ANSI B11.0-2023
ANSI B11.0-2023
ANSI B11.0-2023
0 – 2023
Safety of Machinery
ANSI-Accredited Standards Developer and Secretariat:
American National Standards are promulgated through ANSI for voluntary use; their existence does not in any respect
preclude anyone, whether they have approved the standards or not, from manufacturing, marketing, purchasing, or using
products, processes, or procedures not conforming to the standards. However, users, distributors, regulatory bodies,
certification agencies and others concerned may apply American National Standards as mandatory requirements in
commerce and industry.
Neither B11 Standards, Inc. nor any of the organizations or individuals that assisted in authoring, developing,
editing or distributing this standard (B11 Standards, Inc. and such organizations and individuals collectively
referred to as the “Contributing Parties”) makes any warranty, either expressed or implied, as to the fitness of
merchantability or accuracy of the information contained within this standard. The Contributing Parties disclaim
and make no warranty that the information in this document will fulfill any of your particular purposes or needs.
The Contributing Parties disclaim liability for any personal injury, property or other damages of any nature
whatsoever, whether special, indirect, consequential or compensatory, directly or indirectly resulting from the
publication, use of, application or reliance on this document. The Contributing Parties do not undertake to
guarantee the performance of any individual manufacturer or seller’s products or services by virtue of this
standard or guide, nor does it take any position with respect to the validity of any patent rights asserted in
connection with the items which are mentioned in or are the subject of this document. The Contributing Parties
disclaim liability for the infringement of any patent resulting from the use of or reliance on this document. Users
of this document are expressly advised that determination of the validity of any such patent rights, and the risk
of infringement of such rights, is entirely their own responsibility.
In publishing or making this document available, the Contributing Parties are not undertaking to render
professional or other services for or on behalf of any person or entity, nor are the Contributing Parties undertaking
to perform any duty owed by any person or entity to someone else. Anyone using this document should rely on
his or her own independent judgment, or as appropriate, seek the advice of a competent professional in
determining the exercise of reasonable care in any given circumstances. In addition to conforming to the
requirements of this standard, the responsible personnel need to also make an independent determination as to
whether a machine, activity or condition complies with the applicable legal requirements in the relevant
jurisdiction(s).
B11 Standards, Inc., has no power, nor does it undertake to police or enforce conformance to the requirements of this
document. B11 Standards, Inc., does not certify, test or inspect products, designs, or installations for safety or health
purposes. Any certification or other statement of conformance to any health or safety-related information in this document
shall not be attributable to B11 Standards, Inc., and is solely the responsibility of the certifier or maker of the statement.
The American National Standards institute does not develop standards and will in no circumstances give an interpretation
of an American National Standard. Moreover, no person shall have the right or authority to issue an interpretation of an
American National Standard in the name of the American National Standards Institute. Requests for interpretations should
be addressed to the Secretariat (B11 Standards, Inc.).
NOTICE: This American National Standard may be revised or withdrawn at any time. The procedures of the American
National Standards Institute require that action be taken periodically to reaffirm, revise, or withdraw this standard. You
may contact the Secretariat for current status information on this, or other B11 standards.
FOREWORD ........................................................................................................................................... 8
Overview and History..................................................................................................................... 8
Changes from prior edition ........................................................................................................... 8
Application ..................................................................................................................................... 9
General ........................................................................................................................................... 9
Objective ...................................................................................................................................... 10
Alignment ..................................................................................................................................... 10
New Terminology ......................................................................................................................... 11
Context ......................................................................................................................................... 11
Effective Date ............................................................................................................................... 11
Development ................................................................................................................................ 12
INTRODUCTION ................................................................................................................................... 13
1 SCOPE .......................................................................................................................................... 17
2 NORMATIVE REFERENCES......................................................................................................... 18
3 DEFINITIONS ................................................................................................................................ 19
4 RESPONSIBILITIES ...................................................................................................................... 32
4.1 General ............................................................................................................................... 32
4.2 Collaborative efforts .......................................................................................................... 32
4.3 Responsibilities of the component supplier and component user / machine supplier .. 33
4.3.1 Integration............................................................................................................. 34
4.3.2 Documentation ...................................................................................................... 34
4.3.3 Engineering controls ............................................................................................. 34
4.4 Responsibilities of the Integrator / modifier / rebuilder.................................................... 35
4.5 Responsibilities of the machine user ................................................................................ 35
4.5.1 Training of user personnel ..................................................................................... 35
4.5.2 Cleaning ............................................................................................................... 35
4.5.3 Operational working space .................................................................................... 36
4.6 Specifications for custom machinery ............................................................................... 36
4.7 Responsibilities of co-manufacturers ............................................................................... 36
4.7.1 General ................................................................................................................. 36
4.7.2 Supplying an entire machine or system ................................................................. 36
4.7.3 Training personnel ................................................................................................ 36
4.8 Machinery as a Service ...................................................................................................... 37
4.9 Purchasers of used machinery ......................................................................................... 37
4.10 Personnel responsibilities ................................................................................................. 37
5 LIFECYCLE REQUIREMENTS AND RESPONSIBILITIES ............................................................ 38
5.1 General ............................................................................................................................... 38
5.2 Design, construction and information for operation and maintenance........................... 40
5.4 Operation and maintenance .............................................................................................. 40
5.5 Modifying or rebuilding existing (legacy) machinery ....................................................... 41
5.6 Decommissioning .............................................................................................................. 41
9 SUPERVISION .............................................................................................................................. 73
10 TRAINING ..................................................................................................................................... 73
10.1 General ............................................................................................................................... 73
10.2 Training elements .............................................................................................................. 73
10.2.1 General ................................................................................................................. 73
10.2.2 Training program(s)............................................................................................... 74
10.2.3 Trainer qualifications ............................................................................................. 75
10.3 Operator training ................................................................................................................ 75
10.4 Maintenance personnel training ........................................................................................ 76
10.5 Supervisor training ............................................................................................................ 76
10.6 Retraining ........................................................................................................................... 76
LIST of FIGURES
Figure 1 — Illustration of relationship between ISO 12100 and ANSI B11.0 10
Figure 2 — Organization of the B11 Series of Documents 13
Figure 3 — How to use type-C standards 14
Figure 4 — Example of Machinery Lifecycle Responsibilities 33
Figure 5 — Machinery and equipment lifecycle stages 38
Figure 6 — The Risk Assessment Process 43
Figure 7 — Elements of Risk 46
Figure 8 — Two Stage Iterative Approach to the Hierarchy of Controls and Risk Reduction 77
Figure 9 — Illustration of the process of the supplier and user risk reduction efforts 79
Figure 10 — Layout Analysis Process 106
Figure 11 — Risk reduction for special mode 108
Figure 12 — ANSI standards applicable in the United States 118
LIST of TABLES
Table 1 — Requirements for New and Existing Machinery 39
Table 2 — Example Risk Scoring System 47
Table 3 — The Hazard Control Hierarchy 49
Table 4 — Example of relations between Hazard, Safety Function and Risk Reduction 55
Table 5 — Noise Source and Noise Reduction Methods (Informative) 70
Table 6 — Potential Effects/Additional Characteristics of Risk Reduction Measures 80
Table 7 — Machinery Hazards 85
Table 8 — Guidance for Estimating Injury Severity 90
Table 9 — Considerations for Probability of Occurrence 95
Table 10 — MIL-STD-882E Risk Scoring System [4x5] 96
Table 11 — RIA TR R15.306-2016 Risk Level Decision Matrix 97
Table 12 — RIA TR R15.306-2016 Injury Severity, Exposure, and Avoidance Categories 98
Table 13 — ANSI / ASSP Z10 Risk Scoring Matrix 99
Table 14 — Sample Risk Assessment 103
Table 15 — Manual Content 111
Table 16 — Low / Reduced Speed Values in Ascending Order with References 125
Table 17 — Low / Reduced Force Values in Ascending Order with References 127
Table 18 — Low/reduced kinetic energy values in ascending order with references 128
Table 19 — Low / Reduced Pressure Values in Ascending Order with References 128
Table 20 — Recommended Performance of Safety Levels for Reduced-Energy Operating Modes 130
FOREWORD (This Foreword is not part of the requirements of this ANSI B11.0 standard on Safety of Machinery)
This American National Standard was promulgated by the B11 Standards Development Committee as a
voluntary consensus standard to establish and specify general safety requirements for the design,
construction, operation and maintenance (including installation, dismantling and transport) of machinery and
machinery systems. This standard also applies to devices that are integral to these machines.
This standard was first published in 2008 as ANSI B11.GSR (General Safety Requirements). It was
substantively revised and re-designated as ANSI B11.0 in 2010. The standard was again revised and
published in 2015; that third edition of this standard added responsibilities related to machinery components,
clarified the relationship between the risk assessment for the machine and the design specification for control
systems, provided additional information on documentation requirements, included new subclauses on
supervision and training, presented new annexes correlating machinery safety standards in the U.S. and
EN/ISO, and generally clarified and simplified text in the standard. The 2020 edition of B11.0 provided
additional or improved guidance in several key areas such as existing (legacy) equipment, prevention through
design, how to achieve acceptable risk and validate/verify (check, test, confirm) risk reduction measures. It
also included new content on alternative methods for the control of hazardous energy, manual and special
operation modes, and machinery systems dealing with aspects such as layout analysis and spans of control.
Application
The concepts and principles contained in this standard can be applied very broadly to a wide variety of systems
and applications. Documented risk assessments were first introduced to the machine tool industry in 2000
with the publication of (ANSI) B11.TR3 – Risk Assessment and Risk Reduction – A Guide to Estimate, Evaluate
and Reduce Risks Associated With Machine Tools; to the robot industry in 1999 with the publication of
ANSI/RIA R15.06-Requirements for Industrial Robots and Robot Systems; and to the packaging machinery
industry in 2006 with the publication of ANSI / PMMI B155.1-Safety Requirements for Packaging Machinery
and Packaging-Related Converting Machinery. Since that time, the principles of the risk assessment process
have been employed in a wide variety of diverse applications – including traffic control, consumer products,
process safety, incident investigations and, of course, machinery. Interested readers are encouraged to apply
these principles and concepts to other systems in addition to machinery as suits their needs.
General
“Safe” is the state of being protected from recognized hazards that are likely to cause physical harm. There
is no such thing as being absolutely safe, or in other words, a complete absence of risk. In turn, there is no
machine that is absolutely safe. All machinery contains hazards, and some level of residual risk. However,
the risk associated with those hazards should be reduced to an acceptable level.
This standard guides machinery suppliers and users through a risk assessment process that identifies hazards
and reduces corresponding risks to an acceptable level. In this standard, the terms “acceptable” and
“tolerable” are used as synonyms. Although engineers have long applied an informal risk assessment
framework, this standard includes a formal method to conduct and document the risk assessment process.
This standard identifies some preparations that need to be made before a risk assessment begins, and
presents the basic risk assessment process in a step by step approach to assist in achieving this goal.
The outcome of completing the risk assessment process should be:
• a clear understanding of risk(s) including the potential severity of harm and the probability of the
occurrence of harm;
• risk reduction measures appropriate to the circumstances;
• machinery with risks reduced to an acceptable level;
• documentation of the risk assessment.
This standard reflects the best industry practice at the time of its approval. The inclusion or omission of
language relative to any evolving technology, either in the normative or informative areas of this standard, in
no way infers acceptance or rejection of such technologies. The presentation style used in this standard mixes
both informative and explanatory text with normative requirements and was chosen to enhance the readability
of the information. The distinction between these texts is illustrated as follows:
The normative text (requirements) appears aligned to the left margin. To meet the requirements of this
standard, machinery suppliers and users need to conform to these normative requirements. These
requirements typically use the verb “shall.” Informative text (recommendations and/or guidance) appears as:
Informative text
The informative or explanatory text in this standard appears as indented Informative Notes in italics, in a reduced
font size, left justified (vs. full justification), and colored purple (for those with electronic or color printed versions),
all of which are in an effort to provide a strong visual signal/reminder to the reader that this is informative text, not
normative text, and is not to be considered part of the requirements of this standard; this text is advisory in nature
only. The suppliers, the users and the machines themselves are not required to conform to the informative text.
The machine-specific “base” (type-C) safety standards all use the more traditional ANSI two-column format, and
the informative text appears as the right-hand column and is titled “Explanatory Information.” This standard uses
the single column format common to many international standards. The informative text is presented in this
manner in an attempt to enhance readability and reduce confusion.
Prevention Through Design or PTD is a recent term in industry. The objectives of risk assessment, risk
reduction and elimination of hazards as early as possible are integral and not new to this document. The
phrase "Prevention Through Design" is used within this document, as are other equivalent terms such as
“elimination by design,” "design out," and "substitution" to thoroughly address risk assessment and apply it to
the lifecycle and operations of the machine.
Objective
The objective of the B11 series of standards is to eliminate injuries to personnel working with or around
machinery or machinery systems by establishing requirements for the design, construction, reconstruction,
modification, installation, set–up, operation and maintenance of machinery or machine systems. This standard
should be used by suppliers and users, as well as by the appropriate Authority Having Jurisdiction (AHJ).
Responsibilities have been assigned to the supplier (i.e., manufacturer, the re-constructor, and the modifier),
the user, and the user personnel to implement the requirements of this standard. This standard is not intended
to replace good judgment and personal responsibility. Personnel skill, attitude, training and experience are
safety factors that need to be considered by the user.
Applying risk reduction measures to machinery is complicated by the wide variety of operations and operating
conditions, including, but not limited to the following:
• the variations in size, speed, and type of machinery used;
• the size, thickness, and kind of pieces to be worked;
• the required accuracy of the finished work; the skill of operators;
• the length of run; and
• the method of feeding, including part and scrap removal.
Because of these varying factors in the operations and in the workplace, a wide variety of risk reduction
measures have been covered in this standard as well as the machine-specific “base” (type-C) safety standards.
Alignment
This standard has been aligned with international standards (primarily ISO, but ASTM and IEC as well) and
European (EN) standards by the introduction of hazard identification and risk assessment as the principal
method for analyzing hazards to personnel to achieve a level of acceptable risk. This standard integrates the
requirements of ISO 12100:2010, as well as selected U.S. standards.
In 2012, ISO 12100 was adopted as an American National Standard and re-designated as ANSI / ISO 12100-
2012 IDT (the “IDT” in the official alpha-numeric ANSI designation means identical and virtually unchanged
from the ISO version).
ISO 12100 was used as one of the principal resource documents in developing ANSI B11.GSR (and by
extension, ANSI B11.0). However, the technical requirements of ISO 12100 have undergone little change
since the early 1990s (the content of ISO 12100:2003 parts 1 and 2, and ISO 14121:2007 were editorially
combined without ANY technical changes to create ISO 12100:2010).
In addition, ISO 12100 applies ONLY to the suppliers of machinery and includes NO requirements for users of
machinery. ISO 12100 also applies only to new machinery and excludes machinery made prior to its
publication in 2010. ANSI B11.0 differs from ISO 12100 in that it specifically includes requirements for both
suppliers and end users of machinery. It also includes numerous requirements and informative guidance and
other information related to the safety of machinery which goes beyond that which is contained in ISO 12100.
As a result, conforming with the requirements of ISO 12100 will not assure conformance to the requirements
of ANSI B11.0. Conversely, conforming with the requirements of ANSI B11.0 will automatically result in
conformance to the requirements of ISO 12100. Figure 1 on the following page is a simplistic illustration of
the relationship between these two standards in terms of the ISO vice versa principle.
ANSI B11.0
ISO
12100
This standard contains references to federal Occupational Safety and Health Administration (OSHA)
standards. OSHA standards represent the minimum level of regulatory compliance requirements within the
United States. Federal OSHA-approved individual state safety and health programs/agencies (of which
approximately half of the U.S. states have (e.g., Michigan OSHA, known as MIOSHA, and California OSHA,
known as Cal-OSHA) have standards that may exceed these minimum requirements. Accordingly, the
appropriate standards need to be used. Voluntary consensus standards such as this one represent state of
the art industry practices and often exceed federal regulatory requirements, and these can be, and often are,
used by OSHA compliance officers to augment their dated regulatory standards.
New Terminology
Historically, terms have been used in the B11 community to describe requirements for the safety of machinery.
Experience has shown that certain terms (e.g., safeguarding, or complementary equipment) are often used
imprecisely, even by technical experts. This revision of B11.0 includes an effort to bring better precision to
certain technical terms and has resulted in the deletion of other terms. Although no longer included in B11.0,
these terms should still be used in conversations or communications with audiences that have a shared
understanding of the intended meaning. In addition, some terms are commonly used but not necessarily with
common meanings. As a result, this edition of B11.0 has transitioned to certain new terms, including the
following:
The terms repair, rebuild, refurbish, remanufacture, reconstruct and others are used to describe work done on
existing (legacy) equipment. These terms have been defined for use in this standard, and the requirements
for the work on existing machinery are described in clause 4.
Context
The writers of this standard understand that the reader/user of this American National Standard is unlikely to
read it cover-to-cover but instead (for example), might use the Table of Contents as a sort of ‘roadmap’ to find
a very specific topic and then review only that topic. However, the reader/user of this standard is informed
that the elements (clauses, subclauses, etc.) of these documents are sequenced and often interrelated in such
a way as to state requirements that may very well be dependent on text in a section(s) that precedes the actual
requirement. It therefore becomes vital and important for the user of this standard to ensure they understand
the depth, range and especially the context of the section or topic in which the actual requirement appears.
Effective Date
The following information on effective dates is informative guidance only, and not a normative part of this
standard. The subcommittee recognizes that some period of time after the approval date on the title page of
this document is necessary for suppliers and users to develop new designs, and/or modify existing designs or
manufacturing processes in order to incorporate the new and/or revised requirements of this standard into
their product development or production system.
The subcommittee recommends that suppliers complete and implement design changes for new machinery
and machinery systems within 30 months of the approval of this standard.
The subcommittee recommends that users evaluate whether existing machinery and machinery systems
implement this edition within 30 months of the approval date of this standard using generally recognized risk
assessment methods. If the risk assessment shows that modification(s) is necessary, refer to the requirements
of this standard or the machine-specific “base” (type-C) safety standard to implement risk reduction measures
(protective measures) for appropriate risk reduction.
Development
At the time this standard was approved as an American National Standard, the ANSI-accredited consensus body (B11
Standards Development Committee) was composed of the following Members:
Alan Metelsky, FS, Eng., Chair / Anne Mathias, PE, Vice-Chair / David Felinski, Secretariat
Organizations Represented Delegate Alternate
Aluminum Extruders Council Mel Mitchell, CSP Brad Wyatt, CSP
Amazon Jeread Sines, B11 LMSS, FS Eng Josh Owens, B11 LMSS, FS Eng
American Society of Safety Professionals Ted Sberna, Sr. Anne Mathias, PE
Association for Advancing Automation Carole Franklin Jeff Fryman
Association For Manufacturing Technology Russ Bensman Alan Metelsky, FS Eng
Assoc. for Packaging & Processing Tech. Bruce Main, PE, CSP Tom Egan
The Boeing Company Rhiannon McPherson Mark Ellingson
Bridgestone Kenji Furukawa, FS Eng Joey Hinson, FS Eng
Canadian Standards Association Ana Andronescu, P.Eng. Walter Veugen
Deere & Co. Tony Beeth Scott Winter
Euchner Andy Smith Jilani Bouchane
Exponent Steve Andrew, PE, CSM Alex Zelhofer, PhD, PE
FDR Safety Mike Taubitz Luke Contos, Joe Wolfsberger
Fortress Safety Jenny Tuertscher, B11 LMSS, FS Eng Josh Hill
Honda Development & Mfg. of America Todd Dickey Doug Titus, Tyler Willis
General Motors Corporation Tony Ross Mike Douglas
IDEM Safety Mark Witherspoon Amir Mohtasham
Komatsu America Industries George Schreck James Landowski
Liberty Mutual Craig Karasack, CSP Julie Thompson, CSP
MAG Automotive Erik Carrier Doug Watts
Metal Powder Industries Federation Bill Edwards James Adams
National Inst. for Occupational Safety & Health Rick Current, PE
Occupational Safety & Health Administration Ken Stevanus Mary Bauer, CIH, CSP, B11 LMSS
Omron Scientific Technologies Incorporated Tina Hull, FS Exp
Pilz Automation Safety, LP Mike Beerman, CMSE Dino Mariuz
Plastics Industry Association Jeff Linder Dale Bartholomew
Precision Metalforming Association Jim Barrett, Jr. PhD David Klotz
Presence–sensing Device Manufacturers Assn. Jim Kirton Mike Carlson
Rockwell Automation Darin Magnuson, FS Eng Jonathan Barrett, FS Eng
Rockford Systems Brian Boes Matt Brenner
Safe–T–Sense Mike Poynter, FS Eng Federico Badillo
SICK Product & Competence Centers America Chris Soranno, FS Exp Nate Gose, FS Eng
Sheet Met. & Air Cond. Contract. Nat’l. Assoc. Justin Crandol, CSP Rick Di Ioli
Toyota Motor Manufacturing North America Chip Boertlein Mike Collier, B11 LMSS
At the time this standard was approved, the B11.0 Safety of Machinery Subcommittee had the following
members who participated in and contributed to the development of this American National Standard:
Bruce Main, PE, CSP – Chair design safety engineering, inc. Chris Felinski, Secretary B11 Standards, Inc.
Anne Mathias, PE – Vice-Chair Engineering Systems, Inc. David Felinski, Secretariat B11 Standards, Inc.
Steve Andrew Exponent Brandon Miller Henkel NA
Jim Barrett Link Systems John Piampiano International Paper
Mike Carlson Banner Engineering Pat Rockey Rockwell
Eddie Crawford Rockwell Ted Sberna, Sr. White Horse Safety
Eric Cummings Ross Controls Jeread Sines Amazon
Rick Current NIOSH Chris Soranno SICK PCA
Todd Dickey Honda Marco Tacchini GT Engineering
Mike Douglas General Motors Mike Taubitz FDR Safety
Bryant Eismeier Flexware Innovations Doug Titus Honda
Kenji Furukawa Bridgestone Jenny Tuertscher Fortress Safety
Chris Gerges DAK Machine Safety Jim Van Kessel JVK Safety
Bryan Harrell Eli Lilly Mark Witherspoon IDEM Safety
Heinz Knackstedt Machine Control Safety Scott Whittington Cincinnati
Rhiannon McPherson Boeing Paul Wozniczka MTS Systems
Alan Metelsky Gleason Works
Introduction
Organization and Application of B11 Documents
The B11 series of machinery safety standards and technical reports has aligned with the ISO “type A-B-C”
structure of categorizing standards as described immediately below (and shown in Figure 2).
Type-A standards (basis safety standards) give basic concepts, principles for design, and
general ‘foundational’ aspects that can be applied broadly across different types of machinery;
Type-B standards (generic safety standards) deal with one or more safety aspects or one or
more types of risk reduction measure that can be used/applied across a wide range of machinery
(ISO further divides type-B standards into B1 on safety aspects and B2 on safeguards);
Type-C standards (machine-specific safety standards) deal with detailed safety requirements
for a particular machine or “group of machines” (meaning machines having a similar intended
use and similar hazards, hazardous situations or hazardous events).
The B11 Standards Development Committee recognizes that an additional type of standard has emerged -
these ‘Hybrid’ standards represent an evolutionary development in machinery safety standardization that
combine some unspecified percentage of the typical content and requirements found in any two (or even all
three) of the standard types described above. Usually, they are some combination of requirements generally
found in type-A and type-C standards. With the possible exception of this standard, none of the other
documents in the B11 portfolio fit into this new type, numerous examples of these hybrid machinery safety
standards exist outside of ANSI B11.
This ANSI B11.0 standard on machinery safety is predominantly a “type-A” standard in that it applies to an
extremely broad array of machines and contains general requirements. However, in some sections, it also
contains very specific requirements, hence, the “exception” noted in the paragraph above. B11.19, B11.20,
B11.21, B11.25, B11.26 and the entire B11 series of Technical Reports are all typical “type-B” documents
addressing general safety concepts, subjects and/or elements that can be used across a wide range of
machinery (such as B11.19 on risk reduction measures, B11.26 on functional safety or (ANSI) B11.TR1 on
ergonomics) or as a standard to be used when integrating machinery into a system (B11.20). The B11 series
of Technical Reports are informative documents that may be generally applied to many different machines,
and as such, would all fall within the “type-B” category. The machine-specific “base” (type-C) B11 standards
contain detailed safety requirements for a particular machine type or group of machines (see the list of machine
and machinery system safety standards in subclause 7.19).
Machinery safety depends on the practical application of the risk assessment process. The type-A (B11.0)
and type-B standards are intended to be used concurrently with the type-C (machine-specific) standards during
the risk assessment process, by the supplier and user of machines. See Figure 3.
If a type-C standard exists, for a particular machine or group of machines, the hazards and risk reduction
measures identified in the type-C standard assists the standards user in applying the risk assessment process.
Readers may rely on the type-C standard for this information, subject to any application-specific hazards. If
no type-C standard exists, the reader needs to identify the hazards for the particular application and apply risk
reduction measures accordingly.
When a type-C standard deviates from one or more provisions dealt with by this standard or by a type-B
standard, the type-C standard requirement generally takes precedence. Any deviation in conforming to a
requirement of any standard should be carefully evaluated and based on a documented risk assessment.
This standard is intended for readers with differing levels of familiarity with the B11 series of safety standards
and the risk assessment process. Readers new to these standards may benefit from starting with the B11.0
and then reading the applicable machine-specific B11.x standard, B11.19, and other relevant or appropriate
standards and technical reports. More experienced users may find efficiencies in beginning with the machine-
specific B11.x standard and then reviewing relevant portions of the ANSI B11.0 standard as necessary.
The requirements of the machine-specific ANSI standards are grouped according to those that apply to the
supplier (i.e., manufacturer, rebuilder, modifier) and those that apply to the user. Some are shared between
the supplier and user and are so indicated.
Risk assessment is a scalable process, which simply means that risk assessment can be applied to a single
hazard, to multiple hazards of a simple machine, or to hazards on more complex (automated) machine
systems.
Risk assessment can be applied to new machines, to existing machines, or modified machines. To facilitate
the process, the risk assessment leader may need to create ad hoc teams that meet together, or with
individuals that meet at different times to capture the appropriate information. Much of the risk assessment
process can be conducted quite effectively at the shop floor level in the environment where the tasks and
hazards occur.
New technologies, or new applications of existing technologies rarely have existing industry standards to
describe the hazards and risk reduction measures that can be applied to them. The risk assessment process
as described in ANSI B11.0 may be used to achieve acceptable risk under these circumstances.
The writers of this standard recognize that zero risk does not exist and cannot be attained. However, a good
faith approach to risk assessment and risk reduction should achieve an acceptable risk level.
As of the date of approval of this standard, the ANSI B11 series of American National Standards and Technical
Reports on machinery safety consisted of the following documents shown in the list below. The user should
check a licensed reseller such as ANSI (www.ansi.org) for the current versions of any of these documents. All
archival / historical versions of the documents are available at www.b11standards.org.
List of the ANSI B11 Series of Safety Standards and Technical Reports
# SHORT TITLE / TOPIC YEAR TYPE
B11.0 Safety of Machinery 2023 A
B11.1 Mechanical Power Presses 2009 (R20) C
B11.2 Hydraulic & Pneumatic Power Presses 2013 (R20) C
B11.3 Power Press Brakes 2022 C
B11.4 Shears 2003 (R20) C
B11.5 Ironworkers 1988 (R20) C
B11.6 Manual Turning Machines (Lathes) with or without Auto Control 2001 (R20) C
B11.7 Cold Headers and Cold Formers 2020 C
B11.8 Manual Milling, Drilling, & Boring Machines 2022 C
B11.9 Grinding Machines 2010 (R20) C
B11.10 Sawing Machines 2003 (R20) C
B11.11 Withdrawn (Gear and Spline Cutting Machines; use B11.0 and B11.19) 2001 (R20) C
B11.12 Roll Forming and Roll Bending Machines 2005 (R20) C
B11.13 Single & Multiple-Spindle Automatic Bar and Chucking Machines 2020 C
B11.14 Withdrawn (Coil Slitting Machines; combined into B11.18) (1996) C
B11.15 Pipe, Tube and Shape Bending Machines 2001 (R20) C
B11.16 Powder / Metal Compacting Presses 2014 (R20) C
B11.17 Horizontal Hydraulic Extrusion Presses 2023 C
B11.18 Machines Processing or Slitting Coiled or Non-Coiled Metal 2006 (R20) C
B11.19 Performance Requirements for Risk Reduction Measures (Safeguarding) 2019 B
B11.20 Integration of Machinery into a System 2017 B
B11.21 Machine Tools Using Lasers for Processing Materials 2006 (R20) B
B11.22 Turning Centers and Automatic Numerically Controlled Turning Machines 2002 (R20) C
B11.23 Machining Centers & CNC Milling, Drilling & Boring Machines 2002 (R20) C
B11.24 Transfer Machines 2002 (R20) C
B11.25 Large Machines 2022 B
B11.26 Functional Safety for Equipment / Machine Control Systems 2018 B
B11.27 Electro-Discharge Machines 2020 C
B11.TR1 Ergonomics 2016 B
B11.TR2 Metal Working Fluids 1997 (R16) B
B11.TR3 Withdrawn (Risk Assessment / Risk Reduction Guide; use B11.0) 2000 (R15) B
B11.TR4 Selection of Programmable Electronic Systems (PES/PLC) 2004 (R15) B
B11.TR5 Noise Measurement 2006 B
B11.TR6 Withdrawn (Safety Control Systems for Machines; revised as B11.26) (2010) B
B11.TR7 Integration of Lean and Safety 2007 (R17) B
B11.TR8 Guide to Inspection of Risk Reduction Measures 2022 B
B11.TR9 Cybersecurity 2019 B
B11.TR10 Guidance on Artificial Intelligence into Machinery Safety Applications 2020 B
ANSI / ISO 12100 Safety of machinery (identical adoption of ISO 12100-2010) 2012 A
Safety of Machinery
1 Scope
This type-A standard applies to new, existing, modified or rebuilt power-driven machines, not portable by hand
while working, that are used to process materials by cutting; forming; pressure; electrical, thermal or optical
techniques; lamination; or a combination of these processes. This includes associated equipment used to
transfer material or tooling (including fixtures) to assemble/disassemble, and to inspect or test. The associated
equipment, including logic controller(s) and associated software or logic, together with the machine actuators
and sensors, are considered a part of the machinery.
This standard specifies basic terminology, principles and a methodology for achieving acceptable risk in the
design and the use of machinery. It specifies principles of risk assessment and risk reduction to help designers,
integrators and users of machinery in achieving this objective. These principles are based on knowledge and
experience of the design, use, incidents, accidents and risks associated with machinery. Procedures are
described for identifying hazards and estimating and evaluating risks during relevant phases of the machine
lifecycle, and for the elimination of hazards or the provision of sufficient risk reduction. Guidance is given
regarding the documentation and confirmation of the risk assessment and risk reduction process.
Other industry sectors can benefit from applying this standard. A risk assessment may be required to
determine if a machine-specific “base” (type-C) safety standard adequately covers the hazards associated
with the specific application of a machine.
Where a machine-specific (type-C) safety standard exists, the requirements of the machine-specific “base”
(type-C) safety standard shall generally apply.
Deviations from the requirements of this standard or from any machine-specific (type-C) safety standard shall
be based on a documented risk assessment.
Informative Note 1: Deviating from the requirements of this document should be considered only when it is not
feasible to apply the requirements.
Informative Note 2: See clause 6 for additional information on risk assessment.
Informative Note 3: See 7.19 for a list of example machines covered by other specific standards.
2 Normative References
The following standards contain provisions either in whole or in part which constitute additional requirements
of this American National Standard and are incorporated into this standard by reference. At the time of
publication, the editions indicated below were current.
All standards are subject to revision, and parties to agreements based on this American National Standard are
encouraged to investigate the possibility of applying the most recent editions of the standards indicated below.
Informative Note 1: Not all of the normative standards below will necessarily apply to a specific application.
The reader is responsible for determining and obtaining the normative references that apply to the particular
situation under consideration.
Informative Note 2: The normative standards cited by reference, in turn, include other normative standards.
The reader is responsible for determining and obtaining those ‘secondary’ normative references that may
apply to the particular situation under consideration.
ANSI B11.19–2019 Performance Requirements for Risk Reduction Measures: Safeguarding and other
Means of Reducing Risk
ANSI B11.20–2017 Safety Requirements for the Integration of Machinery into a System
ANSI B11.26–2018 Functional Safety for Equipment: Design Principles and the Practical Application of ISO
13849-1.
NFPA 70–2023 National Electrical Code
NFPA 79–2021 Electrical Standard for Industrial Machinery
NFPA 70E–2024 Standard for Electrical Safety in the Workplace
ANSI / ASSP Z244.1–2016 Control of Hazardous Energy – Lockout/Tagout and Alternative Methods.
ISO 4413–2010 Hydraulic fluid power - General rules and safety requirements for systems and their
components Pneumatic fluid power – Systems Standard for Industrial Machinery
ISO 4414–2010 Pneumatic fluid power - General rules and safety requirements for systems and their
components
ANSI Z535 series on safety signs, labels, symbols, product manuals and instructions.
In addition to the normative references listed above, see Annex R for a list of potentially useful informative
references.
3 Definitions
The following definitions are common within the B11 community and the portfolio of its ANSI standards and
technical reports, as well as the general machinery/machine tool industry. The definitions of the terms in this
clause are applied in a consistent manner throughout the entire B11 portfolio of ANSI standards and technical
reports. Where a machine– or industry–specific definition exists and the definition conflicts with the definition in
this clause, the definition of the machine– or industry–specific standard shall apply.
3.1 acceptable risk: A risk level achieved after risk reduction measures have been applied. It is a risk
level that is accepted for a given task (hazardous situation) or hazard. For the purpose of this standard and
the entire B11 series, the terms “acceptable risk” and “tolerable risk” are considered to be synonymous.
Informative Note 1: The expression “acceptable risk” usually, but not always, refers to the level at which
further technologically, functionally, and financially feasible risk reduction measures or additional expenditure(s)
of resources will not result in significant reduction in risk. The decision to accept (tolerate) a risk is influenced
by many factors including the culture, technological and economic feasibility of installing additional risk
reduction measures, the degree of protection achieved through the use of additional risk reduction measures,
and the regulatory requirements or best industry practice.
Informative Note 2: The user and supplier may have a differing ‘level’ of acceptable risk.
Informative Note 3: A similar phraseology used in some ISO standards is as follows: “the risk has been
adequately reduced.”
3.2 accumulator: A vessel containing fluid under pressure and used as a source of stored energy.
3.3 affected person: An individual who operates, services and/or maintains a machine, or others who
are in proximity to the machine.
Informative Note: See also, Annex P.
3.4 alternative method: A means of controlling hazardous energy (other than energy isolation) to reduce
risk to an acceptable level.
3.5 anti-repeat: The part of the control system designed to limit the machine to a single cycle if the
actuating control is maintained in an operating position. Anti-repeat requires release of all actuating controls
before another cycle can be initiated.
Informative Note: The function of anti-repeat is to prevent successive cycles that could occur if the anti-repeat
control did not exist.
3.6 Authority Having Jurisdiction (AHJ): An organization, office, or individual having the authority to
enforce the requirements of a code, law, regulation or standard, or to approve equipment, materials, an
installation, or a procedure. This can include Federal, State or Local Regulators, as well as organizations
responsible for product or equipment listing or approval.
3.7 authorized personnel: Qualified personnel identified by the user (employer) or supplier to perform
a specific task. See qualified personnel (3.74).
Informative Note: See also, Annex P.
3.8 awareness means: A barrier, signal, sign, or marking that warns individuals of an impending,
approaching or present hazard.
3.9 bed: The stationary member of the machine that supports the tooling and other associated equipment.
3.12 clutch: A mechanism that, when engaged, transmits torque to impart motion from a driving member
to a driven member.
3.12.1 full revolution clutch: A type of clutch that, when engaged, cannot be disengaged until the
machine has completed a single cycle.
3.12.2 part revolution clutch: A type of clutch that may be engaged or disengaged during the
machine cycle.
3.13 co-manufacturer: One or more users who share the duties of industrial production using machinery.
3.14 concurrent: Acting in conjunction with another and used to describe a situation where two or more
controls exist in an operated condition at the same time (but not necessarily simultaneously).
3.15 control device: A device connected into the control circuit and used for controlling the operation of
the machine (e.g., position sensor, manual control switch, relay, magnetically operated valve).
Informative Note: See also, Annex Q.
3.15.1 actuating control [actuating means]: An operator control used to initiate or maintain machine
motion(s) or other machine function(s). Also referred to as: foot control, hand control, pedal,
presence sensing device initiation, treadle bar, two-hand control, or two-hand trip.
Informative Note 1: For a motor driven direct mechanism, the motor would be the actuator.
Informative Note 2: For a flywheel/clutch driven mechanism, the clutch would be the actuator and not
the motor that is driving the flywheel.
3.15.2 enabling device: A manually actuated control device which, when continuously activated
and used in conjunction with a separate actuating control, will allow the machine to function.
3.15.3 foot control: A foot-operated mechanism or device used as a control device.
Informative Note: Also referred to as: foot pedal, foot treadle, foot treadle bar, pedal, single
control device, or single trip device.
3.15.4 hand control: A hand-operated mechanism or device used as a control device.
Informative Note: Also referred to as: actuating control, two-hand control device, two-hand trip
device, single control device, or single trip device.
3.15.5 hold-to-run control device: Manually actuated control device which initiates and maintains
machine functions only as long as the manual control device is actuated.
Informative Note: Examples include two-hand control devices and single control devices (hand- or
foot-operated).
3.15.6 reset device: A manually actuated control device which, when operated, initiates a reset
function(s).
3.15.7 safety-related manual control device: Control device which requires deliberate human
action that may cause or result in potential harm to individuals.
Informative Note: Examples include actuating devices such as pushbuttons, selector switches, or
foot pedals designed for functions like reset, start/restart, guard unlocking or hold-to-run control (e.g.,
jog, inching).
3.15.8 safety-related reset: A function within the SRP/CS used to restore one or more safety
functions before restarting a machine.
Informative Note: This can be automatic or manual.
3.15.9 single control device: An actuating control used to initiate and maintain hazardous machine
function(s).
Informative Note: Single control devices only provide risk reduction for the person operating the
actuating control.
3.15.10 single trip device: An actuating control which initiates hazardous machine function(s) and
then can be released.
Informative Note: Single trip devices only provide risk reduction for the person operating the
actuating control.
3.15.11 stop control: A control device or function which, when actuated, initiates an immediate stop
command or a stop at a predefined position in a cycle.
3.15.12 two-hand control device (THCD): An actuating control that requires the simultaneous
operation by both hands to initiate and maintain hazardous machine function(s).
Informative Note: Two-hand control devices only provide risk reduction for the person operating the
actuating control.
3.15.13 two-hand trip device (THTD): An actuating control that requires the simultaneous operation
by both hands to initiate hazardous machine function(s) and then can be released.
Informative Note: Two-hand trip devices only provide risk reduction for the person operating the
actuating control.
3.16 control reliability: The capability of the [machine] control system, the engineering control – devices,
other control components and related interfacing to achieve a safe state in the event of a failure within the
safety-related parts of the control system.
Informative Note: For additional information about performance of safety functions, see ANSI B11.19, ANSI
B11.26, IEC 62061, IEC 61508, and ISO 13849.
3.17 control system: Sensors, manual input and mode selection elements, interlocking and decision-
making circuitry and output elements to the machine actuators, operating devices and mechanisms.
3.18 counterbalance: Means provided to balance the reciprocating mass of the slide/ram drive members
and slide/ram attachments.
3.19 cycle: A complete movement of a machine, from the initial start position back to the same start
position, which may include feeding and removal of the material or workpiece.
3.20 design: To plan and develop the machine to meet the intended purpose and function during its
lifecycle.
3.21 energy: As used in this document, energy refers to electrical, mechanical, hydraulic, pneumatic,
chemical, nuclear, thermal, gravity or other forms of energy to power a machine or system, or as a waste or
byproduct.
3.21.1: beneficial energy: Energy that is required or essential to reduce risk to personnel when
performing a task.
Informative Note: Examples include, but are not limited to:
• energy that offsets gravity and does not pose a hazard during performance of a task(s)
(e.g., counterbalances);
• maintaining power to a processor, HMI or input devices to facilitate a specific task(s)
(e.g., troubleshooting);
• energy necessary to maintain control of potential energy (e.g., wound coil material).
3.21.2: hazardous energy: Any energy that could cause harm to personnel.
3.21.3: non-hazardous energy: Energy that does not expose personnel to harm when performing
a task.
Informative Note: Energy that can be considered as non-hazardous for a particular task might be
considered hazardous for a different task.
3.23 engineering controls: Guards or devices and associated safety-related parts of the control system
(SRP/CS) used to reduce risk.
Informative Note: See also, ANSI B11.19 and 6.5.1.3.
3.23.1 engineering controls – control functions: Safety functions associated with engineering
controls (guards or devices) intended to reduce risk.
Informative Note: Examples of these include the following:
• stopping functions;
• safety-related reset;
• suspension of safety functions (manual suspension, muting);
• variable sensing functions (sensing field switching, blanking);
• presence-sensing device initiation (PSDI).
3.23.2 engineering controls – devices (safeguarding device): A device that provides protection
from a hazard(s) by preventing or detecting exposure to the hazard zone.
Informative Note 1: Engineering controls – devices, when used for detection, typically provide an
output(s). Examples of these include the following:
• interlock devices;
• movable barrier devices;
• presence-sensing devices;
• actuating controls;
• enabling devices;
• emergency stop devices.
Informative Note 2: These do not include personal protective equipment (e.g., safety
glasses/goggles, face shields, safety shoes, etc.). See also, ANSI B11.19.
3.23.3 engineering controls – guards: A barrier that provides protection from a hazard.
Informative Note: Examples of these include the following:
• fixed guards;
• movable guards;
• interlocked guards;
• adjustable guards;
• self-adjusting guards;
• partial guards;
• perimeter guards;
• nip guards;
• power transmission guards.
3.24 ensure: To reasonably establish, maintain, and monitor requirements of this standard or other
standards within the B11 series of American National Standards.
Informative Note: In the context of B11 documents, ensure is not synonymous with “guarantee.”
3.25 fail-to-safe: A design or event such that a failure or fault within the system causes the hazardous
situation to achieve a safe state.
Informative Note: The term “fail-to-safe” is not the same as fail-safe and does not guarantee complete
freedom from failure, e.g., from multiple failures. The term “fail-safe” is typically used in the process control
industry where the process needs to continue to run or function. Fail-safe is not typically used in the
machinery or machine tool industry.
3.27 fault: The state of an item characterized by the inability to perform a required function after a failure.
Informative Note 1: A fault does not include the inability to perform during preventive maintenance or other
planned actions, or due to lack of material, product, utilities or other external resources.
Informative Note 2: A fault is often the result of a failure of the item itself but may exist without prior failure. In
this standard, “fault” means a random fault.
3.28 feasible: Reasonably capable of being done, put in [into] practice or carried out.
Informative Note 1: Not all potential risk reduction measures are feasible. Many factors determine if the risk
reduction measure is feasible. It is necessary to evaluate the application of the risk reduction measure against
the following factors:
• regulatory obligations;
• introduction of new hazards;
• effectiveness;
• machine performance;
• usability;
• productivity;
• durability;
• maintainability;
• ability to clean;
• ergonomic impact;
• economic feasibility;
• technological feasibility.
Informative Note 2: The terms “feasible” and “possible” are not considered to be synonymous.
Informative Note 3: In this standard, the terms “feasible” and “practicable” are considered to be synonymous.
3.29 feasibility: The practicability of implementing a risk reduction measure(s) in an actual application to
reduce risk to an acceptable level.
Informative Note 1: See also, 6.5, 6.7 and the definition for acceptable risk (3.1).
Informative Note 2: The terms “feasibility” and “possibility” are not considered to be synonymous.
Informative Note 3: In this standard, the terms “feasibility” and “practicability” are considered as synonymous.
3.30 fixture: A means used to locate or support the material, workpiece or tool during operation.
3.32 hand tool: Any device used for manual feeding, or for freeing a stuck workpiece or scrap.
3.38 inadvertent contact: When a person touches or otherwise contacts a hazard accidentally or
unintentionally.
3.39 individual: A person, including personnel, who may or may not be under the direct control of the
supplier or user. See also, personnel.
Informative Note: See also, Annex P.
3.40 inherently safe by design: a design measure that reduces risk, which is not susceptible to a
malfunction that will increase the risk of harm.
Informative Note: See also, 6.5.1.
3.41 in-running nip point: Any location between a rotating machine member and another rotating or fixed
member, or the material where a part of the body could be drawn in and injured. Also referred to as: in-going
nip point.
Informative Note 1: Examples of in-running nip points include:
a) two or more counter-rotating surfaces, whether powered or unpowered;
b) surfaces rotating in the same direction, but with different peripheral speeds;
c) surfaces rotating in the same direction, but with different surface properties (such as frictional or
entanglement characteristics);
d) one surface rotating toward an adjacent fixed object or part of the machine;
e) open drive belts, chains or webs, contact rollers, or gears and sprockets;
f) non-powered rollers (riding rollers, guide rollers) driven by movement of the product.
Informative Note 2: See also, “nip points” in Table 7 of Annex D.
3.42 installer: An individual, partnership or corporation responsible for placement and preparation for use
of a machine.
Informative Note: Responsibility for installation of the machine usually depends on the terms
specified in the purchase agreement.
3.43 integrator: An entity that designs, provides, manufactures, or assembles a machine, machinery
system or related equipment, and oversees the safety strategy, including the risk reduction measure(s) (guards
and devices), control interfaces, or interconnections of the control system into a machinery system. See also,
supplier (3.116) and user (3.126).
Informative Note: Under certain circumstances, the user becomes the integrator.
3.44 intended use (of a machine): The use for which a machine is suited according to the information
provided by the supplier, or which is deemed usual according to its design, construction, and function.
Informative Note 1: Intended use should be consistent with the supplier’s instructions, which should take into
account, reasonably foreseeable misuse. The intended use may be determined by the user.
Informative Note 2: This may include situations where engineering controls need to be suspended by qualified
and authorized persons to perform a task.
3.45 interlock: Mechanical, electrical, fluid power or other type of device or means to prevent a hazardous
situation(s) under specified conditions.
3.46 layout analysis: The process by which the intended use of the machine or machinery system is
evaluated to determine task zones, control zones and appropriate risk reduction measures.
3.47 lifecycle (of a machine): The phases of a machine including but are not necessarily limited to:
• concept;
• design and construction;
• reconstruction;
• modification;
• transport;
• set-up;
• installation;
• operation;
• maintenance;
• dismantling;
and/or
• disposal.
Informative Note: See also, clause 5.
3.48 local control: A mode that provides the operator with direct control of machines and related
equipment or cells within the machinery system.
3.49 machine (machinery; machine tool): An assembly of linked parts or components (at least one of
which moves) with the appropriate actuators, control, and power circuits, etc., that are joined together for a
specific application, such as for the processing, treatment, marking, or moving of material.
3.50 Machinery as a Service: Industrial machinery or equipment that is in use in the user’s facility, but
not owned by the user.
Informative Note: In some instances, the user can be prohibited from operating, maintaining, or
modifying the machinery.
3.51 machinery system: A machine(s) with ancillary equipment such as a material handling system, tool
change equipment, gaging, etc. A machinery system may be an integrated manufacturing system (see ANSI
B11.20).
3.52 maintenance personnel: Qualified personnel trained and authorized to maintain the machine,
including the engineering controls and awareness means.
Informative Note: See also, Annex P.
3.53 manual suspension: A suspension that is actuated or selected by an individual that disables or
renders ineffective, one or more safety function(s).
Informative Note: This has been known as overriding or bypassing.
3.55 mechanical power transmission apparatus: The mechanical components that, together with a
source of power, provide the motion to an element of a machine or equipment, e.g., shafts, gears, belts,
pulleys, couplings.
3.56 mode: The operation of a machine or machinery system as determined by the state or condition of
the control system. Specific operating modes are defined in the machine-specific “base” (type-C) safety
standards and may include the following examples:
3.56.1 automatic mode: An operating mode that produces continuous cycling, automatically
initiated single cycles, or intermittent continuous cycling on an automatic basis.
3.56.2 continuous mode: Continuous cycling, initiated by an operator and maintained by the
machine control system, without further operator interaction.
3.56.3 jog/inch mode: To impart motion by momentary manual operation of the jog/inch control
device.
Informative Note: As a function, inch is synonymous with jog. However, inch mode and jog mode
are not the same. Traditionally, inch mode uses a clutch to effect motion whereas jog mode uses the
motor to effect motion.
3.56.4 manual mode: Any operating mode of the machine that requires the operator to initiate
and/or maintain motion of the machine during the cycle, or portion of the cycle, by use of the
actuating control.
Informative Note: Other manual modes may be developed for a particular machine or task, based on
the risk assessment (e.g., single block mode in NC machines, maintenance, or a machine-specific mode
to complete a task).
3.56.5 normal operation: The operating condition where the machine or production system
performs the intended production function(s).
3.56.6 run mode: The operating modes, whether automatic, continuous, or manual, used for
production operations on a machine.
3.56.7 semi-automatic mode: The operating mode requiring one or more control actions by the
operator per machine cycle.
3.56.8 special mode: A mode specifically designed to allow a given task to be performed.
Informative Note: “Special Mode” is a generic term used within this and other standards. See also,
7.3.8 and Annex K.
3.57 mode selector: One or more means used to establish the machine operating mode.
3.58 modification: Change made to the machine or machinery system that alters its original purpose,
function, capacity, operation or risk reduction measures.
Informative Note 1: A modification is considered a change that potentially impacts the safety of a machine.
Informative Note 2: An upgrade is typically considered to be a modification.
3.59 modifier: Any entity that changes the original purpose, function or capacity of the machine or
machinery system by design or construction. See also, supplier (3.116), user (3.126) and modification.
Informative Note: Under certain circumstances, the user becomes the modifier.
3.60 monitoring: The checking of system components to detect a failure or fault of a component,
subassembly or module that affects the performance of the safety functions.
3.61 muting: The automatic temporary suspension of any safety-related function(s) of the control system
or engineering controls – device. See manual suspension (3.53).
3.63 operator: Personnel who perform production work on a machine or who control the machine.
Informative Note: See also, Annex P.
3.64 personnel: Individuals who are employed by or on behalf of the user or supplier.
Informative Note 1: The term “personnel” includes subcontractors, consultants, or other contract workers,
under the direct or indirect control of the supplier or user.
Informative Note 2: See also, Annex P.
3.65 pinch point: Zone or area in which the human body or parts of the human body are exposed to a
crushing hazard.
3.66 point of operation: The location in the machine where the material or workpiece is positioned and
where work is performed on the material or workpiece.
3.69 presence-sensing device: A device that creates a sensing field, area or plane to detect the presence
of an individual or object and provides an output signal(s).
3.70 Presence Sensing Device Initiation (PSDI): An operating mode that utilizes a presence sensing
device to actuate a single machine cycle.
Informative Note: This operating mode is also known as “ESPE used as a machine re-initiation device” (IEC
61496-1) and “sensitive protective equipment when used for cycle initiation” (ISO 12100). See also, ANSI B11.19.
3.71 production system: The machine(s), tooling, methods of feeding, auxiliary equipment and risk
reduction measures established for production operations.
3.72 programmable electronic system (PES): An electronic system that performs logical, decision-
making, or arithmetic functions by executing instructions in a specified manner. The system usually includes
input and output elements (ports) and is usually reprogrammable.
3.74 qualified personnel: Persons who, by the application of knowledge, training, and experience,
demonstrate an understanding and ability to competently perform the responsibilities or tasks assigned to them
involving the design, construction, operation or maintenance of the machinery and the associated hazards.
Informative Note: See also, Annex P.
3.75 ram: A machine member(s) that reciprocates linearly. It may also be referred to as slide (3.110).
3.76 readily accessible: Capable of being reached quickly without having to remove obstacles or
obstructions.
3.77 reasonably foreseeable misuse: The use of a machine in a way not intended by the supplier or
user, but which may result from readily predictable human behavior.
Informative Note: A risk assessment should address the following human factors (this is not intended as an
all-inclusive list):
• Inappropriate actions because of mistakes, errors, and poor judgment, excluding deliberate
abuse of the machine;
• Inappropriate actions or reactions taken in response to unusual circumstances, such as
equipment malfunction;
• The tendency to take the “path of least resistance” in carrying out a task;
• Misreading, misinterpreting, or forgetting information.
3.78 rebuilder (reconstructor): An entity who partially or completely rebuilds or reconstructs a machine
or machinery system, or any portion thereof. See also, rebuilding; supplier (3.116).
Informative Note 1: Under certain circumstances, the user becomes the rebuilder.
3.79 rebuilding / reconstruction / refurbish: Restoring the machine or the machinery system to its
original design, purpose, capacity, and function. Sometimes also referred to as retool.
Informative Note: Rebuilding involves the restoration or replacement of major components of the machine or
the machinery system and is not considered a maintenance or repair activity.
3.80 reconfigure: A machine whose components have been rearranged so that the layout is different from
the original installation. A machine might be reconfigured several times over its lifecycle; also, it might be both
reconfigured and relocated at the same time.
3.81 relocate: To move a machine to a different location with no changes to operation, process, equipment
arrangement, or risk reduction measures.
3.82 remanufacture: Modification of a machine by replacing worn-out or failed components (which may
include the controller) with new or used parts, resulting in different machine specifications from the original.
Also referred to using terms such as upgrade or modified.
3.83 reset: A function that initializes or returns a device, circuit, or other measure to its operating or
enabling state.
Informative Note: The function can be either safety-related or unrelated to safety.
3.84 restraint mechanism: A physical element (mechanical obstacle) that restricts hazardous movement
by virtue of its own strength.
Informative Note: Previously referred to as safety blocks, chain locks, locking pins, limiting/blocking pins. Not
to be confused with hold out (restraint) device.
3.85 redundancy: The use of multiple means to perform the same function.
Informative Note: Redundancy is typically used to improve the reliability of the system.
3.86 repair: To restore a machine by replacing a part or putting together that which is broken without
altering its original purpose, function, capacity, operation, or risk reduction measures.
3.88 residual risk: The risk remaining after risk reduction measures (protective measures) are applied.
3.89 risk: The combination of the probability of occurrence of harm and the severity of that harm.
3.90 risk assessment: The process by which the intended use of the machine, the tasks and hazards,
and the level of risk are determined.
3.91 risk assessment process: The entire process of identifying hazards, assessing risk, reducing risk,
and documenting the results (see Figure 6).
3.92 risk reduction: That part of the risk assessment process involving the elimination of hazards or the
selection of other appropriate and feasible risk reduction measures (protective measures) to reduce the
probability of harm or its severity.
3.93 risk reduction measure (protective measure): Any action or means used to eliminate hazards
and/or reduce risks.
Informative Note 1: Risk reduction measures follow the hazard control hierarchy and can include but are not
limited to:
• inherently safe by design (elimination or substitution);
• engineering controls, including:
o guards;
o control functions;
o devices.
• administrative controls, including:
o awareness means;
o training and procedures;
o personal protective equipment (PPE).
Informative Note 2: This document uses the term “risk reduction measure(s)” as a synonym for the ‘outmoded’
term “protective measure(s)” due to its improved clarity of meaning and increasing adoption/use internationally.
3.94 safe condition monitoring system: A sensor, system or device used to monitor the performance of
the machine to achieve a safe condition.
Informative Note: This was previously referred to as stopping performance monitor or brake monitor. This
also includes zero speed monitors. See also, ANSI B11.19.
3.95 safe-work procedure(s): Formal written documentation developed by the user that describes steps
that are to be taken to safely complete tasks where hazardous situations may be present or hazardous events
are likely to occur.
3.96 safeguarded space: An area or volume enclosing a hazard zone(s) where engineering controls are
intended to protect individuals.
3.99 safety block: A prop that is inserted between opposing tooling or machine members to prevent
closing of machine members or tooling components. Also referred to as: die block or restraint mechanism.
3.100 safety distance: The minimum distance an engineering control (guard or device) is installed from a
hazard such that individuals are not exposed to the hazard.
Informative Note 1: See also, ANSI B11.19.
Informative Note 2: This is referred to as “safety distance” for guards in ISO 13857 and “minimum
distance” for devices in ISO 13855.
3.101 safety function: A function of a machine, the malfunction of which would increase the risk of harm.
3.102 safety pin: A physical object to prevent movement of a machine or machine part. Also referred to as
restraint mechanism.
3.103 safety-related part of the control system (SRP/CS): Part of a control system that responds to
safety-related input signals and generates safety-related output signals.
Informative Note 1: SRP/CS are those part(s) of the machinery control system that provides safety functions
which can consist of separate components of the hardware and software and can either be separate from the
machine control or be an integral part of it.
Informative Note 2: The combined safety-related parts of a control system start at the point where the safety-
related input signals are initiated (including, for example, the actuating cam and the roller of the position switch)
and end at the output of the power control elements (including, for example, the main contacts of a contactor).
Informative Note 3: If monitoring systems are used for diagnostics, they are also considered as SRP/CS.
Informative Note 4: For additional information, see ANSI B11.26, IEC 61508, IEC 62061, and ISO 13849.
3.104 set-up: The process of changing over or adjusting the machine parameters, work holding devices,
tooling, and risk reduction measures for proper operation of the machine or machinery system that may require
personnel to work on or near energized equipment/machinery.
Informative Note 1: Also referred to as tryout.
Informative Note 2: Set-up may include checking the initial part quality and producing test parts.
3.106 shear point: Other than the point of operation, the immediate area where two or more machine
elements pass in close contact, creating a shearing action.
Informative Note: The elements may be in any form of motion, or one may be stationary.
3.107 shield: A barrier used to contain anticipated materials and energies (e.g., chips, coolant, radiation,
atmosphere, noise, temperature, and hazardous substances) and is not intended to contain parts, workpieces
or tooling that are ejected as a result of faults or failures.
Informative Note 1: This excludes PPE such as face shields.
Informative Note 2: A shield is not considered to be a guard.
Informative Note 3: Due to the energies involved, containing ejected workpieces etc. is often not feasible.
Informative Note 4: For further information, see ANSI B11.19.
3.109 simultaneous: Actuation where the start of two separate input signals is at the same time.
Informative Note: This term is rarely applied to actuation of signals in ANSI standards which typically use
“concurrent” or “synchronous,” but is often used in ISO/IEC standards to describe that function.
3.110 slide: The machine member(s) that reciprocates linearly. It may also be referred to as ram (3.75).
3.111 span of control: The predetermined portion of the machinery under control of a specific device or
safety function.
3.112 stop: Immediate or controlled cessation of machine motion or other hazardous situations. There are
many terms used to describe the different kinds of stops, including user- or supplier-specific terms, the
operation and function of which is determined by the individual design. See ANSI B11.19 and the machine-
specific “base” (type-C) safety standard. Definitions of some of the more commonly used “stop” terminology
include:
3.112.1 controlled stop: The stopping of machine motion while retaining power to the machine
actuators during the stopping process. Also referred to as Category 1 or Category 2 stop.
3.112.2 emergency stop: The stopping of a machine, manually initiated, for emergency purposes.
3.112.3 normal stop: The stopping of a machine, initiated by the control system, at the completion
of a cycle.
3.112.4 protective stop: The stopping of a machine initiated by an engineering control - device for
risk reduction purposes.
Informative Note: This type of stop allows the orderly cessation of motion or the hazardous situation
and allows for the retention of program logic to facilitate restarting of the machine. This type of stop
includes stop categories 0, 1 and 2 as defined in 9.2.2 of NFPA 79.
3.112.5 uncontrolled stop: The stopping of machine motion by removing power to the machine
actuators, all brakes or other mechanical stopping devices being activated. Also referred to as:
Category 0 stop.
3.113 stop command: An action to cause a safe condition (including cessation of machine motion) either
automatically or through human intervention. The stop command can be immediate or normal.
3.113.1 immediate stop [stopping] command: A command that initiates an action(s) to stop
motion(s) or situation(s) at any point in the machine cycle.
3.113.2 normal stop command: A command that initiates an action(s) to achieve a safe
condition at the end of a machine cycle or at other points required by the machine functions.
3.114 supervised: A means or method whereby the user exercises control of the operation of the machinery
system. Also referred to as supervisory control.
3.115 supervisor: An individual authorized to act on behalf of the user and to direct the activities of other
personnel.
Informative Note: See also, Annex P.
3.116 supplier: An individual, corporation, partnership or other legal entity or form of business that provides
equipment or services.
Informative Note 1: A supplier can include but not be limited to any of the following: the manufacturer;
manufacturer’s agent, representative or distributor; reseller; installer; modifier; rebuilder; integrator.
Informative Note 2: When the user provides equipment or services, the user is considered to be the supplier
within the scope of that work activity.
3.117 suspension: When the function of one or more engineering controls or safety functions are disabled or
rendered ineffective in order to perform a task.
Informative Note: See also, manual suspension (3.53) and muting (3.61).
3.118 swarf: Chips, shavings, and other fine particles removed from the workpiece by a cutting or grinding
tool.
3.119 synchronous (actuation): Concurrent actuation where the time lag between the start of one input
signal and the start of the other is less than or equal to a predetermined time.
Informative Note: For two-hand control and/or two-hand trip devices, the time lag is less than or equal to 500
milliseconds.
3.120 task: Any specific activity that is done with, on or around the machine during its lifecycle.
3.122 tool [tooling]: A punch, die, knife, cutting tool, blade, or abrasive wheel used in the manufacture of
production parts. Also referred to as die(s) and tooling.
3.124 unexpected start: Any start-up which, because of its unexpected nature, generates a risk to
individuals.
Informative Note: Machine start-up during normal sequence of an automatic cycle is not unintended but can
be unexpected from the point of view of the operator.
3.125 unintended actuation: The inadvertent initiation or actuation of the machine which could create a
hazardous condition. Also referred to as unintended operation.
3.126 user: An individual, corporation, partnership, other legal entity, or form of business that utilizes a
machine, machine production system or related equipment.
Informative Note 1: Under certain circumstances (i.e., while acting as a builder, modifier, integrator), the user
is considered a supplier.
Informative Note 2: See also, Annex P.
3.127 validation: Confirmation, through the provision of testing on the as-built machine, that the risk
assessment requirements have been fulfilled.
Informative Note 1: Validation can involve answering two questions:
1. Are we doing the right things? (Is the risk reduction measure appropriate?);
2. Are we doing things right? (Is the risk reduction measure used properly?).
Informative Note 2: “Validate” as used in this standard means to check and test, to confirm and document, but
does not imply formal validation as used, for example, in the pharmaceutical industry.
Informative Note 3: For additional information about the process of validation, see IEC 61508, IEC 62061, and
ISO 13849-2.
3.128 verification: The process of checking that the design and development outputs have met the
requirements of the risk assessment during the design phase.
Informative Note 1: For example: Evaluation of components to confirm they meet the requirements of the
safety functions; analysis of the safety circuits to confirm that the performance achieves the requirements of the
risk assessment.
Informative Note 2: For additional information about the process of verification, see IEC 61508, IEC
62061, and ISO 13849-2.
3.129 warning: A means used to call attention to a hazard (see also, ANSI Z535.4).
3.130 work(ing) envelope: An area in which motion can occur due to part of the machine or workpiece
moving within its normal operating range.
3.131 workpiece: Any material placed into the machine for the purpose of having work performed upon it.
3.132.1 control zone: An identified portion of a production system coordinated by the control
system.
3.132.2 hazard zone: Any space within or around a machine(s) in which an individual can be
exposed to a hazard.
Informative Note: Also referred to as hazard area or hazard space.
3.132.3 task zone: Any predetermined space within or around a machine(s) in which personnel
can perform work.
Informative Note: Task zones are used as an interim step of zone determination.
4 Responsibilities
Machinery suppliers and machinery users have responsibilities for defining and achieving acceptable risk.
4.1 General
The supplier and the user, either separately or jointly, shall identify hazards, assess risks, and reduce risks to
an acceptable level within the scope of their respective work activities as described in this standard.
Informative Note: Under some circumstances, the results of the risk assessment process can indicate
unacceptable risk. A task should not be undertaken until appropriate risk reduction measures have been
applied to achieve acceptable risk.
Suppliers and users shall involve qualified personnel in meeting their respective obligations and
responsibilities. The supplier and user shall use the relevant regulations and standards applicable to their
work activity.
Informative Note: This may include regulations and standards for a specific location and/or for a specific
application.
4.3 Responsibilities of the component supplier and component user / machine supplier
The component supplier and machine supplier shall be responsible for achieving acceptable risk within the
scope of their work activity.
Informative Note 1: In general, the component supplier is responsible for the component it supplies, but not for
how the component is integrated into a machine or how it is used / maintained.
Informative Note 2: In general, the machine supplier is responsible for the machine it supplies and for the
integration of the component parts it selects, but not for the components themselves or for how the machine is
used.
Informative Note 3: If more than one entity is involved in the design, construction, integration or installation of
the machine, each entity is responsible for the scope of its work activity.
Informative Note 4: Suppliers of stock-built machines (generic or off-the-shelf) rely on the user to define
intended use and provide suitable risk reduction measures.
The supplier shall provide risk reduction measure(s) as determined in the supplier risk assessment and the
appropriate machine-specific “base” (type-C) safety standard.
Informative Note: See Annex A, Section A1 (classification of risk reduction measures).
Where applicable, the supplier shall consider cleaning during the design of the machinery and construct the
machinery to enable proper and/or appropriate cleaning.
Informative Note: Examples include but are not limited to:
• radius corners rather than sharp joints;
• no level surfaces to avoid pooling of fluids;
• opening or removal of guards to improve access;
• slip resistant walking/working surfaces; etc.
4.3.1 Integration
The machine supplier shall determine what risk reduction measures, if any, are required to achieve acceptable
risk with any components it integrates into the machine.
Informative Note: Particular attention should be paid to instances where engineering controls are removed
from individual components in order to achieve the desired integration.
Specific types of machines used as part of machinery or incorporated into machinery may be treated as a
component. The risks of specific types of machines used as a component shall be reduced to an acceptable
level in accordance with the requirements of either ANSI B11.0, ANSI B11.19 and ANSI B11.20; or their
machine-specific “base” (type-C) safety standard.
Informative Note 1: An industrial robot is an example of a specific type of machine that could be used as a
component.
Informative Note 2: Equivalent ISO standards may also be applied.
4.3.2 Documentation
The machine supplier shall obtain documentation from the component supplier as required for the
component(s), including installation requirements, operating instructions, and maintenance requirements.
The component part supplier shall furnish documentation as required for the risk reduction measures, including
installation requirements, operating instructions, and maintenance requirements.
Informative Note: The documentation from both the machine supplier and the component part supplier should
include the following, where applicable:
• performance specifications;
• electrical or fluid power schematics and diagrams;
• physical environment for which the component was designed;
• function and location of the operator controls, indicators, and displays;
• schedules for periodic maintenance, lubrication, and inspection;
• signs and warnings.
See also, ANSI Z535.6 for additional guidance.
When components are ordered/purchased without engineering controls, the component user / machine
supplier shall provide engineering controls as determined by this document and other applicable safety
standard(s).
The user shall provide and install additional risk reduction measure(s) as determined in the user risk
assessment. The user shall ensure that risk reduction measure(s) are properly used, maintained and
functional.
Informative Note: See Annex A, Section A1 (classification of risk reduction measures).
The machine user shall check and confirm that when any change to the tooling, process or procedures occurs,
the machine and any affected component(s) continues to meet the requirements of this standard and the
applicable ANSI B11 machine-specific “base” (type-C) safety standard.
Informative Note 1: Changes in the production system that may affect the machine and its components
include, but are not limited to:
• tooling changes;
• addition or removal of auxiliary equipment;
• modification of the machine;
• modification of machine systems;
• operating method (program);
• change in operating personnel;
• adjustment / location of engineering controls;
• part configuration.
Informative Note 2: Adjustments to the machine and its components or additional risk reduction measures
may be necessary.
The user shall ensure that all personnel that work on, with or around machinery are trained in accordance with
the results of the risk assessment and the appropriate machine-specific “base” (type-C) safety standard.
Informative Note: The training should be consistent with the supplier’s information for use.
If the user deviates from the supplier’s information, the user shall use the risk assessment process to develop
the training needed to maintain risk at an acceptable level. The training shall be documented. See clause 10
for additional information.
Informative Note: Different levels of training can be required based on tasks (installation, adjustment,
operation and maintenance) and levels of risk.
4.5.2 Cleaning
The user shall ensure that the risk level is maintained at an acceptable level during the cleaning of the
machinery. Except as provided below, the user shall clean the machinery in accordance with the established
procedures and supplier information for operation and maintenance.
The user shall establish and follow a program of periodic and regular cleaning to ensure that all parts, auxiliary
machinery, and risk reduction measures are in a safe operating condition, in accordance with the supplier
information for operation and maintenance.
If the user deviates from the supplier information for operation and maintenance or the established cleaning
procedures, the user shall use the risk assessment process to maintain risk at an acceptable level.
Responsibilities for co-manufacturing machinery shall be defined between the machine owner, the machine
supplier (if different), and the machine user. The entities involved in supplying and using machinery in a co-
manufacturing application shall clearly communicate the scope of the work activities and the associated
responsibilities for the risk assessment process.
Informative Note 3: Examples include:
• clarifying which safety rules and safe work procedures apply (those of the co-manufacturers, the
facility, or the user);
• procedures for the control of hazardous energy (lockout/tagout);
• responsibilities for training.
Responsibilities for Machinery as a Service shall be defined between the machine supplier, the service supplier
(if different), and the machine user.
See also 7.2.2 and 7.3.3 for further guidance on cybersecurity and remote/tele-operated control function.
The user shall ensure that the original machinery supplier’s risk reduction measures are installed on the
machine and functional, or that other measures are provided to achieve acceptable risk.
Where practical, the user shall contact the original machinery supplier and obtain any missing manual(s),
warning labels, and other information for use.
Personnel shall not wear clothing, jewelry, or unrestrained hair styles that will be hazardous to personal safety.
Personnel shall follow appropriate training, policies, procedures, and instructions provided by the user and/or
machine supplier in performing their work activities.
Informative note: The Occupational Safety and Health Act of 1970 – Public Law 91-596, states in section 5(b),
“Each employee shall comply with occupational safety and health standards and all rules, regulations and
orders issued pursuant to this Act which are applicable to his own actions and conduct.”
5.1 General
Risks associated with the concept, design, construction, reconstruction, modification, transport, set-up,
installation, operation, maintenance, dismantling and disposal of machinery shall be reduced to an acceptable
level.
Informative Note 1: In general, the machinery supplier is responsible for the design, construction and
providing information for operation and maintenance of the machine, while the user is responsible for the
operation and maintenance of the machine. Responsibility for installation of the machinery usually depends on
the terms of the purchase agreement.
Informative Note 2: The machinery lifecycle progression from concept through decommissioning is shown in
Figure 5. Although the responsibilities of the supplier and the user differ over the lifecycle of the machinery,
each uses the risk assessment process (see clause 6).
The requirements for risk assessment and applicable standards for machinery shall be determined by Table
1. The scenarios 2-5 require that the machine be maintained in accordance with the original design and
information for use, and that the risk reduction measures have been periodically inspected. See also, (ANSI)
B11.TR8.
The supplier shall use the risk assessment process in designing and constructing the machine and for
developing the information for operation and maintenance of the machinery, considering the lifecycle of the
machine.
Informative Note: Suppliers should consider applicable waste and recycling issues over the machine lifecycle.
Within the scope of their respective work activities, the user and supplier shall reduce the risks associated with
the installation, commissioning, and start-up of the machinery to an acceptable level.
The installation, commissioning and start-up shall be accomplished in accordance with, but not limited to, the
following:
• appropriate regulatory standards (e.g., hazardous energy control [lockout / tagout / alternative
methods] regulations, construction safety);
• accepted industry practices as detailed in applicable voluntary consensus standards;
• recommendations for use of machine features that can facilitate installation, such as lifting bolts
and transportation means;
• supplier installation instructions;
• recommendations for supplier and/or user-supplied interim risk reduction measures used during
installation and commissioning, prior to installation, testing and confirmation of the designed
solution(s);
• recommendations for supplier and/or user-supplied energy control procedures and signage;
• user installation instructions.
Before being placed into production, the user shall check and/or test the risk reduction measures of the
machine.
Informative Note 1: The user may need the supplier to assist in meeting this requirement.
Informative Note 2: In complex installations with multiple production zones, multiple validations may be
required.
During the operation and maintenance of the machinery, the user shall ensure that the risk level is maintained
at an acceptable level, as determined by the risk assessment or the appropriate machine-specific “base” (type-
C) safety standard. The user shall operate and maintain the machinery within the established operating limits,
and consistent with the supplier information for operation and maintenance.
The user shall establish and follow a program of periodic and regular inspection and maintenance such that
all parts, auxiliary machinery, and risk reduction measures are in a state of safe operating condition,
adjustment, and repair, in accordance with the supplier information for operation and maintenance.
If the user deviates from the supplier information for operation and maintenance or the established operating
limits, the user shall consult with the supplier and/or component supplier(s) and shall use the risk assessment
process to maintain risk at an acceptable level.
The user shall be responsible for controlling hazardous energy (lockout / tagout / alternative methods) in the
use of a machine or machinery system. See ANSI / ASSP Z244.1 and see also, 7.9.
Modifiers and/or rebuilders shall, where feasible, solicit the original supplier’s recommendations regarding any
proposed modification to a machine that may affect the safe operation prior to making any such changes.
Where modifications are made to the machinery (e.g., intended use, tasks, hardware, and software), a risk
assessment shall be repeated for those parts of the machinery being modified or affected.
The user shall confirm that acceptable risk is maintained after modifying and/or rebuilding is complete, and
maintain updated risk assessment documentation for both historical purposes as well as future use for potential
additional modifications to the machine (see 6.9.1 and 6.9.2).
When evaluating existing machinery, the risk assessment process shall include but not be limited to the
following where available:
• input of personnel experienced in operation, set-up and maintenance;
• experience in the field;
• history of past incidents;
• similar machinery and processes;
• reports of near misses;
• number of machines in the field;
• lifespan of the equipment;
• new information regarding hazards;
• internal safety audits or regulatory visits;
• Information for Use for the machine;
• safe work procedures.
Informative Note 1: This standard presents a standardized risk assessment process that can be used to
evaluate existing machines and/or systems. The supplier and/or user should decide when and what existing
machinery should be evaluated.
Informative Note 2: Relocation of existing machinery may create additional hazards stemming from the
relocation.
Informative Note 3: When evaluating existing machinery where upgrading of engineering controls is not
feasible, the supplier and/or user should evaluate use of additional administrative controls (e.g., awareness
means, posted written procedures, etc.) to further reduce risk.
5.6 Decommissioning
The supplier shall consider decommissioning during the design of the machinery and provide information on
known hazardous components or processes regarding decommissioning of machinery.
The user shall ensure that acceptable risk is maintained during decommissioning of machinery.
Informative Note 1: Typically, a decommissioned machine needs to be cleaned, stripped, and drained of any
potential hazards that could cause injury or environmental damage.
Informative Note 2: The risk assessment should take into account special disposal and recycling requirements
for the machine and/or instructions associated with the SDS (safety data sheet; formerly called material safety
data sheet or MSDS) on materials in the equipment.
The means to disconnect, isolate and dissipate all sources of hazardous energy of the machine shall be
identified and the hazardous energy controlled.
Informative Note: Often during this phase of the machine lifecycle, other types of hazardous energy could be
encountered that would not have been foreseen through the normal maintenance procedures and energy
control methods. Proper dismantling techniques and control of gravity and various other hazards should be
reviewed to check that they meet the needs for decommissioning.
Identifying hazards shall take into account the different tasks, operating modes and intervention procedures, in
particular when the machine does not perform the intended function (i.e., it malfunctions).
Informative Note 1: This can be due to a variety of reasons, including but not limited to the following:
• variation of a property or dimension of the processed material or product;
• failure of one (or more) of its component parts or services;
• external disturbances (e.g., shocks, vibration, electromagnetic interference);
• interruption of its power source.
Informative Note 2: For lean manufacturing, identifying forms of waste can improve system performance and
safety performance. See (ANSI) B11.TR7 for additional information.
Informative Note 3: When identifying hazards, variables impacting tasks should be identified (e.g., changes in
product weight/size, tendency of certain product runs to create jams, and type of material).
Identifying tasks shall include modes of operation and work methods during which it is necessary to suspend
or modify one or more risk reduction measures.
Informative Note 1: Behaviors such as the following should be considered in a task-based risk assessment:
• incorrect behaviors (errors);
• reflexive and/or reactive behavior of a person in case of malfunction, incident, failure, etc.;
• behavior resulting from taking the "path of least resistance" in carrying out a task;
• behavior when a risk reduction device or method impedes a task;
• reasonably foreseeable behavior of unauthorized or untrained persons.
Informative Note 2: Examples of actions that could be reasonably foreseeable misuse include, but are not
limited to:
• attempting to clean under a machine in operation;
• removing debris from a moving roller;
• standing on part of a machine to reach a filter;
• loading an incorrect recipe or program.
Informative Note 3: Intentional misuse or abuse of a machine is outside the scope of a risk assessment.
Informative Note 4: Examples of action that could be intentional misuse/abuse (not reasonably foreseeable
misuse) include, but are not limited to:
• not locking out for tasks that require lockout;
• climbing on a machine while in operation;
• sleeping on/under/in/behind a machine;
• horseplay;
• at-risk behaviors;
• defeating, bypassing or circumventing a risk reduction measure (e.g., utilizing a spare
interlock actuator as a “cheater key” or crawling through a tunnel guard).
The tasks identified in 6.3.2 shall be used to identify hazards associated with those tasks. Hazards that are
not related to tasks shall also be identified.
Informative Note 1: Examples include but are not limited to:
• explosive environment;
• noise;
• instability;
• equipment failures or operational errors such as using an inappropriately sized workpiece;
• mechanical failure of a chuck;
• operating at incorrect speed, etc.
Informative Note 2: Some hazards may impose risk(s) beyond a simple contact point, for example,
gaseous exposure, electrical discharge, explosion, or fire.
Design changes to how a task is performed shall be identified and implemented to reduce risk by eliminating
or reducing exposure to a hazard where feasible.
Informative Note: Changes to tasks can include:
• moving the location of personnel where the work is done;
• redesigning the machine layout to reduce risk by enabling a task to be performed from outside the
hazard zone.
6.5.1.2 Substitution
Where feasible, alternative materials, methods or energy levels shall be substituted to reduce the risk of harm
from hazards.
Informative Note 1: Some examples include but are not limited to:
• substituting less toxic or hazardous materials and substances;
• substituting automated material handling instead of manual material handling.
Informative Note 2: See also, Annex R.
Functional safety requirements are separate from a risk assessment of a machine. Functional safety shall
be taken into account when a risk reduction measure requires a control system, according to 7.2.
Informative Note 1: A common error occurs when the functional safety specifications are mistaken to be the
risk assessment of a machine. Functional safety is a subset of risk reduction but is not a risk assessment of the
machine.
Informative Note 2: See also ISO/TR 22100-2 (2013).
Informative Note 3: A common error is to attribute a functional safety design specification to an entire
machine, rather than to a safety function. Different levels of functional safety are frequently applicable within a
single machine.
The machine supplier shall inform the user of specialized procedures and training necessary for using the
machine. See clause 8.
Informative Note 1: Procedures and training should be provided for the operation of the machine, the
application, use and adjustment of engineering controls, and for awareness means.
Informative Note 2: Procedures and training may include but are not limited to:
• formal or informal training;
• standard operating procedures;
• checklists;
• personnel certifications;
• lockout / tagout / alternative methods.
The incentive to defeat or circumvent risk reduction measures shall be considered when selecting them.
Informative Note 1: The incentive, or necessity, to defeat or circumvent risk reduction measures depends on
both the circumstances considered and the design details of the risk reduction measure(s). Incentives to defeat
or circumvent a risk reduction measure may include but are not limited to factors such as:
• the risk reduction measure prevents the task from being performed;
• there is a need to perform a task that was not identified and assessed for hazards and risks;
• the risk reduction measure slows down production or interferes with any other activities or preferences of
the user;
• the risk reduction measure is difficult to use;
• additional personnel other than the intended operator(s) perform the task, for example:
– operator resets engineering controls - devices while maintenance personnel are inside the hazard zone;
– engineering controls intended to protect an individual are inappropriately used for multiple personnel.
• the risk reduction measure and/or its associated hazard is not recognized as such by personnel;
• the risk reduction measure is not accepted as suitable, necessary, or appropriate for its function.
Informative Note 2: The use of programmable systems introduces an additional possibility to defeat or
circumvent provisions for access to programmable systems if not properly applied or supervised. This is
particularly important when remote access for diagnostic or process correction purposes is required.
Informative Note 3: The organizational culture towards safety has bearing on the tendency to defeat or
circumvent risk reduction measures.
Specialized training alone shall not be used as a means of reducing the probability of a hazardous event if it
cannot be confirmed that all individuals exposed to the hazard will have that level of training/knowledge.
Informative Note 1: In assessing the residual risk, the risk factors are estimated assuming that the selected
risk reduction measures are in place.
Informative Note 2: Severity and probability of harm are assessed and combined to obtain a residual risk level
using the selected risk scoring system.
Informative Note 3: See also, Annex E for additional information concerning assessing probability.
Risk reduction is complete when risk reduction measures are applied and acceptable risk for the identified
hazards has been achieved.
Informative Note 1: The decision to accept (tolerate) a risk is influenced by many factors including the culture,
technological and economic feasibility of installing additional risk reduction measures, the degree of protection
achieved through the use of additional risk reduction measures, and the regulatory requirements or best
industry practice.
Informative Note 2: In all machinery applications, some level of residual risk exists. It is possible that high or
medium residual risk remains after all reasonable and feasible risk reduction measures have been applied. The
user and supplier may have different tolerance(s) of acceptable risk.
Informative Note 3: This document does not establish a definitive threshold for acceptable risk. Achieving
acceptable risk will depend on:
• complying with national, regional, and local regulations as required;
• the application of the hierarchy of controls (6.5.1.1 through 6.5.1.6);
• the feasibility of the selected risk reduction measure(s) (see Informative Note under 6.5.2);
• the level at which further technologically, functionally, and financially feasible risk reduction measures or
additional expenditure of resources will not result in significant reduction in risk;
• the operator’s personal responsibility and ability to work in conjunction with the selected risk reduction
measures.
Informative Note 4: Risk assessment should facilitate a consistent decision-making process. Qualified
personnel are particularly important in decision making about acceptable risk.
Informative Note 5: Acceptable risk is fundamentally a decision made by each supplier or user in the context
of their own unique circumstances. The following structure is one example of a practical application of
acceptable residual risk to relevant stakeholders:
• High residual risk: only acceptable when all reasonable alternatives/options (risk reduction
measures) have been reviewed and formally deemed infeasible. It is recommended that the group
performing the risk assessment seek advice from additional safety or subject matter experts.
• Medium residual risk: acceptable only when all reasonable alternatives/options (risk reduction
measures) have been formally deemed infeasible.
• Low residual risk: usually acceptable.
• Negligible residual risk: acceptable.
Informative Note 6: See also, Annex G for additional information on achieving acceptable risk.
6.8 Check, test and confirm (validate and verify) risk reduction measures
Prior to the installation of the risk reduction measures, the design shall be checked to confirm that once
implemented, the design is capable of meeting the functionality and reliability specification determined by the
risk assessment process.
After the risk reduction measures have been implemented, their effectiveness shall be validated and verified
by checking, testing and confirming as described below.
Informative Note 1: Checking can include but is not limited to:
• presence of administrative controls;
• presence of hazardous energy (lockout / tagout / alternative methods) procedures and safe job
procedures;
• review of installation per the design;
• analysis of design per the requirements of this document and other applicable standards.
Informative Note 2: Testing can include but is not limited to:
• physically trying the operation of engineering control devices and safety-related parts of the control
system;
• operational models;
• effectiveness of training;
• review overall operation.
Informative Note 3: Confirming can include but is not limited to:
• documentation of the results of check and test;
• tracking training effectiveness.
The review of the risk reduction measure(s) shall answer three questions (at a minimum):
A. Check:
• Are we doing the right things? (is the risk reduction measure appropriate?)
• Are we doing things, right? (is the risk reduction measure used appropriately?)
B. Test:
• Do the safety functions work correctly?
Testing of the risk reduction measures shall not expose an individual to potential harm should the risk reduction
measure not provide the protection expected.
Informative Note: The checking, testing and confirmation should include:
• what actions should be conducted;
o physical location and presence;
o functional operation in use in all operating modes;
o reasonably foreseeable failures;
• how the actions may be done safely;
• what the expected and required results / reaction of each action should be;
• a record of the results.
Documentation of the risk assessment shall include, but not be limited to:
• the machinery for which the assessment has been made (e.g., specifications, limits, intended use),
(see 6.2);
• the information on which the risk assessment was based (see 6.2);
• any relevant assumptions which have been made (e.g., loads, strengths, safety [design] factors);
• names of the risk assessment team;
• date(s) of the risk assessment;
• the tasks and hazards identified (see 6.3);
• initial risks associated with the machinery (see 6.4);
• the risk reduction measures implemented to eliminate identified hazards or to reduce risk (e.g., from
standards or other specifications) (see 6.5);
• residual risks associated with the machinery (see 6.6);
• the confirmation of risk reduction measures, including the responsible individual and the date of
confirmation (see 6.8).
Informative Note 1: An example of risk assessment documentation is shown in Annex H.
Informative Note 2: When applicable as determined by the supplier and user, a statement of conformity
should be documented and provided. An example Statement of Conformity is attached at Annex I.
Informative Note 3: The risk assessment documentation should be reviewed:
• periodically to confirm risk reduction measures are still effective and in place;
• following an incident or near miss;
• whenever new tasks or activities are required;
• whenever there are modifications to the machine, equipment, or process.
In addition to the above, where practical the supplier documentation shall include recommendations for
additional risk reduction measures to be implemented by the user, system integrator or other entity involved in
machine utilization.
Table 4 — Example of relations between Hazard, Safety Function and Risk Reduction
Task / Hazard Description of the safety function Risk reduction measure
(What does it have to do?)
Access to clear jam Prevent contact with the hazard Movable guard
Open guard to clear jam Stop hazardous motion when the Interlock device
guard is opened
Unexpected start-up – entanglement Prevent unexpected start-up when the Interlock device
hazard guard is opened
For each safety function identified as part of the risk assessment, a design specification shall be determined.
Informative Note 1: The design specification both indicates how the function is to operate, and the required
safety level needed to execute the safety function to an appropriate level of reliability to achieve acceptable risk
for that task / hazard pair.
Informative Note 2: A reliability design specification may be selected for a circuit using one of the following
three methodologies:
• Performance level (PL) as contained in ISO 13849-1 and described in ANSI B11.26;
• Categories as originally contained in EN 954-1 and described in ANSI B11.26, and also described in
clause 6 of ISO 13849-1;
• Control reliability as used in the B11 series of documents and described in ANSI B11.19 and B11.26.
Informative Note 3: Other methods may also satisfy the requirements, including Safety Integrity Levels (SILs)
per IEC 61508 and IEC 62061.
Informative Note 4: The design specification for a control system is not the same as a risk assessment for a
machine.
The design of control systems performing a safety function shall comply with the principles and methods
presented in 7.2.1 through 7.2.5 and 7.3. These principles and methods shall be applied singly or in
combination as appropriate to the circumstances.
7.2.1 General
The design and performance of the safety-related parts of the control system (SRP/CS) shall be commensurate
with the risk reduction provided by the safety function (see clause 6). The SRP/CS shall be appropriate for
the intended use. The integrity of the safety components and/or systems shall be determined by the
appropriate product, system, and/or application safety standard / technical report.
Informative Note 1: Control system standards and technical reports include: ANSI B11.26, (ANSI) B11.TR4,
ANSI B11.19, NFPA 79, ISO 13849-1, ISO 13849-2, ISO 13850, IEC 62061, IEC 60204-1, and IEC 61508.
Informative Note 2: Examples of methods used to increase reliability in designing SRP/CS include one or
more of the following:
• certified components or systems suitable for the application;
• fail-to-safe components or systems;
• redundant components or systems;
• diverse components or systems;
• equipment and devices with an acceptable probability of failure (for additional information, see IEC 61508);
• automatic monitoring (for additional information, see IEC 62061).
The SRP/CS shall be installed, checked and tested to confirm that the specified performance has been
achieved according to 6.8.
Informative Note: Confirmation can include, but not be limited to, the following:
• the circuit was designed and implemented correctly;
• the wiring was checked after installation and before commissioning;
• the functionality of the safety system(s) was validated by the integrator and/or the user;
• the safety function was tested to confirm the specified performance was achieved.
The user shall test the SRP/CS periodically to confirm that it is functioning according to the specifications as
determined by the risk assessment.
7.2.2 Cybersecurity
Cybersecurity shall be considered as part of the overall machine risk assessment. If the risk assessment
identifies that a threat/failure mode exists where cybersecurity issues would result in unacceptable risk,
cybersecurity measures shall be provided to address the cybersecurity safety risks.
Informative Note: Cybersecurity is a dynamic field subject to rapid changes. For further information,
see (ANSI) B11.TR9, and the IEC 62443 series.
The control system, programmable electronic system, and input devices that may remain energized during a
stop function shall not create a hazardous situation(s) as a result of their energized state.
Informative Note: Retention of power for certain portions of the system may be necessary to prevent
hazardous motion, to maintain program logic, or to provide braking during stopping.
The protective stop shall safely control the hazard or hazardous situation.
Informative Note: The intent of this requirement is to separate the safeguarding function from the emergency
stop function due to differing safety performance requirements.
Automatic reset of a safety function shall not be used when whole body access exists (see 7.4).
Operator interfaces that can impact safety functions and can be changed (e.g., via keyboards or displays),
shall be subject to the risk assessment process and may require restrictions, confirmation, limitation, and/or
security access.
A stop control device shall be placed near each start control device. Where the start/stop function is performed
by means of a hold-to-run (jog) control, a separate stop control device shall be provided when a risk can result
from the hold-to-run control device failing to deliver a stop command when released (see also, ANSI B11.19).
Where control zones are used, a layout analysis shall be carried out according to ANSI B11.20 for a machine
or machine system to obtain an overall understanding of the impact of the foreseeable tasks on the functional
performance of the machine based on operational requirements. This analysis should take into account all
machine configurations and operating modes, including production mode and any special modes (see 7.3.8
and Annex K). See Annex J for further information on layout analysis.
The level of performance of the safety-related function(s) of a control device and its associated SRP/CS shall
meet or exceed the highest level of safety performance for the risks identified within its span of control.
The span of control shall be clearly distinguishable or identifiable so as not to be confused with other spans of
control.
Informative Note 1: Means of identifying span of control may include placards, color-coding, signage, shapes,
layout and location, etc.
Informative Note 2: When placards are used, they should be distinguishable from placards used for other
purposes, such as lockout.
Informative Note 3: When color-coding for parts of the enclosure is used for identifying span of control, the
yellow background of emergency stop devices needs to be maintained as required by ANSI B11.19 and NFPA 79.
Informative Note 4: Functionality, including the span of control of the HMI, should be appropriate to the
specific tasks (i.e., production, set-up and maintenance troubleshooting) and should be considered in risk
reduction measures.
7.3.6 Energy sources
Activating an internal or external energy source, including re-energizing after a power interruption, shall not
result in a hazardous condition.
Machinery shall be designed to prevent hazardous conditions resulting from interruption or excessive
fluctuation of the energy source (e.g., electrical, pneumatic, hydraulic). In the event of loss of energy, the
following minimum requirements shall be met:
• the stopping function of the machine shall remain available;
• all devices whose permanent operation is required for safety shall operate in an effective way to
maintain safety (e.g., locking, clamping devices, cooling or heating devices, braking);
• hazardous stored energy shall be safely controlled or dissipated.
Whole body access is often associated with the provision of protection around the perimeter of a hazard zone,
such that an individual(s) could enter the hazard zone beyond the perimeter of protection. Whole body access
also occurs when an engineering control device is located at a separation distance from the hazard zone(s)
and individuals are not detected between the engineering control device and the hazard zone.
The requirements for whole body access apply only to means of entry that are considered intentional use or
reasonably foreseeable misuse.
Informative Note: An example of intentional or unforeseeable misuse includes difficult access through an
opening intended for product entry, exit or rejection when an interlocked access gate is part of the machinery.
For whole body access, both of the following parameters shall be considered:
1. an opening defined by the physical obstructions (e.g., opening in a guard) which permits the entire
body to enter the area (see 7.4.2);
and
2. an area within the safeguarded space which permits an individual to remain undetected (see 7.4.3).
Where the separation distance allows an individual to remain undetected inside the safeguarded space,
additional engineering controls – devices or other risk reduction measures shall be provided to prevent
reasonably foreseeable hazardous situations according to 7.4.2.3.
The dimensions presented above consider reasonably foreseeable behavior of individuals. Smaller
dimensions may allow intentional whole body access but are not considered in this document.
7.4.2.3 Area within the safeguarded space where individuals can remain undetected
Hazardous situations where safety functions can be restored or re-enabled (reset) include but are not limited
to:
• an individual inside the safeguarded space but no longer being detected by the presence-sensing
device;
• a closed interlocked guard with an individual inside the safeguarded space.
See ANSI B11.19-2019, subclause 9.11.1 for guidance to determine dimensions where individuals can remain
undetected within the safeguarded space.
7.4.3 Risk reduction measures to minimize risks derived from whole body access
To prevent the required restart interlock being re-enabled while an individual is inside a safeguarded space,
at least one of the following risk reduction measures in 7.4.3.1, 7.4.3.2 or 7.4.3.3 shall be applied.
7.4.3.1 Isolation and dissipation of hazardous energies (see ANSI / ASSP Z244.1).
7.4.3.2 Automatic detection of an individual(s) within the safeguarded space by means of a presence-sensing
device(s). If some locations within the safeguarded space are not covered by this presence-sensing device,
at least one of the following measures shall be used:
a) additional presence-sensing device(s) to provide detection of an individual(s) within the entire
safeguarded space that allows whole body access;
or
b) physical obstructions to force part(s) of the body of the individual into the sensing field of the presence-
sensing device(s);
or
c) manual reset of the safety function (restart interlock) as described in 7.4.3.3.
Informative Note: The application of one of these measures may not be sufficient and additional measures
may be required.
7.4.3.3 Manual reset (see 7.2.5) of the safety function initiated by the engineering control device(s) that detect
access by an individual to the hazard zone with the addition of the following:
a) activation of safety-related manual control devices from inside the safeguarded space shall be
prevented;
EXCEPTION: When the safety-related manual control device is intended to be used within the
safeguarded space, it should be used in conjunction with other risk reduction measures (e.g., hold-to-
run control on a pendant utilizing an enabling device and speed monitoring function); see ANSI B11.19.
b) when an individual(s) may be present in undetected areas, one or more of the following shall be used:
i. sequential time-limited reset function;
ii. automatic detection of the individual(s) within the safeguarded space;
iii. provision of means for further visibility of the span-of-control (e.g., physical obstruction;
mirrors or vision systems, such as video monitoring or CCTV);
iv. inhibit functions: if a proactive inhibit function cannot be implemented and reactive inhibit
function is provided, an initiation warning system shall also be provided.
Informative Note: A proactive inhibit function allows the person to inhibit the reset of the restart interlock
before entering the safeguarded space. A reactive inhibit function allows the person to interrupt the reset of the
restart interlock with a stop command actuated from inside the safeguarded space.
c) Provision of at least one of the following measures to address the possibility when an individual can
be trapped inside the guards that define the safeguarded space:
i. proactive inhibit functions;
ii. movable guards capable of internal opening and an initiation warning system. An escape
release of guard locking devices shall be provided if applicable.
When openings are smaller than those defined in subclause 7.4.2, the engineering controls (guards or
devices) shall be located at a distance from any associated hazard(s) within the span of control such that
individuals will not be exposed to a hazard(s) according to ANSI B11.19-2019, subclause 9.6. Means to
achieve this include:
• initiating a protective stop when opening an interlocked guard or movable barrier device prior to the
individual reaching the hazard;
• providing an engineering controls – devices that initiates a protective stop when an individual is
detected; or
• providing an engineering controls – guard that prevents an individual from accessing the hazard by
reaching over, under, around, or through.
Informative Note 1: One method of achieving safety distance is by the use of tunnel guards. Bends in tunnel
guards can further restrict access.
Informative Note 2: When the product is considered part of the risk reduction measure, any remaining
opening(s) shall prevent individuals from reaching the identified hazard(s). See ANSI B11.19 -2019 clause 7.3.
The machinery user shall control hazardous energy to protect personnel using lockout, tagout, or alternative
methods.
Informative Note: See also Annex L and ANSI / ASSP Z244.1.
The user shall be in corformance with the energy control documentation, training, and authorization
requirements of ANSI / ASSP Z244.1.
Where applicable, the user shall identify energies as being hazardous, non-hazardous, or beneficial for specific
tasks to be performed on a machine.
Informative Note 1: Not all energies are hazardous for certain tasks. Some energies are beneficial and
enhance the safety of tasks, e.g., hold down arms on coiling machines or counterbalance systems on presses.
Informative Note 2: Non-hazardous or beneficial energies for certain tasks can be hazardous for other tasks.
For example, energies for hold down arms or counterbalance systems could be hazardous for tasks working on
those systems, but non-hazardous or beneficial during set-up, diagnostics or other tasks.
Energy that is non-hazardous for a specific task shall be maintained to achieve acceptable risk.
Informative Note: Pre-task planning is often used to identify hazardous and non-hazardous energies.
Energy that is beneficial for a specific task shall be controlled to complete the task with acceptable risk.
Informative Note: Beneficial energy that is not adequately controlled could become hazardous energy.
Alternative methods shall be provided for personnel safety when it is necessary for machinery to remain partially
energized (e.g., to hold parts, save information, retain heat or provide local lighting). See ANSI / ASSP Z244.1.
Informative Note 1: Maintaining power to the controller can avoid problems associated with restarting the
machine.
Informative Note 2: For span of control, see 7.3.4.
Removed, disabled, manually suspended (bypassed) or suspended engineering controls shall be restored to
full operational status prior to the resumption of normal operation. Where feasible, the suspending shall be a
defined mode that shall suspend the appropriate engineering controls as well as allow for activation of the
alternative risk reduction measures.
7.12.2.2 Visibility
Engineering controls, awareness means, and risk reduction measures shall not cause undue obstruction to
the view of the production process.
Informative Note: Polycarbonate or other plastic materials often used for viewing panels may be subject to
degradation from exposure to the environment, lubricants, metalworking/metal removal fluids, etc., and the
conditions of use. The degradation is not always visible and can impact the ability to view the process. See
also, Annex G of ANSI B11.19.
Where applicable, a lifting point(s) on the load shall be identified. Transport personnel shall be able to reach
the attachment devices safely. Weight, and center of gravity (where applicable) details shall be given on the
machine, in operations manuals, on its packaging, and/or on transportation documents.
Regulators shall be used for air controlling equipment and pneumatic actuators requiring less than line
pressure or variable pressure settings.
When pressure (vacuum) adjustments can lead to unacceptable risk, pressure control components shall be
permanently marked to indicate the allowable pressure range and should be lockable. If appropriate, fixed
pressure relief valves or rupture discs are preferred. Machinery design shall minimize potential hazards from:
• overpressure;
• pressure surges or pressure increase;
• pressure loss or underpressure;
• high pressure injection;
• stored energy;
• sudden hazardous movement of a hose resulting from leakage and/or component failures.
Informative Note: Components with an adjustable range that is within the allowable pressure range of the
system are preferred.
Overpressure protection (e.g., regulator, relief valve, pressure switch, bypass) shall be provided on all
hydraulic power sources. The pressure adjustment on a pressure compensated pump shall not be the
protective device. An additional relief valve downstream from the pump shall be provided.
Pressure relief valves shall operate in such a way that reduces risk to an acceptable level.
Informative Note: Nothing in this subclause is meant to circumvent or supersede the requirements of the
ASME Boiler and Pressure Vessel Code, or other applicable specifications or requirements.
• have a properly sized exhaust port equal to or greater than its supply port;
• have a pressure indicator (i.e., a gauge) that is visible to the operator to indicate that the line is relieved
of pressure.
Informative Note: The above list is intended for fluid power specific isolating devices, where used, and is not
intended to preclude the use of electrical isolation devices on the fluid energy source, provided they meet the
intent of this subclause.
The air shall be filtered, and excessive moisture removed before it enters the system. Lubrication shall be
provided only for components that require it. The lubrication can be of the single point type which applies
lubrication directly to the actuator.
Lubricators shall be set so as to provide sufficient lubrication but not so as to over lubricate, thereby causing
excessive oil to be discharged into the atmosphere or create valve malfunction.
Informative Note: Lubricated systems should have a re-classifier installed into the exhaust port of the valve
controlling the lubricated actuator.
7.14.7 Actuators
If rapid system pressurization causes hazardous movement, additional risk reduction measures shall be
provided.
Informative Note 1: Some examples include but are not limited to:
• soft start-type valves;
• counterweights / springs;
• open centered valves;
• flow restrictors;
• rod brakes;
• shot pins and slide locks.
Informative Note 2: See ANSI B11.26 for additional information.
The supplier of components or machinery that generates electromagnetic hazards shall advise users of the
strength of the electromagnetic field at a given distance(s).
Before releasing to operations, equipment incorporating radiation energy sources shall be tested and
confirmed to determine that the equipment is within the intended limits. Procedures for periodic confirmation
shall be developed to ensure that radiation energy conditions have not changed (settings, effectiveness of
guarding, bonding).
Residual risks associated with radiation energy sources shall be communicated to the machinery user.
Informative Note: Examples include, but are not limited to:
• warning labels;
• warning signs;
• instructions in a manual;
• messages on an HMI;
• audible alarms;
• visual alarms.
If the measures for the reduction of emissions at the source are not practical and/or adequate, the machine
shall be provided with additional risk reduction measures.
Informative Note: Examples include, but are not limited to the following:
• avoiding the use of hazardous radiation sources;
• use of filtering and/or absorption;
• use of attenuating screens and/or guards;
• limiting radiation power to the lowest level sufficient for the proper functioning of the machine;
• designing the source so that the beam is concentrated on the target;
• increasing the distance between the source and the operator;
• labeling or instructions;
• providing for remote operation of the machine.
Where practical, hazardous radiated emissions from a machine or machinery system shall be reduced at their
source, to the level and concentration necessary for reliable functioning.
Informative Note: Radiation emissions may include ionizing radiation sources (e.g., X-rays and gamma rays) or
non-ionizing radiation sources (e.g., lasers, magnetic or electromagnetic fields, ultraviolet, infrared, microwave
and laser emissions), induction heating and sealing).
Where practical, the area of the equipment where radiation is present shall be limited and minimized.
Guards shall be provided to isolate the radiation to only the intended area.
Where practical, shielding, bonding and grounding shall be provided to reduce susceptibility and to neutralize
radiation.
The supplier of components or machinery that generate hazardous electromagnetic or magnetic fields shall
advise users of the strength of the hazardous field at a given distance.
Informative Note: For additional guidance see EN 50527-2-1, EN 50499, or IEEE C95.1, and Annex R.
If the measures for the reduction of emissions at the source are not practical or adequate, the machine shall
be provided with additional risk reduction measures.
Informative Note: Examples of risk reduction measures include, but are not limited to the following:
• use of filtering or absorption;
• use of attenuating screens or guards;
• de-energizing radiation sources when not in use;
• designing the source so that the beam is concentrated on the target;
• increasing the distance between the source and the operator;
• using automatic functions to limit the exposure of personnel to the shortest time needed to perform
required tasks;
• labeling and instructions.
Before releasing machinery to operations or production, equipment incorporating radiation energy sources
shall be validated to determine that the equipment is within the intended limits. Procedures for periodic
confirmation shall be developed to ensure that radiation energy conditions have not changed (settings,
effectiveness of guarding, bonding).
When applicable, machinery users shall monitor radiation energy exposure and accumulated radiation in
personnel (e.g., dosimeters).
Residual risks associated with radiation energy sources shall be communicated to the machinery user.
Informative Note 1: Examples include: warning labels or signs, instructions in a manual, messages on an
HMI, audible or visual alarms, etc.
Informative Note 2: Natural magnets and electromagnetic fields can present a hazard to persons with an
implantable medical device(s).
Informative Note 3: Risks can include:
• corruption of critical signals;
• interruption of communications;
• premature degradation of materials.
7.18 Lubrication
Where feasible, lubrication points shall be located so that personnel are not exposed to unacceptable risks
during access.
Informative Note 1: Where access is difficult, remote, or self-lubrication methods should be considered.
Informative Note 2: On machines where an automatic lubrication system failure could cause a hazard, the
system should incorporate an indication of its correct functioning or a warning of a malfunction.
Hazards associated with the operation of mechanical power transmission apparatus shall be eliminated by
design of the equipment or the risk reduced by an engineering control (guard or device) or safe-location.
Where feasible, mechanical power transmission apparatus shall be located within the structure of the machine,
equipment, or system. Where breakage of a mechanical power transmission component can result in injury,
provision shall be made for appropriate containment of components.
7.21 Modified atmospheres
Machinery that uses or that creates modified atmospheres shall prevent accumulation of gases at hazardous
levels, by providing adequate ventilation and/or eliminating the potential hazard by design, or provide for
detection, warning and evacuation of unsafe gas levels.
Informative Note: Modified atmospheres can be created due to normal operations, maintenance, nearby
machining operations or a fault condition. Machinery that uses modified atmospheres can create a hazard
within a facility and can require an additional risk reduction measure(s) by the user.
7.22 Noise
Machines shall be so designed and constructed that risks from noise emission produced by the machines are
reduced to the extent practical. Exposure to the noise level of a machine and/or machinery system shall be
reduced to an acceptable level.
Informative Note 1: Noise levels should be measured in accordance with (ANSI) B11.TR5.
Informative Note 2: Design or construction methods could include sound absorption materials, covers,
silencers, vibration damping or selection of component materials or other methods.
Informative Note 3: Table 5 presents some sources of machine noise and corresponding examples of noise
reduction methods.
For machines used in certain industries, lubricants from machine elements such as gears, bearings,
hydraulics, pneumatics, compressors, slideways and chains shall not contaminate the product or the
packaging. In all cases where product and lubricant contact cannot be fully prevented, lubricants that are
acceptable for that particular use shall be used.
Informative Note: Requirements and/or guidance for the sanitary design of machinery may be found
in ANSI / PMMI B155.1, ISO 14159, ISO 21469, EN 1672 Parts 1 and 2 and the American Meat
Institute principles of sanitary design.
7.24 Stability
A machine shall have sufficient stability to allow it to be used safely under the conditions of use and reasonably
foreseeable misuse.
Informative Note: A machine may become unstable due to one or more of the following:
• geometry of the base;
• weight distribution, including loading;
• dynamic forces due to movements of parts of the machine, movement of the machine itself, or of
elements held by the machine which may result in an overturning movement;
• vibration;
• oscillation of the center of gravity;
• characteristics of the supporting surface in case of traveling or installation on different sites (e.g.,
ground conditions, slope, etc.);
• external factors (e.g., air movement, manual or seismic forces, mishandled loading, worker bumping,
cart incidents, other nearby equipment or work operations not directly related, etc.).
If stability cannot be achieved by design, other risk reduction measures shall be used.
Informative Note: Risk reduction measures for improved stability may include but not be limited to:
• anchorage bolts;
• locking devices;
• movement limiters or mechanical stops;
7.28 Visibility
Visibility required for the safe operation and/or adjustment of the machine shall be provided. Machines shall
be designed and used to minimize hazards from the lack of visibility of portions of the machine.
Informative Note: Risk reduction measures may include:
• audible and/or visual alarms;
• remote vision systems or cameras and external or remote adjustments and/or lubrication access;
• use of transparent materials;
• mirrors.
7.29 Ventilation of airborne contaminants
For machinery and production systems that generate particles, mists, vapors, fumes or dust, appropriate
control technology or where necessary, the means to connect to a user’s fume/dust collection system, shall
be provided. The user shall appropriately control particles, mists, vapors, fumes or dust.
The user shall provide information to personnel for operation and maintenance. The user shall determine the
need for additional information beyond that provided by the supplier. The user shall determine the need for
required information in an additional language(s).
Informative Note: The information for use should be updated based on machine modification(s).
8.2 Manuals
One or more manuals (instruction handbook) shall be supplied with machinery that addresses as applicable,
the subjects of Safety, Installation, Operation, Maintenance, Parts and Checking / Testing / Confirming of the
safety related systems describing the intended use(s) of the machinery. The manual(s) shall also inform and/or
warn personnel about the residual risks (see 6.6 and Annex D), and conform to ANSI Z535.6.
Informative Note: The manual should include the sections shown in Annex M, as applicable. The order of the
information shown in Annex M is recommended but not required. The manual should be written for the
intended audience. Safety information should appear prominently and be easy to read. See also, ISO 20607.
Information to conform to the labeling requirements of NFPA 70E shall be provided by the user.
8.4 Nameplate
The machine shall have a nameplate that includes at a minimum:
• name and address or location of the manufacturer;
• designation of series or type;
• serial number, if any.
Informative Note: The nameplate should be permanent and remain legible throughout the expected life of the
machine (see also, NFPA 79). Machine specific “base” (type-C) standards may have additional requirements.
9 Supervision
The user shall confirm that the operation and maintenance of the machine is supervised only by qualified
personnel. An individual must meet the requirements of a qualified person before a user assigns tasks to
either operate or supervise the operation of a machine.
Informative Note: Anyone who is trained and authorized by the user may perform the “supervisory” function.
There is no intent to imply that only a person with a title such as “supervisor” may assume that function. See
also, Annex P.
The designated supervisor shall ensure that changes affecting risk reduction measures are only made by
authorized personnel. Where applicable, means to prevent unauthorized changes shall be implemented and
maintained in a manner(s) that is effective and commensurate with the risk.
Informative Note: See ANSI B11.19 for further details regarding avoidance of unauthorized changes.
The designated supervisor shall confirm that the user's operating procedures are within the guidelines as
described in the supplier's operating manual or according to the updated information provided with the
modification.
10 Training
The supplier shall provide materials (written, electronic or video) for the user to incorporate into its training
program(s) (see clause 8). Where training materials or information are not available, the user shall develop
appropriate training materials or obtain them from other sources.
10.1 General
All personnel shall be trained to perform the functions for which they are responsible. Users shall confirm that
personnel working with machines are properly trained in safe working procedures and are qualified to perform
the functions to which they are assigned.
Informative Note: The user should refer to the supplier’s recommendations when establishing a
training program. Examples of training program elements include:
• description of the assigned task;
• hazards associated with the assigned task;
• designated risk reduction measures;
• function of operator controls to be encountered in performing the assigned task;
• methods of function-testing or otherwise assuring the proper function of engineering controls.
As required by assigned functions, personnel shall be trained in the safe working procedures for controlling
hazardous energy sources (lockout / tagout / alternative methods). See ANSI / ASSP Z244.1.
Informative Note: See Annex N for additional guidance on training. See also, 29 CFR 1910.147 and
1910.333.
Training shall include the identification and proper use of appropriate risk reduction measures necessary to
reduce the risk of injury to personnel.
The requirements for personal protective equipment shall be determined. Personnel shall be trained in the
proper donning/doffing, use and maintenance of this equipment and such use shall be enforced by the user.
Aspects of the training program shall include the following elements, as appropriate:
a) information on the risk reduction measures used;
Informative Note: Topics include but are not limited to:
• types;
• capabilities / options;
• description for a specific application;
• function and functional tests;
• limitations.
b) task/hazard combinations associated with the system;
c) system set-up;
Informative Note: Topics include but are not limited to:
• procedures for all set-ups;
• procedures for changing, replacing and adjusting fixtures / tooling;
• transport, and storage of fixtures / tooling;
• hazards associated with alternate risk reduction measures.
d) system operation;
Informative Note: Topics include but are not limited to:
• machine tasks;
• hazards related to each task;
• response to abnormal / unexpected events;
• recovery of operation;
• use of auxiliary equipment.
e) system maintenance;
Informative Note: Topics include but are not limited to:
• applicable system training;
• emergency operations;
• hazards associated with:
– preventive maintenance / calibrations;
– troubleshooting;
– repair;
– operational checks;
Operators of machines shall demonstrate their proficiency and knowledge of safe procedures by practical /
actual demonstrated performance and proficiency.
Informative Note: Demonstration of proficiency is necessary in order to check the effectiveness of training.
Operators of a machine shall be trained in cross-discipline specializations as necessary to safely perform the
tasks associated with a particular machine.
Informative Note: For example, machining, material handling, fork truck operation.
Training shall cover the workings of the machine, sub-components, and ancillary components, even if these
sub-components and ancillary components were supplied by other than the Original Equipment Manufacturer
(OEM). Training shall include safe work procedures and practices.
10.6 Retraining
The user shall provide periodic retraining to individuals responsible for the supervision, set-up, operation,
maintenance and inspection of the machine or machinery system on safety issues related to assigned tasks.
Informative Note 1: Reasons for retraining may include but are not limited to:
• system changes (i.e., reconfiguring or reprogramming the system);
• after an incident;
• refreshment / enhancement.
Informative Note 2: This training is best presented when integrated with operational training.
Table 3 and Figure 8 and Figure 9 stress prevention through design (PtD) as the best option, especially when
performed early in the system lifecycle. They both emphasize designing out the hazards or hazardous situations
where feasible (Stage 1). If that is not feasible, use the hierarchy of controls to combine or balance the lower-
level options in order to reduce risk to a safe and acceptable level (Stage 2).
Stage 1
• Change task, function,
location etc... Eliminate Hazards Eliminated
• Substitution of materials
• Training (operator,
maintenance, etc.)
• Personal Protective
Equipment
Figure 8 — Two Stage Iterative Approach to the Hierarchy of Controls and Risk Reduction
Stage 1 – Description
Stage 1 aims to eliminate hazards through either changing the design or through substitution with something
less hazardous.
Stage 1.1 – Elimination: Determine if any actions can be taken to change the task, function, location of
the equipment or the worker (operator, maintenance, cleaning crew, etc.) that would result in the
elimination of the hazard from the area under analysis. This is critical to perform early in the design
stage when all associated geometries of the machinery and equipment or system under analysis is still
flexible. Significant efforts need to be made to eliminate all identified hazards by changing geometries
(tooling layout, equipment layout, traffic flow interactions from pedestrians, and ancillary mobile facility
equipment, etc.).
Stage 1.2 – Substitution: If the hazard cannot be eliminated, determine if substitution is an option that
will result in reducing the risk. Substitution often is useful when considering chemicals, hazardous
materials, etc. If elimination or substitution is not feasible, move to Stage 2.
Stage 2 – Description
Stage 2 requires an equilibrium of five elements to achieve an overall safety balance. All five elements need
to be considered in this stage.
Stage 2.1 – Engineering controls: Engineering controls need to be considered and analyzed and typically
take the form of guards, devices and control functions as described in ANSI B11.19.
Stage 2.2 – Awareness means: Determine what awareness means are required based on the design
configuration for each specific application. Each unique design and configuration will determine (through
the risk assessment and associated hazards identified with each task) which awareness device
combination is appropriate.
Stage 2.3 – Procedures: Identify procedures and instructions for use that are required for the personnel
to safely use the system as intended, and also to point out any reasonably foreseeable misuse of the
system.
Stage 2.4 – Training: A training package for proper use and for reasonably foreseeable misuse needs to
be supplied.
Stage 2.5 – PPE: The system needs to be analyzed for remaining hazards and any appropriate personal
protective equipment (PPE) shall be required and applied to reduce residual risks to an acceptable level.
Situations where elimination could not be attained typically require a balance or mix of actions shown in Figure
9. For example, installing a controlled access system also requires awareness placards, safe operating
instructions, personnel protective equipment as required, and initial (as well as refresher or periodic) training
for all affected workers in the area. Notice that engineering controls alone are not sufficient to reduce the
residual risk to an acceptable level. It requires some effort at all five steps to achieve the desired result.
Most risk reduction measures are susceptible to failure if not properly inspected, maintained and used within
proper design parameters.
Figure 9 — Illustration of the process of the supplier and user risk reduction efforts
This figure is an illustrative depiction of Table 3 and is not to scale.
Severity
Hierarchy
Occur-
Avoid-
Expo-
rence
Examples Error /
ance
sure
Failure
Misuse
Classification Type
Transferring information about residual risk can be accomplished through communication between suppliers
and users as to the circumstances surrounding the transfer (see subclause 4.2 and clause 8 for further
information). Risk that is transferred may require the user of the system or process to implement further risk
reduction measures based on the use of the machine.
Some examples of transferring information about residual risks include but are not limited to:
• from supplier (or rebuilder) to user:
- instruction manuals;
- warning labels;
- information about point of operation engineering controls.
• from user to personnel:
- lockout / tagout / alternative methods;
- periodically testing controls;
- live troubleshooting of an electrical panel.
• from supplier to integrator:
- instruction manuals;
- assembly sequence;
- temporary construction or installation of risk reduction measures.
• from user to third party service providers (cleaning, maintenance, rigging etc.):
- special cleaning procedures;
- information on lockout / tagout / alternative methods;
- preventative maintenance requirements.
• from user to decommissioning:
- special disposal and recycling requirement;
- notifying affected parties;
- SDS (safety data sheet) on materials in the equipment.
Information on transferring risk has limitations. Some risks may exceed capabilities to be effectively managed.
Some risks can never be transferred completely. Failures in transferring risks which may result in inappropriate
risk exposure include but are not limited to:
• risks that may not be completely understood or known by the supplier and/or user;
• risks that may not be accepted by the risk transferee;
• documentation that does not include all of the relevant assumptions that have been made;
• information that may not be received by the appropriate parties.
The choice of a specific method or tool is less important than the process itself. The benefit of risk assessment
comes from the discipline of the process rather than the precision of the results. A systematic approach using
due diligence should be used to proceed from identifying hazards to reducing risk. Risk assessment can focus
on the system or process as a whole, or the individual elements within that system or process. Application-
specific risk assessments for the machine address the particular process, use, installation, or integration of the
machine.
Risk assessment can also be used as a system design tool to identify a variety of issues, or to identify
opportunities to optimize the system or process. Issues take many forms based on the point in the lifecycle at
which the risk assessment is performed, such as:
• injury;
• waste (as used in lean manufacturing);
• quality;
• business interruption;
• financial;
• environmental.
Adding risk reduction measures to a design can increase costs and can restrict ease of use of the machine if
they are added after a design has been finalized or the machinery has been built. Changes to machinery are
generally less expensive and more effective at the design stage, so risk assessment should be initiated during
the machinery design. The individuals conducting the risk assessment should use due diligence throughout
the process in order to achieve a high level of confidence in the results. Confidence can be improved by
consulting others with the appropriate knowledge and expertise, and by having other competent personnel
review the risk assessment.
Where appropriate, reasonably foreseeable uses of the machinery by persons identified by sex, age, culture or
language, dominant hand usage, limiting physical abilities (e.g., visual or hearing impairment, size, strength),
or other human factors may be included.
Setting the scope of the risk assessment also includes determining the limits and intended use of the machine.
This step can include describing the purpose of the machine, its use(s), reasonably foreseeable misuse(s),
human factors (see also, (ANSI) B11.TR1), and the type of environment in which it is likely to be used and
maintained. The limits of the assessment need not only have a physical constraint, such as a machine floor
plan, but may also have virtual constraints such as including processes, methods, programs, logic diagrams,
and electrical systems.
Depending on the timing of the risk assessment within the machine lifecycle, the limits can include, but are not
limited to:
• use limits (such as the intended use of the machine / operating modes / number of persons);
• space limits (such as floor plan / maintenance access / material flow);
• time limits (such as production rates / cycle times / maintenance and wear of components);
• environmental limits (such as temperature / noise / lighting / corrosion);
• interface limits (such as other machines or auxiliary equipment / energy sources);
• human factors limits (ergonomics / cognitive capabilities / time requirements).
When setting the scope of the assessment, the team may focus on one or more of the following:
• a single machine;
• the operators / immediate workers at a single machine;
• a system of multiple machines;
• the interactions with nearby machines;
• the interactions with the overall plant site / other buildings;
• the interactions with the local community.
Although the risk assessment is generally limited to the machine, the interaction with other machines,
architectural walls, and hazards from other systems in the areas should also be considered.
The team should bring together knowledge of different disciplines and a variety of experience and expertise.
Team members should be selected according to the skills and expertise required for the risk assessment. The
team should include those people who:
• can answer technical questions about the design and functions of the machinery;
• have actual experience of how the machinery is operated, set-up, maintained, serviced, etc.;
• have knowledge of processes and other dependent hardware / items;
• have knowledge of the incident history of this type of machinery;
• have a good understanding of the relevant regulations, standards, and any specific safety issues
associated with the machinery;
• understand human factors (see (ANSI) B11.TR1).
The team members may include (but are not limited to):
• workers, customers and/or end users;
• maintenance and/or field service personnel;
• team leader, management;
• engineers and/or safety practitioners;
• representatives from component suppliers and/or machine users;
• legal counsel and/or consultants;
• insurers, insurance brokers, and others.
The information should be updated throughout the lifecycle of the system or process, and a new risk
assessment may be necessary as this information changes. Information on accident / incident history can be
very useful in identifying hazards. A “near miss” recording system that captures details surrounding these
events should be deployed as an integral part of an accident / incident reporting program. “Close Calls” and
“Near Misses” should be included in the risk assessment process. While not leading directly to an injury, “Close
Calls” and “Near Misses” are frequently indicative of the potential or presence of a hazardous situation(s) which,
with continued exposure, will likely lead to an injury.
Before beginning a new assessment, the risk assessment team should identify any existing risk assessment
conducted on prior version(s) or for similar products that might be applicable. For improved efficiency of the
risk assessment process, the risks of one machine can be compared with risks of a similar machine provided
the following criteria apply:
• the similar machinery has risks reduced to an acceptable level;
• the intended use and the operational characteristics of the machinery are comparable;
• the hazards and the elements of risk are comparable;
• the technical specifications are comparable;
• the conditions for use are comparable.
The purpose of assessing risk is to estimate the risk magnitude expressed as a level, index, score or injury
rate for each hazardous situation to which a person could be exposed. The risk associated with a particular
hazardous situation depends on the following elements:
a) the severity of harm;
b) the probability of occurrence of that harm, which is a function of:
• the exposure of a person(s) to the hazard,
• the occurrence of a hazardous event,
• the technical and/or human possibilities of avoiding or limiting the harm.
Risk reduction efforts may not be completely effective or may result in excessive risk reduction measures if
the level of risk has not been estimated.
There are also hybrid systems that use a combination of methods or methods not listed above.
The choice of a specific risk scoring system is less important than the process itself. The benefit of risk
assessment comes from the discipline of the process rather than in the absolute precision of the results, as
long as all the elements of risk are fully considered. Moreover, resources are better directed at risk reduction
efforts rather than towards an attempt to achieve absolute precision in risk estimation.
In practice, qualitative analysis is often used first to rank the risks in relation to one another, indicate the level
of risk and to reveal the most significant risks. Once risks have been broadly assessed, a more detailed
quantitative or qualitative approach can be used in order to assist the organization in making decisions
regarding whether risk levels are acceptable or require additional attention or risk reduction.
There are many variables that can influence the severity potential, including anthropometrics and
biomechanics. In most instances, where forces and energies are used to estimate severity potential, the
lowest value should be a pain threshold above which increasing degrees of harm may occur.
When determining risk, the most credible severity of harm should be selected rather than the extremes (the
worst or least possible severity). The selection of the severity level needs to be made in an objective and
realistic manner. For example, a minor laceration can potentially become fatal if it becomes septic, but death
is a rare outcome of this type of injury.
The values in the table are rooted in research and various studies conducted over the last several decades and have been shown to be valuable
time-tested guidance, however, the values should not be used as precise classifications of severity. Values may differ based on a variety of factors,
not the least of which are application specific data or individual susceptibilities. Some detailed injury information presented below may be useful in
evaluating historical data with known hazardous events. Variations to this table are acceptable.
Fracture ** Fracture of major skeletal Fracture of long bones in Fracture of small bones, Contusions and skin
support structures typically arms, legs or fracture of the typically caused by loads abrasions typically
caused by loads exceeding skull or spine, typically between 297 kPa (43 psi) caused by loads
399.9 kPa (58 psi) under caused by loads exceeding and 399.9 kPa (58 psi) between 83 kPa (12 psi)
certain test conditions. 297 kPa (43 psi) and 399.9 under certain test and 297 kPa (43 psi)
kPa (58 psi) under certain conditions. under certain test
For example, fracture of the test conditions. conditions. No physical
spinal column. For example: signs typically caused
For example: • extremities (finger, by dynamic loads less
• ankle; toe, hand, foot); than 83 kPa (12 psi)
• leg (femur or lower leg); • wrist; under certain test
• hip; • arm; conditions.
• skull; • rib;
• spine (minor • sternum;
compression fracture); • nose;
• jaw (severe); • tooth;
• larynx; • jaw;
• multiple rib fractures • bones around eye.
leading to a hemo- or
pneumothorax.
Substances For example: For example: For example: Local slight irritation.
Irritation, dermatitis, inflammation or • lungs, requiring • lungs, respiratory • reversible eye
corrosive effect of substances (inhalation, respiratory insufficiency, chemical damage;
dermal) assistance; pneumonia; • reversible systemic
• asphyxia; • partial loss of sight; effects;
Refer to OSHA, NIOSH, ACGIH, NFPA • irreversible systemic • corrosive effects. • inflammatory
45-2011, and EPA for details concerning effects. effects.
specific substances.
Allergic reaction or sensitization For example: For example: For example: Mild or local allergic
• anaphylactic • strong sensitization • allergic reaction; reaction.
Refer to OSHA, NIOSH, ACGIH, NFPA reaction; that provokes allergic • widespread allergic
45-2011, and EPA for details concerning • shock; reactions to multiple contact dermatitis.
specific substances. • fatality. substances.
* Note: Contact with a hot surface is based upon contact with aluminum less than 1 second. Temperature threshold will vary and which are dependent upon the material contacted
and the duration of contact. For data on burn thresholds of contact with other materials, and for more information on assessing the risk of burning, see ISO 13732-1.
** Note: Fracture and amputation force are derived from a literature search that identified pain and fracture thresholds at 150 N, (33.7 lbf), 400 N (89.9 lbf), and 2000 N (449.6 lbf) using
an 80 mm (3.15 in) diameter load cell.
*** Note: “Let Go Current” is a term of art that refers to the maximal current at which a person can withdraw or “let go” voluntarily.
**** Note: Contact with High Voltage/Low Current may result in injury due to physical harm and/or reflexive reaction causing falls and/or unintended movement into a hazard.
The absence of an incident history or a small number of incidents should not be taken as an automatic
presumption of a low probability of harm without confirming the existence of risk reduction measures or
identifying other existing mitigating factors. Information on “near misses” and “close calls” should be assessed
with the same significance as injury data with a judgment of the extent of the injury which most likely would
have occurred under slightly different circumstances. Where hazards exist and exposure continues without
risk reduction measures, the continued exposure can lead to injury.
Evaluating the probability of the occurrence of harm is a subjective evaluation based on the information
available. Achieving precision in probability estimates provides little value. Time, energy and resources are
better spent on reducing risk than on estimating probability.
When assessing the initial risk, the tendency is to assume the probability of occurrence is very likely since risk
reduction measures have not yet been applied. However, Table 9 provides some examples of considerations
for initial risk assessment when evaluating the probability of occurrence.
The hierarchy of controls can be used as a means to estimate the probability of the occurrence of harm after
risk reduction measures have been applied. When properly designed, applied, and maintained, higher order
risk reduction measures typically have a lower probability of failures to danger than lower order risk reduction
measures.
There are many different risk rating systems available and in use, but there is no universally accepted
approach. Some systems contain both the risk matrix as well as remediation strategies, while others may not.
It is left to the organization to choose a technique which best fits its business model and risk tolerance. Some
organizations have chosen to take the matrix from one source and the remediation from another. Others have
taken a system which has both, as presented, or have modified it to suit their specific needs or concerns.
Again, it should be emphasized that the ultimate value of the risk assessment is in the structure and discipline
of the process and not in the absolute accuracy of the results. It has been shown that various instruments
lead to very similar results both in risk levels as well as in remediation performance requirements.
In addition to the examples below, there are other rating and evaluation systems which may meet the needs
of the organization. Some practical examples of real risk assessments using these are given in Annex H.
The risk scoring system in Table 10 defines the probability and the severity in a “two-factor” (severity and
probability) chart. The majority of rating systems result in either four or five risk categories. In most cases,
the remediation design variations between the lowest and next higher risk level in a five-category system are
slight and are frequently lumped together with only minor discretionary design variations into what ultimately
becomes a four-category stratification.
E0 - Prevented
NEGLIGIBLE
A1 - Likely
S1 - Minor E1 - Low
A2/A3 - Not
likely/possible
E2 - High
LOW
E0 - Prevented
E1 - Low
S2 - Moderate
MEDIUM
A1 - Likely
E2 - High
A2/A3 - Not likely/possible
HIGH
E0 - Prevented
LOW
E1 - Low
S3 - Serious
HIGH
A1/A2 - Likely/Not likely
E2 - High
A3 - Not possible
VERY HIGH
– Insuffic ient clearance to mov e out of the way and safety -rated reduc ed
speed control is not used
– the robot system layout causes the operator to be trapped, with the
Not possible escape route toward the hazard
A3 – safeguarding is not expected to offer protection from the pr oc ess
haz ard (e.g., ex plosion or eruption haz ard)
If any of the abov e are applicable, the rating is NOT POSSIBLE
– insufficient c learanc e to move out of the way and s afety -rated reduced
speed control is used
– obstructed path to move to safe area
Avoidance Not likely – haz ard is moving faster than reduc ed speed (250 mm/sec ; 10 in/s ec)
A2 – inadequate warning/reaction time
– might not perceiv e the haz ard ex ists
If any of the abov e are applicable, the rating is NOT LIKELY
– sufficient clearance to move out of the way
– haz ard is incapable of moving greater than reduced speed (25 0
Likely mm/sec; 10 in/sec)
A1 – adequate warning/reaction time
– positioned in a safe loc ation away from the hazard
If any of the abov e are applicable, the rating is LIKELY
Likelihood:
FREQUENT: Likely to occur repeatedly
PROBABLE: Likely to occur several times
OCCASIONAL: Likely to occur sometimes
REMOTE: Not likely to occur
IMPROBABLE: Very unlikely to occur – may assume exposure will not happen
Severity/Consequence:
NEGLIGIBLE: First Aid or minor medical treatment
MARGINAL: Minor injury, lost workday accident
CRITICAL: Disability in excess of three months
CATASTROPHIC: Death or permanent total disability
Risk Level:
LOW: Risk acceptable, remedial action discretionary
MEDIUM: Take remedial action at appropriate time
SERIOUS: High priority remedial action
HIGH: Operation not permissible
NOTE: These definitions are provided for illustrative purposes only and each organization will need to define
these terms for their own purposes and/or process.
e) Organization culture
o Is the risk level consistent with corporate policy?
o Are personnel encouraged to watch out for each other?
o Do personnel have the ability/motivation to share their methods for improving safety and
efficiency?
f) Personnel experience
o Are personnel experienced in the recognition of how and when hazardous situations
emerge?
o Can human factors or ergonomics such as fatigue, distraction or complacency impact
personnel?
Statement of Conformity:
The following text is a sample Statement of Conformity. The wording can be adjusted as appropriate to
meet the needs of a particular machine supplier or application. The machine supplier should list only the
standards by which the supplier is confident that conformance to their requirements is complete. Some
standards can be incorporated by reference (for example, ASME B20.1 is referenced in ANSI B11.0, thus,
listing B11.0 may be sufficient).
The XYZ Company, declares that the above machine conforms to the provisions of the following Standards and
Regulations: [include examples of regulations and or applicable standards specifically included in the contract]:
Based on the application of these standards an acceptable level of risk has been achieved.
Title Address
After identifying the above elements, the machine can be divided into appropriate control zones to:
• accommodate the task zones;
• allow a portion of the machine to continue production while tasks are carried out within an
individual zone.
Layout analysis is an iterative process and part of risk reduction. Layout analysis may result in one or
more of the following:
a) modification of the layout, the machine functionality or the machine limits;
b) modification or addition of new special modes of operation (see 7.3.9 and Annex K);
c) change or modification of some equipment in order to suppress or modify some tasks;
d) determination of new access means;
e) modification of the means by which tasks are performed.
Design reviews are part of the iterative process described above. When acceptable risk and machine
functionality have been achieved, layout analysis is complete.
K.1 – General
Operating a machine under special mode is a combination of specific risk reduction measures and safe
work procedures to provide protection to the operator when the special mode is active.
A special mode usually limits potentially hazardous situations by restricting operating parameters such as
velocities, movement, torque, access, etc., and restricts potential hazards that are not required for the
special mode (e.g., allowing slow speed motion of an auger to permit cleaning but prohibiting all other
motions or transfers).
Operation under special mode (e.g., temporary observation of automatic processes) should occur while
associated risks are reduced to an acceptable level by applying alternative risk reduction measures.
Risk reduction measures should be implemented in such a way that reasonably foreseeable misuse will
also be prevented.
This form of action should be the subject of focused communication between the supplier and user in order
to analyze the requirements for the safe work procedures for personnel and then translate the requirements
into the risk assessment (see 4.2).
If a special mode of the machine or of parts of the machine is necessary, a decision process according to
Figure 11 should be applied.
K.2 – Considerations on Risk Reduction for Special Mode (see Figure 11)
a) Evaluate the requirement for personnel to be “closer” to the working process. Determine if the
working process can be controlled by the relevant modes of operation described in the appropriate
machine-specific “base” safety standards. Consider if additional systems may eliminate or reduce tasks
requiring special mode (e.g., video cameras, remote detection or measurement devices). Conduct
discussions between the supplier and the user. The user should sufficiently explain that a special mode of
operation is absolutely necessary for the intended task (e.g., due to considerably varying tolerances,
correction of manufacturing, quality check, etc.).
b) Document the results of the discussions and, in particular, the reasons for the special mode of
operation. Restrict special modes of operation to only the specific task in the scope of the intended use.
c) The intended use of the machine with application of the special mode of operation should be
specifically identified and included in the technical documentation. The risk reduction measures should
include the intended use for the task identified for the risk assessment (see clause 6), and the particular
conditions (e.g., personnel close to the process) should be taken into account.
d) The reduction of risk by means of design measures according to the hierarchy of controls is of
highest priority for the risk reduction strategy.
e) When design measures are not feasible, engineering controls (guards, control functions and
devices) for risk reduction should be considered. The engineering controls should reduce the risks and
restrict the special mode of operation to the required minimum extent in order to prevent misuse, for
example by:
• safe limiting of speed and transverse paths to the required level only;
• manual restart of moving parts;
• control of hazardous situations (e.g., movements/axes) not required for the special mode;
• prevention of automatic tool changing;
• prevention of pallet changing;
• control of external hazards, such as automated guided vehicles (AGVs), robots, gantries,
conveyors and storage / retrieval systems;
• prevention of putting fluids (e.g., cooling, lubricant, metal removal fluid) under high pressure;
• manual acknowledgement of cooling agent release;
• easy accessibility of emergency stop devices for stopping in case of emergency; and
• authorized access only (e.g., by key operated control or password).
f) additional risk reduction measures by administrative controls should also be applied as necessary,
such as:
• restricting access to qualified personnel;
• providing regular training (see clause 10);
• personal protective equipment (e.g., protective glasses/shoes, wearing of suitable clothing);
• posting operating instructions concerning the special mode of operation at the machine; such
measures should be documented and included as a requirement in the operation manual and
as markings or warning signs on the machine.
g) The iterative process should be continued until acceptable risk is achieved.
h) Risk reduction measures used for special mode should be reviewed against regulatory
requirements as applicable, such as:
• international;
• regional;
• local.
i) All information relating to the special mode of operation should be documented in the operating
manual, including:
• intended use;
• precautions against reasonably foreseeable misuse;
• description of operation and functions;
• other requirements concerning maintenance and control.
j) If sufficient risk reduction has been achieved, the special mode of operation may be provided. If
the residual risk is not acceptable, no special mode of operation should be provided for the machine.
Lockout or tagout is the primary method of hazardous energy control. Lockout or tagout is used to secure
the energy isolating device(s) to control hazardous energy to the machinery, equipment, or processes from
the energy source. Tagout is a less preferred method for controlling hazardous energy. The control of
hazardous energy includes isolation, de-energization, and checking and testing which takes into account
the impacts of residual energy.
This annex describes considerations related to implementing alternative methods to control hazardous
energy rather than lockout or tagout. This annex is for users who face the following question:
“What do we do if a task:
• requires manual suspension of engineering controls?
• requires service and maintenance but also requires power?
• may not qualify for the Minor Servicing Exception to lockout or tagout under OSHA?”
However, lockout or tagout is not always feasible. Some tasks require power. Other tasks could
theoretically be performed under lockout or tagout, but are truly impractical to complete under full lockout
or tagout. Still other tasks can be completed more effectively, efficiently and with reduced risk using
alternative methods.
Other terms used include “alternative measures” and “alternative protective methods.” There are no
differences in the meaning of these terms.
The manual should include but not be limited to the following, where applicable:
• performance specifications;
• appropriate schematics and diagrams;
• physical environment for which the machine is designed;
• function and location of the operator controls, indicators, and displays;
• schedules for periodic maintenance, lubrication, and inspection;
• application of risk reduction measures;
• auxiliary equipment.
The manual and/or other written instructions (e.g., on the packaging) may contain:
a) Information relating to transport, handling and storage of the machine, for example:
• storage conditions for the machine;
• dimensions, mass value(s), position of the center(s) of gravity;
• indications for handling (e.g., drawings indicating application points for lifting equipment).
To assist the user in developing an operator training program, the following guidelines are recommended:
1. “Tell the operator” – Have the operator(s) read and understand the manual. Provide adequate verbal
and written instructions to the operator(s). Evaluate the operator’s understanding of the instruction before
proceeding.
2. “Show the operator” – Have the operator(s) observe an experienced operator(s) or supervisor running
the equipment.
3. “Let the operator do it” – After steps 1 and 2 have been satisfactorily completed, let the operator(s)
run the equipment under close supervision.
4. “Correct the operator, if necessary” – Having observed the operator(s) running the equipment, make
recommendations and corrections, if necessary.
5. “Evaluate and assign the operator” - After steps 1 through 4 have been satisfactorily completed,
assign to the operator the responsibility of running the equipment.
6. “Follow up on instructions” – At specified intervals, observe the operator(s) and review performance
to ensure compliance with instructions, operating procedures, and safety guidelines.
7. “Revise, update, re-train” – Keep instructions current. Any revisions should be reviewed with the
operator(s) to assure safe operation of the equipment.
The following guidelines are recommended to help ensure safe operation of machines:
• The user should have job descriptions that outline the skills required for each operator;
• The training of operators should be of the "On-The-Job" type. Trainees should be initially assigned
to work with experienced personnel or under the direct supervision of a knowledgeable individual until
the trainee has gained sufficient familiarity to work independently;
• A training schedule should be established by each user. This schedule should outline the progression
of advancement through the necessary trainee and operator positions as covered by the job
descriptions. A training timetable can be a part of this training schedule, but the emphasis should be
on actual skills acquired rather than the elapsed or prescribed time in an individual's training history.
The following generic example questions may be administered to machine operators as a means of
reviewing their knowledge. A quiz may be administered in writing or orally. User organizations may wish
to expand upon this basic content to provide questions relating to unique machine tasks or procedures. A
quiz should be given during initial operator training and periodically thereafter.
6. If during a visual inspection, leaks in the air or hydraulic system are detected, you must:
(a) Shut off the machine immediately until it can be repaired/checked for safe operation.
(b) Continue working until the machine can be repaired.
(c) Continue working and report at the end of your shift to your supervisor/team leader.
(d) None of the above.
7. Before cycling the machine at the start of each shift, you must:
(a) Check all safety devices for proper operation.
(b) Visually inspect machine for leaks and proper set-up.
(c) Make sure all personnel are clear of the machine.
(d) None of the above.
(e) (a), (b) and (c).
8. When an emergency exists, what method is used to shut down the machine?
(a) Finish the cycle and turn off the machine.
(b) Finish the part and turn off the machine.
(c) Activate the emergency stop device.
(d) None of the above.
1. (d)
2. (d)
3. (d)
4. (b)
5. (c)
6. (a)
7. (e)
8. (c)
9. (b)
10. (f)
11. (d)
12. (e)
The reader is cautioned to note that this listing is not intended to be a completely comprehensive one, nor
is it intended to imply a direct correlation between similar standards in different regions.
The information contained in this annex was current as of the date of publication.
Figure 14 — International standards (ISO & IEC only; other international standards may apply)
Figure 15 — Terms for Persons used in the B11 series of machinery safety standards
• Individuals may enter an industrial environment (workplace). They become Affected Persons
when they are in proximity to a machine or equipment.
• Certain Individuals are considered Personnel if they are employed or contracted to work in the
industrial environment (workplace). Personnel may or may not be under the direct control of the
machinery supplier or user. Personnel may include operators, maintenance personnel and
others. Although not explicitly defined in B11 standards, “Other” as used in Figure 15 may
include service personnel, contractors, subcontractors, etc.
• With appropriate training, personnel can become Qualified Personnel.
• With permission from the machinery supplier or user, Qualified Personnel can become Authorized
Personnel.
• A Supervisor oversees the work of various Personnel.
R.1 – Introduction
Achieving acceptable risk is the purpose of risk assessment and application of risk reduction measures.
Whenever possible, elimination and isolation of hazardous energy is the preferred method to reduce risk to
individuals. However, certain tasks require partial (or full) energization to perform the task. Energy control
is not required for activities where power is required to perform a task, as long as risk reduction measures
are provided to achieve acceptable risk. See also, ANSI / ASSP Z244.1.
In these situations, a risk assessment will determine if reduced-energy applied as a risk reduction measure
– typically with additional risk reduction measures, such as engineering controls or administrative controls
– will result in acceptable risk (e.g., a ‘safe condition’ as addressed in this document). For reduction of risk
to individuals, reduced-energy modes of operation typically apply to speed, force, pressure and temperature
values. When reduced energy is utilized as a risk reduction measure, the condition is a safety function and
must meet the requirements of ANSI B11.19.
A review of available literature published in February 2017 by The Institut de recherche Robert-Sauvé en
santé et en sécurité du travail (IRSST) in Quebec, Canada revealed a wide variety of recommendations
with respect to reduced-energy levels (see also, IRSST R-956 [0]). The abstract of the study describes
the research:
ABSTRACT
The hazards associated with the moving parts of industrial machines are known to be the
source of serious and even fatal accidents. The purpose of section 189.1 (previously 186)
of the Quebec Regulation respecting Occupational Health and Safety (ROHS) is to provide
guidance for machine maintenance, repair and adjustment work, further to section 182,
which governs production work by prohibiting access to hazard zones and ensuring that
moving parts are stopped when workers enter these zones. The focus of this research
project was the application of ROHS section 186. The first objective was to assess the
state of knowledge and recommendations in the literature on reduced-energy modes of
operation, especially in terms of speed, force, pressure, and temperature values. The
second objective was to understand, through factory visits, how ROHS section 186 is being
implemented.
Last, the study revealed that reduced-energy values depend on many factors and that the wide variety of
possible situations makes it necessary to conduct an in-depth risk analysis. The application of ROHS
section 186 is therefore an integral part of the risk assessment and reduction process for tasks where
workers have no alternative but to enter the zone where machine parts are in motion. The purpose of this
process is to achieve a level of risk comparable to that contemplated in ROHS section 182, by taking
protective measures that will compensate for opening a guard or starting up the machine. These protective
measures are based on three principles: reduce harm, increase the possibility of avoiding harm and reduce
exposure to the hazard. Yet the issue of determining reduced-energy levels remains unresolved.
Generally speaking, when the literature recommends values, if the situation in question corresponds exactly
to the context described in the literature, then designers may use these same values. On the other hand,
when no reference is available, the determination of a tolerable energy level must be based on more
extensive thought and analysis. Only a thorough comparison of the context of the proposals made in the
literature and that of the real situation will allow extrapolation of the recommendations to comparable, but
not identical situations. A risk analysis must be conducted. The study identified some reference points or
factors that will provide guidance to designers and users as they analyze specific cases and try to decide
on the most appropriate values for reduced speed, force, kinetic energy and contact pressure.
The recommendations, based primarily on standards and closely related to a specific context, often require
additional risk reduction measures since a reduction in energy alone is often not sufficient to achieve
acceptable residual risk. The latest edition of the source document should be referenced before any
determination is made. Combining reduction of energy levels with additional risk reduction measures is a
compromise between different application constraints (related to task requirements, machine design,
production requirements, etc.) and risk reduction in order to reduce potential harm. Acceptable reduced-
energy values depend on many factors. Therefore, a comprehensive risk assessment is required to identify
the wide variety of possible situations in order to determine applicable values to achieve acceptable risk
where personnel must perform tasks with full or partial energy available.
A risk reduction process is based on eliminating hazards and/or reducing risk to individuals. However, the
issue of determining acceptable reduced-energy levels remains unresolved. Generally speaking, when
literature recommends a specific value, the specific application must correspond exactly to the context
described in order for the identified values to be applicable. Furthermore, when no reference is available,
the determination of a tolerable energy level must be based on more extensive evaluation of the risk factors;
probability of occurrence of harm and the severity of that harm. A thorough comparison of the context of
the proposals made in literature and that of the real situation will allow extrapolation of the recommendations
to comparable, but not identical situations. The IRSST study identified some reference points or factors
that will provide guidance to analyze specific cases and determine the most appropriate values for reduced
speed, force, kinetic energy and contact pressure.
The primary objective of the peer-reviewed IRSST study was to review the knowledge of reduced-energy
operating modes and recommendations on standard practices in industry, including a characterization of
the energy levels of various hazards: mechanical (speed and force), hydraulic and pneumatic (pressure),
and thermal (temperature). The data provided below are excerpts from the IRSST study, and they are
provided in this Annex as informative only; a thorough risk assessment is required for each hazardous
situation.
Prescribed Speed 1
Industry Machines – Machine Part (if specified) Source
mm/s in/s
Printing Embosser – Rolls, backing rolls, laminating rolls 83 3.27 [6]
Printing and paper converting machine –
Printing Common requirements 83 3.27 [15]
Unwinder/rewinder
Printing Printing press (with varnishing sheets) 83 3.27 [3]
Horizontal rotary bobbin unwinder
Printing 83 3.27 [4]
Litho-laminators
Printing Corrugator – Preheater 83 3.27 [5]
Manufacturing Machining center 83 3.27 [21]
Printing Envelope-making machine – Printer group 100 3.94 [4]
Printing Corrugator, single-sided 100 3.94 [5]
Printing Rotary printing press and varnishing machine 133 5.24 [3]
Manufacturing Machining center 133 5.24 [21]
Printing Printing press 167 6.57 [2]
Printing Binding and finishing system 167 6.57 [6]
Textile industry Textile industry – Gill box 167 6.57 [26]
Printing Glue binder machine 167 6.57 [4]
Industrial robots Robot 170 6.69 [27]
Industrial robots Robot 200 7.87 [28]
Pulp and Paper Calender 200 7.87 [29]
Industrial robots Robot 250 9.84 [30]
Manufacturing Integrated manufacturing system 250 9.84 [13]
Textile industry Air transportation of processed materials 250 9.84 [19]
General General 250 9.84 [1]
Printing Corrugator – Splicer 250 9.84 [5]
Pulp and paper Paper making and finishing machine – General requirements 250 9.84 [31]
Pulp and paper Cutter 300 11.81 [24]
Printing Printing Press 330 13.00 [2]
Mining Roof bolter 330 13.00 [32]
Printing Unwinder/rewinder 330 13.00 [15]
Printing Hardcover book production line 330 13.00 [4]
Printing Corrugator – Stacker 1 500 59.06 [5]
1 The prescribed speeds are linear (speed of an object in translational motion or peripheral speed of a rotating object).
Standard ISO 13732-1 [39] gives temperature thresholds that can cause burns when the skin of an
individual is in contact with a hot surface for 0.5 seconds or more. The latest edition of the source document
should be referenced before any determination is made.
As shown in Figure 17, temperatures and exposure times have been defined and may be used to determine
the severity of harm to individuals based on exposure.
Figure 17 — Burn threshold when skin contacts smooth, hot, bare metal surface
[from ISO 13732-1]
The additional risk reduction measures most frequently discussed in literature in order of frequency are
listed below (see also, ANSI B11.19):
• hold-to-run control;
• emergency stop accessible nearby;
• automatic opening device (or reversal of movement device);
• safe clearance;
• enabling device;
• minimum distance between a fixed component (e.g., built) and a movable component;
• sound signal;
• operating mode selector switch;
• training; and
• placement of control device so that hazard zone can always be seen by person operating control
device.
There are a variety of risk reduction measures associated with reduced-speed/force mode and their
effectiveness varies. Manual or hold-to-run controls are the most common engineering controls – device
which are generally recommended for machine start-up, as they allow personnel to retain control over
hazardous situations at all times during exposure. In addition, in all cases, and especially when several
individuals are present in the hazard zone simultaneously, it is recommended that the safety-related manual
control device be located so that the hazard(s) within the span of control can always be seen by the
individual controlling the hazard [3]. Similarly, some standards contain recommendations about the level
of safety performance for the additional engineering controls – devices and its associated SRP/CS, such
as hold-to-run controls. The recommendations proposed in the literature on the level of safety performance
are listed in Table 20. The latest edition of the source document should be referenced before any
determination is made.
Table 20 — Recommendations on Performance of Safety Levels for Reduced-Energy
Operating Modes
Recommendations for Level
Industry Machines (if specified) Standard
of Safety Performance
Printing and paper converting Common requirements Category 1, EN 954-1:1996 EN 1010-5:2005
ANSI B65.1:2005
Printing Printing press Category 3, ISO 13849-1:1999
ANSI B65.2:2005
PLr d, ISO 13849-1:1999, or
Printing Binding and finishing system ANSI B65-1:2011
SIL 2, IEC 62061
Printing Binding and finishing system Category B, EN 954:1996 EN 1010-4:2004
Textile industry Fabric manufacturing Category 3 or 4, ISO 13849-1:1999 ISO 11111-6:2009
Manufacturing Machining center Category 3, EN 954:1996 EN 12417+A2:2009
Pulp and paper Sheeter Category 1, EN 954:1996 EN 1034-5+A1:2010
NOTE The Categories of EN 954-1:1996 [42] are the same as those of ISO 13849-1:1999 [43].
R.8 – IRSST Study Bibliography The sources referenced in this Annex are listed below:
[0] Chinniah, Y., Aucourt, B., Bourbonnière, R. (2015). “Study of machine safety for reduced-speed or reduced-
force work,” Robert Sauvé Research Institute in Occupational Health and Safety, Québec, Canada, Report R-
956.
[1] ISO, “Safety of machinery: Risk assessment. Part 2, Practical guidance and examples of methods,” ISO/TR
14121-2, 2007.
[2] ANSI, “American national standard: graphic technology - safety standard - printing press systems,” ANSI B65.1,
2005.
[3] AFNOR, “Safety of machinery: Safety requirements for the design and construction of printing and paper
converting machines. Part 2, Printing and varnishing machines including pre-press machinery,” EN 1010-2,
2010.
[4] AFNOR, “Safety of machinery: Safety requirements for the design and construction of printing and paper
converting machines. Part 4, Bookbinding, paper converting and finishing machines,” EN 1010-4, 2010.
[5] AFNOR, “Safety of machinery: Safety requirements for the design and construction of printing and paper
converting machines - Part 5: Machines for the production of corrugated board and machines for the conversion
of flat corrugated board,” EN 1010-5, 2005.
[6] American National Standards Institute, “American national standard: graphic technology: Safety requirements
for binding and finishing systems and equipment,” ANSI B65.2, 2005.
[7] "Health and safety self-diagnostic grid of work – Folding Presses,” Joint Sectoral Association for Occupational
Health and Safety in the Metal Product Manufacturing, Electrical Products and Clothing Industries (ASPHME)
sector, Québec, Canada.
[8] CSA, “Code for power press operation: Health, safety, and safeguarding requirements,” CSA Z142, 2010.
[9] Burlet-Vienney, D., Jocelyn, S., Daigle, R., Massé, S., “Safeguarding of hydraulic power press brakes,” Robert
Sauvé Research Institute in Occupational Health and Safety, Québec, Canada, Guide RF-651, 2010.
[10] Bello, J.-P., Cazin, B., Caillet, J.-P., Hue, G., “Working safely of hydraulic folding presses,” French National
Research and Safety Institute for the Prevention of Occupational Accidents and Diseases, France, Guide ED-
879, 2011.
[11] Gillot, J., Baudoin, J., Bello, J.-P., Blaise, J.-C., “Hydraulic bending presses for cold metal work – improved safety
on machinery – technical specifications for use by users, inventors and innovators,” French National Research
and Safety Institute for the Prevention of Occupational Accidents and Diseases, France, Guide ED-927, 2010.
[12] ISO, “Textile machinery: Safety requirements. Part 6, Fabric manufacturing machinery,” ISO 11111-6, 2009.
[13] ISO, “Safety of machinery: Integrated manufacturing systems: Basic requirements,” ISO 11161, 2007.
[14] AFNOR, “Plastics and rubber machines: injection moulding machines: Safety requirements,” EN 201, 2009.
[15] AFNOR, “Safety of machinery – Safety requirements for the design and construction of printing and paper
converting machines – Part 1: Common requirements,” EN 1010-1+A1, 2011.
[16] Beauchamp, Y., Jaraiedi, M., Etherton, J., “Manual Control of Industrial Robots: Slow Speed,” Proceedings of
the 20th Annual meeting of the Canadian Ergonomics Association, vol. 20, pp. 31-34, 1987.
[17] AFNOR, “Safety of machinery: Safety requirements for the design and construction. Part 3, Rereelers and
winders,” EN 1034-3, 2012.
[18] ASSE, “Control of hazardous energy lockout/tagout and alternative methods,” ASSE/ANSI Z244.1, 2008.
[19] ISO, “Textile machinery: Safety requirements. Part 1, Common requirements,” ISO, ISO 11111-1, 2009.
[20] Lupin, H., “High-speed machining centres (UGV centres),” French National Research and Security Institute,
Guide ND-2138, 2003.
[21] AFNOR, “Machine tools: Safety: Machining centres,” EN 12417+A2, 2009.
[22] ANSI, “Graphic technology: safety requirements for graphic technology equipment and systems. Part 3, binding
and finishing equipment and systems,” ANSI B65-3, 2011.
[23] AFNOR, “Safety of machinery: Safety requirements for the design and construction of printing and paper
converting machines. Part 3, Cutting machines,” EN 1010-3, 2010.
[24] AFNOR, “Safety of machinery: Safety requirements for the design and construction of paper making and finishing
machines. Part 5, Sheeters,” EN 1034-5+A1, 2010.
[25] ANSI, “American national standard: graphic technology: safety requirements for graphic technology equipment
and systems. Part 1, general requirements,” ANSI B65.1, 2011.
[26] ISO, “Textile machinery: Safety requirements. Part 2, Spinning preparatory and spinning machines,” ISO 11111-
2, 2009.
[27] Beauchamp, Y., Stobbe, T.J., Ghosh, K., Imbeau, D., “Determination of a Safe Slow Robot Motion Speed Based
on the Effect of Environmental Factors,” Human factors, vol. 33, no. 4, pp. 419-427, 1991.
[28] Karwowski, W., Parsaei, H., Soundararajan, A., Pongpatanasuegsa, N., “Estimation of Safe Distance from the
Robot Arm as a Guide for Limiting Slow Speed of Robot Motions,” Proceedings of the Human Factors Society
36th Annual Meeting, vol. 2, pp. 992-996, 1992.
[29] AFNOR, “Safety of machinery. Safety requirements for the design and construction of paper making and finishing
machines. Part 6, Calender,” EN 1034-6+A1, 2010.
[30] ANSI, “American National Standards for industrial robots and robot systems: safety requirements,” ANSI / RIA
R15.06, 1999.
[31] AFNOR “Safety of machinery: Safety requirements for the design and construction of paper making and finishing
machines. Part 1, Common requirements,” EN 1034-1+A, 2010.
[32] Ambrose, D.H., Bartels, J.R., Kwitowski, A.J., Gallagher, S., Battenhouse Jr., T.R., “Computer simulations help
determine safe vertical boom speeds for roof bolting in underground coal mines,” Journal of safety research, vol.
36, pp. 387-397, 2005.
[33] "Prevention of mechanical risks, practical solutions,” International Association of Social Security (ISSA)
prevention series, no. 2014, Genève, 1994.
[34] Lupin, H., Marsot, J., “Safety of machinery and work equipment: means of protection against mechanical
hazards,” French National Research and Safety Institute for the Prevention of Occupational Accidents and
Diseases, France, Guide ED-807, 2006.
NOTE: This publication has been replaced by INRS guide ED-6122 [44].
[35] CSA, “Safety code for elevators,” CSA B44-00, 2003.
[36] ISO, “Safety of machinery: Guards: General requirements for the design and construction of fixed and movable
guards,” ISO 14120, 2007.
[37] Lupien, T., “Action on machinery: The right trimmer,” Joint Sectoral Association of Occupational Health and
Safety, Printing Sector and Related Activities", Québec, Canada, 2010.
[38] AFNOR, “Safety of packaging machines. Part 8, Strapping machines,” EN 415-8, 2008.
[39] ISO, “Ergonomics of the thermal environment. Method for the assessment of human responses to contact with
surfaces. Part 1, Hot surfaces,” ISO 13732-1, 2008.
[40] Institute for Foreign Relations (IFA), “BG/BGIA risk assessment recommendations according to machinery
directive: design of workplaces with collaborative robots,” German Statuatory Accident Insurance, 2011.
[41] AFNOR, “Safety of packaging machines. Part 10, General requirements,”, EN 415-10, 2014.
[42] CEN, “Safety of machinery: Safety-related parts of control systems. Part 1, General principles for design,” EN
954-1, 1996.
[43] ISO, “Safety of machinery - Safety-related parts of control systems. Part 1, General principles for design,” ISO
13849-1, 1999.
[44] Blaise, J.-C., Lefèvre, B.-D., Lupin, H., Marsot, J., Wélitz, G., “Safety of work equipment: Prevention of
mechanical risks,” French National Research and Safety Institute for the Prevention of Occupational Accidents
and Diseases, France, Guide ED-6122, 2012.
[45] AFNOR, “Safety of packaging machines. Part 7, Group and secondary packaging machines,” EN 415-7, 2008.
ANSI-ISO 12100:2012 (ISO 12100:2010 IDT) Safety of Machinery — General principles for design, risk
assessment and risk reduction
ANSI Z590.3 – 2011 (R2016) Prevention through Design - Guidelines for Addressing Occupational Hazards
and Risks in Design and Redesign Processes
ANSI / RIA R15.06 – 2012 Safety Requirements for Industrial Robots and Robot Systems
ANSI / PMMI B155.1 – 2016 Safety Requirements for Packaging and Processing Machinery
ANSI / ASSP A1264.1 – 2017 Safety Requirements for Industrial Fixed Stairs, Floor and Wall Openings,
and Industrial Railings and Toe Boards
ANSI / ASSP A1264.2 – 2012 Standard for the Provision of Slip Resistance on Walking/Working Surfaces
ANSI ASC A14.3-2008 (R2018) American National Standard for Safety Requirements for Fixed Ladders
ANSI / ASC O1.1-2013 Woodworking Machinery – Safety Requirements
ANSI / ASME B20.1 – 2021 Safety Standards for Conveyors and Related Equipment
ANSI Z136.1 – 2022 Standard for Safe Use of Lasers
ANSI Z136.9-2013 American National Standard for Safe Use of Lasers in Manufacturing Environments
ANSI / ASSP Z490.1– 2016 Criteria for Accepted Practices in Safety, Health and Environment Training
ASME Boiler And Pressure Vessel Code (BPVC) 2017 Section VIII, Division I
MIL STD 882E: 2012 Systems Safety Program Requirements
NFPA (National Fluid Power Association) / T2.6.1 R2 – 2001 (R19) Fluid power components – method for verifying
the fatigue and establishing the burst pressure ratings of the pressure containing envelope of a metal
fluid power component
IEC 60204-1:2016 Safety of machinery — Electrical equipment of machines — Part 1: General requirements
IEC 60825-1:2014 Safety of laser products — Part 1: Equipment classification, requirements and user's
guide
IEC 61000-6-4:2018 Electromagnetic compatibility (EMC) - Part 6-4: Generic standards - Emission
standard for industrial environments
IEC 61496-1:2020 Safety of machinery — Electro-sensitive protective equipment — Part 1: General
requirements and test
IEC 61496-2:2020 Safety of machinery — Electro-sensitive protective equipment - Part 2: Particular
requirements for equipment using active opto-electronic protective devices (AOPDs)
IEC 61508-1:2010 Functional safety of electrical/electronic/programmable electronic safety-related
systems — Part 1: General requirements
IEC 61508-3:2010 Functional safety of electrical/electronic/programmable electronic safety-related
systems — Part 3: Software requirements
IEC 62061:2021 Safety of machinery — Functional safety of safety-related electrical, electronic and
programmable electronic control systems
ISO 3864:2011 Graphical Symbols Series (includes ISO 3864-1, ISO 3864-2, ISO 3864-3 and ISO 3864-4)
ISO 13732-1:2006 Ergonomics of the thermal environment — Methods for the assessment of human
responses to contact with surfaces — Part 1: Hot surfaces
ISO 13732-3:2005 Ergonomics of the thermal environment — Methods for the assessment of human
responses to contact with surfaces – Part 3: Cold surfaces
ISO 13849-1:2023 Safety of machinery — Safety-related parts of control systems — Part 1: General
principles for design
ISO TR 13849-100:2000 Safety of machinery — Safety-related parts of control systems — Part 100:
Guidelines for the use and application of ISO 13849
ISO 13849-2:2012 Safety of machinery — Safety-related parts of control systems — Part 2: Validation
ISO 13850:2015 Safety of machinery — Emergency stop -- Principles for design
ISO 13857:2019 Safety of machinery — Safety distances to prevent hazard zones being reached by upper
and lower limbs
ISO TR 14121-2:2012 Safety of machinery — Risk assessment, Part 2: Practical guidance and examples
of methods
ISO 14159:2002 Safety of machinery — Hygiene requirements for the design of machinery
ISO 20607:2019 Safety of machinery - Instruction handbook - General drafting principles
ISO 21469:2006 Safety of machinery — Lubricants with incidental product contact — Hygiene
requirements
ISO 13855:2010 Safety of machinery — Positioning of protective equipment with respect to the approach
speeds of parts of the human body
ISO 13856-1:2013 Safety of machinery — Pressure-sensitive protective devices -- Part 1: General
principles for design and testing of pressure-sensitive mats and pressure-sensitive floors
ISO 14118:2017 Safety of machinery — Prevention of unexpected start-up
ISO 14119:2013 Safety of machinery — Interlocking devices associated with guards — Principles for
design and selection
ISO 14120:2015 Safety of machinery — Guards -- General requirements for the design and construction
of fixed and movable guards