Machine Guarding Design and Safety Standards

Motionwell Automation designs and builds machine guarding in Singapore, and the machine guarding standards that decide what a guard physically looks like are rarely the ones named in a tender. ISO 13857 fixes reaching distances, which pairs mesh aperture with standoff. ISO 13855 fixes where a safety laser scanner or light curtain may sit, from stopping performance measured on the built machine. ISO 14119 decides whether an access door is switched or locked, and how hard it is to defeat. ISO 13849-1 rates the circuit behind all of it. Delivered guarding scope on our machines includes guard fencing and interlocked access doors, guard locking, safety laser scanners, safety-rated stop circuits, LVD and CE testing, and Ministry of Manpower lifting certification where the machine lifts loads.

This page is about the guard as a built object: which type belongs at each opening, how far back it has to stand, how large its holes can be, how people get in for setup and out again, and how a guard turns into a hazard of its own. The process that produces those decisions (risk assessment, required Performance Level, validation and the technical file) is set out on our machine safety compliance and CE marking page, and everything below assumes it has been run.

Why Is Machine Guarding Required?

A hazard that cannot be removed by design has to be separated from people by something physical, and a barrier still works when a procedure is forgotten. In Singapore the Workplace Safety and Health Act requires dangerous parts of machinery to be securely fenced, and binds the occupier as well as anyone supplying machinery for use at work.

What Are the General Machine Guarding Guidelines?

Select the guard type at each opening from how often a person genuinely has to get in. Where nobody needs access between planned maintenance, use a fixed guard fastened so a tool is needed to remove it. Where an operator has a production reason to open it, use an interlocked movable guard, and add guard locking whenever run-down time after the stop command exceeds the time it takes to reach the hazard. Use a light curtain or a safety laser scanner where material or people cross the boundary continuously and a door would become an obstacle. Then position all of it by calculation: reaching distances from ISO 13857, detection distances from ISO 13855 using stopping performance measured on the machine you actually built. A fence placed by eye reads as safe on the general arrangement drawing and is reached before the motion stops.

If you have a machine with a guarding gap to close, talk to an engineer.

Which Guard Type Belongs at Each Opening?

Guard selection is done per opening. A multi-station machine has an operator loading position, a material infeed, a product exit, two or three maintenance panels and a route for a pallet truck, and those six openings can easily need four different answers. Deciding the type once for the whole enclosure is what produces the two familiar failures: a fence with a door in it that is propped open all shift, or a light curtain across an opening that only ever passes a pallet.

A fixed guard is the cheapest thing to own. There is no circuit, no diagnostics, no reliability data to keep and nothing to fail. It is the right answer wherever access belongs to maintenance with the machine isolated. Its weakness is human: a fixed guard that gets removed weekly is a fixed guard in name only, and once panels start living on the floor beside the machine, nothing about the safety case is still true.

A movable interlocked guard buys routine access and costs a safety function. Each door becomes its own line in the safety function register with its own required Performance Level, its own devices, wiring and diagnostics, and its own entry in the validation record. Two doors where one would do is not a small decision.

Guard locking is the same door with the ability to keep it shut until the hazard has actually gone. It is required where the machine takes longer to run down than a person takes to reach the danger, and it is released by a standstill monitor during commissioning.

An electro-sensitive protective device, a light curtain or a safety laser scanner, removes the physical barrier entirely at that opening. That is exactly what makes it useful for continuous material flow and exactly what makes it fragile: it detects an approach and nothing else, so anything that lets a person stand behind the detection plane undetected destroys the protection unless a restart interlock or presence detection is added.

What Does a Fixed Guard Have to Survive?

Two things, and neither is structural. First, it has to stay fixed: fasteners that need a tool, and captive fasteners so that the hardware is still there when the panel goes back. Second, it has to be practical to remove for the job it exists to allow. Size panels so that one person can take one off, carry it and refit it, and leave somewhere to put it down. A panel that needs two people and a trolley is competing with the shift schedule every time it is opened, and that competition has a predictable winner.

How Does Stopping Time Set the Position of the Fence?

For a detection device, minimum distance is not a preference. ISO 13855 derives it from the approach speed constant K, taken as 2,000 mm/s up to 500 mm and 1,600 mm/s beyond, multiplied by the total system stopping performance, plus a penetration factor for how far a body part gets past the detection plane before it is seen.

The term that carries the uncertainty is stopping performance, because it is a chain: sensor response, safety controller processing, output contactor drop-out, then the mechanical run-down of whatever was moving. Only the first three come with datasheets. The last one is a property of the built machine (its inertia, its brake, its load at the moment of the stop) and it is measured. On a servo indexing machine (a 12-station rotary dial, for example) run-down at the moment of a full index is not the same as run-down at rest, so the measurement is taken at the worst credible instant. The indexer, dial and station choices that set that run-down are worked through in our guide to how we design multi-station rotary assembly machines.

This is where guarding cost is decided long before anyone prices fence panels. A slower stop means a larger minimum distance, a larger distance means a larger enclosure, and a larger enclosure means floor area in a Singapore facility you pay rent on every month. Drive sizing, brake selection and stopping category are guarding decisions wearing different job titles.

The retrofit case deserves stating plainly because the guard usually stays and the machine underneath it does not. Replacing ageing servo drives and a controller changes run-down behaviour in ways no datasheet predicts, so the distance calculation that justified the existing fence position is no longer evidence. Re-measure, re-derive, then move the fence line or the scanner field if the number moved. That measurement belongs in the scope of any control system modernisation as a named commissioning deliverable.

How Do Opening Size and Reach Distance Fix the Mesh?

Aperture and standoff are a single decision under ISO 13857, taken together or taken badly. A small opening admits a finger; a larger one admits a hand and then an arm, and each admits it further. So the standard pairs the size of the opening with how far the barrier must stand from the hazard behind it, and the two cannot be specified in different meetings.

The practical order is: fix the standoff you can afford in floor area, then take the aperture that goes with it. Reversing that order is how a fence gets built from whatever mesh was in stock and then quietly fails an assessment. Where floor area is genuinely unavailable and the hazard sits immediately behind the panel, the answer is not finer mesh but a solid panel, because at that point you are enclosing.

Three geometry traps come up repeatedly on layouts we review:

• Reaching over the top. Over-fence reach depends on the height of the hazard and the height of the barrier together, so a fence height that is adequate in front of a low hazard is not adequate in front of a high one. Raising a fence is cheaper at design stage than after the frame is welded.
• Reaching underneath. The floor gap that cleaning staff ask for and the gap a person can reach or crawl under are the same gap. Decide it once, with both requirements on the table.
• Standing surfaces nobody drew. Reaching distances assume where a person’s feet are, and a pallet stack, a step, a stillage or a tote bin parked beside the fence raises the feet and shortens every reach in the calculation. Guarding that depends on floor level belongs with a marked exclusion zone that keeps the floor clear.

When Does an Interlocked Door Need Locking Instead of a Switch?

The primary test is timing. If run-down time after the stop command exceeds the time it takes to reach the hazard, plain interlocking is not enough and the guard needs locking, released by a standstill monitor. The second test is process: where opening the door mid-cycle would spoil containment, extraction or a controlled atmosphere, locking protects the process as well as the person, and both reasons end up in the same hardware.

Locking creates a hazard of its own the moment a person can be fully inside the guarded space. A door that stays shut until standstill is a trap if the standstill happens to arrive with somebody in the enclosure. Locking doors on any guard large enough to walk into need a release operable from inside, positioned where a person who has just been shut in can actually reach it, and that requirement changes the door hardware and the panel layout. A label does not satisfy it.

ISO 14119 covers device selection and how hard each is to defeat. Coded magnetic and RFID interlocks belong anywhere an operator has a production reason to want the door open, and the mounting matters as much as the device: concealed fixings, a switch positioned so a spare actuator cannot simply be presented to it, and no convenient bypass point in the wiring.

Defeat is rarely about discipline. It is usually a symptom that a real task cannot be done with the guard shut, a jam cleared, a feeder replenished, a position taught. The design answer is to provide that mode safely, with limited speed, hold-to-run control and an enabling device, so that the door does not have to be beaten to get the work done. The circuit that carries any of this to Performance Level d is a controls question, covered on our safety circuit and control panel design page.

How Does Product Get In and Out Without Giving a Hand a Route In?

Every enclosure has to let material through, and every material opening is a hole in the argument. Three approaches close it, and each one works.

Make the opening too long to reach through. A tunnel section sized so that reach under ISO 13857 cannot arrive at the hazard needs no sensing at all, has no failure mode, and costs only length. Where the product allows it, this is the answer with the least to go wrong for the life of the machine.

Mute a detection device. A light curtain across the opening, muted by a sensor arrangement that recognises the material profile and rejects a person, is the standard approach where the tunnel would be impractically long. Muting is where the design effort actually goes: sensor geometry, sequence and timing have to distinguish a pallet from a person including a person walking directly behind the pallet, and the logic gets validated against the profile it is supposed to accept, not against the profile it happened to see during commissioning.

Remove the opening from the operator’s world. On end-of-line cells, a full pallet either leaves through a muted opening for a manual forklift pull, or it leaves on an automated discharge conveyor to a stretch wrapper. The second has an opening that only ever passes a pallet on a conveyor and a fixed guard everywhere else, and that is a smaller safety case to build and to keep. The trade-offs across cell types are on our automated palletizing systems page.

What Does Setup and Maintenance Access Change About the Guard?

Setup, cleaning, fault clearing and teaching are the modes where guards get opened deliberately, and they are the modes a perimeter fence designed around normal production tends to serve worst. Three design consequences follow.

Whole-body access changes the restart rules. Where a person can get fully inside the guarded space, closing the door proves nothing about whether the space is empty. The reset device sits outside the hazard zone with full view of it, the machine does not restart on guard closure alone, and on large enclosures a physical or sensed check that the space is clear is part of the sequence.

Devices mounted on the guard have to be reachable. Interlocks, scanners and curtain columns need cleaning, alignment checks and occasional replacement. A scanner mounted where a technician has to climb the fence to reach it will be aligned by someone standing on something that was never meant to be stood on. Access to every safety device is therefore a guard layout requirement, settled on the drawing with the panel positions.

The guard has to allow the job it blocks. If clearing a jam requires reaching into a station, either the station gets a local access door with its own interlock, or the machine gets a safe slow-speed mode, or the jam gets designed out upstream. Choosing none of the three is choosing that the guard gets defeated.

How Does a Guard Become a New Hazard?

A guard is part of the machine, so it goes into the risk assessment as a source of hazards as well as a control measure. This is the section that gets skipped, and the resulting problems are all mechanical, all obvious in hindsight and all cheap to fix on the drawing.

The last row is not a corner case. On the cleanroom automated test equipment we built, the guard enclosure also carries the fan filter units and has to preserve downward airflow, which makes it a process component that happens to be a guard. The same logic runs the other way on abrasive processes: a sealed cabinet with an interlocked, locking door and extraction interlocked to start is the guard, the containment and the ventilation in one assembly. Cleanroom-specific enclosure constraints are covered on our cleanroom automation equipment page.

What Must the Guard Contain as Well as Enclose?

Keeping people out is one requirement. Keeping things in is a separate one, and it decides panel material, frame design and fixings more than the reach calculation does.

Ejected parts, blasting media, swarf, spray and process fluids all need retention, and retention is a property of the whole assembly. Panel thickness on its own is not the answer if the frame, the fixings and the joints let the panel move or let the fragment through a seam. Where something can be thrown, the guard is designed as a containment structure with a barrier function, in that order.

Noise, light and atmosphere are the quieter containment requirements. An enclosure changes what reaches the operator outside it, and it also changes what a person is exposed to during setup inside it. A welding or laser process changes the panel specification entirely, because now the panel is protecting eyes as well as hands.

One boundary worth stating clearly, since it decides where the money goes: where the layout is rectangular, the openings are ordinary and nothing has to be contained, a standard modular fence system is the right thing to buy and we will specify one. A fabricated enclosure earns its cost when geometry, containment, airflow or cleaning rules the kit out, and the two get combined more often than either gets used alone, with a modular perimeter and a fabricated section where the process lives.

What Changes When a Robot Is Inside the Guard?

The robot itself is covered by ISO 10218-1:2025 and the integrated system by ISO 10218-2, and the guarding around it is still ordinary guarding: the same reaching distances, the same interlock selection, the same detection device positioning. Three things do change.

The guarded envelope is not the robot’s reach envelope. It is reach plus the tool plus the part in the tool plus whatever the part does if it is released, which is why a fence set out from a reach radius on a datasheet ends up too close on the built cell.

A robot on a linear track guards a corridor. The safeguarded space is as long as the rail, and the moving carriage creates a trapping point against every fixed object beside it for the whole stroke, whether or not the arm is moving. Reaching distances apply along the entire length. That geometry is discussed on our robot 7th axis linear track page.

The standards references moved recently. ISO 10218-1:2025 is the third edition and the first substantive revision since 2011, adding robot classifications with matching functional safety requirements, safety-related cybersecurity requirements and end-effector guidance, and most of what ISO/TS 15066:2016 said about collaborative operation now sits in Part 2. It references ISO 13849-1:2023 for the control system safety functions, so a cell documented against the 2015 edition will need its PL calculations restated when it is re-assessed.

Collaborative applications do not remove the guard, they relocate it. Where the hazard sits in the gripper, the workpiece or the load, force limiting addresses none of it and physical safeguarding goes around the hazard: fixed guarding under a pallet zone, a scanner covering an approach, a barrier at a station with a sharp tool. Which mode fits which task is worked through in our guide to collaborative robot safety standards.

What Should a Guarding Scope Say Before It Is Priced?

A guarding quotation built from a perimeter length and a door count is a guess wearing a decimal point. What makes it a real number is the same information the design needs anyway.

Send the general arrangement drawing with every opening marked and what crosses it. List the operating modes, including setup, cleaning, fault clearing and teaching, and say who does each and how often. State the stopping performance if it has been measured, or say that it has not. Mark forklift and pedestrian routes, ceiling height and floor flatness. Say whether anything is ejected, extracted or kept clean, what cleaning agents are used, and whether a robot or a mobile robot shares the space. Name the destination market, because it changes the electrical build behind the guard.

What moves the price, without ranking the items, because there is no cost breakdown here to rank them with:

• Perimeter length and geometry. Enclosure cost follows the shape chosen at layout, not the severity of the hazard, and an awkward footprint costs twice: once in panels and once in the non-standard sections.
• Number of access points. Each door is a safety function with devices, wiring, diagnostics, calculation and validation behind it.
• Locking versus switching. Solenoid locking, standstill monitoring and an internal release are a different bill of materials from a coded switch.
• Sensing and muting. Scanner zones, multi-beam arrays and muted openings add configuration and validation time on top of the hardware.
• Containment duty. Retention, extraction, cleanroom airflow or optical protection change the panel and frame specification.
• Validation evidence. Fault injection, stopping time measurement, muting checks and scanner zone verification are engineering hours with records attached.

Where Is a Guard’s Cost Actually Decided?

Machine guarding standards do not produce a shape, they produce constraints, and the guard is what remains when all of them are satisfied at once: aperture paired with standoff under ISO 13857, detection distance derived from measured stopping performance under ISO 13855, interlock selection and defeat resistance under ISO 14119, and each safety function rated under ISO 13849-1. Everything expensive about a guard is decided at layout, when the perimeter, the access points and the material paths are still lines on a drawing.

Singapore does not require CE marking, but the fencing duty under the Workplace Safety and Health Act applies whether or not the machine carries a mark. We deliver the physical scope that follows: guard fencing and interlocked access doors, guard locking, safety laser scanners, safety-rated stop circuits, LVD and CE testing, and Ministry of Manpower lifting certification where the machine includes lifting equipment. Machines are assembled and tested at our Woodlands Link facility before they ship, under ISO 9001:2015 and bizSAFE Level 3.

Frequently Asked Questions

Can we keep the existing guard fence when the machine inside it is retrofitted?

Only after stopping performance has been measured again. Scanner and light curtain positions under ISO 13855 are derived from the total time the machine takes to stop, and new drives, new brakes or a changed load move that time even when the mechanics look identical. A control system retrofit therefore invalidates the distance calculation that put the fence where it is, ahead of the wiring diagram. Re-measure stopping performance on the rebuilt machine, re-derive the minimum distance, and move the fence line or the scanner field if the number moved. Reaching distances under ISO 13857 need re-checking too if any opening, panel or standing surface changed during the work.

Should guard panels be welded mesh or solid and transparent?

Choose by what the guard has to do besides keep people out. Mesh is open, light and straightforward to modify, and it passes air, light and sight lines, which suits a perimeter fence around a cell where nothing is thrown and nothing has to be kept clean. Solid or transparent panels are for containment and separation: media, spray, swarf, noise, or a controlled atmosphere. Either way the aperture and the standoff distance are one pair under ISO 13857, so mesh close to a hazard needs a small aperture while the same mesh further back does not. Check the panel material against the cleaning agents used on the line before specifying it.

Who is responsible when an operator defeats a guard interlock?

In Singapore the Workplace Safety and Health Act places duties on the occupier of the workplace and on anyone supplying machinery for use at work, so the plant running the machine and the builder who designed the guard both carry obligations. The designer does not get to treat defeat as somebody else's problem. ISO 14119 asks for interlocking devices selected and mounted so that defeat in a reasonably foreseeable manner is difficult, which is why coded magnetic or RFID switches belong at any door an operator has a production reason to open. The more durable fix is to remove the reason: if setup or fault clearing cannot be done with the guard shut, provide a safe mode for it.