A robot hazard analysis produces useful safety requirements when each requirement connects to a defined operating scenario, a source of harm, a chosen protective measure and evidence that can test the measure's effectiveness. ISO 12100 provides the general machinery risk-assessment and risk-reduction method. The engineering task is to preserve the reasoning from hazard identification through the remaining risk, so a well-written requirement does not become a substitute for the safety argument. (ISO 12100 public scope)
Consider a robot that transfers trays through a loading fixture. “The robot shall be safe” leaves almost every decision open. What happens when a tray jams? Who can reach the fixture? Can automatic motion restart after someone clears it? Which design change reduces the risk, and what would demonstrate that it works? Those questions turn a broad safety intention into a reviewable chain.
What ISO 12100 establishes
ISO's catalogue identifies ISO 12100:2010, Edition 1, as the published standard, reviewed and confirmed in 2022. Its public abstract describes terminology, principles and a methodology for machinery safety, including hazard identification, risk estimation and evaluation, risk reduction, documentation and verification through relevant lifecycle phases. The revision shown on the catalogue is under development. (ISO catalogue, checked 21 October 2026)
The catalogue supports that method and scope. It does not supply the licensed clauses needed for a detailed conformity assessment. It also states that ISO 12100 does not address risk or damage to domestic animals, property or the environment. A project's wider obligation set may still address those subjects through another source.
There is a useful public legal counterpart. For products within its scope, the EU Machinery Regulation's Annex III General Principles specify an iterative risk assessment: determine limits, identify hazards and hazardous situations, estimate risk, evaluate the need for reduction, then eliminate hazards or reduce risk through protective measures in the required order. The Regulation principally applies from 20 January 2027. The Machinery Directive's Annex I already contains an iterative process for its applicable products. (Regulation Annex III and Article 54, Directive Annex I)
This gives an accessible basis for explaining the chain. It does not select the detailed robot standard, a performance level, an integrity level or a contact limit for a particular system.
Separate the hazard, the situation and the harm
A hazard is the potential source of injury or damage to health. The Machinery Regulation uses that definition and defines risk through the probability and degree of injury or damage arising in a hazardous situation. (Annex III Part A)
For a working hazard record, describe the hazardous situation as the circumstances exposing a person to that source. Then describe the possible harm. This practical separation helps the team choose a measure that actually addresses the scenario.
| Part of the record | Fictional tray-cell example | What the distinction exposes |
|---|---|---|
| Operating scenario | A technician clears a jam at the loading fixture | Identifies the activity and person involved |
| Hazard | Moving gripper and tray create a crushing source at the fixed fixture | Names the physical source of injury |
| Hazardous situation | The technician's hand is in the gap when automatic movement begins | Connects exposure, location and machine state |
| Possible harm | Crush injury to the hand | States the consequence to assess |
| Risk assessment | Severity and probability need assessment using the cell's actual conditions | Keeps the judgement separate from the description |
“Hand injury” is a consequence, so it does not explain which source must be controlled. “Robot movement” is too broad to distinguish normal guarded production from jam clearing. “Operator error” also leaves the design question unresolved. The record needs the foreseeable situation in which an error, restart, retained energy or failure can expose the person.
Define the scenario before deriving requirements
Start with the robot's limits and lifecycle. Include production, loading, adjustment, teaching, cleaning, maintenance and foreseeable abnormal use where relevant. The limits record should identify the tool and load, accessible space, modes, other equipment, people and activities that affect risk. These are inputs to the assessment.
For the fictional tray cell, the jam-clearing scenario would need answers about access to the fixture, sources of stored energy, which equipment can move the tray and what state persists after intervention. A surrounding conveyor or another actuator may change the hazardous situation. Focusing only on the robot arm would leave that interaction unexamined.
Annex III General Principles expressly include risks from machinery arranged and controlled as an integral whole, and foreseeable lifecycle hazards from intended evolution of self-evolving behaviour or logic. For a robot with learned behaviour, record what is allowed to change and how that affects exposure and protective measures. (Annex III General Principles, point 1)
A complete scenario is still not a risk decision. It provides the context needed to estimate and evaluate risk. Record the assessment method, assumptions, evidence and responsible authority beside the scenario. A qualitative label with no supporting explanation cannot show why a control was chosen.
Follow the priority of risk reduction
The Machinery Regulation's safety-integration order starts with eliminating hazards or minimising risks through inherently safe design and construction. It then requires protective measures for risks that remain, followed by information on residual risks, training and protective equipment where needed. (Annex III 1.1.2(b))
Applied to the fictional cell, the first question is whether the fixture or handling approach can remove the trapping source or the need for access during jam clearing. If a hazardous situation remains, the team considers protective measures appropriate to the actual access and motion. Instructions explain remaining risks and required activities after those decisions. The order should be visible in the record.
This avoids an attractive shortcut: writing a warning and then treating the hazard row as closed. A warning does not by itself demonstrate that design and protective-measure options have been adequately considered. Likewise, adding a guard introduces questions about access, stopping, restart and retained energy that need their own analysis.
Build the hazard-to-requirement chain
The following teaching record continues the same fictional tray-cell scenario. All protective measures and requirements are candidates. No assessment, installation or test has been performed, and no residual risk has been accepted.
| Link | Candidate record | Decision or evidence still needed |
|---|---|---|
| Scenario SC-JAM-01 | Technician clears a jam at loading fixture F1 | Confirm actual access, modes, load, other moving equipment and energy sources |
| Hazard H-CRUSH-01 | Crushing source between moving gripper or tray and F1 | Confirm geometry and credible exposure conditions |
| Harm | Hand crush injury | Assess possible severity and occurrence using actual circumstances |
| Design option | Change fixture geometry or jam-clearing approach to remove the hazardous situation | Review feasibility and whether the revised design introduces another hazard |
| Protective-measure candidate | Prevent automatic cycle initiation during access through gate G1 | Assess the complete access-protection arrangement, including existing motion and failures |
| Requirement SR-CELL-01 | The cell shall inhibit automatic cycle initiation while loading-access gate G1 is open | Confirm scope and ownership, then verify the defined behaviour |
| Requirement SR-CELL-02 | Closing loading-access gate G1 shall not by itself initiate or resume automatic motion of the cell | Review other restart conditions and verify the prohibited transition |
| Remaining-risk question | What exposure remains during intervention, including stored energy or movement already underway? | Reassess after the chosen measures are implemented |
| Evidence and decision | Verification is planned. No report or acceptance decision exists | Complete and assess the evidence before changing the state |
The two requirement sentences describe specific behaviour, but they do not define a complete access-safety function. They do not establish that hazardous motion stops before a person can reach it, control dangerous stored energy or prove behaviour under faults. That limitation belongs beside the requirements because the original hazardous situation is broader than either sentence.
Keep the requirement's source link to H-CRUSH-01 and SC-JAM-01, plus the protective-measure decision and implementation revision. Give the requirement an accountable engineering owner. Identify the authority who can judge risk reduction separately. A person who can edit a requirement may have neither the evidence nor the responsibility to accept the remaining risk.
For general statement quality, the existing verifiable-requirements guide explains subject, outcome, conditions and proof path. Here, the extra obligation is to preserve the hazard and protective-measure reasoning behind the sentence.
Keep requirements, evidence and residual risk distinct
A requirement says what the system must do. A verification plan explains how that statement will be examined. Evidence records what was actually inspected, analysed or tested for a particular configuration. The risk assessment uses that evidence, together with the complete hazard context, to judge the effectiveness and limitations of the measures.
For SR-CELL-01, a proposed verification activity could open G1 in each relevant declared mode, apply the defined automatic-start requests and observe whether an automatic cycle initiates. The procedure needs the actual configuration, stimulus set, measurement method, expected response and fault scope before execution. This is a plan for one requirement. It supplies no observed result and does not establish the entire cell's safety.
For SR-CELL-02, the reviewer needs evidence about the transition after gate closure, including the controller state and resulting machine behaviour. An interface state alone may be insufficient if another mechanism can command motion. The evidence must address the product behaviour being claimed.
Residual risk means the risk remaining after protective measures. Reassess it using the implemented design and the relevant evidence, preserving unresolved assumptions and any newly introduced hazardous situation. A passing functional test or a colour change in the register cannot establish that judgement by itself. Annex IV links risk-assessment documentation to applicable requirements, implemented protective measures and relevant residual risks. (Annex IV Part A)
Start with one credible intervention scenario. Follow it from source of harm to design options, candidate requirements, evidence needs and the remaining-risk decision. If any link is missing, record the specific question and the authority needed to resolve it. That is a useful safety-engineering action even before a final requirement baseline exists.
The companion guide on the EU machinery transition covers the separate product, responsibility and market-date decisions.