Basic Safety Standard ISO 12100 | EMEA

1. Risk assessment and risk reduction
2. Risk assessment
2-1. Process 1: Determination of the limits of the machinery
2-2. Process 2: Hazard identification
2-3. Process 3: Risk estimation
2-4. Process 4: Risk evaluation
3. Risk reduction
3-1. Inherently safe design measures
3-2. Safeguarding
3-3. Complementary protective measures
3-4. Information for use

ISO/IEC Guide 51, a guideline jointly developed by ISO and IEC for the preparation of safety standards, requires that safety standards be developed through a systematic approach. Within the hierarchy of standards, safety standards are classified, from top to bottom, as follows: (1) basic safety standards, (2) group safety standards, and (3) product safety standards. This page provides an overview of ISO 12100, which is a basic safety standard.

Basic safety standards, also referred to as Type-A standards, specify the concepts and methodologies of risk assessment and risk reduction that are fundamental to the safe design of machinery.

Risk assessment is a systematic activity carried out in the workplace to identify existing or potential hazards and hazardous situations, and to eliminate or adequately reduce the risks of industrial accidents before they occur.

With advances in technology and the expansion of new markets, machinery, equipment, and working environments have become increasingly diverse. Consequently, the causes of industrial accidents have also become more complex and varied. Potential workplace hazards and hazardous situations often exist, and if left unaddressed they may lead to industrial accidents.

Therefore, it is essential to proactively identify potential hazards and hazardous situations in the workplace, and to take appropriate preventive measures before any accidents occur. This systematic process of identifying and controlling risks is referred to as “risk assessment and risk reduction.”

Process (1): Determination of the limits of the machinery

The procedure starts with determining the limits of the relevant machinery. The general specifications of the machinery shall be clarified to define the scope and conditions of the risk assessment.

To this end, it is important to define the following three aspects:

• Use limits

• Space limits

• Time limits

Process (2): Hazard identification

This process identifies all reasonably foreseeable hazards, hazardous situations and/or hazardous events throughout all phases of the machine life cycle (from transport and assembly to dismantling and disposal).

Process (3): Risk estimation

This process estimates the severity of harm and probability of occurrence for each hazard identified during Process (2).

Process (4): Risk evaluation

This process judges whether risk reduction objectives have been achieved based on risk analysis.

This section explains the risk assessment procedure and outlines, following the flow of Processes (1) to (4) as shown in Figure 2.

In addition to being safe, machinery is also required to be easy to use and highly productive. Taking such conditions into account, the practical limits of use shall be determined, and the risk assessment shall be conducted accordingly. As previously described, limits related to use, space, and time shall be clearly defined.

1. Use limits

• Different machinery operating modes and intervention procedures for users

• Use of the machinery (for example, industrial, non-industrial, etc.) by persons identified by sex, age, dominant hand usage, or limiting physical abilities (visual or hearing impairment, size, strength, etc.);

• Training, experience, or ability of users

These limits shall take into account both intended use and reasonably foreseeable misuse.

• Intended use: Use of a machine in accordance with the information for use provided in the instructions.

• Reasonably foreseeable misuse: Use of a machine in a way not intended by the designer, but which can result from readily predictable human behavior.

2. Space limits

• Range of movement of the machine (e.g., the manipulator of a robot or the traveling range of a crane).

• Proper working space for persons interacting with the machine, such as during normal operation or maintenance.

• Proper human interaction, such as the operator-machine interface.

• The machine–power supply (e.g. electrical power) interface.

3. Time limits

• Consideration of the life limit of the machinery or its component parts
  Examples include cutting edges of tools, air/oil filters, grease, lubricating oil, gaskets, and switch contacts.

• Recommended service intervals

Hazard identification is an essential step in any risk assessment of machinery. If a hazard is overlooked, the necessary protective measures may not be implemented, resulting in a machine operating with high risk and possibly leading to a serious accident.

Hazards, hazardous situations, and hazardous events

The list of hazards given in ISO 12100 is shown below (extracted from ISO 12100 Annex B, Table B.1).

This list does not cover all possible hazards, nor does it indicate any order of priority. However, it serves as a very useful reference for persons performing risk assessments to ensure that all hazards are identified without omission.

As shown, hazards are grouped by type, such as mechanical, noise, vibration, etc. It is recommended to express them as a combination of the “cause” and the “consequence” according to the type of hazard. For example, the following expressions can be used:

• ”Cutting” caused by “angular parts

• ”Stabbing” caused by “sharp edges”

• ”Impact” caused by “kinetic energy”

• ”Electric shock” caused by “live parts”

• ”Burn” caused by contact with “objects with a high temperature”

For lists of hazardous situations and hazardous events, please refer to ISO 12100 Annex B.2 to B.4.

Points to consider when identifying hazards

Below are the key points to consider when identifying hazards.

Significant hazards

It is desirable to identify all hazards, both major and minor ones, but particular care shall be taken not to overlook any significant ones.

Definitive (permanent) hazards

Examples include moving parts of machinery, live parts, high or low temperatures, awkward operating postures, noise, or radiation (e.g. X-rays). These hazards are relatively easy to identify because they are permanently present during the life of the machinery, but if they are overlooked, persons may be continuously exposed to them.

Incidental hazards

Examples include unexpected start-up or restart leading to entrapment, acceleration or deceleration leading to a fall, fires or explosions, etc. Because these occur unpredictably, they are difficult to identify and require special attention.

Hazards of damage to health

It is generally considered difficult to compare damage to health with physical injury using the same table. In considering cumulative effects such as damage to health, the severity of harm needs to be assessed and determined taking the frequency and duration of exposure into account.

Methods for identifying hazards

Although ISO 12100 provides lists of hazards and hazardous events, it does not specify concrete methods for identifying them. Therefore, the following practical methods are presented as a reference to prevent hazards from being overlooked.

Hazard listing method

When applied to situations such as long production lines (from material input to finished product output), this method identifies all hazards from each processing stage.

When using this method, hazard identification should include not only routine operation but also non-routine activities, such as setup changes, maintenance, and servicing work. Attention should also be paid to reasonably foreseeable hazards that may occur during misuse, such as abnormalities being handled without stopping the work process.

Task-based method

This method identifies hazards in accordance with the sequence of tasks performed by persons. On existing production lines, there are work procedures for the tasks performed by workers. Using this method, hazards are identified by carrying out the tasks in accordance with these work procedures. However, as work procedure documents do not yet exist at the design stage for machinery, this method is considered to be effective for existing production lines.

It is also important not to exclude existing hazards simply because no work is currently performed in that location.

Utility tracking method

This method focuses on the places where utilities such as electricity, compressed air, steam, or pressurized fluids are used, and identifies these energy sources as hazards. Utility use is traced to check whether mechanical motion, fluid ejection, or similar phenomena constitute a hazard.

It should be noted that this method requires attention not only to utilities but also to other types of hazards, such as sharp protrusions, ergonomic hazards (e.g. unhealthy or awkward operating postures), and potential energy (e.g. placing heavy objects on upper shelves).

When any of these methods are applied, consulting the lists provided in ISO 12100 Annex B helps to ensure that no hazards are overlooked.

Other points to consider when identifying hazards

Even when dealing with the same hazard, the potential hazardous events and hazardous situations may differ depending on the type of task being performed. For example, during normal operation, when an operator manually inserts materials between the upper and lower dies and removes them after processing, the part of the body primarily at risk of injury is the upper arm. A light curtain is a commonly used protective measure for this task.
In contrast, during non-routine tasks such as maintenance, when a worker enters the space between the upper and lower dies to clean them, the part of the body primarily exposed to risk is the upper torso, and any incident in such a situation is likely to result in fatal injury. Protective measures for this task include fall prevention mechanisms, or supporting blocks placed between the upper and lower dies. In other words, a single hazard may give rise to multiple hazardous events, and multiple protective measures are required in such cases.

It is also important to confirm that protective measures already implemented do not themselves create new hazards. For example, one should check whether a person could be injured by a sharp corner of a safety fence, or whether a worker could become trapped between the safety fence installed around a robot and the robot manipulator itself.

After identifying the hazards, risk estimation is carried out for each hazardous situation arising from those hazards.

Risk and its constituent elements

Risk (R), in the event that harm occurs due to the hazards of the relevant machinery, is expressed as a combination of the severity of harm (S) and the probability of occurrence of harm (P). Furthermore, the probability of occurrence of harm (P) consists of the following elements: probability of occurrence of a hazardous event (P1), frequency of exposure (F), duration of exposure (T), and possibility of avoiding harm (Q).

Explanation of each element

To specifically estimate risk, criteria are required for assessing the severity of harm (S) and the probability of occurrence of harm (P).

By establishing such criteria, risk can be estimated on the same basis for any type of machinery, making comparison possible. However, ISO 12100 does not specify these criteria.

Risk estimation

There are several methods for estimating risk. Because ISO 12100 does not describe specific methods, the following approaches are introduced based on the (Japan) Ministry of Health, Labour and Welfare’s Guideline on Investigation of Hazards and Harmful Factors, as well as ISO/TR 14121-2.

1. Addition/multiplication methods

Using these methods, numerical scores are assigned to all elements required for risk estimation, and the scores are combined with addition or multiplication.

In the example below, the severity of harm (S) is classified into four levels, and the probability of occurrence of harm (P) is defined as a combination of the probability of occurrence of a hazardous event (P1) and the frequency of exposure (F). These elements are then combined by addition or multiplication to obtain a numerical value.

A key feature of this method is that all necessary elements can be incorporated into the calculation.

2. Risk matrix method

In this method, the severity of harm (S) is generally plotted on the vertical axis and the probability of occurrence of harm (P) on the horizontal axis. Each section of the matrix is assigned a numerical value representing the risk index. A key feature of this method is that it clearly visualizes the magnitude of risk, making it easy to understand.

3. Risk graph method

In principle, this method uses three elements: the severity of harm (S), the frequency of exposure (F), and the possibility of avoidance (P). Because it follows a binary (yes/no) decision structure, it is seen as a method that results in relatively low differences of opinion between evaluators.

4. Risk graph used for safety-related parts of control systems

Figure 6 shows the risk graph used in ISO 13849-1. It is applied during risk assessments for the safety-related parts of control systems, and to determine the required Performance Level (PLr).

After the risk estimation is complete, a risk evaluation is conducted to determine whether risk reduction is necessary. If the result shows that the risk does not fall below the tolerable risk level, risk reduction measures (the three-step method) shall be applied.

When new protective measures are implemented for risk reduction, verification that these measures do not introduce new hazards or increase other risks is required. If new hazards arise or other risks increase, the risk assessment procedure shall be carried out again, starting from risk estimation (process 3).

Concept of tolerable risk levels

Although tolerable risk levels are not explicitly specified in ISO 12100 or other international safety standards, it is important for an organization to determine its tolerable risk levels before carrying out a risk assessment. If any of the tolerable risk levels change during the risk assessment process, it may affect the protective measures that have already been implemented.

3. Avoiding creation of sharp parts

Sharp edges or protruding parts shall not be created. If such parts exist, they shall be covered. Surfaces shall be smooth so that clothing does not get caught.

4. Physical measures

• The force and energy associated with moving parts shall be reduced as far as possible so that they do not create a hazard.

• Suppress emissions by addressing their root causes; that is, reduce noises and vibrations at their respective sources.

• Replace hazardous substances with less hazardous alternatives, or modify the work process so that it produces fewer hazardous substances.

5. Considerations in machine design

• Perform appropriate stress calculations. Dynamic balance shall also be considered.

• Select appropriate materials and grades, taking corrosion, wear, and flammability into account.

6. Choice of appropriate technology

For machinery used in potentially explosive atmospheres, use pneumatic or hydraulic control systems instead of electrical circuits, or use intrinsically safe electrical equipment. If pneumatic equipment generates excessive noise, use an electrical system instead.

7. Application of positive mechanical action

This refers to an operating principle in which machine parts move through combinations of rigid elements only. Accordingly, springs or other elastic elements shall not be used in the transmission path.

Examples include the direct opening function of normally closed (NC) contacts in emergency stop switches and safety switches (door interlock devices).

Stability, maintainability, etc.

1. Requirements for stability

Machines shall be designed and installed to have sufficient stability with respect to their installation location.

2. Requirements for maintainability

Parts requiring maintenance shall be easily accessible, so that maintenance can be carried out easily.

Operation shall be easy to understand, and the need for tools shall be minimized as far as possible.

Measures to prevent electrical hazards

ISO 12100 requires that IEC 60204-1 be referenced in relation to the safety of electrical equipment of machines.

IEC 60204-1 (Safety of machinery — Electrical equipment of machines — Part 1: General requirements) specifies requirements for the disconnection and switching of electrical and control circuits, and for protection against electric shock and fires, primarily to protect persons and electrical equipment from electrical hazards.

Prevention of pneumatic and hydraulic hazards

Pneumatic and hydraulic equipment and systems shall be designed with consideration of the following requirements:

• The maximum rated pressure shall not be exceeded in the circuits using, for example, pressure-limiting devices.

• No hazardous fluid jet or sudden hazardous movement of the hose (whiplash) shall result from leakage or component failures.

• As far as possible, reservoirs and vessels, including compressed-gas cylinders, shall be automatically depressurized when isolating the machine from its power supply.

If depressurization is not possible, means shall be provided for their isolation or local depressurizing, as well as pressure indication.

Compliance with ergonomic principles

The design shall take into account the following, so as to reduce physical and mental stress on the operator:

• The machine shall be positioned and set at a height such that operation can be carried out without requiring stressful postures.

• The operating position shall be set so that the operator is not exposed to noise, vibration and thermal effects such as extreme (high or low) temperatures.

• The operator’s working rhythm shall not be forced to match the automatic succession of cycles.

• Locations where work is to be performed shall have adequate lighting (excessive glare shall be avoided).

• Actuators, such as switches and levers shall be selected, located, and identified so that, for example:

- actuators intended to be operated are clearly visible and identifiable

- arrangement of switches and indicators shall be standardized, so as to reduce the likelihood of misuse when the operator moves from one machine to another; and

- the direction of movement of switches and levers is consistent with the expected effect of their operation (see Figure 11).

Inherently safe design measures using control systems

1. Prevention of hazardous situations due to the starting of the power source or connection to the power supply

Mobile machinery, for example, shall not move merely as a result of starting the engine. Similarly, machinery shall not initiate movement of parts merely by being connected to the main power supply.

2. Starting and stopping of a machine

• It is recommended that the starting of machinery be achieved by the application (or an increase) of voltage or fluid pressure. If represented in binary logic, this corresponds to the passage from state 0 to state 1 (where 1 represents the highest energy state).

• Stopping of machinery is recommended to be achieved by the removal (or reduction) of voltage or fluid pressure. If represented in binary logic, this corresponds to the passage from state 1 to state 0 (where 0 represents the lowest energy state).

3. Prevention of restart after power interruption

When, for any reason, the energy supply has been interrupted and is subsequently restored, and automatic restarting of the machine could create a hazardous situation, a control system shall be provided to prevent an unexpected restart. For example, this may be achieved by means of a self-holding circuit using relays.

4. Interruption of the power supply

Machinery shall be designed and built so that an interruption of the power supply does not lead to a hazardous situation. The stop function shall be maintained, and any workpieces (including heavy loads) held by the machinery shall be retained for the time necessary to allow them to be safely lowered.

5. Safety functions implemented by programmable electronic control systems

Control systems, including programmable logic controllers (PLCs), shall be designed so that they have a sufficiently low probability of random hardware failures and a low likelihood of systematic failures in the safety-related parts of the control system.

Furthermore, validation shall be carried out to ensure that the required Safety Integrity Level (SIL) and other relevant requirements are met.

Application software should not be reprogrammable by the user. When reprogramming by the user is necessary, access to the software dealing with safety functions should be restricted (e.g. by locking, or the use of passwords).

6. Principles relating to manual control

• Manual control devices shall be designed and positioned according to the relevant ergonomic principles.

• A stop control switch shall be placed near each starting switch.

• Switches and other control devices shall be placed out of reach of danger zones and shall be operable only from safe locations, except where their location within the danger zone is unavoidable (e.g. emergency stop switches, teaching pendants).

• Control devices and control positions shall be located so that the operator is able to observe hazard zones.

• Where a machine (or hazard) can be started from more than one control device, the control system shall be designed so that only one control device is effective at a given time. This requirement applies particularly to teaching pendants that operators may carry into danger zones.

• Switches and other control devices shall be designed so that, where a risk is present, they require intentional operation, or shall be fitted with a guard to prevent unintentional actuation.

• For ensuring the safety of machines directly controlled by the operator, measures shall be provided to ensure that the operator is in a safe operating position (e.g. using two-hand control devices for presses).

• For cableless control, an automatic stop shall be performed when correct control signals are not received, including loss of communication (see IEC 60204-1).

7. Control mode for setting, teaching, process changeover, fault-finding, cleaning or maintenance

Where a guard is displaced or removed and/or a protective device is disabled, and it is necessary for the purpose of these operations for the machinery or part of the machine to be put into operation, the safety of the operator shall be achieved using a specific control mode which simultaneously:

• disables all other control modes

• permits operation only by actuation of an enabling device, a two-hand control device or a hold-to-run control device; and

• permits operation only in reduced risk conditions (e.g. reduced speed, reduced power/force).

This control mode shall be associated with one or more of the following measures:

1. restriction of access to the danger zone as far as possible;

2. installation of an emergency stop control switch within immediate reach of the operator;

3. use of a portable control unit (teaching pendant) and/or local control devices (allowing sight of the controlled elements).

8. Proper selection of control and operating modes

For machinery that uses multiple operating modes, the risk level and protective measures differ for each mode. Therefore, such machinery shall be fitted with a mode selector which can be locked in each position. Each position of the mode selector, for example that of a key selector switch, shall be clearly identifiable.

Measures to minimize the probability of failure of safety functions

Safety of machinery is not only dependent on the reliability of the control systems, but also on the reliability of all parts of the machine. Therefore, the following requirements shall be met.

1. Use of reliable components

Components that are capable of withstanding all disturbances and stresses for the period of time or the number of operations fixed for the use, and with a low probability of failures, shall be used.

2. Use of “oriented failure mode” components

“Oriented failure mode” components (or systems) in which the predominant failure mode is known in advance shall be used.

A typical example of a component with an oriented failure mode is a fuse used for overcurrent protection. When an overcurrent occurs, a fuse does not fail by short-circuiting; instead, it melts and interrupts the current.

3. Duplication (or redundancy) of components or subsystems

With regard to safety-related parts of control systems, duplication (or redundancy) of components may be used so that, if one component fails, another component or components continue to perform the respective function(s), ensuring that the safety function remains available. In addition to duplication, diversity of design and/or technology can be used to avoid common cause failures (CCF) or common mode failures.

4. Use of automatic monitoring (self-diagnostic) functions

In safety-related parts of control systems, automatic monitoring functions are used to detect single faults without impairing the performance of the actual safety function (e.g. actuating an emergency stop switch to bring the machine to an emergency stop). When a single fault is detected by such monitoring, protective measures shall be taken, such as bringing the machine to a safe stop. After the stop, measures may be taken, including the prevention of restart and provision of an alarm or indication.

Reduction of frequency of exposure to hazards through increased reliability

When the reliability of components is high, the need to approach hazards for repair work is reduced, limiting exposure to hazards. If the reliability is low, frequent system stoppages may occur, increasing the motivation to override guards or protective devices.

Limitation of exposure to hazards by automating loading or unloading operations

Automation of machine loading/unloading operations limits the risk generated by these operations by reducing the exposure of persons to hazards at the operating points.

Limiting exposure to hazards through location of setting and maintenance points outside danger zones

When locating maintenance, lubrication and setting points outside danger zones, the need for access to such zones may be eliminated.

Safeguarding is a protective measure primarily based on the principles of ‘isolation’ and ‘stopping’.

• Safeguarding through isolation: Using guards to physically separate persons from hazards (danger zones) of machinery.

• Safeguarding through stopping: Temporally separating persons from hazards by ensuring that machine hazards are stopped when a guard is opened, or by ensuring that a guard can only be opened after the hazards have come to a stop.

Selection and implementation of guards and protective devices

The selection criteria can be classified into the following three groups, depending on the situation:

1. Where access to the hazard zone is not required during normal operation

Safeguards should be selected from the following:

• fixed guards

• interlocking guards (with or without guard locking)

• self-closing guards

• sensitive protective equipment (e.g. light curtains, laser scanners).

2. Where access to the hazard zone is required during normal operation

Where access to the hazard zone is required during normal operation of the machinery, safeguards should be selected from the following:

• interlocking guards (with or without guard locking)

• sensitive protective equipment (e.g. light curtains)

• adjustable guards

• two-hand control devices

• interlocking guards with a start function (control guards)

3. Where access to the hazard zone is required for machine setting, teaching, process changeover, fault-finding, cleaning or maintenance

Protective devices shall be selected to ensure the safety of working personnel while causing as little interference with the work as possible. Where it is possible to shut off the power (e.g. electrical power) for the task concerned, isolating the power supply and reducing any residual energy to zero are the most effective measures.

Requirements for guards

Important general requirements for guards include that they: are of robust construction, do not give rise to any additional hazard, are not easy to bypass or render non-operational, and cause minimum obstruction to the view of the production process.

In addition to these, the following requirements apply depending on the type of guard:

1. Requirements for fixed guards

Fixed guards shall be securely held in place, either

• permanently, for example by welding, or

• by means of fasteners (screws, nuts), making removal/opening impossible without using tools.

2. Requirements for movable guards

General requirements for movable guards include the following. Such guards shall, where necessary, coordinate with the machine’s control system.

• Movable guards shall remain fixed to the machinery or its supporting structure, generally by means of hinges or guides, not only when closed but also when open.

• Moving parts of the machine cannot start up while they are within the operator's reach.
  In addition, the operator shall not reach moving parts once they have started up. This can be achieved by interlocking guards, with guard locking when necessary,

• If a movable guard becomes displaced or removed, or if an associated interlocking device is defeated or has failed, the start-up of the machine’s moving parts shall be prevented, or, if the machine is operating, the moving parts shall be brought to a stop. This can be achieved by automatic monitoring of the control system.

3. Requirements for interlocking guards with a start function (control guards)

This refers to a special form of interlocking guard which, once it has reached its closed position, gives a start command without the use of a separate start control (e.g. a start switch). This type of guard may only be used provided that:

• all requirements for interlocking guards are satisfied

• the cycle time of the machine is short

• the maximum opening time of the guard is preset to a low value (for example, equal to the cycle time); and
  when this time is exceeded, the machine cannot be initiated by the closing of the interlocking guard with a start function and resetting is needed

• the dimensions or shape of the machine do not allow a person, or part of a person, to stay in the hazard zone or between the hazard zone and the guard while the guard is closed

• the interlocking device associated with the interlocking guard with a start function is designed such that, for example, by duplication and use of automatic monitoring, its failure does not lead to an unintended/unexpected start-up; and

• the guard is securely held open (for example, by a spring or counterweight) such that it cannot initiate a start while falling by its own weight.

4. Reduction of emissions

If inherently safe design measures for the reduction of emissions of noise, vibration or hazardous materials (e.g. gases or vapors) are not adequate, additional protective measures shall be taken, such as installing silencers or vibration-damping devices, or through forced ventilation.

• A safety distance shall be provided between persons and the hazard, taking into account the overall stopping time required for both the sensitive protective equipment and the machine.

• Sensitive protective equipment shall give a stop command as soon as a person or part of a person is detected.

• The withdrawal of the person or part of a person detected shall not, by itself, restart the hazardous machine function(s). In addition, the stop command given by the sensitive protective equipment shall be maintained by the control system until a new command is given.

• Restarting the machine shall be performed only by voluntary actuation by the operator of a control device placed outside the hazard zone.

• A person or part of a person shall be prevented from entering or being present in the hazard zone without being detected. For this purpose, fixed guards may be used in combination with the sensitive protective equipment, as necessary.

In the following cases, the use of sensitive protective equipment alone is insufficient. Additional protective measures or reconsideration of the use of sensitive protective equipment are required:

• where objects such as chips of materials or cutting fluid may be ejected from the hazard zone

• where noise, dust, X-rays, or other emissions are released

• where irregular and prolonged stops occur during a process, leading to the misunderstanding that the machine has been completely stopped

• where the machine has characteristics that do not allow emergency stopping during a cycle (e.g. where large inertia of moving parts exists).

3) Safety requirements for sensitive protective equipment when used for cycle initiation

As an exception, for the primary purpose of improving productivity, automatic restarting of the machine cycle is permitted when a person or part of the body leaves the detection zone of the sensitive protective equipment. However, this is subject to various conditions and requirements. For details, refer to the main text of ISO 12100.

Even after risk reduction has been implemented, complementary protective measures may still be required, considering the intended use or reasonably foreseeable misuse of the machine. The following five types of complementary protective measures are representative examples:

• Provision of an emergency stop function, enabling a person to immediately stop the machine at will in order to avert an impending emergency situation.

• Means of escape for persons trapped in the machine, and means of rescue where escape is not possible.

• Measures to ensure complete isolation from power sources (e.g. electrical power) and the dissipation of stored energy in preparation for maintenance and similar activities.

• Measures for the safe handling of heavy loads, including the machinery.

• Measures that enable safe access to, or entry into, the relevant parts of the machinery.

Emergency stop function

• Emergency stop actuators, such as mushroom-type switches, shall be clearly identifiable, readily accessible, and capable of being actuated rapidly.

• When an emergency stop command is given by actuating an emergency stop device such as a switch, the machine shall come to a stop as quickly as possible without creating additional hazards.

• The effect of the emergency stop command shall be sustained until it is reset (i.e. the machine shall remain in the stopped condition).

• Resetting the emergency stop command (i.e. reset of the emergency stop switch) shall be possible only at that location where the emergency stop command was initiated.

• The reset of the emergency stop command shall not restart the machinery, but only permit restarting.

Measures for the escape and rescue of trapped persons

• Providing escape routes to the outside or temporary shelters where persons can evacuate safely

• Providing arrangements for moving some elements by hand, after an emergency stop command

• Providing arrangements for reversing (the movement/rotation of) some elements

• Devices that enable safe descent and anchors for such devices

• Means of communication to enable trapped operators to call for help

Measures for isolation and energy dissipation

• capability of isolating (disconnecting, separating) the machine (or defined parts of the machine) from all power supplies

• locking (or otherwise securing) with a padlock or similar device, all the isolating units in the isolating position

• dissipating or, if this is not possible or practicable, containing any stored energy which can give rise to a hazard

Safe handling of heavy component parts

Heavy machines shall be provided with, or be capable of being provided with, suitable attachment devices for transport by means of lifting gear.

• Lifting accessories such as slings, hooks, eyebolts, or tapped holes for appliance fixing shall be provided.

• Fork locating devices for machines to be transported by a lift truck shall be provided.

Measures for safe access to machinery

• Machinery shall be so designed as to enable all tasks to be carried out as far as possible by persons remaining at ground level. Where this is not possible, machines shall have built-in platforms, stairs or other facilities to provide safe access for those tasks.

• Means of access to parts of machinery located at height shall be provided with protective means against falls (for example, stairways, stepladders, safety cages for ladders, and fall-arrest anchorage)

• The walking areas shall be made from materials which remain slip resistant.

• Control devices, such as panel-mounted switches, shall be designed and located so as to prevent them from being used as aids for access, for example, as a footstool.

Where risks remain despite inherently safe design measures and safeguarding, the residual risks shall be clearly communicated to users of the machine as the information for use.

Information for use shall cover every aspect of machine operation, such as transport, assembly and installation, commissioning (start-up, acceptance, handover, transfer), setting (arrangements, etc.), teaching/programming or process changeover, operation, cleaning, fault/failure detection and maintenance; and, if necessary, dismantling, disabling and scrapping.

Information for use shall include:

• all information necessary to ensure safe and correct use of the machine in terms of its intended use.

• notifications and warnings concerning residual risk. Information on the need for training, the need for personal protective equipment, and the need for additional guards or protective devices shall also be included, where applicable.

• warnings concerning risks arising from the use of the machine in a way not intended or from reasonably foreseeable misuse, and others.

Warning of hazardous events using signals and warning devices

Indicator/flashing lights or buzzers/sirens may be used to warn of the machine status, provided that such signals:

• are emitted before the occurrence of the hazardous event, and

• are clearly recognizable by humans.

These warning devices shall be easy to inspect. (If inspection is time-consuming, there is a risk that regular inspections may be neglected.)

Attention shall also be paid to avoiding sensory fatigue or disabling of the warning devices as a result of frequent activation.

Markings, written warnings, and signs (pictograms)

• Name and address of the manufacturer, designation of product series or type, and serial number (if any)

• Markings indicating compliance with applicable requirements (e.g. CE marking, UL marking)

• Various caution or warning markings (Note: signs or written warnings indicating only “Danger” shall not be used. Instead, the nature of the danger shall be specifically indicated.)

• Signs (pictograms) are more readily understandable than written warnings, so they should be used preferentially.

• Written warnings shall be provided firstly in the language(s) of the country in which the machine will be used, and, on request, in the language(s) understood by operators.

Accompanying documents (in particular — instruction handbook)

1. Information relating to transport, handling and storage of the machine

2. Information relating to installation, start-up, acceptance, handover, and transfer (commissioning) of the machine

3. Information relating to the machine itself

4. Information relating to the use of the machine (e.g. intended use, reasonably foreseeable misuse and prohibited applications, required personal protective equipment, and required training)

5. Information for maintenance, with clear distinctions between, for example:

• Instructions relating to maintenance operations which need to be carried out exclusively by skilled persons (for example, maintenance staff, specialists)

• Instructions relating to maintenance actions that may be carried out by users (for example, operators)

6. Information relating to dismantling, disabling and scrapping

7. Information for emergency situations, such as the operating method in the event of breakdown and the type of fire-fighting equipment to be used

Instruction handbook

The following applies to the production and presentation of the instruction handbook.

1. The type font and size of print shall ensure the best possible legibility. Safety warnings and/or cautions should be emphasized by the use of colors, symbols and/or large print.

2. The information for use shall be provided firstly in the language(s) of the country in which the machine will be used, in the original version of the instruction handbook. If more than one language is to be used, each should be easily distinguishable from one another, and efforts should be made to keep the translated text and relevant illustration together.