Frequently asked questions on risk assessment

In the order set out in EN ISO 12100: determine the limits of the machine, identify hazards, estimate risks, evaluate risks, define measures following the three-step method, check their effectiveness and repeat the cycle until the residual risk is acceptable. Every step is documented; the documentation is the actual evidence. Read in full

Before placing any new machine on the market and before putting a self-built installation into service. It does not begin at the end of the design work, it accompanies it. Findings that only emerge after the build lead to expensive retrofits. It also has to be carried out again after a substantial modification. Read in full

There is no formal accreditation. The manufacturer is responsible; the work has to be done by someone with sufficient knowledge of the machine, the hazards and the standards to be applied. In practice it is teamwork between design, control engineering and safety specialists. One person alone regularly overlooks operating modes outside normal operation. Read in full

EN ISO 12100 as the basic standard; it describes the method and the procedure. For evaluating safety-related parts of control systems EN ISO 13849-1 is added. Where a type-C standard exists for the machine type, its specific provisions take precedence. Read in full

It is an iterative cycle: set the limits, identify hazards, estimate the risk, evaluate the risk, implement measures, and then check again whether the measure has created new hazards. The cycle ends when the remaining risk is acceptable and the result has been documented. Read in full

All that can occur over the entire life cycle: mechanical, electrical, thermal, noise, vibration, radiation, materials and substances, ergonomics, plus hazards from the environment and from combinations. Not only normal operation has to be considered but also transport, assembly, setting, fault clearance, cleaning, maintenance and dismantling. The annexes of EN ISO 12100 provide the checklist for this. Read in full

Through the severity of the possible harm and the probability of its occurrence, which is made up of exposure time in the hazard zone, probability of the event and possibility of avoidance. Whether a risk matrix, a risk graph or a scoring system is used is not prescribed by the standard. More important than the method is that it is applied consistently and documented traceably. Read in full

Traceably for each hazard: the hazard identified, the risk before the measure, the measure chosen with its place in the three-step method, the technical implementation with evidence, and the remaining risk after the measure. For control measures the performance level achieved plus its calculation belongs with it. References to the instructions for use do not replace a technical measure. Read in full

When the three-step method has been worked through in its order and the remaining risk is acceptable in relation to the state of the art. First inherently safe design, then technical safeguards, and only last information for use. A warning in the instructions must never replace a design solution that is possible. Read in full

Residual risks are the hazards that remain despite design and safeguards. They are recorded in the risk assessment and have to be carried over into the instructions for use, with the source of the hazard, the possible consequence and the measure the operating company has to take. These statements are at the same time the basis for that company's own workplace risk assessment. Read in full

Risk analysis covers determining the limits, identifying hazards and estimating risks. Risk evaluation then decides whether risk reduction is necessary. Both together make up the risk assessment, the umbrella term for the document that is required. Read in full

Typically a table with one row per hazard: life-cycle phase, location or assembly, hazard, possible event, risk before the measure, measure, standard or evidence, risk after the measure, residual risk for the instructions for use. Ahead of it stand the limits of the machine, behind it the validation of the safety functions. What matters is unbroken traceability from the hazard to the evidence. Read in full

The standard does not prescribe a form, only the method and the content to be documented. Any structure works that consistently covers the limits of the machine, a hazard list across all life-cycle phases, risk estimation, measures following the three-step method, evidence and residual risks. A template does not replace hazard identification, it only structures the result. Read in full

With every change to the machine that could be safety-relevant, including changes to software and parameters. Likewise when new hazards become known during operation, for instance after a near miss. A risk assessment that does not match the machine as delivered is worthless as evidence.