Document type: Validation protocol (floor-usable)
Applies to: Area laser scanners / light curtains with muting on robotic cells
Does not apply to: Collaborative force-limiting theory, cable carriers, ATC docks
If muting is “how we hit takt,” this protocol exists to keep muting from becoming a silent hardwire bypass.
0. Preconditions (do not skip)
0.1 Risk assessment revision on the cell is current.
0.2 Safety PLC / relay configuration under change control (hash or export dated).
0.3 Muting lamps / status bits visible to operators—not only to engineers.
0.4 No temporary jumpers on safety inputs (photograph panel before start).
Fail any precondition → STOP. Do not “validate later.”
1. Define the mute window in one sentence
Write on the cell placard:
Muting is permitted only while object/pallet/carrier occupies zone for max seconds, for material transfer, not for personnel entry.
If you cannot finish that sentence, you do not have muting—you have hope.
2. Sensor geometry checks
| Step | Action | Pass criterion | | --- | --- | --- | | 2.1 | Confirm mute sensor pair orientation | Only material path triggers both | | 2.2 | Attempt personnel-shaped intrusion during mute | Safety function still trips / mute denied | | 2.3 | Partial occlusion / shiny wrap test | No false mute from reflectance tricks | | 2.4 | Misalignment tolerance | Documented; beyond tolerance = fail |
If a person can mute it with their body, the geometry failed.
3. Timing proofs (numbers, not vibes)
3.1 Measure max mute duration under production-worst material length.
3.2 Inject stuck-high mute sensor; confirm timeout opens protective stop.
3.3 Confirm mute cannot latch across cycle boundaries without re-qualification of sensors.
3.4 Record times in the validation sheet—ms or s, not “seemed fine.”
4. Override and defeat tests (adversarial)
4.1 Tape / magnet / zip-tie attempts on mute sensors—expect detection or mechanical design that resists casual defeat.
4.2 Teach pendant presence does not widen mute beyond design.
4.3 Maintenance mode clearly distinct from production mute (different lamp / bit).
Untimed ‘OK’ initials are not a proof test.
5. Integration with the robot program
5.1 Mute status is monitored by safety logic—not only by the robot task program.
5.2 Robot speed / zone while muted matches the risk assessment (no silent full-speed surprise).
5.3 E-stop and protective stop paths tested independently of mute.
6. Sign-off matrix
| Role | Signs for | Cannot substitute | | --- | --- | --- | | Safety engineer | Risk alignment | Production supervisor | | Controls | Logic export match | Operator | | Production | Placard sentence + training | Vendor alone | | Maintenance | Defeat resistance / geometry | Finance |
Missing signature → cell stays locked out of production mute.
7. Periodic revalidation triggers
- Any fence / scanner move
- Conveyor or pallet size change
- Safety logic download
- Near-miss involving the mute path
- Calendar interval per site policy (write the interval)
Adjacent fences
Cobot ISO essays own collaborative force and speed theory. Dress-pack briefs own cable flex. Tool-changer briefs own docking seals. Humanoid deployment stories own pilot theater. None of them own mute timing proofs and defeat tests on area scanners. Do not cite ISO 10218 in a slide and skip Step 3.2.
Close
Muting is a controlled exception with a stopwatch and a signature chain. Everything else is a bypass culture wearing a safety scanner.