Machine Design #41: Impact Protection and Hard Stops — Do Not Make the Damper Do Every Job
A mechanism that hits a hard stop every cycle, while its damper becomes hotter and noisier, is not automatically robust. The sound and heat are evidence that energy is entering the stop chain. The design question is whether each element is performing the role it was selected for, with enough capacity and a verifiable failure state.
Planned deceleration, end-of-stroke cushioning, a shock absorber, and a hard stop are not interchangeable. The first controls velocity before impact. Cushioning manages the final part of a stroke. The shock absorber dissipates defined kinetic energy. The hard stop establishes a limit or datum and should not become an unplanned energy absorber.
This article is a conceptual engineering guide. It does not replace load calculations, supplier selection, machine risk assessment, safety requirements, or validation under the actual duty cycle.
1. Separate four layers in the stopping chain
Planned deceleration
The controller or drive reduces speed before the mechanism reaches the end region. It is the first opportunity to reduce kinetic energy.
End-of-stroke cushioning
A cylinder cushion, flow control, profile, or compliant element controls the final travel region. It must work across pressure, load, temperature, and speed variation.
Shock absorber
The shock absorber converts a defined amount of kinetic energy into heat over a defined stroke and force profile. It is selected for energy per event, frequency, velocity, load, and mounting condition.
Hard stop
The hard stop defines a physical limit or datum. It may take exceptional energy, but it should not be used as the normal deceleration device unless that duty is explicitly calculated and validated.
2. Start with the energy path, not the catalogue
Draw the moving mass, velocity, direction, friction, actuator force, external load, and every element that can absorb or return energy. Include gravity, springs, belts, flexible structures, and energy arriving from another axis.
For a simple moving mass, kinetic energy is approximately E = 1/2 m v². The square on velocity matters: doubling impact velocity quadruples kinetic energy. A force created by a cylinder or motor may add energy during the stop, while gravity can continue to accelerate a vertical axis.
The energy path must identify where heat goes, which part reaches its limit first, and what happens if one element loses capacity. A catalog value at nominal temperature is not the complete design case.
3. Impact velocity is not average velocity
A slide may travel at 0.5 m/s on average but enter the final stop region at a higher or lower speed depending on the profile, friction, pressure, and control delay. Measure the velocity at the point where the absorber begins to work.
Consider command latency, PLC and drive update, valve response, hose compliance, sensor position, and variation between cycles. A stop sensor that is too far from the impact point may leave the absorber with less stroke than the drawing suggests.
4. Kinetic energy is not the only energy to absorb
The absorber may also see actuator thrust, gravity, spring force, belt tension, pressure trapped in a cylinder, and elastic energy in the frame or tooling. A nominal mass-and-speed calculation can be safe on a horizontal axis and wrong on a vertical or pressing mechanism.
Define the worst credible combined event, not only the normal cycle. Include a mis-timed command, loss of braking, maximum payload, pressure maximum, and a mechanism that reaches the stop before the expected control response.
5. Energy per cycle and energy per hour are different gates
An absorber can survive one high-energy event and still overheat under repeated lower-energy cycles. Check both energy per impact and average power over the duty period. Include startup, changeover, jam recovery, and abnormal tests.
Thermal capacity depends on ambient temperature, mounting, ventilation, stroke utilization, and heat transfer to nearby parts. A damper that feels acceptable during a short FAT may exceed its temperature limit in a full production shift.
6. Stopping stroke determines deceleration and reaction
For the same energy, a longer effective stroke generally reduces peak force, while a short stroke increases force and structural stress. The available stroke is not necessarily the body length: reserve may be lost to adjustment, target variation, compression, or a hard-stop gap.
Define acceptable deceleration, peak force, travel error, rebound, and settling time. Check the frame, guide, bearings, fasteners, brackets, and workpiece—not only the absorber rating.
7. Do not make the hard stop fight the shock absorber
If the hard stop contacts before the shock absorber completes its stroke, the impact bypasses the absorber. If the absorber remains compressed against the stop, preload and rebound can shift the datum or overload the mounting.
Set the sequence and tolerances so the absorber works within its intended window and the hard stop remains a defined limit. Provide adjustment locking and a way to inspect the gap, stroke, and wear.
8. One stop or two?
Some mechanisms need a normal-cycle stop and an independent emergency or failure stop. The normal stop may use controlled motion and a precision datum; the emergency stop may need a separate energy-rated structure and containment.
Do not assume redundancy simply because two physical blocks exist. If both blocks depend on one loose bracket, one frame weld, or one incorrect sensor, they share a failure path. Define which stop protects people, which protects equipment, and what happens when one is reached.
9. Alignment and side load can destroy a good design
Shock absorbers are often rated for axial loading. Misalignment, guide wear, asymmetric payload, or a tilted bracket adds side load and bending. The mechanism may still move while the absorber seal, rod, or mount is being damaged.
Use guides and hard stops to carry lateral loads. Check parallelism, concentricity, mounting stiffness, rod buckling, and full-stroke alignment. Inspect witness marks and temperature differences between repeated cycles; they can reveal load paths that the calculation missed.
10. A sensor is not a mechanical stop
A sensor can request deceleration or report that a position has been reached. It cannot physically prevent motion after a drive fault, valve failure, stale communication, or unexpected external force.
Use the sensor as evidence in the control layer and the stop as a mechanical boundary. Define what happens if the sensor is disconnected, stuck, misaligned, or delayed. A machine should not rely on a software bit to contain energy that requires a physical limit.
11. Define the failure state of the stopping system
Review loss of damping, damper leakage, broken mount, seized guide, stop loosening, sensor failure, loss of power, loss of air, and unexpected motion. For each, determine whether the mechanism stops, drifts, rebounds, collides, or becomes accessible to a person.
Use inspection, temperature, cycle count, pressure, position, or force evidence where practical. Define a controlled degraded mode and a replacement criterion. “Damper failed” is not a recovery strategy unless the machine knows how to remain safe while it is failed.
12. A hard stop for normal cycles is different from one for emergency or failure
A normal-cycle hard stop may be a precision locating surface used thousands of times. An emergency stop may experience one rare but severe event. Their material, energy capacity, mounting, access protection, inspection, and replacement criteria can be different.
If one component must serve both roles, calculate and validate both duty classes. Mark the design boundary so production does not silently turn an emergency containment part into a positioning datum or vice versa.
13. Validation must test boundary conditions
Test maximum and minimum payload, speed, pressure, temperature, friction, alignment, stroke, duty cycle, and realistic wear. Test sensor delays, power or air loss, loss of damping, and a hard stop reached from the wrong state.
Record impact velocity, stopping time, travel, peak force where measurable, absorber temperature, rebound, noise, mounting movement, and post-test damage. Repeat enough cycles to expose thermal accumulation and loosening.
14. Design for inspection and replacement
Provide access to inspect the rod, seal, mount, gap, stroke, witness marks, and fasteners. Mark the approved adjustment and replacement part. Make it impossible or unlikely to install an absorber with the wrong stroke or capacity without a visible mismatch.
Document cycle count, proof test, lubrication, tightening, temperature limit, and disposal criteria. A replacement is not complete until the stop gap, sensor timing, and recovery behavior are reverified.
15. Review checklist
- [ ] Planned deceleration, cushioning, shock absorption, and hard stop have separate roles.
- [ ] Energy includes mass, velocity, actuator force, gravity, spring, pressure, and elastic structure.
- [ ] Impact velocity is measured or justified at the absorber entry point.
- [ ] Energy per event and average power per hour are within limits.
- [ ] Effective stroke, peak force, rebound, and settling are defined.
- [ ] Hard-stop gap and absorber stroke remain valid across tolerances.
- [ ] Guides and mounts carry side loads and are checked for alignment.
- [ ] Sensors are not credited as physical containment.
- [ ] Failure states include damping loss, loosening, utility loss, and sensor failure.
- [ ] Normal and emergency duty classes are distinguished.
- [ ] Boundary validation includes wear, temperature, maximum load, and repeated cycles.
- [ ] Inspection, replacement, proof test, and revalidation criteria are documented.
Conclusion
Impact protection works when each element carries the job it was designed for. Planned deceleration reduces velocity, cushioning manages the end region, a shock absorber dissipates defined energy, and a hard stop establishes a physical limit. Combining all roles in one small component creates heat, force, wear, and an unverified failure state.
Follow the energy path, measure the real impact condition, account for frequency and alignment, separate normal from emergency duty, and validate the boundaries. A hard stop that is quiet and stable is evidence of a controlled design; a hot damper and repeated impact are evidence that the machine is asking the wrong part to do too much.
Public references
View all MINATA technical articles