How it works, step by step, to EN ISO 12100

The Machinery Regulation (EU) 2023/1230 and the Machinery Directive 2006/42/EC both require the manufacturer to ensure that a risk assessment is carried out, to determine which essential health and safety requirements apply to the machine. The machine must then be designed and built on the basis of the result. The requirement sits in the general principles of Annex III of the regulation and Annex I of the directive.

The risk assessment is part of the technical file, together with the protective measures and the residual risks (Annex IV, Part A, point (b)(ii) of the regulation and Annex VII, Part A of the directive).

The manufacturer's risk assessment of the machine is not the same as the employer's risk assessment under workplace health and safety management. The first is about how the machine is designed, the second about how it is used at the workplace. Anyone who builds a machine for their own use has both roles.

EN ISO 12100 is the harmonised standard that describes how to carry out a risk assessment of a machine. It is a type-A standard, with the basic concepts and method for all machinery. Type-B standards deal with one safety aspect or type of safeguard, such as safety distances, and type-C standards with a particular kind of machine, such as EN ISO 10218-2 for robot cells. Where a type-C standard exists for the machine, it takes precedence where the two differ.

The standard is sold by SIS, the Swedish Institute for Standards. This guide describes the method in our own words and refers to the standard's clauses.

The manufacturer is responsible, but the work goes best in a small group where someone knows the machine from each side:

• The designer, who knows what the machine is built for and why it looks the way it does.
• Whoever did the electrics and control system, for the safety functions and what happens on a fault.
• Someone who runs or services similar machines and knows how they are really used.
• One person who leads the work and keeps to the method, ideally someone who didn't design the machine.

Start while the design can still change, and revisit the assessment when the drawings change. A risk assessment done at delivery can only add signs and guards.

The risk assessment starts with a description of the machine's limits, which clause 5.3 divides into four kinds:

• Use: intended use, operating modes, reasonably foreseeable misuse, and who uses the machine or is near it.
• Space: range of movement, space for installation, operation and maintenance, and the interfaces with people and power supply.
• Time: the life of the machine and its components, and the intervals for servicing and replacing wear parts.
• Other: the material the machine processes and the environment it stands in, such as temperature, humidity or whether it is outdoors.

Go through every life phase: transport, installation, commissioning, setting, operation, cleaning, maintenance, fault finding and decommissioning. Many accidents happen when the machine is not in normal operation, and that is where risk assessments are usually thinnest.

For each task, ask what the person does at the machine, which states the machine can be in, including faults and power failures, and how someone might behave unexpectedly. A reflex movement of the hand or a defeated guard is foreseeable.

Annex B of the standard sorts hazards into groups. Some examples:

• Mechanical: crushing, cutting, drawing-in, ejected parts and stored energy.
• Electrical: live parts and arc flash.
• Thermal: hot and cold surfaces.
• Noise and vibration.
• Radiation: laser, UV and electromagnetic fields.
• Materials and substances: dust, fumes, gas and flammable substances.
• Ergonomic: working postures, repetitive movements and controls that are hard to understand.

The risk in a hazardous situation has two parts: how severe the harm can be and how likely it is. The likelihood in turn depends on how often and how long someone is exposed, how likely the hazardous event is and whether the person can avoid the harm (clause 5.5).

The standard does not prescribe a particular method. ISO/TR 14121-2 describes several, such as a risk matrix, a risk graph and numerical scoring. Verkio uses the hybrid method from there: severity 1–4 and a probability class that is the sum of exposure, the probability of the hazardous event and the possibility of avoiding the harm.

Estimate the risk both before and after the protective measure, with the same parameters. That shows how much the measure reduced the risk.

When the protective measure is a safety function, you also determine the performance level it requires, PLr, usually with the risk graph in EN ISO 13849-1.

With the hybrid method each hazardous situation gets four numbers. Severity says how bad it can get:

• 1: first aid is enough.
• 2: needs a doctor, but heals completely.
• 3: permanent injury, such as a lost finger or a broken leg.
• 4: death, or a lost arm or lost sight.

The probability class is the sum of three numbers, from 3 to 15:

• Exposure, 1–5: from less than once a year to every hour or more.
• Probability of the hazardous event, 1–5: from negligible to very high.
• Possibility of avoiding the harm, 1, 3 or 5: probable, rarely possible or impossible.

Severity and class together give a risk level: low, medium or high. A crushing hazard with severity 3, exposure 4, probability 3 and avoidance 3 gets class 10 and level medium. An interlocked guard that brings probability down to 1 and avoidance to 1 gives class 6 and level low.

The level says how urgent it is to reduce the risk. It doesn't say a risk is acceptable: you decide that after working through the measures in the right order.

When a risk is reduced by a safety function in the control system, such as an interlocked door, a light curtain or an emergency stop, the function has to be as reliable as the risk demands. EN ISO 13849-1 calls this the performance level, PL, from a to e.

The required performance level, PLr, comes from the standard's risk graph and three questions:

• Severity of injury: slight and normally reversible (S1), or serious and normally irreversible, or death (S2).
• Frequency and duration of exposure: seldom and short (F1), or frequent or long (F2).
• Possibility of avoiding the hazard: possible under specific conditions (P1), or scarcely possible (P2).

S1, F1 and P1 give PLr a. F2 and P2 each raise it one level and S2 two, so S2, F2 and P2 give PLr e. An interlocked door to a robot cell that the operator opens several times an hour often lands on PLr d.

The designer then shows that the function as built reaches at least PLr, with its category, MTTFD and diagnostic coverage, and validates it to EN ISO 13849-2. Fixed guards, signs and training are not safety functions and get no PLr.

Clause 6.1 describes the three-step method, and the order is not optional:

• Inherent design measures (6.2): remove the hazard or reduce the risk in the design, for example with lower force and speed or with gaps wide enough that no one can be crushed.
• Safeguarding and complementary protective measures (6.3): fixed guards, interlocked doors, light curtains and emergency stops where the design is not enough.
• Information for use (6.4): warnings, signs and instructions for use about the risk that remains.

A later step never replaces an earlier one that is practicable. A warning sign is no alternative to a guard that can be built. Every measure can also create new hazards, so the process goes round again.

The documentation describes the machine and its limits, the assumptions made, the hazards and hazardous situations, the basis for the estimation, the protective measures and the standards applied, and the residual risks (clause 7). It is part of the technical file.

State the version, the date and who approved it, and carry the residual risks over into the instructions for use.

Most keep the register in a spreadsheet with one row per hazardous situation: life phase, task, hazard, hazardous situation, estimate before, protective measure and estimate after. Our Excel template has those columns and three filled-in examples.

An integrator who puts together a robot cell or a line of several machines is the manufacturer of the whole. Each machine already has its risk assessment, but the risks at the interfaces are new: where a conveyor hands over to a robot, where the guards meet, and what an emergency stop in one part does to the rest.

Partly completed machinery, such as a robot without its tool and guards, comes with a declaration of incorporation and assembly instructions. The assembly instructions say which risks the integrator has to deal with, and the risk assessment of the whole builds on them.

The risk assessment covers the machine as built. Redo it, in full or for the part affected, when:

• the design changes after the assessment was made, during the project too
• the machine is rebuilt, moved to another use or given new tooling
• an accident, near miss or complaint shows a hazard that was missing
• a standard you applied comes out in a new version.

A change that affects safety and wasn't foreseen by the manufacturer can be a substantial modification. Under the Machinery Regulation, whoever makes it then becomes the manufacturer for what the change affects, with a risk assessment and technical file to match (Article 18).

• The risk assessment is done afterwards, on a finished machine, when the design can no longer change.
• It is copied from the last project without the limits matching this machine.
• Only normal operation is covered, not setting, cleaning, maintenance and fault finding.
• Reasonably foreseeable misuse is missing.
• The protective measures are not linked to the requirements they are meant to meet.
• The residual risks never make it into the instructions for use.