# IoT-Aware Architecture to Guarantee Safety of Maintenance Operators in Industrial Plants
## 4 System Requirements  
### Requirements  
The most important regulation related to the design of safety machine tools is the already mentioned ISO 12100-2010 [8]. In particular, Section 5.3.1 of the regulation reports that \"Risk assessment begins with the determination of the limits of the machinery, taking into account all the phases of the machinery life. This means that the characteristics and performances of the machine or a series of machines in an integrated process, and the related people, environment, and products, should be identified in terms of the limits of machinery\" and, therefore, have to be taken into account in designing new safety machines. Specifically, the limits to be respected in using any machinery are reported in Section 5.3.2 of the regulation, and the ones related to the safety of workers during maintenance are discussed at point c. At this point, it is specifically requested that the training level of maintenance personnel has to be always taken into account. In addition, as reported in point 5.4 of the regulation, hazard identification has to be performed and hazardous situations have to be taken into account, as listed in Section 5.4 (a). Guided by the just mentioned state of the art and all the other relevant standards applied for this kind of risk analysis, we have elaborated and extracted the following list of requirements to enhance worker safety in maintenance procedures. The first list reports the main functional requirements (FR) that guided the design of the proposed system architecture, while the second list reports the non-functional ones (NFR). The system should: FR1. be always connected to the machinery through a smart system complaint with MD 2006/42/CEE. This requirement is extracted from EN 62745:2017+A11:2020 [27] that is the standard to be respected to guarantee the safety of machinery and, thus, contains a lot of specifications related to operating command signals such as neutral frames (Definition 3.10) and valid signals (Definition 3.21). The specific part from which the FR1 has been extracted is the one related to the cessation of transmission from the remote station that shall cause an automatic stop command for the machine. This mandatory rule generated both the requirements and the consequent countermeasures designed for our system. FR2. be able to verify that the system is in safe mode before allowing any maintenance operation. It is derived from the specification reported in the standard ISO 12100:2010 [8], paragraph 6.2.11.10: machinery with service mode shall be provided with a mode selector which can be locked in each position/location. The physical selection of service mode enables input signals to the safety-related part of the control system as defined in ISO13849-1 [5]. FR3. guarantee support to de-energize and re-energize the machinery before and after the maintenance. The de-energization of any machinery before any maintenance activity declined in the LockOut/TagOut procedure is one of the specifications reported as a specific measure to be performed in disconnecting the machine from the power supply. It can be found in standard ISO12100:2010 [8] paragraph 6.3.5.4, Measures for isolation and energy dissipation. FR4. monitor the position of operators concerning some specific LOTO points. At the time of writing, the verification of the correct execution of each procedure is delegated to the visual inspection of the operations and the self-responsibility of the operators. However, it is not always easy to visually inspect operators' actions, especially in huge industrial plants. Therefore, the monitoring can be appreciated by all the stakeholders. FR5. guide the operator throughout all the foreseen operations; each step should be enabled only if the previous one was successfully completed.