Risk Assessment and Safety Engineering

Introduction

Electrical engineering involves hazards that may be immediate, such as electric shock and arc flash, or delayed, such as hearing loss, musculoskeletal injury, and fire caused by deteriorating equipment. Safe work therefore cannot depend only on personal caution or compliance with isolated rules. It requires a systematic process for identifying hazards, estimating and evaluating risk, selecting effective controls, authorising work, and verifying that controls remain effective.

Risk assessment is the disciplined examination of a task, system, or workplace to determine what could cause harm, how severe the consequences could be, how likely they are, and what measures are necessary to reduce risk. Safety engineering extends this process by applying design principles, reliability analysis, human-factors knowledge, protective systems, and organisational controls throughout the life cycle of electrical equipment.

A risk assessment is not a prediction of exactly what will happen. It is a reasoned decision process based on available evidence, engineering judgment, operating experience, and applicable law or standards. It must be reviewed when equipment, people, procedures, environmental conditions, or organisational arrangements change.

Learning Objectives

By the end of this chapter, students should be able to:

• distinguish hazards, risks, consequences, controls, and residual risk;
• conduct a preliminary hazard identification and a job safety analysis;
• apply qualitative and semi-quantitative risk matrices appropriately;
• select controls using the hierarchy of controls;
• explain bow-tie analysis, ALARP, FMEA, permit-to-work, and dynamic risk assessment;
• evaluate the limitations of risk models and the influence of human and organisational factors; and
• develop a defensible safety plan for electrical maintenance work.

1. Fundamental Concepts

A hazard is a source or situation with the potential to cause injury, ill health, property damage, environmental harm, or a combination of these. Examples include an energised conductor, stored energy in a capacitor, an inadequately supported cable, a confined space, or an unverified isolation.

Risk combines the likelihood of an unwanted event with the severity of its consequences. A hazard can exist without an incident; risk concerns the possibility that the hazard will interact with people, equipment, or the environment. An incident is an unplanned event, whether or not harm occurs. A near miss is an incident with no injury or damage but with credible potential for harm.

Important distinctions are:

• Inherent risk: risk before additional controls are applied.
• Residual risk: risk remaining after controls are applied.
• Acceptable risk: risk judged tolerable under defined criteria; it is not necessarily zero.
• Risk owner: the person or organisation accountable for ensuring that risk is controlled.
• Safety-critical control: a control whose failure could produce a serious or fatal outcome.

Risk assessment should consider the complete chain from initiating event to consequence. For example, an arc-flash event may require an insulation failure, a source of fault current, an exposed worker, and inadequate separation or protective equipment. Removing any essential link may prevent injury.

Electrical hazard categories

Electrical risk assessment must include non-electrical hazards because maintenance tasks occur in real workplaces rather than in an electrical-only environment.

2. The Risk Assessment Process

A robust assessment generally follows these steps:

1. Define the scope, task, equipment boundaries, and persons at risk.
2. Gather information: drawings, protection settings, maintenance history, incident data, operating instructions, and legal requirements.
3. Identify hazards and credible initiating events.
4. Determine potential consequences and affected people or assets.
5. Estimate likelihood and severity using a stated method.
6. Evaluate the risk against organisational and legal criteria.
7. Select controls, prioritising inherently safer solutions.
8. Record responsibilities, assumptions, and required actions.
9. Communicate the assessment and verify that controls are implemented.
10. Monitor, review, and revise the assessment when conditions change.

The assessment should be proportionate. A complex high-energy substation requires more detailed analysis than routine replacement of a low-voltage indicator lamp, although neither should be treated casually.

Risk estimation

A common qualitative or semi-quantitative model is:

where R is a risk score, S is a severity rating, and L is a likelihood rating. These ratings are usually ordinal categories, such as 1 to 5, not precise physical measurements. Consequently, multiplying them produces a prioritisation index rather than a probability of injury.

A more explicit representation is:

where P(E) is the probability of the hazardous event over a specified exposure period and C is the consequence measure. If P(E) is dimensionless and C is expressed as an expected loss, R has the same units as the consequence measure. This formulation is conceptually useful, but reliable numerical probabilities are rarely available for individual maintenance tasks.

A risk matrix must define its scales. For example, severity may range from first aid injury to multiple fatalities, while likelihood may range from rare to almost certain. The organisation must specify what scores require immediate cessation, additional authorisation, engineering review, or routine management.

Worked example: a semi-quantitative matrix

Suppose an assessment rates possible electric shock during testing as severity 5, because fatality is credible, and likelihood 3, because exposure is occasional despite existing controls. The score is:

If the organisation defines scores 10–25 as high risk, the task cannot proceed under routine arrangements. The result requires stronger controls, such as de-energisation, a test-for-dead procedure, restricted access, or a revised test method. The number 15 does not mean a 15% chance of death; it is an ordinal decision aid.

3. Hazard Identification and Job Safety Analysis

Hazard identification should use multiple sources rather than relying on memory. Useful methods include workplace inspection, task observation, equipment drawings, manufacturer information, incident and near-miss records, worker consultation, change-management reviews, and structured techniques such as What-if analysis, checklist analysis, and HAZOP.

A Job Safety Analysis (JSA) decomposes a task into logical steps, identifies hazards at each step, and specifies controls. It is especially effective for maintenance because it focuses on how work is actually performed.

A JSA should answer four questions for every step:

1. What is the task step?
2. What can go wrong?
3. What could cause harm, and to whom?
4. What controls are required before and during the step?

A JSA is not a substitute for engineering design or a permit-to-work system. It explains task controls, while the permit establishes formal authorisation and coordination.

4. The Hierarchy of Controls

The hierarchy of controls ranks controls by their usual reliability and independence from human action:

1. Elimination: remove the hazard, for example by carrying out work de-energised or eliminating an unnecessary exposed test point.
2. Substitution: replace a hazardous process or material with a less hazardous one, such as using lower-energy equipment where technically feasible.
3. Engineering controls: physically isolate people from hazards, including interlocks, barriers, enclosures, automatic disconnection, current limitation, remote operation, and arc-resistant equipment.
4. Administrative controls: change how work is organised through procedures, training, competency requirements, inspection, scheduling, supervision, and permits.
5. Personal protective equipment (PPE): protect the individual with insulated gloves, face shields, arc-rated clothing, eye protection, hearing protection, and safety footwear.

The lower levels are generally less reliable because they depend more heavily on people behaving as expected. PPE is essential in many electrical tasks, but it should not be used to justify avoidable exposure. For instance, arc-rated clothing does not make energised work automatically acceptable; it limits injury if other controls fail.

Controls should be specific and verifiable. “Take care” is not a control. “Install a lock on the supply isolator, attach an identification tag, and verify absence of voltage with a proved instrument” is a control with observable evidence.

5. Bow-Tie Analysis and Barrier Thinking

Bow-tie analysis connects causes, a top event, consequences, and barriers. On the left are threats that may lead to a top event; preventive barriers act before that event. On the right are consequences; mitigative barriers reduce harm after the event.

For an electrical isolation scenario:

• Threats: incomplete drawings, multiple supplies, backfeed, or incorrect identification.
• Top event: equipment believed to be isolated remains energised.
• Preventive barriers: isolation procedure, locked devices, identification, competent authorisation, and test-for-dead verification.
• Consequences: shock, arc flash, fall, serious injury, or fatality.
• Mitigative barriers: insulated tools, restricted approach boundaries, arc-rated PPE, emergency response, and rescue arrangements.

Barrier quality should be assessed. A barrier may be independent or dependent on the same failure cause as another barrier; it may be preventive or mitigative; and it may be physical, human, or procedural. A written instruction and a warning label are not equivalent to a physical isolation, because they do not prevent contact by themselves.

Bow-tie analysis is valuable for communicating safety-critical controls and assigning barrier owners. Its limitation is that it can oversimplify complex interactions and may imply that barriers are independent when they share common causes, such as poor maintenance or inadequate staffing.

6. ALARP and Risk Evaluation

ALARP means as low as reasonably practicable. It expresses the principle that risk should be reduced until further reduction is grossly disproportionate to the sacrifice required, considering safety benefits, cost, time, and technical feasibility. ALARP is not equivalent to “as cheap as possible,” and it does not permit ignoring a practicable control merely because the existing risk is numerically low.

The decision should consider:

• seriousness and scale of possible harm;
• number and vulnerability of exposed people;
• frequency and duration of exposure;
• available engineering solutions and good practice;
• uncertainty in the assessment;
• cost, disruption, and resources required for further reduction; and
• whether the proposed control is legally required.

Where consequences are potentially catastrophic, a high level of confidence is required. A weak argument based only on cost is not adequate. The duty holder should document why further measures are or are not reasonably practicable, identify residual uncertainty, and obtain competent review.

ALARP is a decision principle, not a substitute for compliance. Legal duties, electrical installation rules, occupational safety regulations, and company standards may prescribe minimum requirements regardless of a calculated score.

7. Failure Mode and Effects Analysis

FMEA is a structured, forward-looking method for examining how components or process steps can fail. For each failure mode, the team identifies effects, causes, existing controls, and recommended actions. Traditional FMEA uses ratings for severity, occurrence, and detectability.

Here S, O, and D are ordinal ratings, often from 1 to 10, for severity, occurrence, and detectability respectively. The Risk Priority Number (RPN) is a prioritisation aid, not a probability and not an absolute measure of safety.

Example:

The first two entries have equal RPNs but different safety implications. Therefore, teams should not rank solely by RPN. High-severity failures, single-point failures, common-cause failures, and failures of safety-critical functions require attention even when their numerical score is modest. Modern practice also uses action thresholds, criticality analysis, and explicit consideration of detectability rather than relying on one composite number.

8. Permit-to-Work Systems

A permit-to-work (PTW) is a formal control system that authorises specified work for a defined location, equipment boundary, time, and set of conditions. It is not merely a form. Its effectiveness depends on clear authority, communication, isolation, field verification, and controlled handover.

A typical electrical permit includes:

• exact equipment identification and work boundaries;
• task description and risk assessment reference;
• isolation points and lockout arrangements;
• method of proving dead and discharge or earthing requirements;
• hazards from adjacent energised equipment;
• required PPE, tools, barriers, and access controls;
• names and competencies of the issuer, receiver, and work party;
• start, suspension, extension, and expiry conditions; and
• restoration, inspection, removal of tools, and permit cancellation.

The issuer confirms that the system and conditions are ready. The receiver accepts responsibility for conducting the work within the stated limits. These roles should not be confused merely to accelerate a job. A permit does not transfer the employer’s legal responsibility, and it does not make an unsafe task safe by itself.

Permit systems must address simultaneous operations. For example, one team may be testing a feeder while another is working on a mechanically coupled motor. A permit coordinator should resolve conflicts, define plant status, and ensure that suspension or cancellation is communicated to every affected person.

9. Dynamic Risk Assessment

A planned assessment is based on expected conditions. A dynamic risk assessment is a deliberate reassessment immediately before and during work when conditions may change. It is essential in electrical environments affected by weather, operating demand, equipment status, temporary wiring, alarms, unfamiliar personnel, or unexpected test results.

A practical dynamic process is:

• Stop: pause when conditions differ from the plan.
• Look: identify new hazards, changed energy sources, and affected people.
• Assess: judge whether existing controls remain adequate.
• Control: add controls, change the method, or obtain additional authorisation.
• Communicate: brief the work party and relevant operators.
• Proceed or stop: continue only when risk is controlled; otherwise suspend and escalate.

Workers must have stop-work authority without fear of disciplinary action for raising a genuine safety concern. Dynamic assessment is not permission to bypass planning. It is a feedback mechanism that recognises uncertainty and changing conditions.

10. Applied Case: Replacement of a Low-Voltage Motor Feeder

The following is an illustrative case, not a report of a real incident.

Background

A manufacturing plant planned to replace a damaged 400 V motor feeder supplying a conveyor. The feeder was connected to a distribution board with a main incomer, an auxiliary control supply, and a standby generator capable of backfeeding selected circuits.

Problem

The original work plan listed “isolate motor and replace cable.” It did not identify the generator, control transformer, or induced voltage from adjacent conductors. The cable route also crossed an access passage used by production staff.

Analysis

A multidisciplinary team conducted a hazard identification and JSA. The credible top event was contact with a conductor that workers believed to be dead. Bow-tie analysis identified incomplete isolation and failure to test as key threats. The consequence could be fatal shock or arc flash. FMEA of the isolation process identified incorrect equipment identification as a high-severity failure mode.

The risk assessment found that administrative instructions alone were insufficient. The work required a PTW, lockout of normal and standby supplies, isolation of the control circuit, physical verification of the cable, and a documented test-for-dead procedure. The work area also required barriers and a temporary pedestrian diversion.

Approach and solution

The responsible electrical engineer approved a single-line diagram and marked all energy sources. An authorised person isolated the normal supply and generator output, applied personal locks and tags, and controlled the generator start function. The work party proved the voltage tester on a known live source, tested all relevant conductors and earth, and re-proved the tester. Where required by the governing rules, the isolated conductors were discharged and earthed.

The permit specified the exact cable, boundaries, tools, PPE, and restoration checks. Before reconnection, workers inspected terminations, verified phase identification, checked torque according to the manufacturer’s instructions, and removed tools and temporary earths under controlled conditions. Energisation was performed from a safe position with an exclusion zone. The motor was then tested for rotation, protection operation, emergency stopping, and abnormal heating.

Outcome

The feeder was replaced without injury. The assessment also identified a design improvement: a clearly labelled, lockable isolation point and generator interlock would reduce dependence on procedural controls in future work. The plant added the task to its maintenance learning system and revised drawings.

Learning points

• A task description is not a complete hazard analysis.
• Every possible energy source, including backfeed and stored energy, must be considered.
• Verification of isolation is a physical activity, not a paperwork exercise.
• Barriers should be selected according to the hierarchy of controls.
• Permit, JSA, and dynamic assessment have different but complementary functions.
• Design changes can provide more reliable long-term risk reduction than repeated reminders.

11. Limitations, Governance, and Contemporary Practice

Risk assessment contains uncertainty. Data may be incomplete, workers may normalise deviance, and rare catastrophic events may be underestimated because they have not occurred recently. Risk matrices can create false precision, encourage threshold gaming, and treat very different hazards as equivalent because they receive the same score. Organisations should therefore combine structured tools with competent judgment, worker participation, engineering review, and learning from near misses.

Safety governance requires traceable decisions. Assessments should have version control, defined ownership, review dates, and records of assumptions. Competence must include technical knowledge, practical ability, understanding of local rules, and recognition of personal limits. Contractors require coordination, not merely a request to sign a site induction.

Digital tools can improve access to drawings, inspection records, isolation registers, and control verification. Artificial intelligence may assist with document searching, anomaly detection, or identifying missing hazards in a draft assessment. However, AI-generated suggestions may be incomplete, based on incorrect data, or unable to recognise site-specific conditions. A competent person must validate outputs; AI must not issue permits, authorise energisation, or replace field verification unless a legally compliant and independently validated system explicitly permits such automation.

Best practice is characterised by visible leadership, strong reporting culture, effective maintenance, independent verification of critical controls, learning from weak signals, and continuous improvement. The objective is not to produce a high-scoring form. It is to prevent harm by making hazardous energy difficult to release and difficult to contact.

Chapter Summary

Risk assessment is a structured process for identifying hazards, evaluating risk, selecting controls, and verifying their effectiveness. Electrical assessments must address shock, arc flash, stored energy, backfeed, fire, and the wider workplace environment. Risk matrices can support prioritisation, but their scores are not probabilities and should not replace engineering judgment.

Job safety analysis links task steps to specific hazards and controls. The hierarchy of controls prioritises elimination, substitution, engineering controls, administrative controls, and PPE. Bow-tie analysis shows how preventive and mitigative barriers manage a top event. ALARP requires continued risk reduction unless further measures are grossly disproportionate, while still respecting legal requirements.

FMEA examines failure modes and effects, but RPN values should not obscure high-severity or common-cause failures. Permit-to-work systems provide formal authorisation and coordination, while dynamic risk assessment responds to changing conditions. Effective safety engineering combines technical design, competent people, reliable procedures, verification, governance, and a strong stop-work culture.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and consequence of harm.

Inherent risk: Risk before additional controls are applied.

Residual risk: Risk remaining after controls are applied.

Risk matrix: A table that combines severity and likelihood categories.

Job Safety Analysis: A task-based method for identifying hazards and controls.

Hierarchy of controls: Ranked approach for selecting risk controls.

Engineering control: A physical or technical measure that isolates people from hazards.

Administrative control: A rule, procedure, training measure, or organisational arrangement.

Personal protective equipment: Equipment worn to reduce exposure to a hazard.

Bow-tie analysis: A model linking threats, a top event, barriers, and consequences.

ALARP: As low as reasonably practicable.

FMEA: Failure Mode and Effects Analysis.

RPN: Risk Priority Number calculated from severity, occurrence, and detectability ratings.

Safety-critical control: A control whose failure could cause serious or fatal harm.

Permit-to-work: Formal authorisation for specified work under defined conditions.

Dynamic risk assessment: Reassessment of risk as work conditions change.

Backfeed: Unexpected energisation from an alternative source.

Residual energy: Energy remaining after normal supply isolation.

Risk owner: Person or organisation accountable for managing a risk.

Review Questions

Short Answer Questions

1. Distinguish a hazard from a risk and provide one electrical example of each.
2. Why is PPE placed below engineering controls in the hierarchy of controls?
3. What is the purpose of proving absence of voltage after isolation?
4. Define ALARP in the context of electrical safety.
5. State two limitations of a numerical risk matrix.

Long Answer Questions

1. Explain the complete risk assessment process for electrical maintenance, from scope definition to review.
2. Compare bow-tie analysis and FMEA, including the type of information each method provides.
3. Describe the roles, contents, and limitations of a permit-to-work system.
4. Explain how the hierarchy of controls should be applied to an arc-flash hazard.
5. Discuss how human and organisational factors can undermine technically sound safety controls.

Analytical / Application Questions

1. A maintenance team proposes to work on a 400 V panel using insulated gloves and a warning sign but without isolation. Analyse the proposal using the hierarchy of controls and recommend a safer method.
2. A task has severity rating 4 and likelihood rating 3 on a matrix where scores of 10 or more require additional controls. Calculate the score, explain what it means, and identify why the result is not a 12% probability of injury.
3. Develop a bow-tie outline for unexpected motor start-up during maintenance, identifying at least three threats, three preventive barriers, two consequences, and two mitigative barriers.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a hazard from a risk?

A. A hazard is a source of potential harm; risk considers likelihood and consequence.

B. A hazard is always an incident; risk is always a legal requirement.

C. A hazard is PPE; risk is the training needed to use it.

D. A hazard exists only after injury has occurred; risk exists only before work begins.

Correct Answer: A. A hazard is a source of potential harm; risk considers likelihood and consequence.

Question 2

A risk matrix assigns severity 5 and likelihood 3 to a task. Using R = S × L, what is the risk score?

A. 8

B. 15

C. 25

D. 53

Correct Answer: B. 15

Question 3

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Elimination

D. Warning label

Correct Answer: C. Elimination

Question 4

In a bow-tie analysis, preventive barriers are located:

A. After the consequences

B. Between threats and the top event

C. Only inside emergency response plans

D. After recovery is complete

Correct Answer: B. Between threats and the top event

Question 5

What is the principal purpose of a permit-to-work system?

A. To replace all technical risk assessments

B. To provide formal authorisation and coordination under defined conditions

C. To guarantee that an incident is impossible

D. To transfer legal responsibility to the worker

Correct Answer: B. To provide formal authorisation and coordination under defined conditions

Question 6

Which action is most characteristic of dynamic risk assessment?

A. Ignoring conditions that differ from the original plan

B. Continuing because a permit has already been signed

C. Stopping and reassessing when site conditions change

D. Removing all administrative controls

Correct Answer: C. Stopping and reassessing when site conditions change

Question 7

If an FMEA assigns S = 8, O = 3, and D = 6, what is the RPN?

A. 17

B. 48

C. 144

D. 864

Correct Answer: C. 144

Question 8

Why should RPN not be used as the only basis for safety decisions?

A. It cannot be calculated using ratings

B. Equal RPNs can represent different safety priorities and ordinal ratings are not probabilities

C. It applies only to financial systems

D. It always overestimates low-severity failures

Correct Answer: B. Equal RPNs can represent different safety priorities and ordinal ratings are not probabilities

Question 9

Which is an example of backfeed?

A. A correctly labelled cable tray

B. Unexpected energisation from a generator or alternative supply

C. A protective relay operating correctly

D. A discharged capacitor with verified zero voltage

Correct Answer: B. Unexpected energisation from a generator or alternative supply

Question 10

What does ALARP require?

A. Reducing risk only when the cheapest option is available

B. Accepting any risk below a matrix threshold

C. Reducing risk until further reduction is grossly disproportionate, while meeting legal duties

D. Using PPE instead of engineering controls

Correct Answer: C. Reducing risk until further reduction is grossly disproportionate, while meeting legal duties