vaayaa Inclusive Education
Industrial risk assessment

Industrial Automation and Smart Manufacturing Risk Assessment: Control Logic, Guarding and Reliability Hazards

A worked example of how a smart manufacturing line finds, scores and controls the risks that arise when machines, controllers, networks and people work together, from unintended motion and cyber exposure to supplier dependency and procedural deviation.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Industrial Automation and Smart Manufacturing course

Executive summary

This assessment shows how a smart manufacturing line can find, rate and control the risks that come from combining machines, controllers, networks and people. Eight hazards were selected because they are plausible on a modern production line. Unintended machine motion and guard bypass during maintenance carry the greatest harm, so they are rated High and Critical before controls. Specification mismatch, unplanned downtime and cyber exposure follow closely behind. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but the safety hazards stay at Medium because the consequences of a serious injury are severe. The first actions are a verified lockout check, controlled change records for program edits, network segmentation and a spares plan for critical drives. The site is a teaching example, so every score illustrates method, not a real plant.

Focus area
Industrial automation, process control and smart manufacturing
Setting
Discrete and batch manufacturing plant with programmable controllers, robots, drives, sensors and a plant data network
Method
Five by five likelihood and severity risk register

Scope

This assessment covers a single manufacturing line and its supporting control system, from sensors and drives through controllers, human machine interfaces, plant networks and maintenance routines. It does not cover product design or the commercial terms of suppliers. The site location, jurisdiction, equipment make and software platform are not specified, so they are treated as assumptions for teaching.

Context

The line has three robotic cells, a conveyor network, programmable logic controllers, variable speed drives and a supervisory system that collects production data. Operators load material and clear jams, technicians carry out planned and reactive maintenance, and an engineering team changes control programs during product changes. Some components come from a small number of outside suppliers, and remote support is used for some controllers. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to run the line safely, keep output reliable and quality consistent, protect the control system and its data, and meet the legal duties owed to workers, the public and the environment. The assets in scope are the machines and guarding, controllers and their programs, drives, sensors, the plant network, the supervisory data system, spare parts and the skills held by the team. Stakeholders include operators, maintenance technicians, engineers, plant management, the safety representative, suppliers and integrators who provide support, customers who rely on delivery dates, and regulators. Every risk has one owner role, and the plant manager reviews the register with the safety lead and the engineering lead each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 2, score 8, medium: H08 Likelihood 4, impact 3, score 12, high: H03 H04 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 5, score 15, high: H01 H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 H08 Likelihood 2, impact 3, score 6, medium: H03 Likelihood 2, impact 4, score 8, medium: H01 H02 H05
1 Rare Likelihood 1, impact 3, score 3, low: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unintended machine motion from control logic errors 15 High 8 Medium Automation engineering lead
H02 Guard bypass or failed lockout during maintenance 20 Critical 8 Medium Plant safety lead
H03 Specification mismatch between components and process needs 12 High 6 Medium Controls design engineer
H04 Unplanned downtime from poor maintenance and reliability 12 High 6 Medium Maintenance manager
H05 Cyber exposure of networked control systems 15 High 8 Medium IT and operational technology manager
H06 Release of hydraulic fluid, coolant or cleaning chemicals 8 Medium 3 Low Environmental and facilities lead
H07 Supplier dependency and loss of support 9 Medium 4 Low Procurement manager
H08 Operator and changeover procedural deviation 8 Medium 4 Low Production supervisor
H01

Unintended machine motion from control logic errors

Safety Before 15 After 8

A logic error, wrong parameter or unintended program state causes a robot, axis or conveyor to move when people are inside its reach or when a stop was expected.

Who or what is affected: Operators, technicians and visiting staff near the machines

Causes

Hand edited code, parameters changed during commissioning and untested restarts after a fault.

Consequences

Crush, cut or impact injuries, damage to equipment and an unplanned stoppage.

Existing controls

  • Emergency stop circuits are wired to remove drive power.
  • Program versions are stored on the engineering server.

Control gaps

Program comparison is done only at commissioning, not after each change.

Additional controls

  • Prevent: Use safety rated logic for stop and guard functions and keep them separate from standard control code.
  • Detect: Compare each downloaded program against the approved version before the machine is restarted.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Automation engineering lead Target: Within 45 days Early warning: A controller program that differs from the approved version at startup.
H02

Guard bypass or failed lockout during maintenance

Safety Before 20 After 8

Guards or interlocks are bypassed, or energy is not isolated before a technician enters the machine, so stored or moving energy releases during the work.

Who or what is affected: Maintenance technicians, cleaners and operators on the line

Causes

Time pressure during breakdowns, bypass keys kept in the cell and shortcuts taken during quick fixes.

Consequences

Severe injury or death, prosecution, shutdown of the line and loss of trust.

Existing controls

  • Lockout tags are issued for planned maintenance.
  • Interlocked guard doors stop motion when opened.

Control gaps

Bypass keys are not logged, and reactive repairs often skip the written procedure.

Additional controls

  • Prevent: Fit locks to isolators and require a personal lock for each person entering a guarded area.
  • Respond: Test the stop function and confirm zero energy with a try start before any work begins.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Plant safety lead Target: Within 30 days Early warning: Entries into a guarded area without a recorded lockout check.
H03

Specification mismatch between components and process needs

Operational Before 12 After 6

A sensor, drive, actuator or controller is chosen with ratings, speeds, response times or communication settings that do not match the process, so the line runs outside its design limits.

Who or what is affected: Operators, quality staff and the customers receiving product

Causes

Specifications copied from older machines and changes in product mix that were not reviewed.

Consequences

Defects, rework, nuisance trips, damage to parts and missed delivery dates.

Existing controls

  • Component datasheets are checked by the engineer before purchase.
  • Commissioning includes a basic functional test of each station.

Control gaps

Specifications are not revisited when the product range changes.

Additional controls

  • Prevent: Write a specification for each critical component and verify it against the process requirements before order.
  • Detect: Record cycle times and sensor readings during the first month and compare them with the design values.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Controls design engineer Target: Within 60 days Early warning: Repeated sensor faults or drive trips on the same station within a shift.
H04

Unplanned downtime from poor maintenance and reliability

Operational Before 12 After 6

Worn bearings, failing sensors and unlubricated drives are not found until they stop the line, because planned checks are missed or based only on run hours.

Who or what is affected: Production staff, maintenance team and customers with fixed delivery dates

Causes

Schedules set by run hours, skilled staff leaving and spares held in one location.

Consequences

Lost output, overtime costs, late deliveries and rushed repairs that create new faults.

Existing controls

  • A planned maintenance schedule covers the main drives and bearings.
  • Fault logs are kept on each controller for reactive repairs.

Control gaps

Condition data is collected but not trended, so early wear is missed.

Additional controls

  • Prevent: Base maintenance on condition checks such as vibration and temperature for critical drives.
  • Recover: Keep a tested spares kit and a documented restart sequence for each critical station.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Maintenance manager Target: Within 90 days Early warning: Rising vibration or temperature readings on a critical drive over two weeks.
H05

Cyber exposure of networked control systems

Technology and data Before 15 After 8

Malware, stolen remote access credentials or an unpatched controller allows an outsider to change set points, stop production or copy production records.

Who or what is affected: Operators, plant managers, customers and the supply chain

Causes

Shared passwords, unpatched controllers, removable media and vendor access left open.

Consequences

Stopped production, damaged product, lost records and a breach reported to customers.

Existing controls

  • Firewalls separate the plant network from the office network.
  • Remote access is granted to the vendor for named sessions.

Control gaps

Controllers are not patched because the line cannot easily stop for updates.

Additional controls

  • Prevent: Segment the control network into zones and remove standing remote access for vendors.
  • Detect: Log and alert on new devices, failed logins and changes to controller programs.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: IT and operational technology manager Target: Within 60 days Early warning: A remote session to a controller opened outside agreed support windows.
H06

Release of hydraulic fluid, coolant or cleaning chemicals

Environmental Before 8 After 3

A leaking hose, failed seal or overfilled tank releases hydraulic oil, coolant or cleaning chemicals onto the floor or into a drain, exposing people and the environment.

Who or what is affected: Operators, cleaners, nearby residents and the local water system

Causes

Worn hoses, vibration, overfilling during top ups and drains connected to outside outfalls.

Consequences

Slip injuries, chemical exposure, environmental harm and enforcement action.

Existing controls

  • Drip trays sit under the main hydraulic units.
  • Chemical containers are labeled and stored in a bunded area.

Control gaps

Drain routes are not mapped, so the path of a spill is not known.

Additional controls

  • Prevent: Replace hoses on a fixed interval and fit level alarms to tanks with high fill risk.
  • Respond: Keep spill kits at each cell and train staff to use them with the site contact list.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Environmental and facilities lead Target: Within 60 days Early warning: Fluid found in drip trays or on floor drains during a routine walk.
H07

Supplier dependency and loss of support

Supplier Before 9 After 4

A single supplier stops making a drive or controller, withdraws support, or delivers firmware that is not compatible with the installed hardware, so repairs and upgrades stall.

Who or what is affected: Maintenance staff, production planners and customers

Causes

Long lead times, discontinued parts and integrators who hold the only copy of the code.

Consequences

Extended outages, costly redesign and loss of production capacity.

Existing controls

  • Two suppliers are approved for common spares.
  • Support contracts are reviewed when they renew.

Control gaps

Lifecycle status of installed devices is not tracked against support end dates.

Additional controls

  • Prevent: Check component lifecycle status before adding any new device and name a second source.
  • Recover: Keep a verified backup of each controller program and firmware version off the network.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Procurement manager Target: Within 90 days Early warning: A supplier notice of end of support for any installed controller or drive.
H08

Operator and changeover procedural deviation

People Before 8 After 4

Operators skip checks, use the wrong recipe or bypass a sequence during changeover or restart, so the wrong product or an unsafe state reaches the line.

Who or what is affected: Operators, team leaders and the next shift

Causes

Pressure to restart quickly, unclear checklists and training that is not refreshed.

Consequences

Off specification product, scrap, minor injuries and a shift handover that hides the problem.

Existing controls

  • Changeover checklists are displayed at each station.
  • New operators work with a trained buddy for their first week.

Control gaps

Checklists are not signed, so missed steps cannot be traced.

Additional controls

  • Prevent: Lock recipe selection to authorized users and show the required checks on the screen.
  • Detect: Audit a sample of changeovers each week and record deviations and their causes.
Likelihood 4 x impact 2 before; 2 x 2 after Owner: Production supervisor Target: Within 60 days Early warning: Recipe changes made without a signed changeover checklist.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and severity runs from Negligible to Catastrophic, where severity covers injury, equipment damage, product quality, environmental release, data loss and loss of trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work but does not measure risk. Inherent risk is the score before any controls are considered. Residual risk is the score after existing and added controls are working. A hazard that can injure a person is never rated down because it has not happened yet. Critical risks stop the related work until a plan is approved by the plant manager. High risks need a dated plan and senior review. Medium risks need routine controls with a named owner. Low risks are accepted and watched. Operators, technicians and engineers challenge the ratings at the monthly review, and any rating is reopened when an indicator reaches its threshold or after an incident, near miss or change to the line.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Entries into a guarded area without a recorded lockout check.Escalate to the plant safety lead at once and stop the affected machine until the check is recorded.
Control program changes made without a signed change record.Escalate to the engineering lead the same day and roll back the change until it is approved.
Remote access sessions to controllers outside agreed support windows.Escalate to the IT manager at once and disable the session, with a review to the plant manager within 24 hours.
Critical spares below the agreed minimum stock level.Escalate to the maintenance manager when stock falls below minimum, and to the plant manager if it stays low for 14 days.
Unplanned stoppages on the line in a rolling 30 day period.Escalate to the maintenance manager when stoppages exceed the agreed threshold, and to the plant manager after two repeats.

Contingency arrangements

If a serious event occurs, such as an unexpected machine movement, a controller failure that stops the line or a suspected cyber intrusion, the line is made safe first using the emergency stop and isolation procedure. The shift supervisor secures the area, and the engineering lead preserves the program and log files before any change. The IT manager isolates affected network segments and restores controllers from the last verified backup. The plant manager informs the safety representative, and external support and regulators are contacted as required in the relevant jurisdiction. Production is moved to a standby cell or stock where possible, and customers are told early and plainly.

Prioritized action plan

  1. Verify lockout and tagout at every machine before entry, owner plant safety lead, within 30 days.
  2. Require a signed management of change record for every control program edit, owner engineering lead, within 45 days.
  3. Segment the plant network and remove standing remote access, owner IT manager, within 60 days.
  4. Hold a spares list and firmware register for critical drives and controllers, owner maintenance manager, within 90 days.
  5. Run a short refresher on procedures and changeover checks for all operators, owner production supervisor, within 60 days.

Conclusion

Safe and reliable automation rests on a few steady habits: verified isolation before entry, controlled changes to every program, segmented networks, planned maintenance with tested spares and clear roles for each machine. The highest scores sit with unintended motion, guarding during maintenance and cyber exposure, and each has actions that bring the residual score down. Keep the register as a living record, review it on the stated cycle and seek qualified engineering and safety advice for any real plant decision.

Assumptions and limitations

Assumptions

  • The site operates under one national machinery safety regime, which is not named here and needs local confirmation.
  • Controllers and drives are from mainstream vendors and are maintained by in-house technicians with vendor support.
  • The plant network is partly connected to business systems and to remote support access.

Limitations

  • Scores are examples for learning and do not describe any real plant.
  • Machine safety and functional safety design are specialist fields, so specialist review is needed for any real system.
  • This educational content does not replace a formal site-specific risk assessment or licensed engineering advice.

Related frameworks to study

  • Hierarchy of controls
  • Failure mode and effects analysis
  • Management of change process
  • Lockout and tagout procedure principles
  • Functional safety lifecycle concepts

Industrial Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Industrial Automation and Smart Manufacturing course Read the best practices for this course

More Industrial risk assessments

Hourly Active: 39,499 Learners