Were safeguards tested after the programme changed?: entrapment during robot checks

At a glance

On 11 May 2023, 1 subcontractor worker died after being trapped while checking a robot at an automotive-parts factory in Gyeonggi Province.

A control-programme change had disabled the photoelectric safeguard without anyone recognising it.

From preparation to the aftermath

At the automotive-parts factory, a worker placed frames in a jig and robots carried out processing, transfer and welding. The worker supplied material and removed completed parts from outside the enclosure. The next operation originally required pressing a start button after product removal.

About 1 year before the accident, a separate switch was made so that touching a bar with the product initiated the next operation. The change removed the need to press the start button again. The PLC program was also altered, defeating the response that should have stopped the robot when the photoelectric safeguard detected entry.

On 11 May 2023, nut-check alarms recurred. The worker leaned through an opening to investigate. The robot continued moving and trapped the worker between its arm and the jig. A worker from another line approached after hearing the continuing alarm and found the victim.

Safety mats and a photoelectric safeguard were present. The investigation identified failure of the protective response after the control-program change, rather than simply absence of visible devices. A change intended to simplify production had also changed the conditions needed to protect a person entering the area.

A production-control change can alter the protective response

A photoelectric safeguard detects entry and acts through the control system to stop hazardous movement. A fitted sensor and illuminated indicator do not establish that a stop command reaches the robot. Detection, signal processing and stopping must be verified as one protective function.

Production-start and protective-stop commands serve different purposes. Replacing a start button changes the relationship between material placement, withdrawal and robot departure. Review must cover whether starting is possible while someone remains exposed and how protective intervention stops motion, not only whether production runs smoothly.

A quality alarm is not a protective stop. A nut-check alarm signals a problem to investigate; it does not authorise entry. Removing material or troubleshooting must be separated from normal operation. Before entering the automatic movement area, establish stopping and restart-prevention conditions appropriate to the task.

A jig locates parts for repeatable processing, but can become the fixed side of an entrapment against a moving robot. The hazard includes the space between the held part and jig, not just the arm’s path. At an opening where reaching may become upper-body entry, assess the actual working posture and reach.

Verification after a program change should be planned separately from normal production testing. Examine detection, restart after stopping and access during alarm handling as distinct conditions. Do not test by placing a person in danger; follow manufacturer instructions and a safe test method. Retain results with the change record so later inspections can identify what changed.

A convenience change can alter when a person is close to machinery even if the change appears small. Starting while the hand removing a product remains nearby eliminates the separation previously provided by the start button. Judge the change by the actual sequence, not by counting added switches. Record where the person is and what they are doing when movement begins.

Keeping the previous program aids recovery but does not replace safety assessment. Test cases depend on understanding which functions changed. Repeated normal transfers can miss the response to a presence signal. Link changed start conditions to the protective conditions they affect and verify each by a safe method.

A safeguard separates access from movement rather than merely adding inconvenience. If detection needs adjustment for material passage, check that the change does not also permit human entry. Confusing material-passage conditions with protective stopping can leave production working while protection fails. This requires controlled assessment, not an individual’s improvised program adjustment.

Repeated alarms can make a response familiar and routine. Pressure to clear the alarm and resume production can shorten the stopping procedure. Treat recurrence as an equipment issue and decide whether safe work remains possible pending correction. Frequent repetition does not turn hazardous access into normal operation.

A sensor-indicator check can miss control-system changes; software review alone can miss a moved or obstructed detector. Connect installation position, logic and the actual stopping result. Record the tested condition and observation so a later inspector can repeat the verification under equivalent conditions.

The person completing maintenance may differ from the person restarting production. Link removal of tools and material, personnel clearance, restored protection and authority to restart. A message that testing has ended can otherwise send operators to equipment still configured for another condition. The transition from testing to production needs explicit control.

Ending the explanation at the worker’s entry would omit the program change and lost safeguard response. Address both the repeated alarm prompting access and continued motion during that access. Training should explain that connection, not ask vigilance to compensate for equipment lacking protective stopping. Assess work and protection together when approving a change.

The white paper describes a 6-minute 13-second cycle involving transfer and welding robots at different stages. In an arrangement where other work continues while one robot waits, it is easy to mistake a local pause for a stopped system. Check not only the robot being inspected but any other robot sharing the jig or space. A partial stop is not proof of safety throughout the area.

Several movements connect the loading and unloading positions. After a program change, a familiar reach at the usual time may encounter a different movement. Instruction must explain changed waiting, starting and access conditions, not merely a new button. Experienced operators should not be expected to discover unverified behaviour by adapting during production.

For workplace application, clarify authority to change programs and responsibility for verifying restored protection. A production improvement proposal needs a process connecting equipment expertise, operations and safety review so that the change does not rest on one person’s judgment.

What the comparison shows

In the die-casting cleaning case 2022-13 in the 2024 white paper, gloves held safety-door switches to defeat protection. In the robot case, a program change caused a comparable protective failure. One bypass was physically visible and the other lay in control logic, but hazardous motion continued during human access in both.

Focusing only on hardware repair can miss a program change, while reviewing only software can miss a physical bypass. Inspection must extend from installation to actual stopping and restart behaviour. The shared entrapment category should not obscure the different failure paths.

Causes and protective layers

Investigation and proceedings

The two representatives of the contracting company and subcontractor were sent for trial. At the first trial, the contracting company’s representative received 9 months’ imprisonment, suspended for 1 year; the subcontractor’s representative received 3 months’ imprisonment, suspended for 1 year.

Why the consequences were severe

Robot force acted in the confined space between the worker and jig. Once the upper body was inside, automatic movement left little opportunity to escape. The central protection was a functioning response to entry, not the worker’s experience or familiarity with the equipment.

Questions at the work position

Korean legal references

Article 223 of the Rules on Occupational Safety and Health Standards addresses measures such as enclosures and presence-sensing safeguards against contact during robot operation. Article 224 addresses stopping and preventing restart during repair, inspection and adjustment. Verify that these functions remain effective after program changes rather than checking only that sensors are installed.

Occupational Safety and Health Act (Korean) · Rules on Occupational Safety and Health Standards (Korean)

Field practitioner note

Related cases

• 2022-13 — compare work and equipment hazards
• 2022-15 — compare work and equipment hazards

Sources

MOEL and KOSHA, 2025 Serious Accident White Paper, Part 2, 6–29 pages. Official publication (Korean)