“We need a guard here.”
That sentence appears very early in many design reviews. A moving part is visible. There is a crushing point, a drawing-in hazard, or a shear point. So the default answer becomes a guard, an interlock, a light curtain, or perimeter guarding/fencing.
Maybe that answer will be needed. But at that point, you do not know yet.
Real risk reduction for machinery does not start by choosing a better guard around an unchanged hazard. ISO 12100 starts one step earlier: with the machine itself. Can the relative position of parts be changed so the crushing point no longer exists? Can a sharp edge be rounded, folded, or removed? Does the moving part really need that mass and speed? Can force, energy, pressure, or temperature be limited at the source?
That is the uncomfortable engineering question. Not “what do we add around it?” but “what can we change so the hazard disappears or the risk is lower before anyone reaches for a safeguard?”
Risk reduction for machinery starts before the guard
ISO 12100 is blunt about the order. The first and most important step is the use of inherently safe design measures. These measures eliminate hazards or reduce risk by changing the design features, operating parameters, process, or human-machine interaction.
They do not merely separate a person from an existing hazard. They change the hazard.
That may mean changing geometry. It may mean reducing speed, mass, pressure, stored energy, temperature, noise, vibration, dust, or ignition potential. It may mean choosing another material, drive technology, or production process. It may mean improving stability by changing the mass distribution or centre of gravity. It may mean moving adjustment/setting points, lubrication points, and maintenance points outside the hazard zone.
It may also mean asking a bigger question: why does the operator need to do this task at all?
ISO 12100, clause 5.4, requires the designer to identify machine operations and the tasks performed by people interacting with the machine. Feeding material. Removing product. Adjustment/setting. Cleaning. Clearing jams. Detecting defects. Maintenance. Changeover.
It is easy to treat that task list as fixed. The operator performs the task, so we design a safe way to perform it. That logic is common. It is also often one question too late.
Does the operator really need to perform the task?
Manual feeding can sometimes be mechanised. Part removal can be automated. A lubrication point can be moved outside the hazard zone. Better reliability can reduce the number of jams and failures that require intervention. A better detection concept can eliminate repeated sensor adjustment during changeover.
Removing a task does not always remove the hazard from the machine. But it can remove the hazardous situation or sharply reduce exposure. That matters. Exposure is not paperwork. Exposure is a person leaning into moving equipment because the process keeps asking them to.
Of course, any change can create new hazards. Automation can introduce a new crushing point. Remote adjustment can introduce accidental setting changes. Better guarding can make cleaning harder and encourage bypassing. So after each step, the risk assessment must be repeated. That is not bureaucracy. That is engineering reality.
Step one is not selecting a better guard
The first mistake often appears in the language used around machine safety.
“We designed the guard.”
“We added the interlock.”
“We allowed for a light curtain.”
“We used a safety controller.”
All of those measures may be valid. They may be included in the first 3D model. They may be essential to reach an acceptable level of safety.
But that does not make them step one.
A guard does not become an inherently safe design measure just because it was designed together with the machine. ISO 12100 separates these concepts clearly. An inherently safe design measure eliminates a hazard or reduces risk through the design or operating characteristics of the machine. A guard or protective device reduces risk associated with a hazard that has not been eliminated or sufficiently reduced by design.
The timing is not the issue. The cost is not the issue. The CAD layer is not the issue.
The issue is what actually changed in the machine.
Did the crushing point disappear? Did the energy of the moving element decrease? Was the sharp edge removed? Was emission reduced at source? Does the system behave safely after energy loss? Does the operator still have to perform the hazardous task?
If the hazard remains unchanged and the added measure only prevents or controls access to it, you are usually already in step two: safeguarding/protective measures.
Take a simple mechanism where two parts create a crushing point. You can enclose the mechanism with a guard and monitor the guard position with an interlock. That may be necessary. But first you should ask whether the relative position of the parts can be changed so the gap is safe for the body part under consideration, or so that body part cannot enter the gap at all.
In the first case, you protect the person from an existing crushing point. In the second, you remove the crushing point through machine geometry.
The same applies to motion. You can detect a person and stop the dangerous movement. You can also first ask whether the element really needs that speed, that mass, and that stored energy.
This does not mean guards or safety functions are optional decoration. Step one will not always reduce risk enough. ISO 12100 does not demand that safeguarding be avoided at any cost. It demands the correct order of thinking.
The right first question is not:
“What safeguard did we add?”
The right first question is:
“Which dangerous property of the machine did we actually change?”
If the answer is “none”, step one probably has not been done yet.
“The geometry is finished. Now let’s add safety.”
This is one of the most expensive sentences in machine design.
The mechanical model is approved. Strokes are fixed. Actuators are selected. The frame is out for quotation. Only then does somebody analyse human access and discover crushing, cutting, impact, drawing-in, or entanglement hazards.
At that point nobody wants to change the geometry. So the team starts adding safety.
A guard. A fence. An interlock. A light curtain.
ISO 12100 points in the opposite direction. Clause 6.2.2.1 identifies the shape of the machine and the relative position of its parts as some of the first areas to use for eliminating hazards.
If two moving elements create a crushing point, the designer should first check whether their relative position can be changed. The minimum gap may be increased so the relevant body part can be present without being crushed. Or the gap may be reduced so that body part cannot enter it.
This is not about keeping the person away from the existing hazard by means of perimeter guarding/fencing or safety distance. It is about designing the machine parts so the crushing point no longer exists for the foreseeable contact.
That distinction is fundamental.
In one case, the hazard remains and access is restricted. In the other, the mechanism is changed so the considered movement cannot cause that specific injury.
The same thinking applies to sharp edges, corners, protruding parts, rough surfaces, and openings where a body part or clothing can be trapped. If an edge can be rounded, folded, capped, or made flush, it is hard to justify leaving it sharp and pushing the problem into the instruction handbook.
“Beware of sharp edge” is not a serious answer if the edge does not need to be sharp.
Machine geometry also decides visibility. If safe operation requires the operator to supervise the working area or hazard zone, the operator must actually be able to see it from the control position. A blind spot is not fixed by telling people to take extra care before start-up.
First check whether the machine shape, control station position, or component layout can be changed. Only when direct visibility is not possible should indirect viewing aids, such as correctly positioned mirrors or camera systems, be considered.
Geometry also decides posture. Can the operator reach the controls without leaning over the hazard zone? Does adjustment/setting force a hand between mechanisms? Does the design place the worker in a position where safe movement is harder and escape is slower?
This is not comfort engineering. It is risk reduction by design.
Yes, geometry changes can affect function, footprint, cycle time, and cost. Not every change is possible. Not every change will reduce risk enough. But those limits cannot be assumed just because the model has already been approved.
Before asking where to mount the guard, ask the better question:
Why were the machine parts arranged in a way that created this hazard?
The answer will show whether a protective measure is truly necessary, or whether it is being used to avoid changing finished geometry.
Risk reduction for machinery: remove tasks before you protect tasks
Clause 5.4 of ISO 12100 requires identification of machine operations and human tasks throughout the machine life cycle. In practice, the list often includes material feeding, product removal, adjustment/setting, cleaning, clearing jams, defect detection, maintenance, and changeover.
Here is the trap: once a task appears on the list, the team starts designing a safe way to do it. Select the operating mode. Add a guard. Add an interlock. Add an enabling device. Write a procedure.
Sometimes that is exactly what is needed. But the task list is not sacred. It describes how people interact with the current design. It does not have to describe the final machine.
Every task deserves one extra question:
Must this task still exist in the final design?
Case 1: the operator “just straightens” the material
At the transition between a conveyor and the next machine section, the material occasionally arrives skewed. The operator sees it, walks over, and manually corrects the position.
It takes seconds. It is not treated as a breakdown or formal changeover. The operator is “just straightening the part”.
But during those few seconds, the person reaches into a place where the conveyor, pusher, or another mechanism may move. The risk assessment now includes a task: clearing a jam or correcting material position.
The obvious answer?
Close the access. Add an interlock. Create a manual mode. Write a safe jam-clearing procedure.
Some of those measures may still be needed. But first ask the harder question:
Why is the material misaligned in the first place?
Is there a gap or height difference between conveyors? Do the guides control the material across the full expected range? Are the speeds synchronised? Does a sudden acceleration rotate or tip the product? Can an incorrectly positioned item be detected and rejected automatically before it blocks the next operation?
If the intervention is caused by unreliable feeding, the designer should first work on that reliability. ISO 12100, clause 6.2.13, recognises that higher equipment reliability reduces events requiring human intervention and therefore reduces exposure to hazards.
Changing the transfer geometry, the material guidance, or the motion parameters may remove a task that used to happen several times per shift.
That is not a safer way to straighten material. That is removing the reason the operator had to straighten it.
The hazards have not all vanished. Real jams, damaged product, contamination, and unusual materials still have to be considered. But predictable interventions caused by normal process behaviour have been reduced. That is a major shift: from protecting against the consequence to changing the cause.
Case 2: the sensor must be adjusted inside the hazard zone
The machine runs different material types. The sensor selected in the design does not cover the required detection range, or it must be repositioned depending on the material being processed.
So during changeover, the operator enters the hazard zone and manually adjusts the sensor.
Again, the risk assessment gets a clear task: sensor position adjustment during material changeover.
You can design safe access. Stop the machine. Prevent start-up. Apply LOTO where required. Provide a suitable mode and changeover procedure.
But should that be the first answer?
If the machine is intended to process a defined material range, the properties of those materials are part of the machine limits. The detection system should be selected for the whole foreseeable operating range, not only for one convenient variant.
The first option is therefore a sensor or detection technology that provides the required performance across all intended materials. That connects directly with ISO 12100, clause 6.2.4: selecting appropriate technology.
This does not mean choosing the sensor with the largest possible range by default. A larger detection area can cause false detection or reduce discrimination between materials. The solution must be selected and validated for the real process.
But if the correct sensor eliminates repeated repositioning, the task requiring entry into the hazard zone also disappears.
And if one fixed detection range is not technically possible?
Then check whether the adjustment/setting must happen at the sensor itself. The adjustment mechanism may be routed outside the hazard zone or designed so the operator changes the setting from a safe position. ISO 12100, clause 6.2.15, points directly to placing adjustment and maintenance points outside hazard zones where possible.
Instead of designing safe entry to the sensor, you change where the adjustment is performed.
The thinking is the same in both cases. Identify the human task. Then do not ask only how to safeguard it. Ask why it exists, whether it is caused by the machine function or by a design limitation, whether the machine can take it over, and whether it can be moved outside the hazard zone.
Sometimes the best risk reduction during changeover is not a safer way to enter the hazard zone. It is not needing to enter it.
Before adding a safeguard, ask what can change in the machine
ISO 12100 does not provide one magic answer for every hazard. Clause 6.2 does, however, point to concrete areas where designers should look for ways to eliminate hazards or reduce risk by design.
The table below does not mean guards, safety functions, warnings, or procedures are wrong. A guard, protective device, or procedure may be necessary later. The point is simple: do not reach for step two before you have seriously tested step one.
| Before you immediately... | Check in step one... | Machine-level example |
|---|---|---|
| tell the operator to watch the zone carefully | whether the design gives real visibility | change the machine shape or control station position, reduce blind spots, or use a properly located mirror only where direct visibility is not possible |
| guard a crushing point | whether geometry can remove it | increase the gap so the relevant body part is not crushed, or reduce it so that body part cannot enter |
| label a sharp edge | whether the edge must be sharp | round, fold, deburr, cap, or flush the sheet metal edge or open tube end |
| write a safe reaching instruction | whether the machine shape gives safe posture and access | move controls, avoid leaning over mechanisms, and prevent reaching between moving parts |
| define a protective field around a moving part | whether force, mass, speed, or energy can be reduced | use a smaller actuator, lower pressure, a lighter moving element, or only the speed required by the process |
| enclose a noise source or issue hearing protection | whether noise can be reduced at source | change drive type, speed, stiffness, joint design, or process parameters |
| isolate the operator from vibration | whether the vibration source can be changed | balance rotating parts, change mass distribution, or alter motion frequency and amplitude |
| design ventilation for dust | whether dust generation can be reduced | use granulate instead of powder, or milling instead of grinding where the process allows |
| shield a radiation source | whether the source and power level are necessary | remove the source, reduce power to the required value, or focus the beam on the target |
| add repeated inspections to compensate for weak structure | whether the structure is correctly calculated and manufactured | dimension parts correctly, choose suitable joints, prevent overload and fatigue, and balance rotating parts |
| protect people from part fracture | whether material and safety factors are suitable | consider corrosion, ageing, wear, brittleness, flammability, and real cyclic loads |
| safeguard a hazardous technology | whether another technology can be selected | use an electric drive instead of pneumatic where appropriate, waterjet instead of mechanical cutting, or a process below ignition temperature |
| assume a part will return by spring force or gravity | whether positive mechanical action is possible | use direct or rigid actuation of the second element, such as positively opening contacts |
| tell users to place the machine on a level floor | whether the machine is stable in foreseeable conditions | change the base, mass distribution, centre of gravity, or account for dynamic forces and wind |
| write a special service procedure | whether the machine is maintainable by design | provide access for human dimensions, clothing, and tools, and reduce the need for special tools |
| train the operator not to make mistakes | whether the human-machine interaction invites mistakes | provide a clear HMI, unambiguous controls, good working posture, and avoid forcing the operator into the rhythm of an automatic cycle |
| mark an electrical hazard | whether electrical equipment is designed safely | provide correct isolation, switching, and protection against electric shock |
| add a high-pressure alarm | whether the system can prevent dangerous pressure rise | use suitable pressure limitation and design for foreseeable fluctuations |
| warn about stored energy after shutdown | whether stored energy can be removed automatically | automatically discharge reservoirs or accumulators and vent residual pressure in a controlled way |
| use emergency stop as the answer to unexpected behaviour | whether the control system behaves safely | prevent movement on power-up, prevent automatic restart, maintain stopping, and hold loads after energy loss |
| focus only on the safety controller | whether all parts performing the function have suitable reliability | consider predictable failure behaviour, redundancy, fault detection, and diversity of technologies |
| prepare a procedure for frequent fault clearing | whether events requiring intervention can be reduced | improve material guidance, eliminate jams, use more durable components, and provide diagnostics that do not require bypassing safeguards |
| safeguard manual feeding or part removal | whether the task can be mechanised or automated | use a conveyor, manipulator, pusher, chute, or automatic rejection of wrongly positioned material |
| design safe entry to an adjustable component | whether adjustment can be eliminated or moved outside the zone | select a sensor covering all intended materials or route the adjustment mechanism outside the hazard zone |
| safeguard access to a lubrication point | whether the point must be inside the hazard zone | use a lubrication line, central lubrication, or an external service point |
This table is not a checklist to tick without thinking. Some methods will not be possible. Some changes may create new hazards or affect the core function of the machine.
But these are the questions that should be asked before moving to step two.
After each measure, ask one control question:
What did we really change: the hazard, the risk level, or only human access to the hazardous place?
If the only answer is “we added a guard and a safety function”, you have described a safeguarding measure. You have not yet shown that step one was actually performed.
When can you move to step two?
After working through inherently safe design measures, it is possible to swing too far the other way. Some people start acting as if every guard proves a design failure.
No.
Some hazards cannot be removed without destroying the machine’s basic function. A cutting tool must remain sharp. A press must generate the force required for the process. A working element must move. A material may require a process that creates noise, dust, or heat.
Step one will not always eliminate the hazard. It should reduce the associated risk as far as reasonably practicable by design.
You may reduce motion energy, but not below the value needed for the machine to work. You may improve geometry, but not remove every dangerous area. You may reduce operator interventions, but cleaning, maintenance, and abnormal process disturbances will remain.
That is why ISO 12100 includes step two.
But step two does not start because a guard is the easiest answer. Clause 6.1 calls for safeguarding/protective measures and complementary protective measures when hazards cannot be eliminated, or risk cannot be sufficiently reduced, by inherently safe design measures.
There is a big difference between “it is not practicable” and “we do not want to change the design anymore”.
Before moving to step two, check whether you have:
- considered all operating modes of the machine;
- analysed all foreseeable human interventions;
- reviewed geometry, energy, material, technology, and process choices;
- reduced jams, failures, and access-demanding events where practicable;
- moved adjustment/setting and maintenance points outside hazard zones where possible;
- checked whether the chosen changes created new hazards;
- checked whether the changes worsened usability or working conditions.
The last point is not cosmetic. A measure that makes normal work awkward, slows changeover, or blocks practical clearing of typical disturbances can encourage bypassing. A good risk reduction strategy must consider how measures work together and how people will actually use the machine on the shop floor.
The assessment also does not end after a measure is selected. ISO 12100, clause 5.6, requires checking after each step whether risk has been adequately reduced and whether new hazards have been introduced.
A geometry change may improve safety but make maintenance harder. Automatic feeding may remove manual handling but create a new crushing point. Remote adjustment may reduce exposure but allow accidental setting changes. A guard may control access but increase the temptation to defeat it if it blocks routine work.
Every answer creates the next question.
That is not a weakness of the method. That is the method.
A guard is not proof of poor design. It may be the correct and necessary protective measure. The problem starts when the guard replaces the analysis of what could have been changed in the machine itself.
Step two does not begin when the design team runs out of patience. It begins when the possibilities of step one have been genuinely examined, the machine has been changed where practicable, and the remaining risk still needs safeguarding.