The Jumper on Terminal 4

The jumper converts a guarded machine into an unguarded one, and the PL d label on the relay is being used to imply protection that the system as a whole does not deliver.

• PL is a property of the whole safety-related control system, not of one component. The chain is sensor, logic, and output. The manufacturer's PL d rating covers the logic element only. The gate interlock is a single normally-closed switch with no redundancy and no self-checking, which rules out the architecture and diagnostic coverage that PL d requires; as built, the gate function is realistically Category B or 1 and cannot support a PL d claim. The weakest element sets the system performance level.
• The jumper defeats the gate interlock entirely. With terminal 4 jumpered, the relay is told the gate is closed regardless of its actual state, so the safety function that stops the machine on gate opening no longer exists. Whatever probability of failure the gate circuit had, the jumper makes the failure probability irrelevant - the function has been removed, not degraded.
• Automatic reset is a separate defect. Where a person can be inside the hazard zone, reset must be manual and positioned so the operator can see the whole zone. A system that restarts when the gate closes can restart on someone who is still inside.
• The light curtain at the loading station is not a substitute. It guards a different opening, and jam clearing happens at the gate.
• The injury history is the confirmation. Two recordable hand injuries and three near misses in eleven weeks at one gate is not bad luck; it is a machine that is being used the way the jumper permits.

The correct framing for the manager: this is not a compliance paperwork question, it is an unguarded point of operation with a demonstrated injury rate.

No. A procedure that asks an operator to stand clear while a machine runs with the guard defeated is an administrative control standing in for an engineering safeguard, and it fails on its own terms: jams occur 15-20 times a shift, which means 15-20 times a shift someone is asked to remember a rule in a hurry next to a running machine. Human error is not a hypothetical here; it is the predictable outcome. It also does not address unexpected restart or a second person entering the zone.

Take the jumper out now. That is the first instruction, and it should be done before the next shift regardless of what else is decided.

Interim arrangements I would accept, in order of preference:

1. Restore the gate interlock and use lockout for jam clearing - the current practice - while reducing the lockout time so the production objection goes away. That means a single, well-placed energy-isolation point for the palletizer and conveyor, a stored-energy check, and a jam-clearing tool that keeps hands out of the pinch points. A 6-9 minute lockout is a design problem, not a law of nature.
2. A properly designed limited-motion mode with a hold-to-run enabling device at a fixed location outside the hazard zone, reach distances verified against the relevant safety-distance standard, reduced speed, and a manual reset. This must be designed and validated as a safety function - not improvised by maintenance.
3. Reduce the need to enter at all by fixing the jam source, which is the only measure that scales to 15-20 events per shift.

Before the muting module arrives I would require: a documented risk assessment of the gate and loading station that sets the required performance level for each safety function, a design that meets it including redundancy and self-checking on the interlock, a manual reset, a validation test with records, and a management-of-change review. The 14-week lead time is a reason to order the module and engineer the interim properly, not a reason to keep the jumper.

The jam frequency is the root cause. 15-20 jams per shift is a machine or line-design problem, and every jam is an invitation to reach in. The investigation should go upstream: case spacing and accumulation pressure, photoeye or sensor reliability and alignment, stretch-wrapper film tension and cut sequence, pallet quality and layer pattern, and conveyor speed mismatch between the infeed and the palletizer. A jam-reduction effort that halves the events halves the exposures; a guard that is technically correct but bypassed 20 times a shift protects nobody. A dedicated, guarded jam-clearing opening with the clearing point outside the reach envelope is worth more than a faster lockout alone.

Reporting and recording:

• Amputations are reportable to OSHA within 24 hours of the employer learning of them, and a fingertip amputation generally meets that definition. Confirm whether the report was made and, if it was missed, make it now and document why. That timing failure is a separate exposure from the injury itself.
• Verify the injury log entries for both recordable injuries, including the correct classification and days away or restricted.
• Look at the near-miss reports. Three near misses at the same gate in eleven weeks is a reporting system that worked and a response system that did not. If the response to those reports had been an engineering fix rather than a jumper, the next two injuries do not happen. Reinforce that near-miss reporting is wanted, and be explicit that no one will be disciplined for reporting.
• Check for retaliation risk before any discipline is considered. If the jumper was installed under production pressure, the operators are not the cause of this problem.