ISO 12100:2010 Safety of machinery — General principles for design — Risk assessment and risk reduction

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights.

ISO 12100 was prepared by Technical Committee ISO/TC 199, Safety of machinery .

This first edition of ISO 12100 cancels and replaces ISO 12100-1:2003, ISO 12100-2:2003 and ISO 14121-1:2007, of which it constitutes a consolidation without technical change. It also incorporates the Amendments ISO 12100-1:2003/Amd.1:2009 and ISO 12100-2:2003/Amd.1:2009. Documentation (e.g. risk assessment, type-C standards) based on these replaced documents need not be updated or revised.

Introduction

The primary purpose of this International Standard is to provide designers with an overall framework and guidance for decisions during the development of machinery to enable them to design machines that are safe for their intended use. It also provides a strategy for standards developers and will assist in the preparation of consistent and appropriate type-B and type-C standards.

The concept of safety of machinery considers the ability of a machine to perform its intended function(s) during its life cycle where risk has been adequately reduced.

This International Standard is the basis for a set of standards which has the following structure:

This International Standard is a type-A standard.

When a type-C standard deviates from one or more technical provisions dealt with by this International Standard or by a type-B standard, the type-C standard takes precedence.

It is desirable that this International Standard be referred to in training courses and manuals to convey basic terminology and general design methods to designers.

ISO/IEC Guide 51 has been taken into account as far as practicable at the time of drafting of this International Standard.

1 Scope

This International Standard specifies basic terminology, principles and a methodology for achieving safety in the design of machinery. It specifies principles of risk assessment and risk reduction to help designers in achieving this objective. These principles are based on knowledge and experience of the design, use, incidents, accidents and risks associated with machinery. Procedures are described for identifying hazards and estimating and evaluating risks during relevant phases of the machine life cycle, and for the elimination of hazards or the provision of sufficient risk reduction. Guidance is given on the documentation and verification of the risk assessment and risk reduction process.

This International Standard is also intended to be used as a basis for the preparation of type-B or type-C safety standards.

It does not deal with risk and/or damage to domestic animals, property or the environment.

NOTE 1

Annex B gives, in separate tables, examples of hazards, hazardous situations and hazardous events, in order to clarify these concepts and assist the designer in the process of hazard identification.

NOTE 2

The practical use of a number of methods for each stage of risk assessment is described in ISO/TR 14121-2.

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• IEC 60204-1:2005 Safety of machinery — Electrical equipment of machines — Part 1: General requirements

3 Terms and definitions

For the purposes of this document, the following terms and definitions apply.

3.1 machinery

3.2 reliability

3.3 maintainability

3.4 usability

3.5 harm

3.6 hazard

3.7 relevant hazard

3.8 significant hazard

3.9 hazardous event

3.10 hazardous situation

3.11 hazard zone

3.12 risk

3.13 residual risk

3.14 risk estimation

3.15 risk analysis

3.16 risk evaluation

3.17 risk assessment

3.18 adequate risk reduction

3.19 protective measure

3.20 inherently safe design measure

3.21 safeguarding

3.22 information for use

3.23 intended use

3.24 reasonably foreseeable misuse

3.25 task

3.26 safeguard

3.27 guard

3.27.1 fixed guard

3.27.2 movable guard

3.27.3 adjustable guard

3.27.4 interlocking guard

3.27.5 interlocking guard with guard locking

3.27.6 interlocking guard with a start function

3.28 protective device

3.28.1 interlocking device

3.28.2 enabling device

3.28.3 hold-to-run control device

3.28.4 two-hand control device

3.28.5 sensitive protective equipment

3.28.6 active optoelectronic protective device

3.28.7 mechanical restraint device

3.28.8 limiting device

3.28.9 limited movement control device

3.29 impeding device

3.30 safety function

3.31 unexpected start-up

3.32 failure to danger

3.33 fault

3.34 failure

3.35 common cause failures

3.36 common mode failures

3.37 malfunction

3.38 emergency situation

3.39 emergency operation

3.40 emergency stop

3.41 emission value

3.42 comparative emission data

4 Strategy for risk assessment and risk reduction

To implement risk assessment and risk reduction the designer shall take the following actions, in the order given (see Figure 1):

1. a) determine the limits of the machinery, which include the intended use and any reasonably foreseeable misuse thereof;
2. b) identify the hazards and associated hazardous situations;
3. c) estimate the risk for each identified hazard and hazardous situation;
4. d) evaluate the risk and take decisions about the need for risk reduction;
5. e) eliminate the hazard or reduce the risk associated with the hazard by means of protective measures.

Actions a) to d) are related to risk assessment and e) to risk reduction.

Risk assessment is a series of logical steps to enable, in a systematic way, the analysis and evaluation of the risks associated with machinery.

Risk assessment is followed, whenever necessary, by risk reduction. Iteration of this process can be necessary to eliminate hazards as far as practicable and to adequately reduce risks by the implementation of protective measures.

It is assumed that, when present on machinery, a hazard will sooner or later lead to harm if no protective measure or measures have been implemented. Examples of hazards are given in Annex B.

Protective measures are the combination of the measures implemented by the designer and the user in accordance with Figure 2. Measures which can be incorporated at the design stage are preferable to those implemented by the user and usually prove more effective.

The objective to be met is the greatest practicable risk reduction, taking into account the four below factors. The strategy defined in this clause is represented by the flowchart in Figure 1. The process itself is iterative and several successive applications can be necessary to reduce the risk, making the best use of available technology. In carrying out this process, it is necessary to take into account these four factors, in the following order of preference:

NOTE 1

The ideal application of these principles requires knowledge of the use of the machine, the accident history and health records, available risk reduction techniques, and the legal framework in which the machine is to be used.

NOTE 2

A machine design which is acceptable at a particular time could be no longer justifiable when technological development allows the design of an equivalent machine with lower risk.

Figure 1

^a The first time the question is asked, it is answered by the result of the initial risk assessment.

Figure 2

^a Providing proper information for use is part of the designer's contribution to risk reduction, but the protective measures concerned are only effective when implemented by the user.

^b The user input is that information received by the designer from either the user community, regarding the intended use of the machine in general, or from a specific user.

^c There is no hierarchy between the various protective measures implemented by the user. These protective measures are outside the scope of this International Standard.

^d These are protective measures required due to a specific process or processes not envisaged in the intended use of the machine or to specific conditions for installation that cannot be controlled by the designer.

5.1 General

Risk assessment comprises (see Figure 1)

Risk analysis provides information required for the risk evaluation, which in turn allows judgments to be made about whether or not risk reduction is required.

These judgments shall be supported by a qualitative or, where appropriate, quantitative estimate of the risk associated with the hazards present on the machinery.

NOTE

A quantitative approach can be appropriate when useful data is available. However, a quantitative approach is restricted by the useful data that are available and/or the limited resources of those conducting the risk assessment. Therefore, in many applications only qualitative risk estimation will be possible.

The risk assessment shall be documented according to Clause 7.

5.2 Information for risk assessment

The information for risk assessment should include the following.

• a) Related to machinery description:
  1. 1) user specifications;
  2. 2) anticipated machinery specifications, including
     1. i) a description of the various phases of the whole life cycle of the machinery,
     2. ii) design drawings or other means of establishing the nature of the machinery, and
     3. iii) required energy sources and how they are supplied;
  3. 3) documentation on previous designs of similar machinery, if relevant;
  4. 4) information for use of the machinery, as available.
• b) Related to regulations, standards and other applicable documents:
  1. 1) applicable regulations;
  2. 2) relevant standards;
  3. 3) relevant technical specifications;
  4. 4) relevant safety data sheets.
• c) Related to experience of use:
  1. 1) any accident, incident or malfunction history of the actual or similar machinery;
  2. 2) the history of damage to health resulting, for example, from emissions (noise, vibration, dust, fumes, etc.), chemicals used or materials processed by the machinery;
  3. 3) the experience of users of similar machines and, whenever practicable, an exchange of information with the potential users.

     NOTE

     An incident that has occurred and resulted in harm can be referred to as an “accident”, whereas an incident that has occurred and that did not result in harm can be referred to as a “near miss” or “dangerous occurrence”.

• d) Relevant ergonomic principles.

The information shall be updated as the design develops or when modifications to the machine are required.

Comparisons between similar hazardous situations associated with different types of machinery are often possible, provided that sufficient information about hazards and accident circumstances in those situations is available.

NOTE

The absence of an accident history, a small number of accidents or low severity of accidents ought not to be taken as a presumption of a low risk.

For quantitative analysis, data from databases, handbooks, laboratories or manufacturers' specifications may be used, provided that there is confidence in the suitability of the data. Uncertainty associated with these data shall be indicated in the documentation (see Clause 7).

5.3.1 General

Risk assessment begins with the determination of the limits of the machinery, taking into account all the phases of the machinery life. This means that the characteristics and performances of the machine or a series of machines in an integrated process, and the related people, environment and products, should be identified in terms of the limits of machinery as given in 5.3.2 to 5.3.5.

5.3.2 Use limits

Use limits include the intended use and the reasonably foreseeable misuse. Aspects to be taken into account include the following:

1. a) the different machine operating modes and different intervention procedures for the users, including interventions required by malfunctions of the machine;
2. b) the use of the machinery (for example, industrial, non-industrial and domestic) by persons identified by sex, age, dominant hand usage, or limiting physical abilities (visual or hearing impairment, size, strength, etc.);
3. c) the anticipated levels of training, experience or ability of users including
   1. 1) operators,
   2. 2) maintenance personnel or technicians,
   3. 3) trainees and apprentices, and
   4. 4) the general public;
4. d) exposure of other persons to the hazards associated with the machinery where it can be reasonably foreseen:
   1. 1) persons likely to have a good awareness of the specific hazards, such as operators of adjacent machinery;
   2. 2) persons with little awareness of the specific hazards but likely to have a good awareness of site safety procedures, authorized routes, etc., such as administration staff;
   3. 3) persons likely to have very little awareness of the machine hazards or the site safety procedures, such as visitors or members of the general public, including children.

If specific information is not available in relation to b), above, the manufacturer should take into account general information on the intended user population (for example, appropriate anthropometric data).

5.3.3 Space limits

Aspects of space limits to be taken into account include

1. a) the range of movement,
2. b) space requirements for persons interacting with the machine, such as during operation and maintenance,
3. c) human interaction such as the operator–machine interface, and
4. d) the machine–power supply interface.

5.3.4 Time limits

Aspects of time limits to be taken into account include

1. a) the life limit of the machinery and/or of some of its components (tooling, parts that can wear, electromechanical components, etc.), taking into account its intended use and reasonably foreseeable misuse, and
2. b) recommended service intervals.

5.3.5 Other limits

Examples of other limits include

1. a) properties of the material(s) to be processed,
2. b) housekeeping — the level of cleanliness required, and
3. c) environmental — the recommended minimum and maximum temperatures, whether the machine can be operated indoors or outdoors, in dry or wet weather, in direct sunlight, tolerance to dust and wet, etc.

5.4 Hazard identification

After determination of the limits of the machinery, the essential step in any risk assessment of the machinery is the systematic identification of reasonably foreseeable hazards (permanent hazards and those which can appear unexpectedly), hazardous situations and/or hazardous events during all phases of the machine life cycle, i.e.:

Only when hazards have been identified can steps be taken to eliminate them or to reduce risks. To accomplish this hazard identification, it is necessary to identify the operations to be performed by the machinery and the tasks to be performed by persons who interact with it, taking into account the different parts, mechanisms or functions of the machine, the materials to be processed, if any, and the environment in which the machine can be used.

The designer shall identify hazards taking into account the following.

1. a) Human interaction during the whole life cycle of the machineTask identification should consider all tasks associated with every phase of the machine life cycle as given above. Task identification should also take into account, but not be limited to, the following task categories:

   — setting;

   — testing;

   — teaching/programming;

   — process/tool changeover;

   — start-up;

   — all modes of operation;

   — feeding the machine;

   — removal of product from machine;

   — stopping the machine;

   — stopping the machine in case of emergency;

   — recovery of operation from jam or blockage;

   — restart after unscheduled stop;

   — fault-finding/trouble-shooting (operator intervention);

   — cleaning and housekeeping;

   — preventive maintenance;

   — corrective maintenance.

   All reasonably foreseeable hazards, hazardous situations or hazardous events associated with the various tasks shall then be identified. Annex B gives examples of hazards, hazardous situations and hazardous events to assist in this process. Several methods are available for the systematic identification of hazards. See also ISO/TR 14121-2.In addition, reasonably foreseeable hazards, hazardous situations or hazardous events not directly related to tasks shall be identified.
   EXAMPLE

   Seismic events, lightning, excessive snow loads, noise, break-up of machinery, hydraulic hose burst.

2. b) Possible states of the machineThese are as follows:
   1. 1) the machine performs the intended function (the machine operates normally);
   2. 2) the machine does not perform the intended function (i.e. it malfunctions) due to a variety of reasons, including

      — variation of a property or of a dimension of the processed material or of the workpiece,

      — failure of one or more of its component parts or services,

      — external disturbances (for example, shocks, vibration, electromagnetic interference),

      — design error or deficiency (for example, software errors),

      — disturbance of its power supply, and

      — surrounding conditions (for example, damaged floor surfaces).

3. c) Unintended behaviour of the operator or reasonably foreseeable misuse of the machineExamples include

   — loss of control of the machine by the operator (especially for hand-held or mobile machines),

   — reflex behaviour of a person in case of malfunction, incident or failure during the use of the machine,

   — behaviour resulting from lack of concentration or carelessness,

   — behaviour resulting from taking the “line of least resistance” in carrying out a task,

   — behaviour resulting from pressures to keep the machine running in all circumstances, and

   — behaviour of certain persons (for example, children, disabled persons).

   NOTE

   Examination of the available design documentation can be a useful means of identifying hazards related to the machinery, particularly those associated with moving elements such as motors or hydraulic cylinders.

5.5.1 General

After hazard identification, risk estimation shall be carried out for each hazardous situation by determining the elements of risk given in 5.5.2. When determining these elements, it is necessary to take into account the aspects given in 5.5.3.

If standardized (or other suitable) measurement methods exist for an emission, they should be used, in conjunction with existing machinery or prototypes, to determine emission values and comparative emission data. This makes it possible for the designer to

Hazards other than emissions that are described by measurable parameters can be dealt with in a similar manner.

5.5.2.1 General

The risk associated with a particular hazardous situation depends on the following elements:

1. a) the severity of harm;
2. b) the probability of occurrence of that harm, which is a function of
   1. 1) the exposure of person(s) to the hazard,
   2. 2) the occurrence of a hazardous event, and
   3. 3) the technical and human possibilities to avoid or limit the harm.

The elements of risk are shown in Figure 3. Additional details are given in 5.5.2.2, 5.5.2.3 and 5.5.3.

Figure 3

5.5.2.2 Severity of harm

The severity can be estimated by taking into account the following:

1. a) the severity of injuries or damage to health, for example,

   — slight,

   — serious,

   — death.

2. b) the extent of harm, for example, to

   — one person,

   — several persons.

When carrying out a risk assessment, the risk from the most likely severity of the harm that is likely to occur from each identified hazard shall be considered, but the highest foreseeable severity shall also be taken into account, even if the probability of such an occurrence is not high.

5.5.2.3.1 Exposure of persons to the hazard

The exposure of a person to the hazard influences the probability of the occurrence of harm. Factors to be taken into account when estimating the exposure are, among others,

1. a) the need for access to the hazard zone (for normal operation, correction of malfunction, maintenance or repair, etc.),
2. b) the nature of access (for example, manual feeding of materials),
3. c) the time spent in the hazard zone,
4. d) the number of persons requiring access, and
5. e) the frequency of access.

5.5.2.3.2 Occurrence of a hazardous event

The occurrence of a hazardous event influences the probability of occurrence of harm. Factors to be taken into account when estimating the occurrence of a hazardous event are, among others,

1. a) reliability and other statistical data,
2. b) accident history,
3. c) history of damage to health, and
4. d) comparison of risks (see 5.6.3).

NOTE

The occurrence of a hazardous event can be of a technical or human origin.

5.5.2.3.3 Possibility of avoiding or limiting harm

The possibility of avoiding or limiting harm influences the probability of occurrence of harm. Factors to be taken into account when estimating the possibility of avoiding or limiting harm are, among others, the following:

1. a) different persons who can be exposed to the hazard(s), for example,

   — skilled,

   — unskilled;

2. b) how quickly the hazardous situation could lead to harm, for example,

   — suddenly,

   — quickly,

   — slowly;

3. c) any awareness of risk, for example,

   — by general information, in particular, information for use,

   — by direct observation,

   — through warning signs and indicating devices, in particular, on the machinery;

4. d) the human ability to avoid or limit harm (for example, reflex, agility, possibility of escape);
5. e) practical experience and knowledge, for example,

   — of the machinery,

   — of similar machinery,

   — no experience.

5.5.3.1 Persons exposed

Risk estimation shall take into account all persons (operators and others) for whom exposure to the hazard is reasonably foreseeable.

5.5.3.2 Type, frequency and duration of exposure

The estimation of the exposure to the hazard under consideration (including long-term damage to health) requires analysis of, and shall account for, all modes of operation of the machinery and methods of working. In particular, the analysis shall account for the needs for access during loading/unloading, setting, teaching, process changeover or correction, cleaning, fault-finding and maintenance.

The risk estimation shall also take into account tasks, for which it is necessary to suspend protective measures.

5.5.3.3 Relationship between exposure and effects

The relationship between an exposure to a hazard and its effects shall be taken into account for each hazardous situation considered. The effects of accumulated exposure and combinations of hazards shall also be considered. When considering these effects, risk estimation shall, as far as practicable, be based on appropriate recognized data.

NOTE 1

Accident data can assist in establishing the probability and severity of injury associated with the use of a particular type of machinery with a particular type of protective measure.

NOTE 2

Zero accident data is, however, no guarantee of the low probability and severity of an injury.

5.5.3.4 Human factors

Human factors can affect risk and shall be taken into account in the risk estimation, including, for example,

1. a) the interaction of person(s) with the machinery, including correction of malfunction,
2. b) interaction between persons,
3. c) stress-related aspects,
4. d) ergonomic aspects,
5. e) the capacity of persons to be aware of risks in a given situation depending on their training, experience and ability,
6. f) fatigue aspects, and
7. g) aspects of limited abilities (due to disability, age, etc.).

Training, experience and ability can affect risk; nevertheless, none of these factors shall be used as a substitute for hazard elimination, risk reduction by inherently safe design measure or safeguarding, wherever these protective measures can be practicably implemented.

5.5.3.5 Suitability of protective measures

Risk estimation shall take into account the suitability of protective measures and shall

1. a) identify the circumstances which can result in harm,
2. b) whenever appropriate, be carried out using quantitative methods to compare alternative protective measures (see ISO/TR 14121-2), and
3. c) provide information that can assist with the selection of appropriate protective measures.

When estimating risk, those components and systems identified as immediately increasing the risk in case of failure need special attention.

When protective measures include work organization, correct behaviour, attention, application of personal protective equipment (PPE), skill or training, the relatively low reliability of such measures compared with proven technical protective measures shall be taken into account in the risk estimation.

5.5.3.6 Possibility of defeating or circumventing protective measures

For the continued safe operation of a machine, it is important that the protective measures allow its easy use and do not hinder its intended use. Otherwise, there is a possibility that protective measures might be bypassed in order for maximum utility of the machine to be achieved.

Risk estimation shall take account of the possibility of defeating or circumventing protective measures. It shall also take account of the incentive to defeat or circumvent protective measures when, for example,

1. a) the protective measure slows down production or interferes with another activity or preference of the user,
2. b) the protective measure is difficult to use,
3. c) persons other than the operator are involved, or
4. d) the protective measure is not recognized by the user or not accepted as being suitable for its function.

Whether or not a protective measure can be defeated depends on both the type of protective measure, such as an adjustable guard or programmable trip device, and its design details.

Protective measures that use programmable electronic systems introduce additional possibilities of defeat or circumvention if access to safety-related software is not appropriately restricted by design and monitoring methods. Risk estimation shall identify where safety-related functions are not separated from other machine functions and shall determine the extent to which access is possible. This is particularly important when remote access for diagnostic or process correction purposes is required.

5.5.3.7 Ability to maintain protective measures

Risk estimation shall consider whether the protective measures can be maintained in the condition necessary to provide the required level of protection.

NOTE

If the protective measure cannot easily be maintained in correct working order, this can encourage the defeat or circumvention of the protective measure in order to allow continued use of the machinery.

5.5.3.8 Information for use

Risk estimation shall take into account the information for use, as available. See also 6.4.

5.6.1 General

After risk estimation has been completed, risk evaluation shall be carried out to determine if risk reduction is required. If risk reduction is required, then appropriate protective measures shall be selected and applied (see Clause 6). As shown in Figure 1, the adequacy of the risk reduction shall be determined after applying each of the three steps of risk reduction described in Clause 6. As part of this iterative process, the designer shall also check whether additional hazards are introduced or other risks increased when new protective measures are applied. If additional hazards do occur, they shall be added to the list of identified hazards and appropriate protective measures will be required to address them.

Achieving the objectives of risk reduction and a favourable outcome of risk comparison applied when practicable gives confidence that risk has been adequately reduced.

5.6.2 Adequate risk reduction

Application of the three-step method described in 6.1 is essential in achieving adequate risk reduction.

Following the application of the three-step method, adequate risk reduction is achieved when

5.6.3 Comparison of risks

As part of the process of risk evaluation, the risks associated with the machinery or parts of machinery can be compared with those of similar machinery or parts of machinery, provided the following criteria apply:

The use of this comparison method does not eliminate the need to follow the risk assessment process as described in this International Standard for the specific conditions of use. For example, when a band saw used for cutting meat is compared with a band saw used for cutting wood, the risks associated with the different material shall be assessed.

6.1 General

The objective of risk reduction can be achieved by the elimination of hazards, or by separately or simultaneously reducing each of the two elements that determine the associated risk:

All protective measures intended for reaching this objective shall be applied in the following sequence, referred to as the three-step method (see also Figures 1 and 2).

Step 1: Inherently safe design measures

Step 2: Safeguarding and/or complementary protective measures

Taking into account the intended use and the reasonably foreseeable misuse, appropriately selected safeguarding and complementary protective measures can be used to reduce risk when it is not practicable to eliminate a hazard, or reduce its associated risk sufficiently, using inherently safe design measures. See 6.3.

Step 3: Information for use

Where risks remain despite inherently safe design measures, safeguarding and the adoption of complementary protective measures, the residual risks shall be identified in the information for use. The information for use shall include, but not be limited to, the following:

Information for use shall not be a substitute for the correct application of inherently safe design measures, safeguarding or complementary protective measures.

NOTE 2

Adequate protective measures associated with each of the operating modes and intervention procedures reduce the possibility of operators being induced to use hazardous intervention techniques in case of technical difficulties.

6.2.1 General

Inherently safe design measures are the first and most important step in the risk reduction process. This is because protective measures inherent to the characteristics of the machine are likely to remain effective, whereas experience has shown that even well-designed safeguarding can fail or be violated and information for use may not be followed.

Inherently safe design measures are achieved by avoiding hazards or reducing risks by a suitable choice of design features for the machine itself and/or interaction between the exposed persons and the machine.

NOTE

See 6.3 for safeguarding and complementary measures that can be used to achieve the risk reduction objectives in the case where inherently safe design measures are not sufficient (see 6.1 for the three-step method).

6.2.2.1 Geometrical factors

Such factors include the following.

1. a) The form of machinery is designed to maximize direct visibility of the working areas and hazard zones from the control position — reducing blind spots, for example — and choosing and locating means of indirect vision where necessary (mirrors, etc.) so as to take into account the characteristics of human vision, particularly when safe operation requires permanent direct control by the operator, for example:

   — the travelling and working area of mobile machines;

   — the zone of movement of lifted loads or of the carrier of machinery for lifting persons;

   — the area of contact of the tool of a hand-held or hand-guided machine with the material being worked.

   The design of the machine shall be such that, from the main control position, the operator is able to ensure that there are no exposed persons in the danger zones.
2. b) The form and the relative location of the mechanical components parts: for instance, crushing and shearing hazards are avoided by increasing the minimum gap between the moving parts, such that the part of the body under consideration can enter the gap safely, or by reducing the gap so that no part of the body can enter it (see ISO 13854 and ISO 13857).
3. c) Avoiding sharp edges and corners, protruding parts: in so far as their purpose allows, accessible parts of the machinery shall have no sharp edges, no sharp angles, no rough surfaces, no protruding parts likely to cause injury, and no openings which can “trap” parts of the body or clothing. In particular, sheet metal edges shall be deburred, flanged or trimmed, and open ends of tubes which can cause a “trap” shall be capped.
4. d) The form of the machine is designed so as to achieve a suitable working position and provide accessible manual controls (actuators).

6.2.2.2 Physical aspects

Such aspects include the following:

1. a) limiting the actuating force to a sufficiently low value so that the actuated part does not generate a mechanical hazard;
2. b) limiting the mass and/or velocity of the movable elements, and hence their kinetic energy;
3. c) limiting the emissions by acting on the characteristics of the source using measures for reducing
   • 1) noise emission at source (see ISO/TR 11688-1),
   • 2) the emission of vibration at source, such as redistribution or addition of mass and changes of process parameters [for example, frequency and/or amplitude of movements (for hand-held and hand-guided machinery, see CR 1030-1)],
   • 3) the emission of hazardous substances, including the use of less hazardous substances or dust-reducing processes (granules instead of powders, milling instead of grinding), and
   • 4) radiation emissions, including, for example, avoiding the use of hazardous radiation sources, limiting the power of radiation to the lowest level sufficient for the proper functioning of the machine, designing the source so that the beam is concentrated on the target, increasing the distance between the source and the operator or providing for remote operation of the machinery [measures for reducing emission of non-ionizing radiation are given in 6.3.4.5 (see also EN 12198-1 and EN 12198-3)].

6.2.3 Taking into account general technical knowledge of machine design

This general technical knowledge can be derived from technical specifications for design (standards, design codes, calculation rules, etc.), which should be used to cover

1. a) mechanical stresses such as

   — stress limitation by implementation of correct calculation, construction and fastening methods as regards, for example, bolted assemblies and welded assemblies,

   — stress limitation by overload prevention (bursting disk, pressure-limiting valves, breakage points, torque-limiting devices, etc.),

   — avoiding fatigue in elements under variable stresses (notably cyclic stresses), and

   — static and dynamic balancing of rotating elements,

2. b) materials and their properties such as

   — resistance to corrosion, ageing, abrasion and wear,

   — hardness, ductility, brittleness,

   — homogeneity,

   — toxicity, and

   — flammability, and

3. c) emission values for

   — noise,

   — vibration,

   — hazardous substances, and

   — radiation.

When the reliability of particular components or assemblies is critical for safety (for example, ropes, chains, lifting accessories for lifting loads or persons), stress limits shall be multiplied by appropriate working coefficients.

6.2.4 Choice of appropriate technology

One or more hazards can be eliminated or risks reduced by the choice of the technology to be used in certain applications such as the following:

1. a) on machines intended for use in explosive atmospheres, using

   — appropriately selected pneumatic or hydraulic control system and machine actuators,

   — intrinsically safe electrical equipment (see IEC 60079-11);

2. b) for particular products to be processed (for example, by a solvent), by using equipment that ensures the temperature will remain far below the flash point;
3. c) the use of alternative equipment to avoid high noise levels, such as

   — electrical instead of pneumatic equipment,

   — in certain conditions, water-cutting instead of mechanical equipment.

6.2.5 Applying principle of positive mechanical action

Positive mechanical action is achieved when a moving mechanical component inevitably moves another component along with it, either by direct contact or via rigid elements. An example of this is positive opening operation of switching devices in an electrical circuit (see IEC 60947-5-1 and ISO 14119).

NOTE

Where a mechanical component moves and thus allows a second component to move freely (for example, by gravity or spring force), there is no positive mechanical action of the first component on the second.

6.2.6 Provisions for stability

Machines shall be designed so that they have sufficient stability to allow them to be used safely in their specified conditions of use. Factors to be taken into account include

Stability shall be considered in all phases of the life cycle of the machine, including handling, travelling, installation, use, dismantling, disabling and scrapping.

Other protective measures for stability relevant to safeguarding are given in 6.3.2.6.

6.2.7 Provisions for maintainability

When designing a machine, the following maintainability factors shall be taken into account to enable maintenance of the machine:

6.2.8 Observing ergonomic principles

Ergonomic principles shall be taken into account in designing machinery so as to reduce the mental or physical stress of, and strain on, the operator. These principles shall be considered when allocating functions to operator and machine (degree of automation) in the basic design.

NOTE

Also improved are the performance and reliability of operation and hence the reduction in the probability of errors at all stages of machine use.

Account shall be taken of body sizes likely to be found in the intended user population, strengths and postures, movement amplitudes, frequency of cyclic actions (see ISO 10075 and ISO 10075-2).

All elements of the operator–machine interface, such as controls, signalling or data display elements, shall be designed to be easily understood so that clear and unambiguous interaction between the operator and the machine is possible. See EN 614-1, EN 13861 and IEC 61310-1.

The designer's attention is particularly drawn to following ergonomic aspects of machine design.

1. a) Avoid the necessity for stressful postures and movements during the use of the machine (for example, providing facilities to adjust the machine to suit the various operators).
2. b) Design machines, especially hand-held and mobile machines, so as to enable them to be operated easily, taking into account human effort, actuation of controls and hand, arm and leg anatomy.
3. c) Limit as far as possible noise, vibration and thermal effects such as extreme temperatures.
4. d) Avoid linking the operator's working rhythm to an automatic succession of cycles.
5. e) Provide local lighting on or in the machine for the illumination of the working area and of adjusting, setting-up and frequent maintenance zones when the design features of the machine and/or its guards render the ambient lighting inadequate. Flicker, dazzling, shadows and stroboscopic effects shall be avoided if they can cause a risk. If the position or the lighting source has to be adjusted, its location shall be such that it does not cause any risk to persons making the adjustment.
6. f) Select, locate and identify manual controls (actuators) so that

   — they are clearly visible and identifiable, and appropriately marked where necessary (see 6.4.4),

   — they can be safely operated without hesitation or loss of time and without ambiguity (for example, a standard layout of controls reduces the possibility of error when an operator changes from a machine to another one of similar type having the same pattern of operation),

   — their location (for push-buttons) and their movement (for levers and hand wheels) are consistent with their effect (see IEC 61310-3), and

   — their operation cannot cause additional risk.

   See also ISO 9355-3.Where a control is designed and constructed to perform several different actions — namely, where there is no one-to-one correspondence (for example, keyboards) — the action to be performed shall be clearly displayed and subject to confirmation where necessary.Controls shall be so arranged that their layout, travel and resistance to operation are compatible with the action to be performed, taking account of ergonomic principles. Constraints due to the necessary or foreseeable use of personal protective equipment (such as footwear, gloves) shall be taken into account.
7. g) Select, design and locate indicators, dials and visual display units so that

   — they fit within the parameters and characteristics of human perception,

   — information displayed can be detected, identified and interpreted conveniently, i.e. long-lasting, distinct, unambiguous and understandable with respect to the operator's requirements and the intended use, and

   — the operator is able to perceive them from the control position.

6.2.9 Electrical hazards

For the design of the electrical equipment of machines, IEC 60204-1 gives general provisions about disconnection and switching of electrical circuits and for protection against electric shock. For requirements related to specific machines, see corresponding IEC standards (for example, IEC 61029, IEC 60745 or IEC 60335).

6.2.10 Pneumatic and hydraulic hazards

Pneumatic and hydraulic equipment of machinery shall be designed so that

NOTE

See also ISO 4413 and ISO 4414.

6.2.11.1 General

The design measures of the control system shall be chosen so that their safety-related performance provides a sufficient amount of risk reduction (see ISO 13849-1 or IEC 62061).

The correct design of machine control systems can avoid unforeseen and potentially hazardous machine behaviour.

Typical causes of hazardous machine behaviour are

Typical examples of hazardous machine behaviour are

In order to prevent hazardous machine behaviour and to achieve safety functions, the design of control systems shall comply with the principles and methods presented in this subclause (6.2.11) and in 6.2.12. These principles and methods shall be applied singly or in combination as appropriate to the circumstances (see ISO 13849-1, IEC 60204-1 and IEC 62061).

Control systems shall be designed to enable the operator to interact with the machine safely and easily. This requires one or several of the following solutions:

An assembly of machines may be divided into several zones for emergency stopping, for stopping as a result of protective devices and/or for isolation and energy dissipation. The different zones shall be clearly defined and it shall be obvious which parts of the machine belong to which zone. Likewise, it shall be obvious which control devices (for example, emergency stop devices, supply disconnecting devices) and/or protective devices belong to which zone. The interfaces between zones shall be designed such that no function in one zone creates hazards in another zone which has been stopped for an intervention.

Control systems shall be designed to limit the movements of parts of the machinery, the machine itself, or workpieces and/or loads held by the machinery, to the safe design parameters (for example, range, speed, acceleration, deceleration, load capacity). Allowance shall be made for dynamic effects (swinging of loads, etc.).

For example:

When the machinery contains various elements that can be operated independently, the control system shall be designed to prevent risks arising out of a lack of coordination (for example, collision prevention system).

6.2.11.2 Starting of an internal power source/switching on an external power supply

The starting of an internal power source or switching-on of an external power supply shall not result in a hazardous situation.

For example:

See IEC 60204-1:2005 (see also Annexes A and B).

6.2.11.3 Starting/stopping of a mechanism

The primary action for starting or accelerating the movement of a mechanism should be performed by the application or an increase of voltage or fluid pressure, or — if binary logic elements are considered — by passage from state 0 to state 1 (where state 1 represents the highest energy state).

The primary action for stopping or slowing down should be performed by removal or reduction of voltage or fluid pressure, or — if binary logic elements are considered — by passage from state 1 to state 0 (where state 1 represents the highest energy state).

In certain applications, such as high-voltage switchgear, this principle cannot be followed, in which case other measures should be applied to achieve the same level of confidence for the stopping or slowing down.

When, in order for the operator to maintain permanent control of deceleration, this principle is not observed (for example, a hydraulic braking device of a self-propelled mobile machine), the machine shall be equipped with a means of slowing and stopping in case of failure of the main braking system.

6.2.11.4 Restart after power interruption

If a hazard could be generated, the spontaneous restart of a machine when it is re-energized after power interruption shall be prevented (for example, by use of a self-maintained relay, contactor or valve).

6.2.11.5 Interruption of power supply

Machinery shall be designed to prevent hazardous situations resulting from interruption or excessive fluctuation of the power supply. At least the following requirements shall be met:

6.2.11.6 Use of automatic monitoring

Automatic monitoring is intended to ensure that a safety function or functions implemented by a protective measure do not fail to be performed if the ability of a component or an element to perform its function is diminished, or if the process conditions are changed such that hazards are generated.

Automatic monitoring either detects a fault immediately or carries out periodic checks so that a fault is detected before the next demand upon the safety function. In either case, the protective measure can be initiated immediately or delayed until a specific event occurs (for example, the beginning of the machine cycle).

The protective measure may be, for example,

6.2.11.7.1 General

A control system that includes programmable electronic equipment (for example, programmable controllers) can, where appropriate, be used to implement safety functions at machinery. Where a programmable electronic control system is used, it is necessary to consider its performance requirements in relation to the requirements for the safety functions. The design of the programmable electronic control system shall be such that the probability of random hardware failures and the likelihood of systematic failures that can adversely affect the performance of the safety-related control function(s) is sufficiently low. Where a programmable electronic control system performs a monitoring function, the system behaviour on detection of a fault shall be considered (see also the IEC 61508 series for further guidance).

NOTE

Both ISO 13849-1 and IEC 62061, specific to machinery safety, provide guidance applicable to programmable electronic control systems.

The programmable electronic control system should be installed and validated to ensure that the specified performance [for example, safety integrity level (SIL) in IEC 61508] for each safety function has been achieved. Validation comprises testing and analysis (for example, static, dynamic or failure analysis) to show that all parts interact correctly to perform the safety function and that unintended functions do not occur.

6.2.11.7.2 Hardware aspects

The hardware (including, for example, sensors, actuators and logic solvers) shall be selected, and/or designed and installed, to meet both the functional and performance requirements of the safety function(s) to be performed, in particular, by means of

6.2.11.7.3 Software aspects

The software, including internal operating software (or system software) and application software, shall be designed so as to satisfy the performance specification for the safety functions (see also IEC 61508-3).

Application software should not be reprogrammable by the user. This may be achieved by use of embedded software in a non-reprogrammable memory [for example, micro-controller, application-specific integrated circuit (ASIC)].

When the application requires reprogramming by the user, the access to the software dealing with safety functions should be restricted (for example, by locks or passwords for the authorized persons).

6.2.11.8 Principles relating to manual control

These are as follows.

1. a) Manual control devices shall be designed and located according to the relevant ergonomic principles given in 6.2.8, item f).
2. b) A stop control device shall be placed near each start control device. Where the start/stop function is performed by means of a hold-to-run control, a separate stop control device shall be provided when a risk can result from the hold-to-run control device failing to deliver a stop command when released.
3. c) Manual controls shall be located out of reach of the danger zones (see IEC 61310-3), except for certain controls where, of necessity, they are located within a danger zone, such as emergency stop or teach pendant.
4. d) Whenever possible, control devices and control positions shall be located so that the operator is able to observe the working area or hazard zone.
   1. 1) The driver of a ride-on mobile machine shall be able to actuate all control devices required to operate the machine from the driving position, except for functions which can be controlled more safely from other positions.
   2. 2) On machinery intended for lifting persons, controls for lifting and lowering and, if appropriate, for moving the carrier shall generally be located in the carrier. If safe operation requires controls to be situated outside the carrier, the operator in the carrier shall be provided with the means of preventing hazardous movements.
5. e) If it is possible to start the same hazardous element by means of several controls, the control circuit shall be so arranged that only one control is effective at a given time. This applies especially to machines which can be manually controlled by means of, among others, a portable control unit (such as a teach pendant), with which the operator can enter danger zones.
6. f) Control actuators shall be designed or guarded so that their effect, where a risk is involved, cannot occur without intentional operation (see ISO 9355-1, ISO 9355-3 and ISO 447).
7. g) For machine functions whose safe operation depends on permanent, direct control by the operator, measures shall be implemented to ensure the presence of the operator at the control position (for example, by the design and location of control devices).
8. h) For cableless control, an automatic stop shall be performed when correct control signals are not received, including loss of communication (see IEC 60204-1).

6.2.11.9 Control mode for setting, teaching, process changeover, fault-finding, cleaning or maintenance

Where, for setting, teaching, process changeover, fault-finding, cleaning or maintenance of machinery, a guard has to be displaced or removed and/or a protective device has to be disabled, and where it is necessary for the purpose of these operations for the machinery or part of the machinery to be put into operation, the safety of the operator shall be achieved using a specific control mode which simultaneously

1. a) disables all other control modes,
2. b) permits operation of the hazardous elements only by continuous actuation of an enabling device, a two-hand control device or a hold-to-run control device,
3. c) permits operation of the hazardous elements only in reduced risk conditions (for example, reduced speed, reduced power/force, step-by-step, for example, with a limited movement control device), and
4. d) prevents any operation of hazardous functions by voluntary or involuntary action on the machine's sensors.

NOTE

For some special machinery other protective measures can be appropriate.

This control mode shall be associated with one or more of the following measures:

See IEC 60204-1.

6.2.11.10 Selection of control and operating modes

If machinery has been designed and built to allow for its use in several control or operating modes requiring different protective measures and/or work procedures (for example, to allow for adjustment, setting, maintenance, inspection), it shall be fitted with a mode selector which can be locked in each position. Each position of the selector shall be clearly identifiable and shall exclusively allow one control or operating mode.

The selector may be replaced by another selection means which restricts the use of certain functions of the machinery to certain categories of operators (for example, access codes for certain numerically controlled functions).

6.2.11.11 Applying measures to achieve electromagnetic compatibility (EMC)

For guidance on electromagnetic compatibility, see IEC 60204-1 and IEC 61000-6.

6.2.11.12 Provision of diagnostic systems to aid fault-finding

Diagnostic systems to aid fault-finding should be included in the control system so that there is no need to disable any protective measure.

NOTE

Such systems not only improve availability and maintainability of machinery, they also reduce the exposure of maintenance staff to hazards.

6.2.12.1 General

Safety of machinery is not only dependent on the reliability of the control systems but also on the reliability of all parts of the machine.

The continued operation of the safety functions is essential for the safe use of the machine. This can be achieved by the measures given in 6.2.12.2 to 6.2.12.4.

6.2.12.2 Use of reliable components

“Reliable components” means components which are capable of withstanding all disturbances and stresses associated with the usage of the equipment in the conditions of intended use (including the environmental conditions), for the period of time or the number of operations fixed for the use, with a low probability of failures generating a hazardous malfunctioning of the machine. Components shall be selected taking into account all factors mentioned above (see also 6.2.13).

NOTE 1

“Reliable components” is not a synonym for “well-tried components” (see ISO 13849-1:2006).

NOTE 2

Environmental conditions for consideration include impact, vibration, cold, heat, moisture, dust, corrosive and/or abrasive substances, static electricity and magnetic and electric fields. Disturbances which can be generated by those conditions include insulation failures and temporary or permanent failures in the function of control system components.

6.2.12.3 Use of “oriented failure mode” components

“Oriented failure mode” components or systems are those in which the predominant failure mode is known in advance and which can be used so that the effect of such a failure on the machine function can be predicted.

NOTE

In some cases, it will be necessary to take additional measures to limit the negative effects of such a failure.

The use of such components should always be considered, particularly in cases where redundancy (see 6.2.12.4) is not employed.

6.2.12.4 Duplication (or redundancy) of components or subsystems

In the design of safety-related parts of the machine, duplication (or redundancy) of components may be used so that, if one component fails, another component or components continue to perform the respective function(s), thereby ensuring that the safety function remains available.

In order to allow the proper action to be initiated, component failure shall be detected by automatic monitoring (see 6.2.11.6) or in some circumstances by regular inspection, provided that the inspection interval is shorter than the expected lifetime of the components.

Diversity of design and/or technology can be used to avoid common cause failures (for example, from electromagnetic disturbance) or common mode failures.

6.2.13 Limiting exposure to hazards through reliability of equipment

Increased reliability of all component parts of machinery reduces the frequency of incidents requiring intervention, thereby reducing exposure to hazards.

This applies to power systems (operative part, see Annex A) as well as to control systems, and to safety functions as well as to other functions of machinery.

Safety-related components (for example, certain sensors) of known reliability shall be used.

The elements of guards and of protective devices shall be especially reliable, as their failure can expose persons to hazards, and also because poor reliability would encourage attempts to defeat them.

6.2.14 Limiting exposure to hazards through mechanization or automation of loading (feeding)/ unloading (removal) operations

Mechanization and automation of machine loading/unloading operations and, more generally, of handling operations — of workpieces, materials or substances — limits the risk generated by these operations by reducing the exposure of persons to hazards at the operating points.

Automation can be achieved by, for example, robots, handling devices, transfer mechanisms and air-blast equipment. Mechanization can be achieved by, for example, feeding slides, push-rods and hand-operated indexing tables.

While automatic feeding and removal devices have much to offer in preventing accidents to machine operators, they can create danger when any faults are being corrected. Care shall be taken to ensure that the use of these devices does not introduce further hazards, such as trapping or crushing, between the devices and parts of the machine or workpieces/materials being processed. Suitable safeguards (see 6.3) shall be provided if this cannot be ensured.

Automatic feeding and removal devices with their own control systems and the control system of the associated machine shall be interconnected after thorough study of how all safety functions are performed in all the control and operation modes of the entire equipment.

6.2.15 Limiting exposure to hazards through location of setting and maintenance points outside danger zones

The need for access to danger zones shall be minimized by locating maintenance, lubrication and setting points outside these zones.

6.3.1 General

Guards and protective devices shall be used to protect persons whenever an inherently safe design measure does not reasonably make it possible either to remove hazards or to sufficiently reduce risks. Complementary protective measures involving additional equipment (for example, emergency stop equipment) may have to be implemented.

NOTE

The different kinds of guards and protective devices are defined in 3.27 and 3.28.

Certain safeguards may be used to avoid exposure to more than one hazard.

6.3.2.1 General

This subclause gives guidelines for the selection and the implementation of guards and protective devices the primary purpose of which is to protect persons against hazards generated by moving parts, according to the nature of those parts (see Figure 4) and to the need for access to the danger zone(s).

The exact choice of a safeguard for a particular machine shall be made on the basis of the risk assessment for that machine.

In selecting an appropriate safeguard for a particular type of machinery or hazard zone, it shall be borne in mind that a fixed guard is simple and shall be used where the access of an operator into a danger zone is not required during the normal operation (operation without malfunction) of the machinery.

As the need for frequency of access increases, this inevitably leads to the fixed guard not being replaced. This requires the use of an alternative protective measure (movable interlocking guard, sensitive protective equipment).

A combination of safeguards can sometimes be required. For example, where, in conjunction with a fixed guard, a mechanical loading (feeding) device is used to feed a workpiece into a machine, thereby removing the need for access to the primary hazard zone, a trip device can be required to protect against the secondary drawing-in or shearing hazard between the mechanical loading (feeding) device, when reachable, and the fixed guard.

Consideration shall be given to the enclosure of control positions or intervention zones to provide combined protection against several hazards including

1. a) hazards from falling or ejected objects, using, for example, protection in the form of a falling object protection structure (FOPS),
2. b) emission hazards (protection against noise, vibration, radiation, substances hazardous to health, etc.),
3. c) hazards due to the environment (protection against heat, cold, foul weather, etc.),
4. d) hazards due to tipping over or rolling over of machinery, using, for example, protection in the form of roll-over or tip-over protection structures (ROPS and TOPS).

The design of enclosed work stations, such as cabs and cabins, shall take into account ergonomic principles concerning visibility, lighting, atmospheric conditions, access, posture.

Figure 4

6.3.2.2 Where access to the hazard zone is not required during normal operation

Where access to the hazard zone is not required during normal operation of the machinery, safeguards should be selected from the following:

1. a) fixed guards (see also ISO 14120);
2. b) interlocking guards with or without guard locking (see also 6.3.3.2.3, ISO 14119 and ISO 14120);
3. c) self-closing guards (see ISO 14120:2002);
4. d) sensitive protective equipment, such as electrosensitive protective equipment (see IEC 61496) or pressure-sensitive protective devices (see ISO 13856).

6.3.2.3 Where access to the hazard zone is required during normal operation

Where access to the hazard zone is required during normal operation of the machinery, safeguards should be selected from the following:

1. a) interlocking guards with or without guard locking (see also ISO 14119, ISO 14120 and 6.3.3.2.3 of this document);
2. b) sensitive protective equipment, such as electrosensitive protective equipment (see IEC 61496);
3. c) adjustable guards;
4. d) self-closing guards (see ISO 14120:2002);
5. e) two-hand control devices (see ISO 13851);
6. f) interlocking guards with a start function (control guard) (see 6.3.3.2.5).

6.3.2.4 Where access to the hazard zone is required for machine setting, teaching, process changeover, fault-finding, cleaning or maintenance

As far as possible, machines shall be designed so that the safeguards provided for the protection of the production operator also ensure the protection of personnel carrying out setting, teaching, process changeover, fault-finding, cleaning or maintenance, without hindering them in the performance of their task. Such tasks shall be identified and considered in the risk assessment as parts of the use of the machine (see 5.2).

NOTE

Isolation and energy dissipation for machine shut-down (see 6.3.5.4, and also ISO 14118:2000) ensure the highest level of safety when carrying out tasks (especially maintenance and repair tasks) that do not require the machine to remain connected to its power supply.

6.3.2.5.1 Selection

Due to the great diversity of the technologies on which their detection function is based, all types of sensitive protective equipment are far from being equally suitable for safety applications. The following provisions are intended to provide the designer with criteria for selecting, for each application, the most suitable device(s).

Types of sensitive protective equipment include

Sensitive protective equipment can be used

NOTE

Some types of sensitive protective equipment can be unsuitable either for presence sensing or for tripping purposes.

The following characteristics of the machinery, among others, can preclude the sole use of sensitive protective equipment:

6.3.2.5.2 Implementation

Consideration should be given to

1. a) the size, characteristics and positioning of the detection zone (see ISO 13855, which deals with the positioning of some types of sensitive protective equipment),
2. b) the reaction of the device to fault conditions (see IEC 61496 for electrosensitive protective equipment),
3. c) the possibility of circumvention, and
4. d) detection capability and its variation over the course of time (as a result, for example, of its susceptibility to different environmental conditions such as the presence of reflecting surfaces, other artificial light sources and sunlight or impurities in the air).

NOTE 1

IEC 61496 defines the detection capability of electrosensitive protective equipment.

Sensitive protective equipment shall be integrated in the operative part and associated with the control system of the machine so that

NOTE 2

Muting is the temporary automatic suspension of a safety function(s) by safety-related parts of the control system (see ISO 13849-1).

For detailed consideration of the fault behaviour of, for example, active optoelectronic protective devices, IEC 61496 should be taken into account.

6.3.2.5.3 Additional requirements for sensitive protective equipment when used for cycle initiation

In this exceptional application, the starting of the machine cycle is initiated by the withdrawal of a person or of the detected part of a person from the sensing field of the sensitive protective equipment, without any additional start command, hence deviating from the general requirement given in the second point of the dashed list in 6.3.2.5.2, above. After switching on the power supply, or when the machine has been stopped by the tripping function of the sensitive protective equipment, the machine cycle shall be initiated only by voluntary actuation of a start control.

Cycle initiation by sensitive protective equipment shall be subject to the following conditions:

1. a) only active optoelectronic protective devices (AOPDs) complying with IEC 61496 series shall be used;
2. b) the requirements for an AOPD used as a tripping and presence-sensing device (see IEC 61496) are satisfied — in particular, location, minimum distance (see ISO 13855), detection capability, reliability and monitoring of control and braking systems;
3. c) the cycle time of the machine is short and the facility to re-initiate the machine upon clearing of the sensing field is limited to a period commensurate with a single normal cycle;
4. d) entering the sensing field of the AOPD(s) or opening interlocking guards is the only way to enter the hazard zone;
5. e) if there is more than one AOPD safeguarding the machine, only one of the AOPDs is capable of cycle re-initiation;
6. f) with regard to the higher risk resulting from automatic cycle initiation, the AOPD and the associated control system comply with a higher safety-related performance than under normal conditions.

NOTE 1

The hazard zone as referred to in d) is any zone where the hazardous function (including ancillary equipment and transmission elements) is initiated by clearing of the sensing field.

NOTE 2

See also IEC/TS 62046.

6.3.2.6 Protective measures for stability

If stability cannot be achieved by inherently safe design measures such as weight distribution (see 6.2.6), it shall be maintained by the use of protective measures such as

6.3.2.7 Other protective devices

When a machine requires continuous control by the operator (for example, mobile machines, cranes) and an error of the operator can generate a hazardous situation, this machine shall be equipped with the necessary devices to enable the operation to remain within specified limits, in particular

The necessary devices include

1. a) devices for limiting parameters of movement (distance, angle, velocity, acceleration),
2. b) overloading and moment limiting devices,
3. c) devices to prevent collisions or interference with other machines,
4. d) devices for preventing hazards to pedestrian operators of mobile machinery or other pedestrians,
5. e) torque limiting devices, and breakage points to prevent excessive stress of components and assemblies,
6. f) devices for limiting pressure or temperature,
7. g) devices for monitoring emissions,
8. h) devices to prevent operation in the absence of the operator at the control position,
9. i) devices to prevent lifting operations unless stabilizers are in place,
10. j) devices to limit inclination of the machine on a slope, and
11. k) devices to ensure that components are in a safe position before travelling.

Automatic protective measures triggered by such devices that take operation of the machinery out of the control of the operator (for example, automatic stop of hazardous movement) should be preceded or accompanied by a warning signal to enable the operator to take appropriate action (see 6.4.3).

6.3.3.1 General requirements

Guards and protective devices shall be designed to be suitable for the intended use, taking into account mechanical and other hazards involved. Guards and protective devices shall be compatible with the working environment of the machine and designed so that they cannot be easily defeated. They shall provide the minimum possible interference with activities during operation and other phases of machine life, in order to reduce any incentive to defeat them.

NOTE

For additional information, see ISO 14120, ISO 13849-1, ISO 13851, ISO 14119, ISO 13856, IEC 61496 and IEC 62061.

Guards and protective devices shall

1. a) be of robust construction,
2. b) not give rise to any additional hazard,
3. c) not be easy to bypass or render non-operational,
4. d) be located at an adequate distance from the danger zone (see ISO 13855 and ISO 13857),
5. e) cause minimum obstruction to the view of the production process, and
6. f) enable essential work to be carried out for the installation and/or replacement of tools and for maintenance by allowing access only to the area where the work has to be carried out — if possible, without the guard having to be removed or protective device having to be disabled.

For openings in the guards, see ISO 13857.

6.3.3.2.1 Functions of guards

The functions that guards can achieve are

Additionally, they could need to have particular properties relating to electricity, temperature, fire, explosion, vibration, visibility (see ISO 14120) and operator position ergonomics (for example, usability, operator's movements, postures, repetitive movements).

6.3.3.2.2 Requirements for fixed guards

Fixed guards shall be securely held in place either

NOTE

A fixed guard can be hinged to assist in its opening.

6.3.3.2.3 Requirements for movable guards

Movable guards which provide protection against hazards generated by moving transmission parts shall

1. a) as far as possible when open remain fixed to the machinery or other structure (generally by means of hinges or guides), and
2. b) be interlocking (with guard locking when necessary) (see ISO 14119).

See Figure 4.

Movable guards against hazards generated by non-transmission moving parts shall be designed and associated with the machine control system so that

See Figure 4 and ISO 14119.

6.3.3.2.4 Requirements for adjustable guards

Adjustable guards may only be used where the hazard zone cannot for operational reasons be completely enclosed.

Manually adjustable guards shall be

6.3.3.2.5 Requirements for interlocking guards with a start function (control guards)

An interlocking guard with a start function may only be used provided that

1. a) all requirements for interlocking guards are satisfied (see ISO 14119),
2. b) the cycle time of the machine is short,
3. c) the maximum opening time of the guard is preset to a low value (for example, equal to the cycle time) and, when this time is exceeded, the hazardous function(s) cannot be initiated by the closing of the interlocking guard with a start function and resetting is necessary before restarting the machine,
4. d) the dimensions or shape of the machine do not allow a person, or part of a person, to stay in the hazard zone or between the hazard zone and the guard while the guard is closed (see ISO 14120),
5. e) all other guards, whether fixed (removable type) or movable, are interlocking guards,
6. f) the interlocking device associated with the interlocking guard with a start function is designed such that — for example, by duplication of position detectors and use of automatic monitoring (see 6.2.11.6) — its failure cannot lead to an unintended/unexpected start-up, and
7. g) the guard is securely held open (for example, by a spring or counterweight) such that it cannot initiate a start while falling by its own weight.

6.3.3.2.6 Hazards from guards

Care shall be taken to prevent hazards which could be generated by

6.3.3.3 Technical characteristics of protective devices

Protective devices shall be selected or designed and connected to the control system such that correct implementation of their safety function(s) is ensured.

Protective devices shall be selected on the basis of their having met the appropriate product standard (for example, IEC 61496 for active optoelectronic protective devices) or shall be designed according to one or several of the principles formulated in ISO 13849-1 or IEC 62061.

Protective devices shall be installed and connected to the control system so that they cannot be easily defeated.

6.3.3.4 Provisions for alternative types of safeguards

Provisions should be made to facilitate the fitting of alternative types of safeguards on machinery where it is known that it will be necessary to change the safeguards because of the range of work to be carried out.

6.3.4.1 General

If the measures for the reduction of emissions at source specified in 6.2.2.2 are not adequate, the machine shall be provided with additional protective measures (see 6.3.4.2 to 6.3.4.5).

6.3.4.2 Noise

Additional protective measures against noise include

6.3.4.3 Vibration

Additional protective measures against vibration include

For measures for vibration isolation of stationary industrial machinery see EN 1299.

6.3.4.4 Hazardous substances

Additional protective measures against hazardous substances include

See ISO 14123-1.

6.3.4.5 Radiation

Additional protective measures against radiation include

6.3.5.1 General

Protective measures which are neither inherently safe design measures, nor safeguarding (implementation of guards and/or protective devices), nor information for use, could have to be implemented as required by the intended use and the reasonably foreseeable misuse of the machine. Such measures include, but are not limited to, those dealt with in 6.3.5.2 to 6.3.5.6.

6.3.5.2 Components and elements to achieve emergency stop function

If, following a risk assessment, a machine needs to be fitted with components and elements to achieve an emergency stop function for enabling actual or impending emergency situations to be averted, the following requirements apply:

NOTE

For more detailed provisions, see ISO 13850.

Once active operation of the emergency stop device has ceased following an emergency stop command, the effect of this command shall be sustained until it is reset. This reset shall be possible only at the location where the emergency stop command has been initiated. The reset of the device shall not restart the machinery, but shall only permit restarting.

More details for the design and selection of electrical components and elements to achieve the emergency stop function are provided in IEC 60204.

6.3.5.3 Measures for the escape and rescue of trapped persons

Measures for the escape and rescue of trapped persons may consist, among others, of

6.3.5.4 Measures for isolation and energy dissipation

Machines shall be equipped with the technical means to achieve isolation from power supply(ies) and dissipation of stored energy by means of the following actions:

1. a) isolating (disconnecting, separating) the machine (or defined parts of the machine) from all power supplies;
2. b) locking (or otherwise securing) all the isolating units in the isolating position;
3. c) dissipating or, if this is not possible or practicable, restraining (containing) any stored energy which can give rise to a hazard;
4. d) verifying, by means of safe working procedures, that the actions taken according to a), b) and c) above have produced the desired effect.

See ISO 14118:2000, and IEC 60204-1:2005.

6.3.5.5 Provisions for easy and safe handling of machines and their heavy component parts

Machines and their component parts which cannot be moved or transported by hand shall be provided or be capable of being provided with suitable attachment devices for transport by means of lifting gear.

These attachments may be, among others,

Parts of machinery which can be removed manually in operation shall be provided with means for their safe removal and replacement.

See also 6.4.4 c), item 3).

6.3.5.6 Measures for safe access to machinery

Machinery shall be so designed as to enable operation and all routine tasks relating to setting and/or maintenance to be carried out as far as possible by a person remaining at ground level.

Where this is not possible, machines shall have built-in platforms, stairs or other facilities to provide safe access for those tasks; however, care should be taken to ensure that such platforms or stairs do not give access to danger zones of machinery.

The walking areas shall be made from materials which remain as slip resistant as practicable under working conditions and, depending on the height from the ground, shall be provided with suitable guard-rails (see ISO 14122-3).

In large automated installations, particular attention shall be given to safe means of access, such as walkways, conveyor bridges or crossover points.

Means of access to parts of machinery located at height shall be provided with collective means of protection against falls (for example, guard-rails for stairways, stepladders and platforms and/or safety cages for ladders). As necessary, anchorage points for personal protective equipment against falls from height shall also be provided (for example, in carriers of machinery for lifting persons or with elevating control stations).

Openings shall, whenever possible, open towards a safe position. They shall be designed to prevent hazards due to unintended opening.

The necessary aids for access shall be provided (steps, handholds, etc.). Control devices shall be designed and located to prevent their being used as aids for access.

When machinery for lifting goods and/or persons includes landings at fixed levels, these shall be equipped with interlocking guards for preventing falls when the platform is not present at a level. Movement of the lifting platform shall be prevented while the guards are open.

For detailed provisions see ISO 14122.

6.4.1.1

Drafting information for use is an integral part of the design of a machine (see Figure 2). Information for use consists of communication links, such as texts, words, signs, signals, symbols or diagrams, used separately or in combination to convey information to the user. Information for use is intended for professional and/or non-professional users.

NOTE

See also IEC 62079 for structuring and presentation of information for use.

6.4.1.2

Information shall be provided to the user about the intended use of the machine, taking into account, notably, all its operating modes.

The information shall contain all directions required to ensure safe and correct use of the machine. With this in view, it shall inform and warn the user about residual risk.

The information shall indicate, as appropriate,

It shall not exclude uses of the machine that can reasonably be expected from its designation and description and shall also warn about the risk which would result from using the machine in other ways than the ones described in the information, especially considering its reasonably foreseeable misuse.

6.4.1.3

Information for use shall cover, separately or in combination, transport, assembly and installation, commissioning, use of the machine (setting, teaching/programming or process changeover, operation, cleaning, fault-finding and maintenance) and, if necessary, dismantling, disabling and scrapping.

6.4.2 Location and nature of information for use

Depending on the risk, the time when the information is needed by the user and the machine design, it shall be decided whether the information — or parts thereof — are to be given

1. a) in/on the machine itself (see 6.4.3 and 6.4.4),
2. b) in accompanying documents (in particular instruction handbook, see 6.4.5),
3. c) on the packaging,
4. d) by other means such as signals and warnings outside the machine.

Standardized phrases shall be considered where important messages such as warnings are given (see also IEC 62079).

6.4.3 Signals and warning devices

Visual signals, such as flashing lights and audible signals such as sirens may be used to warn of an impending hazardous event such as machine start-up or overspeed. Such signals may also be used to warn the operator before the triggering of automatic protective measures (see 6.3.2.7).

It is essential that these signals

1. a) be emitted before the occurrence of the hazardous event,
2. b) be unambiguous,
3. c) be clearly perceived and differentiated from all other signals used, and
4. d) be clearly recognized by the operator and other persons.

The warning devices shall be designed and located such that checking is easy. The information for use shall prescribe regular checking of warning devices.

The attention of designers is drawn to the possibility of “sensorial saturation”, which can result from too many visual and/or acoustic signals and which can also lead to defeating the warning devices.

NOTE

Consultation of the user on this subject is often necessary.

6.4.4 Markings, signs (pictograms) and written warnings

Machinery shall bear all markings which are necessary

1. a) for its unambiguous identification, including at least
   1. 1) the name and address of the manufacturer,
   2. 2) the designation of series or type, and
   3. 3) the serial number, if any,
2. b) in order to indicate its compliance with mandatory requirements, comprising
   1. 1) marking, and
   2. 2) written indications, such as the authorized representative of the manufacturer, designation of the machinery, year of construction, and intended use in potentially explosive atmospheres),
3. c) for its safe use, for example,
   1. 1) maximum speed of rotating parts,
   2. 2) maximum diameter of tools,
   3. 3) mass (in kilograms) of the machine itself and/or of removable parts,
   4. 4) maximum working load,
   5. 5) necessity of wearing personal protective equipment,
   6. 6) guard adjustment data, and
   7. 7) frequency of inspection.

Information printed directly on the machine should be permanent and remain legible throughout the expected life of the machine.

Signs or written warnings indicating only “Danger” shall not be used.

Markings, signs and written warnings shall be readily understandable and unambiguous, especially as regards the part of the function(s) of the machine to which they are related. Readily understandable signs (pictograms) should be used in preference to written warnings.

Signs and pictograms should only be used if they are understood in the culture in which the machinery is to be used.

Written warnings shall be drawn up in the language(s) of the country in which the machine will be used for the first time and, on request, in the language(s) understood by operators.

NOTE

In some countries the use of specific language(s) is covered by legal requirements.

Markings shall comply with recognized standards (for example, ISO 2972 or ISO 7000, for pictograms, symbols and colours in particular).

See IEC 60204-1 as regards marking of electrical equipment.

See ISO 4413 and ISO 4414 for hydraulic and pneumatic equipment.

6.4.5.1 Contents

The instruction handbook or other written instructions (for example, on the packaging) shall contain, among others, the following:

1. a) information relating to transport, handling and storage of the machine, such as
   1. 1) storage conditions for the machine,
   2. 2) dimensions, mass value(s), position of the centre(s) of gravity, and
   3. 3) indications for handling (for example, drawings indicating application points for lifting equipment);
2. b) information relating to installation and commissioning of the machine, such as
   1. 1) fixing/anchoring and dampening of noise and vibration requirements,
   2. 2) assembly and mounting conditions,
   3. 3) space needed for use and maintenance,
   4. 4) permissible environmental conditions (for example, temperature, moisture, vibration, electromagnetic radiation),
   5. 5) instructions for connecting the machine to power supply (particularly on protection against electrical overloading),
   6. 6) advice on waste removal/disposal, and
   7. 7) if necessary, recommendations related to protective measures which have to be implemented by the user — for example, additional safeguards (see Figure 2, Footnote d), safety distances, safety signs and signals;
3. c) information relating to the machine itself, such as
   1. 1) detailed description of the machine, its fittings, guards and/or protective devices,
   2. 2) the comprehensive range of applications for which the machine is intended, including prohibited usages, if any, taking into account variations of the original machine if appropriate,
   3. 3) diagrams (especially schematic representation of safety functions),
   4. 4) data on noise and vibration generated by the machine, and on radiation, gases, vapours and dust emitted by it, with reference to the measuring methods (including measurement uncertainties) used,
   5. 5) technical documentation of electrical equipment (see IEC 60204), and
   6. 6) documents attesting that the machine complies with mandatory requirements;
4. d) information relating to the use of the machine, such as that related to or describing
   1. 1) intended use,
   2. 2) manual controls (actuators),
   3. 3) setting and adjustment,
   4. 4) modes and means for stopping (especially emergency stop),
   5. 5) risks which could not be eliminated by the protective measures implemented by the designer,
   6. 6) particular risks which can be generated by certain applications, by the use of certain fittings, and about specific safeguards necessary for such applications,
   7. 7) reasonably foreseeable misuse and prohibited applications,
   8. 8) fault identification and location, for repair and for restarting after an intervention, and
   9. 9) personal protective equipment needed to be used and the training that is required;
5. e) information for maintenance, such as
   1. 1) the nature and frequency of inspections for safety functions,
   2. 2) specification of the spare parts to be used when these can affect the health and safety of operators,
   3. 3) instructions relating to maintenance operations which require a definite technical knowledge or particular skills and hence need to be carried out exclusively by skilled persons (for example, maintenance staff, specialists),
   4. 4) instructions relating to maintenance actions (replacement of parts, etc.) which do not require specific skills and hence may be carried out by users (for example, operators), and
   5. 5) drawings and diagrams enabling maintenance personnel to carry out their task rationally (especially fault-finding tasks);
6. f) information relating to dismantling, disabling and scrapping;
7. g) information for emergency situations, such as
   1. 1) the operating method to be followed in the event of accident or breakdown,
   2. 2) the type of fire-fighting equipment to be used, and
   3. 3) a warning of possible emission or leakage of hazardous substance(s) and, if possible, an indication of means for fighting their effects;
8. h) maintenance instructions provided for skilled persons [item e) 3) above] and maintenance instructions provided for unskilled persons [item e) 4) above], that need to appear clearly separated from each other.

6.4.5.2 Production of instruction handbook

The following applies to the production and presentation of the instruction handbook.

1. a) The type fount and size of print shall ensure the best possible legibility. Safety warnings and/or cautions should be emphasized by the use of colours, symbols and/or large print.
2. b) The information for use shall be given in the language(s) of the country in which the machine will be used for the first time and in the original version. If more than one language is to be used, each should be readily distinguished from another, and efforts should be made to keep the translated text and relevant illustration together.

   NOTE

   In some countries the use of specific language(s) is covered by legal requirements.

3. c) Whenever helpful to the understanding, text should be supported by illustrations. These illustrations should be supplemented with written details enabling, for example, manual controls (actuators) to be located and identified. They should not be separated from the accompanying text and should follow sequential operations.
4. d) Consideration should be given to presenting information in tabular form where this will aid understanding. Tables should be adjacent to the relevant text.
5. e) The use of colours should be considered, particularly in relation to components requiring quick identification.
6. f) When information for use is lengthy, a table of contents and/or an index should be provided.
7. g) Safety-relevant instructions which involve immediate action should be provided in a form readily available to the operator.

6.4.5.3 Drafting and editing information for use

The following applies to the drafting and editing of information for use.

1. a) Relationship to model: the information shall clearly relate to the specific model of machine and, if necessary, other appropriate identification (for example, by serial number).
2. b) Communication principles: when information for use is being prepared, the communication process “see – think – use” should be followed in order to achieve the maximum effect and should follow sequential operations. The questions, “How?” and “Why?” should be anticipated and the answers provided.
3. c) Information for use shall be as simple and as brief as possible, and should be expressed in consistent terms and units with a clear explanation of unusual technical terms.
4. d) When it is foreseen that a machine will be put to non-professional use, the instructions should be written in a form that is readily understood by the non-professional user. If personal protective equipment is required for the safe use of the machine, clear advice should be given, for example, on the packaging as well as on the machine, so that this information is prominently displayed at the point of sale.
5. e) Durability and availability of the documents: documents giving instructions for use should be produced in durable form (i.e. they should be able to survive frequent handling by the user). It can be useful to mark them “keep for future reference”. Where information for use is kept in electronic form (CD, DVD, tape, hard disk, etc.), information on safety-related issues that need immediate action shall always be backed up with a hard copy that is readily available.

7 Documentation of risk assessment and risk reduction

The documentation shall demonstrate the procedure that has been followed and the results that have been achieved. This includes, when relevant, documentation of

1. a) the machinery for which the risk assessment has been made (for example, specifications, limits, intended use);
2. b) any relevant assumptions that have been made (loads, strengths, safety factors, etc.);
3. c) the hazards and hazardous situations identified and the hazardous events considered in the risk assessment;
4. d) the information on which risk assessment was based (see 5.2):
   1. 1) the data used and the sources (accident histories, experience gained from risk reduction applied to similar machinery, etc.);
   2. 2) the uncertainty associated with the data used and its impact on the risk assessment;
5. e) the risk reduction objectives to be achieved by protective measures;
6. f) the protective measures implemented to eliminate identified hazards or to reduce risk;
7. g) residual risks associated with the machinery;
8. h) the result of the risk assessment (see Figure 1);
9. i) any forms completed during the risk assessment.

Standards or other specifications used to select protective measures referred to in f) above should be referenced.

NOTE

No requirement is given in this International Standard to deliver the risk assessment documentation together with the machine. See ISO/TR 14121-2 for information on documentation.

Annex A Schematic representation of a machine

See Figure A.1.

Figure A.1

operator–machine interface

B.1 General

This annex gives, in separate tables, examples of hazards (see Tables B.1 and B.2), hazardous situations (see Table B.3), and hazardous events (see Table B.4), in order to clarify these concepts and assist the persons performing risk assessment in the process of hazard identification (see 5.4).

The lists of hazards, hazardous situations and hazardous events given by this annex are not exhaustive, nor are they prioritized. Therefore, the designer should also identify and document any other hazard, hazardous situation or hazardous event existing in the machine.

B.2 Examples of hazards

In Table B.1, hazards have been grouped in accordance with their type (mechanical hazards, electrical hazards, etc.). In order to offer more detailed information on the type of hazards, there are two additional columns that correspond to the origin of the hazard and its potential consequences.

The use of one or more of the columns presented in Table B.1 depends on the degree of detail needed for describing an identified hazard. In some cases, it is enough to use only one of the columns, particularly when hazards are in the same hazard zone and can be grouped together in terms of protective measures. Which column is used depends on whether the origin of the hazard or nature of the consequences is most useful when choosing an appropriate protective measure. However, all hazards should be documented even if the risk associated with them appears to have been sufficiently reduced by a protective measure suggested for reducing the risk associated with another hazard. Otherwise, the undocumented hazard, the risk from which has been sufficiently reduced by the mitigation of another hazard, could be neglected.

Where, for describing a hazard, more than one of the columns presented in Table B.1 is used, these should not be read line by line. Appropriate words should be selected and combined to describe the hazard in the most convenient way. For example:

Table B.2 is a subset of Table B.1 and contains some examples of typical hazards. Each origin has been related to potential significant consequences. The order of potential consequences is not associated with any priority.

Table B.2

Hazard	Hazard
	Origin cutting parts Potential consequences − cutting − severing		Origin falling objects Potential consequences − crushing − impact
	Origin moving elements Potential consequences − crushing − impact − shearing		Origin moving elements (three examples) Potential consequences − drawing-in − friction, abrasion − impact
	Origin gravity, stability Potential consequences − crushing − trapping		Origin approach of a moving element to a fixed part Potential consequences − crushing − impact
	Origin rotating or moving elements (three examples) Potential consequences − severing − entanglement		Origin moving elements Potential consequences − crushing − friction, abrasion − impact − severing
	Origin live electrical parts Potential consequences − electric shock − burn − puncture − scald		Origin objects or materials with a high or low temperature Potential consequences − burn
	Origin vibrating equipment Potential consequences − osteo-articular disorder − vascular disorder		Origin noisy manufacturing process Potential consequences − fatigue − hearing impairment − loss of awareness − stress
	Origin laser beam Potential consequences − burn − damage to eyes and skin		Origin dust (emissions) Potential consequences − breathing difficulties − explosion − loss of sight
	Origin posture Potential consequences − discomfort − fatigue − musculoskeletal disorder		Origin fumes Potential consequences − breathing difficulties − irritation − poisoning
	Origin location of control devices Potential consequences − any as a consequence of human error − stress		Origin gravity (bulk material solidified) Potential consequences − collapse, falling − crushing − slumping/sagging − suffocation − wedging/jamming

B.3 Examples of hazardous situations

Hazardous situations are those circumstances in which a person is exposed to at least one hazard. The exposure of a person is often the consequence of performing a task on the machine.

Some examples of hazardous situations are

1. a) work near moving parts,
2. b) exposure to ejection of parts,
3. c) work underneath a load,
4. d) work near objects or materials at extreme temperatures, and
5. e) exposure of the worker to hazards generated by noise.

In practice, hazardous situations are often described in terms of tasks or operation of tasks (manual loading and/or unloading of work pieces in a press, trouble-shooting under voltage, etc.).

When describing a hazardous situation it should be ensured that the analysed situation is clearly defined with the information available (task performed, hazard, hazardous zone).

Table B.3 includes a list of tasks which can result in a hazardous situation in the case of exposure to one or more of the hazards presented in Table B.1.

B.4 Examples of hazardous events

Table B.4 gives examples of hazardous events that can occur in the machinery field.

A hazardous event can have different causes. For example, contact with moving parts due to an unexpected start-up can be caused by an unintentional actuation of a control device or by a fault in the control system.

Every cause can in turn be the result of another event or combination of events (chain of events).

Annex C Trilingual lookup and index of specific terms and expressions used in ISO 12100

Bibliography

Footnotes