FH-02 is opened. For maintenance purposes, there are additional removable steel plates in the floor near FH-01 to allow for larger pieces of equipment to be installed. These must be in place to allow operation. A trapped key that inhibits enclosure azimuth motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by enclosure azimuth motion). This secondary key is required to be inserted in a control panel located by Door 501A. Insertion of this key unlocks Door 501A, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit enclosure azimuth motion.

Utility Level Inner Pier Zone (Telescope Cable Wrap)

The Utility Level inner pier hazardous zone contains the telescope cable wrap which presents a significant pinch/crush hazard.

Access to the Utility Level Inner Pier is control via door 403A and gate ‘21’.

This level includes an inner and outer pier area. The inner pier will be separated by a safety barrier to prevent inadvertent entry, since the walls were removed from the design. The inner area contains the mount cable wrap and is accessed by gate “403A” and another gate, “21” on the opposite side. The outer pier has several doors and has access to the emergency exterior ladder ways.

Hazards and controls

Serious crush and pinch hazards exist around the Catwalk. No personnel access is allowed into the utility level inner pier during fully automated control and gate at former location of door 403A shall be interlocked. Access is allowed to the utility level outer pier.

Access to the TMA cable wrap is controlled via door 403A. Door 403A will be electronically locked (controlled by the GIS) and access granted only when telescope azimuth motion is inhibited. Gate “21” will be mechanically locked and monitored by the GIS. The GIS will inhibit telescope azimuth rotation if either Door 403A or Gate “21” is opened.

A trapped key that inhibits telescope azimuth motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by telescope azimuth motion. This secondary key is required to be inserted in a control panel located by Door 403A. Insertion of this key unlocks Door 403A, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit telescope azimuth motion.

Coudé Lab Zone

General

The Coudé floor level has an inner and outer area. The inner rotator area presents the most needs for access to a hazardous zone during fully automated control. Instrument scientists and engineers desire regular access to the Coudé rotator during some operations. The lab can be entered by doors 307A, 308C and the “rec room” ladder way (TBD)[SS7] .

Depending on the type of operations, the probability for entry differs. During diffraction limited seeing, in general, no personnel would be present in the coudé rotator. During seeing limited operations, personnel are likely present and during coronal observations personnel frequent the area.

There is a fixed floor and a rotating floor 16.5m in diameter. During tracking, the speed of the rotator is well below the RIA slow speed control (see

Coudé rotator motion speed analysis

Hazards and controls

The outer pier presents no additional hazards during fully automated control and can be entered. The Coudé lab rotator floor edge area has the potential for serious crush and pinch hazards and therefor the rotator should be speed inhibited to 1.75°/sec (250 mm/sec) when personnel are in the Coudé lab. For example the WFC optical bench is very close to the outer edge of the rotating floor. For a worker be in the Coudé lab, and for it to be able to rotate, it would have to be in slow speed control (<250mm/sec) and safety procedures (TBD) to be followed prior to rotation. Railings have been discussed but these could present crush or pinch hazard themselves, depending on where there are placed.

Equipment should not be installed with 450 mm of moving equipment. The impact to efficiency to reposition the rotator for the slow speed control is about 63 seconds longer (115 sec vs. 52 sec) for a 180 degree rotation than the 6 deg./sec speed (per MT Mechatronics). Other hazard controls are also required such as high visible marking, audible move warnings, bump sensors, barriers etc. (TBD).

Access to the Coudé Lab is controlled via doors 307A and 308C. Normal access to the Coudé Lab is via Door 307A in the vestibule. Door 308C is for not considered a normal means of entry/egress.

Door 307A will be electronically locked (controlled by the GIS) and access granted only when Coudé Lab rotation is limited to a safe speed. Door 308C will be mechanically locked and monitored by the GIS. The GIS will inhibit Coudé Platform rotation if Door 308C is opened.

A trapped key that limits Coudé motion to a safe speed when removed will be located in the control room. This key is required to be inserted in a control panel located by Door 307A. Insertion of this key unlocks Door 307A, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The primary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the primary key is released and can be re-inserted into the main control panel to permit full-speed Coudé Rotator motion.

Mezzanine Floor Level

General

This level includes an inner and outer pier area. The inner area contains the underneath of the Coudé rotator and the instrument cabinets and is accessed by doors 209A and 210A. This area also contains the “Rec Room” in the center of the rotator structure. The “Rec Room” provides ladder access to the center of the inner pier. There is removable ladders which can provide access to the Coudé level[SS8] .

Hazards and controls

During fully automated control the floor is stationary and the rotator structure and instrument cabinets rotate creating pinch and crush hazards. Someone standing or on a ladder on the fixed floor working on the electronic cabinets that could move and impact a worker and cause a fall and/or catch on something and pinch/crush hazard, etc. During fully automated control or any motion controlled from outside the room the inner pier mezzanine level shall not be accessible to personnel and the entry door(s) shall be interlock to prevent entry.

Access to the Mezzanine Level Inner Pier is controlled by doors 209A and 210A. Door 209A will be electronically locked (controlled by the GIS) and access granted only when Coudé Platform rotation is inhibited. Door 210A will be mechanically locked and monitored by the GIS. The GIS will inhibit Coudé Platform rotation if either door is opened.

A trapped key that inhibits Coudé motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by Coudé Rotator motion. This secondary key is required to be inserted in a control panel located by Door 209A. Insertion of this key unlocks Door 209A, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit Coudé Rotator motion.

Door 210A is not considered a normal means of entry/egress to the hazardous zone. Therefore this door will be mechanically locked at all times. Opening the door immediately inhibits motion of Coudé Rotator.

The “Rec Room” is accessible via one of two ladders in the Mezzanine Inner Pier Area. These ladders are permanently installed. The “Rec Room” is also accessible via a removable ladder from the Coudé Rotator Platform above. The hatches in the floor of the Coudé Rotator Platform will be mechanically locked and monitored by the GIS. The GIS will inhibit Coudé Platform rotation if either hatch is opened.[SS1] 

The addition of video and audio communication will help protect workers, but this control alone does not adequately mitigate the hazard of accessing the cabinets that can move “unexpectedly” from a fixed floor. Purely procedural mitigations (make sure you check the cameras) should not to be used as the only control of such a serious hazard.

The rec room is an extension of the coudé lab rotator and can be accessed from the coudé lab ladder way. It can be accessed while continuing to operate in the reduced speed mode (which is well above max required tracking velocity).

The door from the Coudé “rec room” to the mezzanine will be interlocked during normal operation to prevent personnel exiting to the mezzanine with the Coudé rotator in motion.

Ground Floor Inner Pier

General

This level includes an inner and outer pier area and the inner coudé pier. The inner coudé pier area contains the coudé rotator cable wrap and is accessed by door 110 A. The center of the inner coudé pier cable wrap area is accessible from the ladder from the coudé pier inner mezzanine level above, which in turn is accessed from two hatches and ladders in the “rec room” floor.

Access is typically not required during while the Coudé Rotator is in motion. Daily pre-operations check will include a visual inspection of this area.

Hazards and controls

The Coudé Platform Cable Wrap occupies a large portion of the Inner Pier. This represents numerous pinch/crush hazards as well as unexpected startup hazard. To prevent unauthorized access to the Coudé Platform Cable Wrap, Door 110A will be electronically locked and access granted only when Coudé Platform rotation is inhibited.

A trapped key that inhibits Coudé motion when removed will be located in the control room. This key is then inserted into a key exchange unit that frees several secondary keys (secondary keys are also used for other zones that have hazards created by Coudé Rotator motion. This secondary key is required to be inserted in a control panel located by Door 110A. Insertion of this key unlocks Door 110A, releases two personnel safety keys, which must be carried by personnel entering the hazardous zone. The secondary key is trapped until the two personnel safety keys are returned and the door is re-locked. Then the secondary key can be returned to the key exchange unit (and provided all secondary keys are present) to allow the primary key to be released and re-inserted into the main control panel to permit Coudé Rotator motion. An emergency release lever is located inside the hazardous zone at Door 110A to allow personnel to mechanically open Door 110A in the event of power failure or inadvertent trapping.

The center of the Coudé Platform Cable Wrap is accessible only via ladders from above. Entry is through one of two floor hatches in the “Rec Room” located above. Access to the “Rec Room” is controlled by Doors 209A and 210A on the mezzanine level (see section 10).

During fully automated control, the inner coudé pier shall not be accessible to personnel and the entry door shall be interlocked to prevent entry.

Trapped Key Plan

Based upon the idea that no single key can be in two places at once, trapped key interlocks (also known as key interlock systems or “Castell” key interlocks) can be configured to provide that a predetermined sequence of events takes place or that hazards have been reduced before personnel can become exposed to them.

The general arrangement of trapped keys and personnel keys assume that no more than two personnel will enter a hazardous zone. If more than two personnel must enter a hazardous zone, special precautions must be taken to ensure that all personnel have exited the hazardous area before equipment is returned to service.

The trapped key system is NOT a replacement for proper lockout/tagout. It is intended only for access under the minor servicing exception of OSHA lockout/tagout rules (29 CFR §1910.147).

In order to ensure that sources of hazardous energy are removed prior to personnel entering an area the system requires that a trapped key located in the control room is turned to the off position. Each zone is controlled by a trapped key solenoid release unit (SRU). A solenoid holds the key in place until confirmation of a safe condition is received. Then the solenoid is energized allowing the key to be turned which removes the axis permissive signal to the appropriate LIC, preventing re-starting of the axis until the key is returned.

When gaining access to a hazardous area the primary key must be inserted into a bolt that locks the door closed, unlocking the door releases “personnel keys.” These keys MUST be taken with personnel that enter the hazardous area to prevent closing and relocking of the door; failure to do so could result in serious injury or even death.

The key naming scheme presented below is just for reference, actual key labels and types will be coordinated during installation.

Coudé Hazardous Zone

Figure 23 shows the general arrangement of trapped keys for access to hazardous areas of the Coudé Rotator. While the Coudé Rotator is stopped, personnel may remove primary key ‘AA’ from the control panel, this removes the permissive signal to the Coudé Rotator LIC. Primary key ‘AA’ can open either Door 110A (see Figure 21) or Door 209A (see Figure 18) which allow access to the inner pier area. Unlocking a door releases personnel keys ‘BA’ and ‘CA’ which must be taken into the hazardous area.

Coudé Lab Access

Figure 24shows the arrange of keys for entering the Coudé Lab. Removing primary key ‘DA’ requires the Coudé Lab rotator to be travelling at or below the safe limited speed (SLS) of 2°/sec. Once the primary key has been removed Coudé Lab rotation is limited to less than 2°/sec. Primary key ‘DA’ may then be used to open door 307A (see Figure 16) to access the Coudé Lab, which releases two trapped keys ‘EA’ that must be taken into the lab, a third key is available to insert into a key exchange unit that release six additional keys ‘XA.’

Telescope Hazardous Zones

The telescope has two primary keys, ‘FA’ and ‘GA’. These control permissive signals to the Azimuth and Elevation axes respectively. Some hazardous areas only require that one axis be inhibited as shown in Figure 25. Telescope azimuth motion must be inhibited to access the utility level via door 403A (see Figure 14) or the cable wrap level inner pier via door 501A or 502A (see Figure 12). To access either telescope platform elevation motion must be inhibited (see Figure 4).

Figure 26 shows that to access the central tower area (see Figure 4) through gate ‘257’ that both Azimuth and Elevation axes must be inhibited. This requires that both primary keys ‘FA’ and ‘GA’ are inserted into a key exchange unit that releases secondary key ‘HA’ that it turns allows the unlocking of gate ‘257’ and releases two personnel keys ‘NA’ that must be taken into the hazardous area.

Note: to get to the telescope mount, access must be through the area controlled by the enclosure floor access, see section 12.4 below.

Telescope Level Floor Automated Control Access

Figure 27 shows the arrangement for access the enclosure floor area. Similar to the Coudé Lab hazardous zone, this arrangement limits the speed of enclosure rotation to below a safe threshold (1.5°/sec). Primary key ‘UA’ will open either door from the ‘doghouse’ onto the observing chamber floor. Personnel Keys ‘WA’ and/or ‘VA’ must be taken into the hazardous zone.

Enclosure Hazardous Zones Access

Figure 28 shows the arrangement for inhibiting enclosure rotation. The hazardous zone includes interior service platforms and the exterior catwalk. Primary key ‘PA’ inhibits enclosure rotation when removed. This key opens access points to hazardous areas created by enclosure rotation. Personnel keys ‘RA’, ‘SA’, and ‘TA’ must be taken when entering the hazardous zone. Access to the catwalk is controlled via door 402D (see Figure 8).

Note: to get to the Enclosure –X and +X catwalks, access must be through the area controlled by the enclosure floor access, see section 12.4 above.

SUMMARY TABLE OF HAZARDOUS ZONES ACCESS

Note 1, Access Doors:  

IT=Interlocked Trapped Key This type of access door can only be unlocked by inserting the correct trapped key. A manual override will be available for egress only. The lock and the door are monitored to ensure that it cannot open during hazardous operation without stopping hazardous motion.  

IL=Interlocked Locked This type of access door is locked using a normal keyed locked to inhibit entry. The door may be unlocked for egress from the inside. The door is monitored to ensure that it is not opened during hazardous motion. If the door is opened hazardous motion is stopped until it is manually reset.[r13]    IM=Interlocked Monitored This type of access door may inhibit entry or egress. The door is monitored to ensure that it is not opened during hazardous motion. If the door is opened hazardous motion is stopped until it is manually reset.   

M – Monitored This type of access door is unlocked and does not inhibit entry or egress. The door is monitored to ensure that it is not opened during hazardous motion. If the door is opened hazardous motion is stopped until it is manually reset.  

TK – Trapped Key This is a door with a trapped key with exchange for opening, and it may or not be electronically monitored. 

State Diagram Of Hazardous Zones Access

Access to the various hazardous zones represents a complex interaction of moving about the facility from “safe” through various barriers to “hazardous zones.” The diagrams that follow represent the various zones and the barriers through which must be breached to access the zone.

There are zones that while technically are “safe” can only be accessed from “hazardous” zones, therefore it is considered part of the hazardous zone (the “rec room” is one example).

[*]In the area between the mount altitude bearing towers there are a number of pieces of equipment that as the mount moves in altitude sweep close to both the Telescope floor and also close to the M5/M6 Tower. These are Optical Support Structure (OSS) electronics rack and platform, OSS main counterweights and parts of the OSS main structure.

 The access to the Gregorian Optics Station (GOS) is via the OSS platform. To get from the Nasmyth Platform to the OSS platform, they have to be lined up i.e. the mount parked at 104 degrees altitude. Then it is possible to walk from the Nasmyth Platform to the OSS platform. This platform rotates with the mount and so at other angles the platform is not horizontal and the access of the platform may be blocked by mount structure.

The access to M5 and M6 is via a deployable bridge that extends from the OSS platform. Once the OSS platform is aligned to Nasmyth then then it would be possible to extend the walkway to access the M5/M6 on the top of the tower. The extended platform is directly in the path of the tower as the altitude axis moves from 104degrees so has to be retracted to reach lower elevations.

These access provisions are provided for normal maintenance and were not designed for working on the systems while under TCS control (fully automated control) which could invoke a slew at any time. For these activities it would be necessary to implement ‘other protective’ means which could be a combination of local enabled slow speed operation with temporary access via scaffolding. The same issue exists for encoder alignment where access is needed to an area that has intrinsic crush hazards but must be able to move the axis while adjusting. This is not “normal” inspection / maintenance and so falls under the “specific job hazard and alternative protection means.”

[†] The hazards on the Nasmyth platform include the different relative motion of the OSS trunnion and the bearings system, the manual drive gear, brake discs / brake mechanism, encoder and encoder read head brackets. The most straightforward way to protect personnel from these mechanisms is to limit access to the nasmyth platform during fully automated control.

The access as described here does not prohibit working on systems on the Nasmyth platform, what it does is inhibit the altitude axis from moving.

If during IT&C or operations some of the thermal or other systems need adjustment or inspection during tracking, then a specific job hazard analysis would be required and then ‘alternative protection’ means would be implemented.

[SS1]Various parts of the telescope have encroached into with 500 mm of the edge to include pipes, valve handles, stairway base, gate swing radius, elevation cable wrap (crosses over at lowest elevation) et al

[SS2]Door 701A to the stairway open to ~500 mm of the fixed floor edge and door 701B LULA lift to ~230mm of the edge. Parts of the telescope have encroached to and past the fixed floor edge.

[SS3]Need to check. Some rails and duct supports attached to rails likely to exceed.

[SS4]Proposed to be changed to stairway gate interlocks and installing new permanent rails and platform surface to access the mount racks. See section 7

[SS5]Impact is somewhat limited to the 2 ladders and area access could be reviewed.

[SS6]The enclosure cable wrap has an installed mesh barrier. It is proposed to add interlocked gates to the mount service platforms and telescope azimuth equipment level gate and allow access to part of the enclosure cable wrap level during operations and movement. This would also involve replacing the temporary rails and working platforms at the mount service platform level with permanent rails and platform. The floor hatch access to the enclosure drive chamber would remain the same.

Open