Risk assessment and risk reduction under ISO 12100

Every robot safety decision, from the choice of a fence to the speed limit of a hospital delivery robot, should trace back to a risk assessment. ISO 12100:2010, Safety of machinery: General principles for design, Risk assessment and risk reduction, is the international foundation. It is a type-A standard, meaning it sets basic concepts for all machinery; type-B standards such as ISO 13849-1, ISO 13855 and ISO 13857 deal with particular safety aspects or devices; and type-C standards such as ISO 10218, ISO 3691-4 and ISO 13482 give requirements for particular kinds of machines. When a type-C standard exists and covers a hazard, its requirements take precedence, but the ISO 12100 method still frames the work. ROB-440 lesson 8 applied the method briefly to a robot cell. This lesson treats it as a discipline in its own right: how to set limits, find hazards systematically, estimate and evaluate risk, choose measures and document the result so that it stands up to an inspector, an auditor or a court.

The iterative process

ISO 12100 describes risk assessment as a sequence of steps followed by risk reduction, repeated until the risk is adequately reduced. First, determine the limits of the machine. Second, identify hazards and the hazardous situations and events in which people could be harmed. Third, estimate the risk for each hazardous situation. Fourth, evaluate whether risk reduction is needed. If it is, apply the three-step method and then repeat the assessment, because every protective measure can introduce new hazards: a guard can create a trapping point, an interlock can tempt people to defeat it, and an automatic restart can surprise someone.

Determining limits means writing down what the machine is for and what could reasonably happen to it. Use limits describe intended use, operating modes, the people involved and their training, and reasonably foreseeable misuse. Space limits describe the range of motion, the space needed for maintenance and the interfaces with other equipment and people. Time limits describe life span, maintenance intervals and wear parts. Other limits include environmental conditions such as temperature, dust, wet floors or outdoor operation. A good limits statement for a hospital delivery robot, for example, would say who will be in corridors, including children, visitors with walkers and patients on stretchers, what floor surfaces exist, whether elevators and automatic doors are used, and whether it might be pushed, ridden on or blocked by curious people.

Reasonably foreseeable misuse is the part most often skipped. It means use not intended by the designer but likely from readily predictable human behaviour: taking shortcuts, reaching in to clear a jam, defeating a nuisance interlock, using the robot for a task near the one it was designed for, a child climbing on it. Courts in product liability cases ask about foreseeable misuse directly, as lesson 8 explains.

Identifying hazards systematically

Hazard identification should be structured, because unstructured brainstorming finds the obvious hazards and misses the rest. Common techniques suit different stages and systems.

Task-based analysis is the workhorse for robots because, as lesson 1 showed, injuries cluster around particular tasks. The analyst lists, for each life phase, every task and who performs it: transport, installation, commissioning, teaching, production, changeover, cleaning, fault finding, maintenance, software update, decommissioning and disposal. For each task, the analyst asks which hazards could be present and how a person could be exposed. System-theoretic process analysis (STPA), developed by Nancy Leveson at MIT, is increasingly used for autonomous systems because it captures hazards that arise from interactions, such as a fleet manager sending a robot into a corridor that a door controller has just closed, rather than from component failures.

Estimating risk

ISO 12100 defines the elements of risk as the severity of harm and the probability of its occurrence, the latter being a function of the exposure of people to the hazard, the occurrence of a hazardous event and the technical and human possibilities to avoid or limit the harm. The standard does not prescribe a scoring method, so organizations use matrices, scoring systems or graphs. ISO/TR 14121-2 gives practical examples. Whatever the method, it should be applied consistently, calibrated with examples and recorded with the reasoning behind each score, because the scores themselves are judgements.

A risk matrix crosses severity categories with likelihood categories and assigns each cell a risk level. It is easy to explain but coarse: very different risks can fall into the same cell, and matrices can rank risks inconsistently when categories are wide. A scoring system multiplies or adds factor scores. One long-used example is the hazard rating number (HRN), which multiplies the likelihood of occurrence (LO), the frequency of exposure (FE), the degree of possible harm (DPH) and the number of persons at risk (NP). Its factor values are logarithmic in spirit, so the result spans many orders of magnitude. Risk graphs, such as the one in ISO 13849-1 that ROB-440 used, assign a required performance level through a decision tree.

# Hazard rating number (HRN) for a risk register, before and after measures
# Factor scales follow a commonly used HRN table (illustrative values)
LO = {"almost impossible": 0.033, "highly unlikely": 1, "unlikely": 1.5, "possible": 2,
      "even chance": 5, "probable": 8, "likely": 10, "certain": 15}
FE = {"annually": 0.5, "monthly": 1, "weekly": 1.5, "daily": 2.5, "hourly": 4, "constantly": 5}
DPH = {"scratch": 0.1, "laceration": 0.5, "minor fracture": 2, "major fracture": 4,
       "loss of limb": 8, "fatality": 15}
NP = {"1-2": 1, "3-7": 2, "8-15": 4, "16-50": 8, "50+": 12}
def hrn(lo, fe, dph, np_):
    return LO[lo] * FE[fe] * DPH[dph] * NP[np_]
def band(x):
    for limit, name in [(1, "negligible"), (5, "very low"), (10, "low"), (50, "significant"),
                        (100, "high"), (500, "very high"), (1000, "extreme")]:
        if x <= limit:
            return name
    return "unacceptable"
register = [
    ("jam clearing at gripper", ("probable", "daily", "major fracture", "1-2"), ("unlikely", "daily", "major fracture", "1-2")),
    ("AMR strikes pedestrian", ("possible", "hourly", "major fracture", "3-7"), ("highly unlikely", "hourly", "minor fracture", "3-7")),
    ("dropped tool at changer", ("unlikely", "weekly", "fatality", "1-2"), ("almost impossible", "weekly", "fatality", "1-2")),
]
for name, before, after in sorted(register, key=lambda r: -hrn(*r[1])):
    b, a = hrn(*before), hrn(*after)
    print(f"{name:26s} before {b:7.1f} ({band(b)}), after {a:6.2f} ({band(a)})")

jam clearing at gripper    before    80.0 (high), after  15.00 (significant)
AMR strikes pedestrian     before    64.0 (high), after  16.00 (significant)
dropped tool at changer    before    33.8 (significant), after   0.74 (negligible)

The output ranks hazards so that attention goes first to the largest, and it shows how each measure changes the estimate. Two cautions apply. First, multiplying ordinal scores is mathematically shaky, so the numbers are best used for ranking and communication rather than as precise risk values. Second, a measure that reduces likelihood often does nothing for severity: a light curtain makes contact less likely but does not soften the robot. Measures that reduce severity, such as lower speed, lower mass or padded surfaces, are often the most robust because they work even when other layers fail.

Evaluating risk and choosing measures

Risk evaluation decides whether further reduction is needed. Criteria include whether the type-C standard's requirements are met, whether the risk is as low as can reasonably be achieved with current technology, whether measures introduce new hazards, and whether the measures are compatible with the machine's use. ISO 12100 also says that risk reduction is achieved when hazards are eliminated or risk is reduced by the three-step method in the right order. That order is the heart of the standard.

Information for use cannot be used to avoid feasible design or safeguarding measures. A manual that says do not enter the cell while the robot is running is necessary but does not replace an interlocked gate. Equally, a user's own measures, such as training, supervision and permit systems, add to but do not substitute for what the designer must do. The split matters legally: in product liability, as lesson 8 explains, a warning is often judged inadequate when a safer design was reasonably available.

Documentation

A risk assessment that is not written down did not happen, as far as regulators and courts are concerned. ISO/TR 14121-2 and the type-C standards describe what to record: the limits of the machine; the hazards and hazardous situations identified; the information on which the assessment was based, such as data, standards and accident history; the risk estimates; the measures chosen and the standards they meet; the residual risks and how users are informed of them; and the results of validation. The document should name the participants and their competence, show dates and versions, and be kept with the machine's technical file. In Europe the technical file is a legal requirement for CE marking, as lesson 5 explains; in Canada and the United States it is strongly expected evidence of due diligence and reasonable care.

Risk assessments also need to be living documents. They should be reviewed when the robot, its tasks, its environment or its software change, after incidents and near misses, and periodically. Management of change procedures, familiar from process safety, make sure that someone asks whether a modification such as a new gripper, a faster cycle or a new route for a mobile robot changes the hazards. Software updates are a particular challenge, because they can change robot behaviour without any visible physical change, which is one reason the new EU Machinery Regulation and AI rules discussed in lessons 5 and 9 address substantial modifications made by software.

In Canada, provincial OHS regulations increasingly require written hazard assessments, as in Alberta's OHS Code Part 2, which requires employers to assess hazards before work begins and when new work processes are introduced, and to involve workers. In Ontario, pre-start health and safety reviews under section 7 of Regulation 851 require documented reviews for some equipment, discussed in lesson 5. Workers' participation through joint health and safety committees is a legal feature in most provinces, and including committee members in robot risk assessments is good practice.

Finally, residual risk must be communicated honestly. After all measures, some risk remains, and the user needs to know what it is and what they must do about it, such as training, personal protective equipment or procedures. Manuals that bury residual risks or exaggerate safety claims undermine trust and can create liability.