Robot Safety with ISO 10218: What an Automation Engineer Must Know Before Commissioning a Cell

Two standards, one cell

ISO 10218-1 is for the robot manufacturer: how the arm and controller must be built. ISO 10218-2 is for the integrator and the user: how the robot is turned into a safe cell. As the engineer commissioning a cell in India, part 2 is your standard, and since the 2025 revision it absorbs the collaborative requirements that used to live in ISO/TS 15066.

Indian factories follow it because the customer's corporate standard, the CE-marked equipment, and the insurer all reference it. The Factories Act gives the legal duty; ISO 10218 gives the method.

Start with the risk assessment

Nothing in the standard applies until you have done a risk assessment (ISO 12100 method): identify hazards for every task, including maintenance and teaching, estimate severity and probability, reduce risk by design first, then safeguarding, then information. The assessment decides the required Performance Level (PL, from ISO 13849-1) of each safety function. Most robot safety functions land at PL d, Category 3: dual-channel, monitored.

Write it down. The risk assessment is the first document an auditor asks for and the one most Indian cells cannot produce.

The spaces

• Maximum space: everything the robot can reach.
• Restricted space: what it is limited to by hard stops or safety-rated soft limits.
• Safeguarded space: the area inside the fence or the scanner field.
• Operating space: where it actually works.

Safety-rated soft axis limiting (FANUC DCS, ABB SafeMove, KUKA.SafeOperation, Yaskawa FSU) lets you shrink the restricted space without steel, and it is the single most useful feature to learn on each brand.

Safeguarding the perimeter

• Fixed fences with interlocked, guard-locked doors. Opening the door stops the robot (a Category 0 or 1 stop), and the door cannot be opened at speed.
• Light curtains with resolution chosen for finger, hand or body detection and mounted at the safety distance calculated from the robot's stopping time (ISO 13855).
• Safety laser scanners with warning and protective fields.
• Muting where product must pass, designed so a person cannot follow the product in.
• Presence sensing inside the cell so a person who entered cannot be trapped by a restart.

Reduced speed and teaching

In T1 (manual reduced speed) the TCP is limited to 250 mm/s and the operator holds an enabling device. T2 (manual high speed) exists for path verification and needs additional measures. Automatic mode requires all safeguards active. Every pendant has these modes; the engineer's job is to make sure the mode switch is key-controlled and the cell logic respects it.

Collaborative operation

The four methods, now inside ISO 10218-2:

1. Safety-rated monitored stop: the robot stops when a person enters and stays stopped.
2. Hand guiding: the person moves the robot with a guiding device.
3. Speed and separation monitoring: the robot slows as a person approaches, measured by a scanner.
4. Power and force limiting: contact is allowed within biomechanical limits, which is what cobots are built for.

The gripper and part are part of the collaborative system. A cobot holding a sharp part is not collaborative; see cobots versus industrial robots.

The safety circuit

The robot controller's safety inputs (external e-stop, fence, safeguard stop, enabling) connect through a safety PLC or safety relay with dual channels and monitored outputs, exactly as described in emergency stop and safety circuits. On networks, PROFIsafe and CIP Safety carry the same signals; the Siemens Safety Integrated and GuardLogix free courses show the configuration.

Validation and documents

Before handover:

• Functional test of every safety function, recorded.
• Stopping-distance measurement for the safety distance calculation.
• The risk assessment, the safety functions list with PL, the circuit drawings, the safety PLC program with checksum, and the operating instructions.
• Training records for operators and maintenance.

Frequently asked questions

Is a fence always required? No, but the alternative must be a validated collaborative application or a scanner-based safeguarded space, both of which need more engineering, not less.

Who signs the risk assessment? The integrator, and the user accepts it. In-house teams building their own cells are the integrator.

Does the 2025 revision change installed cells? Not retroactively, but any modification triggers reassessment against the current edition.