Author: Justin McNabb
Machine safety retrofits usually start with good intentions—reduce risk, improve compliance, and keep equipment running longer. But in practice, that doesn’t always translate into a solution that actually holds up under scrutiny. As a TÜV-certified safety engineer who performs risk assessments regularly, I see the same patterns come up again and again across different facilities and industries. These aren’t small details being missed; they’re fundamental gaps that can leave real risk on the table and create problems during audits or, worse, after an incident.
Below are five of the most common mistakes I see in retrofit projects. Most of them come down to skipping steps, making assumptions, or prioritizing speed and cost over a structured approach to risk reduction. If you can avoid these, you’re already ahead of where most retrofit projects end up.
Five of the most common mistakes in safety retrofit projects come down to skipping steps, making assumptions, and prioritizing speed and cost over structure.
1. No Risk Assessment was Performed
When a retrofit begins without a formal risk assessment, everything downstream becomes guesswork. This is the most common and most foundational mistake we see.
- No formal risk assessment methodology (e.g., task-based hazard identification) was documented prior to design.
- The client is unaware of all interactions and tasks associated with the machine, including clearing jams, maintenance, sanitation, troubleshooting, and tool changes.
- Secondary or infrequent tasks (blade changes, sensor alignment, die swaps) are not evaluated, even though they often present the highest risk exposure.
- The severity of potential injury is underestimated, especially in older equipment that predates current safety standards.
- Exposure frequency is not properly considered — operators may interact with hazards far more often than assumed.
- There is uncertainty around the required Performance Level (PLr) or SIL rating because risk parameters were never formally scored.
- Hazard countermeasures are selected based on cost or familiarity rather than risk reduction requirements.
- There is confusion around when to choose safeguarding versus Lockout/Tagout (LOTO). If a task is not routine, repetitive, and integral to production, LOTO is typically the justified control method.
- Existing safeguards are assumed to be adequate simply because the machine has “always run this way.”
- No validation step is performed after retrofit to confirm that the implemented solution reduces risk to an acceptable level.
Without a documented risk assessment, it becomes nearly impossible to justify safety architecture decisions or defend them during an audit or post-incident review.
2. Only Electrical Energy Is Considered
Many retrofits focus exclusively on electrical isolation while ignoring other hazardous energy sources. Machines rarely operate on electricity alone.
- Pneumatic energy is not evaluated, especially stored compressed air in accumulators or trapped air in cylinders.
- Hydraulic systems are overlooked, particularly stored pressure in hydraulic lines and manifolds.
- Gravity hazards are not considered (raised platens, suspended loads, vertical axes).
- Mechanical stored energy such as springs, counterbalances, and flywheels is not accounted for.
- Thermal energy (heated surfaces, steam systems) is ignored during hazard evaluation.
- Residual energy after shutdown is not evaluated — energy may remain present even after electrical isolation.
- Electrical isolation is implemented without verifying zero energy state across all systems.
- Bleed-down procedures are not integrated into the safety strategy.
- Safe restart procedures fail to account for uncontrolled motion from gravity or stored pressure.
A true machine safety retrofit must consider all hazardous energy sources, not just what is inside the electrical cabinet.
3. Fault Masking and Daisy-Chained Components
Legacy safety circuits often used simple series wiring for E-stops and gate switches. While common in older designs, this architecture creates diagnostic and reliability issues.
- Multiple E-stops or gate switches are wired in series, preventing fault location identification.
- A single wiring short can mask a downstream device failure.
- Fault masking prevents detection of contact welding in mechanical devices.
- Diagnostic coverage decreases as more devices are added in series.
- Performance Level (PL) calculations often fail to account for reduced diagnostic coverage.
- The probability of dangerous failure increases with every additional device in the safety function.
- Retrofits often retain legacy wiring to avoid rewiring costs, preserving existing weaknesses.
- Troubleshooting time increases because the system only reports a generic “safety chain fault.”
- Maintenance bypasses are more likely when faults are difficult to locate.
- Safety relay architectures are not upgraded to individually monitored inputs when transitioning to a safety PLC.
Each device added to a safety chain increases overall failure probability. Proper retrofits isolate and monitor safety devices individually to maintain diagnostic integrity and meet required PL levels.
4. Hardware Architecture is Good, but Built-in-Safety Functions Are Not Used
Modern safety PLCs provide validated and certified safety function blocks. Failing to use them undermines the integrity of the system.
- Programmable safety PLCs include pre-certified safety function blocks (e.g., Emergency Stop, Guard Monitoring, Two-Hand Control, Safe Speed).
- Custom logic is written instead of using tested safety function blocks.
- Input discrepancies (dual-channel mismatch) are not properly monitored.
- Output device monitoring (EDM) is not implemented, allowing welded contactors to go undetected.
- Manual reset logic is improperly coded, allowing unintended automatic restart.
- Safety time monitoring (e.g., stop time verification) is omitted.
- Validation documentation does not reflect the logic actually implemented in the controller.
Certified safety function blocks are tested to detect dangerous failures. When clients bypass them, they assume responsibility for validating custom logic to the same level — something rarely done thoroughly.
5. Safe Distance Calculations Were Never Performed
Protective devices are only effective if properly located. We frequently see safeguarding installed without safe distance calculations.
- Light curtains are installed too close to the hazard zone.
- Area scanners are mounted based on convenience rather than calculated stopping time.
- Non-locking gate switches are used where stop time requires guard locking.
- The machine’s actual stopping time is never measured.
- Safety distance formulas (based on approach speed and stop time) are not applied.
- Stop time increases over machine life due to brake wear but is never re-verified.
- Safety devices are relocated during retrofit without recalculating safe distance.
- Assumptions are made that the machine will stop before a person can reach the hazard.
- Vertical access points (reaching over, under, or around) are not evaluated.
- No validation testing is performed to confirm stop time under worst-case load conditions.
Without calculating safe distance, even a properly functioning safety device may fail to prevent injury.
Final Thought
If there’s a common thread across all of these, it’s this: too many retrofits are treated like engineering upgrades instead of what they really are, risk reduction efforts. When key elements like a formal risk assessment, full energy evaluation, proper safety architecture, and validation are skipped or rushed, the end result may look good on paper but doesn’t always perform the way it should.
The teams that get this right take a more disciplined approach. They treat safety as a process, not a one-time fix, starting with a solid assessment and following through with proper design, implementation, and validation. That’s what leads to systems that not only meet requirements but actually protect people and stand up to real-world use and review.