Machine Design #68: Safety Covers — More Than a Panel Around the Machine
1. Start with function and evidence
Before choosing a dimension or opening a supplier catalog, write what the machine safety cover must do, where the load or environment comes from, how many cycles it must survive, and what counts as failure. “Use the old drawing” hides assumptions about process, access, maintenance, and safety. A testable requirement states the input condition, operating condition, expected result, acceptance limit, and measurement method. Internal standards are a starting point; the final decision must be checked against the real model, material, process, and installation.
2. Review four layers together
Function and load
Separate nominal, start-up, impact, misalignment, and fault cases. Trace the load through the complete assembly, not only the attractive CAD section. Include inertia, thermal movement, cleaning, vibration, and the number of cycles that actually matters. State the boundary and the reason for the safety margin.
Material and manufacturing
The same geometry behaves differently after cutting, forming, welding, machining, coating, or heat treatment. The drawing must describe what a workshop can make and measure. A tight tolerance cannot compensate for an unknown process, an unprotected datum, or an inspection method that cannot reach the feature.
Interfaces and assembly
Define datums, direction, clearance, contact, fastening, tool access, and mistake-proofing. If variants exist, use geometry or markings to prevent a wrong part or orientation. Record the force, sequence, and evidence expected from the operator.
Operation and maintenance
Check access, replacement time, re-location, cleaning, adjustment, and the measurement that returns the machine to baseline. A design that works only with one experienced fitter is not repeatable.
3. Core checks for this topic
- Hazard, reach envelope, residual energy, and safe distance: start from the hazard, the reach envelope and the residual energy, and derive the safe distance rather than the panel size.
- Guard material, opening, visibility, and impact resistance: choose guard material and opening size together, since visibility and impact resistance pull in opposite directions and both matter.
- Interlock, lock, reset, and fault behavior: define interlock, lock, reset and what happens on fault, so that opening a guard has one designed outcome and no other.
- Access for cleaning, inspection, and replacement: provide access for cleaning, inspection and replacement, because a guard that blocks routine work will be removed and left off.
- Fastening, tamper resistance, edges, and grounding: check fastening and tamper resistance, treat the edges, and bond the guard where a fault could make it live.
- Verification, user information, and maintenance audit: keep verification evidence, the information given to the user, and a maintenance audit that confirms the guard is still doing its job.
The checklist is useful only when every line has evidence. “Reviewed” is not “calculated”, and “calculated” is not “tested at the boundary”. Keep an evidence ID next to each requirement so an engineering change can be audited.
3b. A guard has to answer three geometric questions
A panel only becomes a safety measure when it stops a person reaching the hazard before the dangerous motion has stopped. Three geometric questions decide that.
Can it be reached? A person can reach over the top, under the bottom, through an opening, or around an obstacle. The safety-distance standard gives tables based on fence height, hazard height and opening size — those values must be looked up in the standard that applies, not estimated by eye.
Is the opening size matched to the distance? This is the key relation and the one most often missed: the larger the opening, the further a limb can pass through, so the hazard has to be further away. A coarse mesh mounted close to a moving assembly is less safe than the same mesh mounted further back.
Does it stop in time? For an interlocked door, the distance from the door to the hazard has to be enough for the machine to stop before a person arrives. That means the real stopping time of the machine is an input to the mechanical design, not something belonging only to the electrical side. That time grows as the brake wears, so it also has to be in the periodic inspection plan.
Doors and interlocks: defeat resistance is a design requirement
An interlock being defeated is a very real situation, and the motive is usually not carelessness but a guard that gets in the way of daily work. Defeat resistance therefore starts with designing so the work can still be done, and only then moves to technical measures:
- Places that need frequent access — loading, adjusting, cleaning — must have a way to do that
without opening the main door: a loading chute, a small hatch, or a properly sized safe opening.
- The interlock switch should be of a type that is hard to simulate with a spare actuator, and be
mounted so it cannot be reached from outside while the door is closed.
- A door large enough to walk through needs protection against trapping someone inside: openable
from within, or a device that stops it closing by itself.
- The door state should be visible for diagnosis instead of leaving the operator to guess why the
machine will not run. How to distinguish an interlock from a permissive is in Machine Design #38 — Interlock and permissive.
A guard can create new hazards of its own
This is the part most often missed on drawings, because guards are usually drawn last and reviewed least.
| New hazard | Appears when | Handling it in the design |
|---|
| Sharp edges and corners | Laser-cut panels with unbroken edges | State an edge-break requirement for every edge a person can touch |
| A new pinch point | Sliding doors, heavy hinged doors | Provide a safe gap or limit the closing force |
| Door falling when removed | Large panels held only by screws, no handle | Hinges, handles, or a retaining catch during removal |
| Loss of visibility | A solid panel replacing a transparent one | A viewing window at the position where the work is done |
| Trapped soil, hard to clean | A closed box with dead corners | Rounded corners, sloped surfaces to drain, an access point |
| Heat and noise build-up | Enclosing a heat-generating assembly | Ventilation with correctly sized mesh openings |
Guard fasteners should be of the captive type. A guard with ten loose screws quickly becomes a guard with four, because a few are lost every time it comes off. It is a small change on the drawing but it decides whether the guard is fully refitted after each maintenance visit.
A guard is a second-tier measure, not a first-tier one
In the hierarchy of risk reduction, redesigning to eliminate the hazard always comes before covering it. Before drawing a panel, ask: can this assembly be placed where nobody can reach it? Can the speed or force be brought below the injury threshold? Can the pinch point be removed by changing the structure? Applying that hierarchy is covered in Machine Design #69 — Machine risk assessment.
4. Tolerance stack and variation
Build the stack from the functional datum to the characteristic that must be protected. Separate nominal, worst-case, and statistical values only when the process is stable enough to justify it. Include flatness, squareness, coating or treatment thickness, clamping deformation, temperature, field assembly error, and wear.
If assembly succeeds only because a technician nudges a part, the design has no reliable capability. Assign each contributor a source and identify whether it is controlled by the supplier or verified at incoming inspection. For machine safety cover, pay particular attention to hazard reach, interlock, visibility, access, rigidity, and maintenance without bypass.
5. Failure modes before release
Ask: “If this is wrong, what will the machine show, and what evidence will reveal the cause?”
| Failure mode | Machine symptom | Verification direction |
|---|
| Boundary selected too optimistically | Passes a demo, fails at speed, temperature, load, or cleaning | Test min/max and the defined fault case |
| Tolerance not tied to function | Difficult assembly, play, bind, noise, or leak | Rebuild the stack from functional datums |
| Manufacturing step omitted | Distortion, burr, crack, drift, or poor finish | Review the process and measure after each critical step |
| Inspection cannot reach feature | Supplier report looks complete but function is unknown | Define a reachable method and a sample plan |
| Maintenance not designed | Long replacement or wrong restoration | Run a maintenance trial and restoration check |
| Documents out of sync | Correct name but wrong revision or setting | Baseline BOM, drawing, process, and work instruction |
6. Drawing and record discipline
Specify only requirements that have functional meaning and can be inspected. For a special requirement state the scope, datum or measurement location, condition, and acceptance limit. Notes such as “accurate machining” or “assemble carefully” are not instructions. Keep the calculation or rationale, source revision, assumptions and limits, review comments, prototype or FAT result, and the point to recheck after change.
7. Design review on the real production route
Start at the input and follow the load or environmental attack to the output. Name the surface, edge, joint, thread, hole, treatment, or contact that carries the function. Mark where friction, clearance, temperature, chemicals, operator adjustment, or cleaning can change the result. If a parameter is unknown, assign an owner and measurement plan instead of hiding it in a large factor.
Ask the fabricator which operation creates the most variation, how the feature is inspected, and what happens after deburring, welding, heat treatment, coating, or washing. Compare capability with the stack. If the process cannot hold the drawing, change the process or design before ordering.
On the assembled machine, run start-up, normal duty, stop, restart, and a controlled fault. Record force or torque, temperature, vibration, noise, motion, visual marks, and replacement time as relevant. These observations often reveal an assumption that a drawing review missed.
8. Boundary conditions and calculations
Write lower and upper values for every influential parameter and include combinations that can occur together. Keep units consistent, show the equation or reference, and record catalog test conditions and correction factors. Compare at least one analysis result with a hand calculation or a measured prototype.
For machine safety cover, a useful sheet has columns for input, nominal, lower bound, upper bound, source, result, pass/fail, and “what would invalidate this assumption?” This makes the decision robust when a supplier changes material, cycle time, temperature, chemical, or inspection route.
9. Supplier and incoming inspection
The supplier package should include drawing revision, material condition, special process, inspection points, sample record, and rework rule. Do not outsource design intent. If a supplier proposes a different process, compare function, durability, cost, lead time, and inspection capability before approval.
At incoming inspection, measure the features that protect the function rather than every dimension with equal effort. Record actual values and instrument ID. A part can be within a drawing tolerance and still fail because of the wrong surface, burr, fit, treatment, lubricant, or orientation. Link the result to the lot or serial used on the machine.
10. Commissioning and maintenance feedback
Create a baseline at commissioning: cycle time, force or torque, temperature, vibration, noise, position, surface condition, or appearance as relevant. Define the alarm limit and the action when it is reached. After the first service interval, compare the trend with baseline and update the maintenance instruction. Replacement should restore the baseline, not merely make the machine move again.
A cover is only safe if it is fastened and interlocked right, not just because it is a panel
A good panel is still useless if it is easy to remove and not put back, or if the machine runs with the door open. Two things beyond geometry decide it:
- Fixed vs interlocked guards. Where access is rare, use a fixed guard — but it must need a tool to remove and use captive fasteners so it is not left off after maintenance. Where access is frequent, use an interlocked guard: open the door and the machine stops.
- The interlock must be hard to defeat. Use a coded or tongue-operated interlock, not a simple switch that can be taped over. An operator will find a way around an interlock that is a nuisance — so design it so there is no easy way around.
- Reaction time vs stopping distance. The machine must stop before a hand reaches the hazard: the interlock reaction time plus the mechanism's stopping distance must be small enough for the distance. This is where the geometry (§3b) meets the control.
- Where guarding is feasible, do not replace the panel with a warning label.
| Risk | Why | What to do |
|---|
| Cover left off after maintenance | Loose screws, removed by hand | Captive fasteners, tool required to open |
| Interlock defeated | An easy-to-bypass switch | Coded/tongue interlock, placed so it is hard to bypass |
| Stops too slowly on opening | Reaction + stopping distance too long | Shorten the stop time or increase the distance per the standard |
11. MINATA release checklist
- [ ] Function, load path, duty cycle, and fault or environment boundary are written.
- [ ] Material, process, surface condition, and inspection method are agreed.
- [ ] Functional datums and tolerance stack are visible.
- [ ] The six topic checks above have evidence and pass/fail criteria.
- [ ] Assembly, tool access, orientation, and mistake-proofing were tried on hardware.
- [ ] Failure modes have an owner, evidence, and re-test condition.
- [ ] Supplier and incoming records link to the revision and lot.
- [ ] Commissioning baseline and maintenance response are defined.
Frequently asked questions
How high should a fence be and how large may an opening be?
There is no single figure. The values are in the safety-distance and reach standards and depend on the hazard height, the fence height and the opening size. What matters in design is the relation: the larger the opening, the further away the hazard has to be.
Why is the machine stopping time an input to guard design?
Because on an interlocked door the distance from the door to the hazard has to be enough for the machine to stop before a person arrives. Stopping time also grows as the brake wears, so it is both a design input and a periodic inspection item.
How do you stop operators removing or simulating a door switch?
Start by making the daily work possible without opening the main door. Only then move to switches that are hard to simulate, mounted where they cannot be reached from outside. A guard that gets in the way of work is the most common root cause of defeating.
Can a guard introduce new hazards?
Yes, and this is the part usually missed: sharp edges, a pinch point at a sliding door, a heavy panel falling when removed, loss of visibility, trapped soil, heat and noise build-up. A guard has to be reviewed as a real assembly, not as decoration drawn at the end.
What type of fasteners should hold a guard?
Captive ones, which stay in the panel when loosened. A guard held by loose screws loses screws over a few maintenance visits, and a guard missing fasteners no longer performs as designed.
12. Closing note
Good mechanical design is a chain of explicit assumptions that survives manufacturing, assembly, operation, maintenance, and change. For machine safety cover, the right question is not only “will it work?” but “what evidence will show it continues to work when the boundary moves?” That is the standard MINATA uses to turn a drawing into a dependable machine.
Frequently asked questions, continued
When do I use a fixed guard versus an interlocked guard?
Where access is rare (maintenance only), use a fixed guard that needs a tool to remove, with captive fasteners so it is not left off. Where access is frequent during operation, use an interlocked guard so the machine stops when it is opened. Choose by access frequency, not by which is cheaper.
Why does the interlock reaction time matter?
Because when the door opens, the machine must stop before a hand reaches the hazard. The interlock reaction time plus the mechanism's stopping distance sets the minimum safety distance; if it stops slowly, you must increase the distance or shorten the stopping distance, per the applicable standard.
Conclusion
Safety Covers is not a matter of picking a single number. Good design ties function, load, material, process, tolerance, assembly and maintenance into one contract that can be checked. An internal standard preserves the experience already accumulated; the designer's job is to understand the conditions under which it applies and turn it into a clear decision on the product at hand.
View all MINATA technical articles