The fence is part of the machine

§ 1Designed in, not bolted on

A common mental model goes like this: engineers specify the arm, the integrator mounts it, then someone adds safety fencing around the outside to satisfy the inspector. That sequence is wrong, and the errors it produces are expensive. The enclosure is not an afterthought. Its dimensions, the placement of the access gates, the rated stopping distance of the arm at full speed — all of these are inputs to the cell design, not outputs.

Consider stopping distance. An arm at maximum reach and maximum velocity carries significant momentum. When a safety signal fires — a light curtain interrupted, a gate opened — the controller initiates a stop, but the arm does not stop instantly. It travels some distance before it is stationary. That distance must fit inside the enclosure before a person's hand could reach the nearest hazard point. If the cell is too shallow, the arm must be speed-limited. If the arm is speed-limited, the cycle time suffers. The fence geometry and the arm's operating envelope are therefore coupled from the first line of the layout drawing.

The same logic applies to reach. The arm's rated working envelope — the volume it can physically enter — is larger than the volume it needs for any given task. An integrator may restrict joint travel in software, shrinking the monitored space and allowing a smaller, cheaper enclosure. But that restriction has to be validated against every path the arm might ever take, including error-recovery moves and the paths generated during teaching. An envelope restriction that holds during normal production and fails during a fault is a hazard, not a safeguard.

§ 2What the enclosure actually contains

The fencing marks the boundary of a monitored zone, but the real content of that zone is a set of overlapping risks: the arm's swept volume, the trajectories of any part the arm is carrying, the reach of any tool — welding arc, laser, adhesive bead — and the ejection envelope of anything that could be dropped or flung. A weld cell must contain spatter. A press-tending cell must account for the press's own hazard zone, not only the arm's. The enclosure contains the worst-case event, not merely the normal one.

Gates and light curtains and scanners divide the zone into regions with different access rules. A maintenance gate on the far side of the cell may allow entry when the arm is in a defined rest position; the operator-side access point may require a full controlled stop and a key-operated hold-to-run mode before the door can open. These are not interchangeable. Each entry point has its own risk profile, its own required response time, and its own enabling conditions — and all of them were determined by the hazard analysis, not by what hardware happened to be available.

§ 3Speed, mode and presence

Once a person is inside the guarded zone — for teaching, for maintenance, for clearing a jam — the arm does not simply stop being dangerous. It becomes dangerous at a lower threshold. Reduced speed mode exists precisely because the hazard is not eliminated by presence; it is managed by reducing the consequences of contact and giving the person time to move clear. The teach pendant becomes the primary interface, and the enabling device on it — the three-position switch that stops the arm if gripped too hard or released entirely — is another element of the same system.

None of this works if the enclosure is treated as a separate product. The stopping-distance calculation, the speed restrictions, the entry interlocks, the teach-mode behaviour: they are all derived from the same hazard model, and that model has to account for the specific arm, at its specific reach, running its specific paths, inside its specific enclosure. Change one element and the analysis must be revisited.

The fence is not decoration. It is the outer structure of a machine that happens to have a robot inside it.

Citizen Robot is an independent publication about robot engineering. It is not a vendor, integrator, reseller or safety authority.

If the arm is speed-limited, the cycle time suffers.