# Robot safety validation in India: proving the cell stops

> Validate an industrial robot cell in India: measure stopping time, calculate safety distance to ISO 13855, verify the safety circuit and record the evidence.

Canonical: https://roboticsengineering.in/robot-safety-validation-india/ | Published: 2026-10-31 | Updated: 2026-11-01 | Author: Jignesh Panchal

Ask a plant manager whether the robot cell is safe and the answer is usually “yes, it has a fence and an interlock”. Ask for the document that proves the interlock stops the arm before a person can reach it, and the conversation stops. The fence is visible. The proof does not exist.

Safety validation is the step that turns a design into evidence: the stopping time was measured, the safety distance was calculated from that measurement, the safety circuit was tested against its required performance level, and the whole thing was signed by someone competent to sign it. Without it, a cell can look compliant and still hurt someone.

This is the third document in a set. A [safety audit](https://roboticsengineering.in/robot-cell-safety-audit-india/) finds what a running cell has drifted into. The [commissioning checklist](https://roboticsengineering.in/robot-cell-commissioning-checklist/) covers the build. Validation is the proof that sits underneath both, and it is the one Indian plants most often skip because nobody asks for it until an inspector or a customer audit does.

## What validation is, and what it is not

Three activities get confused because they all involve safety and all produce paper. They answer different questions:

| Activity | Question it answers | Typical timing |
| --- | --- | --- |
| Risk assessment | What can hurt someone, how badly, and what will we do about it? | Before design |
| Validation | Does the built machine actually do what the risk assessment assumed, measured? | Before handover, and after any change |
| Audit | What has the machine become after months of production pressure? | Periodically, and after modifications |

Validation is measurement, not opinion. “The interlock works, we tested it” is not validation. “The guard door interlock opens the safety output, the robot stops in 0.42 s from full speed at the worst-case program point, the light curtain is mounted at 550 mm and the calculated minimum distance is 480 mm, and the safety function is dual-channel with cross-monitoring on a Category 3 architecture” is validation, because every claim has a number or a wiring fact behind it.

## Four things that have to be measured or verified

A validation that covers only the devices is incomplete. These four items are the minimum for an industrial robot cell under [ISO 10218-2:2025](https://www.iso.org/standard/73934.html), and each fails independently.

### 1. Stopping performance

The robot’s stopping time and stopping distance, measured at the worst case, not the average. The worst case is usually the fastest point of the fastest program with the heaviest payload the cell is allowed to run, at the end of the arm’s reach where inertia is highest. If the plant runs three programs, measure the one with the highest speed and payload combination.

This number is the input to everything else. Change the payload, the gripper, the program speed or the brake condition and the number changes, which is why validation is tied to a configuration and not to a machine nameplate.

### 2. Safety distance

Every protective device — light curtain, laser scanner, fence opening, two-hand control — has a minimum distance from the hazard. That distance is calculated, not chosen by eye, using the method in [ISO 13855:2024](https://www.iso.org/obp/ui/#iso:std:iso:13855:en):

**S = K × T + C**

- **S** is the minimum distance from the detection zone to the hazard.
- **T** is the overall system stopping time: the robot’s own stop time plus the response time of the safety device, the safety controller and any valve or drive delay in the chain.
- **K** is the approach speed of a person, set by the standard.
- **C** is the intrusion distance for the detection capability of the device.

Take K and C from the current edition of the standard for the device type and resolution you actually installed. Do not carry them from an older copy of the standard or from a supplier’s quick guide, because both the approach speed treatment and the intrusion allowances have been revised. The only number from your plant in this formula is T, and T is only as good as the measurement in step 1.

### 3. Safety function integrity

Each safety function needs a performance level, and the circuit needs the architecture that delivers it. Under [EN ISO 13849-1:2023](https://www.cencenelec.eu/news-events/news/2023/eninthespotlight/2023-05-25-en-iso-13849-1-2023/), the performance level comes from the combination of category, mean time to dangerous failure, diagnostic coverage and common cause failure measures. In practice, for a robot cell, that means checking on the panel:

- Are the safety inputs dual-channel, or is one channel a single wire that a single fault can defeat?
- Does the controller actually detect a discrepancy between the two channels, and does that detection stop the robot?
- Is the reset performed outside the safeguarded space, so a person cannot reset while standing inside it?
- Does a single component failure — a stuck contactor, a welded relay contact, a shorted input — leave the cell safe?
- Are muting and manual-mode reduced speed implemented as designed, and tested in the state they will be used?

This is where a [safety relay and a safety PLC](https://roboticsengineering.in/safety-plc-vs-safety-relay-guide/) stop being interchangeable. The architecture has to match the claim, and the claim has to be argued in the risk assessment, not assumed because the part carries a logo.

### 4. Physical safeguarding geometry

Distance is not the only geometric check. Fence height and mesh size are governed by reach-over and reach-through limits in [ISO 13857:2019](https://www.iso.org/standard/69569.html), and guard doors are governed by [ISO 14119:2024](https://www.iso.org/standard/75942.html). A cell can pass its stopping distance calculation and still fail because someone can reach over the fence top, or because the door interlock is easy to defeat with a spare actuator. The same arithmetic decides where a [laser scanner or light curtain](https://roboticsengineering.in/safety-laser-scanner-guide-india/) is mounted, which is why the device cannot be validated separately from the robot it protects.

## How stop-time measurement is actually done

In a typical Indian installation the measurement looks like this:

1. Configure the cell to its worst-case program, payload and speed. Warm the robot to normal running temperature, because brakes behave differently cold.
2. Connect a stop-time analyser to the safety output and to a motion reference — usually a speed signal or an encoder output. The analyser starts its clock when the safety output drops and stops it when motion ceases.
3. Trigger the stop the way the safety function will trigger in use: open the guard door, break the curtain, press the emergency stop. Measure the function, not the emergency stop alone.
4. Repeat at least ten times and record every result. Report the longest time and the spread, not the average. A single fast result proves nothing.
5. Repeat at the other trigger points and in manual mode if reduced speed is the only protection there.
6. Add a margin for brake wear and for any maintenance the cell will receive over its life before you use the number in the distance calculation.

The output is a table, not a sentence: trigger point, program, payload, every measured time, the maximum, and the configuration it belongs to. That table is what a customer audit or a safety inspector will ask for, and it is the only defensible answer to “how do you know”.

## What a validation report contains

| Section | Evidence expected |
| --- | --- |
| Scope and configuration | Cell layout, robot model, programs, payloads, software version, list of safety functions |
| Risk assessment reference | The hazards, the required performance level per function, and the design decisions they drove |
| Stopping measurements | Raw results per trigger point, worst case, measurement instrument and its calibration |
| Distance calculations | The ISO 13855 calculation for each protective device, with the K, T and C values used and the device resolution |
| Circuit verification | Wiring as built, category and diagnostics argued against the required performance level, fault tests performed |
| Functional tests | Each safety function tested in use, including defeat attempts on interlocks and reset from inside the cell |
| Deviations | Anything that does not meet the design, with the interim measure and the date it will be corrected |
| Sign-off | Who validated, against which standards, and the configuration the result applies to |

The last row matters more than it looks. A validation applies to the machine as configured on the day. When the plant changes the gripper, raises the speed or moves the scanner, the report is no longer current, and a validation that does not say so invites people to rely on a document that describes a different machine.

## The failures that show up again and again

- **Stopping time never measured.** The scanner was mounted at a distance the installer considered sensible, and nobody can show the calculation.
- **Measurement done at reduced speed.** The cell was validated in a slow test program, then commissioned at production speed.
- **Interlock on one channel.** A dual-channel safety device wired to a single input, with the second contact left unused.
- **Reset inside the safeguarded space.** The reset button is reachable from inside the fence, so a person can restart the cell while still in the hazard zone.
- **Validation done once.** The cell has since gained a conveyor, a new part and a faster recovery routine, and the report still describes the original build.
- **No configuration record.** The report does not state the payload or program it was measured at, so nobody can tell whether it still applies.

Each of these is cheap to find and expensive to discover after an incident. The [audit](https://roboticsengineering.in/robot-cell-safety-audit-india/) and the [standards overview](https://roboticsengineering.in/robot-safety-standards-india/) will tell you which of them your cell has.

## Where this sits under Indian law

The Factories Act, 1948 was repealed on 21 November 2025, when the Occupational Safety, Health and Working Conditions Code, 2020 came into force. The Code keeps the core duty that matters here: the employer must ensure that machinery and equipment are safe, and that persons who operate them are protected. A validation report is not a legal certificate, and no Indian standard law says “keep a stopping-time table”. But when something goes wrong, the question asked is whether you took reasonable steps to identify and control the hazard, and a measured, signed, configuration-specific validation is a very different answer from a fence.

If the cell sits inside a plant supplying an automotive OEM or an export customer, the customer’s own process audit will usually ask for exactly this document, in exactly this form, before awarding new business.

## What to ask for, and from whom

Validation needs someone competent in machinery safety, not only in robots. The robot integrator knows the robot; the safety function spans the robot’s controller, the safety relay or PLC, the protective devices and the tooling. On a small Indian cell this is often one person from the integrator’s side plus the plant’s electrical maintenance engineer, with the calculations reviewed by a third party.

Ask any supplier three questions before accepting a validation:

1. Will you measure stopping time at the worst-case program and payload, and give me every measurement?
2. Will you show the ISO 13855 calculation for each protective device, with the values used?
3. Will the report state the configuration it applies to, and what we must do when that configuration changes?

A supplier who answers all three in writing is doing validation. A supplier who promises “safety as per standards” is selling a fence.

The level one safety function needs, and what to check in a supplier’s calculation, is in [the ISO 13849 performance level guide](https://roboticsengineering.in/iso-13849-performance-level-india/).

## Frequently asked questions

**Is safety validation mandatory for a robot cell in India?**

No single Indian regulation mandates a validation report by name. The employer's duty to keep machinery safe under the Occupational Safety, Health and Working Conditions Code, 2020 does apply, and customer audits and export requirements frequently demand documented validation. In practice the obligation arrives through the customer or through liability after an incident, not through a named rule.

**How often should a robot cell be validated?**

At commissioning, after any change to the cell, the program, the payload, the guarding or the safety circuit, and on a periodic basis you can defend. The measurement is tied to a configuration, so the trigger is change rather than the calendar; a two-shift cell with heavy use also deserves a periodic re-measurement because brakes and devices wear.

**Can I validate the cell myself?**

You can perform the measurements and tests yourself if you have a stop-time analyser and someone competent to interpret the results against the standards. What you cannot do honestly is measure at one speed and validate at another, or write a report without the calculation. Many plants buy the measurement service and keep the report internally.

**What is the difference between a safety audit and safety validation?**

Validation proves the machine as built matches its risk assessment, using measurements taken at a known configuration. An audit inspects a machine that has been running and looks for drift: guards removed, interlocks bypassed, processes changed, documentation stale. A plant needs both, and the audit usually ends by discovering that the validation is out of date.

**Does a cobot need the same validation?**

It needs validation of its own safety functions, which are usually different: force and power limits, speed and separation monitoring, and the hand-guiding function were the assumptions. A collaborative robot removes the fence, not the obligation to prove that the monitored stop, the limit values and the end-effector design match what the risk assessment assumed.

**What does validation cost?**

It depends on the number of safety functions, the number of trigger points that need measuring, how much of the wiring is accessible for inspection, and whether the original risk assessment exists. A cell with a documented design and accessible panels is a short job; a cell with no drawings and a safety relay nobody can trace is a reverse-engineering job. Ask for the scope in functions and measurements, then compare quotes on that basis rather than on a lump sum.

## Sources and further reading

- [ISO 10218-2:2025 — robot applications and robot cells](https://www.iso.org/standard/73934.html), the cell-level safety requirements.
- [ISO 13855:2024 — positioning of safeguards with respect to approach speeds](https://www.iso.org/obp/ui/#iso:std:iso:13855:en), the safety distance method.
- [CEN-CENELEC — EN ISO 13849-1:2023 on safety-related parts of control systems](https://www.cencenelec.eu/news-events/news/2023/eninthespotlight/2023-05-25-en-iso-13849-1-2023/).
- [ISO 13857:2019 — safety distances to prevent reaching hazardous zones](https://www.iso.org/standard/69569.html).
- [ISO 14119:2024 — interlocking devices associated with guards](https://www.iso.org/standard/75942.html).
- [PRS Legislative Research — Occupational Safety, Health and Working Conditions Code, 2020](https://prsindia.org/billtrack/the-occupational-safety-health-and-working-conditions-code-2020).