No robot cell stays as designed. A jam gets cleared by reaching over the fence. A sensor is moved two inches to see a new part. A guard panel comes off to make room for a pallet and never goes back. The interlock still works, so nothing looks wrong, and nobody writes any of it down.
Then a new product arrives, a new operator is trained in ten minutes, and the cell that passed acceptance is now a different machine with the same nameplate. A safety audit is how you find out what it has become.
This is not the same exercise as commissioning a new cell. The commissioning checklist covers the build; this covers the cell you already run, and it is the one most Indian plants never do.
Why an installed cell drifts
The drift is rarely malicious. It is the accumulated result of production pressure:
- Guarding modified for access. A panel removed for maintenance, a gate propped open, a fence cut to clear a new bin.
- Interlocks bypassed to keep running. A key switch taped over, a reset bridged, a mute function left permanently active.
- Process changes. New part geometry, a heavier payload, a faster program, a different gripper than the one the risk assessment assumed.
- Layout changes. The cell moved closer to an aisle, a conveyor added, a manual station placed inside the reach envelope.
- Software changes. A program edit that raises speed in manual mode, a recovery routine that moves the arm without the guard interlock.
- People changes. Operators who learned the cell from each other rather than from the manual, and a maintenance team that has never seen the risk assessment.
Each one is small. Together they invalidate the assumptions the cell was validated against.
What triggers an audit
Two triggers, and most plants only act on the first.
Change. Any modification to the cell, the process, the product, the guarding, the safety circuit or the control software. Also a change of use: a cell built for one part family now running another. The risk assessment must be revisited whenever the machine’s behaviour or its surroundings change, which is the principle behind EN ISO 12100 and carried into the 2025 editions of ISO 10218-1 and ISO 10218-2.
Time. Even with no changes, components age, guards loosen, scanners drift, and the people who understood the design leave. A periodic audit — annually for a two-shift cell, or at a frequency you can defend — catches what maintenance reports do not.
An incident is a third trigger, and the worst one to rely on.
What the audit actually tests
An audit that consists of walking around the fence and ticking boxes is a liability document, not a safety document. Ask what is measured.
| Area | What is checked | Evidence produced |
|---|---|---|
| Scope and limits | Intended use, space limits, payload, task, and whether current use matches the original assessment | Updated limits statement, list of changes since last assessment |
| Hazard identification | Reach envelope, pinch and crush points, ejected parts, stored energy, gravity fall on power loss | Hazard register with risk ratings |
| Guards and access | Fence integrity, fixed guard fixings, gate interlocks, height and distance from the hazard | Photographs with findings, measured distances |
| Safety functions | E-stops, guard interlocks, light curtains and scanners, enabling device, reduced speed in manual mode | Function test record and measured stopping performance |
| Control system | Safety circuit architecture, category and performance level claimed versus installed, wiring as built | Circuit review against the validation record |
| Operation and competence | Who may enter, lockout procedure, recovery routine, training records, signage and language | Procedure review, interview notes, training gaps |
The fourth row is where audits earn their fee. A guard that is present but does not stop the arm before a person can reach the danger zone is not a guard; it is scenery.
Stopping performance is a measurement, not an opinion
Distance guarding depends on three things: how fast a person can approach, how long the system takes to detect and stop, and how far the machine travels while stopping. The approach speed is an assumption in the standard. The detection and stop time are properties of your cell, and they change with load, speed, brake wear and software.
So the audit should measure the stop time of each safety function at the speed the cell actually runs, then compare the resulting distance with the installed guard distance. If nobody has measured it since commissioning, you do not know whether the fence is in the right place — you only know that it is there.
This is also where a safety relay or safety PLC claim gets tested. A performance level written on a drawing is a design intent. The validation record is what shows the installed circuit achieves it, and the standard for that calculation is EN ISO 13849-1, in its 2023 edition.
The components that most often cause a finding are the ones with the least glamour: a scanner mounted too low, a curtain with a blanked-out zone that grew, a gate interlock whose actuator was replaced with a non-coded one, an E-stop on a long series chain with a response time nobody measured. The placement rules for detection devices are covered in the safety laser scanner guide, and the wider duty set in the robot safety standards that apply in India.
Who should do it
The integrator who built the cell knows it best, and is also the least independent reviewer of their own work. Both matter.
- Use the builder for the technical history, the drawings and the as-built detail. They can usually supply the validation record faster than anyone.
- Use someone independent when the question is whether the cell meets the standard, when there has been an incident, or when the builder is no longer trading or no longer responsive.
- Check competence, not certification theatre. Ask who will do the work, what they will measure, and whether they will put their name to a performance level. A report with no measurements and no named author is not an audit.
Whoever does it, the audit must end in a document you can act on: findings ranked by severity, each with the evidence, the standard it relates to, and a recommended control.
What the report must contain
- The cell as found, with photographs and serial numbers, and the date and time of the audit.
- The scope and limits assumed, and every change since the last assessment.
- A hazard register with risk ratings before and after recommended controls.
- Measured stopping performance for each safety function, and the calculated required distances.
- A findings list with severity: immediate stop, fix within a stated window, improve at next planned downtime.
- A statement of what could not be assessed, and why. This is the most honest line in any audit and the one most often missing.
If the report has no exclusions, it is not thorough; it is incomplete and pretending.
The legal position in India
The duty to keep the workplace safe rests with the occupier. Since November 2025 the Occupational Safety, Health and Working Conditions Code, 2020 has replaced the Factories Act, 1948 along with twelve other central labour laws, and it carries duties on both the occupier and the supplier. Neither replaces the other.
Practically, that means the audit is evidence of your diligence, not a transfer of your duty. Commissioning the audit and filing the report does not make you compliant; closing the immediate findings and recording that you did is what a court or an inspector will look for.
Keep the chain intact: risk assessment, validation record, audit report, corrective actions, re-test. A folder with only the first two is the state most plants are in, and it is the state that fails an inspection.
Common findings in Indian robot cells
- No validation record exists for the safety functions, only a declaration that the cell complies.
- Guard distance never recalculated after the program was sped up.
- Gate interlocks that stop the cycle but not the hazardous motion in manual mode.
- Light curtains blanked or muted to stop nuisance trips, with no record of the change.
- Manual mode at full speed, with the enabling device held in a way that defeats its purpose.
- No lockout procedure for entering the cell, and no padlock to enforce one.
- Operators trained on the job, with no record and no refresher.
- The assessment covers the robot but not the conveyor, the fixture clamp or the part transfer that injures people.
Each of these is cheap to fix before an incident and expensive afterwards.
Closing findings without stopping production
Most cells cannot be stopped for a week to fix a list. Sequence the work instead:
- Immediate: anything that could kill or maim in normal operation. Stop, isolate, fix, or restrict access until fixed.
- Short window: interlocks, muting, guard fixings, signage, lockout equipment. These are hours of work and days of paperwork, not weeks of downtime.
- Next planned stop: distance recalculations that need measurement, guard re-design (fencing costs here), control circuit changes, retraining.
- Record the interim control for anything left open, with the date it will be closed. An open finding with a plan is defensible; an open finding nobody remembers is not.
Then re-test what you changed. A modified interlock needs the same measurement as a new one, and the re-test is what turns a report into a record.
Put the periodic test in the maintenance contract, not in someone’s memory. What a robot AMC should cover sets out how to write safety function testing and measured stopping performance into the annual service, so the audit is not a one-off event.
Frequently asked questions
How often should a robot cell be safety audited?
After any change to the cell, the process, the product or the control software, and periodically even without changes — annually is a defensible frequency for a two-shift cell. The correct rule is event-driven first, calendar second.
Can the integrator who built the cell do the audit?
They can, and they often should for the technical detail and the as-built documents. For an incident investigation, a dispute, or a cell whose builder is gone, use an independent assessor. Either way, insist on measured stopping performance rather than a visual check.
What is the difference between a safety audit and a risk assessment?
The risk assessment is the design-stage analysis of hazards and controls. The audit checks whether the installed cell still matches that assessment after months or years of operation, and whether the controls actually perform as claimed.
Does an audit make the plant legally compliant?
No. The duty to keep the workplace safe rests with the occupier under the Occupational Safety, Health and Working Conditions Code, 2020. The audit is evidence of diligence; closing the findings and recording the corrective actions is what demonstrates it.
What should I do if the audit finds a serious hazard?
Stop the hazardous operation or restrict access before anything else, then fix or engineer out the hazard, then re-test and record. Do not wait for the full report if the finding is immediate — the report can follow.
How much does a robot cell safety audit cost in India?
It depends on cell complexity, the number of safety functions to measure and travel. Price it on scope — days on site, functions tested, report detail — and ask for the stopping-performance measurements to be included, because that is the part that distinguishes an audit from a walkthrough.
Where the audit ends, validation begins: how to prove the cell stops in time, using measured stopping time and the ISO 13855 distance calculation.
Sources and further reading
- IBF Solutions — the 2025 editions of EN ISO 10218-1 and -2, including the cell-level requirements
- CEN-CENELEC — EN ISO 13849-1:2023 on safety-related parts of control systems
- PRS Legislative Research — the Occupational Safety, Health and Working Conditions Code, 2020
- The Factories Act, 1948 — full text, for the duties it placed on occupiers before the Code replaced it
