1. Introduction. 2. Design. Safety and Emergency Stop Circuit Design Standard. Safety and Emergency Stop Circuit Design Standard.

Transcription

1 Safety and Emergency Stop Circuit Design Standard The Safety and Emergency Stop Circuit Design Standard provide design criteria and specifications for safety and emergency stop circuits used in General Mills (GMI) manufacturing facilities. Table of Contents 1. Introduction 2. Design 3. Safety Risk Category 3 Control Circuits 4. Safety Risk Category 3 Power Circuits 5. Safety Circuit Templates 6. Documentation and Deliverable 7. Products or Materials 8. Identification 9. Calibrations and Testing 10. Revision Summaries 1. Introduction Consider all standards described in this document mandatory unless otherwise identified as optional or preferred. Any variance from GMI requirements or preferences requires prior GMI Engineering approval. Obtain approval from the engineer that issued this document or has been designated as responsible for project deliverables. GMI will provide and document specific project requirements and approvals. 2. Design General Mills safety strategy is to perform a risk assessment based on a clear understanding of the machine limits and functions and analyze them to identify those that pose a potential hazard. Then, project engineers estimate the degree of risk to determine the correct safety classification. Most GMI systems fall under the EN954-1 risk category 3 (no single point of failure shall compromise the circuit). Category 3 is the default standard for all equipment unless an assessment has identified a greater risk. The safety strategy for motor control must comply with NFPA79 Stop Categories. For any other method, obtain approval from GMI Engineering before proceeding. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

2 Category 0 is an uncontrolled stop by immediately removing power to the machine actuators. Category 1 is a controlled stop with power to the machine actuators available to achieve the stop then remove power when the stop has been achieved. Emergency stops, safety circuits, lockout/tagout (LOTO) methods all address human safety. GMI uses emergency stops to bring a running machine to a safe rest state as quickly as possible. In the safe rest state, all electrical power circuits must be mechanically opened and kept open. Safety circuits, along with safety switches and e-stops, bring a machine to a safe condition or keep the machine at rest mechanically. LOTO methods remove electrical energy from the machine to eliminate electrical shock hazard and ensure that the machine remains at rest. LOTO provides the safest method to service and maintain hazardous equipment. GMI requires adherence to its Lockout, Tagout, and Try procedure. Include safety and emergency stop (E-Stop) methods in designs for all electrical, hydraulic, or pneumatic systems. General Mills requires all machine suppliers and designers to provide appropriate safety training for all equipment and systems. The training must provide the following instruction: Description of all safety hazards associated with the equipment. Description and operation of all safety devices, including disconnects, e-stops, guards, and other devices. Safe equipment operation and maintenance practices. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

3 2.1 General Design Requirements GMI requires all safety circuit components to be control reliable (single fault tolerant), because Safety Category 3 is our standard safety circuit, the design will need to include the following: Duality (Also known as Redundancy) If one device fails, there is another device that can bring the system to a safe state. Dual inputs are wired in parallel, dual outputs in series. Diversity Protects against two things failing in exactly the same way at the same time. Example: Using one NO and One NC set of contacts. Example: Using both a high and a low input channel to a safety device. Example: Using Power Pulse signals for safety relay input channels 1 and 2. Power Pulse are voltages sourced from the safety relay, they are used to detect channel-to-channel shorts circuits faults. The output signals are pulsed very quickly. The Channel 1 pulse is offset from the channel 2 pulse. If a short occurs, the pulses occur concurrently and are detected by the safety relay. Diagnostics (Also known as Monitoring) Safety products have built in circuitry that performs internal diagnostics. If a problem is detected the system will go into a safe state, and will not allow the system to restart until the problem is fixed. Status from each safety device will need to be communicated to the HMI via a PLC input Safety Components requirements Safety input devices must have direct driven contacts. The actuator must be able to force open the contacts if they become welded together. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

4 Redundant contacts are required on the Safety Relay s safety outputs and on power contactors that open up the power feed to motor or other safety hazard. The exception to this is if a particular device has met the Category 3 Safety requirement through a testing agency such as TUV. PowerFlex VFD s, for example, have TUV certification on its Safe-off module. Safety inputs must be tamper resistance. Select devices that use coded magnets, RFID safety switches, mechanical key insertion or hinge style switches. Safety contactors must be mechanically linked / positively guided, so that if one contact welds, all of the contacts will stay closed. In such a case, the monitoring contact will indicate that the contactor has not opened and the safety relay will not be permitted to reset. Distance from a safety guard to a pinch-point shall be great enough for the machine to come to a full stop before an operator can reach the hazard. Use ANSI B11.19 standards to calculate this distance. If the safe distance cannot be established, a safety interlocking device shall be used to lock the guard and prevent it from opening until the machine comes to a full stop. Provide for field additions or modifications in the safety circuit design (such as removal of pre-installed jumpers to add safety switches, E-stop pushbuttons, or tie into an existing production line). Safety circuits should NOT have bypasses. If a modification to a safety system is necessary to accomplish an operational task, or if a manufacturing line is equipped to have parts of the system removed for different products, a secondary guard needs to protect the hazardous area while completing the safety circuit. Safety devices must be wired directly to the control enclosure terminal blocks or safety relay; no wiring should be routed from safety device to safety device. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

5 2.2 Emergency Stop Pushbuttons Emergency stop pushbuttons shall be located at each operator control station and other locations where emergency stop is required. Emergency stop pushbuttons shall be red with a mushroom-type head that can be operated by the palm of the hand; illuminate (with an LED) when pressed; and have maintained, push/pull actuation. Background legend plates for emergency stop pushbuttons shall be yellow. The combination of a red pushbutton on a yellow background shall not be used anywhere other than on emergency stop stations. The button shall have two normally-closed contacts to connect into channel 1 and channel 2 of the safety controller and one normally-open contact block to illuminate the light in the Emergency Stop pushbutton. See connection illustration later in the document. Self-monitoring contact blocks that will disable the safety circuit in the event that the contact blocks falls off of the pushbutton operator shall be used. Example AB 800TC-XD4S Emergency stop pushbuttons shall be readily accessible and designed to be initiated by a single human action. If a normal, system Cycle Stop pushbutton is needed to initiate a controlled stop to minimize recovery time for non-emergency conditions, a Cycle Stop pushbutton shall be located near each emergency stop pushbutton. Safety circuits shall be zoned to provide the most practical and safe location of e- stop stations. GMI does NOT allow emergency stop circuits to be used and an alternative to lockout/tag-out disconnect switches. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

6 2.3 Cable (Rope) Pull Safety Switches Cable Pull Safety switches can be used when a machine has multiple locations where emergency stops are required and it is not feasible to use Emergency Stop pushbuttons. Required features include: Red/yellow color scheme on the body of the switch. Red safety cable labeled Emergency Stop. The switch must actuate when pulled in either direction and with loss of tension (a broken cable). The switch must be reset manually. The switch must include a red indicator light that illuminates when the switch is tripped. Only the manufacturer s hardware shall be used including tension springs, direction-changing pulleys, and tensioners. GMI requires strict compliance with manufacturer s installation recommendations. If a single switch is used on one end of the cable, a tension spring shall be used on the other end. 2.4 Safety Guards Switches Safety Guard Switches are to be used to monitor that the safety guard is in a safe position. All safety guards that can be opened without the use of a tool will require a safety switch. Interlock safety switches must be used, if the guard door can be opened and expose an operator to the hazard. Use ANSI B11.19 standards to determine how far the guard must be from the hazard. If the guard cannot be mounted at least this far away, an interlocking type safety switch must be used to hold the guard in place until the hazard (usually machine movement) is no longer present. Required features include: Safety Switches must be designed for use as safety device and must have a SIL 2 or SIL 3 rating. Mount safety devices so they cannot be easily defeated. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

7 Mount safety devices to prevent breakage. If tongue style safety switch are used, a mechanical alignment guide shall be used. Do NOT rely on the safety switch to align the guarding. Safety switches require need 2 safety contacts and a means to communicate on/off status to the HMI. See safety circuits in this document to specify switch configuration. Interlock guard switches hold the guard closed preventing it from opening. The interlock guard is release when no machine hazards are present and the emergency stop circuit is disabled by pressing a emergency stop pushbutton. Avoid using a non-contacting safety switch when the guard door is not mechanically latched. Guards can vibrate when the machine is operating causing the guards to open and the trip the safety circuit. 2.5 Safety Light Curtains GMI permits safety light curtains as an acceptable technique for safety guarding. Install the guards at a distance between the pinch point and the presence sensing safety device safety field that ensures that the operator cannot reach the danger point before the machine comes to a full stop. Follow the safety distance calculations listed in ANSI B GMI Engineering must review and approve all designs that include safety light curtains. 2.6 Reset Requirements Note that resetting a safety device and resetting the safety circuit are separate and distinct operations. Tripping the safety device trips the safety circuit. However, resetting the safety device will not reset the safety circuit. All safety devices must be reset to allow the safety circuit to reset. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

8 GMI requires that a white illuminated reset push button be used to reset the safety relays. The reset push button light illuminates when the circuit is enabled. The start button and safety circuit reset button may be combined or kept separate. If combined, the safety circuits reset when the start button is pressed, and this will initiate a warning alarm and a 3 second delay. If the button is not held for the delay time, the safety circuit remains set, but the machine will not start. If the safety circuit cannot be reset, the warning alarm will not sound and the machine will not start. GMI also accepts resetting a safety circuit from an HMI screen. If you incorporate the safety circuit status light in the HMI, make sure it is always visible on all unit operation screens. If you use safety relays that can be configured for either manual or automatic reset, use the manual reset option only. GMI does not permit safety relays that automatically reset. Do not allow automatic equipment restart when an e-stop button is pulled out or a safety gate is closed. 2.7 Disconnects Install a disconnect switch for all stored energy sources (electric, pneumatic, hydraulic, etc.) Make each disconnect switch lockable and suitable as a safety device in compliance with GMI s lockout tagout (LOTO) program. The preferred disconnect switch is either a Hubbell HBLDS#AC (where # is 3 [30A], 6 [60A], or 10 [100A]) or an Allen- Bradley 194E-CaxxE-P11 (where xx is related to the load size). Install a lockable disconnect and integral dump valve to release the stored energy on all pneumatic circuits. Local disconnect are not part of the emergency safety circuit. Emergency safety systems must perform all necessary function without the usage of a Local Disconnect. 2.8 Hazardous Temperature Safety Circuits For equipment capable of producing burn hazards, the long heat-up and cool-down cycle requires special safety circuit and LOTO designs. De-energizing such equipment can lead to excessive downtime and material loss with little safety benefit. The following standards apply. For hot melt reservoirs, provide a LOTO disconnect separate from the main machine s disconnect. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

9 For heat seal jaws, do NOT de-energize with a safety circuit trip. Deenergize when the machine is locked out at the main disconnect. Be sure to provide appropriate signage for all burn hazards. Provide specific training on the safety hazards and on safety equipment configuration and operation. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

10 3. Safety Risk Category 3 Control Circuits This section provides examples of acceptable Safety Risk Category 3 Circuits. Three different safety circuits have been developed to suit the operational requirement of a system. NOTE: These Safety Category 3 Safety Circuits are available in AutoCAD format; they can be requested through GMI Engineering. 3.1 Control Safety Circuits GMI has developed 3 different levels of Safety Risk Category 3 circuits. They are identified as General Safety circuits, Advanced Safety circuits and Hybrid Safety circuits. General Safety Circuits; this design is used in most safety applications. Use this general design where a single safety zone is needed and there is no need for muting of guard doors. Advanced Safety Circuits; this design is to be used in complex applications that need the functionality of a programmable safety controller. Use this advanced design with multiple safety zones or if there is a need to mute guard doors based on a revolving work zone with in a safety area. Hybrid Safety Circuits; this circuit was designed to aid in retrofitting our existing safety circuits by minimizing the amount field wiring changes. This circuit should NOT be used in a new installation. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

11 3.2 General Category 3 Safety Circuits Refer to figure 1: The General Safety Circuit is based on Rockwell Automation Modular Safety Monitoring Relays (MSR 300 Series). The safety input modules are stackable with up to 10 modules connected together. This will allow for 20 safety devices to be connected on one safety system. The safety output modules are also stackable with up to 6 modules connected together, with each module having 3 N.O. and 1 N.C. contacts. If additional safety output contacts are needed, safety expansion modules can be connected as illustrated in Figure 3 of the Hybrid safety circuit. Each safety inputs switch will have 2 contacts that will connect to the safety input module s channel 1 and channel 2. The power side of the safety switch will be sourced from the MSR310 base module. Each channel will have a different pulse power source that will be at a different pulse frequency. Use a blue wire with a red trace to identify channel 1 circuit and channel 2 is identified with a solid blue wire. The status of the input device is sent to the PLC either though an output contact on the safety input module or over a DeviceNet interface option on the safety controller s Base Module. The output modules of the MSR 300 series can be selected to have 3 different groups or zones. GMI recommends only using a single group safety output module for this controller. Consider using the Advanced Safety Circuit (Figure 2) if a multi-zone control is needed. The safety output s contacts will connect directly to the safety device. Two output contacts will be required to achieve a safety category 3 design. Short circuit protection must be provided to protect these contacts. The safety contactor's state will need to be monitored by the safety controller, if a safety contactor fails to opens every time, the safety circuit is cycled, the safety controller will detect the contactor fault and prevent the safety circuit from enabling. In this General Safety Circuit the standard PLC inputs are used to monitor each safety device through a N.C. contact on each safety contactor. If all of the safety contactors report to the PLC a high signal when the devices are de-energized, the output of the PLC enables a relay to allow the safety controller to reset and enable the safety circuit. The design of the power safety components will be discussed later in this document. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

12 Figure 1: Example Diagram Safety Risk Category 3 General Circuit CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

13 3.3 Advanced Category 3 Safety Circuits Refer to figure 2: This Advanced Safety Circuit is based on Rockwell Automation SmartGuard 600 controller. The SmartGuard has 16 safety inputs and 8 safety outputs on the base module. Additional safety Compactblock I/O can be added over SIP Safety for DeviceNet. In order to achieve a Safety Category 3 circuit, 2 sets of inputs and outputs will need to be configured in the SmartGuard for each safety device. The SmartGuard is programmed with RSNetworx for DeviceNet with the safety function block editor. Once the application has been developed it will need to be approved by General Mills Engineering. Each safety input s switch will have 2 contacts that will connect to the safety inputs. Configuration in the SmartGuard will group the inputs together. The power side of the safety switch will be sourced from T0 for the 1 st contact and T1 for the 2 nd contact. T0 and T1 have a different pulse frequency providing diversity in the sensors inputs. Use a blue wire with a red trace to identify T0, and T1 be identified with a solid blue wire. T2 power is to be used for all other auxiliary inputs. Connect safety outputs directly to the safety device that is controlled. The circuit will require 2 outputs to each power device to achieve a safety category 3 design. The safety outputs are protected by an internal overload circuit, so it is not necessary to add additional short circuit protection. The state status of each safety device will be communicated to the programmable controller with DeviceNet. This SIP Safety DeviceNet segment must only be used for safety. Use Belden 3082A Red-jacketed cable for the Safety DeviceNet cables. The safety contactor s state will need to be monitored by the safety controller. If a safety contactor fails opens every time, the safety circuit is cycled, the safety controller will detect the contact fault and prevent the safety circuit from enabling. In the Advanced Safety Circuit the inputs of the SmartGuard are used to monitor each safety device through a N.C. contact on each safety contactor. If all of the safety contactors report to the SmartGuard a high signal when the devices are de-energized, the logic in the SmartGuard will allow the safety circuits to reset and enable the safety circuit. The design of the power safety components will be discussed later in this document. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

14 Figure 2: Example Diagram Safety Risk Category 3 Advanced Circuit CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

15 3.4 Hybrid Category 3 Safety Circuit Refer to figure 3: The Hybrid Safety Circuit is based on Rockwell Automation Safety Monitoring Relays (MSR 138). This safety circuit connects one contact of a safety device to channel 1 of a safety relay and the second contact of the safety device to a programmable controller s inputs. The programmable controller s logic then compares the status of all of the safety devices inputs and when they all are in the safe state the programmable controller s output module enables channel 2 on the safety relay. The safety relay in this safety circuit makes the final determination if the circuits are safe to enable the safety circuit. The purpose of this Hybrid safety circuit is to provide a method of upgrading existing non category 3 circuits to a near category 3 level without extensive modifications. The safety contactor s state will need to be monitored by the safety controller. If a safety contactor fails to opens every time, the safety circuit is cycled the safety controller will detect the contactor fault and prevent the safety circuit from enabling. In this Hybrid Safety Circuit the standard PLC inputs are used to monitor each safety device through a N.C. contact on each safety contactor. If all of the safety contactors report to the PLC a high signal when the devices are de-energized, the output of the PLC enables a relay to allow the safety controller to reset and enable the safety circuit. Particular attention is needed on figure 3, Hybrid Safety Circuit. Notice that there is a CR1 contact in both channel 1 and channel 2 of the safety circuit. The purpose of having a CR1 contact in the channel 1 is to open the both circuits of the safety relay; if only one circuit is opened the safety relay will detect a fault. The reason for this is as follows: when the PLC is put in program mode it will drop all of its outputs, including the output in channel 2 of the safety relay. The safety relay would then fault and the only way to clear this fault is to drop both channel 1 & 2 or cycle power to the safety relay. By putting CR1 contact in both safety channels, the safety relay will not fault when the PLC is in program mode. The design of the power safety components will be discussed later in this document. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

16 Figure 3: Example Diagram Safety Risk Category 3 Hybrid Circuit CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

17 4. Safety Risk Category 3 Power Circuits This section provides examples of Safety Risk Category 3 Power Circuits. The following circuits illustrate the design necessary to NOT have a single point of failure in a power circuit. (Duality / Redundancy) NOTE: These Safety Category 3 Safety Circuits are available in AutoCAD format; they can be requested through your CIS Lead Engineer CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

18 4.1 Motor Starters Safety In an application of a single speed motor, the motor starters can be emergency stopped together in a logical grouping (figure 4). A group safety master contactor may be placed on the line-side of the grouping to reduce the number of contactors required. Contacts from the safety monitoring relay are wired to a contactor safety relay to shutdown the motor group. The second contact from the safety relay will control power to the PLC output module. When the emergency stop circuit is disabled it will remove power to the PLC output module and open the contactor dropping power to the motor. The group safety master contactor and the motor contactor are monitored through a N.C. contact that will connect to a PLC input to provide the status back to the Safety Monitoring Relay that the contactors have opened. If the contactors fail to open the safety circuit will not reset. Figure 4: Example Diagram Safety redundancy on single speed motors. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

19 4.2 VFD Safety The second circuit (figure 5, M2) includes a VFD with a Safe-Off module which has a contact that opens the IGTB gating circuit which prevents 3-phase power from going to the motor. A second safety monitoring relay contact is connected to the drive s enable circuit and will disable the drive when an emergency stop circuit is disabled. Using the Safe-Off option on these VFD s reduces the number of components in a control panel thereby saving space, installation time and maintenance. GMI prefers this method of control. For variable frequency drives without the Safe-Off Option (figure 5, M1), use two sets of safety monitoring relay contacts for a safety shutdown. One set of contacts must be wired into the 24Vdc enable circuit and the set of contacts must be wired to a load-side contactor. Line-side contactors may not be used on variable frequency drives. Figure 5: Example Diagram Circuits Integrated into VFD Safety CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

20 4.3 Servo Motion Control Safety Select motion controllers that have safety circuits internal to the hardware. Rockwell Kinetix 6000 GuardMotion motion controller is an example of motion controller with an internal safety circuit that meets EN954-1 requirements. GuardMotion servo motors can connected together as one safety circuit (figure 6), or each servo motor can have separate safety control. It is recommended that all servo systems are designed with a Class 1 Stop which will to bring the servo motor to a controlled stop and then remove power. To accomplish a Class 1 Stop, the Safety Monitoring Relay will need to have a safety delay timer, and the machine guards will need to remain interlocked until the machine comes to a full stop. Figure 6: Example Diagram Circuits Integrated into Servo System Safety 5. Safety Circuit Templates This section illustrates the General Mills safety circuits for the General, Advanced and Hybrid category 3 level safety circuits. Contact General Mills Engineering for AutoCAD files for these templates. The internal details of the Safety Relay must be drawn on all safety circuit drawings. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

21 CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

22 CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

23 CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

24 6. Documentation and Deliverable Refer to GMI s drawing templates for preferred documentation format and expected content. Templates are available upon request. 7. Products or Materials GMI requires the following products and manufacturers: Allen-Bradley Safety Monitoring Relays Allen-Bradley Safety machine guard sensors Allen-Bradley 800H series, red LED illuminated, push-pull E-stop pushbuttons with yellow legend plate Allen-Bradley 800H series, white LED illuminated, momentary contact reset pushbuttons Allen-Bradley 855T series column LED lights (red, yellow, and green) Allen-Bradley Safety Rated Contactors (Positively Guided/Mechanically Linked Auxiliary Contacts) GMI prefers Allen-Bradley safety contactors 100S-C series Allen-Bradley audible horn (p/n 855H-BA10AD) CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

25 8. Identification Label cabinets or enclosures that house contactors, starters, or other control devices on the outside with the source of the electrical power used. This might be the number of a specific MCC or a breaker number from a lighting distribution panel or general utility power panel. Label all major components (such as safety monitoring relays, safety switches, E-stop pushbuttons, motor starters, or local disconnects) as identified on the schematic diagrams. Identify all wires at each termination (refer to 306_P&ID_and_CAD_Standards). Use wire markers to identify a unique number that corresponds to the schematic diagram. When the wires are part of a PLC system, label them with the same number as the input or output points of the PLC. 9. Calibrations and Testing Emergency safety circuits design must be approved by GMI engineering prior to installation of the equipment. All equipment emergency stops and safety guards must be in position and operable prior to running any hazardous equipment. On a scheduled basis (weekly is recommended), all safety devices will need to be cycled off/on to verify correct operation of the emergency stop system. CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

26 10. Revision Summaries Enter information in these tables to track revisions to the master document. NOTE: In the Entry column, enter your information between the dashes. The entries automatically update matching document properties. Document Property Entry Master Owner -Daniel Migliori- Increment revision numbers Master Revision Number -1- by one. Master Revision Date -2/18/2008- Revision Number Revision Date Revision Owner Revision Summary (Brief description of major changes) 0 7/29/2005 Daniel Migliori Original development 1 2/18/2008 Daniel Migliori Safety circuits updated CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February

27 10.1 Plant Customization Tracking Enter information in these tables to track revisions to plant customized documents. NOTE: In the Entry column, enter your information between the dashes. The entries automatically update document properties. Document Property Entry Plant Code -XXX- Use the following format for Plant Owner -Enter Namethe Plant Revision Number: Plant Revision Number <Master Revision Number>.<Plant Revision Plant Revision Date -3/29/05- Number> Revision Number Revision Date Revision Owner Revision Summary (Brief description of major changes) 0 CIS_304_Safety-E-Stop_Circuit_Design_Standard_WHQ_Rev1.doc, Revision 1, February