Function analysis: finding the hazards no checklist finds
· Dipl.-Ing. Andreas May
Working through a hazard list is quick. For a table saw it lists blade contact, kickback, noise, wood dust, electric shock. All of it correct, and still not enough. Some hazards only emerge from an interaction: a secondary function fails, the operator improvises, and the situation that follows appears in no catalogue.
Function analysis starts there. It does not ask “what hazards does a machine like this have”, it asks “what does this machine do, and what happens when one of its functions does not behave as intended”.
What a hazard list does and does not do
The hazard lists in EN ISO 12100 and in type C standards, the EN 1870 series for circular sawing machines for instance, are catalogues of hazard types. They answer which kinds of hazard can occur in principle. As a completeness check they are indispensable. As a method of discovery they have two weaknesses.
The first: the catalogue is generic, and mapping it to the actual machine is left to whoever fills it in. Someone who knows the machine well is finished quickly, and that is precisely the problem. What gets ticked off is what obviously fits.
The second: combinations are barely in there. That wood dust settles on electrical components and turns into a fire load does not follow from the keyword “dust”, nor from the keyword “electrical hazard”. It follows from tracing where the dust ends up inside this machine.
Breaking the machine down into functions
The first step is a breakdown not by assembly, but by technical function. For the example machine TK100 there are ten:
- TF-01 supply and convert energy
- TF-02 drive the tool
- TF-03 support the workpiece
- TF-04 guide the workpiece
- TF-05 perform the cut
- TF-06 set the cutting geometry
- TF-07 remove chips and dust
- TF-08 control and switch the machine
- TF-09 protect the operator and the surroundings
- TF-10 provide stability and mobility
The difference from an assembly list matters. “Guide the workpiece” is a function; the rip fence and the sliding carriage are the parts that deliver it. Sort by parts and you look at the fence. Sort by functions and you look at guiding, which also brings up freehand cutting, for which no part is responsible at all.
Four questions per function
Each function is put through four questions. Taking TF-07, the removal of chips and dust:
- What is the function meant to do? Capture the chips and dust produced at the cutting area through the extraction hood, port and hose, and carry them to the external extraction unit.
- How can it be disturbed? Blocked or leaking extraction, hose fallen off, insufficient extraction rate, electrostatic charging, dust settling on electrical components.
- How can it foreseeably be misused? Operating without extraction, clearing blockages while the blade is running, using non-earthed plastic components.
- Which hazards follow from that? Inhalation of wood dust, fire and explosion risk, electrostatic discharge.
Question 3 is the uncomfortable one. It asks you to take seriously what the operator will do, not what the operator is allowed to do. That is why the Probavis field is labelled foreseeable misuse and incentive to bypass: when a safeguard noticeably gets in the way of the work, bypassing it is foreseeable and therefore belongs in the assessment.
Questions 2 and 3 are easily blurred together. Keeping them apart pays off. A malfunction is a technical fault condition and usually leads to a design or control measure. Misuse is human behaviour and often calls for a different answer, such as making the bypass unattractive by design.
Secondary functions yield the most
The primary function of a machine is usually well examined. With a saw, the eye goes to the blade first. The supporting functions are more productive, because they get less attention.
In the example project, six hazards can be traced back to that one function TF-07, spread across two assemblies:
- ST-01 inhalation of wood dust
- ST-03 chip removal at the running blade
- EL-09 dust ingress into the control box due to insufficient protection rating
- EL-16 heat build-up from dust deposits
- EL-19 electrostatic charging of the extraction system
- K-01 dust and electrics as a combined fire hazard
The last four belong to a different assembly than the extraction system itself. That is the whole point. A hazard search organised by assembly easily misses them, because the cause sits at the saw unit and the consequence arrives in the control cabinet. The function connects the two, because it does not stop at assembly boundaries.
Safety functions are functions too
TF-09 is called “protect the operator and the surroundings” and covers the upper blade guard, the riving knife, the push stick, the covers and the emergency stop. It goes through the same four questions as every other function.
Its malfunctions: missing, damaged or wrongly adjusted blade guard, missing riving knife, lost push stick, open covers. Its foreseeable misuse: operating with a removed or manipulated safeguard, permanently taking off the riving knife. In the project this becomes a hazard in its own right, K-02 “operation without safeguards”, with its own evaluation and its own measures.
This step is easily skipped. The protective measure is noted as the answer to a hazard and then never questioned again. Yet it is itself a technical system with failure modes, with adjustment errors, and with an incentive to bypass it.
From finding to hazard
Function analysis produces candidates, not finished hazards. Every finding still has to be stated properly, with location, origin, cause and consequence. For the electrostatic charging out of TF-07 the example project reads:
- Location: electrostatics at the extraction system
- Origin: static electricity
- Cause: charging of non-earthed extraction components
- Consequence: incendive discharge in a dust-laden atmosphere
Only then comes the risk estimation with Se, Fr, Pr and Av. In this case: severity requiring medical treatment, weekly exposure, low probability of occurrence, avoidance possible. That yields a medium risk with a score of 9. The essential health and safety requirements 1.5.2 “static electricity” and 1.5.7 “explosion” are assigned to it.
Three mistakes that waste the effort
Framing the functions too coarsely. “Sawing” as a single function answers none of the four questions usefully. A function is framed right when it can be stated with a verb and has a malfunction and a misuse of its own. If an entry needs several of each, it still holds more than one function; if it has none, it belongs to a neighbouring function.
Looking only at normal operation. TF-06, setting the cutting geometry, is active during setup and maintenance, not during sawing. TF-10, stability, additionally covers transport and installation. Assign each function the life phases in which it actually occurs, or whole life phases drop out of the assessment.
Treating the analysis as a replacement rather than a complement. Function analysis and hazard lists answer different questions. The analysis finds, the list checks for completeness. Do only one of the two and you either have gaps or a collection with no bearing on the machine.
Keeping the record in Probavis
In Probavis the function analysis is a branch of the project tree in its own right, on the same level as the machine, its limits and its life phases. Each function becomes an entry with the four fields and the life phases assigned to it.
The hazards derived from it are created where they belong in safety terms: at the affected assembly, with risk estimation, measures, assigned safety requirements and the standard cited. The analysis itself stays in the project and appears in the report as a chapter of its own. That makes it traceable for an assessor how the hazard list came about.
If you would like to run a function analysis on a machine from your own design work, write to info@cetron.de.