Radar Safety Sensors for Industrial Zone Monitoring

The Three Failure Modes That Defeat Light Curtains

Light curtains and laser scanners have been the dominant industrial safety sensors for thirty years. They work, until they do not. Three structural failure modes are increasingly the reason machinery designers look elsewhere.

Contamination. Dust from grinding, oil mist from machining, mineral particulates from cement and packaging, paper fibre from converting. Each scatters light at the wavelength of typical safety photoelectric devices. After enough contamination, the safety device blanks or starts producing nuisance trips, and the production line stops. Cleaning schedules become part of the operational cost of the machine.

Two-dimensional coverage. A light curtain blocks a plane. A person who reaches over the top, ducks underneath, or climbs around the side is not detected. The machine designer has to physically prevent these approaches with cages and access controls, which constrains the mechanical layout of the cell.

Mechanical sensitivity. Light curtains depend on alignment between transmitter and receiver. Mechanical knocks from forklifts, vibration from nearby presses, and thermal expansion of the supporting structure all degrade alignment, requiring routine maintenance.

60 GHz mmWave radar solves all three.

What Industrial Radar Solves

• Insensitive to contamination. Atmospheric attenuation from dust and oil mist at 60 GHz is in the order of fractions of a decibel per metre, well within the link budget of the IWR6843. Production lines that lose three hours per shift to light-curtain cleaning gain those hours back.
• True three-dimensional zone coverage. The radar sees a volume, not a plane. A person reaching over a partial barrier is detected. The mechanical cage can be smaller and lighter, which lowers cost and improves ergonomics for the operators who do legitimately need to interact with the cell.
• No alignment requirement. The radar is a single device, not a transmitter-receiver pair. A mechanical knock that shifts the radar's mounting by a few degrees does not invalidate the safety function; recalibration is a software task.

For most safety functions defined as detection of a person inside a hazardous zone, radar is now the right answer. The remaining engineering question is how to design the radar safety sensor so it passes IEC 61496 and IEC 62061 review.

Standards Pathway: IEC 61496, IEC 62061, ISO 13849

Industrial radar safety sensors live at the intersection of three standards families. The exact mix depends on the integration: a stand-alone safety sensor versus a sensor integrated into a safety-rated machine controller.

IEC 61496-1 is the generic standard for electro-sensitive protective equipment (ESPE). It defines the device-level requirements for active opto-electronic protective devices. The standard does not explicitly cover radar yet, but the concepts (resolution, detection capability, response time, fault behaviour) all transfer cleanly. Submissions to notified bodies typically reference IEC 61496-1 with explicit justification for the wavelength and detection principle.

IEC 62061:2021 covers the safety-of-machinery system level. Radar safety sensors are subsystems within this framework, with SIL claims that contribute to the overall machine safety integrity. SIL 2 is the typical floor for industrial safety sensors; SIL 3 is required for applications where unsafe failure could cause severe injury and the surrounding architecture does not provide diverse-channel mitigation.

ISO 13849-1:2023 covers safety-related parts of control systems for machinery, expressed as Performance Levels (PL a through e) and Categories (B, 1, 2, 3, 4). PL d and PL e map approximately to SIL 2 and SIL 3. Many CE machinery directive submissions reference ISO 13849, particularly in Europe.

The methodology to take a radar product through all three is well-established. Our functional safety engineering practice typically prepares a single integrated work-product set that supports IEC 61496-1, IEC 62061, and ISO 13849 simultaneously, reducing the duplicate effort that fragments these submissions in less experienced teams.

Zone Architectures: Warning, Slowdown, Stop

An industrial radar safety sensor typically defines two or three concentric zones around the hazard. The zone architecture determines the response of the connected safety controller:

• Warning zone (outermost). Optional. Triggers a visible or audible alert without slowing the machine. Used to signal to operators that they are approaching a hazardous area.
• Slowdown zone (middle). Triggers a reduction in machine speed or torque. Used in collaborative robotics and where complete stops are operationally expensive.
• Stop zone (innermost). Triggers a Category 0 or Category 1 stop per IEC 60204-1. The hazardous motion ceases within the response-time budget of the system.

For each zone, the response time of the entire safety chain matters: radar frame rate, processing latency, safety bus latency, and machine controller stop time. A well-engineered system reaches end-to-end response times of 40 to 100 milliseconds from intrusion to motion arrest. This is comparable to a Type 4 light curtain and faster than a laser scanner of similar detection capability.

Diagnostic Coverage in Industrial Radar

For SIL 2 the diagnostic coverage target is above 90 percent; for SIL 3 above 99 percent. The diagnostics catalogue for an industrial radar is well-established and includes:

• Continuous monitoring of transmit power at the antenna feed.
• ADC dynamic-range monitoring against an expected noise floor.
• Periodic injection of a calibration signal across the receive chain.
• Watchdog supervision of the signal-processing schedule.
• Cross-comparison of two independent processing paths over the same point cloud.
• Plausibility checks on tracked target motion (no teleport, bounded acceleration).
• Communications integrity over the safety bus with CRC plus sequence number.
• Periodic self-test on demand from the safety controller (test pulses on the safety output).

The justification of diagnostic coverage requires fault-injection testing, which is mandatory at SIL 3 and recommended at SIL 2. Plan for a four-to-six-week fault-injection campaign in the verification phase of the program.

Robot Cells, Press Brakes, AGVs: Three Worked Examples

Three industrial deployments where radar safety sensors materially changed the engineering economics:

Robot cell with collaborative working zone. A six-axis arm operating at high speed in a defined inner zone, with humans approaching for material loading and quality checks. Two radar sensors mounted at the cell corners cover the approach corridors. Warning zone at 2 m, slowdown at 1.2 m, stop at 0.6 m. Replaced a four-camera vision-safety enclosure plus a Type 4 light curtain. Bill of materials reduced by 30 percent, cycle time gained back because of reduced false stops in greasy conditions.

Press brake operator zone. An IEC 12622-compliant press brake fitted with a radar safety sensor under the die, looking forward and downward. Detects the operator's hands approaching the closing line. Replaced a finger-sensitive light curtain that suffered from chip and lubricant contamination, with substantial downtime cost. SIL 3 reached via a 1oo2D arrangement with diverse radar mounting.

AGV exterior monitoring. Mobile robot in a warehouse with a forward-looking IWR6843ISK and a rearward-looking second unit. Replaces a laser scanner that drifted in performance every six months due to optical contamination. Lower BOM, better warranty performance, identical SIL 2 claim.

Engineering the Sensor Head: Mechanical and EMC Considerations

The sensor head is where the program either works or fails. Eight engineering decisions consistently determine outcome:

1. Antenna choice based on zone geometry. The IWR6843ISK with a patch antenna is the default for industrial safety because of the narrower elevation beam. See our EVM comparison for the platform decision.
2. Radome material and thickness. A radome must transmit at 60 GHz with less than 2 dB loss. PTFE-loaded composites and certain polycarbonates work well; standard ABS does not.
3. Mechanical mounting that survives industrial vibration. Vibration profile per IEC 60068-2-6 across 10 to 500 Hz, plus shock per IEC 60068-2-27. The radar PCB needs damping or rigid mounting depending on the host machine.
4. Ingress protection. IP65 is the minimum for indoor industrial use. IP67 for outdoor or wash-down applications. The radome sealing affects this directly.
5. Temperature range. Minus 25 to plus 70 degrees Celsius is typical for indoor industrial; minus 40 to plus 85 for outdoor and automotive-adjacent applications.
6. EMC immunity per IEC 61000-4 series. Press brakes and welding cells are electrically noisy environments; the radar must operate through it without false trips or unsafe failures.
7. Power input compatible with 24 V DC industrial supplies, with reverse-polarity, over-voltage, and transient protection.
8. Safety output in OSSD (output signal switching device) format for direct connection to safety controllers, or via a safe fieldbus (PROFIsafe, CIP Safety, openSAFETY).

Record-and-Replay HIL Bench with AI Result Analysis

The notified body's verification report depends on a documented test campaign. Most submissions fail not on the radar itself, but on gaps in the evidence pack. Our HIL bench closes those gaps by capturing real lab scenarios as raw radar data, replaying them at full fidelity, and verifying results against synchronised vision recordings.

Three properties of this approach are decisive for enterprise safety programs.

• Raw-data replay, not synthetic simulation. The device under test sees the same ADC samples it would see in the real installation. Bugs that only emerge in genuine multipath, clutter, and micro-motion environments are caught on the bench, not in the field.
• Thousands of scenarios in hours. A regression run covering the full library completes overnight or in hours, not weeks. After every commit the safety-relevant KPIs are re-verified across thousands of recorded cases at the press of a button.
• AI analysis plus vision ground truth. An in-house pipeline classifies every detection event and cross-checks it against the synchronised camera recording. False-alarm and miss rates are quantified per scenario, with a per-case audit trail the notified body can read directly.

Output of the HIL campaign is a structured test report that maps every safety requirement to its verification evidence, with per-scenario IDs and reproducible playback commands. The notified body uses this as the primary input to the verification visit, which then becomes a confirmation rather than a discovery.

From Prototype to Notified-Body Submission

The path from working prototype to a Type 3 or Type 4 ESPE submission has six well-defined phases:

1. Working prototype on the IWR6843ISK with safety architecture in place.
2. Hazard analysis, safety requirements, target SIL or PL agreed with the customer and the notified body.
3. FMEDA delivered, diagnostics implemented, fault-injection testing completed.
4. Production-intent custom PCB completed, environmental and EMC pre-compliance passed.
5. Safety case delivered, supporting evidence indexed and traceable.
6. Notified-body visit, questions answered, certificate issued.

For a well-scoped Type 3 ESPE program, this entire path runs ten to fourteen months from kickoff. Type 4 adds two to four months because of the higher fault-tolerance and fault-injection requirements.

Frequently Asked Questions

Lukas Hofstätter

Founder and Managing Director, HALready GmbH

Lukas leads HALready's safety-critical embedded engineering practice, including industrial machinery programs to IEC 61496, IEC 62061, and ISO 13849. His work covers radar safety sensors from initial hazard analysis through notified-body submission and start of production.

LinkedIn profile