How do you service your end of arm tool?

Generally, the dangers that need to be eliminated are active power and stored energy. "Stored energy" includes gravity (something that might fall on you), air or hydraulic pressure remaining in the lines, heat, and stored electrical charge.

Active power is "live" power -- main air pressure still present on the EOAT and maintained by the facility supply, electrical power still present to the actuators, sensors, communication units, etc.

Stored energy needs to be secured safely. Air lines vented and locked out from the facilities supply, electrical power disconnected and locked out, any dangerous objects that might fall on someone either placed on the floor or safely secured to something that will hold them up, etc.

Sometimes you need to work on an EOAT without eliminating all the energy, however. Say, adjusting a part-present sensor to trip correctly. It's often not possible to tell if the switch is reading the part or not unless you have power to it. Likewise, if you're testing an air-powered gripper, you may need to cycle it repeatedly, which would require active air pressure, at minimum. And it's normal practice, when a robot is put into Teach mode, to disable motive power (like, electrical power to move pneumatic valves) but leave communications power. Comms power is usually so low-voltage as to not be hazardous, even hot-plugging connectors, but if cutting cables or landing bare wires, one should still eliminate this power as well. It's situational.

Usually, if a robot is in teach mode and the safety perimeter has been breached (usually when someone is working by the robot with the teach pendant), normal practice is to interlock the motive power to the EOAT with the pendant deadman switch. This leaves the programmer able to use the EOAT, as long as they squeeze the deadman, but reduces (not eliminates) the chances of the EOAT moving unexpectedly.

So, the key is to identify all the sources of active and stored energy in the system that could cause harm, the scenarios where someone might be exposed to them, and develop clear procedures to mitigate or eliminate those risks.

A heavy object carried by an EOAT that has locking grippers is probably safe to walk under, depending on the EOAT design, and if the EOAT has a good grip on the object (still a good habit not to linger below, though). An EOAT using suction cups, however, is a different story -- any loss of air pressure could drop the payload without warning. No one should go near the EOAT unless the potentially harmful energies are dealt with. If the robot's "grip" on the payload isn't trustworthy, lower it close to the floor so no one can walk under. If the EOAT power isn't tied into the robot Teach safeties, then it needs to be locked out safely. But if locking out that power puts the EOAT at risk of dropping the payload, then deal with the payload first. If you're going to do wiring, lock out any electrical power supplies feeding the EOAT. Ditto for air. You may need to lock out more than one energy supply (air and electrical, for example), and more than one safety lock may be required.

Robot brakes are usually more than robust enough to stand up to maintenance work on the EOAT, unless major forces are applied, or the robot is badly worn out.

Quote from SkyeFire

It's situational.

....

Robot brakes are usually more than robust enough to stand up to maintenance work on the EOAT, unless major forces are applied, or the robot is badly worn out.

SkyeFire once again provides excellent, and most importantly experienced, information.

Please remember, if a safety system design makes it prohibitive to work on, people will resort to bypassing it.

Safety is critical. Never underestimate the ingenuity of complete fools.

The best safety is passive -- that is, it's inherent to how the machine is built, in such a way that it doesn't rely too much on people taking active steps to be safe. Like linking the perimeter gate with the robot's auto mode, so that auto is only possible with the gate closed.

Safety also needs to be low-friction. As PDL said, if the safety procedures are too burdensome, people will look for ways to cut corners. This is why major automation users, like automotive companies, put so much emphasis on single-point lockout -- in most of their systems, you can render a system (mostly) safe for human entry by locking out at one single point. But this requires deliberate design.

Of course, you often cannot make something completely safe. For example, the grippers on a robot. If the gate is open, and the robot is in teach, the programmer usually needs to be able to control the grippers from the teach pendant. This means it's possible for them to punch the wrong button and drop an engine block on their head (or someone else). This leads to rules requiring hard hats inside some cells, and every-person-must-have-their-own-deadman rules.

My favorite "too much safety" story is the plant where, even after locking out main power to the robot, maintenance staff were required to chain the robot to the floor before doing anything else inside the safety perimeter. The justification for this was the "possibility" for a lightning bolt to hit the building, travel down the mains power bus, arc across the locked-out disconnect, and somehow make the robot move violently and strike someone. Not only were the resources put into protecting against that "possibility" wasted, they also encouraged the people on the floor to disregard other, more relevant safety measures, b/c they came from the same rules-makers.