June 24, 2026 · Robot System Safety
Fenceless cells are spreading fast across the West Michigan auto-supply and manufacturing base, and for good reason. Floor space is tight, layouts change, and a scanner-guarded cell is faster to reconfigure than a welded fence. Plants in Grand Rapids, Wyoming, Holland, and Kalamazoo are pulling hard guards and dropping in safety laser scanners. The technology is sound. The problem we see on audits is that removing the fence quietly moves the entire safety burden onto a risk assessment and a sensing chain that often was not engineered to carry it.
This is the engineer's walkthrough of how a fenceless cell has to be assessed, why it is fundamentally different from a collaborative application, where the safety distance math actually comes from, what performance level the safety functions need, and the specific gaps that turn up when a senior controls and EHS engineer reviews these cells. It builds on the presence-sensing detail in our light curtains and laser scanners guide and the standards stack in our ANSI, ISO, and OSHA alignment guide.
A perimeter fence is a blunt, reliable safety device. It physically prevents a person from reaching the robot, and it does so passively, with no power, no logic, and no failure mode more complex than a gate left open. When you remove it, you do not just remove steel. You remove a passive barrier and replace it with an active system that has to detect a person, decide, and stop the robot in time, every single time, including when a component fails.
That is the conceptual shift. With a fence, the safety case is mostly the guard. Without it, the safety case is the risk assessment plus the entire sensing and control chain, and the assessment has to prove that chain stops a full-speed industrial robot before a human can reach the hazard. ISO 10218-2, adopted in the US as ANSI/RIA R15.06, requires that documented risk assessment for the integrated cell. It is not optional, and a sensor data sheet is not a substitute for it.
This is the single most dangerous confusion in the field, and we flag it on cell after cell. A fenceless cell and a collaborative cell are not the same thing, and assessing one as the other gets people hurt.
A collaborative application under ISO/TS 15066 limits the robot's speed, force, and pressure so that contact with a person stays below biomechanical injury thresholds. The whole premise is that brief contact is tolerable because it cannot injure. A fenceless standard industrial robot has none of those limits. It runs at full programmed speed, full payload, full force. Contact is not tolerable, it is an amputation or worse. The fenceless cell is safe only because the sensing stops the robot before contact can occur. There is no force-limiting fallback. We cover the collaborative case separately in our ISO/TS 15066 cobot guide, and the line between the two has to be drawn explicitly in the assessment.
The practical consequence: a fenceless cell's safety distance has to assume the robot is dangerous on contact, so the sensing must guarantee a stop with the person still clear. That is a stricter requirement than a collaborative cell faces, not a looser one, even though it looks more open on the floor.
The heart of a fenceless assessment is the minimum safety distance, the gap between where the sensing field detects a person and where the hazard is. Get it wrong and the robot is still moving when a hand arrives. ISO 13855 is the method, and it pulls from several inputs that all have to be honest.
| Input | What it represents | Where it goes wrong |
|---|---|---|
| Approach speed | How fast a person moves toward the hazard | Using walking speed where a reach or lunge applies |
| Robot stopping time | Total time to bring the robot to a safe state | Spec-sheet number instead of a measured stop at load |
| Sensor response time | Detection plus signal processing delay | Omitting controller and contactor latency in the chain |
| Detection capability | Smallest object reliably detected, plus height | Coarse resolution that misses a reach-under or reach-over |
| Intrusion allowance | Extra distance for reaching past the field | Left out entirely on horizontal scanner fields |
The input that fails most often is stopping time. A robot's true stop is longer than the brochure, and it grows as the machine ages, the brakes wear, and the payload runs at the high end. ISO 10218 expects the stopping performance to be measured for the actual robot, at the actual load and speed, and re-verified over the robot's life. A safety distance computed from an optimistic stop time is undersized the day it is commissioned and gets worse every year. Measuring real stop time is one of the first things we do on a fenceless gap analysis.
Sizing the distance is half the job. The other half is that the safety functions doing the sensing and stopping have to be reliable enough that a single fault does not quietly defeat them. ISO 13849-1 is the standard, and it expresses that reliability as a required performance level.
For most fenceless safeguarding, the risk assessment lands the safety function at performance level d, built on category 3 architecture: a single fault must not cause loss of the safety function, and the fault has to be detected. In plain terms, the scanner, the safety logic, and the robot's safe-stop input all have to be safety-rated, redundant where required, and monitored. A common and serious gap is a safety scanner wired into a standard PLC input or a non-safety relay. The sensor may be excellent, but the chain it feeds does not meet the performance level, so the safety function does not actually exist at the integrity the risk demands. The whole chain, sensing to logic to the robot's safe state, has to be validated together.
Here is the gap that catches plants that did everything else right. Presence sensing protects a person during production access. It slows or stops the robot when someone crosses the field. It does nothing to control hazardous energy when a technician goes in to service the cell. The scanner can be bypassed, muted, or in a maintenance mode, and it never isolates the electrical, pneumatic, hydraulic, or stored energy in the system.
OSHA 1910.147 and MIOSHA Part 85 still require equipment-specific lockout procedures for servicing a fenceless cell, exactly as they would for a fenced one. Safeguarding and energy isolation solve different problems, and a fenceless cell needs both: the sensing for production, and a real LOTO procedure for service. We see fenceless cells with beautifully engineered scanner coverage and no cell-specific lockout procedure at all, which is its own citation. That isolation discipline is the core of our robotics gap analysis work.
Five failure patterns account for most of the fenceless findings we document across West Michigan plants.
Safety distance sized from a spec-sheet stop, not a measured one at load. The robot is still moving when a person reaches the hazard. The fix is a measured stop-time study and a recalculated distance, re-verified on a schedule.
A horizontal scanner field that handles a walk-in but misses a reach-over, reach-under, or reach-around to the hazard. The fix is detection capability and field geometry that account for every approach path, not just the obvious one.
A safety-rated scanner feeding a standard PLC or relay that does not meet the required performance level. The fix is a validated safety chain from sensor to safe-stop, rated to ISO 13849-1.
A full-speed industrial robot assessed as if force-limiting made contact safe. It does not. The fix is an assessment that treats the robot as dangerous on contact and proves the stop happens first.
Sensing in place, energy-control procedure absent. The fix is a cell-specific lockout procedure layered under the safeguarding, covering every energy source in the cell.
We will assess your fenceless cells against ISO 10218 and ANSI/RIA R15.06, measure real stopping time, validate safety distance per ISO 13855, verify the safety functions meet the required performance level under ISO 13849-1, and write the cell-specific LOTO procedures OSHA 1910.147 and MIOSHA Part 85 require. Direct line: 616-217-3325.
Request Gap AssessmentA fenceless robot cell is an industrial robot work area that uses presence-sensing safeguards, such as safety laser scanners or light curtains, instead of a hard perimeter fence to protect workers. When a person enters the sensed zone, the robot slows or stops. It is not the same as a collaborative cell. A fenceless cell still runs a standard industrial robot at full speed and force, and the sensing is what keeps people out of the danger zone, so the risk assessment carries the whole safety case.
No, and conflating them is a common and dangerous mistake. A collaborative application under ISO/TS 15066 limits the robot's speed, force, and pressure so contact with a person stays below injury thresholds. A fenceless standard industrial robot is not power-and-force limited. It runs full speed and would injure on contact, so it relies entirely on sensing to stop it before a person reaches the hazard. The two are governed differently and must not be assessed the same way.
ISO 10218-1 and 10218-2, adopted in the US as ANSI/RIA R15.06, govern industrial robot and robot system safety and require a documented risk assessment. ISO 13855 sets the method for calculating safety distance from approach speed and stopping performance. ISO 13849-1 sets the required performance level of the safety functions. OSHA 1910.147 still governs energy control for service, and in Michigan MIOSHA Part 85 enforces it. A fenceless cell has to satisfy all of these, not just the sensor spec sheet.
Using the ISO 13855 approach. The minimum distance between the sensing field and the hazard is driven by how fast a person can approach, the total system stopping time, the sensor's detection capability and response time, and an intrusion allowance. The robot must come to a safe state before the person can reach the hazard. The critical input people underestimate is the real measured stopping time of the robot at load, which lengthens as the robot and its brakes age, not the optimistic number from a spec sheet.
Most fenceless safeguarding functions land at performance level d with category 3 architecture under ISO 13849-1, meaning a single fault must not lead to loss of the safety function and the fault is detected. The exact requirement comes from the risk assessment, but a scanner wired into a non-safety-rated input or a standard PLC does not meet it. The sensing, the logic, and the robot's safe-stop function all have to be safety-rated and validated as a complete chain.
The most common findings are an undersized safety distance based on an optimistic stopping time, sensing that does not cover the full approach including reach-over and reach-around, no validated stop-time measurement, safety functions that do not meet the required performance level, and treating a full-speed fenceless cell as if it were collaborative. The other recurring gap is LOTO. Sensing protects production access, it does not isolate energy for service, and the cell still needs equipment-specific lockout procedures.
Related reading: Light Curtains and Laser Scanners for Robot Cells, Collaborative Robot Safety per ISO/TS 15066, Robot Cell LOTO Standards Alignment.