The light curtain opens. The robot halts. Someone clears the fault on the pendant and the cell goes live again. If the stop category relied on monitored standstill—drives held and motion supervised so joints cannot creep under gravity or residual torque—then “cleared” is not the same as “proved still stopped.” A reset path that restores servo power without confirming standstill monitoring is active again has quietly left the safety function the cell was certified on.
Brake-hold tests own mechanical brake torque at commissioning intervals. Collision-sensitivity notes own payload vs. trip thresholds. Scanner-muting validation owns mute timing defeat tests. This page is standstill monitoring after protective stop and fault reset: the proof that “stopped” still means supervised motionless axes before production resumes.
In practice the failure is procedural as often as it is wired wrong. Operators learn a two-button dance that bypasses the intended stop category. Integrators leave SMS configured in the robot controller but never wire the safety PLC to demand and verify it on every stop/reset cycle. After a drive replacement or safety-firmware update, standstill parameters revert to defaults nobody re-validates.
A floor-usable proof is short: inject or command the protective stop; confirm the safety chain reports standstill monitoring engaged; attempt a controlled motion request while the stop is active and confirm it is rejected; clear only through the designed reset sequence; confirm SMS re-arms before auto is allowed. Log the test against cell ID and safety software revision—same seriousness as a mute validation sheet.
If the risk assessment names monitored standstill and the restart checklist only says “fault reset OK,” the assessment and the plant disagree. Align them before the next shift treats the pendant as the safety system.