A safety controller is a dedicated, certified control unit that monitors safety-related signals and robot motion and forces the robot into a safe state when a limit is violated. In robot safety, it is the component that executes the safety functions identified in the risk assessment, independently of the ordinary motion controller that runs the robot’s program.
The defining property of a safety controller is not intelligence but trustworthiness. It is designed with redundant channels, self-diagnostics and defined failure behavior, so that a single fault does not lead to the loss of a safety function. This is why it is kept separate from the application software, which can contain bugs or be changed at any time.
How a safety controller works
A safety controller reads safety inputs such as emergency stop buttons, light curtains, laser scanners, door interlocks and enabling switches, together with redundant position and speed feedback from the robot’s joints. It evaluates them against configured limits in a cyclic program, typically every few milliseconds, and drives safety outputs that remove power or command a controlled stop.
Internally, it usually uses two processing channels that compute the same logic and cross-check each other. Inputs are often wired in dual channels as well, and outputs pass through two series-connected switching elements. If the channels disagree or a diagnostic test fails, the controller goes to its safe state, which for most robots means stopping and removing motor torque.
The safe state is executed through standardized stop categories defined for machinery, summarized below.
| Stop category | What happens | Typical use |
|---|---|---|
| Category 0 | Immediate removal of power to actuators | Uncontrolled stop, serious faults |
| Category 1 | Controlled braking, then power removal | Emergency stops on most industrial robots |
| Category 2 | Controlled stop with power maintained and standstill monitored | Protective stops for quick restart |
Safety functions it typically provides
Modern robot safety controllers offer a library of configurable safety functions. The integrator selects and parameterizes them according to the risk assessment of the specific application, not according to what the controller happens to support.
| Function | What it monitors | Typical purpose |
|---|---|---|
| Safe torque off (STO) | Enable path to motor drives | Prevents any torque generation |
| Safe stop 1 (SS1) | Braking ramp before STO | Controlled emergency stop |
| Safe operating stop (SOS) | Standstill with power on | Operator works near a halted robot |
| Safely limited speed (SLS) | Joint or tool speed | Reduced speed when people approach |
| Safe zones and joint limits | Tool and joint positions | Keeps the robot out of forbidden areas |
| Power and force limiting | Contact force or torque | Collaborative operation with people |
Speed and separation monitoring, a central mode of human-robot collaboration, combines laser scanner zones with SLS: the robot slows as a person enters a warning zone and stops in a protective zone. The required distances follow from stopping time, approach speed and sensor resolution.
Standards and performance levels
Safety controllers are developed and rated under functional safety standards. For machinery, the main ones are ISO 13849-1, which uses performance levels (PL a to PL e), and IEC 62061, which uses safety integrity levels (SIL 1 to SIL 3). Robot-specific requirements come from ISO 10218 for industrial robots and its guidance on collaborative applications.
| Rating | Typical architecture | Where it is commonly required |
|---|---|---|
| PL d, Category 3 | Two channels, single-fault tolerant | Most industrial robot safety functions |
| PL e, Category 4 | Two channels with high diagnostic coverage | Highest-risk functions, demanding applications |
| SIL 2 | Comparable to PL d | Functions specified under IEC 62061 |
| SIL 3 | Comparable to PL e | Very high risk reduction |
The rating applies to the whole safety function, from sensor through logic to actuator, not to the controller alone. A PL e controller cannot make a function PL e if it is wired to a single-channel door switch.
Safety controller compared with related components
A safety controller is easily confused with neighboring devices. The distinction lies in what is certified and what reacts to which hazard.
| Component | Main role | Safety-rated |
|---|---|---|
| Robot motion controller | Runs programs and trajectories | No |
| Safety controller | Monitors limits and triggers safe states | Yes |
| Safety relay | Simple fixed logic for a few inputs | Yes |
| Safety PLC | Programmable safety logic for a whole cell | Yes |
| Emergency stop device | Manual input that requests a stop | Yes, as an input device |
Many robot controllers integrate a safety controller as a separate certified module inside the cabinet. In larger cells, a safety PLC coordinates several robots, conveyors and guards, exchanging signals over a safety fieldbus such as PROFIsafe or CIP Safety.
Configuration pitfalls
A certified device does not guarantee a safe cell. Many incidents trace back to configuration and validation errors by the integrator.
- Unvalidated parameters: zones, speeds and stopping distances must be verified on the real robot after every change.
- Ignoring stopping time growth: payload, speed and brake wear lengthen stopping distance, so margins must cover the worst case.
- Tool not modeled: a safe zone that monitors only the flange lets a long gripper or part enter forbidden space.
- Uncontrolled changes: configurations should be protected by password and checksum, with every change documented.
- Bypassed devices: muted or bridged inputs left in place after commissioning defeat the whole design.
In everyday language
A safety controller is like a strict, independent supervisor standing next to the robot. The robot’s normal brain decides what to do, but the supervisor constantly checks speed, position and the safety buttons and sensors.
If anything crosses a line, the supervisor stops the robot, no matter what the program wants. It is built with a backup of itself, so even if one part of it fails, it still keeps people safe.
Seen in the real world
A packaging line uses an industrial robot to stack cartons on pallets, and operators must regularly swap full pallets. Instead of a fully fenced cell, the integrator installs two safety laser scanners and configures the robot’s safety controller with safely limited speed in a warning zone and a Category 2 protective stop in the inner zone.
Safe zones also prevent the robot from swinging over the pallet being changed. During validation, the team measures stopping distances at full payload and enlarges the protective zone accordingly. Operators can now change pallets without halting the whole line, while the robot keeps working on the opposite station at full speed.