Tag: Hierarchy

The Third Level of the Hierarchy: Information for Use

This entry is part 3 of 3 in the series Hierarchy of Controls

I’ve writ­ten about the Hierarchy of Controls in past posts, but I’ve focused on the ‘engin­eer­ing’ side of the con­trol equa­tion: Physical changes to machine design to elim­in­ate haz­ards, and mech­an­ic­al or elec­tric­al con­trol sys­tems that can reduce risk.

The first two levels of the Hierarchy, Elimination/​Substitution and Engineering Controls, are typ­ic­ally more chal­len­ging to apply in most people’s minds, because expert know­ledge is required. These levels are also more effect­ive in con­trolling risk than the sub­sequent levels.

The Third Level

iStock_000009386795Small - Photo of Instruction manualThe third level of the Hierarchy is ‘Information for Use’, some­times abbre­vi­ated as ‘IFU.’ This level is decept­ively simple, and is fre­quently the level people want to jump to when the oth­er con­trols seem too dif­fi­cult to imple­ment. Done well, inform­a­tion for use can make a sig­ni­fic­ant con­tri­bu­tion to risk con­trol. Unfortunately, it’s done poorly or not at all more often than it’s done well.

Information for use includes:

  • Instructions and Manuals;
  • Operator Device tags and Legend Plates;
  • HMI screens;
  • Hazard Warning signs and labels;
  • Training Materials (text, video, audio) and Training (face-​to-​face, webinars, self-​directed);
  • Sales and mar­ket­ing mater­i­als.

Information for use is needed in all the stages of the product life cycle: Transportation, Installation, Commissioning, Use, Maintenance, Service, Decommissioning and Disposal [1]. At each stage in the life cycle, the con­tent of the inform­a­tion and the present­a­tion may be dif­fer­ent. In every stage it can make a sig­ni­fic­ant con­tri­bu­tion to risk reduc­tion by com­mu­nic­at­ing the safe approach to the tasks in that stage, and the risks related to those tasks. The inform­a­tion should include the inten­ded use and the fore­see­able mis­uses of the product. This is a leg­al require­ment in the EU [2], and is a best-​practice in North America.

In this art­icle I’m going to focus on instruc­tion manu­als. If you’re inter­ested in Hazard Warnings, includ­ing signs, labels, and integ­ra­tion into manu­als and instruc­tions, watch for a future post on this top­ic.

Legal requirements and standards

In the European Union, the leg­al oblig­a­tion to provide inform­a­tion with a product is enshrined in law [2].
No North American jur­is­dic­tions make an expli­cit require­ment for instruc­tions or inform­a­tion for use in law, but many product spe­cif­ic stand­ards include require­ments for the con­tent of manu­als.

CSA Z432 [3] out­lines require­ments for con­tent in Clause 17, and in EN 60204 – 1 [7]. IEC 62079 [4], provides guid­ance on the design and present­a­tion of instruc­tions. ANSI Z535.6 [5], provides spe­cif­ic instruc­tions on inclu­sion of haz­ard warn­ings in manu­als and instruc­tions.

Training require­ments are also dis­cussed in CSA Z432 [3], Clause 18.

5% Discount on ISO and IEC Standards with code: CC2011 

In the USA, provid­ing inform­a­tion for use with a product is con­sidered to be sound ‘due dili­gence’, how­ever, provid­ing inform­a­tion on resid­ual risk is often seen by liab­il­ity law­yers as dan­ger­ous, since man­u­fac­tur­ers are provid­ing inform­a­tion, in writ­ing, that their product is not ‘per­fectly safe.’ If you’ve read any­thing I’ve writ­ten on risk assess­ment, you’ll know that there is no such state as ‘per­fectly safe.’ If a haz­ard exists, a poten­tial for harm exists, a prob­ab­il­ity can be assessed and thus risk exists, how­ever remote that risk may be. I think that this argu­ment by some liab­il­ity law­yers is fatu­ous at best.

Kenneth Ross, one of the lead­ing product liab­il­ity law­yers in the USA, dis­cusses the require­ments for warn­ings and instruc­tions in an art­icle pub­lished in 2007 [6]. In the art­icle, he explains the US require­ments:

“Product sellers must provide “reas­on­able warn­ings and instruc­tions” about their products’ risks. The law dif­fer­en­ti­ates warn­ings and instruc­tions as fol­lows:

“Warnings alert users and con­sumers to the exist­ence and nature of product risks so that they can pre­vent harm either by appro­pri­ate con­duct dur­ing use or con­sump­tion or by choos­ing not to use or con­sume.”

Instructions “inform per­sons how to use and con­sume products safely.”

A court has held that warn­ings, stand­ing alone, may have no prac­tic­al rel­ev­ance without instruc­tions and that instruc­tions without warn­ings may not be adequate.

Therefore, when the law talks about the “duty to warn,” it includes warn­ings on products in the form of warn­ing labels; safety inform­a­tion in instruc­tions; instruc­tions that affirm­at­ively describe how to use a product safely; and safety inform­a­tion in oth­er means of com­mu­nic­a­tion such as videos, advert­ising, cata­logs and web­sites.

The law says that a man­u­fac­turer has a duty to warn where: (1) the product is dan­ger­ous; (2) the danger is or should be known by the man­u­fac­turer; (3) the danger is present when the product is used in the usu­al and expec­ted man­ner; and (4) the danger is not obvi­ous or well known to the user.”

Read Mr. Ross’ latest art­icle on warn­ings.

This prac­tic­al and sens­ible approach is very sim­il­ar to that in the EU. Note the require­ment that “instruc­tions that affirm­at­ively describe how to use a product safely.” The  old list of “don’ts” doesn’t cut it – you must tell your user how to use the product in an affirm­at­ive way.

Second Best

So why is it that so many man­u­fac­tur­ers settle for manu­als that are barely ‘second best’? In many com­pan­ies, the doc­u­ment­a­tion func­tion is:

  • Not seen to add value to the product;
  • not under­stood to have leg­al import in lim­it­ing product liab­il­ity;
  • giv­en little effort.

The per­cep­tion seems to be that manu­als are pro­duced primar­ily to fill fil­ing cab­in­ets and that cus­tom­ers don’t use the inform­a­tion provided. This leads to manu­als that are writ­ten after-​the-​fact by engin­eers, or worse, the role of ‘tech­nic­al writer’ is seen to be an entry level pos­i­tion often filled by interns or co-​op stu­dents.

End-​user train­ing is fre­quently giv­en even less thought than the manu­als. When designed togeth­er, the manu­al will sup­port the train­ing pro­gram, and the train­ers can use the manu­al as one of the primary train­ing tools. This provides con­tinu­ity, and ensures that the train­ing pro­cess is prop­erly doc­u­mented.

iStock_000012657812Small - Techncial ManualMy exper­i­ence is that few engin­eers are excel­lent writers. There are some, no doubt. Writing manu­als takes a sound under­stand­ing of edu­ca­tion­al the­ory, includ­ing an under­stand­ing of the audi­ence to whom the mater­i­al is dir­ec­ted. The level of tech­nic­al soph­ist­ic­a­tion required for a simple house­hold product is com­pletely dif­fer­ent from that required for the tech­nic­al sup­port manu­al for an indus­tri­al weld­ing laser.
The engin­eers design­ing and integ­rat­ing an indus­tri­al sys­tem are often too close to the design of the product to be able to write effect­ively to the tar­get audi­ence. Assumptions about the level of edu­ca­tion that the user will have are often incor­rect, and key steps may be skipped because they are assumed to be ‘com­mon know­ledge.’

Quality doc­u­ment­a­tion is also a cus­tom­er ser­vice issue. Products that are well doc­u­mented require less cus­tom­er ser­vice sup­port, and when cus­tom­ers do need sup­port, they are gen­er­ally more sat­is­fied with the res­ult.

New Delivery Methods

The deliv­ery meth­ods for tech­nic­al doc­u­ments have changed con­sid­er­ably in recent years. Large, ring-​bound paper manu­als are being dis­placed by on-​line, inter­act­ive doc­u­ment­a­tion that can be accessed at the user inter­face. The use of PDF-​format manu­als has jumped, and this brings in the abil­ity to link error mes­sages gen­er­ated by the con­trol sys­tem to the sec­tions of the manu­al that related to that aspect of the sys­tem. Video and anim­a­tions can be added that provide at-​a-​glance under­stand­ing of the oper­a­tion of the machinery. WiFi net­works in indus­tri­al facil­it­ies, along with the accept­ance of mobile pad-​computing devices like the Apple iPad, mean users can have the instruc­tions where they need them, and tech­ni­cians and ser­vice per­son­nel can take the manu­al with them to the area where a prob­lem exists, and can use the doc­u­ments even in very low-​light con­di­tions.

Finding tech­nic­al writ­ing resources can be a chal­lenge, par­tic­u­larly if you are look­ing to move away from paper to elec­tron­ic doc­u­ment­a­tion. The stand­ards men­tioned in this art­icle are a good place to start.
Documentation can range from writ­ing through tech­nic­al illus­tra­tions, anim­a­tion and video pro­duc­tion. Finding indi­vidu­als who can provide you with pro­fes­sion­al ser­vices in these areas in a timely way and at a reas­on­able price is not an easy task. If you need assist­ance ran­ging from a few ques­tions that need answers to hir­ing a tech­nic­al writer, Compliance InSight Consulting can help. Contact me for more inform­a­tion!

Are your product manu­als as good as they could be? What kinds of chal­lenges have you had with get­ting them writ­ten, or used? Add your com­ments below!

References

5% Discount on ISO and IEC Standards with code: CC2011 

[1]    “Safety of machinery – General prin­ciples for design – Risk assess­ment and risk reduc­tion”, ISO Standard 12100, 2010

[2]    “DIRECTIVE 2006/​42/​EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 17 May 2006 on machinery, and amend­ing Directive 95/​16/​EC”, Annex 1, Clause 1.7, European Commission, 2006.

[3]    “Safeguarding of Machinery”, CSA Standard Z432, Canadian Standards Association, 2004.

[4]    “Preparation of instruc­tions – Structuring, con­tent and present­a­tion”, IEC Standard 62079, International Electrotechnical Commission, 2001.

[5]    “American National Standard For Product Safety Information in Product Manuals, Instructions, and Other Collateral Materials”, ANSI Standard Z535.6, American National Standards Institute, 2006.

[6]    K. Ross. “Danger! The Legal Duty to Warn and Instruct”, Risk Management Magazine, [web] 2007, Available: No longer avail­able.

[7]      “Safety of machinery — Electrical equip­ment of machines — Part 1: General require­ments”, CENELEC Standard EN 60204 – 1, CENELEC, 2009.

Hockey Teams and Risk Reduction or What Makes Roberto Luongo = PPE

This entry is part 1 of 3 in the series Hierarchy of Controls

Special Co-​Author, Tom Doyle

Last week we saw the Boston Bruins earn the Stanley Cup. I was root­ing for the green, blue and white, and the ruin of my voice on Thursday was ample evid­ence that no amount of cheer­ing helped. While I was watch­ing the game with friends and col­leagues, I real­ized that Roberto Luongo and Tim Thomas were their respect­ive team’s PPE*. Sound odd? Let me explain.

Risk Assessment and the Hierarchy of Controls

Equipment design­ers need to under­stand  OHS* risk. The only proven meth­od for under­stand­ing risk is risk assess­ment. Once that is done, the next play in the game is the reduc­tion of risks by elim­in­at­ing haz­ards wherever pos­sible and con­trolling those that remain.

Control comes in a couple of fla­vours:

  • Hazard modi­fic­a­tion to reduce the sever­ity of injury, or 
  • prob­ab­il­ity modi­fic­a­tion to reduce the prob­ab­il­ity of a work­er com­ing togeth­er with the haz­ard.

These ideas have been form­al­ized in the Hierarchy of Controls. Briefly, the Hierarchy starts with haz­ard elim­in­a­tion or sub­sti­tu­tion, and flows down through engin­eer­ing con­trols, inform­a­tion for use, admin­is­trat­ive con­trols and finally PPE. As you move down through the Hierarchy, the effect­ive­ness and the reli­ab­il­ity of the meas­ures declines.

It’s import­ant to recog­nize that we haven’t done a risk assess­ment in writ­ing this post. This step was skipped for the pur­pose of this example — to apply the hier­archy cor­rectly, you MUST start with a risk assess­ment!

So how does this relate to Hockey?

Hockey and the Hierarchy of Controls

Hazard Identification and Exposure to Risk

If we con­sider the goal as the work­er – the thing we don’t want “injured”, the puck is the haz­ard, and the act of scor­ing a goal as the act of injur­ing a per­son, then the rest quickly becomes clear.

Level 1: Hazard Elimination

By defin­i­tion, if we elim­in­ate the puck, we no longer have a game. We just have a bunch of big guys skat­ing around in cool jer­seys with sticks, maybe hav­ing a fight or two, because they’re bored or just don’t know what else to do. Since we want to have a game, either to play or to watch, we have to allow the risk of injury to exist. We could call this the “intrins­ic risk”, as it is the risk that exists before we add any con­trols.

Level 2: Hazard Substitution

The Center and the Wingers (col­lect­ively the “Forwards” or the “Offensive Line”), act as haz­ard “sub­sti­tu­tion”. We’ve already estab­lished that elim­in­a­tion of the haz­ard res­ults in the loss of the inten­ded func­tion — no puck, no game. The for­wards only let the oth­er team have the puck on rare occa­sion, if they’re play­ing well. This is a great idea, but still a little too optim­ist­ic after all. Both teams are try­ing to get the puck in the oppos­ing net and both teams have qual­i­fied to play the final game. If they fail to keep the puck bey­ond the oth­er team’s blue line, or at least bey­ond the cen­ter line, then the next lay­er of pro­tec­tion kicks in, with the Defensive Line.

Level 3: Engineering Controls

As the puck moves down the ice, the Defensive Line engages the approach­ing puck, attempt­ing to block access to the area closer to the goal. They act as a mov­able bar­ri­er between the net and the puck.  They will do whatever is neces­sary to keep the haz­ard from com­ing in con­tact with the net. As engin­eer­ing con­trols, their coördin­a­tion and pos­i­tion­ing are crit­ic­al in ensur­ing suc­cess.

The sys­tem will fail if the con­trols have poor:

  • pos­i­tion­ing,
  • choice of mater­i­als (play­ers),
  • tim­ing, etc.

These risk con­trols fail reg­u­larly, so are less desir­able than hav­ing the Forward Line handle Risk Control.

Level 4: Information for Use and Awareness Means

In a hockey game, the inform­a­tion for use is the rule book. This inform­a­tion tells play­ers, coaches, and offi­cials how the game is to be played, and what the inten­ded use of the game should be. Activities like spear­ing, trip­ping, and blind-​side checks are not per­mit­ted.

The aware­ness means are provided by the roar of the fans. As the puck heads for the home-team’s goal, the home fans will roar, let­ting the team know, if they don’t know already, that the goal is at risk from the puck. Hopefully the defens­ive line can react in time and get between the puck and the net.

Level 5: Administrative Controls

Information for use from the pre­vi­ous step is the basis for all the fol­low­ing con­trols. The team’s coaches, or “super­visors”, use this inform­a­tion to give train­ing in the form of hockey prac­tice. The Forward Line and Defensive Line could be con­sidered the Suppliers and Users. They all need to know what to do to avoid haz­ard­ous situ­ations, and what to do when one arises, to reduce the num­ber of poten­tial fail­ures.

A “Permit to Work” is giv­en to the play­ers by the coach when they form the lines. The coach ensures that the right people are on the ice for each set of cir­cum­stances, decid­ing when line changes hap­pen as the game pro­gresses, adapt­ing the people per­mit­ted to work to the spe­cif­ic con­di­tions on the ice.

Level 6: Personal Protective Equipment (PPE)

All of this brings me to Roberto Luongo and Tim Thomas. So how is a Goalie like PPE?

Goalies are the “last-​ditch” pro­tec­tion. It’s clear that the first 5 levels of the hier­archy don’t always work, since every type of con­trol, even haz­ard elim­in­a­tion, has fail­ure modes. To give a bit of backup, we should make sure that we add extra pro­tec­tion in the form of PPE.

The puck wasn’t elim­in­ated, since hav­ing a hockey game is the point, after all. The puck wasn’t kept dis­tant by the Forward Line. The Defensive Line failed to main­tain safe dis­tance between the goal and the puck, and now all that is left is the goalie (or your pro­tect­ive eye­wear, boots, hard­hat, or whatever). In the 2011 Stanley Cup Final game, Luongo equaled long pants and long sleeves, while Thomas equaled a suit of armour. The Bruin’s “PPE” afforded super­i­or pro­tec­tion in this case.

As any­one who has used pro­tect­ive eye­wear knows, particles can get by your eye­wear. There are lots of factors, includ­ing how well they fit, if you’re wear­ing them (prop­erly or at all!), etc. If the gear is fit­ted and used prop­erly by a per­son who under­stands WHY and HOW to use the equip­ment, then the PPE is more like Tim Thomas, and you may be able to “shut out” injury. Most of the time. Remember that even Tim Thomas misses stop­ping some shots on goal and the oth­er guys can still score.

When your PPE doesn’t fit prop­erly, isn’t selec­ted prop­erly, is worn out (or psyched out as the case may be), or isn’t used prop­erly, then it’s more like Roberto Luongo. Sometimes it works per­fectly, and life is good. Sometimes it fails com­pletely and you end up injured or worse.

Goalies are also like PPE because they are RIGHT THERE. Right before injury will occur. PPE is RIGHT THERE, pro­tect­ing you — 5 mm from the sur­face of your eye, or in your ear, 2 mm from your ear drum. By this point the harm­ful energy is RIGHT THERE, ready to hurt you, and injury is immin­ent. A simple mis­place­ment or bad fit con­di­tion and you’re blinded or deaf or… well you get the idea!

On Wednesday night, 15-​Jun-​2011, everything failed for the Vancouver Canucks. The team’s spir­it was down, and they went into the game think­ing “We just don’t want to lose!” instead of Boston’s “We’re tak­ing that Cup home!”. Even the touted Home Ice Advantage wasn’t enough to psych out the Bruins, and in the end I think it turned on the Canucks as the fans real­ized that the game was lost. The warn­ings failed, the guards failed, and the PPE failed. Somebody got hurt, and unfor­tu­nately for Canadian fans, it was the Canucks. Luckily it wasn’t a fatal­ity! Even being #2 in the NHL is a long stretch bet­ter than filling a cool­er draw­er in the morgue.

So the next time you’re set­ting up a job, an assembly line, a new machine, or a new work­place, check out your team and make sure that you’ve got the right play­ers on the ice. You only get one chance to get it right. Sure, you can change the lines and upgrade when you need to, but once someone scores a goal, you have an injured per­son and big­ger prob­lems to deal with.

Special thanks to Tom Doyle for his con­tri­bu­tions to this post!

*Personal Protective EquipmentOccupational Health and Safety

Understanding the Hierarchy of Controls

This entry is part 2 of 3 in the series Hierarchy of Controls

Risk assess­ment is the first step in redu­cing the risk that your cus­tom­ers and users are exposed to when they use your products. The second step is Risk Reduction, some­times called Risk Control or Risk Mitigation. This art­icle looks at the ways that risk can be con­trolled using the Hierarchy of Controls. Figure 2 from ISO 12100 – 1 (shown below) illus­trates this point.

The sys­tem is called a hier­archy because you must apply each level in the order that they fall in the list. In terms of effect­ive­ness at redu­cing risk, the first level in the hier­archy, elim­in­a­tion, is the most effect­ive, down to the last, PPE*, which has the least effect­ive­ness.

It’s import­ant to under­stand that ques­tions must be asked after each step in the hier­archy is imple­men­ted, and that is “Is the risk reduced as much as pos­sible? Is the resid­ual risk a) in com­pli­ance with leg­al require­ments, and b) accept­able to the user or work­er?”. When you can answer ‘YES’ to all of these ques­tions, the last step is to ensure that you have warned the user of the resid­ual risks, have iden­ti­fied the required train­ing needed and finally have made recom­mend­a­tions for any needed PPE.

*PPE – Personal Protective Equipment. e.g. Protective eye wear, safety boots, bump caps, hard hats, cloth­ing, gloves, res­pir­at­ors, etc. CSA Z1002 includes ‘…any­thing designed to be worn, held, or car­ried by an indi­vidu­al for pro­tec­tion against one or more haz­ards.’  in this defin­i­tion.

Risk Reduction from the Designer's Viewpoint
ISO 12100:2010 – Figure 2

 

Introducing the Hierarchy of Controls

The Hierarchy of Controls was developed in a num­ber of dif­fer­ent stand­ards over the last 20 years or so. The idea was to provide a com­mon struc­ture that would provide guid­ance to design­ers when con­trolling risk.

Typically, the first three levels of the hier­archy may be con­sidered to be ‘engin­eer­ing con­trols’ because they are part of the design pro­cess for a product. This does not mean that they must be done by engin­eers!

We’ll look at each level in the hier­archy in detail. First, let’s take a look at what is included in the Hierarchy.

The Hierarchy of Controls includes:

1)    Hazard Elimination or Substitution (Design)
2)    Engineering Controls (see [1, 2, 8, 9, 10, and 11])

a)    Barriers

b)    Guards (Fixed, Movable w/​interlocks)

c)    Safeguarding Devices

d)    Complementary Protective Measures

3)    Information for Use (see [1, 2, 4, 7, 8, 12, and 13])

a)    Hazard Warnings

b)    Manuals

c)    HMI* & Awareness Devices (lights, horns)

4)    Administrative Controls (see [1, 2, 4, 5, 7, and 8])

a)    Training

b)    SOP’s,

c)    Hazardous Energy Control Procedures (see [5, 14])

d)    Authorization

5)    Personal Protective Equipment

a)    Specification

b)    Fitting

c)    Training in use

d)    Maintenance

*HMI – Human-​Machine Interface. Also called the ‘con­sole’ or ‘oper­at­or sta­tion’. The loc­a­tion on the machine where the oper­at­or con­trols are loc­ated. Often includes a pro­gram­mable screen or oper­at­or dis­play, but can be a simple array of but­tons, switches and indic­at­or lights.

The man­u­fac­turer, developer or integ­rat­or of the sys­tem should provide the first three levels of the hier­archy. Where they have not been provided, the work­place or user should provide them.

The last two levels must be provided by the work­place or user.

Effectiveness

Each lay­er in the hier­archy has a level of effect­ive­ness that is related to the fail­ure modes asso­ci­ated with the con­trol meas­ures and the rel­at­ive effect­ive­ness in redu­cing risk in that lay­er. As you go down the hier­archy, the reli­ab­il­ity and effect­ive­ness decrease as shown below.

Effectiveness of the Hierarchy of ControlsThere is no way to meas­ure or spe­cific­ally quanti­fy the reli­ab­il­ity or effect­ive­ness of each lay­er of the hier­archy – that must wait until you make some selec­tions from each level, and even then it can be very hard to do. The import­ant thing to under­stand is that Elimination is more effect­ive than Guarding (engin­eer­ing con­trols), which is more effect­ive than Awareness Means, etc.

1. Hazard Elimination or Substitution

Hazard Elimination

Hazard elim­in­a­tion is the most effect­ive means of redu­cing risk from a par­tic­u­lar haz­ard, for the simple reas­on that once the haz­ard has been elim­in­ated there is no remain­ing risk. Remember that risk is a func­tion of sever­ity and prob­ab­il­ity. Since both sever­ity and prob­ab­il­ity are affected by the exist­ence of the haz­ard, elim­in­at­ing the haz­ard reduces the risk from that par­tic­u­lar haz­ard to zero. Some prac­ti­tion­ers con­sider this to mean the elim­in­a­tion is 100% effect­ive, how­ever it’s my opin­ion that this is not the case because even elim­in­a­tion has fail­ure modes that can re-​introduce the haz­ard.

Failure Modes:

Hazard elim­in­a­tion can fail if the haz­ard is rein­tro­duced into the design. With machinery this isn’t that likely to occur, but in pro­cesses, ser­vices and work­places it can occur.

Substitution

Substitution requires the design­er to sub­sti­tute a less haz­ard­ous mater­i­al or pro­cess for the ori­gin­al mater­i­al or pro­cess. For example, beryl­li­um is a highly tox­ic met­al that is used in some high tech applic­a­tions. Inhalation or skin con­tact with beryl­li­um dust can do ser­i­ous harm to a per­son very quickly, caus­ing acute beryl­li­um dis­ease. Long term expos­ure can cause chron­ic beryl­li­um dis­ease. Substituting a less tox­ic mater­i­al with sim­il­ar prop­er­ties in place of the beryl­li­um in the pro­cess  could reduce or elim­in­ate the pos­sib­il­ity of beryl­li­um dis­ease, depend­ing on the exact con­tent of the sub­sti­tute mater­i­al. If the sub­sti­tute mater­i­al includes any amount of beryl­li­um, then the risk is only reduced. If it con­tains no beryl­li­um, the risk is elim­in­ated. Note that the risk can also be reduced by ensur­ing that the beryl­li­um dust is not cre­ated by the pro­cess, since beryl­li­um is not tox­ic unless inges­ted.

Alternatively, using pro­cesses to handle the beryl­li­um without cre­at­ing dust or particles could reduce the expos­ure to the mater­i­al in forms that are likely to cause beryl­li­um dis­ease. An example of this could be sub­sti­tu­tion of water-​jet cut­ting instead of mech­an­ic­al saw­ing of the mater­i­al.

Failure Modes:

Reintroduction of the sub­sti­tuted mater­i­al into a pro­cess is the primary fail­ure mode, how­ever there may be oth­ers that are spe­cif­ic to the haz­ard and the cir­cum­stances. In the above example, pre- and post-​cutting hand­ling of the mater­i­al could still cre­ate dust or small particles, res­ult­ing in expos­ure to beryl­li­um. A sub­sti­tuted mater­i­al might intro­duce oth­er, new haz­ards, or might cre­ate fail­ure modes in the final product that would res­ult in risks to the end user. Careful con­sid­er­a­tion is required!

If neither elim­in­a­tion or sub­sti­tu­tion is pos­sible, we move to the next level in the hier­archy.

2. Engineering Controls

Engineering con­trols typ­ic­ally include vari­ous types of mech­an­ic­al guards [16, 17, & 18], inter­lock­ing sys­tems [9, 10, 11, & 15], and safe­guard­ing devices like light cur­tains or fences, area scan­ners, safety mats and two-​hand con­trols [19]. These sys­tems are pro­act­ive in nature, act­ing auto­mat­ic­ally to pre­vent access to a haz­ard and there­fore pre­vent­ing injury. These sys­tems are designed to act before a per­son can reach the danger zone and be exposed to the haz­ard.

Control reliability

Barrier guards and fixed guards are not eval­u­ated for reli­ab­il­ity because they do not rely on a con­trol sys­tem for their effect­ive­ness. As long as they are placed cor­rectly in the first place, and are oth­er­wise prop­erly designed to con­tain the haz­ards they are pro­tect­ing, then noth­ing more is required. On the oth­er hand, safe­guard­ing devices, like inter­locked guards, light fences, light cur­tains, area scan­ners, safety mats, two-​hand con­trols and safety edges, all rely on a con­trol sys­tem for their effect­ive­ness. Correct applic­a­tion of these devices requires cor­rect place­ment based on the stop­ping per­form­ance of the haz­ard and cor­rect integ­ra­tion of the safety device into the safety related parts of the con­trol sys­tem [19]. The degree of reli­ab­il­ity is based on the amount of risk reduc­tion that is being required of the safe­guard­ing device and the degree of risk present in the unguarded state [9, 10].

There are many detailed tech­nic­al require­ments for engin­eer­ing con­trols that I can’t get into in this art­icle, but you can learn more by check­ing out the ref­er­ences at the end of this art­icle and oth­er art­icles on this blog.

Failure Modes

Failure modes for engin­eer­ing con­trols are as many and as var­ied as the devices used and the meth­ods of integ­ra­tion chosen. This dis­cus­sion will have to wait for anoth­er art­icle!

Awareness Devices

Of spe­cial note are ‘aware­ness devices’. This group includes warn­ing lights, horns, buzzers, bells, etc. These devices have some aspects that are sim­il­ar to engin­eer­ing con­trols, in that they are usu­ally part of the machine con­trol sys­tem, but they are also some­times classed as ‘inform­a­tion for use’, par­tic­u­larly when you con­sider indic­at­or or warn­ing lights and HMI screens. In addi­tion to these ‘act­ive’ types of devices, aware­ness devices may also include lines painted or taped on the floor or on the edge of a step or elev­a­tion change, warn­ing chains, sig­nage, etc. Signage may also be included in the class of ‘inform­a­tion for use’, along with HMI screens.

Failure Modes

Failure modes for Awareness Devices include:

  • Ignoring the warn­ings (Complacency or Failure to com­pre­hend the mean­ing of the warn­ing);
  • Failure to main­tain the device (warn­ing lights burned out or removed);
  • Defeat of the device (silen­cing an aud­ible warn­ing device);
  • Inappropriate selec­tion of the device (invis­ible or inaud­ible in the pre­dom­in­at­ing con­di­tions).

Complementary Protective Measures

Complementary Protective meas­ures are a class of con­trols that are sep­ar­ate from the vari­ous types of safe­guard­ing because they gen­er­ally can­not pre­vent injury, but may reduce the sever­ity of injury or the prob­ab­il­ity of the injury occur­ring. Complementary pro­tect­ive meas­ures are react­ive in nature, mean­ing that they are not auto­mat­ic. They must be manu­ally activ­ated by a user before any­thing will occur, e.g. press­ing an emer­gency stop but­ton. They can only com­ple­ment the pro­tec­tion provided by the auto­mat­ic sys­tems.

A good example of this is the Emergency Stop sys­tem that is designed into many machines. On its own, the emer­gency stop sys­tem will do noth­ing to pre­vent an injury. The sys­tem must be activ­ated manu­ally by press­ing a but­ton or pulling a cable. This relies on someone detect­ing a prob­lem and real­iz­ing that the machine needs to be stopped to avoid or reduce the sever­ity of an injury that is about to occur or is occur­ring. Emergency stop can only ever be a back-​up meas­ure to the auto­mat­ic inter­locks and safe­guard­ing devices used on the machine. In many cases, the next step in emer­gency response after press­ing the emer­gency stop is to call 911.

Failure Modes:

The fail­ure modes for these kinds of con­trols are too numer­ous to list here, how­ever they range from simple fail­ure to replace a fixed guard or bar­ri­er fence, to fail­ure of elec­tric­al, pneu­mat­ic or hydraul­ic con­trols. These fail­ure modes are enough of a con­cern that a new field of safety engin­eer­ing called ‘Functional Safety Engineering’ has grown up around the need to be able to ana­lyze the prob­ab­il­ity of fail­ure of these sys­tems and to use addi­tion­al design ele­ments to reduce the prob­ab­il­ity of fail­ure to a level we can tol­er­ate. For more on this, see [9, 10, 11].

Once you have exhausted all the pos­sib­il­it­ies in Engineering Controls, you can move to the next level down in the hier­archy.

3. Information for Use

This is a very broad top­ic, includ­ing manu­als, instruc­tion sheets, inform­a­tion labels on the product, haz­ard warn­ing signs and labels, HMI screens, indic­at­or and warn­ing lights, train­ing mater­i­als, video, pho­to­graphs, draw­ings, bills of mater­i­als, etc. There are some excel­lent stand­ards now avail­able that can guide you in devel­op­ing these mater­i­als [1, 12 and 13].

Failure Modes:

The major fail­ure modes in this level include:

  • Poorly writ­ten or incom­plete mater­i­als;
  • Provision of the mater­i­als in a lan­guage that is not under­stood by the user;
  • Failure by the user to read and under­stand the mater­i­als;
  • Inability to access the mater­i­als when needed;
  • Etcetera.

When all pos­sib­il­it­ies for inform­ing the user have been covered, you can move to the next level down in the hier­archy. Note that this is the usu­al sep­ar­a­tion point between the man­u­fac­turer and the user of a product. This is nicely illus­trated in Fig 2 from ISO 12100 above. It is import­ant to under­stand at this point that the resid­ual risk posed by the product to the user may not yet be tol­er­able. The user is respons­ible for imple­ment­ing the next two levels in the hier­archy in most cases. The man­u­fac­turer can make recom­mend­a­tions that the user may want to fol­low, but typ­ic­ally that is the extent of influ­ence that the man­u­fac­turer will have on the user.

4. Administrative Controls

This level in the hier­archy includes:

  • Training;
  • Standard Operating Procedures (SOP’s);
  • Safe work­ing pro­ced­ures e.g. Hazardous Energy Control, Lockout, Tagout (where per­mit­ted by law), etc.;
  • Authorization; and
  • Supervision.

Training is the meth­od used to get the inform­a­tion provided by the man­u­fac­turer to the work­er or end user. This can be provided by the man­u­fac­turer, by a third party, or self-​taught by the user or work­er.
SOP’s can include any kind of pro­ced­ure insti­tuted by the work­place to reduce risk. For example, requir­ing work­ers who drive vehicles to do a walk-​around inspec­tion of the vehicle before use, and log­ging of any prob­lems found dur­ing the inspec­tion is an example of an SOP to reduce risk while driv­ing.
Safe work­ing pro­ced­ures can be strongly influ­enced by the man­u­fac­turer through the inform­a­tion for use provided. Maintenance pro­ced­ures for haz­ard­ous tasks provided in the main­ten­ance manu­al are an example of this.
Authorization is the pro­ced­ure that an employ­er uses to author­ize a work­er to carry out a par­tic­u­lar task. For example, an employ­er might put a policy in place that only per­mits licensed elec­tri­cians to access elec­tric­al enclos­ures and carry out work with the enclos­ure live. The employ­er might require that work­ers who may need to use lad­ders in their work take a lad­der safety and a fall pro­tec­tion train­ing course. Once the pre­requis­ites for author­iz­a­tion are com­pleted, the work­er is ‘author­ized’ by the employ­er to carry out the task.
Supervision is one of the most crit­ic­al of the Administrative Controls. Sound super­vi­sion can make all of the above work. Failure to prop­erly super­vise work can cause all of these meas­ures to fail.

Failure Modes

Administrative con­trols have many fail­ure modes. Here are some of the most com­mon:

  • Failure to train;
  • Failure to inform work­ers regard­ing the haz­ards present and the related risks;
  • Failure to cre­ate and imple­ment SOP’s;
  • Failure to provide and main­tain spe­cial equip­ment needed to imple­ment SOP’s;
  • No form­al means of author­iz­a­tion – i.e. How do you KNOW that Joe has his lift truck license?;
  • Failure to super­vise adequately.

I’m sure you can think of MANY oth­er ways that Administrative Controls can go wrong!

5. Personal Protective Equipment (PPE)

PPE includes everything from safety glasses, to hard­hats and bump caps, to fire-​retardant cloth­ing, hear­ing defend­ers, and work boots. Some stand­ards even include warn­ing devices that are worn by the user, such as gas detect­ors and person-​down detect­ors, in this group.
PPE is prob­ably the single most over-​used and least under­stood risk con­trol meas­ure. It falls at the bot­tom of the hier­archy for a num­ber of reas­ons:

  1. It is a meas­ure of last resort;
  2. It per­mits the haz­ard to come as close to the per­son as their cloth­ing;
  3. It is often incor­rectly spe­cified;
  4. It is often poorly fit­ted;
  5. It is often poorly main­tained; and
  6. It is often improp­erly used.

The prob­lems with PPE are hard to deal with. You can­not glue or screw a set of safety glasses to a person’s face, so ensur­ing the the pro­tect­ive equip­ment is used is a big prob­lem that goes back to super­vi­sion.

Many small and medi­um sized enter­prises do not have the expert­ise in the organ­iz­a­tion to prop­erly spe­cify, fit and main­tain the equip­ment.

User com­fort is extremely import­ant. Uncomfortable equip­ment won’t be used for long.

Finally, by the time that prop­erly spe­cified, fit­ted and used equip­ment can do it’s job, the haz­ard is as close to the per­son as it can get. The prob­ab­il­ity of fail­ure at this point is very high, which is what makes PPE a meas­ure of last resort, com­ple­ment­ary to the more effect­ive meas­ures that can be provided in the first three levels of the hier­archy.

If work­ers are not prop­erly trained and adequately informed about the haz­ards they face and the reas­ons behind the use of PPE, they are deprived of the oppor­tun­ity to make safe choices, even if that choice is to refuse the work.

Failure Modes

Failure modes for PPE include:

  • Incorrect spe­cific­a­tion (not suit­able for the haz­ard);
  • Incorrect fit (allows haz­ard to bypass PPE);
  • Poor main­ten­ance (pre­vents or restricts vis­ion or move­ment, increas­ing the risk; causes PPE fail­ure under stress or allows haz­ard to bypass PPE);
  • Incorrect usage (fail­ure to train and inform users, incor­rect selec­tion or spe­cific­a­tion of PPE).

Time to Apply the Hierarchy

So now you know some­thing about the ‘hier­archy of con­trols’. Each lay­er has its own intric­a­cies and nuances that can only be learned by train­ing and exper­i­ence. With a doc­u­mented risk assess­ment in hand, you can begin to apply the hier­archy to con­trol the risks. Don’t for­get to iter­ate the assess­ment post-​control to doc­u­ment the degree of risk reduc­tion achieved. You may cre­ate new haz­ards when con­trol meas­ures are applied, and you may need to add addi­tion­al con­trol meas­ures to achieve effect­ive risk reduc­tion.

The doc­u­ments ref­er­enced below should give you a good start in under­stand­ing some of these chal­lenges.

References

5% Discount on All Standards with code: CC2011 

NOTE: [1], [2], and[3]  were com­bined by ISO and repub­lished as ISO 12100:2010. This stand­ard has no tech­nic­al changes from the pre­ced­ing stand­ards, but com­bines them in a single doc­u­ment. ISO/​TR 14121 – 2 remains cur­rent and should be used with the cur­rent edi­tion of ISO 12100.

[1]             Safety of machinery – Basic con­cepts, gen­er­al prin­ciples for design – Part 1: Basic ter­min­o­logy and meth­od­o­logy, ISO Standard 12100 – 1, 2003.
[2]            Safety of machinery – Basic con­cepts, gen­er­al prin­ciples for design – Basic ter­min­o­logy and meth­od­o­logy, Part 2: Technical prin­ciples, ISO Standard 12100 – 2, 2003.
[3]            Safety of Machinery – Risk Assessment – Part 1: Principles, ISO Standard 14121 – 1, 2007.
[4]            Safety of machinery — Prevention of unex­pec­ted start-​up, ISO 14118, 2000
[5]            Control of haz­ard­ous energy – Lockout and oth­er meth­ods, CSA Z460, 2005
[6]            Fluid power sys­tems and com­pon­ents – Graphic sym­bols and cir­cuit dia­grams – Part 1: Graphic sym­bols for con­ven­tion­al use and data-​processing applic­a­tions, ISO Standard 1219 – 1, 2006
[7]            Pneumatic flu­id power – General rules and safety require­ments for sys­tems and their com­pon­ents, ISO Standard 4414, 1998
[8]            American National Standard for Industrial Robots and Robot Systems — Safety Requirements, ANSI/​RIA R15.06, 1999.
[9]            Safety of machinery — Safety-​related parts of con­trol sys­tems — Part 1: General prin­ciples for design, ISO Standard 13849 – 1, 2006
[10]          Safety of machinery – Functional safety of safety-​related elec­tric­al, elec­tron­ic and pro­gram­mable elec­tron­ic con­trol sys­tems, IEC Standard 62061, 2005
[11]           Functional safety of electrical/​electronic/​programmable elec­tron­ic safety-​related sys­tems, IEC Standard 61508-​X, sev­en parts.
[12]          Preparation of Instructions — Structuring, Content and Presentation, IEC Standard 62079, 2001
[13]          American National Standard For Product Safety Information in Product Manuals, Instructions, and Other Collateral Materials, ANSI Standard Z535.6, 2010.
[14]          Control of Hazardous Energy Lockout/​Tagout and Alternative Methods, ANSI Standard Z244.1, 2003.
[15]          Safety of Machinery — Interlocking devices asso­ci­ated with guards — prin­ciples for design and selec­tion, EN 1088+A1:2008.
[16]          Safety of Machinery — Guards – General require­ments for the design and con­struc­tion of fixed and mov­able guards, EN 953+A1:2009.
[17]          Safety of machinery — Guards — General require­ments for the design and con­struc­tion of fixed and mov­able guards, ISO 14120.
[18]         Safety of machinery — Safety dis­tances to pre­vent haz­ard zones being reached by upper and lower limbs, ISO 13857:2008.
[19]         Safety of machinery — Positioning of safe­guards with respect to the approach speeds of parts of the human body, ISO 13855:2010.

5% Discount on All Standards with code: CC2011