vaayaa Inclusive Education
Technical risk assessment

Industrial Automation Control Risk Assessment: Logic, Interlocks, Network and Maintenance Hazards

A worked example of how an automation team identifies, scores and controls hazards from control logic defects, bypassed interlocks, network exposure, maintenance backlogs and supplier dependencies in a controlled production process.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Industrial Automation Control course

Executive summary

This assessment shows how an automation team can find, score and control the hazards that matter most to people, equipment and product on a controlled line. Eight risks were chosen because they are plausible in daily control work. Bypassed interlocks and control logic defects carry the highest scores before controls, while electrical exposure and network intrusion are less likely but could cause serious harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but electrical exposure and bypass risk stay at Medium because the impact remains severe. The first actions are a logic release check, removal of software force functions, individual remote accounts and a written isolation procedure. The line is a teaching example, so every score illustrates method, not a real plant.

Focus area
Industrial automation and process control
Setting
Automated production line with programmable controllers, operator interfaces and a supervisory control room
Method
Five by five likelihood and impact register with inherent and residual scoring

Scope

This assessment covers the control system of an automated process line, from field sensors and actuators through controllers, operator screens, engineering workstations, maintenance routines and supplier support. It looks at risks to people, equipment, product, data and the environment. It does not cover the design of any real plant. Jurisdiction, process type, equipment make and site layout are not specified and are treated as assumptions for teaching.

Context

The line has programmable logic controllers linked to drives, valves, pressure and temperature sensors and safety input devices. Operators use a supervisory screen and can change setpoints within limits. An engineering workstation holds the program, which is changed through a formal change request. Maintenance staff perform planned checks and respond to faults, and a small number of vendor engineers support the system remotely. Each hazard is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to run the process safely, keep product within specification, protect equipment and data, meet the duties set by the site and local rules, and keep the trust of operators, customers and regulators. The assets in scope are the controllers, drives, valves, sensors, operator screens, engineering workstations, program files, production records and spare parts. Stakeholders include operators, maintenance and electrical staff, engineers, plant management, contractors, vendors, customers and the inspection authorities. Clear roles matter: every risk has one owner role, and the operations supervisor reports open high scores to plant management each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H05 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 2, score 6, medium: H08 Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H02 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H05
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 Likelihood 2, impact 4, score 8, medium: H03 H04
1 Rare Likelihood 1, impact 5, score 5, medium: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Control logic defect or specification mismatch 16 High 6 Medium Control systems engineer
H02 Sensor or actuator failure causing process deviation 12 High 6 Medium Instrumentation technician
H03 Bypassed interlock during a procedural deviation 20 Critical 8 Medium Operations supervisor
H04 Network intrusion through remote access 15 High 8 Medium Operational technology security lead
H05 Maintenance backlog and equipment unreliability 12 High 6 Medium Maintenance lead
H06 Electrical energy exposure during commissioning and maintenance 10 High 5 Medium Electrical safety lead
H07 Supplier obsolescence and support dependency 9 Medium 4 Low Procurement lead
H08 Incomplete records and compliance gaps 6 Medium 4 Low Compliance officer
H01

Control logic defect or specification mismatch

Operational Before 16 After 6

A program change, sequence or setpoint does not match the process specification, so the line moves to an unintended state during start up, a fault or a product changeover.

Who or what is affected: Operators, maintenance staff and product quality

Causes

Rushed changes, incomplete specifications and untested edge cases in sequences.

Consequences

Equipment damage, off specification product, unsafe motion and lost production time.

Existing controls

  • Program changes are recorded in a change request log.
  • A senior engineer reviews each new program before release.

Control gaps

Changes made during faults are sometimes released without a full review.

Additional controls

  • Prevent: Test each sequence in a simulation or offline copy against the written specification before release.
  • Detect: Compare the running program with the approved version at each shift and alert on any difference.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Control systems engineer Target: Within 45 days Early warning: A program checksum that differs from the approved version after a change window.
H02

Sensor or actuator failure causing process deviation

Safety Before 12 After 6

A pressure, temperature or level sensor drifts, sticks or fails, or a valve fails to move, so the controller acts on false information and the process moves outside its safe range.

Who or what is affected: Operators, nearby workers and plant equipment

Causes

Wear, fouling, vibration, poor wiring and calibration drift over time.

Consequences

Overpressure, overheating, product loss and an unplanned shutdown.

Existing controls

  • Critical sensors are checked against a second instrument at each shift.
  • Alarms signal high and low process limits to operators.

Control gaps

Plausibility checks are missing on several loops, so a stuck reading can look normal.

Additional controls

  • Prevent: Replace sensors on a planned interval and record calibration results against the loop.
  • Detect: Add plausibility checks that flag readings that disagree with related measurements.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Instrumentation technician Target: Within 60 days Early warning: A sensor reading that does not change for longer than the normal scan period.
H03

Bypassed interlock during a procedural deviation

People Before 20 After 8

An operator or technician overrides, forces or bypasses a safety interlock to keep the line running, so a protective function is removed while the process is still hazardous.

Who or what is affected: Operators, maintenance staff and visitors near the line

Causes

Pressure to meet output targets, nuisance trips and unclear rules on who may override.

Consequences

Serious injury, equipment destruction and loss of the protective function.

Existing controls

  • Forcing of inputs requires a supervisor key held in a log.
  • Shift handover includes a check of active overrides.

Control gaps

Overrides are logged but not reviewed until a fault forces a review.

Additional controls

  • Prevent: Remove the software force function from operator screens and allow it only under a signed permit.
  • Respond: Stop the line at once when an interlock is found bypassed and record the reason before restart.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Operations supervisor Target: Within 30 days Early warning: An active force or bypass on a safety input that is not linked to a signed permit.
H04

Network intrusion through remote access

Technology and data Before 15 After 8

Shared accounts, unpatched workstations or an open remote access link let an outsider or careless user change setpoints, stop equipment or copy program files from the control network.

Who or what is affected: Operators, plant equipment and the business data held in production records

Causes

Shared logins, phishing against staff, unpatched software and long-standing vendor links.

Consequences

Unauthorized process changes, stolen recipes, shutdown and loss of trust in the system.

Existing controls

  • The control network is separated from the office network by a firewall.
  • Remote sessions are enabled only for named vendor accounts.

Control gaps

Vendor sessions are not logged in one place, and old workstations remain on the network.

Additional controls

  • Prevent: Use individual accounts, multi-factor sign in and time limited remote sessions for vendors.
  • Detect: Log all network sessions and alert on any new device or unexpected connection to a controller.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Operational technology security lead Target: Within 45 days Early warning: A login to a controller from an address or account not on the approved list.
H05

Maintenance backlog and equipment unreliability

Operational Before 12 After 6

Planned checks are deferred, spare parts are missing and repeat faults are fixed by quick workarounds, so the equipment becomes less reliable and more likely to fail under load.

Who or what is affected: Maintenance staff, operators and production planners

Causes

Staff shortages, production pressure and unclear priorities between tasks.

Consequences

Unplanned stoppages, product losses and rising repair costs.

Existing controls

  • A planned maintenance schedule is kept for drives and pumps.
  • Faults are recorded in a maintenance log.

Control gaps

Repeat faults are closed as complete without checking whether the cause was removed.

Additional controls

  • Prevent: Rank overdue tasks by safety and production risk and clear the highest ranked items first.
  • Recover: Keep critical spares on site and review each repeat fault to find the root cause.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Maintenance lead Target: Within 60 days Early warning: Planned maintenance tasks more than two weeks overdue on critical equipment.
H06

Electrical energy exposure during commissioning and maintenance

Safety Before 10 After 5

Stored or live electrical energy is not isolated before work on panels, drives or motors, so workers may receive an electric shock, arc flash or unexpected movement.

Who or what is affected: Electricians, maintenance staff and contractors

Causes

Skipped isolation steps, rushed fault finding and unclear labelling of stored energy.

Consequences

Serious electric shock, burns, arc flash injury or fatality.

Existing controls

  • Panels are labelled with their supply and isolation points.
  • Only authorized electricians open control cabinets.

Control gaps

Contractor permits are not checked against the isolation list before work starts.

Additional controls

  • Prevent: Require a written isolation procedure with lock and tag at every point before work starts.
  • Detect: Test for absence of voltage at the work point before any contact and record the result on the permit.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Electrical safety lead Target: Within 30 days Early warning: A work permit issued without a recorded isolation point and test result.
H07

Supplier obsolescence and support dependency

Supplier Before 9 After 4

A controller, drive or software licence is withdrawn or a supplier stops support, so spare parts, updates and technical help are no longer available when a fault occurs.

Who or what is affected: Production planners, maintenance staff and the supplier relationship

Causes

Product life cycles, supplier mergers and licences tied to a single vendor.

Consequences

Long outages, costly redesigns and reliance on one supplier.

Existing controls

  • Key equipment is listed with its supplier and model.
  • The supplier is asked for support terms at renewal.

Control gaps

Support end dates are not tracked against the replacement plan.

Additional controls

  • Prevent: Hold a register of obsolete parts with a supplier status check every six months.
  • Recover: Keep a tested backup of each program and a compatible spare module for critical controllers.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Procurement lead Target: Within 90 days Early warning: A supplier notice of end of life or reduced support for an installed model.
H08

Incomplete records and compliance gaps

Legal and compliance Before 6 After 4

Safety function records, test certificates, wiring drawings and change histories are missing or out of date, so the line cannot show that it meets its specified duties or local rules.

Who or what is affected: Plant managers, inspectors and auditors

Causes

Weak document control, changes made without updating records and staff turnover.

Consequences

Failed inspection, delayed restart, fines and difficulty tracing faults.

Existing controls

  • Drawings are stored in a shared document folder.
  • Test certificates are filed after each commissioning.

Control gaps

Drawings are not checked against the physical wiring after minor changes.

Additional controls

  • Prevent: Link every drawing revision to its change request and block release until the record is complete.
  • Detect: Review a sample of records each quarter against the installed equipment.
Likelihood 3 x impact 2 before; 2 x 2 after Owner: Compliance officer Target: Within 90 days Early warning: A drawing revision that is older than the last recorded change to the same panel.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Minor to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls, using the line as it would run with no added measures. Residual risk is the score after existing and added controls. Impact is judged on harm to people first, then equipment, product, environment and reputation. A risk with a severe impact is never rated down only because it has not happened yet. Anything still High needs plant management attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Operators, engineers and maintenance staff should challenge the ratings, and each risk is reviewed after any incident, near miss or change to the control system.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Program checksum differs from the approved version after a change window.Escalate to the control systems engineer at once, and stop the affected line until the approved version is confirmed.
Active force or bypass on a safety input without a signed permit.Escalate to the operations supervisor immediately, and to plant management if the bypass remains after the shift ends.
Controller login from an address or account not on the approved list.Escalate to the operational technology security lead at once, and isolate the device from the network until cleared.
Critical maintenance tasks more than two weeks overdue.Escalate to the maintenance lead when any critical task is overdue, and to plant management if it is still open after 30 days.
Permit issued without a recorded isolation point and test result.Escalate to the electrical safety lead before work starts, and stop the permit until the isolation is recorded.

Contingency arrangements

If a serious event occurs, such as an interlock bypass causing a hazardous state, a controller fault that moves equipment unexpectedly or a suspected network intrusion, the operations supervisor stops the affected section using the emergency stop and the safe state defined for the process. The control systems engineer isolates the affected controller from the network and restores the approved program from a tested backup after checking it. Specialist review is needed before restart, and plant management and the relevant authorities are informed as required by local rules.

Prioritized action plan

  1. Release all program changes only after a checked test against the written specification, owner control systems engineer, within 45 days.
  2. Remove software force functions from operator screens and require a signed permit for any bypass, owner operations supervisor, within 30 days.
  3. Require a written isolation procedure with lock and tag before electrical work, owner electrical safety lead, within 30 days.
  4. Replace shared logins with individual accounts and log all vendor sessions, owner operational technology security lead, within 45 days.
  5. Rank overdue maintenance by safety and production risk and build a critical spares list, owner maintenance lead, within 60 days.

Conclusion

Safe and reliable automation depends on a few steady habits: checked program releases, no unmanaged overrides, individual access, isolation before any electrical work, current records and planned maintenance. The highest scores sit with logic defects and interlock bypass, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified engineering and safety advice for any real plant decision.

Assumptions and limitations

Assumptions

  • The process is assumed to be a batch or continuous process with hazardous energy, pressure or heat, and the plant is not named.
  • Legal duties are described in general terms because the jurisdiction is not specified.
  • Operators are trained on the line, and engineers hold recognized qualifications for control work.

Limitations

  • The scores are examples for learning and do not describe any real plant or control system.
  • Safety functions, standards and electrical rules vary by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific hazard study or licensed engineering advice.

Related frameworks to study

  • Hierarchy of controls
  • Management of change process
  • Layers of protection concept
  • Lockout and tagout practice
  • Defence in depth for industrial networks

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Industrial Automation Control course Read the best practices for this course

More Technical risk assessments

Hourly Active: 35,661 Learners