2. Laboratory safety and compliance foundations

An automotive safety laboratory is not simply a room full of instruments. It is a regulated environment where measurement credibility, functional safety, and occupational health obligations intersect. Before any automation script is written or any robot arm is commissioned, the engineering team must establish which standards govern the facility, which obligations flow down to the automation layer, and how those obligations are verified. This section maps the four foundational frameworks — ISO/IEC 17025, ISO 26262, IEC 61508, and facility-level EHS requirements — onto the concrete reality of an automated crash-sled or airbag deployment cell.

Four Frameworks, Four Different Questions

These standards are often listed together as if they were interchangeable. They are not. Each answers a different question, and confusing them leads to compliance gaps that surface during audits or, worse, during an incident.

The critical insight for automation engineers is that ISO 26262 and IEC 61508 are frequently conflated. ISO 26262 is the automotive sector adaptation of the IEC 61508 functional safety philosophy, but it applies to road vehicles and defines Automotive Safety Integrity Levels (ASIL A–D). IEC 61508 is the generic parent standard and defines SIL 1–4. When you specify a safety PLC or a light curtain for a test cell, you are usually working in IEC 61508 / ISO 13849 territory, not ISO 26262. The test cell itself is not a vehicle function; it is industrial machinery that happens to test vehicle functions.

ISO/IEC 17025: Making Results Defensible

ISO/IEC 17025 accreditation is what allows a laboratory's test report to be accepted by regulators, OEMs, and courts. For an automated cell, the standard imposes several non-negotiable requirements:

• Traceability: Every measurement — load cell force, accelerometer output, high-speed camera timing — must trace to a national or international standard through an unbroken calibration chain.
• Method validation: When you automate a test method, you must demonstrate that the automated execution produces equivalent or better results than the manual method. This is not a one-time exercise; it is triggered by any change to the automation sequence.
• Uncertainty: The laboratory must estimate measurement uncertainty for each test parameter and report it. Automation can reduce human-induced variance, but it introduces its own sources — timing jitter, trigger latency, synchronization error.
• Impartiality and data integrity: Automated data acquisition must prevent post-hoc modification. Audit trails, checksums, and write-once storage are common controls.

IEC 61508 and the Safety Instrumented Function of a Test Cell

An automated test cell contains hazardous energy: pneumatic actuators, hydraulic sleds, high-voltage battery simulators, and pyrotechnic devices. The safety instrumented function (SIF) is the engineered system that brings the cell to a safe state when a demand occurs. IEC 61508 requires that each SIF be assigned a SIL based on risk assessment, and that the achieved SIL be verified through calculation.

A typical cell E-stop and interlock chain might be assessed as SIL 2. The verification uses the probability of failure on demand (PFD) for low-demand mode or probability of failure per hour (PFH) for high-demand mode. For a SIL 2 low-demand SIF, the target PFD range is 10⁻³ to 10⁻². The calculation combines the failure rates of each element — sensor, logic solver, final element — plus diagnostic coverage and proof-test interval.

Example SIF architecture (illustrative, not a real calculation):
  Sensor:        Safety light curtain, λ_du = 2.0e-7 /h, DC = 90%
  Logic solver:  Safety PLC, λ_du = 1.0e-7 /h, DC = 99%
  Final element: Dual-channel safety relay + dump valve, λ_du = 5.0e-7 /h, DC = 60%
  Proof-test interval: T1 = 8760 h (1 year)

  Simplified PFD_avg per element ≈ λ_du × (T1/2) × (1 - DC)
  Sensor:        2.0e-7 × 4380 × 0.10 = 8.76e-5
  Logic solver:  1.0e-7 × 4380 × 0.01 = 4.38e-6
  Final element: 5.0e-7 × 4380 × 0.40 = 8.76e-4
  Total PFD_avg ≈ 9.69e-4  → within SIL 2 range (1e-3 to 1e-2)

The numbers above are illustrative. The engineering point is that the automation engineer must know the diagnostic coverage of every device in the chain and must not silently change a component without re-verifying the SIF. Replacing a safety relay with a different model that has a lower DC can drop the achieved SIL below the required level.

Facility-Level EHS: The Physical Layer

EHS requirements are often treated as a separate domain from automation, but in an automated cell they are tightly coupled. Key facility-level obligations include:

• Machine guarding: Physical barriers, interlocked gates, and presence-sensing devices must prevent access during hazardous motion. The automation sequence must not be able to override a guard interlock.
• Lockout/tagout (LOTO): Automated cells require a documented energy isolation procedure. Robots and actuators must be brought to a de-energized state before maintenance. Software-only stops are not sufficient for LOTO.
• Ventilation and exposure: Airbag deployment releases particulates and gases. The cell must have adequate extraction, and exposure monitoring must be documented.
• Noise: Pyrotechnic deployments exceed 140 dB peak. Hearing protection zones and administrative controls are mandatory.
• Fire and explosion: Pyrotechnic devices and lithium-ion battery abuse tests require fire suppression, blast containment, and sometimes inert atmosphere.

Integrating the Frameworks into an Automation Design Review

The practical challenge is not understanding each standard in isolation but ensuring that the automation design satisfies all four simultaneously. A design review checklist for a new automated test cell should force explicit answers to the following:

1. Which test parameters are ISO 17025 scope, and what is the calibration and uncertainty plan for each?
2. Which hazards require a SIF, what SIL is required, and what is the achieved SIL with the selected components?
3. Does the automation sequence respect all guard interlocks and LOTO boundaries?
4. Are EHS controls (ventilation, noise, fire suppression) interlocked with the test sequence so that a test cannot start if an EHS control is not active?
5. Is there a documented change-control process that triggers re-verification when any safety-related component or software is modified?

The SVG below illustrates how these four frameworks map onto a single automated test cell and where their requirements intersect at the automation layer.

What This Means for the Automation Engineer

The automation engineer in a safety laboratory is not a passive implementer of test sequences. They are a compliance stakeholder. Three practical habits prevent the most common failures:

First, treat the safety controller as a separate system. The safety PLC or safety relay network must be architecturally independent from the process controller. It may exchange status signals, but it must not depend on the process controller for its safety function. This separation is what allows the SIL claim to hold.

Second, maintain a live compliance matrix. For every automated test method, track which standard applies, what evidence exists, and when it was last verified. When a sensor is replaced, when a sequence is modified, or when a new test article is introduced, the matrix tells you what needs re-validation.

Third, design for auditability from the start. ISO 17025 and functional safety audits both ask the same question in different forms: "Show me how you know this is correct." If the automation system cannot produce a timestamped, tamper-evident record of calibration status, interlock state, and test execution, the answer is not defensible. Retrofitting audit trails is far more expensive than building them in.

The next section builds on these foundations by examining how test cell automation architectures are structured to satisfy these requirements in practice.