Robot cell safety and the design review

Six months after the project began, Baywind presents the finished design of cell BC-1 for review before it is built in their shop. Around the table are Owen and Farah, who will seal Tidewater's acceptance; Gilles, who will maintain the controls; Lucie, who owns the balancing process; Marco Rossi, the quality manager; Denise Cormier from the impeller shop, who will work beside the cell every day; and Simone with her lead programr. The agenda has three parts: the safety case, the verification of the requirements from Lesson 1, and the business case. This lesson follows the review and uses it to draw the course together.

Robot hazards

Industrial robots are fast, strong and, to a person standing near them, unpredictable: a robot paused waiting for a signal can move suddenly when the signal arrives, and it can sweep through any point within its reach. Investigations of robot accidents in many countries show a consistent pattern. Most do not happen during normal production but during programming, maintenance, setup and clearing jams, when people are inside the safeguarded space and the usual protections are bypassed or misunderstood. The robot safety standards were written with that pattern in mind.

The standards

Machine safety rests on a hierarchy of standards. ISO 12100 sets out the general method: identify hazards, estimate and evaluate risks, and reduce them in order of preference by inherently safe design, then by safeguarding and complementary protective measures, then by information for use such as warning signs and training. ISO 10218 is the robot-specific standard; Part 1 covers the robot itself, which the robot maker is responsible for, and Part 2 covers robot applications and cells, which the integrator is responsible for. Its 2025 revision reorganized both parts, absorbed the earlier technical specification on collaborative operation, ISO/TS 15066, into Part 2, and now speaks of collaborative applications rather than collaborative robots, because whether an application is safe for people to share depends on the task, the tool and the part as much as on the robot.

Nationally, ANSI/A3 R15.06-2025, the US adoption of ISO 10218-1 and -2:2025, published in 2025, is the robot safety standard that regulators and customers refer to here, and machine safeguarding more generally follows the ANSI B11 series of machine safety standards. The legal duty to protect workers comes from OSHA's general industry standards in 29 CFR 1910, enforced by OSHA. Standards are not all mandatory in themselves, but they define the recognized good practice against which an employer's or integrator's diligence is judged after an incident, and contracts commonly require compliance with them. ISO 13849-1 governs the design of the safety-related parts of the control system, such as the light curtain, the door interlock and their logic, and ISO 13855 and 13857 set safety distances and reach.

Risk assessment

Baywind's risk assessment lists every task a person does at the cell, from loading trays to changing grippers and clearing jams, and every hazard in each task. Each hazard is scored for the severity of the possible harm and the probability of harm, considering how often a person is exposed, the probability of the hazardous event and whether it could be avoided. The program uses a simple severity-times-likelihood score to rank six of the hazards before and after protective measures. The highest, a person struck by R1 after entering the cell and a hand caught in the infeed pallet lifter, each score 12 before protection and 3 or 4 after. Scoring schemes vary, and the numbers carry less meaning than the discipline of considering every task and recording why each measure was chosen. Denise's contribution here is invaluable: she knows that the jam the integrator imagines operators clearing from outside the fence is, in practice, cleared by reaching in, unless the cell is designed so that reaching in is never necessary.

Safeguarding

BC-1 uses a perimeter guard 2.0 m high with mesh small enough, at its distance from the hazards, to prevent reaching through, sized from the tables of ISO 13857. Entry for maintenance is through door D1, whose interlock switch is monitored by the safety controller; opening it stops all hazardous motion and, through the soft-start dump valve of Lesson 4, exhausts the air to the clamps and press. The interlock's guard locking holds the door shut until the robot and the drill spindle have come to rest. Each person entering applies a personal lock to the door's lockout point for maintenance, and the lockout procedure, following OSHA's lockout/tagout standard, 29 CFR 1910.147, lists the electrical, pneumatic and gravity energy sources that must be isolated.

At the load station, where the operator places trays of castings on the infeed while the cell runs, a light curtain detects a hand crossing into the hazard zone and stops the pallet lifter and R1's motion in the pick zone. The safety function is only effective if the curtain is far enough from the hazard that the hazard stops before the hand arrives. ISO 13855 gives the minimum distance as

where K is the approach speed of the body part, 2,000 mm/s for a hand, T the total time from detection to the hazard ceasing, and C an intrusion allowance that depends on the curtain's resolution d; for a curtain that detects a hand, \(C = 8(d - 14)\) mm. If S calculated with K = 2,000 mm/s exceeds 500 mm, it may be recalculated with K = 1,600 mm/s, but not below 500 mm.

# Cell BC-1 design review: light-curtain safety distance, a simple risk ranking, and the business case
import math

# 1. Minimum distance of the operator load-station light curtain from the hazard (ISO 13855 form S = K T + C)
d = 30                         # curtain resolution, mm (detects a hand)
T = 0.012 + 0.025 + 0.200      # curtain response + safety PLC + stopping time of the pallet lifter and robot R1 (s)
C = 8 * (d - 14)
for K in (2000, 1600):
    S = K * T + C
    print(f"K = {K} mm/s: S = {K} x {T:.3f} + {C} = {S:.0f} mm")
S2000 = 2000 * T + C
print("Rule: use K = 2000 mm/s; if S comes out above 500 mm, recalculate with K = 1600 mm/s, minimum 500 mm.")
S = S2000 if S2000 <= 500 else max(500, 1600 * T + C)
print(f"Required distance {S:.0f} mm; the layout allows 600 mm  ->  {'acceptable' if S <= 600 else 'move the curtain'}")
T_slow = 0.012 + 0.025 + 0.320                 # if the lifter brake wears and stopping time rises to 0.32 s
S_slow = max(500, 1600 * T_slow + C) if 2000 * T_slow + C > 500 else 2000 * T_slow + C
print(f"With a worn brake (0.32 s): {S_slow:.0f} mm  ->  stopping-time monitoring is needed")

# 2. Risk ranking: severity (1-4) x likelihood of the hazardous event (1-5), before and after protective measures
hazards = [("robot R1 strikes person entering cell", 4, 3, 1), ("hand in infeed pallet lifter pinch point", 3, 4, 1),
           ("impeller dropped from gripper", 3, 2, 1), ("drill spindle entanglement", 4, 2, 1),
           ("compressed air release on maintenance", 2, 3, 2), ("SCARA R2 contact at seal nest", 2, 3, 2)]
for name, sev, lik, lik_after in sorted(hazards, key=lambda h: -h[1] * h[2]):
    print(f"  {name:40s} risk {sev*lik:2d} -> {sev*lik_after:2d}")

# 3. Business case: manual balancing versus the cell (illustrative figures, dollars)
labor_saved = 2 * 1800 * 2 * 38.0             # two operators per shift, two shifts, 1,800 h each, loaded rate
scrap_saved = 300 * 2 * 250 * 0.004 * 140.0    # scrap rate falls 0.4 points on 150,000 impellers a year
upkeep = 32_000.0
capital = 690_000.0
annual = labor_saved + scrap_saved - upkeep
print(f"Annual net saving {annual:,.0f}; simple payback {capital/annual:.1f} years")
r, n = 0.08, 10
npv = -capital + sum(annual / (1 + r)**k for k in range(1, n + 1))
print(f"Net present value over {n} years at {100*r:.0f} %: {npv:,.0f}")

K = 2000 mm/s: S = 2000 x 0.237 + 128 = 602 mm
K = 1600 mm/s: S = 1600 x 0.237 + 128 = 507 mm
Rule: use K = 2000 mm/s; if S comes out above 500 mm, recalculate with K = 1600 mm/s, minimum 500 mm.
Required distance 507 mm; the layout allows 600 mm  ->  acceptable
With a worn brake (0.32 s): 699 mm  ->  stopping-time monitoring is needed
  robot R1 strikes person entering cell    risk 12 ->  4
  hand in infeed pallet lifter pinch point risk 12 ->  3
  drill spindle entanglement               risk  8 ->  4
  impeller dropped from gripper            risk  6 ->  3
  compressed air release on maintenance    risk  6 ->  4
  SCARA R2 contact at seal nest            risk  6 ->  4
Annual net saving 325,600; simple payback 2.1 years
Net present value over 10 years at 8 %: 1,494,803

The curtain responds in 12 ms, the safety controller in 25 ms, and the pallet lifter and R1 stop in 200 ms, so T = 0.237 s. With a 30 mm curtain, C = 128 mm. With K = 2,000 mm/s, S = 602 mm, more than 500 mm, so the recalculation with 1,600 mm/s applies and gives 507 mm. The layout provides 600 mm, which is acceptable. The final line of the program shows why the result must be protected over the cell's life: if the lifter's brake wears and its stopping time rises to 0.32 s, the required distance becomes 699 mm and the guard no longer protects. Owen's review comment, accepted by Baywind, is that the stopping time must be measured at commissioning and checked periodically, with the cell's maintenance plan stating the limit.

Safety functions and performance levels

Each safety function, such as stopping when the door opens or when the curtain is interrupted, must be reliable in proportion to the risk it controls. ISO 13849-1 expresses this as a required performance level, PLr, from a (lowest) to e (highest), determined from the severity of injury, frequency of exposure and possibility of avoiding the hazard. The designer then shows that the achieved performance level, PL, of the input devices, logic and output devices together meets or exceeds PLr, using the architecture category, the reliability of each component, the diagnostic coverage and protection against common-cause failures. For an industrial robot cell the main stopping functions are typically required at PL d, and robot standards set that as a baseline for many robot safety functions. That is why the cell uses a safety controller with dual-channel inputs, drives with safe torque off certified to the corresponding level, and monitored contactors, and why the seal fixture's microcontroller of Lesson 5 is not part of any safety function.

Stopping itself has categories. A category 0 stop removes power immediately, letting the machine coast or brake mechanically. A category 1 stop decelerates under control and then removes power. A category 2 stop decelerates and keeps power applied, with standstill monitored. Robots typically use category 1 for protective stops, because a controlled stop on the path is shorter and keeps the robot from sagging or wandering, followed by safe torque off and the brakes. Modern robot controllers add safety-rated functions of their own: safe speed limits, safe zones that confine the tool to a programd volume, and monitored standstill, renamed in the 2025 revision of ISO 10218 from the earlier safety-rated monitored stop. BC-1 uses a safe zone to keep R1's tool away from the load station whatever its program says, which also shortens the stopping time that enters the curtain calculation.

Collaborative applications

Denise asks why the seal assembly could not be done by a collaborative robot working beside an operator, without a fence. It could, in principle. ISO 10218-2 now describes collaborative applications by method: safety-rated monitored standstill, hand guiding, speed and separation monitoring, and power and force limiting. Under power and force limiting, contact between robot and person is permitted but limited to values that should not cause injury, with body-region limits published in the standard's guidance. The catch is the application as a whole: R2 carries seal faces with sharp edges into a press, so contact with the part or the press, not the robot arm, sets the risk. Simone's team concluded that a fenced SCARA was simpler, faster and safer for this task, and the review agrees. Collaborative operation suits slower, lighter tasks where a person's presence is genuinely useful.

Verifying the requirements

The second part of the review walks down Owen's requirements table, now with a column for how each requirement has been verified so far and how it will be at the run-off. Cycle time: the simulation of the overlapped sequence gives 79.5 s against the 86.0 s takt, to be proven in an eight-hour run-off. Placement accuracy: the error budget gives 0.200 mm root-sum-square, and the compliance device of Lesson 11 adds tolerance. Axis X1: the 750 W motor with a 2.6:1 inertia ratio, with settling to be measured on the real axis. Seal test: ST-1's 9.6 s test with its firmware unit-tested off target. Gripper: form-fit fingers and air-loss retention, to be tested by cutting the air. Network: 2,250 packets per second of cyclic load, with the cell in its own firewalled zone. Safety: the risk assessment, the curtain distance and the performance level calculations, to be validated at commissioning by testing every safety function and measuring stopping times. Two items remain open, the drill station's chip extraction and the operator screen's layout, and are given owners and dates.

The business case

The last item is money. The cell replaces two operators per shift on two shifts in the balancing area, at a loaded labor rate of 38 dollars an hour, saving about 273,600 dollars a year. Consistent correction should reduce the scrap rate on 150,000 impeller operations a year by 0.4 percentage points, at 140 dollars per scrapped impeller, saving 84,000 dollars. Maintenance, spares and the integrator's support contract cost 32,000 dollars a year. On a capital cost of 690,000 dollars the simple payback is 2.1 years and the net present value over ten years at 8 percent is about 1.49 million dollars. These are Tidewater's illustrative planning numbers, and the conclusion is not sensitive to them: even with the labor saving halved, the payback stays under four years. The operators are not laid off. Denise's crew moves to the seal assembly line and to running and maintaining the cell, and two of them begin the plant's mechatronics technician training. The plant manager's interest in the project was always the bottleneck and the injuries as much as the labor.

What the course has built

Looking back over the twelve lessons, Owen can see the cell as a single system. The cycle-time budget of Lesson 1 depended on the balancing machine; the motor of Lesson 2 was chosen by an inertia ratio, which Lesson 10's tuning confirmed; the drive's safe torque off from Lesson 3 and the dump valve from Lesson 4 became parts of the safety functions here; the microcontroller fixture of Lessons 5 and 6 was kept out of them deliberately; the PLC's signal list of Lesson 7 is how the robots of Lessons 8 to 11 take part in the sequence; and the stopping time that the curtain calculation needs is a property of motors, drives, brakes and controller settings chosen in every earlier lesson. That is what mechatronic design means: a requirement at one level ends up constraining a choice several disciplines away, and the engineer's job is to follow it there. Farah signs the review minutes, and the cell goes into the build.