How do human-robot safety systems maintain a safe distance?

How do human-robot safety systems maintain a safe distance?

How can robots work efficiently alongside people without compromising safety? Human robot coexistence safety systems use sensing, protective separation distances, and speed and separation monitoring to detect people and adjust robot motion before a hazardous situation develops. For quality control and safety managers, understanding how these measures work is essential to assessing risks, validating safeguards, and maintaining reliable production. This article explores the technologies and practical considerations behind safe distancing in shared workspaces.

The central idea is straightforward: when a person approaches a moving hazard, enough space must remain for the safety system to detect the approach, issue a command, and bring hazardous motion to a safe state. In practice, that space is not simply the distance between a worker and the robot’s base. It must account for the moving arm, tooling, workpiece, sensing limitations and the time needed to stop.

A safe distance is a calculation, not a fixed gap

A protective separation distance is determined for the application and its foreseeable conditions. A robot carrying a small inspection probe at low speed presents a different stopping problem from one moving a large fixture at high speed. Even when the robot model is identical, payload, pose, path and the stopping performance of the complete system can change the result.

A practical calculation considers at least the person’s potential approach during the system response, robot motion before and during stopping, and allowances for detection and measurement uncertainty. The relevant response time is the entire chain: sensor detection, signal processing, safety logic, communication where applicable, drive response and mechanical stopping. Omitting a component can make a seemingly conservative distance inadequate.

The nearest hazardous point may be a gripper corner or the edge of a part rather than a robot joint. The calculation also needs to consider whether someone could reach toward the hazard before their body is detected. Appropriate methods depend on the safeguard and geometry; ISO 13855 addresses the positioning of safeguards with respect to human approach, while ISO 13857 addresses safety distances to prevent hazard zones being reached by upper and lower limbs. Confirm the applicable editions and scope for the installation.

This is why a protective field copied from a similar cell is not automatically valid. If an integrator changes the tool, increases speed, alters a route or moves a scanner, the assumptions behind the original field need review.

How speed and separation monitoring responds to people

Speed and separation monitoring, often abbreviated to SSM, is one way to manage shared space. The system monitors the separation between a person and the hazardous robot motion and ensures that the required protective distance is maintained. Depending on the design, the robot may run at a higher permitted speed when the area is clear, slow as a person approaches, and initiate a protective stop if the remaining separation requires it.

A common implementation uses predefined protective fields rather than continuously calculating the exact distance to every point on the robot. An outer field can trigger a safety-rated reduced-speed function; an inner field can trigger a stop. Field boundaries must be designed around the robot’s actual motion envelope and validated stopping behavior, not just drawn around a convenient floor area.

Consider a shared inspection station where an operator loads a part while a robot tends a nearby process. A slow-speed zone may allow the operator to approach without stopping production immediately. But if a fixture blocks the sensor’s view of the operator’s hand, the zone does not solve the underlying problem. The layout may need another protective device, a physical barrier, a revised approach route or a different division of tasks.

A protective stop is not the same as an emergency stop. The required stop function and restart behavior must follow the risk assessment and applicable standards. After a stop, automatic resumption is only appropriate where the system design and risk assessment permit it; the system must not restart into an occupied or insufficiently monitored hazard area.

Detection quality determines whether the distance is meaningful

Safety laser scanners are often used to monitor floor-level access zones, while safety light curtains can protect defined openings. Safety-rated vision or other sensing technologies may be suitable where their specified capabilities match the application. The decision should begin with what must be detected and from which directions, not with which sensor looks easiest to install.

A floor-level scanner, for example, may detect a person walking into a zone but not necessarily an arm reaching over a table or a person climbing around an obstruction. A light curtain can guard an opening, yet the design must also prevent someone from reaching over, under or around it. Pallets, robot tooling, stacked parts and temporary carts can create blind spots that were absent from the original layout.

Environmental conditions matter too. Dust, reflective surfaces, lighting, washdown, vibration and sensor contamination can affect different technologies in different ways. Check the manufacturer’s safety manual for mounting, field configuration, diagnostic behavior and operating limits. A sensor’s advertised maximum range is not proof that it can reliably detect the relevant approach in the installed environment.

Ordinary machine vision can be useful for process observation, but it should not be assumed to perform a safety function. If a camera or algorithm is credited with preventing access to a hazard, the complete function must be suitable for the required safety integrity and validated in its intended configuration. The same caution applies to digital twins: simulation can reveal reach and line-of-sight problems, but it does not replace physical validation of the installed safeguard.

The robot is only one part of the hazard

A robot marketed as collaborative does not make its entire application safe by default. A sharp tool, hot workpiece, pinch point, welding process or unexpected movement of an external axis can create risks that robot speed monitoring alone cannot address. Safety assessment must cover the robot system, end effector, workpiece, surrounding machinery and all relevant operating modes.

Nor is distance monitoring the only collaborative approach. Depending on the task, a safety-rated monitored stop, hand guiding, or power and force limiting may form part of the solution. Power and force limiting concerns contact risks and should not be treated as a substitute for guarding every other hazard. Many real installations combine measures: fixed guarding for a dangerous process, interlocked access for maintenance and monitored speed where people and the robot legitimately share space.

Pay particular attention to modes that occur outside normal production. Teaching, fault recovery, cleaning and clearing a jam can place people closer to equipment than the planned loading sequence. Mode selection, enabling devices, access controls and restart procedures should be assessed for those tasks rather than assumed to inherit the safety of automatic operation.

Standards: use them as a system, not a checklist

ISO 10218-1 and ISO 10218-2 address industrial robot safety and robot applications or cells, respectively. ISO/TS 15066 provides guidance relevant to collaborative industrial robot applications. ISO 12100 provides the general framework for machinery risk assessment and risk reduction. For safety-related control systems, ISO 13849-1 and IEC 62061 are commonly relevant routes for design and assessment.

These documents do not remove the need to define each safety function. For a reduced-speed function, the specification should identify the initiating condition, the required response, the monitored speed limit, the safe state on fault and the required safety performance. The applicable performance level or safety integrity level comes from the risk assessment and the chosen methodology; it should not be selected simply because a component offers it.

Standards are revised, and regional adoption and legal requirements can differ. Project teams should verify the editions applicable to the machine, destination market and date of placing it into service. A component certificate or a declaration for the robot alone does not establish that the integrated cell meets all applicable requirements.

What to verify before accepting a cell

Acceptance should connect the risk assessment to observable performance on the factory floor. Ask the integrator for the safety function specifications, separation-distance assumptions, sensor layouts, stop-time data, configuration records and validation results. The documentation should identify the relevant robot speeds, payloads, tooling and operating conditions used to establish the protective fields.

Stopping performance should be checked under representative and appropriately conservative conditions, including the poses and movements that matter to the application. Where stopping time is monitored or periodically measured, the maintenance plan should define what happens if results exceed the validated assumptions. Brake wear, payload changes and alterations to motion settings can invalidate an earlier calculation.

Validation should also challenge the detection layout: approach from each accessible direction, examine reach paths and check for occlusion in realistic production arrangements. Confirm that faults and loss of the relevant safety signals lead to the specified safe response, and test reset and restart behavior. These checks need a documented method and qualified personnel; an informal walk-through is not an adequate substitute.

For quality teams, nuisance stops deserve investigation rather than quick suppression. A field that repeatedly trips may indicate poor material flow, misplaced equipment or a task that was not represented in the original assessment. Shrinking the field or disabling a function to recover throughput changes the safety design and requires formal review and revalidation.

Keep the safety case aligned with production

Flexible manufacturing makes change control especially important. A new part family can add a longer gripper; a revised cycle can alter the robot’s approach speed; a relocated rack can obstruct a scanner. None of these changes necessarily looks like a safety modification to the person requesting it, yet each can affect the protective separation or the ability to detect someone.

GIRA-Matrix follows developments in robotics, machine vision and digital industrial systems that can help teams frame these decisions. The practical next step is more specific: compare the current cell configuration with the assumptions in its validated safety documentation. If the payload, path, sensing coverage or access route has changed, reassess the affected functions before treating the old separation distance as sufficient.