Inherently safe design and the hierarchy of controls

Every safety program in this course rests on one idea: some controls are more reliable than others. A hazard that has been designed out cannot hurt anyone. A fixed guard bolted in place protects people whether they are paying attention or not. A warning sign depends on someone reading it, understanding it and choosing to obey it on a busy day. The hierarchy of controls ranks these options so that the most effective ones are considered first.

The hierarchy applied to machines

CSA Z432:23 is organized around the hierarchy of controls, and the same ranking appears in CSA Z1000, the occupational health and safety management standard, and in provincial guidance. Applied to machinery, the levels are:

• Elimination or substitution: remove the hazard entirely or replace it with something less hazardous. Examples include automating a manual feeding task so no one needs to approach the point of operation, replacing a belt drive with a direct drive, reducing speed or force, or eliminating a pinch point by changing the geometry.
• Engineering controls: guards and safeguarding devices that keep people out of the hazard zone or stop the hazard before they reach it. Examples include fixed guards, interlocked guards, light curtains, two-hand controls and safety-rated speed monitoring.
• Awareness means: signs, labels, lights, horns and floor markings that warn people of a hazard. They do not prevent contact, but they help people recognize and avoid the hazard.
• Administrative controls: safe work procedures, training, supervision, job rotation, permits and lockout procedures. They rely on people doing the right thing every time.
• Personal protective equipment: safety glasses, face shields, hearing protection, gloves where appropriate and hair nets. PPE does not reduce the hazard; it reduces the consequence for the wearer, and only if it is worn correctly.

The hierarchy does not mean that only one level is used. Most machines need a combination: an engineering control does most of the work, training explains how to use it, signs remind people of residual hazards, and PPE protects against what remains. The point is to start at the top and justify every step down.

The three-step method of ISO 12100

International machinery standards express the same idea as a three-step method for designers, adopted in CSA Z432 and ANSI B11.0. The designer first tries to reduce risk by inherently safe design, then adds safeguarding and complementary protective measures, and finally provides information for use for the risk that remains.

Inherently safe design is the most powerful step and is often overlooked by users who simply buy a machine. When you specify a new machine, you can ask the supplier to design out hazards: to locate lubrication points and adjustments outside the guards, to make the gap at a nip point too small for a finger or too large to trap a body part, to limit force so that a closing door cannot crush, or to design the machine so that jams can be cleared without reaching in.

Eliminating crushing and shearing hazards by geometry

One of the most elegant inherently safe design measures is to control the gap between moving parts. If the gap is so small that no body part can enter, there is no trap. If the gap is large enough that the body part is not crushed, there is no trap either. ISO 13854 gives the minimum gaps needed to avoid crushing different parts of the body.

Why administrative controls and PPE are weak on their own

It is tempting to deal with a machine hazard by writing a procedure, posting a sign and telling people to be careful. These measures cost little and can be done today. But they depend on human behaviour, and human behaviour is variable. People are tired, distracted, rushed and sometimes overconfident. Production pressure rewards shortcuts. New workers do not yet know the hazards. Experienced workers may believe they are fast enough to avoid a moving part. Studies of machine injuries repeatedly find that the injured person knew the rule but broke it because the safe way was slower or awkward.

PPE has particular limits around machines. Gloves can be caught by rotating parts and pull the hand in. A face shield protects against chips but not against a hand caught in a press. Cut-resistant gloves reduce lacerations from sharp edges but do nothing against crushing or amputation by powered motion. PPE is the last line of defence, not a substitute for guarding.

Residual risk

No machine is perfectly safe. After inherently safe design and safeguarding, some risk remains. That residual risk must be made known to users through information for use: warning labels at the point of hazard, instructions in the manual, training, and PPE where needed. The employer then decides, through its own risk assessment, whether the residual risk is acceptable in the way the machine will actually be used. If it is not, more risk reduction is needed.

Residual risk is often greatest during non-production tasks: setup, adjustment, troubleshooting, cleaning and maintenance. A machine that is well guarded for production may expose a maintainer to the same hazards when guards are open. That is why standards require designers to consider all phases of the machine's life, from transport and installation through operation, maintenance and decommissioning, and why lockout is an essential part of machine safety.

Life-cycle thinking

The hierarchy of controls is cheapest to apply early. Designing out a hazard on paper costs almost nothing; retrofitting a guard after installation costs more; and responding to an injury costs the most of all. When an organization buys, builds, moves or modifies a machine, the purchasing specification, the supplier's design, the installation plan and the commissioning checks are all opportunities to apply the hierarchy. Lesson 11 covers this in detail.

A practical habit is to ask, for every hazard on a machine, whether it could be removed altogether before deciding how to guard it. The answer is often yes for a surprising number of small hazards: a protruding set screw replaced with a flush one, an exposed coupling replaced with a shrouded design, or a manual transfer replaced with a chute.