The Machine That Passed Inspection and Still Hurt Someone
A new packaging cell was delivered, installed, and inspected. The inspector checked the guards, the e-stop, and the light curtain. All present. The machine ran. Three months later, an operator reached in to clear a label jam — the light curtain was muted (the conveyor “product” was passing), and her hand entered the robot workspace. The robot did not know she was a person. The injury was serious. The root cause was not a missing guard. It was a missing risk assessment. The integrator had designed for “normal operation” but had not analyzed the jam-clearing scenario. The muting logic, which was correct for product flow, was wrong for a hand entering during a jam.
A risk assessment is the process of asking “what can go wrong?” before the machine hurts someone. It is not paperwork — it is the thinking that prevents the injury.
The Risk Assessment Process (ISO 12100)
ISO 12100 is the standard for machinery risk assessment. It follows a loop: identify the limits of the machine, identify the hazards, estimate the risk, reduce it, and repeat until the residual risk is acceptable. The key is to think through every scenario the operator will actually face — not just the happy path.
Step 1: Define the Limits
Before listing hazards, define the machine’s intended use and the foreseeable misuse. Who operates it? What are the tasks (normal run, jam-clearing, setup, maintenance)? What are the environments (washdown, dust, cold)? The label jam-clearing scenario above was a foreseeable task that the integrator had not analyzed.
Step 2: Identify the Hazards
Walk through every task and ask: what can hurt the operator? The standard list:
- Mechanical: crushing, shearing, cutting, entanglement, ejection.
- Electrical: shock, arc flash.
- Thermal: burns, hot surfaces.
- Noise: hearing loss.
- Vibration: hand-arm vibration.
- Ergonomic: lifting, repetition, awkward posture.
- Human error: bypassing a guard, rushing a jam-clear.
The “human error” category is the one most often missed. Operators do not behave like the manual says — they jam-clear under production pressure. The risk assessment must include this.
Step 3: Estimate the Risk
For each hazard, rate the risk on a simple matrix: severity (S) and frequency/probability (F). A high-severity, high-frequency hazard gets the highest priority. The robot muting scenario was high-severity (crushing) and high-frequency (jam-clearing happens every shift). It should have been flagged as unacceptable.
The risk rule: If a hazard can kill or maim someone, the risk is unacceptable no matter how “rare” it is. The hierarchy of controls: eliminate the hazard first, then guard it, then warn, then train. Do not rely on training alone to stop a crushing hazard.
Step 4: Reduce the Risk (Hierarchy of Controls)
The reduction follows a strict order — never skip to the bottom:
- Eliminate: Design the hazard out. Move the nip point away. Use a remote operator station.
- Substitute: Replace a dangerous process with a safer one (pneumatic instead of manual clamping).
- Engineering controls: Guards, light curtains, interlocks, safety relays.
- Warnings: Signs, alarms, labels.
- Administrative: Procedures, training, permits.
- PPE: Gloves, safety glasses (last resort).
The robot cell injury could have been prevented by engineering: a two-hand control for jam-clearing, or a safe-stop (Category 1) that triggers when the light curtain is muted for more than a few seconds. Training alone (“don’t reach in”) is not a control.
Step 5: Review After Changes
A risk assessment is not a one-time document. Any change to the machine (a new task, a new material, a modification) requires a fresh assessment. The label jam-clearing scenario was not in the original design because the machine was specified without it. When the customer added a new label type (which jammed more often), the risk changed — and nobody reassessed.
A Risk Assessment Starter
| Task | Hazard | Severity | Frequency | Control |
|---|---|---|---|---|
| Normal run | Crushing (robot) | High | Low | Light curtain + fence |
| Jam-clearing | Crushing (robot) | High | High | Two-hand hold-to-run |
| Setup | Pinch (die) | Medium | Medium | Interlocked guard |
| Maintenance | Electrical shock | High | Low | LOTO |
| Cleaning | Slip, chemical | Low | High | PPE, procedure |
The Bottom Line
The machine that passed inspection and still hurt someone was not designed for the operator’s actual day. A risk assessment walks through every task — jam-clearing, setup, maintenance — and asks “what if?” before the injury happens. It is paperwork only if you treat it that way. Done seriously, it is the difference between a machine that runs and a machine that hurts.
