A coloured cell or a two-digit score can help a plant team rank machinery hazards, but it cannot measure safety in the way an instrument measures pressure, temperature or speed. The value records a set of engineering judgements. To make those judgements useful, assessors must begin with a credible hazardous scenario, define every parameter and reassess the same scenario after risk reduction.
The number is an output, not a physical quantity
Risk-scoring methods appeal to busy engineering teams because they impose order. Severity, exposure, the occurrence of a hazardous event and the possibility of avoiding harm can be assigned classes and combined. The result supports prioritisation and can reveal whether different teams are applying a common method. It does not, however, provide an objective measurement with universal units.
A score of 12 in one plant may not be comparable with 12 in another. The formula, scales, thresholds and parameter definitions may all differ. Even within one organisation, two assessors can produce different results if one interprets “frequent” as once per shift while another interprets it as continuous exposure. A practical guide to the limits of machinery risk scoring is therefore most valuable when it brings the discussion back from the final number to the assumptions beneath it.
This distinction matters when working within the ISO 12100 risk-assessment process. A scoring tool can support risk estimation, but the formula does not replace identification of machinery limits, hazards, hazardous situations and foreseeable task conditions. The calculation is defensible only when a reviewer can reconstruct why each value was selected.
Start with a scenario, not a hazard label
Entries such as “moving parts”, “electrical hazard” or “stored pressure” are too broad to score meaningfully. A scenario should identify the person, task, machine state, route to exposure, hazardous event and reasonably foreseeable harm. It should also distinguish production from interventions such as setting, fault-finding, cleaning, jam clearance and maintenance.
Consider a guarded drive. During automatic production, the operator may have no access to the moving elements. During maintenance, the guard may be removed, stored energy may remain and another person may restore a supply. The source of hazard has not changed, but the hazardous situation has. Combining both cases into one score conceals the conditions that should determine the protective measures.
A useful statement might describe a maintenance technician reaching near an actuator during sensor adjustment, followed by unexpected movement when pneumatic pressure is restored. That description gives the assessment team something concrete to test. Who controls isolation? Can energy be dissipated? Is movement visible? How quickly could it occur? What body part is exposed, and what harm could realistically follow?
Challenge each probability assumption
Severity should describe the harm that could arise in the stated scenario. Installing an interlocked guard may reduce access or the likelihood of hazardous movement, but it does not automatically make contact with the underlying tool less severe. Lowering the severity value merely because a safeguard has been fitted can make the post-control result look better without representing the physical consequence.
Exposure must reflect real work rather than the intended production cycle alone. Review shift patterns, tool changes, cleaning, adjustments, recovery from common stoppages and access by maintenance personnel. A short task performed several times per shift may be more important than a lengthy annual intervention. Plant observations and discussions with operators can expose differences between the written procedure and the task as performed.
The hazardous event should also be stated explicitly. It may involve component failure, unexpected start-up, loss of a workpiece, pressure restoration, defeat of a guard or foreseeable human behaviour. “No previous accident” is not, by itself, a technical explanation for a low value. The team should identify what initiates the event and what existing measures influence its occurrence.
Avoidance is often the weakest assumption. Seeing a moving component does not establish that a person can avoid it. Engineers should consider speed, distance, warning, visibility, available escape space, the onset of movement and the time needed to recognise and respond. Training can support safe work, but it should not be converted automatically into confidence that an operator will always react in time.
Reassess what the control actually changed
Risk reduction should follow a defined hierarchy and be connected to the scenario. After a design change or safeguard is introduced, repeat the assessment using the same parameter definitions. Do not begin with the desired risk category and work backwards. Ask whether the measure changed severity, reduced exposure, made the hazardous event less likely or improved a genuine possibility of avoiding or limiting harm.
For example, moving an adjustment point outside a hazardous zone may reduce exposure. A mechanical restraint may prevent an actuator from moving during an intervention. Reduced speed under controlled conditions may affect the event or the opportunity to respond. Each claim should be supported by design information, inspection or appropriate testing rather than by a revised colour in a spreadsheet.
Traceability becomes especially important during retrofit and automation projects, where drawings, photographs, validation records and test reports may be created by different parties. Keeping machine risk assessment evidence linked to the relevant scenario and protective measure helps a reviewer see what was changed, what was checked and which assumptions still require confirmation. It also prevents a generic test record from being treated as proof for an unrelated hazard.
Make scoring repeatable without mistaking it for proof
A plant-wide method needs agreed parameter definitions, examples and decision rules. The assessment record should preserve the full parameter breakdown, not only “low”, “medium” or “high”. This matters because identical totals can arise from very different combinations: severe harm with rare exposure is not the same engineering problem as minor harm with frequent exposure.
Teams should also record uncertainty and disagreement. If production and maintenance personnel interpret exposure differently, the answer is not to average their scores silently. Observe the task, clarify its frequency and document the basis for the final class. Where operating conditions vary, separate scenarios may be more honest than a single compromise value.
For organisations seeking consistency across machines and sites, a repeatable machinery risk assessment process should define roles, review points, working methods and the treatment of evidence. Software can help structure records and comparisons, but responsibility remains with the people designing, modifying, supplying and operating the machine. A completed field is not evidence that an assumption is sound.
The final question is not whether the score has turned green. It is whether the scenario is clear, the assumptions are technically credible, the selected measures address the causes of harm and the residual risk has been reassessed and communicated. Used in that order, scoring organises engineering judgement. Used without it, the number can create precision without understanding.
