Machine Safety & Guarding: The Complete Engineering Guide — A 408 mm Wall of Light in Front of a Press, the B10d Arithmetic That Turns a Door Switch and Two Contactors into PL d, 19 mm of Mesh That Buys 120 mm of Standoff, the 500 ms Two-Hand Window, a 65 N Limit Where a Cobot May Touch a Face, and a 2026 Rupee Ledger from ₹5,500 Light Curtains to a ₹1.46-Crore OSHA Fine

Machine guarding and functional safety in numbers: ISO 12100/13849 PL and PFHd arithmetic worked on a guard chain, ISO 13857 reach distances and mesh selection, ISO 13855 safety distance for light curtains, interlock types and defeat, stop categories, press and press-brake rules, collaborative-robot force limits, and a 2026 India rupee ledger from ₹5,500 curtains to ₹1.46-crore OSHA fines.

·

Machine Safety & Guarding: The Complete Engineering Guide

This series has spent more than a year taking machines apart — boilers and bearings, pumps and PLCs, conveyors and cleanrooms, robots and press lines — and treated each one the way an engineer treats it: as a system of capacities, limits and failure modes. This guide takes apart the subsystem every one of those machines carries and none of those guides itemised, even though it is the one that decides whether the machine is allowed to run at all: the safety layer — the guards, interlocks, curtains, relays and stops that stand between the moving metal and the person who earns a living beside it.

The neglect is easy to explain. Safety devices don't make parts; they interrupt motions, and to accountants they read like cost centres. But open any quotation for a machine bound for Europe, walk any shop floor after an accident, or read any inspector's order, and the safety layer turns out to be the most heavily regulated subsystem on the machine — with its own arithmetic, as exact as the gear math of a gearbox. A light curtain is not a curtain; it is a distance, and the distance is computed: S = K \cdot T + C, where K is how fast a hand travels, T is how long the machine takes to actually stop after the command, and C is 8 mm per millimetre of detection capability above 14 mm. A guard is not a fence; it is a geometric contract — ISO 13857 lists, opening by opening, how far a danger point must sit behind the steel. An interlock is not a switch; it is a reliability budget — ISO 13849 buys safety from failure rates, and a channel assembled from a 2,000,000-cycle door switch, a safety relay and two monitored contactors lands at 33 years of mean time to dangerous failure and Performance Level d, or it doesn't run.

The stakes are priced, too. In the United States, work claimed 5,283 lives in 2023 (5,070 in 2024), of which 779 were contact incidents — people struck, caught or compressed by machinery and equipment [10]. OSHA's maximum fine for a single willful violation in 2025 is $165,514 per violation, about ₹1.46 crore [9]. India's numbers are smaller and less believable for a reason worth stating plainly: the National Crime Records Bureau recorded 762 factory/machine accidents and 670 deaths in 2023 (742 and 660 in 2024) [15], while the DGFASLI returns from states reported 1,090 fatal and 2,949 non-fatal factory injuries in 2023 across 353,950 registered factories — a fatal-injury rate of 5.46 per lakh workers [14]. Both sets count only what registered factories report; the storied machine in a job shop's back room with a defeated interlock appears in neither until it appears on a stretcher.

What follows, section by section:

1. The Boundary as an Engineering Problem

1.1 Everything starts at ISO 12100

No safety device has a defensible size, distance or performance level until a risk assessment says so, and the governing document is ISO 12100:2010, the type-A standard that all machinery safety in the world — European CE marking, ISO certification, a competent Indian safety officer's file — ultimately rests on. It insists on risk reduction in a fixed order, the three-step method [1]:

  1. Inherently safe design — remove the hazard or make it unreachable by design. A grinding wheel enclosed by the machine's own castings; a shear whose hold-down keeps hands out of the path; an arm light enough that its contact cannot hurt. This step costs design time and saves everything else.
  2. Safeguarding and complementary protective measures — the guards, interlocks, curtains, two-hand controls and e-stops this guide is about. What you buy when step 1 is exhausted.
  3. Information for use — markings, manuals, training, PPE. The step everyone over-uses because it's free and it's the weakest: PPE protects the person who wears it correctly, on the day they chose to.

The inspectable output of the assessment is a safety functions list: each function states its trigger (door opened, beam broken, e-stop pressed), its required reaction (power removed from the spindle within 250 ms), and its required reliability (PL d, say). That last item is a number, and it comes from a graph.

1.2 The risk graph, worked

ISO 13849-1's Annex A risk graph scores three parameters and outputs the required Performance Level (PLr) for each safety function [2]:

The mapping (Figure A.1) is worth memorising, because half of all guard budgets are decided by two letters:

Two worked cases from the same shop:

A CNC turning centre's door interlock. Severity: S2 — a spinning chuck and parts in a closed cabinet amputate fingers; the injury is irreversible even though it is rare. Exposure: F2 — the door is opened for loading and part inspection every few cycles, dozens of times per shift. Avoidance: P1 — when the door is open the spindle is visible, the run-down is short and the operator's access is deliberate, so under these specific conditions harm can frequently be avoided. Read the graph: S2 F2 P1 → PL d. This is why the industry convention for CNC door interlocks is PL d, and why an off-the-shelf interlocked switch feeding a category-3 relay channel passes while a single cam switch in the door hinge does not.

A press brake's front access with light-curtain protection. S2 — crushing and shearing of fingers and hands between punch and die is irreversible. F2 — the operator's hands enter the tool area every single stroke, all shift. P2 — the ram closes in a fraction of a second and there is no avoidance once the stroke is initiated; even with a curtain, the approach to the tool offers no opportunity to dodge. S2 F2 P2 → PL e, the top of the ladder — which, per §2, can only be built with a Category 4 architecture at high diagnostic coverage, and is why press-brake safety is where light curtains, two-hand controls and redundant hydraulics all pile onto the same machine.

Note the discipline this imposes: PLr is required performance, decided before hardware is chosen. Choosing hardware first and writing the paperwork later is how shops end up with a PL c relay chain on a PL e function — a machine that runs, sells and is one audit away from being embargoed. And one 2023 revision detail matters in practice: ISO 13849-1:2023 no longer lets you merge "probability of occurrence" into the avoidance parameter; occurrence is assumed to be 100 % unless you can justify (and document) a lower estimate, which allows only a one-level downgrade of the PLr from the graph [2]. Convenience downgrades just got formally harder.

1.3 Safety functions are chains, not devices

The most useful habit the standard teaches is decomposition. A safety function — "opening the guard stops the spindle" — is a chain of subsystems: the sensor that detects the condition (door switch, curtain, e-stop button), the logic that evaluates it (safety relay or safety PLC), and the actuators that execute it (contactors, valves, drives). Each link carries its own failure data, and the chain's reliability is computed link by link, which is exactly what §2 does. It also immediately explains a common shop phenomenon: an expensive guarded door bolted to a machine whose spindle coasts for four seconds because nobody measured the run-down. The sensor was world-class; the actuator — friction and inertia — was out of the loop, and the function failed as a chain. Anything you add to the chain (an extra relay, a longer wire, a second switch in series) changes the budget, which is why safety circuits are drawn, numbered and taken seriously — and why the rest of this guide is arithmetic.

2. The Reliability Arithmetic

2.1 PFH_{d}: the number that defines everything

ISO 13849-1 grades safety performance by the average probability of a dangerous failure per hour of the function, and chops the continuum into five Performance Levels [2]:

PL · Average probability of dangerous failure per hour, PFH_{d} (1/h)

a · ≥ 10⁻⁵ to < 10⁻⁴

b · ≥ 3 × 10⁻⁶ to < 10⁻⁵

c · ≥ 10⁻⁶ to < 3 × 10⁻⁶

d · ≥ 10⁻⁷ to < 10⁻⁶

e · ≥ 10⁻⁸ to < 10⁻⁷

Read the table as money. Moving from PL c to PL d means the function must be ten times less likely to fail dangerously; PL d to PL e, another ten times. Every one of those decade steps is paid for in redundancy, diagnostics, or better components — which is why "we'll just make it PL e" is a sentence that should always be followed by a look at the parts list. For orientation, the two most quoted anchor values in the whole standard: a Category 3 channel with MTTF_{d} of 30 years and 90 % diagnostic coverage computes to PFH_{d} = 2.47 × 10⁻⁷ /h (PL d, comfortably inside the decade); a Category 4 channel with 100-year components at 99 % DC computes to 2.31 × 10⁻⁸ /h (PL e) [2].

The same numbers exist in SIL language, and the two systems are designed to be read side by side: IEC 62061's SIL 1 sits alongside PL c, SIL 2 alongside PL d, SIL 3 alongside PL e — approximate equivalences, enough for cross-referencing a vendor's certificate, and the 2023 edition of ISO 13849-1 deliberately moved closer to its IEC sibling [2].

2.2 The three inputs: MTTF_{d}, DC, and CCF

To know where you land, the standard needs three things about your channel.

MTTF_{d} — mean time to dangerous failure of each channel. For components with a manufacturer's B10_{d} (the number of cycles after which 10 % of a population has failed dangerously), the standard gives the working formula the whole industry uses:

where n_{op} is operations per year — cycles, presses of a button, door openings — with n_{op} = \frac{d_{op} \times h_{op} \times 3600}{t_{cycle}} when you know the duty in time terms. Values are booked into three bands: low (3–10 years), medium (10–30 years), high (30–100 years), with each channel's contribution capped (100 years in the common case) so that one heroic component cannot carry the arithmetic [2]. That cap is important: a magnetic interlock with B10_{d} of 20 million against 5,000 openings a year computes to 4,000 years, which the arithmetic politely truncates to 100 — because at thousands of years the assumptions behind B10_{d} itself (wear-out mechanisms, environment) have long since died.

DC — diagnostic coverage. The fraction of dangerous failures the architecture detects before they accumulate into a hazard: none (< 60 %), low (60–90 %), medium (90–99 %), high (≥ 99 %) [2]. Dual-channel switches with cross-monitoring, test pulses from a safety relay, EDM feedback from contactors — these are the mechanisms that buy DC. Forget to wire the EDM feedback loop and the contactors' DC collapses from 99 % to nothing; the function's PL falls with it. This is the single most common silent downgrade in real control cabinets.

CCF — common cause failure. Both channels failing for the same reason (one flooding event, one power supply, one idiot with a jumper). The standard's defence is a checklist — separation, diversity, design, environmental rating, assessment — scored to at least 65 points for Categories 2, 3 and 4 [2]. You cannot buy CCF immunity at the component level; you earn it in layout.

2.3 The categories: four answers to one question

The category is the architecture — the answer to "what happens when one thing fails?" [2]

The simplified table most engineers actually carry in their heads, in its useful corner:

MTTF_{d} of each channel · Cat 3, DC low · Cat 3, DC medium · Cat 4, DC high

Low (3–10 y) · b · c · —

Medium (10–30 y) · c · d · —

High (30–100 y) · d · d · e

Everything else in this guide — guard locking, curtain mute logic, press-brake hydraulics — is an argument about which cell your machine must live in.

2.4 A guard interlock chain, worked end to end

Take a real, unglamorous project: a vertical machining centre under an interlocked enclosure door, function = "opening the door removes drive power from the spindle and the axis drives within 250 ms." Assume the shop assessed it at PLr d (§1: S2 F2 P1).

Subsystem 1 — the interlock switch. A dual-channel electromechanical door switch with a codable actuator; datasheet B10_{d} = 2,000,000 cycles. The door is opened 20 times a day, 260 days a year: n_{op} = 5,200/year. MTTF_{d} = 2,000,000 / (0.1 × 5,200) = 3,846 years → booked at the 100-year cap. DC: dual-channel cross-monitoring, 99 %.

Subsystem 2 — the safety relay. A dual-channel safety relay with monitored start, published MTTF_{d} ≥ 100 years, DC 99 %, its own PFH given on the certificate in the 10⁻⁹ range. Booked: MTTF_{d} 100 years, DC 99 %.

Subsystem 3 — the actuators. Two contactors in series, dropping the spindle drives and axes. Each B10_{d} = 2,000,000 switching cycles; same 5,200 operations/year → 100-year cap each. DC comes from EDM: the safety relay's feedback loop proves both contactors released before a restart is allowed — a well-tried measure that books the contactors at DC ≥ 99 %.

Channel arithmetic. MTTF_{d} of the series channel = 1 / (1/100 + 1/100 + 1/100) = 33.3 years — medium, as the cap intends. DC_{avg} ≈ 99 % (high; even a conservative reading that discounts the contactors to low DC keeps the average at medium). Architecture: Category 3. Read the table: Cat 3 + MTTF_{d} medium + DC ≥ medium → PL d — met, with margin. Run through the standard's Annex-style calculation, the chain lands in the low 10⁻⁷ range per hour; the classic neighbouring cell is 2.47 × 10⁻⁷ [2].

Now the instructive part. Want PL e on the same machine — say, an application where avoidance was assessed P2? The single-fault-tolerant Category 3 is no longer enough; you need Category 4 diagnostics so that any single fault is detected immediately, DC high on every link including the contactors, and MTTF_{d} high throughout. In hardware: monitored dual switches (not just dual contacts), a relay or safety PLC with true immediate fault detection (not just next-demand), contactors with mechanically linked contacts and dedicated EDM — and the parts bill for one door roughly doubles to triples. That is the real meaning of the risk graph's last letter: P2 is expensive, which is why sensible machine design earns P1 (visible hazards, guarded speeds, escape routes) at step 1 of ISO 12100 before anyone orders a PL e relay.

One more lever: drive-based safety. On modern machines, the function above can be executed without contactors at all — a safe torque off (STO) input on the servo drives, or safe motion functions (SLS — safely limited speed; SSM — safe speed monitoring) integrated in the drive. The reliability data comes from the drive's functional-safety certificate (STO typically certified to SIL 3/PLe capable), the wiring shrinks to a few terminals, and the wear parts vanish: no contactor coil to stick, no contact welding to monitor. For new machines this is now the default; for retrofits of older cabinets, the relay-and-contactor chain above remains the lingua franca — and the chain this series recommends every shop learn to draw, because it is the chain an inspector will ask to see.

2.5 The 2023 edition, briefly

ISO 13849-1's fourth edition (published 27 April 2023; EN adoption published in the EU Official Journal in 2024) is a clarification-and-structure revision rather than new physics, but three things changed in daily practice [2]:

Timeline worth knowing for anyone buying or exporting: EN ISO 13849-1:2015's transition period runs to 15 May 2027, and the EU's Machinery Regulation (EU) 2023/1230 replaces the old Machinery Directive on 20 January 2027 [2]. Machines engineered in 2026 should be designed against the new pair.

3. Guard Geometry

3.1 A guard is a distance, not a fence

The second great arithmetic of machine safety lives in ISO 13857, which answers a deceptively simple question: given an opening of a certain size, how far behind it must the hazard sit so that a person cannot reach it? [4] The tables were built from anthropometric data of people 14 years and older (5th-percentile stature ~1,400 mm), with a separate ladder for children over 3 for the reach-through case — the classic industrial fence with a 100 mm bottom gap is, among other things, a child-reach problem in any plant that receives visitors.

Reaching through openings (Table 4, extracts). The dimension e is the opening's narrowest side — square's side, round's diameter, slot's width:

Opening e (mm) · Safety distance, slot · square · round

e ≤ 4 · ≥ 2 mm · ≥ 2 · ≥ 2

4 < e ≤ 6 · ≥ 10 mm · ≥ 5 · ≥ 5

6 < e ≤ 8 · ≥ 20 mm · ≥ 15 · ≥ 5

8 < e ≤ 10 · ≥ 80 mm · ≥ 25 · ≥ 20

10 < e ≤ 12 · ≥ 100 mm · ≥ 80 · ≥ 80

12 < e ≤ 20 · ≥ 120 mm · ≥ 120 · ≥ 120

20 < e ≤ 30 · ≥ 850 mm* · ≥ 120 · ≥ 120

30 < e ≤ 40 · ≥ 850 mm · ≥ 200 · ≥ 120

40 < e ≤ 120 · ≥ 850 mm · ≥ 850 · ≥ 850

> 120 (slot > 180, square/round > 240) · full-body access — additional measures required · ·

If the slot's length* is ≤ 65 mm, the thumb acts as a stop and the 850 mm cell relaxes to 200 mm [4].

Read three rows of that table slowly and the engineering of every real guard becomes visible:

Two practical notes the series' previous guides would recognise. First, mount a coarse mesh at its required distance or don't mount it — a 40 mm mesh at 100 mm is a signed confession. Second, the table's units are the narrowest dimension for slots, so a 20 × 200 mm louvers guard is a 20 mm slot: 12 < e ≤ 20 → 120 mm stands, unless the slot runs long, in which case re-check the slot's own row. This is the kind of detail that separates a guard designed from the standard from a guard designed from a catalogue's picture.

3.2 Reaching over

Openings are half the geometry; the other half is what a person can do over a protective structure at full upward reach. ISO 13857's Table 2 gives horizontal safety distances as a function of the height of the hazard zone a and the height of the structure b. Too many shops have never seen this table, and it is why "we put a 1 m fence around it" so often fails an audit. Extracts, worked for a hazard whose danger zone sits 2,400 mm above the floor (a rotating shaft at eye height behind a boundary): structure 1,000 mm high → 1,100 mm horizontal distance; 1,200 → 1,000; 1,400 → 900; 1,600 → 800; 1,800 → 700; 2,000 → 600; 2,200 → 400; 2,400 → 300; 2,500 → 100 mm [4].

The pattern is the design guidance: protective structures lower than 1,400 mm should not be used without additional safety measures, and the whole table converges to "zero distance" only as the structure approaches the hazard's own height. The operational reading for a shop building a perimeter fence: a 2,000 mm fence is the first height that buys an honest standoff (600 mm for an eye-height hazard) at modest steel cost; a 2,500–2,700 mm perimeter approaches the tables' own horizon where no reach-over distance is required at all — which is exactly why industrial robot cells and press lines converge on ~2.7 m perimeter fences with no inner clearance for humans at standing reach. Price the height, not just the length.

3.3 The floor gap, the lower limbs, and a 180 mm rule

An under-appreciated 2019 revision addition: the gap between the floor and the bottom of a guard. ISO 13857:2019 requires consideration of whole-body access and caps the floor sweep — keep the gap between floor and guard ≤ 180 mm [4]. The lower-limb tables (Table 7) explain the arithmetic: a slot opening of 180–240 mm is not admissible as protection at all (the leg gets through to the groin), slots 95–180 mm demand ≥ 1,100 mm of distance, and even a 60–80 mm foot opening demands ≥ 650 mm. A knee-height gap under a fence is not a vent; it is a reach vector with numbers attached.

3.4 ISO 14120: the design contract for guards themselves

ISO 13857 sizes guards; ISO 14120:2015 specifies how they shall be built and selected [4], and its requirements are the boring ones that win inspections: guards shall be of substantial construction and stay in place; fixed guards reopen only with a tool (a fixed guard a hand can shift is a movable guard pretending otherwise — and must then be interlocked); movable guards be designed so their interlocks cannot be successfully defeated; guards allow feeding, lubrication and maintenance to be done with the guard in place wherever possible; and the mesh/height choices above be documented in the risk assessment, not discovered in the catalogue. The standard also pushes visibility: guards shall offer adequate viewing of the process (darker wire reads as more transparent to the eye than bright galvanising — a genuinely useful, genuinely unknown fact of mesh selection) and be built so they are not climbable when they must remain a boundary [4].

One honest note that applies to every Indian job shop reading this: the guard on the machine you bought second-hand was sized for someone else's tooling and someone else's fixture layout, in some other country's market. Changing a chuck, adding a tailstock, enlarging a fixture — each moves the danger zone and invalidates the geometry. The tables above take fifteen minutes to re-run; the accident takes less.

4. The Interlock Contract

4.1 ISO 14119 and the taxonomy of door switches

An interlocking device detects the position of a movable guard and generates a stop signal; a guard locking device (or locking interlock) additionally keeps the guard closed until a defined condition — usually hazard run-down — is met. The governing standard is ISO 14119, and its first gift to a shop is a taxonomy that ends every "which switch do I put on this door" argument [5]:

Type · Principle · Example · Defeat resistance

1 · Mechanical, uncoded · Cam- or hinge-operated position switch · Lowest — any screwdriver can imitate the door

2 · Mechanical, coded · Tongue switch (shaped actuator enters switch head) · Moderate — a spare actuator fits

3 · Non-contact, uncoded · Plain magnet and reed/inductive sensor · Low — any magnet triggers it

4 · Non-contact, coded · Coded magnet, RFID, coded opto (unique actuator ID) · Highest — only the matched actuator works

Over the four types sits a coding level: low (1–9 code variations), medium (10–1,000), high (> 1,000) [5]. The distinction is not academic. A "spare actuator in the drawer" defeats a Type 2; a fridge magnet defeats a Type 3; only a high-coded Type 4 makes substitution by any handy object impractical — which is the technical reason RFID switches dominate on any guard where operators have access to hardware. And a genuine engineering subtlety: ISO 14119 grades coding and mounting — a high-coded switch with its targets reachable and swappable is still defeatable; the standard's measure list includes non-detachable fasteners (welding, rivets, one-way screws) precisely so the device cannot migrate from the door to the frame [5].

4.2 Defeat is a design problem, not a discipline problem

ISO 14119's most important concept is written as a design duty: "the machine shall be designed in such a way that it minimizes the motivation for defeating the interlocking devices" [5]. The standard then lists what defeats actually look like — manual bypass with a tool; substitution of the actuator; repositioning of the switch; blocking of the mechanism — and the countermeasure hierarchy that starts with the why:

  1. Remove the motivation. If the guard stands between the operator and a task performed twice a shift (jam clearing, sampling, a chip brush-off), the bypass is not a personnel problem; it is a design problem with a design budget. Solve the task: a hinged flap, a sample port, a slowed crawl speed behind a second interlock, a better chip conveyor.
  2. Use high-coded devices where motivation remains. A defeated Type 3 with a magnet proves nothing about the operator's character that the machine didn't already assume.
  3. Mount out of reach / out of sight so presenting a substitute actuator is physically impractical.
  4. Make actuators non-detachable — the actuator must not be unboltable and relocatable, because that turns any coded device into a Type 1 with extra steps.
  5. Detect defeat: plausibility checking between two different measurement principles, cyclic testing, trapped-key interlocks for the most hard-core cases (a key released only when energy is isolated).

The most cited sentence in the standard, near enough: an interlock that makes someone's job harder every day will eventually be defeated, no matter how clever the engineering [5]. Every maintenance-interlock retrofit in this series' world — press brakes, chip conveyors, robot cages — should start by watching the operator's worst task, not by picking a switch.

4.3 Locking, or not: the run-down test

The single most common interlock question: does this guard need locking, or is a plain interlocked switch enough? The decision is a race between two times:

where d_{\text{reach}} is the distance from the guard opening to the nearest reachable hazard, v_{\text{reach}} the conservative reach speed from ISO 13855 for whole-body movement (1,600 mm/s), and t_{\text{run-down}} the time the hazard actually takes to stop once the interlock trips — measured, not catalogued. If the operator could physically reach the hazard before it has stopped — t_{\text{access}} < t_{\text{run-down}} — an unloked interlocked guard is not protection; the guard must lock closed until the hazard has stopped, and release only then.

Worked: a saw blade with 300 mm of reachable distance behind its door opening. t_{\text{access}} = 300 / 1,600 = 0.19 s. A direct-drive saw stopping in 0.10 s needs no lock. The same door on a machine that coasts for 4 s — an unbraked spindle, a flywheel, a hydraulic axis bleeding down — needs a locking interlock with a release time longer than the run-down, plus a monitored release so the machine cannot restart while the door stands open. Locking devices then raise their own questions, all standardised: escape release (mandatory whenever a person can be locked inside the guarded space), power-to-release versus power-to-lock (the standard warns that power-to-release fails open on power loss — choose to fail safe), and the extra failure modes (bolt jams, solenoid failures) that a plain switch never had. The trap for retrofits: fitting a locking interlock with a 5-second release bolt to a machine whose operator legitimately opens the door every cycle — by month two, someone will have bridged the lock, and ISO 14119's motivation clause predicted it.

4.4 The rest of the furniture: ISO 14118 and safe isolation

Between the interlock and the lockout padlock sits ISO 14118 (prevention of unexpected start-up): every energy source the machine uses — electrical, pneumatic, hydraulic, gravity, stored spring — must be isolatable by a device that can be locked in the isolated position, and the standard expects the machine designer to provide it, not the electrician to improvise it. This is the standard behind the "lockable isolator at the machine" that every European machine ships with and every Indian machine acquired from the second-hand market is missing. When this series' guides say a retrofit should start at the isolator, this clause is why: everything else — the LOTO sequence in §9, the maintenance work on the conveyor in the bulk-handling guide, the tooling change on the press brake — begins once energy is provably off and provably stays off.

5. The Safety Distance

5.1 The equation that places every curtain

The light curtain is the most arithmetic-dense device in the safety catalogue, and it fails the imagination of first-time users the same way every time: the curtain does not stop the machine. It starts a timer. What stops the machine is the control system, over a stopping time that includes the curtain's own scan time, the relay's processing, and the machine's mechanical run-down. The safety distance is the floor space between "the beam is broken" and "the hazard is reached" — and it must be longer than everyone's delays, with margin. That is ISO 13855 [3]:

Every millisecond in T costs 2 mm of floor at hand-approach speed — the single most useful number for justifying fast components. A curtain with 12 ms response versus another with 10.2 ms is 3.6 mm of distance; a relay add 10 ms; and the machine's stop time, typically the elephant, is 100–400 ms on a press and often 1,000+ ms on anything unbraked.

5.2 Worked: a press guarded by a vertical curtain

A mechanical press with a measured stopping time of 180 ms (worst-case: full flywheel energy, cold brakes, worn clutch — measured with a stop-time meter, at the speed and tooling actually used). Curtain response 14 ms; safety relay 10 ms.

Case A — 14 mm resolution (finger detection). C = 8 \times (14-14) = 0. S = 2,000 \times 0.204 + 0 = \mathbf{408\ mm}. Since S \le 500, K = 2,000 stands and the curtain goes up 408 mm from the tool line.

Case B — the same press, same wiring, a 30 mm resolution curtain (hand detection). C = 8 \times (30-14) = 128\ \text{mm}. First pass with K = 2,000: S = 2,000 \times 0.204 + 128 = 536\ \text{mm} — above 500, so the standard lets you re-derive with K = 1,600: S = 1,600 \times 0.204 + 128 = 454\ \text{mm} — below the 500 mm floor for that recalculation, so the floor wins: 500 mm [3].

The comparison is the whole lesson of this section: the coarse curtain does not merely "cost less"; it moves the machine's safety point 92 mm further into the workspace — and on a press brake, that 92 mm is material handling space, supports, and a deeper footprint in a shop where floor is expensive. The fine curtain also opens the muting/blanking conversation (§6.5) from a stronger position. In practice the industry runs finger-resolution (14 mm) curtains in front of press brakes for exactly this reason, and pays for the resolution once instead of paying for the floor forever.

5.3 Horizontal curtains, presence-sensing planes, and the H formula

Where a curtain lies flat to detect a person approaching a robot cell or press line (approach parallel to the plane), the equation changes its shape: K = 1,600 mm/s (body), and

where H is the plane's height above the floor, itself fixed by the curtain's detection capability: H = 15 \times (d - 50) mm [3]. Worked for a common presence plane: a 90 mm-resolution multi-beam floor scanner. H = 15 \times 40 = 600 mm; C = 1200 - 0.4 \times 600 = 960\ \text{mm}; with T = 0.25 s, S = 1,600 \times 0.25 + 960 = \mathbf{1,360\ mm}. The plane sits 600 mm high, 1.36 m out from the hazard — and the formula's shape says something subtle: lower planes need more distance (C grows as H shrinks), which is why shop-floor scanners hug robot-cell boundaries at the code-required heights instead of being tucked wherever the bracket fit.

5.4 After the measurement, the maintenance

The number that invalidates the most installed curtains in the field is the machine's stop time, because it is the number that changes without anyone editing a document. Brakes wear and grip differently; the clutch pack beds in; a heavier tooling load arrives; someone ups the press speed for a job. ISO 13855's arithmetic is only as good as the T fed into it, so the discipline is: measure the stop time at commissioning, record the certificate, and re-measure after any change that touches stopping performance — and before any audit that matters. The stop-time meter (a small box that times the interval from a trigger pulse to the machine's actual halt) is the instrument behind every number in this section; a shop that owns one costs itself less than one day of project delay per use, and it converts the whole of §5 from theory into evidence.

5.5 Scanners and muting — two modern footnotes

Safety laser scanners are 2-D curtains in rotating form: a scanning plane with a protective field (stop) and a warning field (slow/alert), placed under the same S = K T + C arithmetic with an intrusion term C for the scanner geometry, and the same stop-time discipline. Their advantage — freedom to approach from any angle with a configurable field — is also their trap: field configurations are software, software is editable, and ISO 13849-1:2023's expanded software clauses (§2.5) exist because an editable protective field is part of the safety function. Lock the configuration, checksum it, document it.

Muting — the temporary suspension of a curtain while material legitimately passes — is not an off switch; it is a safety function in its own right. Correctly engineered muting uses non-safety sensors for the sequence (part passed? conveyor running?) but insists the logic (permit the mute only in the right sequence, for a bounded time, never with a person present) be built from the same reliable components and validated with the same PL as the curtain itself. It also must be fail-safe by construction: material present + power dip must not equal muted-with-person-inside. The correct mute architecture is more expensive than the curtain it mutes; budget accordingly.

6. Signals, Stops, Reset

6.1 Stop categories: what "stop" even means

Every stop function belongs to one of three stop categories per IEC 60204-1 [6]:

The art of machine design is assigning categories per function: production stop = Cat 2; protective stop from a curtain = usually Cat 1 (controlled, to protect the tooling and the parts) or Cat 0 for simple machines; e-stop = Cat 0 or Cat 1 only, chosen per machine and documented.

6.2 The e-stop, exactly specified

The e-stop is the most familiar and most abused device in the catalogue. ISO 13850 [6] and its family specify it tightly:

6.3 Two-hand control: the 500 ms window

A two-hand control device (THCD), standardised in ISO 13851:2019 [7], forces both of the operator's hands to be occupied by the actuation devices at the moment a hazardous motion is initiated — the hands are on the buttons, not in the die. The characteristics that matter on the floor:

Two honest limitations keep THCDs in their lane. First, a THCD protects only the person whose hands are on it — it stops nothing from a colleague's approach, which is why THCDs are typically combined with curtains or guards at the same machine. Second, press standards have moved it out of the driver's seat: since the EN ISO 16092 series, a two-hand control as the only safeguarding measure is restricted to narrow presses (roughly up to 650 mm table width in typical configurations); wider presses need guards or electro-sensitive protective equipment in addition [8]. If your press's entire safety case is two silver buttons, read §7 next.

6.4 Detection capability: Type 2 vs Type 4

Light curtains are certified under IEC 61496, and the type number is a capability statement, not a brand tier [3][5]:

The detection capability d — 14 mm finger, 25/30 mm hand, 40–90 mm body — feeds the C term of §5 directly, so the selection conversation at a machine is really about three letters at once: resolution (what C you pay), type (what PL ceiling you buy), and height (what opening the guarded approach actually is). Laser AOPDs and safety radars obey the same logic under their own sheets; the arithmetic in §5 is the invariant.

6.5 Reset, restart, and anti-restart

One more discipline that separates compliant machines from merely stopped ones. A protective stop must lead to a state that stays stopped until a manual, deliberate reset — and the reset must be positioned so the operator can see the hazard zone before confirming it. The chain is: device trips → machine stops → condition cleared (door closed, field free) → then reset button → then separate start. Merging any two of those steps is the classic "it started on its own" complaint in accident files. ISO 13849-1:2023 tightened the wording on manual reset (a monitored signal edge — a clean transition — is required, not just a button press-level held through power cycles [2]). Machines that restart on power-return without a deliberate act are the other half of this rule: after any power loss, the machine shall come back to a safe state and wait, not resume.

7. The Machines That Bite

7.1 The press regulatory stack

Presses — the archetypal maiming machine — carry their own type-C standards above the B-level arithmetic. The current European/ISO stack: EN ISO 16092-1 (general, 2017), -2 mechanical presses, -3 hydraulic presses, -4 pneumatic presses — with hydraulic press brakes deliberately carved out of the series' scope and living under their own standard, EN 12622:2009+A1:2013 [8]. The old EN 692/693/13736 standards are superseded; if a machine's paperwork cites them, the paperwork is a decade stale.

The 16092-1 general part changed practice in ways worth knowing even without a copy: the verification table maps every requirement to a verification method (retrofit engineers use it as an inspection checklist); operating-mode selection (setup / single stroke / automatic) is itself a safety function with a required PL, protected against unauthorised use by key or password; and an e-stop mounted on a movable operator panel must clearly indicate its active status, so the operator is not lulled by a dead button on a parked pendant [8].

7.2 Press brakes, specifically

The press brake is the most-produced machine tool in the world's fabrication shops and among the most persistently dangerous, because its production motion — a beam closing on a narrow tool line — is initiated by the same hands it endangers, thousands of times a day, with material precisely placed under the tool at the moment of closure. EN 12622's protective scheme, in the shape a retrofit actually takes [8]:

The two most common non-compliances seen on Indian press brakes in the second-hand machine market, in the experience of anyone who audits them: curtains whose mute arrangement is actually a defeat (a key switch or a taped-over sensor for "difficult jobs"), and the missing rear/side guarding on machines whose back gauge area is a third, unguarded pressing zone that nobody watches because the operator faces the front.

7.3 Mechanical presses and the American rulebook

Where the machine is a mechanical stamping press, US shops work under 29 CFR 1910.217, which frames the safeguarding options — presence-sensing devices (curtains), two-hand controls/trips, pullbacks, restraints, fixed barriers — and requires the presence-sensing option to be positioned so that the operator cannot reach the point of operation before the slide's motion has stopped. The rule's arithmetic and ISO 13855's are the same physics in different costumes. The other classic delta: 1910.217's brake monitor — an electronic watchdog that audits the stop-time of a mechanical press's brake on a schedule and locks the machine out when stopping performance degrades — an instrument the ISO world achieves through §5.4's re-measurement discipline, and which is the single best maintenance argument for the shop that "never touches" its press.

7.4 Shears, saws, conveyors: the same recipe

Nothing about the method is press-specific. A guillotine shear runs foot-pedal-initiated strokes with hands under the clamps → front finger-guard comb, curtain or fixed tunnel guard sized by §3, single-stroke/hold-to-run logic, and the back gauge as its own zone. A cold saw's blade returns home by design → guarding of the blade at all points of the cycle plus a distance check for the out-feed side. The conveyor this series ran in its bulk-handling guide has nip points at every drum and idler and a tail drum that eats bootlegs → fixed guards at the drive, nip bars at the tail, pull-cords sized to the §5 logic at every accessible run along the line. The one machine class that broke this series' usual rule — the robot — needed a whole different arithmetic, and that is next.

8. Cobots and the Contact Budget

8.1 The robot standards changed in 2025

For most of its life, robot safety was fenced safety: a cage, an interlocked gate, and the person outside. The exceptions lived in ISO/TS 15066, the 2016 Technical Specification that defined collaborative operation and set biomechanical contact limits — and in February 2025 that arrangement was formally re-drawn. ISO 10218, the robot safety standard, was revised in its third edition (published 2025-02, Parts 1 and 2), and the biomechanical limits that had lived as supplementary guidance in TS 15066 were folded directly into the 2025 edition of Part 2 as requirements, converting collaborative-robot force limits from "consult this technical specification" into "the standard says" [11][12]. Anyone maintaining a robot cell's safety file should note the date their reference framework changed; anyone building a new cell should note that both parts are now in scope — Part 1 addresses the robot as partly completed machinery, Part 2 the integrated application and its cell [11].

The standard's collaborative modes remain the four every cobot deployment picks from [12]:

  1. Safety-rated monitored stop — the robot stops when a human enters, and may resume automatically when they leave; the human and robot share the space but not the time.
  2. Hand guiding — a person physically guides the robot via a safety-rated enabling device; the robot does what it's pulled to do.
  3. Speed and separation monitoring (SSM) — the robot keeps a computed protective distance from the human, slowing or stopping as the gap closes; the arithmetic of §8.3.
  4. Power and force limiting (PFL) — the robot may touch a human, because its mass, speed, geometry, force and power are limited so that any contact stays under biomechanical thresholds.

One sentence from the standard's philosophy deserves to be on a plaque: "collaborative" is not a property of a robot; it is a property of the application. The same 6-axis arm that smiles through a PFL handshake in one cell is a blunt instrument of fracture in another, where its payload, fixtures and path conspire; the risk assessment, not the nameplate, decides which modes a cell may use [12].

8.2 The contact budget, in numbers

The heart of the PFL case is a table of what the human body can take. The values every cobot safety file quotes (quasi-static contact — the clamping case, where a body part is pinned with no escape) [12]:

Body region · Quasi-static force limit

Skull / forehead · 130 N

Face · 65 N

Chest · 140 N

Hand / finger · 140 N

Two structural facts govern the arithmetic around these numbers. Transient contacts — brief impacts — are generally allowed twice the quasi-static value, because the energy transfer is short and the tissue deforms elastically; but the head's regions are treated most conservatively (any head contact must stay near the quasi-static limits regardless of brevity) [12]. And alongside force, the standard bounds transmitted power — with an 80 W ceiling in quasi-static conditions [12] — plus contact pressure in N/cm², because 140 N through a blunt pad and 140 N through a 2 mm tool edge are not the same injury. The whole table is the reason a cobot's ability to "safely collide" is engineered rather than marketed: 65 N on a face is about the weight of a 6.5 kg mass resting on your cheek [12] — a budget that geometry (rounded surfaces), payload, speed, and torque-sensing must all stay inside simultaneously, at every point of every path, including the unexpected ones.

8.3 Speed and separation monitoring, worked

SSM turns the fencing problem into a moving one: the cell must maintain a protective separation distance S computed from both parties' motion, such that even if everything stopped, no contact occurs. In the form institutionalised by ISO/TS 15066 and worked through by NIST [13]:

Plug in a mid-size cobot cell: human walking at v_H = 1.6 m/s; robot capped at v_r = 1.0 m/s; reaction T_R = 0.2 s; stop T_S = 0.4 s; measured stopping distance S_s = 0.25 m; uncertainties totalling Z = 0.07 m; C = 0 (gap between sensed volumes):

Now move the levers. Halve the robot speed (0.5 m/s, stopping distance scaling to ~0.125 m): S = 0.96 + 0.10 + 0.125 + 0.07 \approx 1.26 m — a 240 mm win for halving throughput. Instead attack the times — faster sensing and a faster stop (say T_R = 0.1 s, T_S = 0.25 s, S_s = 0.15 m, robot back at 1.0 m/s): S = 1.6(0.35) + 0.1 + 0.15 + 0.07 = 0.56 + 0.32 \approx \mathbf{0.88\ m} — a 600 mm win without giving up speed. That asymmetry is the design lesson: the cell's floor space is bought from reaction time and stopping distance, not from crawling. The human's term (0.96 m of the 1.5) doesn't care about your cobot; the robot's terms are where the engineering budget lives, which is why safety-rated sensing, fast fieldbus safety I/O and honest stopping tests are worth more in an SSM cell than a torque-friendly arm alone.

8.4 What this means on a shop floor

Three practical rules of thumb, drawn straight from the arithmetic:

And one from the 2025 revisions worth pre-empting in any new design: treat the safety-rating of every subsystem in the collaborative chain (sensor, controller, robot, and the application logic in between) as its own PL claim to be verified, not inherited. Category 3 was never a property of the whole machine merely because each bought part carried a certificate — that is §2's arithmetic, and robots are not exempt from math.

9. Defeat, Lockout and the Indian Framework

9.1 The defeat economy

Every guard has an adversary, and the adversary changes nothing about the physics. The defeat mechanisms ISO 14119 enumerates [5] — bypass, substitution, repositioning, blocking — are all, in the standard's own words, design artefacts: a machine that needs a jam cleared through an interlocked gate twice an hour, a chip tray that cannot be pulled without the fence, a bend that cannot be seen around the curtain. Each of these produces the same sentence in the maintenance log — "switch was found bypassed" — and the sentence is a description of the machine, not of the person.

The reason to spend on defeat-resistance rather than posters is arithmetic again: the defeat multiplies the risk back to the unguarded state for every subsequent cycle, warping the probability of harm that every PLr in §1 assumed away. A PL d door interlock feeding a bypassed switch at the door is a PL d relay reading a lie. This is why the standard's mitigation order puts motivation first (make the task possible without defeating), coding second (make the act hard), detection third (make it visible: cyclic testing, plausibility between two principles, trapped keys) — and why an audit that checks only "is the switch fitted" verifies nothing that matters.

9.2 Lockout: the six acts

For maintenance and cleaning, the guard discussion hands off to lockout/tagout — the discipline of making the energy state provably dead. The OSHA procedure (29 CFR 1910.147) that most of the world's training is modelled on runs [9]:

  1. Prepare — know the energies on the machine (electrical, pneumatic, hydraulic, gravity, thermal, stored spring); know what each lock must isolate.
  2. Notify the affected operators — the person on the machine must know why it will not run.
  3. Shut down using the normal stopping procedure (not the e-stop, not the breaker).
  4. Isolate every energy source — the disconnect, the valve, the block.
  5. Lock and tag each isolating device — one lock per worker, keys stay with the person behind the lock, tags carry a name and a reason.
  6. Dissipate stored energy — bleed accumulators, discharge capacitors, block gravity loads, cool thermal loads.
  7. Verify — attempt a normal start, test for absence of voltage/flow, and try. The verification step is the difference between a lockout and a guess.

Then work; then reverse in order. The supporting hardware — lockable isolators per ISO 14118 (§4.4) — is a machine-design obligation, not an improvisation. And one Indian reality to name plainly: much of the factory stock predates any lockable-isolation habit, so the practical retrofit list in a typical job shop starts with adding lockable disconnects and labeling energy sources before any clever safety device earns its bracket.

9.3 What the Factories Act actually says

For an Indian shop, the legal floor sits in Chapter IV (Safety) of the Factories Act, 1948, and its sections map onto this guide almost line for line [16]:

The penalties close the loop with uncommon clarity on who pays: Section 92 makes the occupier and the manager each guilty of an offence — imprisonment up to two years, or fine up to ₹1 lakh, or both, plus ₹1,000 per day while a contravention continues; where the contravention of Chapter IV caused a death, the fine shall not be less than ₹25,000, and after conviction for a repeat offence (s.94) the penalty rises to three years and fines between ₹10,000 and ₹2 lakh [16]. Whoever signs as manager should read those numbers twice. Alongside the Act, the Occupational Safety, Health and Working Conditions Code, 2020 — which consolidates the Factories Act framework — continues to be phased in through state rules, and its architecture keeps the same duties and heavier corporate responsibility; but as of writing, the 1948 Act's sections remain what most inspectors cite on a shop floor, and they remain enforceable today.

9.4 The safety file that saves you

None of the above works as paperwork theatre, and all of it works as a file. What an inspector, an insurer, or a court actually reads when a machine has hurt someone: the risk assessment (ISO 12100: hazard list, risk graph inputs, chosen PLr per function), the validation record (ISO 13849-1 Clause 10: calculations, component certificates, the wiring as built), the stop-time measurements with dates, the maintenance log showing guards and interlocks serviced and inspected — and the training records for §22's trained workers and §23's young persons. A shop that keeps this file is not merely compliant; it is the shop that can say, with evidence, "we engineered against exactly this accident," which is what the occupier-and-manager liability in §9.3 quietly asks for.

10. The Ledger

10.1 The market

Machine safety is not a hobbyist's line item. Market research puts the global machine-safety business at USD 5.66 billion in 2025, on track for USD 7.45 billion by 2030 at ~5.7 % CAGR (MarketsandMarkets), with a second house tracking it from USD 6.17 bn in 2025 to USD 9.16 bn in 2030 at ~8 % — the definitional spread you get when "machine safety" can mean presence sensors one year and entire functional-safety platforms the next [17]. The composition matters more than the total: presence-detection sensors (curtains, scanners), safety controllers, relays, interlock switches, e-stops, and two-hand controls — precisely the components this guide just put numbers on — with Asia-Pacific the fastest-growing region and automation-compliance demand as the named driver [17]. Read as a shop-owner's signal: the component supply chain that serves you is thickening in your region, prices are on a volume learning curve, and the auditors are multiplying.

10.2 What the parts cost in 2026, in rupees

Representative Indian street prices for the two components this guide sized most carefully (listings carry ex-tax prices; treat as indicative, not quotes) [18]:

Component · Class · Indicative 2026 price

Type 4 light curtain (domestic) · 20–30 mm resolution, 300–600 mm protective height, hand detection · ₹5,000–8,000 per unit / pair

Type 4 light curtain (Omron class) · 14 mm finger resolution, small protective height · from ₹10,000 per piece

Type 4 light curtain, advanced · muting, blanking, warning zones (F3SJ-advanced class) · ₹19,750–46,450

Safety relay (Allen-Bradley MSR127-class) · dual-channel, e-stop/gate monitoring · ₹7,000–8,000

Safety relay (Pilz PNOZ X-class, 774080) · dual-channel, gate + e-stop, monitored start · ₹10,500

Safety relay (ABB dual-channel, higher-end) · 2 safety contacts, 24 V DC, expandable · ₹36,000

The instructive column is the spread: a domestic hand-resolution curtain pair plus a name-brand safety relay lands near ₹12,500–18,500 in parts; the imported, feature-rich equivalent can pass ₹50,000 — before brackets, wiring, integration, the stop-time measurement, and the validation file. Which is to say what every controls engineer knows and every capex sheet hides: the devices are the cheap part of a safety function; the engineering around them is the cost. A shop that quotes only the components line has quoted the tip of the bill.

10.3 A worked retrofit budget

Take the year's most common job: a hydraulic press brake, 30–40 tonnes class, brought up to front guarding with a curtain and a monitored relay, as §7.2 sketches.

Line · Conservative (domestic/standard) · Higher-spec (imported, 14 mm, advanced)

Light-curtain set (finger resolution) · ₹5,500–15,000 · ₹20,000–47,000

Safety relay, dual-channel · ₹7,000–10,500 · ₹10,500–36,000

Mounting/brackets/muting sensors · ₹3,000–8,000 · ₹8,000–20,000

Integration labour (controls engineer + electrician, 1–2 days) · ₹8,000–20,000 · ₹15,000–35,000

Stop-time measurement + validation documentation · ₹5,000–15,000 · ₹10,000–25,000

Indicative total, parts + integration · ≈ ₹28,500–68,500 · ≈ ₹63,500–1,63,000

Two footnotes. First, these are the ranges a retrofit lands in when the machine already has a stop circuit worth relaying; a machine missing its lockable isolator, an e-stop, or rear guarding (§7.2) builds upward from here. Second, the higher-spec column often pays for itself in §5 arithmetic — the 14 mm resolution that costs ₹15,000 more in hardware saves ~90 mm of standing distance and one class of curtain-related muting problem that would otherwise consume weekly operator attention forever. Safety retrofits are like insulation: the near-optimal point is well below the maximum spend and well above the minimum.

10.4 The fine, and the arithmetic everyone should run once

Set the numbers side by side one final time.

Item · 2026 cost

Domestic light-curtain + relay retrofit, parts · ≈ ₹12,500–18,500

A single OSHA "serious" violation (max), 2025-adjusted · $16,550 ≈ ₹14.6 lakh

A single OSHA "willful/repeated" violation (max) · $165,514 ≈ ₹1.46 crore

OSHA failure-to-abate, per day · $16,550

India, Factories Act s.92, per death under Chapter IV · fine ≥ ₹25,000, plus up to 2 years' imprisonment for occupier and manager, each

India, s.94 repeat conviction · up to 3 years, ₹10,000–2,00,000

The headline — one willful US citation, about ₹1.46 crore, versus a complete press-brake safeguarding retrofit at roughly ₹28,500–68,500 — is the entire capex argument in two lines, and it isn't even the biggest number in the table. The biggest numbers are the ones not in it: a hand's earnings over a lifetime, a family's month after an amputation, a shop's next insurance renewal, the manager's name on a charge sheet under §92 that cannot be migrated to the company. Every section of this guide — the PLr graph, the B10_{d} arithmetic, the mesh table, the 408 mm of light, the 65 N face limit — exists to make those numbers smaller, and every one of them is quantifiable before the machine runs. That is the discipline: the machine's safety case is not the absence of accidents so far. It is a set of computed distances and probabilities, drawn, measured, and kept where the inspector and the lawyer will look.

Frequently Asked Questions

What is the minimum safety distance for a light curtain?

It is never a fixed number — it is computed from S = K \cdot T + C. For hand/arm approach, K = 2,000 mm/s (drop to 1,600 only when the result exceeds 500 mm); C = 8 \times (d - 14) mm for curtains of 14–40 mm resolution, or 850 mm for body detection; and T is the sum of curtain response, relay response, and the machine's measured stopping time. A press stopping in 180 ms with a 14 mm curtain and 24 ms of electronics: T = 0.204 s, C = 0, S = \mathbf{408\ mm} — and the same press with a 30 mm curtain moves to 536 mm (recomputed, floored at 500). Always re-measure stop time after brake or drive work; every millisecond is 2 mm of floor.

Which Performance Level do I actually need?

Run the ISO 13849-1 risk graph before choosing any hardware: severity (S1/S2), exposure (F1/F2), and avoidability (P1/P2) map to PLr a–e. The shop-floor accents: guard doors on machines that are opened every cycle, with reversible-in-theory but serious injuries and visible hazards, classically land at PL d; press-brake front protection and other no-escape hazards land at PL e; low-exposure conveyor e-stops and maintenance functions often sit at c–d. PL e requires a Category 4 architecture with high diagnostic coverage — roughly double the hardware of PL d — so designing out the P2 (add visibility, slow speeds, escape routes) is usually cheaper than buying PL e. And with ISO 13849-1:2023, any downgrade of the graph's result needs written justification.

Can two-hand control alone guard my press?

For a press above roughly 650 mm of table width, no — since the EN ISO 16092 series, a two-hand control as the sole safeguarding measure is restricted to narrow presses; wider machines need guards or electro-sensitive protective equipment in addition. Even where used, a THCD protects only the person whose two hands are on it (ISO 13851:2019), so a second approach path — a colleague, a maintenance reach — is unprotected by definition. The modern press-brake pattern is a 14 mm curtain doing the everyday protection, with two-hand or hold-to-run logic reserved for slow setup mode.

Do I need guard locking, or is an interlocked switch enough?

Race two times: how long until a person can physically reach the hazard through the opened guard (distance ÷ ~1,600 mm/s whole-body approach), versus how long the hazard takes to actually stop. If reach time exceeds run-down — a direct-drive tool stopping in 0.1 s behind 300+ mm — a plain interlock is adequate. If the hazard coasts (unbraked spindle, flywheel, sinking hydraulic axis), the guard must lock closed until standstill, with a monitored release, an escape release for anyone who could be locked inside, and the failure direction chosen deliberately (power-to-release fails open — prefer fail-safe). And answer the defeat question honestly first: if operators will be in and out all shift, fix the task, or a bypass is coming no matter how the lock is coded.

Type 2 or Type 4 light curtain — what's the difference?

It is a fault-tolerance grading, not a quality grade. Type 4 detectors are self-testing with immediate detection of internal faults and can take part in PL e / SIL 3 functions; Type 2 devices can lose the protective function between self-tests and are limited to roughly PL c / SIL 1 functions. Both come in resolutions — 14 mm (finger), 25–30 mm (hand), 40–90 mm (body) — and the resolution, not the type, sets the C term and therefore the safety distance. The decision order on a real machine: PLr first, then type to cover it, then resolution to make the resulting distance physically fit the floor.

How often should safety distances and interlocks be re-verified?

Continuously meaningful, periodically documented. The numbers that decay are the machine's stopping time (brake wear, clutch bed-in, tooling mass, speed changes) and the mechanisms that keep guards honest (switch alignment, actuator wear, defeat). The workable schedule for a job shop: measure stop time and check all guard devices at commissioning and annually; re-measure after any change touching stopping performance or guarding; and make guard/interlock condition part of daily pre-start checks so the alignment problem is caught by the operator, not by an accident. Record everything — a valid safety file is the evidence that today's machine still matches the design the calculations were done for.

The Discipline in One Page

Machine safety is one idea — the boundary between people and moving machinery is an engineered structure with dimensions, failure rates, and maintenance — worked through a stack of arithmetic. The risk assessment sets the order of operations before a single device is priced: ISO 12100's three steps, and the ISO 13849-1 risk graph whose three letters (S, F, P) convert a hazard into a required PL, from a to e (§1). Reliability is then a budget, not a brand: PFH_{d} windows from 10⁻⁵ to 10⁻⁸ per hour, MTTF_{d} = B10_{d}/(0.1·n_{op}), DC bands, a 65-point CCF score, and architectures B through 4 whose table reads — Category 3, MTTF_{d} medium, DC medium — PL d; the worked chain of a door switch, relay and two EDM-monitored contactors lands at 33 years per channel and PL d, and PL e costs a Category 4 rebuild (§2). Geometry is quantitative: ISO 13857 prices openings in standoff — 4 mm → 2 mm, 12–20 mm → 120 mm, 40 mm → 200 mm, up to 120 mm → 850 mm; a 19 mm mesh buys 120 mm of closeness; a 2,400 mm hazard behind a 1,000 mm fence demands 1,100 mm of distance and behind a 2,000 mm fence only 600; the floor gap closes to 180 mm (§3). Interlocks are a contract to be defended: types 1–4, coding that outpaces spare-actuator defeat, locking decided by the reach-versus-run-down race at 1,600 mm/s, and motivation engineered away before anything is bolted on (§4). The distance that places every curtain is S = KT + C — 408 mm for a 14 mm curtain on a press stopping in 204 ms, 500 for the coarse one, 1,360 mm for a 90 mm presence plane at 600 mm — with every millisecond worth 2 mm and every stop-time change invalidating the stack (§5). Stops have categories, e-stops have a rulebook, two-hand controls have a 500 ms window, and reset is a deliberate act with its own edge (§6). Presses concentrate all of it — EN ISO 16092 and EN 12622: curtains at 14 mm, setup at ≤ 10 mm/s, valves in pairs, mode selection as a safety function (§7). Robots traded the fence for an equation: 130 N to a forehead, 65 N to a face, 140 N to a hand, 80 W of power, and an SSM separation that shrinks with reaction time, not with shamefaced slow speeds — 1.5 m becomes 0.88 m when the sensing and stopping improve (§8). And the enforcement layer is real in both worlds being debated here — BLS's 779 contact deaths in America's 2023, DGFASLI's 1,090 fatal factory injuries and NCRB's 660 machine deaths in India's returns — against penalties that start at ₹25,000 under s.92 and reach $165,514 (≈ ₹1.46 crore) for one willful OSHA violation, while the safeguarding that prevents the accident costs a fraction of either (§9–10).

The ledger closes the loop. A machine-safety market compounding at 6–8 % a year is not selling fear; it is selling arithmetic that happens to overlap with fear — PL d relay channels at ₹7,000–10,500, finger-resolution curtains from ₹5,500 domestic to ₹46,450 advanced, and a complete press-brake retrofit inside ₹70,000 at the conservative end. Against that, one inspector's order under the Factories Act to "prohibit its use until properly repaired," one day of downtime, one claim. The shops that understand this stop asking "what does the inspector want" and start asking §1's question — what does the hazard require — because the two answers turn out to be the same document, and the document is cheaper to write at the design table than in a courtroom.

That is the layer every machine in this series has been carrying without the previous guides naming it. It was never decoration on the way to the real engineering. It is the real engineering — the one subsystem whose specification is a person, and whose tolerance is zero.

Previous guides in this series: PCB Fabrication & Bare Board Manufacturing · Industrial Ventilation, Fans & Dust Collection · Lean Manufacturing & Production Systems · Belt Conveyors & Bulk Material Handling · Cranes, Hoists & Rigging · Cleanroom Engineering & Contamination Control · Industrial Refrigeration & Cold Chain Systems · Industrial Electrical Power Distribution · Metrology & Dimensional Inspection · Industrial Furnaces, Kilns & Refractories · Structural Steel Design & Fabrication · Pressure Vessels & Storage Tanks · Process Piping & Pipe Fabrication · Industrial Steam Boilers & Steam Systems · Non-Destructive Testing.

[1] ISO 12100:2010 (Safety of machinery — General principles for design, risk assessment and risk reduction) — the three-step method (inherently safe design → safeguarding/complementary protective measures → information for use) and hazard-to-risk reduction workflow that every downstream calculation in this guide presumes. [2] ISO 13849-1:2023 — Safety of machinery, safety-related parts of control systems, Part 1 (4th edition, published 27 April 2023): Performance Level definitions and PFH_{d} ranges for PL a–e (10⁻⁵ to 10⁻⁸ /h); MTTF_{d} bands (low 3–10 y, medium 10–30 y, high 30–100 y; per-channel caps, 100 y common case / 2,500 y Cat 4 case); DC bands (none < 60 %, low 60–90 %, medium 90–99 %, high ≥ 99 %); CCF score ≥ 65 points (Annex F); Categories B–4 requirements and the simplified PL table (Cat 3 + MTTF_{d} medium + DC_{avg} medium → PL d; Cat 4 + high + high → PL e; only Cat 4 reaches PL e); classic reference PFH_{d} values 2.47 × 10⁻⁷/h (Cat 3, 30 y, 90 %) and 2.31 × 10⁻⁸/h (Cat 4, 100 y, 99 %); 2023-edition changes (subsystems terminology, expanded software clauses, validation in Part 1, EMC annex L, Annex A parameter-P change with one-level downgrade requiring documentation); EN transition horizon 15 May 2027 and EU Machinery Regulation (EU) 2023/1230 applying from 20 January 2027 — per DGUV "Fourth edition of EN ISO 13849-1 – new features", Pilz standards documentation, TÜV SÜD release, and ISSA/Siemens/IDEC/Rockwell training materials that reproduce Tables K.1/7 equivalents and worked Annex examples (MTTF_{d,CH} = 38.5 y, DC_{avg} = 95.7 % case included in ISSA seminar deck). [3] ISO 13855:2010 (Positioning of safeguards with respect to the approach speeds of parts of the human body) — S = K·T + C; K = 2,000 mm/s (hand/arm; S ≤ 500) and 1,600 mm/s recalc (S > 500, floor 500); C = 8(d − 14) for d ≤ 40 mm, C = 850 for body detection; S ≥ 100 mm; horizontal-approach form S = 1,600T + (1,200 − 0.4H), C ≥ 850, H ≤ 1,000, H = 15(d − 50); worked examples as reproduced across Reer's industrial-safety guide, fsddsk ISO 13855 worked examples (press: 408 mm at d = 14; 536/454/500 at d = 30), and safety-curtain vendor calculators (ENT-14 example: 221 mm at 10.2 ms + 100 ms; 12 ms variant 244 mm). [4] ISO 13857:2019 (Safety distances — upper and lower limbs): Table 4 reach-through values (fingertip e ≤ 4 → 2; 4 < e ≤ 6 → 10; 6 < e ≤ 8 → 20; 8 < e ≤ 10 → 80 slot / 25 square / 20 round; 10 < e ≤ 12 → 100/80/80; 12 < e ≤ 20 → 120; 20 < e ≤ 30 → 850 slot (200 when slot length ≤ 65) / 120; 30 < e ≤ 40 → 850/200/120; 40 < e ≤ 120 → 850; slots > 180 and square/round > 240 admit full body); Table 2 reach-over distances (worked rows for hazard at 2,400 mm: 1,100/1,000/900/800/700/600/400/300/100 for structure heights 1,000–2,500 mm) as reproduced in Troax's machine-guard safety guide (which also notes protective structures below 1,400 mm should not be used without additional measures), Prismont panel documentation, and Satech's modular-guard catalogue (19 mm slot → 120 mm installation distance); floor-gap/whole-body considerations per the 2019 edition's clause 4.4 as summarised in vendor documentation; the 22 × 100 × 3 mm mesh = 19 mm clear aperture worked example established here from the slot rules. [5] ISO 14119 — interlocking devices associated with guards: device types 1–4 (plus trapped-key systems), coding levels (low 1–9, medium 10–1,000, high > 1,000), defeat definitions, and the requirement to minimise motivation to defeat, with measures ranked (access prevention, non-detachable fasteners, coded actuators, plausibility/cyclic testing) as presented in MachineBuilding.net's explainer, ReeR's summary tables, Fabrico's selection guide, and LegalClarity's defeat-measures analysis. [6] ISO 13850:2015 (Emergency stop function — principles for design) and IEC 60204-1 (Electrical equipment of machines — stop categories 0/1/2; e-stop realisation restricted to category 0 or 1; reset by deliberate action; direct opening action per IEC 60947-5-1 Annex K; mounting ergonomics ~0.6–1.7 m). [7] ISO 13851:2019 (Two-hand control devices): three types by functional characteristics; synchronous actuation and release-before-restart requirements; prevention of defeat (one hand + elbow/knee, blocking of actuating devices); note that THCDs protect only the actuating person — per ISO documentation and industrial-implementation summaries. [8] Press standards: EN ISO 16092-1:2017 (general; verification table; operating-mode selection as safety function with PL; movable-panel e-stop status indication; two-hand control as sole measure restricted to narrow presses, ~650 mm typical) and parts -2/-3/-4 (mechanical/hydraulic/pneumatic) per Pohlann's structure analysis and ISO catalogue scope notes; EN 12622:2009+A1:2013 for hydraulic press brakes (front protection by AOPD/light curtains, EN 13985 slow-speed ≤ 10 mm/s setting modes, redundant anti-descent provisions, minimum-distance annexes) per CEN scope text and the SIS/ITeh catalogue entries; additionally 29 CFR 1910.217 (US mechanical power presses: presence sensing, two-hand trips, brake monitors) and 1910.212 (general machine guarding). [9] OSHA — 2025 civil penalty adjustments (news release 14 Jan 2025 and penalties page): serious/other-than-serious max 16,550 per violation; willful/repeated max 165,514 per violation; failure-to-abate $16,550 per day; lockout/tagout procedure per 29 CFR 1910.147 (isolation, locking, stored-energy release, verification) as summarised in the OSH Act enforcement materials. [10] U.S. Bureau of Labor Statistics — Census of Fatal Occupational Injuries: 5,283 fatal work injuries (2023) and 5,070 (2024); 779 contact-with-objects-and-equipment fatalities in 2023 (756 in 2024), including 226 (2023) and 213 (2024) "struck, caught, or compressed by running powered equipment"; manufacturing 391 fatalities and 120 contact incidents (2023) — CFOI Tables A-1/A-7 and the 2023–24 event tables. [11] ISO 10218-1:2025 and ISO 10218-2:2025 — Robotics — Safety requirements (3rd editions, published 2025-02; Part 1 95 pages; Part 2 absorbing the biomechanical contact limits formerly in ISO/TS 15066 as formal requirements) per ISO catalogue entries and standard-package descriptions; ANSI/RIA R15.06-2012 as the harmonised US counterpart. [12] ISO/TS 15066:2016 — Collaborative robots (still current, reviewed and confirmed 2022): four collaborative operation modes (safety-rated monitored stop, hand guiding, speed and separation monitoring, power and force limiting); Annex A quasi-static contact limits as universally reproduced (skull/forehead 130 N, face 65 N, chest 140 N, hand 140 N; transient ≈ 2× quasi-static for most regions while head regions stay most conservative; pressure limits in N/cm²; 80 W power ceiling in quasi-static conditions) per the technical specification and its summaries in FedLaws/LegalClarity cobot-safety analyses and NIST background papers. [13] NIST — Marvel & Norcross, "Implementing Speed and Separation Monitoring in Collaborative Robot Workcells," Robotics and Computer-Integrated Manufacturing 44 (2017) 144–155 (the SSM separation-distance form S = S_h + S_r + S_s + C + Z_d + Z_r + Z_s, term definitions, and human/robot travel decomposition derived from the ISO 13855 approach model), and NIST IR 7851 (SSM testbed, worst-case 2.0 m/s approach evaluations). [14] DGFASLI (Directorate General Factory Advice Service & Labour Institutes) — occupational safety and health data for registered factories, 2023 returns (353,950 registered factories; 19,965,085 workers; 975 dangerous occurrences; 1,090 fatal injuries; 2,949 non-fatal injuries; fatal-injury rate 5.46 per lakh workers; 3.08 fatal injuries per 1,000 registered factories) via the compiled Standard Reference Note datasets. [15] NCRB — Accidental Deaths & Suicides in India: factory/machine accidents 762 (2023) and 742 (2024); deaths 670 (2023) and 660 (2024) via the compiled ADSI dataset (2001–2024). [16] The Factories Act, 1948 — Chapter IV ss.21 (fencing of machinery; Gujarat occupier-burden case as summarised in compliance commentary), 22 (work on/near machinery in motion; trained adult workers; clothing), 23 (young persons on dangerous machines), 24 (striking gear; power cut-off devices; locking in safe position), 25 (self-acting machines; 45 cm traverse clearance), 26 (casing of new machinery; seller/hirer liability), 40 (inspector's power over unsafe machinery), 40B (safety officers where 1,000+ workers or hazardous process), 41H (workers' right to warn of imminent danger); penalties ss.92 (up to 2 years and/or ₹1 lakh; not less than ₹25,000 fine where contravention causes death), 94 (repeat offences up to 3 years, ₹10,000–2,00,000), per the Act text as published by the Maharashtra Labour Department and consolidated references; OSH & Working Conditions Code, 2020 as the consolidating statute being phased in. [17] Machine-safety market sizing: MarketsandMarkets (USD 5.66 bn 2025 → USD 7.45 bn 2030, 5.7 % CAGR; segments: presence-detection sensors, safety controllers/relays, interlock switches, e-stops, two-hand controls; Asia-Pacific fastest-growing) and The Business Research Company (USD 6.17 bn 2025 → USD 9.16 bn 2030, 8.2 %) with the corresponding PRNewswire release. [18] Indicative Indian component pricing, October 2026: IndiaMART listings for domestic Type 4 safety light curtains (₹5,000–5,500 per unit/pair ex-tax, Nashik OEMs; 20–30 mm resolution; 300–600 mm protective heights), Omron F3SJ finger-protection curtain (₹10,000/piece small height; advanced types ₹19,750–46,450), safety relays (Allen-Bradley MSR127TP-class ₹7,000–8,000; Pilz 774080 dual-channel ₹10,500; ABB dual-channel ₹36,000; generic 2-channel force-guided modules ₹10,500); labour and validation lines in the worked budget are this guide's estimates for Indian integration rates, to be re-quoted locally. [19] Background on global occupational harm: ILO estimates of work-related fatalities on the order of three million per year (order-of-magnitude context only; national reporting systems differ in scope).

Note on sources: ISO, IEC, EN and OSHA texts are the governing documents for every specification in this guide; where this guide states thicknesses, distances, limits or worked numbers, they are the values of the cited editions and mainstream 2026 interpretations of them, or arithmetic performed on publicly documented datasheet and price values — always re-run the numbers on your machine's own measured stopping times, your components' own certificates, and your state's own Factories Rules, because processes, prices and enforcement each move, and safety is a contract with the standard, not with a brochure.

More FabFlow blog posts