Share this article
Continue reading with these related posts
Every automation project looks cleaner in the proposal than it does on the shop floor. This is the honest version: the cobot cell we built for a digital print shop, what drove our design decisions, where reality diverged from the plan, and what we measured when it was all running.
One of the most overlooked costs in automation is the ongoing human cost of keeping it running. This post helps you assess your team's current capabilities, identify the training paths that actually work, build a preventive maintenance programme, and decide when a support contract is worth the money.
Not every robot is the right robot. Learn how collaborative robots and traditional industrial robots differ in safety requirements, flexibility, programming complexity, and total cost — so you can choose the technology that actually fits your operation.
In the previous post, we tackled how to connect robots to existing equipment — communication protocols, PLCs, and the timing challenges of getting everything to work together. Now we turn to a topic that too many manufacturers treat as an afterthought: keeping people safe when robots are in the picture.
Industrial robots are remarkably powerful machines. A mid-sized collaborative robot can exert several hundred newtons of force at its end effector; a traditional six-axis arm can fling a component across a room if something goes wrong. OSHA estimates that robot-related incidents cost U.S. manufacturers hundreds of millions of dollars annually, and the majority of those incidents involve inadequate safeguarding rather than equipment failure. The machines work exactly as designed — the problem is that nobody anticipated a technician reaching into the wrong place at the wrong time.
The good news is that safety engineering for automated cells is a well-solved problem. There are international standards, proven hardware solutions, and systematic methodologies that, when applied correctly, virtually eliminate the risk of serious injury. This post walks you through the full picture: risk assessment methodology, physical safeguards, safety-rated controls, emergency stop requirements, and the documentation you need to demonstrate compliance.
What Is a Risk Assessment
A formal risk assessment is a structured process for identifying hazards, estimating the likelihood and severity of potential harm, and selecting proportionate risk reduction measures. ISO 12100 is the international standard that defines this process for machinery, including robotic manufacturing cells. It is referenced by regulators in Canada, the United States, and the European Union.
Safety in automated cells is not just a moral obligation — it is a legal one. In Canada, provincial occupational health and safety regulations require that machinery be guarded to protect workers from mechanical hazards. In the United States, OSHA's general industry standards apply. If you sell equipment into Europe, the EU Machinery Directive mandates a CE mark backed by a documented risk assessment before the machine is placed on the market.
Beyond regulation, there is a very practical business case. An unguarded robot that injures a worker will shut down your facility while investigators arrive, increase your insurance premiums, and potentially expose you to fines or litigation. The cost of retrofitting safety after the fact is almost always significantly higher than designing it in from the start — and retrofits rarely achieve the same level of protection because the layout constraints work against you.
The most common mistake we see is treating safety as a checklist item completed at the end of the project, after the mechanical design is finalised and the electrical cabinet is wired. By that point, the cell footprint is fixed, cable routing is done, and adding a proper safety fence means reworking weeks of work. The right approach is to run the risk assessment in parallel with concept design, so that safeguarding requirements shape the cell layout rather than fighting against it.
Never Design Safety In at the End
Retrofitting guarding onto a completed cell design typically costs two to five times more than integrating it from the start. Begin your risk assessment during the concept phase, before dimensions are finalised and component locations are locked in.
ISO 12100 — "Safety of Machinery: General Principles for Design" — is the foundational standard for machinery risk assessment worldwide. It provides a three-step iterative process: identify hazards, estimate risk, and reduce risk. You repeat the loop until the residual risk is acceptable.
Begin by listing every hazard your cell presents. ISO 12100 organises them into categories:
For each hazard, estimate risk using two factors: the severity of potential harm (from minor bruising to fatality or permanent disability) and the probability of occurrence (accounting for how frequently workers are exposed, how reliable the safeguards are, and whether the person can reasonably avoid the hazard once it begins). Most practitioners use a 3×3 or 4×4 risk matrix to score each hazard and prioritise where to focus design effort.
ISO 12100 explicitly asks you to consider all phases of the machine lifecycle: normal operation, maintenance, tooling changeover, fault recovery, cleaning, and decommissioning. Maintenance injuries are disproportionately common because technicians often need to enter the cell or defeat guards to access equipment — which is precisely why lockout/tagout procedures are so critical, and why maintenance access must be designed in from the beginning.
ISO 12100 defines a three-level hierarchy for risk reduction, sometimes called the "3-step method":
Inherently safe design. Eliminate the hazard at its source — use a lower payload robot for a lighter-duty task, reduce operating speed, or choose a cobot that power-and-force-limits on contact. This is always the first preference because no safeguard can fail if the hazard no longer exists.
Safeguarding and protective devices. If the hazard cannot be eliminated, contain it or detect intrusion into the hazard zone. This is the domain of perimeter fencing, light curtains, safety laser scanners, and interlocked access doors.
Information for use. Warning signs, operating procedures, training, and personal protective equipment. This is your last line of defence, not your first — it relies on people behaving correctly every single time, which is an unreliable assumption.
Most real-world cells use all three levels in combination. The residual risk that remains after applying all measures is documented, reviewed, and formally accepted by the machine owner or operator.
Physical safeguards are the tangible barriers and detection devices that prevent people from entering hazardous zones or detect their presence when they do.
Hard guarding (perimeter fencing) is the most robust option. Welded steel panels with mesh infill, mounted on a structural frame, physically prevent entry except through controlled access points. The minimum mesh opening size is governed by the distance from the nearest hazard — closer distances require smaller openings to prevent reaching through the mesh. Exact requirements are found in ISO 13857 (Safety distances). Access doors must be interlocked: the robot must reach a safe state before the door can open, and it must not restart until the door is closed and the operator performs a deliberate reset action outside the cell.
Light curtains are arrays of photoelectric beams that detect when a person or object crosses the plane of the hazard zone. They are ideal for loading and unloading stations where an operator regularly needs access — instead of opening a gate, the operator reaches into the detection field, the robot pauses, they load or unload the part, withdraw their hands, and the cycle resumes automatically. Light curtains come in Type 2 (lower reliability, for minor injury risk) and Type 4 (highest reliability, for serious injury risk) classifications per IEC 61496. Use Type 4 for any application where contact with the robot could cause serious harm.
Safety laser scanners use a rotating laser beam to define a two-dimensional detection field in the horizontal plane. Unlike light curtains, which detect a single plane, scanners can define configurable zones: a warning zone that slows the robot and a protective stop zone that halts it. They work well in larger cells or where operators approach from multiple directions.
Safety mats are pressure-sensitive floor pads placed around hazardous equipment. Stepping on the mat triggers a protective stop. They are simple and reliable but require regular inspection for wear, and they can be defeated by bridging — so they are rarely used as the sole safeguard for serious hazards.
Zone Your Cell for Maximum Uptime
Design your cell with multiple zones rather than a single large safe area. A scanner with separate warning and stop zones, or a physical barrier that divides the robot workspace from the loading station, allows the robot to continue operating in one area while a human works safely in the other. This dramatically reduces the cycle time penalty for manual interventions.
A standard PLC controls your process logic. A safety PLC — also called a safety controller or failsafe controller — monitors and enforces safety functions. The distinction is critical: standard PLCs are not designed to be fault-tolerant, and a single internal fault could cause them to output the wrong signal without any indication that something is wrong.
Safety PLCs are certified to IEC 62061 (Safety Integrity Level, or SIL) or ISO 13849 (Performance Level, or PL) standards. These standards quantify how likely the safety function is to fail in a dangerous manner. For most robot cell applications, target SIL 2 or PL d for primary safety functions: emergency stop, guard door monitoring, and light curtain inputs.
What makes a safety PLC different from a standard one?
Safety relays are a simpler, lower-cost alternative for straightforward applications. A standard safety relay module accepts dual-channel inputs from an e-stop button or guard switch and provides a supervised output to a motor contactor. They are reliable and easy to understand, but they lack the flexibility of a full safety PLC when your cell has multiple zones, configurable safety functions, or complex interdependencies.
The robot's own controller already has certified safety I/O — use it. Most modern industrial robots and cobots provide safety-rated inputs for emergency stop, protective stop, and speed/zone reduction. Always connect your cell's safety system to these dedicated inputs rather than attempting to implement safety logic through a standard digital output to the robot's run-enable signal.
Emergency stops (e-stops) are manually operated devices that bring the machine to a safe state as quickly as possible. IEC 60204-1 defines three stop categories:
Most robot cells use Category 1 for primary e-stops. E-stop devices must be located at every operator station, at each access door, and at any point where a worker could become isolated from the main control panel. They must use red mushroom-head push buttons on a yellow background, per ISO 13850, and they must not self-reset — a deliberate action is required to resume operation after an e-stop.
Lockout/tagout (LOTO) is the procedure used to ensure that equipment is fully de-energised and cannot be restarted before a worker performs maintenance, tooling changes, or fault investigation. LOTO applies not just to electrical energy but to all stored energy: pneumatic pressure in cylinders and air lines, hydraulic pressure, gravitational potential energy from suspended loads, and stored spring forces in mechanisms.
A proper LOTO programme includes:
LOTO Is Not Optional
Lockout/tagout violations are among the most frequently cited OSHA violations in manufacturing, and they result in some of the most severe injuries. Never allow a worker to enter a robot cell for any reason — including a brief inspection — without completing the full lockout/tagout procedure.
A risk assessment is only useful if it is documented, maintained, and accessible. Your safety file should include:
If you are supplying a machine to a customer in Canada or the United States, retain this documentation for the lifetime of the machine. If CE marking for the EU market is required, the Technical File containing the risk assessment is a legal prerequisite before the CE mark can be affixed.
Use the Robot Manufacturer's Safety Manual
Every major robot OEM publishes a detailed safety manual for their product that includes recommended wiring diagrams, safety I/O descriptions, stopping performance data, and guidance on configuring the built-in safety functions. Read it during the design phase. The stopping time data in particular is essential for calculating correct safety distances.
A few principles that have served us well across many automation projects:
Safety Designed In Is Safety That Works
A thorough risk assessment, layered physical safeguards, certified safety hardware, proper LOTO procedures, and complete documentation together create a cell that genuinely protects your people. When safety is designed in from the start rather than bolted on at the end, it does not slow you down — it is simply part of how the cell operates.
We have now covered the safety systems that protect your people when the robot is running. In the next post, Programming and Maintenance: What You Need In-House, we shift focus to the human side of the equation: what skills your team needs to program, troubleshoot, and maintain your automated cell on a daily basis, and how to build those capabilities without becoming permanently dependent on expensive vendor service contracts.
