Industrial Automation Safety System Design: Why Risk Comes from Engineering Decisions, Not Equipment Failure

In non-standard automation projects, the safety system is intended to serve as the final barrier protecting personnel, equipment, and production continuity. However, field evidence from numerous manufacturing plants shows a consistent pattern: frequent line stoppages and safety-related disruptions are rarely caused by mechanical failure alone. In most cases, they originate from structural flaws in safety system design.

Across production environments, issues such as false emergency stops, unstable safety door interlocks, misaligned safety light curtains, and poorly designed safety circuits repeatedly lead to unplanned downtime. Many systems operate normally during commissioning but begin to show instability after months of continuous production due to vibration, mechanical wear, dust accumulation, and inadequate maintenance design.

For export-oriented equipment, the safety system is not only a matter of production efficiency. It directly affects regulatory compliance, CE certification readiness, customer acceptance, and long-term operational risk in overseas factories.

Safety System Design Is Risk Control Engineering, Not Component Assembly

A common misconception in non-standard equipment design is treating safety systems as a simple combination of components: an emergency stop button, a safety door switch, and a safety relay.

In reality, international safety standards define safety design as a structured risk control process rather than hardware selection.

According to ISO 12100 (Safety of machinery — General principles for design — Risk assessment and risk reduction), safety engineering must follow a systematic workflow:

Hazard identification → Risk estimation → Risk reduction → Functional safety validation → Continuous verification

Risk reduction follows a three-level hierarchy:

• Inherently safe design measures (eliminating hazards at the source)

• Safeguarding and protective measures (guards, interlocks, safety devices)

• Information for use (warnings, procedures, training)

Chinese national standard GB/T 15706 aligns with this framework, requiring documented risk assessment during the design phase. However, in many non-standard projects, formal risk assessment is either incomplete or entirely absent. Emergency stop configuration is often treated as sufficient compliance, which significantly underestimates system-level risk.

The objective of a safety system is not simply “to stop the machine when something goes wrong.” The actual engineering target is:

• Prevent hazardous events before they occur

• Disconnect energy before injury becomes possible

• Ensure no unintended restart after safety activation

In essence, safety engineering is not about reacting to accidents—it is about ensuring accidents do not become possible within the system design.

Safety Integrity Levels Define the Boundaries of Risk Reduction

Safety performance is governed by functional safety standards that define how reliably a safety function can perform under fault conditions.

Two primary international frameworks are used:

• IEC 62061 / IEC 61508 using SIL (Safety Integrity Level)

• ISO 13849-1 using PL (Performance Level)

Although their calculation methodologies differ, both measure the probability of dangerous failure per hour and define the system’s risk reduction capability.

Typical equivalence is:

• PL c ≈ SIL 1

• PL d ≈ SIL 2

• PL e ≈ SIL 3

For most non-standard automation systems, PL d or SIL 2 is generally sufficient. Higher-risk environments such as automotive welding lines, semiconductor handling systems, and high-speed robotics may require PL e or SIL 3.

Importantly, higher safety levels are not inherently better. Each level increase introduces:

• Additional redundancy architecture

• More complex wiring and diagnostics

• Increased commissioning complexity

• Higher cost and longer validation cycles

The correct safety level must be derived from risk assessment results, not assumed based on perceived importance of the equipment.

Three Critical Safety Components and Their Real-World Failure Modes

Emergency Stop Systems

Emergency stop buttons represent the final manual intervention layer in safety architecture.

Field data shows that many production lines still adopt fully series-connected emergency stop circuits across multiple stations. While this simplifies wiring, it introduces systemic vulnerabilities:

• A single fault triggers a full-line shutdown

• Contact degradation in one button can stop the entire system

• Fault localization becomes time-consuming and inefficient

A more robust approach is zone-based safety design, where each risk area has an independent safety circuit managed by safety relays or safety PLC inputs. Zones are interlocked logically rather than electrically chained.

Another frequently overlooked issue is reset logic. Safe restart must always require deliberate operator confirmation. Any automatic restart after fault clearance is strictly prohibited under functional safety principles.

Safety Door Interlocking Systems

Safety door systems are among the most common sources of intermittent shutdowns in long-term operation.

Typical failure mechanisms include:

• Mechanical misalignment due to repeated operation

• Structural loosening under vibration

• Connector degradation

• Oxidation of contacts

• Poor installation tolerances

Design requirements should include:

• Installation tolerance control at assembly stage

• Dual-channel safety input architecture

• Cross-channel monitoring and diagnostics

• Mechanical anti-loosening design features

• Continuous fault detection capability

For high-duty-cycle equipment, periodic inspection of door switch resistance and actuation reliability should be incorporated into preventive maintenance systems. Safety degradation is often gradual and invisible until frequent downtime occurs.

Safety Light Curtains

Safety light curtains are widely used in material loading areas and robot interaction zones, where frequent human access is required.

Common field issues include:

• Mounting bracket deformation due to vibration

• Optical axis misalignment over time

• Dust accumulation affecting signal integrity

• Interference between adjacent light curtains

• False triggers caused by accidental contact

Resolution depends on correct application design:

• 14 mm resolution for finger protection

• 30 mm resolution for hand protection

• Multi-beam systems for body protection

A critical requirement is manual reset after interruption. Automatic restart after beam clearance is strictly prohibited, as it creates a high-risk scenario where equipment resumes motion without operator awareness.

Safety PLC vs Safety Relay: A Risk-Driven Selection Decision

Two primary architectures are used in safety control systems:

Safety Relays

Safety relays are suitable for:

• Single-machine systems

• Limited safety functions

• Simple control logic

• Cost-sensitive applications

They use forced-guided contact structures that ensure fault detection under specific failure conditions. However, as system complexity increases, relay-based wiring becomes difficult to manage and highly error-prone.

Safety PLC Systems

Safety PLCs are the standard solution for complex automation lines.

Key advantages include:

• Zone-based independent safety control

• Flexible interlocking logic

• Integrated diagnostics and fault tracing

• Easy scalability for future modifications

• Reduced wiring complexity

In automotive, lithium battery, and semiconductor industries, safety PLCs significantly reduce the scope of shutdown events. Instead of stopping entire lines, faults are isolated to specific zones, improving overall equipment effectiveness (OEE) and reducing downtime.

A critical rule in safety engineering: standard relays must never replace safety relays. Safety relays are built with force-guided contact mechanisms, ensuring that welded or stuck contacts are detectable. Standard relays do not provide this guarantee, making them unsuitable for safety functions.

Common Hidden Risks in Safety System Design

Field audits of non-standard automation systems frequently reveal recurring issues:

• Absence of formal risk assessment documentation

• Incorrect or missing safety level calculations

• Fully series-connected emergency stop circuits

• Improper safety zone segmentation

• Shared safety circuits across unrelated systems

• Insufficient diagnostic coverage

• Automatic reset logic in safety functions

• Lack of validation for safety PLC programming

• Mismatch between components and required PL/SIL levels

• Absence of lifecycle verification and maintenance procedures

These issues typically do not manifest during commissioning. Instead, they emerge gradually after months of operation, eventually leading to false trips, production interruptions, or in severe cases, safety incidents.

For export equipment, these deficiencies may also lead to CE compliance failures, FAT/SAT rejection, or audit findings during overseas customer inspections.

Safety Engineering Must Begin at the Design Stage

Safety systems are not auxiliary components of automation equipment. They are fundamental elements of system-level risk control.

A well-designed safety system must simultaneously satisfy international standards such as ISO 12100, ISO 13849, IEC 62061, and GB/T 15706, while maintaining operational stability, maintainability, and production efficiency.

Based on extensive industrial field experience, properly engineered safety systems deliver measurable benefits beyond compliance:

• Reduced personnel risk exposure

• Lower frequency of false shutdowns

• Faster fault diagnosis and recovery

• Improved equipment utilization (OEE)

• Reduced lifecycle operating costs

Ultimately, the core challenge in non-standard automation safety design is not adding more components. It is establishing a verifiable, structured, and maintainable risk control system during the design phase—one that ensures stable operation throughout the entire equipment lifecycle and supports long-term global deployment.