Functional safety is the part of overall safety that depends on a control system responding correctly to its inputs, detecting a hazardous condition and bringing the machine into a safe state within a defined time. In robot safety, it covers every protective function implemented in electronics and software, such as stopping on an emergency stop, limiting speed near people or halting motion when a light curtain is interrupted.
The concept separates what the safety function must do from how reliably it must do it. A safety function is specified, its required reliability is derived from a risk assessment, and the hardware and software are then designed, verified and validated so that dangerous failures are rare enough to meet that target.
How functional safety works in robotics
Every safety function follows the same chain: sense, decide, act. An input device such as a safety laser scanner detects a condition, a safety controller evaluates it, and an output device such as a safe torque off circuit or a contactor removes hazardous energy. The function is only as reliable as the weakest element in that chain.
Reliability comes from architecture and diagnostics. Redundant channels cross-check each other, diagnostic coverage detects internal faults before they accumulate, and measures against common cause failure prevent one event, such as overheating or electrical noise, from disabling both channels at once. The table lists typical robot safety functions.
| Safety function | Trigger | Safe reaction |
|---|---|---|
| Emergency stop | Operator presses the stop device | Stop category 0 or 1 |
| Safety-rated monitored stop | Person enters a shared zone | Robot holds position with power on |
| Speed and separation monitoring | Distance to a person shrinks | Robot slows down or stops |
| Power and force limiting | Contact force exceeds a limit | Robot stops or reverses |
| Safe zone and axis limiting | Tool or joint nears a boundary | Motion is restricted or stopped |
Standards and integrity levels
Functional safety is defined by a family of standards. IEC 61508 is the generic basic standard for electrical, electronic and programmable systems. For machinery, ISO 13849-1 expresses reliability as a Performance Level from PL a to PL e, while IEC 62061 uses Safety Integrity Levels SIL 1 to SIL 3. Robot-specific requirements come from ISO 10218, with ISO/TS 15066 adding guidance for collaborative operation.
Each level corresponds to a band of average probability of dangerous failure per hour (PFHd). The values below are the commonly used ranges for continuous-demand machinery functions.
| Performance level | PFHd range per hour | Roughly comparable SIL |
|---|---|---|
| PL a | 10^-5 to below 10^-4 | No SIL equivalent |
| PL b | 3 x 10^-6 to below 10^-5 | SIL 1 |
| PL c | 10^-6 to below 3 x 10^-6 | SIL 1 |
| PL d | 10^-7 to below 10^-6 | SIL 2 |
| PL e | 10^-8 to below 10^-7 | SIL 3 |
Industrial robot standards have commonly required PL d with category 3 architecture for key safety functions unless the risk assessment justifies a different level. The required level is never chosen by habit: it follows from severity, exposure and the possibility of avoiding harm.
Functional safety compared with related concepts
Functional safety is often confused with neighboring ideas. The distinction matters because each is handled by different methods and different evidence.
| Concept | Focus | Example |
|---|---|---|
| Functional safety | Correct behavior of safety-related controls | Scanner slows the robot near a person |
| Inherent safe design | Removing hazards by design | Rounded edges, low payload, low inertia |
| Passive safeguarding | Physical barriers without logic | Fixed safety fence |
| Risk assessment | Identifying and rating hazards | Deciding a function needs PL d |
| Cybersecurity | Protection against intentional attack | Securing the safety network |
The usual order of measures is inherent design first, safeguarding second, information for use last. Functional safety belongs to the safeguarding step, and it increasingly depends on cybersecurity, because a manipulated configuration can defeat a correctly designed function.
The functional safety lifecycle in practice
Functional safety is managed as a lifecycle, not a component purchase. Using certified parts does not make a robot cell safe; the integrated system must be specified, built and validated.
- Risk assessment identifies hazards and assigns a required performance level to each safety function.
- Safety requirements specification defines triggers, reactions, response times and stopping distances.
- Design and calculation confirm architecture, PFHd, diagnostic coverage and common cause measures.
- Verification and validation test every function, including fault injection and stopping time measurement.
- Operation and change management control parameters, passwords and modifications over the cell’s lifetime.
Stopping performance links the safety function to physical layout. The minimum separation distance depends on human approach speed, sensor response time, controller reaction time and the robot’s measured stopping time and distance, which grow with speed and payload.
Common mistakes and failure modes
Most functional safety problems in robot cells come from integration and maintenance rather than from faulty components. The table lists recurring patterns.
| Mistake | Consequence | Correction |
|---|---|---|
| Bypassed or muted sensors | Function silently disabled | Supervised muting and access control |
| Wrong stopping data | Separation distance too short | Measure stopping at worst-case load |
| Unmanaged parameter changes | Validated settings lost | Checksums and change records |
| Standard PLC used for safety | No diagnostics or redundancy | Use a rated safety controller |
A further misconception is that a collaborative robot is safe by itself. Power and force limiting only covers the arm; a sharp tool, a heavy workpiece or a clamping point near a fixture can still cause injury, so the application as a whole must be assessed and validated, not the robot alone.
In simple terms
Functional safety is about making sure the robot’s protective reflexes always work. When someone opens a gate, steps too close or presses the red button, the machine must notice and stop, every single time, quickly enough to prevent harm.
Engineers achieve this by checking every sensor and decision twice and by testing that the stop really happens. The more serious the possible injury, the more reliable the protection must be.
A practical example
A furniture maker installs a palletizing robot next to a walkway where forklift drivers occasionally pass. The risk assessment rates contact with the moving arm as a possible serious injury with frequent exposure, so the integrator sets PL d as the required level for the protective functions.
Two safety laser scanners define a warning zone and a protective zone. When a person enters the outer zone, the robot reduces speed to a safe value; when the inner zone is breached, it triggers a protective stop. Stopping time is measured at full payload, and the scanner fields are sized from that measurement. During validation, technicians disconnect each scanner channel in turn to confirm that the controller detects the fault. The cell keeps running safely without a full fence, which saves floor space while keeping the walkway protected.