Brazilian NR-12 follows machinery through its use phase, including operation, cleaning, adjustment, inspection, maintenance, repair, decommissioning, and dismantling. Safety therefore cannot be treated as a purchasing requirement that remains correct forever. A removed guard, a replaced sensor, a software change, a new product, or an improvised access can alter risk after commissioning.
Official Brazilian Ministry of Labor and Employment sources were consulted on August 23, 2026. NR-12 is a Brazilian regulatory standard and does not establish obligations outside Brazil. Other jurisdictions require their own laws, regulators, standards, employer procedures, and accountable professionals. Every real machine requires its own risk assessment, safeguarding design, technical records, training, procedures, authorization, and compliance decisions.
Maintenance belongs to the machinery life cycle
Planning starts with the machine, process, risk assessment, safeguarding design, manufacturer information, and current field condition. A generic preventive operation cannot determine a safety category, stopping distance, diagnostic coverage, or acceptable access. Those decisions require competent engineering and the applicable technical basis.
The maintenance team needs to know which components affect a safety function, which interventions require a legally qualified professional, what documentation must accompany the job, and which findings make the machine unavailable. Production demand must not convert a safety defect into a lower priority notification.
Changes deserve the same discipline. Replacing a component by a physically similar item, bypassing an input during diagnosis, or changing controller logic may alter the designed performance. The work package must show when engineering approval and validation are prerequisites.
Guards, interlocks, and emergency stops have different functions
A fixed guard creates a barrier whose removal requires tools or permanent fastening. A movable guard is associated with interlocking when access is needed. Depending on risk and the time until hazardous movement ceases, guard locking may be necessary. Closing a guard generally must not become an unintended start command.
An emergency stop is intended for emergency conditions. It does not replace suitable safeguarding, isolate all energy sources, or create a normal maintenance condition. A stopped indication on a PLC or HMI likewise does not prove that hazardous movement or stored energy has disappeared.
Loss and restoration of power must not create unexpected hazardous operation. Manual reset, visibility of the zone, prevention of a person remaining inside, and start conditions depend on the assessment and design. Moving a reset button for convenience can invalidate the intended function.
Maintenance records support technical decisions
NR-12 requires maintenance in the form and frequency defined by the manufacturer or by competent professionals as applicable. Records may be maintained in an internal computerized system and need useful details: intervention, date, service, repaired or replaced parts, safety conditions, conclusion on safe condition, and responsible person.
Items that influence safety require a preventive schedule. Predictive maintenance needs the analysis technique and supervision means to be described. A confirmation reading “completed” cannot replace the observed state of an interlock, brake, light curtain, valve, or other safety related component.
When a defect compromises safety, repair or replacement must preserve safe characteristics and conditions. Equivalence involves performance and compatibility, not only dimensions or connector shape. Procurement and stores therefore share a control point with engineering and maintenance.
Intervention requires isolation and authorized people
For covered interventions, the current wording addresses trained, qualified, or legally qualified professionals who are formally authorized, machine stoppage, isolation and discharge of energy sources, mechanical and electrical locking of cut off devices, signaling, and control of downstream energy. Hydraulic, pneumatic, raised, articulated, or gravity loaded parts may require additional retention.
Pressing an emergency stop or opening the main disconnect does not control every source. Electrical, pneumatic, hydraulic, thermal, gravitational, mechanical, and process energy can remain or return. The approved procedure identifies each source, point, control method, verification, and restoration.
The lockout and tagout article covers multienergy governance. NR-12 remains the Brazilian reference for machine specific requirements within its scope.
Special modes do not legitimize routine bypasses
NR-12 includes narrowly defined conditions for selected operating modes when normal conditions cannot be met and access to a danger zone is necessary. Requirements can include disabling automatic operation, hold to run control, reduced speed or limited movement, prevention of unauthorized mode changes, priority over other modes, and clear indication.
Another provision addresses certain situations that offer no risk, do not reduce the safety level, and do not require danger zone access under supervision. There is also specific treatment for technical impossibility caused by thermal inertia under management by a legally qualified professional.
These conditions are not shortcuts. Frequent troubleshooting, a short intervention, or production pressure does not create an exception. Engineering must establish whether the case fits the official conditions and how safety performance is preserved.
Roles in the maintenance cycle
| Role | Decision | Evidence |
|---|---|---|
| Engineering or technical lead | Defines assessment, architecture, change, equivalence, and acceptance criteria | Controlled analysis, design, and specification |
| Maintenance planning | Organizes plan, window, resources, documents, and dependencies | Plan and order linked to the machine |
| Maintenance execution | Works within the approved scope of competence and authorization and stops when conditions deviate | Intervention and safe condition records |
| Operations | Coordinates stop, process state, area, test, and return | Traceable operational release |
| Occupational safety | Integrates hazards, controls, and training with risk management | Applicable records and oversight |
| Procurement and stores | Preserve specifications and traceability | Approved and compatible material |
A complete order shows who decides without transferring technical responsibility to the planner or turning the technician into a designer.
Industrial case: PR-220 press with an interlock fault
Independent teaching scenario: press PR-220 has an intermittent alarm in the movable-guard interlock circuit. During controlled preparation, position indication fails to follow opening in some cycles. The machine remains unavailable, with no jumper, improvised block, or schedule-driven release. The asset, counts, and results do not represent a client, regulatory limit, or PM Run result.
Triage and unavailable condition
The SAP notification records the alarm, mode, moment, and observed condition. The diagnostic order remains separate from a possible replacement. Engineering defines a protocol under controlled conditions, with isolation, the specified test mode, protected area, and authorized people. Before repair, the protocol reproduces incorrect indication in 3 of 20 cycles. This denominator belongs to the case and does not authorize exposure to hazardous motion.
Master data, schematic, device model, actuator, mounting, cable, logic, and history are compared. The fault is localized to the sensor and actuator assembly. A warehouse part looks similar but has a different code and electrical characteristic. Replacement remains blocked until the approved specification reaches the package.
Completed decision map
| Point | Evidence | Decision |
|---|---|---|
| May the machine produce? | 3 failures in 20 controlled cycles | Keep it unavailable |
| Does emergency stop resolve the fault? | It performs a different function | Do not use it as a substitute |
| Will a similar component work? | Code and characteristic differ | Use only the approved specification |
| Is bypass needed for diagnosis? | The protocol permits testing without exposing people | Prohibit an operational jumper |
| Who accepts return? | Engineering and accountable roles define criteria | Require every verification to be completed and accepted |
Execution and didactic Engineering criteria
The crew isolates, confirms the safe state, replaces the approved assembly, restores mounting and cable, and verifies configuration. The criteria below were defined by accountable Engineering only for the didactic PR-220. They are not a universal NR-12 frequency, cycle count, or limit.
| Case verification | Executed sample | Result |
|---|---|---|
| Opening the guard interrupts the hazardous condition and inhibits a new start | 20/20 cycles | Accepted |
| A reset attempt with the guard open cannot start a cycle | 10/10 attempts | Accepted |
| Diagnostic indications match the expected state | 20/20 cycles | Accepted |
| Identification, characteristic, wiring, and configuration | 4/4 checks | Matched the approved document |
The controlled test preserves barriers and exposes no person to the hazard zone. Engineering and Operations accept return only after all 54 recorded verifications, counted as 20 + 10 + 20 + 4 checks. Labor confirmation alone cannot close this hold point.
Day 30 and Day 90 reviews
| Window | Observed exposure | Scheduled verification | Decision |
|---|---|---|---|
| Day 30 | 4,800 operating cycles, 0 repeated alarm | 1/1 verification accepted | Retain the task and continue monitoring |
| Day 90 | 14,600 cumulative cycles, 0 repeated alarm | 3/3 cumulative verifications accepted, including Day 30 | Retain the case-defined plan |
The decision uses executed checks, component traceability, and cycle history. The absence of an alarm by itself does not prove integrity of the safety function. A new alarm, failed check, or change to component, logic, guard, or configuration makes the machine unavailable and reopens the notification, Engineering assessment, and order. The interval remains installation-specific and does not become a rule for another machine.
SAP PM preserves the symptom, cause, component, configuration, cycles, tests, and decision. PM Run supports planning, mobility, and execution over SAP PM without automatically validating the safety function, defining criteria, or authorizing return.
Safe passage from finding to history
- Notification: capture symptom and condition without inventing a cause.
- Triage: identify impact on a safety function and decide availability.
- Order: link machine, scope, people, documents, parts, and dependencies.
- Isolation: apply and verify physical controls through the procedure.
- Repair: execute approved work and stop on differences.
- Test: validate defined criteria in a controlled stage.
- Return: restore safeguards and complete accountable releases.
- Learning: update drawings, master data, plan, spare, and assessment as needed.
The maintenance work order preserves this connection. A maintenance checklist can support consistency without replacing machine specific criteria.
Evidence oriented audit
- Does the inventory link each machine to current documents?
- Do assessment and diagrams reflect completed changes?
- Are safety related components specified and traceable?
- Do preventive safety items have a schedule?
- Do predictive tasks state technique and supervision?
- Do records include safety condition and conclusion?
- Are competence and authorization demonstrable?
- Do special modes have technical justification and control?
- Are functional tests planned to prevent exposure?
- Do repeated defects return to engineering and the plan?
Useful indicators include overdue safety findings, jobs missing controlled documents, unapproved substitutions, repeated faults, and time between detection and controlled condition. A high volume of completed orders does not demonstrate safeguarding integrity.
Change control and configuration evidence
A machine can remain productive after a modification while losing part of its safeguarding performance. Software, stopping time, sensor position, tool mass, speed, material, feeding device, and access changes can alter risk assessment assumptions. Change control brings engineering, operations, maintenance, and occupational safety together before release.
The validation package defines functions, test conditions, instruments, acceptance criteria, responsible people, and records. Testing avoids exposing a person merely to observe a hazardous response. Simulations, controlled modes, and measurement methods are selected by the accountable technical function. A result outside criteria keeps the machine unavailable.
SAP PM can reference component serial number, program version, approved drawing, and configuration. Confirmation preserves what was installed and tested. Spare part data should prevent a generic description from becoming automatic equivalence. Obsolescence needs an engineered decision with procurement before shutdown.
Preparing recurring machine work
Recurrence allows a procedure to improve without removing field verification. A plan can carry isolation points, retention, sequence, tools, competence, and return criteria. Before each execution, the team confirms that machine, configuration, and environment match the basis. A modification, different tool, or damaged guard invalidates automatic repetition.
History should distinguish component failure, alignment, contamination, wiring, logic, vibration, and operating use. Increasing frequency without this classification may consume downtime without addressing the mechanism. Reliability proposes action and engineering decides any effect on the safety function.
Official sources, date, and limits
- Brazilian Ministry of Labor and Employment, official NR-12 page, consulted August 23, 2026.
- Current NR-12 wording provided by MTE, consulted on the same date.
- Official NR-12 application manual, supporting MTE publication.
- Official NR-1 page.
The technical decision must confirm current wording, applicability, manufacturer requirements, referenced standards, and local machine conditions in official and controlled sources. Protected standards are not reproduced.
Frequently asked questions
Does NR-12 apply only to new machinery?
No. The Brazilian wording addresses new and used machinery except where a specific provision says otherwise.
Does an emergency stop allow maintenance?
No. It does not replace stoppage, isolation, control of residual energy, retention, and verification required for the intervention.
Can a similar part replace a safety component?
Only after competent evaluation confirms the required characteristics and safe conditions.
Can the maintenance record be digital?
The current wording allows an internal computerized system when required information is maintained and available to the stated parties.
Does PM Run guarantee NR-12 compliance?
No. It supports planning, mobility, execution, and SAP PM records. Compliance depends on the machine, assessment, design, controls, people, and organization.
After responsible teams define the controls, see how PM Run connects planning and field execution to SAP PM.
