Machine Safety Risk Assessment: ISO 12100 and Getting to a Performance Level
The short answer
ISO 12100 tells you how to identify hazards and assess risk on a machine. For each hazard that a control system will reduce, ISO 13849-1 turns three judgements about the hazard into a required performance level, PLr, from a to e. You then design a safety function that achieves at least that performance level, and validate it to ISO 13849-2. The number is the easy part; the risk assessment and the validation are where machines are actually made safe or not.
The order ISO 12100 sets
- Determine the limits of the machine: what it does, who uses it, its life, its foreseeable misuse. Foreseeable misuse is not optional and is where most injuries live.
- Identify hazards at every lifecycle phase, including installation, setting, cleaning, fault finding and decommissioning. Most serious machine injuries happen during intervention, not during normal production.
- Estimate risk for each hazard.
- Evaluate whether risk reduction is required.
- Reduce risk in a fixed order: inherently safe design first, then safeguarding and protective devices, then information for use. A guard is the second choice; removing the hazard is the first.
That order is not advice. Adding a light curtain to a hazard you could have designed out is a documented failure to follow the standard.
Getting to PLr
ISO 13849-1 asks three questions about the hazard, not about the machine:
S, severity of injury. S1 is slight and normally reversible. S2 is serious, normally irreversible, including death.
F, frequency and duration of exposure. F1 is seldom to less often, F2 is frequent to continuous. The threshold people use in practice is roughly whether exposure happens more than once per shift.
P, possibility of avoiding the hazard. P1 means possible under specific conditions, for example a slow-moving hazard the operator can see coming. P2 means scarcely possible.
Follow the path through the risk graph and you get PLr from a to e. In practice, most guard-interlock functions on a machine with a serious hazard and frequent access land on PLr d, and a hazard that could kill with no chance of avoidance lands on e.
Category is not performance level
This is the most frequent misunderstanding on Indian shop floors and in tender documents.
A category (B, 1, 2, 3, 4) describes the architecture: single channel, single channel with well-tried components, tested, redundant with monitoring, redundant with continuous monitoring.
A performance level describes the achieved probability of dangerous failure per hour, and depends on the category plus the MTTFd of the components, the diagnostic coverage, and common cause failure.
So "category 3" does not mean PL d. Two category 3 circuits with different components achieve different performance levels. You need the component data, and you need to do the calculation, usually in SISTEMA or the equivalent.
What gets skipped
Validation, ISO 13849-2. Designing the function is not the same as proving it works. Validation means checking the design against the specification and then testing the implemented function, including fault injection: open a channel, short a channel, and confirm the machine still goes to a safe state and does not restart on its own.
The safety function specification itself. Each function needs a written statement: what it detects, what it does, how long it takes, and what happens on fault and on restart. Without it, validation has nothing to validate against.
Response time. A light curtain at the wrong distance from the hazard is decorative. Safety distance follows ISO 13855 and depends on the total stopping time of the machine including the response of the safety relay and the contactors.
Where to learn it
The Siemens Safety Integrated course and Allen-Bradley GuardLogix course cover implementing safety functions in the two most common platforms. For process rather than machinery safety, the standard is different: see SIL and IEC 61511. Related reading: emergency stop and safety circuits and robot safety to ISO 10218.
Frequently asked questions
Is an emergency stop a protective measure? No. ISO 13850 is explicit that an emergency stop is a complementary measure. It does not reduce the risk of a hazard and cannot be counted as the safeguard.
Do I need SISTEMA? You need a calculation. SISTEMA is free, it holds manufacturers' libraries, and it produces a report an auditor accepts, so most people use it.
Who is responsible on a modified machine? Whoever modified it, in most jurisdictions, becomes responsible for the modification and often for re-assessing the machine. Retrofitting a robot into an existing cell is a new machine in practice.
