Machine Design #69: Machine Risk Assessment — From Hazard to a Verifiable Control
1. Start with function and evidence
Before choosing a dimension or opening a supplier catalog, write what the machine risk assessment must do, where the load or environment comes from, how many cycles it must survive, and what counts as failure. “Use the old drawing” hides assumptions about process, access, maintenance, and safety. A testable requirement states the input condition, operating condition, expected result, acceptance limit, and measurement method. Internal standards are a starting point; the final decision must be checked against the real model, material, process, and installation.
2. Review four layers together
Function and load
Separate nominal, start-up, impact, misalignment, and fault cases. Trace the load through the complete assembly, not only the attractive CAD section. Include inertia, thermal movement, cleaning, vibration, and the number of cycles that actually matters. State the boundary and the reason for the safety margin.
Material and manufacturing
The same geometry behaves differently after cutting, forming, welding, machining, coating, or heat treatment. The drawing must describe what a workshop can make and measure. A tight tolerance cannot compensate for an unknown process, an unprotected datum, or an inspection method that cannot reach the feature.
Interfaces and assembly
Define datums, direction, clearance, contact, fastening, tool access, and mistake-proofing. If variants exist, use geometry or markings to prevent a wrong part or orientation. Record the force, sequence, and evidence expected from the operator.
Operation and maintenance
Check access, replacement time, re-location, cleaning, adjustment, and the measurement that returns the machine to baseline. A design that works only with one experienced fitter is not repeatable.
3. Core checks for this topic
- Hazard source, task, exposed person, and operating phase: name the hazard source, the task, the person exposed and the operating phase; a hazard assessed only for normal running misses setting and cleaning.
- Severity, frequency, possibility of avoidance, and assumptions: record severity, frequency and the possibility of avoidance, and write the assumptions down — the assumptions are what a reviewer can challenge.
- Inherently safe design before guards or instructions: look for inherently safe design first, before adding guards or instructions, because eliminating a hazard needs no verification later.
- Protective device, control reliability, and failure response: state the protective device, the reliability the control needs, and how the system behaves when that device itself fails.
- Validation evidence, test condition, and acceptance: keep the validation evidence with its test condition and acceptance criterion, not just a statement that the function was checked.
- Residual risk, user information, training, and review after change: declare the residual risk, the information given to the user, the training required, and when the assessment is reviewed after a change.
The checklist is useful only when every line has evidence. “Reviewed” is not “calculated”, and “calculated” is not “tested at the boundary”. Keep an evidence ID next to each requirement so an engineering change can be audited.
3b. The three-step hierarchy: guarding is step two, not step one
Every machinery safety standard uses the same hierarchy, and the order has a reason: the higher a measure sits, the less it depends on a person doing the right thing.
| Step | Content | Why it beats the step below |
|---|
| 1. Design it out | Remove the hazard: change the structure, lower force or speed, move the assembly out of reach, eliminate the pinch point | If the hazard is gone, nobody has to remember anything |
| 2. Engineering measures | Guarding, interlocks, sensitive protective equipment, mechanical locks | Still works when a person forgets, but can be defeated |
| 3. Information for use | Warning labels, instructions, training, personal protective equipment | Works only if the person reads it, remembers it and complies every time |
The common mistake is to jump straight to step two because it is concrete and easy to draw. The question to ask before every panel is: can this hazard be removed by a design change? If the moving assembly can sit where nobody reaches it, there is nothing to guard, no interlock to build, and no interlock to maintain for the next ten years.
The abnormal tasks are where accidents happen
A risk assessment that only looks at automatic running misses most of the genuinely dangerous situations. The task list has to span the whole life cycle:
- Installation, first alignment, commissioning.
- Normal automatic running.
- Loading, unloading, changeover, adjusting while running.
- Clearing jams and faults — the most dangerous task, because people enter the machine in a
hurry and usually skip the procedure.
- Cleaning, lubrication, periodic inspection.
- Repair, part replacement, calibration.
- Dismantling and relocation.
For each task, answer: who does it, where do they stand, which body part goes into which zone, what state is the machine in, and if the correct procedure is inconvenient, how will people shortcut it. That last question is the most useful one in the whole review.
A measure has to be verifiable, not a promise
A measure only counts as implemented when it lives in an artefact that can be checked. This is where risk assessment connects to everyday design work:
| The stated measure | The artefact it must live in | How it is verified |
|---|
| "The cutter cannot be reached" | Guard drawing, distances on the layout drawing | Measure on the real machine per the reach standard |
| "Opening the door stops the machine" | Safety circuit schematic, device list | Open the door in every mode, measure the stopping time |
| "Isolate the power before repair" | Lockout procedure and labels, isolation point on the machine | Confirm a physical lock point exists and residual energy is released |
| "The load cannot fall on power loss" | Fall-arrest drawing, sizing records | Cut power with the load applied, with guarding during the test |
| "The operator is trained" | Manual, training records | The weakest of the group — use it for residual risk only |
Residual risk must be stated, not hidden
No machine reduces risk to zero. What remains after all three steps is the residual risk, and it has to be written into the handover documentation: which hazard remains, in which task, and what equipment or procedure is required. Stating residual risk is not a legal formality; it is how the operator knows where not to be casual.
The risk assessment file also has to live with the machine: every change of structure, speed, added assembly or way of working requires the relevant part to be reviewed again. A file signed once and filed away does not describe the machine now running on the floor.
4. Tolerance stack and variation
Build the stack from the functional datum to the characteristic that must be protected. Separate nominal, worst-case, and statistical values only when the process is stable enough to justify it. Include flatness, squareness, coating or treatment thickness, clamping deformation, temperature, field assembly error, and wear.
If assembly succeeds only because a technician nudges a part, the design has no reliable capability. Assign each contributor a source and identify whether it is controlled by the supplier or verified at incoming inspection. For machine risk assessment, pay particular attention to hazard identification, exposure, severity, protective measures, validation, and residual risk.
5. Failure modes before release
Ask: “If this is wrong, what will the machine show, and what evidence will reveal the cause?”
| Failure mode | Machine symptom | Verification direction |
|---|
| Boundary selected too optimistically | Passes a demo, fails at speed, temperature, load, or cleaning | Test min/max and the defined fault case |
| Tolerance not tied to function | Difficult assembly, play, bind, noise, or leak | Rebuild the stack from functional datums |
| Manufacturing step omitted | Distortion, burr, crack, drift, or poor finish | Review the process and measure after each critical step |
| Inspection cannot reach feature | Supplier report looks complete but function is unknown | Define a reachable method and a sample plan |
| Maintenance not designed | Long replacement or wrong restoration | Run a maintenance trial and restoration check |
| Documents out of sync | Correct name but wrong revision or setting | Baseline BOM, drawing, process, and work instruction |
6. Drawing and record discipline
Specify only requirements that have functional meaning and can be inspected. For a special requirement state the scope, datum or measurement location, condition, and acceptance limit. Notes such as “accurate machining” or “assemble carefully” are not instructions. Keep the calculation or rationale, source revision, assumptions and limits, review comments, prototype or FAT result, and the point to recheck after change.
7. Design review on the real production route
Start at the input and follow the load or environmental attack to the output. Name the surface, edge, joint, thread, hole, treatment, or contact that carries the function. Mark where friction, clearance, temperature, chemicals, operator adjustment, or cleaning can change the result. If a parameter is unknown, assign an owner and measurement plan instead of hiding it in a large factor.
Ask the fabricator which operation creates the most variation, how the feature is inspected, and what happens after deburring, welding, heat treatment, coating, or washing. Compare capability with the stack. If the process cannot hold the drawing, change the process or design before ordering.
On the assembled machine, run start-up, normal duty, stop, restart, and a controlled fault. Record force or torque, temperature, vibration, noise, motion, visual marks, and replacement time as relevant. These observations often reveal an assumption that a drawing review missed.
8. Boundary conditions and calculations
Write lower and upper values for every influential parameter and include combinations that can occur together. Keep units consistent, show the equation or reference, and record catalog test conditions and correction factors. Compare at least one analysis result with a hand calculation or a measured prototype.
For machine risk assessment, a useful sheet has columns for input, nominal, lower bound, upper bound, source, result, pass/fail, and “what would invalidate this assumption?” This makes the decision robust when a supplier changes material, cycle time, temperature, chemical, or inspection route.
9. Supplier and incoming inspection
The supplier package should include drawing revision, material condition, special process, inspection points, sample record, and rework rule. Do not outsource design intent. If a supplier proposes a different process, compare function, durability, cost, lead time, and inspection capability before approval.
At incoming inspection, measure the features that protect the function rather than every dimension with equal effort. Record actual values and instrument ID. A part can be within a drawing tolerance and still fail because of the wrong surface, burr, fit, treatment, lubricant, or orientation. Link the result to the lot or serial used on the machine.
10. Commissioning and maintenance feedback
Create a baseline at commissioning: cycle time, force or torque, temperature, vibration, noise, position, surface condition, or appearance as relevant. Define the alarm limit and the action when it is reached. After the first service interval, compare the trend with baseline and update the maintenance instruction. Replacement should restore the baseline, not merely make the machine move again.
A risk assessment is not done when the table is filled, but when each measure is verified
A fully filled risk-assessment table does not prove the machine is safe. It is done when each risk-reduction measure has been verified to work, and the residual risk has been recorded and handled.
For each measure, ask three questions:
- Is it implemented? The measure is really on the machine, not only in the document.
- Does it work under fault? Test it at the boundary and in the fault state, not only in the calm scenario.
- What risk remains? The residual risk after the measure must be recorded and turned into information for use (warnings, procedures, protective equipment) where design cannot reduce it further.
And, importantly, the risk assessment is a living document. Every engineering change must ask "which risk-reduction measure is affected, and what part must be re-assessed" — a direct link to change control.
| Trap | Consequence | What to do |
|---|
| Treating a filled table as safety | The measure exists on paper, not the machine | Verify each measure, with evidence |
| Testing only the calm scenario | Real faults are missed | Test at the boundary and in the fault state |
| Not recording residual risk | The operator is not warned | Record residual risk → information for use |
| Not updating after a change | The assessment is stale | Re-assess the affected part when something changes |
11. MINATA release checklist
- [ ] Function, load path, duty cycle, and fault or environment boundary are written.
- [ ] Material, process, surface condition, and inspection method are agreed.
- [ ] Functional datums and tolerance stack are visible.
- [ ] The six topic checks above have evidence and pass/fail criteria.
- [ ] Assembly, tool access, orientation, and mistake-proofing were tried on hardware.
- [ ] Failure modes have an owner, evidence, and re-test condition.
- [ ] Supplier and incoming records link to the revision and lot.
- [ ] Commissioning baseline and maintenance response are defined.
Frequently asked questions
Why is guarding not the first measure?
Because measures higher in the hierarchy depend less on people. If a design change removes the hazard, there is nothing to guard, no interlock to build, and no interlock to maintain for the life of the machine. Guarding sits second in the hierarchy of risk reduction.
Which tasks should a risk assessment cover?
The whole life cycle, not only automatic running: installation, commissioning, loading, changeover, clearing jams, cleaning, lubrication, repair and dismantling. Clearing jams is usually the most dangerous task, because people enter the machine in a hurry.
How do you know a measure has actually been implemented?
When it lives in a checkable artefact — a drawing, a circuit schematic, a device list, a lockout procedure — and there is a way to verify it on the real machine. A measure that exists only in meeting minutes has not been implemented.
Does training count as a risk reduction measure?
Yes, but at the lowest level, because it only works when the person remembers and complies every time. Use training and warnings for residual risk, not as a substitute for an engineering measure against a serious hazard.
Does the risk assessment file have to be updated?
Yes, whenever the machine changes structure, speed, assemblies or the way it is operated. A file signed once and filed away describes a machine that no longer exists.
12. Closing note
Good mechanical design is a chain of explicit assumptions that survives manufacturing, assembly, operation, maintenance, and change. For machine risk assessment, the right question is not only “will it work?” but “what evidence will show it continues to work when the boundary moves?” That is the standard MINATA uses to turn a drawing into a dependable machine.
Frequently asked questions, continued
Is the machine safe once the risk-assessment table is filled in?
No. The table only lists intentions. The machine is safe when each risk-reduction measure has been verified to work at the boundary and in the fault state, and the residual risk has been recorded and turned into information for use. Evidence, an owner, and a date must accompany it.
After a retrofit or engineering change, must the risk be re-assessed?
Yes, but not necessarily from scratch. Identify which risk-reduction measure is affected by the change and re-assess that part, updating the document. The risk assessment is a living document, not a one-time file put away in a drawer.
Conclusion
Machine Risk Assessment is not a matter of picking a single number. Good design ties function, load, material, process, tolerance, assembly and maintenance into one contract that can be checked. An internal standard preserves the experience already accumulated; the designer's job is to understand the conditions under which it applies and turn it into a clear decision on the product at hand.
View all MINATA technical articles