Designing to Control Risk and Maintain Function Under Uncertainty
Risk Control & Robustness is a design discipline that systematically identifies and reduces potential risks in products and equipment while
ensuring that required functions and performance remain stable despite manufacturing variation, environmental change, component degradation,
external disturbance, and unforeseen conditions.
The terms can be defined as follows:
Risk Control — Risk reduction or risk mitigation
Robustness — The ability to withstand variation
Robust Design — Design that remains stable under variation
Risk Control & Robustness — Risk control and robust design
Risk Control is the activity of reducing the likelihood and consequences of undesirable outcomes such as accidents, injuries, equipment damage,
quality defects, contamination, and production loss.
Robustness is the ability of a product to perform its required function consistently even when operating conditions, component characteristics,
process variation, and environmental conditions change.
The two concepts are closely connected.
Even when a safety device is installed to reduce risk, reliable risk control may not be achieved if the device is sensitive to temperature, vibration,
contamination, or component variation.
Conversely, a product may be resistant to performance variation but still cannot be considered safe if it lacks protection against hazardous failure
modes.
Risk Control & Robustness begins with the following questions:
What hazards exist?
Under what conditions can a hazard arise?
What consequences will result if a failure occurs?
What are the likelihood and severity of the risk?
Can the hazard be eliminated through the design itself?
Can a protective device fail or be bypassed?
Does manufacturing variation affect function or safety?
Do temperature, humidity, vibration, and contamination affect performance?
Is function maintained as components wear or deteriorate?
Can the failure of one component create a hazardous condition in the entire system?
How does the system respond to unexpected operating conditions?
Does the system remain stable when control parameters or sensor values change?
To what degree can the system tolerate operator error or incorrect settings?
Can abnormal conditions be detected before failure occurs?
Are risk-control measures maintained throughout the product’s service life?
The main review elements of Risk Control & Robustness can be organized as follows:
Hazard Identification
Risk Estimation
Risk Evaluation
Inherently Safe Design
Safeguarding
Information and Procedures
Structural Robustness
Functional Robustness
Control Robustness
Environmental Robustness
Manufacturing Robustness
Tolerance and Margin
Fault Tolerance
Diagnostics and Monitoring
Verification and Validation
Basic Concept of Risk Control
Risk Control is the process of eliminating hazards or reducing risks that cannot be eliminated to an acceptable level.
Risk is generally understood as a combination of the following elements:
Risk = Severity of harm × Probability of occurrence
When exposure frequency is included, it may be evaluated as follows:
Risk = Severity of harm × Frequency of exposure × Probability of an accident
The important point is not the equation itself, but the separation and evaluation of the elements that create risk.
How severe will the harm be if an accident occurs?
How frequently is the worker exposed to the hazard?
How likely is a hazardous situation to occur?
How likely is the hazardous situation to result in an actual accident?
Can the hazard be avoided or escaped?
Risk Control is not simply the addition of warning labels or protective covers.
The first priority should be to eliminate or reduce the hazardous structure or energy itself.
Basic Concept of Robustness
Robustness is the ability of a design to maintain its required function despite variation and uncertainty.
It is not sufficient for a product to operate normally only under ideal design conditions.
Actual products are exposed to the following variations:
Variation in material properties
Machining variation
Assembly error
Sensor variation
Power-supply fluctuation
Temperature change
Humidity change
Change in friction coefficient
Variation in lubrication condition
Component wear
Differences in operator use
Variation in raw-material and product characteristics
External shock and vibration
Differences in maintenance condition
A robust design limits changes in output performance even when these conditions vary.
Robustness can be understood through the following relationship:
Output and functional variation should remain small even when input and environmental variation are large.
A good robust design does not attempt to eliminate every source of variation. Instead, it reduces the effect of unavoidable variation on product
function.
Difference Between Risk Control and Robustness
Risk Control and Robustness differ in purpose and evaluation method.
Risk Control
The main objectives of Risk Control include:
Prevention of injury
Control of hazardous energy
Prevention of equipment damage
Prevention of fire and explosion
Prevention of food or product contamination
Prevention of environmental damage
Prevention of production loss
The main questions are:
What is hazardous?
How can an accident occur?
How can the harm be eliminated or reduced?
Robustness
The main objectives of Robustness include:
Reduction of performance variation
Stable functional performance
Adaptation to environmental change
Absorption of manufacturing variation
Consistent quality
Reduced probability of failure
Long-term usability
The main questions are:
Which variables disturb performance?
Which design variables are sensitive?
Can function be maintained when conditions change?
Risk Control focuses on reducing harm, while Robustness focuses on maintaining stable function under variation.
However, because a risk-control measure can become unreliable when robustness is poor, the two concepts should be reviewed together in
actual design.
Types of Risk
Risks in products and equipment may appear in many forms.
Mechanical Hazards
Typical mechanical hazards include:
Cutting
Entrapment
Crushing
Shearing
Entanglement
Impact
Puncture
Falling
Ejection
Contact with rotating components
Unexpected movement
Release of stored energy
Mechanical hazards commonly arise around rotating components, linear-motion systems, drives, blades, belts, chains, gears, and cylinders.
Electrical Hazards
Major electrical hazards include:
Electric shock
Leakage current
Short circuit
Overcurrent
Overheating
Arcing
Insulation failure
Improper grounding
Unexpected restart
Thermal Hazards
Thermal hazards include:
Hot surfaces
Cold burns
Steam
Hot fluids
Overheated bearings
Fire
Thermal-decomposition gases
Pressure and Fluid Hazards
The following hazards may occur in pneumatic, hydraulic, vacuum, and fluid systems:
Hose rupture
Release of residual pressure
High-pressure fluid injection
Vacuum-vessel failure
Sudden cylinder movement
Valve malfunction
Leakage
Noise and Vibration Hazards
High noise and vibration can cause:
Hearing damage
Increased fatigue
Fastener loosening
Structural fatigue
Sensor malfunction
Reduced precision
Chemical Hazards
Risks associated with chemicals include:
Exposure to cleaning agents
Lubricant leakage
Refrigerant leakage
Solvent vapor
Corrosive substances
Hazardous dust
Material-decomposition products
Hygienic and Contamination Hazards
The following hazards are important in food, pharmaceutical, and cosmetic equipment:
Microbial contamination
Metal contamination
Plastic fragments
Lubricant contamination
Cleaning-agent residue
Corrosion products
Cross-contamination
Uncleanable dead zones
Functional and Control Hazards
The following hazards may occur in control systems:
Sensor failure
Incorrect control output
Communication loss
Software error
Unexpected automatic restart
Mode-selection error
Incorrect setting input
Confusion between safety and standard signals
Basic Risk-Control Process
Risk Control is generally performed in the following sequence:
Define the system and its intended use.
Identify hazards.
Develop hazardous situations and accident scenarios.
Estimate the severity and probability of harm.
Evaluate the level of risk.
Select risk-reduction measures.
Reassess residual risk.
Verify risk-control measures.
Monitor new risks arising during use.
Update the risk assessment when the design changes.
Risk assessment is not a one-time documentation task.
It should be repeatedly updated during design, prototyping, production, installation, operation, and maintenance.
Defining System Scope and Conditions of Use
Before evaluating risk, the conditions under which the product will be used must be defined.
Intended Use
Intended use should include:
Product function
Material or product being processed
Normal operating conditions
Installation location
Type of operator
Production volume
Operating hours
Cleaning method
Maintenance strategy
Reasonably Foreseeable Misuse
Users do not always operate products exactly as the designer expects.
The following forms of misuse should be considered:
Operating with a safety cover open
Bypassing a sensor
Loading oversized products
Processing unsuitable materials
Entering incorrect settings
Operating beyond rated conditions
Using nonstandard tools
Re-energizing equipment during maintenance
Incorrect reassembly after cleaning
Not every abnormal use can be predicted, but misuse that is likely to occur repeatedly should be considered in the design.
Product Life Cycle
Hazards do not occur only during normal operation.
The following stages should all be reviewed:
Transportation
Delivery and handling
Installation
Commissioning
Normal operation
Setup
Product changeover
Cleaning
Inspection
Breakdown repair
Component replacement
Dismantling
Disposal
Hazard Identification
Hazard identification is the starting point of risk control.
If hazards are overlooked, the subsequent risk assessment and protective measures will also be incomplete.
Functional Review
The following should be reviewed for each function:
Energy source
Moving components
Cutting or crushing elements
High and low temperature
Pressure
Electricity
Hazardous materials
Worker access
Condition following failure
State-Based Review
Hazards should be reviewed for each operating state:
Stopped condition
Startup
Normal operation
Deceleration
Shutdown
Emergency stop
Maintenance mode
Failure condition
Power restoration
Communication loss
Interface Review
Interfaces between components and systems are common sources of risk.
Examples include:
Machine and operator
Machine and product
Motor and drivetrain
Sensor and controller
Mechanical and electrical system
Mechanical and pneumatic system
Machine and supervisory system
Machine and adjacent equipment
Transitional-State Review
Risk can increase during transitions such as:
Mode change
Product changeover
Speed change
Power restoration
Pressure restoration
Cover opening
Manual-to-automatic transition
Process startup and shutdown
Risk Estimation
Risk estimation determines the significance of an identified risk.
Severity of Harm
Severity may be classified as:
Minor injury
Injury requiring treatment
Permanent disability
Serious injury
Death
Equipment damage
Major production loss
Product recall
Environmental damage
Frequency of Exposure
Exposure frequency may be assessed as:
Less than once per year
Once per month
Once per week
Once per day
Repeated or continuous exposure
Probability of Occurrence
The probability that a hazardous situation will occur may be classified as:
Nearly impossible
Low
Possible
High
Frequent
Possibility of Avoidance
The ability of a worker to avoid harm should also be considered:
Hazard can be recognized and avoided
Partial avoidance is possible
Event occurs too rapidly to avoid
Hazard cannot be perceived
Risk Evaluation
Risk evaluation determines whether the estimated risk is acceptable or requires further reduction.
The following questions should be reviewed:
Are legal and industry requirements satisfied?
Is the level appropriate compared with similar products?
Is there a practical technical method to reduce the risk further?
Is the cost of further risk reduction disproportionate?
Does the risk-reduction measure create a new hazard?
Can the user understand the residual risk?
Will the risk-control measure remain effective throughout product life?
A severe hazard should not be accepted solely because its probability is low.
Hazards that could result in death or serious injury should be reviewed for inherently safe design and multiple protective measures even when
occurrence is unlikely.
Risk-Control Hierarchy
Risk control generally follows this order:
Eliminate the hazard.
Reduce hazardous energy and performance.
Apply inherently safe design.
Apply guards and safety functions.
Provide warnings and information.
Establish procedures and training.
Use personal protective equipment.
Higher-level controls depend less on operator behavior.
For example, preventing access to a blade is a stronger control than relying only on a warning label.
Inherently Safe Design
Inherently safe design eliminates or reduces hazards through the design itself before adding protective devices.
Reduction of Hazardous Energy
The following may be reduced:
Speed
Force
Torque
Pressure
Temperature
Voltage
Stored energy
Travel distance
Energy above the level required for function may increase both risk and damage.
Elimination of Hazardous Geometry
The following geometries should be reduced or eliminated:
Sharp edges
Exposed rotating parts
Narrow pinch points
Shear points
Projections
Snagging features
Unexpected falling paths
Safe Layout
Hazardous components can be located away from the operator’s access area.
Examples include:
Internal placement of drives
Separation of hazardous piping
Shielding of hot areas
Separation of electrical and washdown zones
Separation of operating and maintenance areas
Stable Safe State
The system should move to a safe state when power or pressure is removed.
Examples include:
Valves that close under gravity
Brakes that engage without power
Actuators that stop when pressure is lost
Prevention of automatic restart after power restoration
Safeguarding
Hazards that cannot be eliminated through design should be controlled by guards and safety functions.
Fixed Guards
A fixed guard is difficult to remove without tools and prevents access to hazardous areas during operation.
Typical applications include:
Belts
Chains
Gears
Rotating shafts
Fans
Couplings
Hot components
Movable Guards
A movable guard may be opened for inspection, cleaning, or product loading.
The following should be reviewed:
Hinges
Locking devices
Opening direction
Interlocks
Open-position support
Closed-position confirmation
Interlocks
An interlock stops hazardous motion when a guard is opened or an abnormal condition is detected.
Interlock design should consider:
Sensor wiring failure
Contact welding
Misalignment
Possibility of bypass
Vibration
Contamination
Washdown water
Restart conditions
Fault diagnosis
Emergency Stop
An emergency stop provides rapid stopping during a hazardous event.
It does not replace inherently safe design.
An emergency stop should:
Be easy to identify
Be quickly accessible
Remain latched after activation
Require manual reset
Not cause automatic restart when reset
Address residual hazards after stopping
Limited Speed and Restricted Operation
Limited speed or energy may be used during setup and maintenance.
Examples include:
Low-speed operation
Jog operation
Hold-to-run control
Motion of selected axes only
Limited torque
Safely monitored speed
Information and Procedures
Residual risks that cannot be eliminated through design or guarding must be communicated clearly to users.
Warning Labels
A warning label may include:
Type of hazard
Location of the hazard
Expected consequence
Action to avoid
Required protective measure
Instruction Manual
The instruction manual should include:
Normal operating method
Prohibited use
Safe setup
Cleaning method
Maintenance method
Energy-isolation method
Residual risks
Inspection intervals
Replacement components
Response to abnormal conditions
Operator Training
Training can support design-based risk control but should not replace structural risk reduction.
Structural Robustness
Structural robustness is the ability of a structure to maintain required function despite variation in load, shock, vibration, fatigue, and
manufacturing quality.
Load Variation
Actual loading is rarely constant.
The following variations should be considered:
Product-weight variation
Impact loading
Eccentric loading
Rapid acceleration and deceleration
Product jams
Operator loading
Shock during transportation
Additional loading caused by assembly error
Safety Factor
A safety factor is a basic method for absorbing uncertainty.
Safety factor = Allowable material or structural capacity ÷ Actual required load
However, robustness cannot be achieved through a high safety factor alone.
The following should also be reviewed:
Load path
Stress concentration
Fatigue
Weld quality
Corrosion
Degradation
Buckling
Fastener loosening
Load Path
The path through which loads are transferred to the supporting structure should be clear.
An unclear load path may concentrate unexpected loads on a specific component.
Local Stress Concentration
Stress concentration commonly occurs at:
Sudden section changes
Small corner radii
Keyways
Threads
Weld ends
Hole edges
Fastening regions
A robust structure reduces local stress concentration and distributes loads over a wider area.
Functional Robustness
Functional robustness is the ability of a product to maintain its core function despite changes in operating conditions and component condition.
For example, the following may vary in cutting equipment:
Product temperature
Product hardness
Moisture content
Product size
Loading position
Blade wear
Feed speed
Friction coefficient
Functional robustness can be improved by:
Clearly defining the operating range
Identifying sensitive input variables
Confirming performance across the allowable range
Applying automatic compensation
Limiting adjustment ranges
Stopping safely under failure or boundary conditions
Control Robustness
Control robustness is the ability of a control system to remain stable despite sensor error, load variation, communication delay, and model
uncertainty.
Sensor Variation
Sensor values may be affected by:
Temperature
Vibration
Electrical noise
Contamination
Installation position
Cable length
Power-supply fluctuation
Long-term drift
A system that depends excessively on one sensor value may have poor robustness.
Signal Validation
Sensor errors can be reduced through:
Range checking
Rate-of-change checking
Cross-comparison
Redundant sensors
Time-delay verification
Signal-disagreement diagnosis
Filtering
Control-Parameter Sensitivity
A system has poor robustness if small parameter changes cause instability.
The following should be reviewed:
Gain variation
Load-inertia variation
Friction variation
Delay-time variation
Sampling time
Speed and acceleration range
Communication Failure
The system state following communication loss or delay should be defined.
Possible responses include:
Hold the last command
Safe stop
Restricted operation
Switch to local control
Display a fault code
For hazardous motion, transition to a defined safe state is usually preferable to remaining in an uncertain state.
Environmental Robustness
Environmental robustness is the ability of a product to maintain function despite changes in temperature, humidity, water exposure, dust,
vibration, and chemicals.
Temperature
Temperature affects:
Material strength
Lubricant viscosity
Seal elasticity
Sensor accuracy
Battery performance
Electronic-component life
Thermal expansion
Clearance
Humidity and Water
Moisture and washdown water may cause:
Corrosion
Insulation deterioration
Connector-contact failure
Sensor malfunction
Loss of lubricant
Microbial growth
Vibration and Shock
Vibration and shock may cause:
Fastener loosening
Wiring failure
Sensor movement
Weld fatigue
Controller malfunction
Loss of precision
Chemicals
The effect of cleaning agents, lubricants, and process chemicals on materials should be reviewed.
Possible effects include:
Corrosion
Swelling
Cracking
Hardening
Softening
Coating delamination
Seal degradation
Manufacturing Robustness
Manufacturing robustness is the ability of a product to maintain consistent quality despite variation in material, machining, assembly, and supplier
capability.
Dimensional Variation
Even when each component is within tolerance, tolerance accumulation may reduce assembly performance.
The following should be reviewed:
Tolerance stack-up
Datum consistency
Assembly clearance
Locating method
Adjustment range
Interchangeability
Process Capability
When design tolerances are much tighter than process capability, defects and rework increase.
A robust design balances functional tolerance requirements with actual process capability.
Supplier Variation
Components with the same nominal specification may have different actual characteristics depending on supplier.
Review items include:
Dimensions
Material
Hardness
Surface roughness
Lubrication
Electrical characteristics
Response time
Service life
Assembly-Operator Variation
Manufacturing robustness is poor when differences in operator skill strongly affect product performance.
Variation can be reduced through:
Locating structures
Standard tightening torque
Assembly fixtures
Mistake-proofing
Automated inspection
Work standards
Tolerance and Margin
Robust design requires sufficient margin between required performance and actual system capability.
Performance Margin
Performance margin = System capability − Maximum requirement
For example, if available motor torque is nearly equal to the maximum required torque, a small increase in friction or a voltage drop may cause
loss of function.
Dimensional Margin
Assembly clearance and fit tolerance should consider machining variation, coating thickness, thermal expansion, and contamination.
Temperature Margin
There should be sufficient margin between allowable component temperature and expected operating temperature.
Electrical Margin
The following may be reviewed:
Current margin
Voltage margin
Power margin
Insulation margin
Thermal margin
Derating
Derating means operating a component below its maximum rated condition.
Benefits include:
Lower heat generation
Longer life
Better tolerance of environmental change
Lower failure rate
Excessive derating, however, may increase size and cost and should therefore be applied at a reasonable level.
Fault Tolerance
Fault Tolerance is the ability of a system to avoid transitioning into a hazardous state when a component fails, and instead maintain limited
function or stop safely.
Fail-Safe
Fail-Safe design causes the system to move to a safe state when failure occurs.
Examples include:
Brake engagement after power loss
Valve closure after pressure loss
Prevention of operation after sensor-wire failure
Safe stop after communication loss
Fail-Operational
Fail-Operational design allows limited continued operation after a fault.
It may be used where continuity of operation is important, but additional hazards must not arise during faulted operation.
Redundancy
Redundancy provides identical or alternative functions through multiple paths.
Examples include:
Dual sensors
Dual power supplies
Dual communication paths
Auxiliary brakes
Parallel pumps
Redundancy can improve reliability, but it also increases complexity and may introduce common-cause failures.
Common-Cause Failure
Redundant components may fail simultaneously because of the same cause.
Examples include:
Shared power supply
Identical software error
Exposure to the same environment
Shared wiring route
Common manufacturing defect
Redundancy requires independence, not merely duplication.
Diagnostics and Monitoring
A robust system should detect abnormal conditions before they develop into serious failures.
Condition-Monitoring Variables
Temperature
Vibration
Current
Pressure
Flow
Speed
Position
Lubrication condition
Wear
Operating time
Number of cycles
Trend Analysis
Monitoring trends can identify deterioration earlier than simple threshold alarms.
Examples include:
Increasing bearing vibration
Rising motor current
Increasing cycle time
Falling pressure
Increasing sensor error
Longer cleaning time
Diagnostic Capability
A fault code should provide possible causes and inspection methods, not merely indicate the final result.
Response to Degradation
Before complete failure occurs, the system may respond through:
Warning
Performance limitation
Maintenance request
Safe stop
Component replacement
Risk and Robustness Analysis Methods
FMEA
FMEA analyzes the failure modes and effects of each component or function.
Main elements include:
Function
Failure mode
Failure cause
Failure effect
Existing control measure
Severity
Occurrence
Detection
Improvement action
FMEA may be applied at both component and process levels.
FTA
FTA starts with a final accident or system failure and logically traces possible causes.
Examples include:
Blade fails to stop
Machine operates with guard open
Product contamination occurs
Shaft fractures
Overheating occurs
FTA is useful for understanding how combinations of failures can lead to one accident.
HAZOP
HAZOP systematically reviews deviations from intended process variables and operation.
Typical guide words include:
No flow
Excessive flow
High pressure
Low temperature
Reverse flow
Delay
Wrong material
What-If Analysis
“What if?” questions are used to review abnormal conditions.
Examples include:
What if the sensor fails?
What if the product jams?
What if the operator opens the guard?
What if power is restored?
What if the connector is still wet after cleaning?
Bow-Tie Analysis
Bow-Tie analysis connects causes, preventive controls, consequences, and mitigation controls around a central hazardous event.
Left side: causes
Center: central hazardous event
Right side: consequences
Preventive controls
Mitigation controls
Sensitivity Analysis
Sensitivity analysis determines how much output performance changes when a design variable changes.
Sensitivity = Change in output ÷ Change in input
Highly sensitive variables require design modification, tighter tolerance control, or control compensation.
Worst-Case Analysis
Worst-case analysis evaluates the combination of variables in the most unfavorable direction.
Examples include:
Maximum load
Minimum voltage
Maximum friction
Maximum temperature
Minimum material strength
Maximum tolerance stack-up
Monte Carlo Analysis
Monte Carlo analysis repeatedly calculates many combinations using probability distributions of input variables.
It can be used to determine:
Performance distribution
Probability of defects
Probability of exceeding allowable limits
Sensitive variables
Tolerance optimization
Design of Experiments
Design of Experiments systematically evaluates the influence of design and environmental variables.
Its main purposes include:
Identification of major factors
Evaluation of interactions
Selection of optimum conditions
Selection of robust operating conditions
Verification and Validation
Risk Control & Robustness cannot be completed through analytical documents alone.
Actual tests are required to confirm that the design performs as intended.
Design Verification
Design verification confirms that design outputs satisfy the specified requirements.
Methods include:
Calculation
Simulation
Drawing review
Code review
Tolerance analysis
Circuit review
Product Validation
Product validation confirms that the actual product performs its required function under real operating conditions.
Methods include:
Functional testing
Load testing
Durability testing
Environmental testing
Shock testing
Vibration testing
Cleaning testing
Fault-injection testing
Misuse testing
Boundary-Condition Testing
Not only normal conditions but also limit conditions should be tested.
Examples include:
Maximum load
Minimum load
Low temperature
High temperature
Low voltage
High humidity
Sensor variation
Component wear
Product variation
Long-duration operation
Fault-Injection Testing
Intentional faults may be introduced to confirm system response.
Examples include:
Sensor-wire disconnection
Communication loss
Pressure drop
Motor overload
Guard opening
Brake fault
Power restoration
Design Changes and Risk Management
A design change may reduce an existing risk while creating a new one.
Risk assessment should be repeated after changes such as:
Material change
Motor-capacity change
Control-logic change
Sensor change
Guard-structure change
Production-speed increase
Introduction of a new product
Cleaning-agent change
Supplier change
Software update
The review should include not only the changed component but also adjacent systems and overall product function.
Risk Control & Robustness in Food-Processing Machinery
Food-processing machinery must manage both worker safety and product hygiene.
Blade and Cutting Hazards
Major risks include:
Contact with blades
Cutting injury while clearing jams
Injury during blade replacement
Failure of high-speed rotating components
Ejection of blade fragments
Possible controls include:
Access-prevention structures
Interlocked covers
Safe stopping
Dedicated blade-replacement tools
Blade-storage cases
Maintenance mode
Residual-rotation detection
Product Jams
Product jams are a major reason workers enter hazardous areas.
The following should be reviewed:
Flow paths with low jam probability
Automatic reverse operation
Torque detection
Jam warning
Safe clearing space
Energy isolation
Dedicated clearing tools
Cleaning and Safety
During cleaning, covers are open and major components may be removed, creating hazards different from normal operation.
Relevant controls include:
Power isolation
Residual-pressure removal
Blade protection
Slip prevention
Cleaning-agent exposure control
Hot-water protection
Prevention of incorrect reassembly
Hygienic Robustness
Hygienic performance should remain robust despite environmental and operational variation.
Contamination should be prevented even under:
Repeated cleaning
Variation in cleaning-agent concentration
Variation in water temperature
Gasket wear
Assembly variation
Change in product characteristics
Differences in operator cleaning methods
Corrosion Robustness
Even stainless steel may corrode in the presence of salt, chlorine-based cleaning agents, weld heat-affected zones, and crevices.
The following should therefore be reviewed together:
Surface roughness
Continuous welding
Drainage
Drying
Compatibility with cleaning agents
Crevice reduction
Passivation
Foreign-Material Risk
The possibility of the following entering the product area should be reduced:
Bolts
Washers
Springs
Plastic fragments
Seal fragments
Wire fragments
Coating fragments
Captive fasteners, metal-detectable components, and simplified structures may be applied.
Risk Control & Robustness Evaluation Procedure
Define the System
Define:
Main functions
Users
Operating environment
Product being processed
Energy sources
Normal use
Foreseeable misuse
Product service life
Develop a Hazard List
Identify mechanical, electrical, control, thermal, pressure, chemical, hygienic, and ergonomic hazards.
Develop Risk Scenarios
For each hazard, define the following sequence:
Cause → Hazardous situation → Accident → Harm
Evaluate Risk Level
Assess severity, exposure frequency, probability, and possibility of avoidance.
Select Risk-Reduction Measures
Apply measures in the following order:
Eliminate the hazard.
Reduce energy.
Apply inherently safe design.
Apply guarding.
Apply monitoring and diagnostics.
Provide warnings and procedures.
Provide training and protective equipment.
Identify Sources of Variation
Separate variables affecting performance into:
Design variables
Manufacturing variation
Environmental variables
Usage variables
Degradation variables
Supply-chain variables
Perform Sensitivity Analysis
Identify variables that strongly affect performance.
Establish Robustness Measures
Adjust tolerances
Increase performance margin
Reduce sensitivity
Apply automatic compensation
Standardize components
Shield against environmental influence
Add diagnostic functions
Apply fault-tolerant structures
Develop a Test Plan
Include normal, limit, fault, and life-cycle conditions.
Evaluate Residual Risk
Reassess all remaining risks after improvements.
Document the Results
Prepare:
Risk-assessment report
FMEA
Safety-function list
Robustness analysis
Test results
Residual-risk list
Instruction manual
Change history
Major Failure Modes
Insufficient consideration of Risk Control & Robustness may cause the following problems.
Omitted Hazards
Only normal operation is reviewed, while cleaning, maintenance, power restoration, and misuse are overlooked.
Excessive Reliance on Warnings
Hazards that could be eliminated structurally are controlled only through warning labels and training.
Single-Point Failure
Failure of one sensor or relay allows hazardous operation.
Bypassed Safety Devices
Interlocks or sensors can be easily bypassed for operating convenience.
Common-Cause Failure
Redundant devices fail simultaneously because they share the same power supply, software, or environmental exposure.
Insufficient Design Margin
The product functions under normal conditions but fails after a small increase in load or friction.
Tolerance Stack-Up
Individual components remain within tolerance, but the final assembly does not meet performance requirements.
Environmental Sensitivity
Temperature, humidity, washdown water, or vibration destabilizes sensors and controls.
Failure to Consider Degradation
The product is safe when new, but risk increases after wear, corrosion, seal hardening, or lubrication loss.
Poor Diagnostics
Fault localization takes too long and unnecessary components are replaced.
Misuse of Safety Factors
A high safety factor is applied without evaluating fatigue, impact, stress concentration, or failure modes.
New Hazards Created by Safeguards
Added guards or interlocks create cleaning problems, pinch points, or incentives for operators to bypass them.
Risk Control & Robustness Review Checklist
System Definition
Are the product function and scope of use clearly defined?
Are normal use and foreseeable misuse defined?
Are installation, operation, cleaning, maintenance, and disposal included?
Are the users and operating environment defined?
Hazard Identification
Have mechanical hazards been identified?
Have electrical, thermal, pressure, and chemical hazards been reviewed?
Have hygienic and contamination hazards been included?
Have control and communication failures been reviewed?
Have maintenance and cleaning hazards been included?
Risk Estimation
Has severity of harm been evaluated?
Has frequency of exposure been included?
Has the probability of a hazardous situation been assessed?
Has the possibility of operator avoidance been reviewed?
Are severe hazards prevented from being accepted solely because probability is low?
Inherently Safe Design
Can the hazard be eliminated structurally?
Can speed, force, pressure, or temperature be reduced?
Have hazardous shapes and pinch points been eliminated?
Does the system move to a safe state after loss of power or pressure?
Is automatic restart prevented?
Safeguarding
Are fixed and movable guards appropriate?
Have interlock failure modes been reviewed?
Are safety sensors difficult to bypass?
Are emergency-stop position and function appropriate?
Do protective devices avoid creating new hazards?
Structural Robustness
Have maximum and impact loads been reviewed?
Have fatigue and stress concentration been evaluated?
Is the load path clear?
Are welds, fasteners, and support structures robust?
Is sufficient margin maintained after corrosion and degradation?
Functional Robustness
Have variations in product and raw-material characteristics been considered?
Have changes in friction, wear, and lubrication been included?
Are performance limits clearly defined?
Does performance variation avoid creating hazardous conditions?
Are automatic compensation or limiting functions required?
Control Robustness
Have sensor variation and failure been reviewed?
Are signal-range and rate-of-change checks provided?
Is the system state defined after communication loss?
Are control parameters insensitive to load variation?
Does the system restart safely after power restoration?
Environmental Robustness
Is the operating-temperature range defined?
Is protection provided against humidity, washdown water, and dust?
Can the system withstand vibration and shock?
Are materials compatible with cleaning agents?
Have condensation and corrosion been reviewed?
Manufacturing Robustness
Has tolerance stack-up been reviewed?
Do design tolerances match process capability?
Does supplier variation avoid affecting function?
Is dependence on operator skill low?
Are interchangeability and repeatable positioning secured?
Margin and Derating
Is sufficient margin provided in the structure and drivetrain?
Do motor and power capacities satisfy maximum conditions?
Has derating been applied for temperature and current?
Do clearances account for contamination and thermal expansion?
Has unnecessary increase in cost and size caused by excessive margin been avoided?
Fault Tolerance
Can a single fault create a hazardous state?
Is a safe state defined for failure?
Is the independence of redundant devices secured?
Have common-cause failures been reviewed?
Can fault conditions be diagnosed?
Diagnostics
Can major conditions be monitored?
Do fault codes provide causes and corrective actions?
Can degradation trends be observed?
Can maintenance timing be determined?
Are test points provided safely?
Verification and Validation
Have analytical results been confirmed through testing?
Have maximum and minimum conditions been tested?
Has fault-injection testing been conducted?
Have durability and environmental tests been performed?
Have risk assessment and testing been updated after design changes?
Documentation
Are the risk assessment and FMEA current?
Are risk-control measures and verification results recorded?
Are residual risks communicated to users?
Are safety-related settings and software versions controlled?
Can design-change history be traced?
Conclusion
Risk Control & Robustness does not simply mean adding safety devices to prevent accidents or making structures stronger.
It is a comprehensive design activity that systematically identifies hazards in products and equipment, eliminates hazards through the design
wherever possible, applies reliable protective measures where elimination is not possible, and ensures that function remains stable despite
manufacturing variation, environmental change, component degradation, external disturbance, and changes in operating conditions.
A design with good risk control and robustness should satisfy the following conditions:
Hazards are identified across every stage of the product life cycle.
Foreseeable misuse is reviewed as well as normal use.
Hazardous energy and structures are eliminated through the design wherever possible.
Guards and safety functions remain reliable despite failure and environmental variation.
A single fault does not immediately create a hazardous condition.
Manufacturing variation and assembly error can be absorbed.
Function is maintained despite changes in temperature, humidity, vibration, and contamination.
Sufficient performance margin remains after wear, corrosion, and long-term degradation.
The control system is robust against sensor variation, load change, and communication failure.
Major failures and degradation can be diagnosed.
The system stops safely or continues with limited function after failure.
Risk-control measures and robustness are verified through testing.
Risk assessments and verification results are updated after design changes.
Residual risks and safe-use methods are clearly documented.
In mechanical design, risk cannot be solved simply by adding a protective cover after the product has been completed. Robustness is also not
achieved merely by increasing thickness or applying a high safety factor.
Risk level and robustness are determined from the moment decisions are made about structure, materials, tolerances, sensors, control logic,
interfaces, protective devices, and maintenance strategy.
A good design is not one that works only under normal conditions. It should maintain required function under realistic conditions that include
component variation, environmental change, long-term degradation, and foreseeable failure, and it should transition to a safe state when risk
occurs.
Ultimately, the quality of Risk Control & Robustness is determined not by the complete absence of hazards, but by whether risks are
systematically reduced and product function and safety can be maintained under the uncertainty and variation of real operating conditions.