Risk Assessment Example with ISO 12100
Machinery safety is an important but often undertaught subject, and the terminology in ISO 12100 can make risk assessment difficult to understand. This example works through the procedures and methods in ISO 12100 and the old ISO 14121-2.
Risk assessment identifies risks and hazards in a machine design. As machine designers, we must make our machines safe for people to operate. Finding and eliminating those risks is ultimately our responsibility.
The overview below shows the process:
Standard Procedure for Risk Assessment
Risk assessment can feel theoretical and distant from the machinery you work with. Even so, the complex guidelines are very useful in practice. They use specialized language that can be difficult to follow at first. I will explain that language in simpler terms to connect the guidelines to actual machinery.
First, what is a standard?
A standard is a way of following the law. A practical way of following the law. Because laws are not very specific.
Take for example the Machine Directive. The Machine Directive is a common template that each country in Europe has to implement as a law. But the MD does not tell you anything about how you should assess and reduce risks. It only tells you that you should do it, in order to legally sell your machine in Europe.
Follow the Standard – Follow the Law
Standards describe practical ways to follow the law.
One of those standards describes how to assess and reduce machinery risks. It gives you a solid procedure for risk assessment and risk reduction during machine design.
The most well known standard is the ISO 14121. That standard has been withdrawn and merged with the ISO 12100. But the principles of risk assessment from the old standard still lives in the new one:
ISO 12100 Safety of Machinery – General Principles for Design
The standard uses a lot of specialized terminology, which can make its methods and procedures hard to connect to actual machinery. The goal is to make your machine as safe as possible, whether through safeguarding, safety relays or other measures.
I will use a risk assessment example to connect those methods with different hazard examples.
Risk Assessment Definition
The principles of risk assessment give us a sequence of steps for evaluating potential machinery risks. Following those steps helps us evaluate the risks thoroughly.
The risk assessment procedure follows this sequence:
Risk Assessment Flow Diagram from ISO 14121
The process has 5 steps.
- Determination of the Limits of Machinery
- Hazard Identification
- Risk Estimation
- Risk Evaluation
- Is the Machine Safe?
In these steps, you will assess and evaluate the risks and dangerous situations that can arise when a machine is operating. The scope extends beyond operation to the machine’s whole life cycle. Each step helps you identify risks and then estimate and evaluate the danger they present. In practical terms, you are working out how much harm each risk could cause.
What is a Risk?
Before working through the steps, we need the ISO 12100 definition of risk:
“combination of the probability of occurrence of harm and the severity of that harm”
Harm means physical injury or damage to health. Risk therefore covers both the chance of an injury or health problem and how severe it could be.
Risk Assessment Process
I will apply the 5 risk assessment steps to this machine example:
1. Determination of the Limits of Machinery
First, determine the limits of your machine and the risks involved in operating it. There are 3 types of limits to establish:
- Limits of Use
- Limits of Space
- Limits of Time
Limits of Use
Limits of use describe both normal use and potential misuse. They identify where to focus on safety and where that focus ends. You are defining the machine’s limits in use, space and time.
Describe the people using your machine
Include the people who might use the machine when defining its limits of use. These can be operators, other employees or anyone else likely to use it.
Describe those people in terms relevant to the machine. Consider how long they will use it and the materials they will handle, such as paper in a printing press. Include their competence and experience, along with relevant age and gender information.
Focus on information that is relevant to how people use or misuse your machine. Describing the operator’s experience, for example, helps you understand how that person will understand the machine. If the machine uses advanced technology, its operator may not always understand how it does what it does. Once you know those limits in the operator’s understanding, you can account for them in the design. This helps you build a safer machine for the person who will operate it.
Limits of Space
Next, define the space limits: the machine’s physical size and the space needed to operate and maintain it.
The range of movements is an important part of the space limits. For any moving parts, determine the space they occupy while moving, also called their range of movements. A robot arm is a good example. Consider how much space it needs to move around, rather than only the space it occupies in one position.
Limits of Time
The last limits to determine are those over time, starting with the expected lifetime of the machine. The machine and its components will wear out as time passes. Describe that wear so you have an estimate of how long the different parts are expected to last.
Include maintenance intervals and cleaning. Describe the machine’s life cycle from design through installation and use, including maintenance and eventual disposal.
2. Hazard Identification
Once you have defined the limits, identify the hazards. A hazard is a potential source of harm.
You must describe all the dangerous situations that could arise during hazard identification, probably the most important step in the risk assessment process. Every hazardous situation and event needs to be included here. Anything you miss will also be missing from the later steps, where you work out how to eliminate or reduce the dangers. Those later steps cannot deal with a hazard that was never identified.
Hazards take many forms. The standard groups its examples by type to help you identify them:
- Mechanical Hazards
- Electrical Hazards
- Thermal Hazards
- Noise Hazards
- Vibration Hazards
- Radiation Hazards
- Material/substance Hazard
- Ergonomic Hazards
- Hazards associated with environment in which the machine is used
- Combination of Hazards
Some hazards are obvious to machine designers and builders, while others need specialist knowledge. Noise hazards, for example, require an understanding of how noise affects the human body and the level at which it becomes hazardous. Material and substance hazards likewise require knowledge of which substances can cause harm.
Hazard and Harm
A hazard can cause physical injury or damage to health in several ways. Heat combined with flammable materials is one example of a harmful situation.
Include the origin of the hazard and its potential consequences when describing it. The origin explains what causes the hazard; the consequences describe the possible harm. For example, a rotating knife is the origin of a hazard. The cutting it could cause is the potential consequence.
Using Limits to Look for Hazards
Look for hazards to everyone who could use the machine, including people other than its operator. The first step, determining the limits of machinery, identifies these people.
The machinery limits from the first step set the scope of hazard identification. Use those boundaries to decide where to look for hazards and whose use of the machine to consider. If cleaning personnel fall within the limits of use, for example, look at hazards from their perspective too. Their work needs to be included in this assessment.
Hazard Examples
The following examples describe some of the hazard types in the ISO standard. Many other hazards exist, so this is only a set of examples. For the full list, consult either the old ISO 14121-1 or the new ISO 12100 standard.
Mechanical Hazards
Mechanical hazards come from mechanical parts, including sharp edges and rotating or moving components. They can cause cutting, crushing, shearing and other harm. The pitch point of two gears is one example; unrestricted access to a running gear is a hazard to consider.
Electrical Hazards
All hazards that involve electrical parts of the machine is an electrical hazard. Electrocution, arcs and thermal radiation are the obvious hazards here. But electrical hazards isn’t only the electricity being the direct hazard. Electrical hazards also includes parts that become live under fault conditions, overload, short-circuits and other hazards where the electricity is the indirect source of the hazard. If a part becomes live under fault conditions it won’t be the electricity that will cause harm, but rather the live part (typically moving or rotating when the part is not supposed to).
By following standards like IEC 60204-1 or the American NFPA 79 standards for electrical machine safety when you are building machines, you will automatically take care of many of these hazards. The standards describes safety requirements for electrical machines. As an example, the IEC 60204-1 describes different stop categories which are different ways of stopping a machine. Sometimes you need to stop the machine by cutting the power to the live parts. But sometimes you need to decelerate, break or even keep some parts live during a stop to avoid hazards.
Thermal Hazards
Thermal hazards include explosions and flames, as well as very hot or cold parts and radiation from heat sources. The resulting harm ranges from discomfort to serious burns, dehydration and radiation injuries.
Noise Hazards
Noise can come from many sources, including pneumatic whistling, unbalanced rotating parts and scraping surfaces. The manufacturing process carried out by the machine can itself produce hazardous noise.
Vibration Hazards
Vibration can be a serious hazard, particularly with prolonged exposure. It can loosen bolts and other machine parts. It can also harm the operator, so consider its effects on people as well as on the machine.
Radiation Hazards
Radiation hazards cover radiation that can harm people. Ionizing radiation damages human tissue by removing electrons from atoms. Examples include X-rays, alpha, beta and gamma rays. WHO explains how ionizing radiation can be a hazard.
Material/substance Hazards
Harmful substances can present short-term or long-term risks to anyone exposed to them around the machine. They may be liquids, gases, solids or fumes. Consider substances that harm the human body through skin contact, ingestion or inhalation. Examples include welding fumes, oils and greases, acid and solvents.
Ergonomic Hazards
Ergonomic hazards arise when working positions or procedures threaten people’s well being. Their effects can be short-term or long-term, with different levels of severity. Identifying them can be difficult: a position that seems acceptable may cause harm over time. Consider heavy lifting and repetitive movements, as well as prolonged screen use, when estimating risks.
Hazards associated with environment in which the machine is used
Consider the environment where the machine will work, whether a factory hall, an outdoor location or somewhere else. For an outdoor machine, the terrain may create a hazard.
Combination of Hazards
Combined hazards are easy to overlook because several factors together create the danger. For example, a machine might produce flammable gas while also using heat or fire.
Methods for Identifying Hazards
Identifying hazards can become overwhelming when you consider how many different things could cause harm. Once the number of possible hazards grows, it helps to have a system for putting them in order. That system makes the identification work easier to organize.
Some hazards are “hidden” until a machine or component fails. A broken wire, for example, might stop a stop button from working. My article on normally closed contacts for stop buttons describes that situation. It is one of many “hidden” hazards that can arise while a machine is in use.
A standard method or system for hazard identification also helps with teamwork. You will rarely design a machine entirely alone, unless it is a very small one. More often, machine design involves a team of people working together, and they need a shared approach to identifying hazards.
When several people work on the same machine, particularly during risk assessment, they need to use the same method. A hazard and failure identification method with fixed terminology gives everyone a common understanding. The team can then treat hazards in the same way instead of interpreting the terms differently. Using a shared method reduces misunderstandings and improves communication between the people doing the work.
Hazard and Operability Study
One common method is the hazard and operability study, or HAZOP.
Failure Mode and Effects Analysis
The failure mode and effects analysis, or FMEA, is another method for identifying hazards and failures. It helps find “hidden” hazards caused by machine failures.
FMEA is a technique for analyzing failures. It lets you identify mechanical, electrical and software weaknesses, along with other items that are likely to fail. After identifying those weaknesses, you use the FMEA to describe the actions needed to eliminate them. The analysis therefore connects possible failures to the work needed to address them.
An FMEA usually uses a spreadsheet with fields for describing and analyzing failure modes. A typical example looks like this:
Failure Mode and Effects Analysis spreadsheet template
FMEA Terminology
An FMEA comes with defined terminology as well as a method. Each term has a short description of what it means. These definitions help everyone working on the FMEA use the terms consistently, with the same meaning. The following are examples of the basic terms used in an FMEA:
Failure
The loss of a function under stated conditions.Failure mode
The specific manner or way by which a failure occurs in terms of failure of the item (being a part or (sub) system) function under investigation; it may generally describe the way the failure occurs. Failure mode shall at least clearly describe a (end) failure state of the item (or function in case of a Functional FMEA) under consideration. It is the result of the failure mechanism (cause of the failure mode). For example; a fully fractured axle, a deformed axle or a fully open or fully closed electrical contact are each a separate failure mode.Source: Wikipedia
Defining terms such as failure and failure mode is only part of the work. You also need to encourage the whole team to use those definitions. If someone uses their own terminology, misunderstandings can quickly arise among the people assessing the machine. Since the work concerns machinery safety, those misunderstandings can have fatal consequences.
Failures and Failure Modes
The analysis method is defined as clearly as the terms. Each potential failure mode is assessed consistently using the same criteria.
FMEA also includes parts of the next two steps in risk assessment. Those steps are risk estimation and risk evaluation, both of which you also carry out in an FMEA. That gives the FMEA a place in these later stages as well as in hazard identification. Both estimation and evaluation need to be done with care.
The two steps are extremely important in their own right. There is also another reason to take care: hazard identification often involves more than an FMEA. A fault tree analysis, for example, is another method often used to analyze failures and failure modes.
The next two steps analyze the hazards that have been identified. As in an FMEA, you work with the probability of an event and the possible harm, or severity. However, you will probably use more than an FMEA to find hazards. To cover all the risks, you must also estimate those found through other methods. The FMEA results alone will not cover risks identified elsewhere.
3. Risk Estimation
After identifying risks, estimate them. Risk assessment often involves iteration: estimating one risk can reveal others, even at this stage.
Risk estimation can be confusing at first because there are many ways to do it, each with its own terminology. The objective is to analyze the risks and establish how “serious” they are. You need an estimate of the severity of the hazards as well as how often they are likely to appear as risks. Together, these estimates let you judge the level of risk.
Probability and Severity
The standard describes these two elements of risk estimation as:
- Severity of harm
- Probability of occurrence of harm
The standard also mentions the probability of occurrence of cumulative harm. This means considering a hazardous situation over time, since cumulative exposure can cause harm. It combines elements including exposure frequency, the probability of a hazardous event and the possibility of eliminating or limiting the harm.
Methods of Risk Estimation
You can estimate risk using different methods. The standard describes three types, and your team needs a common method so that everyone estimates risks in the same way. The choice affects how people interpret the risks they find. A study found that parameters and the architecture of the method, among other factors, can have a significant influence on the estimated risk.
With that said, the chosen method itself is not important. It is the process of risk estimation that is important.
- Risk Matrix
- Risk Graph
- Numerical Scoring
Most estimation tools combine one or more of these types, though you can choose another type. Any method must consider at least the severity and probability of harm.
Risk Matrix
A risk matrix uses a multidimensional table with up to four dimensions. The fairly intuitive format helps explain why the technique is widely used. Each dimension or parameter is divided into levels. The standard gives an example in which severity of harm is minor, moderate, serious or catastrophic. You can choose your own levels instead, provided you clearly define each of them so that everyone knows what it means.
The definition of catastrophic is:
“death or permanent disabling injury or illness (unable to return to work)”
Source: ISO 14121-2
The matrix displays risk levels visually, often using color. Like the parameter levels, risk levels have defined categories, typically high, medium, low and negligible. You may also define your own.
A typical risk matrix looks like this:
Risk Assessment Matrix for Risk Estimation
Risk Graph
A risk graph is another visual tool for estimating risks. The graph is a decision tree, with nodes connected by branches to other nodes. Each branch is a decision, and the nodes are the parameters being considered. In a risk graph, those decisions concern the levels of the parameters, such as catastrophic, moderate or minor. If you have experience determining a required performance level or SIL, you have probably encountered a risk graph before.
I find examples the best way to learn, so here is a risk graph example.
Risk Assessment Graph for Estimating Risks
The resulting risk levels from 1-6 correspond to high, medium and low risk.
Numerical Scoring
The last method assigns numerical scores to the parameters, in place of the qualitative terms used in matrices and risk graphs.
Numerical values can seem more objective than qualitative terms such as moderate or serious when you first encounter them. However, assigning those numbers is also a subjective process. The numerical values are often grouped at the end and translated back into qualitative terms. Using numbers therefore does not remove the judgment involved in estimating the risk level.
All parameters are divided into scores or numerical values. The interval these numbers are within is up to you. In the standard you will find an example with an interval of numerical values from 0 to 100. If you take a closer look at the example you will see that, in the translation from qualitative terms to numerical values, each qualitative term doesn’t represent equally sized intervals.
The severity parameter is divided into a severity score (SS) as follows:
Catastrophic = 100
Serious = 90-99
Moderate = 30-89
Minor = 0-29
The probability of harm parameter is similarly divided into a probability score (PS):
Very likely = 100
Likely = 70-99
Unlikely = 30-69
Remote = 0-29
After the numerical values (scores) for the parameters of the risk are found you can calculate the risk score (RS). This is often done by summing up the scores:
RS = SS + PS
After calculating the risk score, your team still has to interpret what it means. A table is one way to translate the numerical score into a qualitative term. You can use other methods for that translation too.
| High | 160+ |
| Medium | 120-159 |
| Low | 90-119 |
| Negligible | 0-89 |
As with the earlier examples, the risk reduction process matters more than whether you use numerical values or qualitative terms. Your team needs to interpret the level or score and decide what actions to take. Those decisions are what matter in practice. This brings us to the next step in the risk assessment process, risk evaluation.
4. Risk Evaluation
This step is, as the name indicates, all about evaluating the risks you found and estimated previously. It is a critical step in the process, because it is here we decide which actions we need to take to reduce those risks. If we need to take any actions at all. From the previous step we learned that a risk can be negligible (risk score from 0-89). If a risk is negligible it is not always necessary to try to reduce the risk.
Risk reduction has two main objectives:
- To decide if a hazardous situation require further risk reduction
- To determine if risk reduction has introduced new hazards or increased other risks
The first objective is to decide what actions will reduce the risks. You also need to check that those actions will not increase risks elsewhere or introduce new ones. This is where the iterative nature of the process becomes necessary. Repeat risk evaluation until you have met both objectives. Where risks are high, a more detailed risk estimation may help you decide what to do.
After reducing risks, evaluate them again. If a measure introduces another risk, you need to return to risk estimation and estimate that risk too. This applies to every hazard and hazardous situation under every condition of use. For each of them, work through the whole risk reduction process instead of treating the first measure as the end of the assessment.
5. Is the Machine Safe?
During each iteration, ask this question:
Has the risk been adequately reduced?
During each iteration, you are considering one risk. If the answer to the question is no, the next step is to begin the risk reduction process for that risk. Asking the question is the final step of risk assessment. Risk reduction has its own process and is not considered part of risk assessment, even though the two processes connect.
My article on risk reduction and safety circuits covers risk reduction in detail. Safeguarding and safety circuits using safety relays are among the available measures.
Since the two processes connect, I will cover some relevant risk reduction information here.
Risk Reduction
Extending the opening flowchart shows the risk reduction process.
Some risk reduction measures take priority over others. The following flowchart shows that order:
Risk reduction flowchart from ISO 12100
First you should consider if the risk can be removed by inherently safe design measures. Only if that is not possible, safeguarding and other protective devices should be considered.
The risk reduction and assessment processes connect at several points. After each of the three risk reduction steps, ask:
Is the intended risk reduction achieved?
A no answer takes you back to risk assessment through another question:
Are other hazards generated?
Introducing emergency stops or safety-related parts of the control system can show why this is necessary. Imagine cutting the power to an actuator that is lifting a heavy object. Stopping a motor with a large load too quickly is another example. Either action can introduce other hazards. If that happens, return to risk assessment and work through the process again to consider those hazards.
The iterative nature of the risk assessment flow diagram is probably its most important point. Treat the diagram as a process you repeat, rather than something you work through only once. You need to repeat it for each hazard, and also for hazards that the risk reduction measures could introduce.
