The Robot Restarted While He Was Inside: Lessons From the Narangba Packaging Incident
- Safety Jon
- 9 minutes ago
- 9 min read
A robot did not suddenly become confused, develop intent or decide that a worker was a box. It performed the movement its control system allowed it to perform while a person remained inside its hazardous operating envelope.
On 10 Jan 26, a worker entered part of an automated packaging line at Multisteps’ Narangba factory in Queensland to inspect a sensor. The machine had reportedly stopped twice within approximately ten minutes and was known to malfunction regularly.
While the worker was positioned within the roller conveyor, the robotic packing arm resumed operating. It struck him from behind, pushed him headfirst towards a box packing machine and continued striking him as he attempted to escape.
The worker survived. A relatively small change in his position, posture or timing could have produced a very different prosecution.
Thirty Seconds Inside the Machine
The worker, identified in court as Mr Lin, had been checking the packaging line after it stopped for the second time within ten minutes. He entered the roller conveyor to inspect a sensor associated with the robotic packing arm.
The arm restarted while he was inside the operating area. It struck Mr Lin in the back, pushed him headfirst towards the adjoining box packing machine and repeatedly struck him while he kicked against the machinery in an attempt to free himself.
The incident continued for approximately 30 seconds before another worker intervened. Mr Lin was taken to hospital and remained there overnight with multiple fractured ribs, bruising to his lung and torso, and other soft tissue injuries.
Acting Magistrate Janelle Boegheim reviewed footage of the incident during the later sentencing proceeding. She observed that the injuries could have been “catastrophic” if a more vulnerable part of Mr Lin’s body had become trapped.
That is often the worst part of being an inspector or safety investigator, is watching the footage of not only what went wrong and the injuries sustained, but just how close someone came to death.
That is the first lesson from this incident. The difference between a serious injury and a fatality can be measured in centimetres, seconds and the position in which a worker happens to fall.
The Caboolture Prosecution
Multisteps pleaded guilty to a Category 2 offence under section 32 of Queensland’s Work Health and Safety Act 2011. A Category 2 offence applies where a person fails to comply with a health and safety duty and that failure exposes an individual to a risk of death or serious injury or illness.
On 29 Jul 26, the company was fined $125,000 in the Caboolture Magistrates Court and ordered to pay $1,615 in legal costs. The court considered the company’s cooperation and the fact that Mr Lin entered the conveyor on his own initiative, rather than being directed to do so.
That conduct reduced the company’s culpability, but it did not remove the underlying duty. A foreseeable interaction between a worker, a repeatedly malfunctioning machine and an accessible danger zone still had to be controlled.
The company decommissioned four packaging lines reportedly valued at approximately $250,000 and spent a further $150,000 on safety and machinery improvements. It also reported an approximate $15 million loss following the shutdown and decommissioning of the affected lines.
The $125,000 fine was therefore only the cleanest number in the story. The broader consequence included serious injury, plant shutdown, lost production, discarded capital, remedial expenditure, investigation costs and damage to organisational reputation.
The incident and sentencing details were reported by The Courier-Mail.
The Warning Had Already Been Given
The court heard that a production supervisor assessed the packaging machines after technicians installed them in 2024. The machines were reportedly classified as presenting a “very high risk”, and the supervisor recommended that isolation procedures be implemented.
The supervisor subsequently died (not at work), and the recommended measures were not carried through. The risk had been identified, its potential severity had been assessed and a control had been recommended, but the organisation did not convert that recommendation into a verified working system.
This is more than a machinery issue. It is an action management and organisational memory failure.
A risk assessment does not control plant. A recommendation does not prevent movement, and a coloured cell in an action register cannot stop a robotic arm.
A safety action involving a potentially fatal hazard requires an accountable owner, a defined completion date and escalation when the action becomes overdue. Closure should require evidence that the control has been installed, commissioned, tested and communicated to the people expected to rely upon it.
If an action disappears when one person leaves the business, changes position or dies, the organisation never properly owned the action. It merely borrowed that person’s memory until the memory was no longer available.
A Malfunction Changes the Work
The packaging line had reportedly stopped twice within approximately ten minutes.
Those stoppages were not just production interruptions because they changed the work from normal operation into troubleshooting and fault finding.
Workers responding to a stopped line may clear jammed products, inspect sensors, realign materials, check guards or attempt to determine why the machine will not complete its cycle. These activities can place them much closer to hazardous movement than normal production does.
A stationary machine may still be energised and capable of restarting. Electrical power, pneumatic pressure, hydraulic pressure, gravity and stored mechanical energy can remain available even when no component appears to be moving.
The second stoppage should have been a defined escalation point. The line should have been withdrawn from normal service, isolated and inspected by an authorised and competent person under a controlled fault recovery process.
The prosecution report does not establish that production pressure caused Mr Lin’s decision. It does establish that the machine stopped repeatedly and that entry into the conveyor was possible while hazardous movement could resume.
A safe system must address that foreseeable combination. It cannot be designed only for the polite version of production where machinery behaves itself and everyone has plenty of time.
Stopping Is Not Isolation
Pressing a stop button does not necessarily isolate a machine. Pressing an emergency stop does not necessarily isolate it either.
An emergency stop may interrupt movement through the control circuit, but energy can remain available to the machine. A control fault, reset, sensor signal or action by another person may still allow hazardous movement to occur.
Before a person enters a robotic cell, conveyor or other danger zone, the relevant energy sources must be identified and isolated. Stored energy must be dissipated or restrained, the isolation must be secured against restoration, and the worker must verify that the machine cannot operate before entering.
Where personal isolation is required, the person entering the area should apply their own lock. The system should prevent anyone else from restoring the energy until every person exposed to the hazard has removed their lock and confirmed that the area is clear.
Isolation procedures must cover more than scheduled maintenance. They should expressly apply to jam clearing, sensor inspection, product recovery, adjustment, cleaning, testing and investigation of intermittent faults.
Access Should Have Been Controlled
Without the complete plant design and investigation evidence, it would be improper to declare which individual component or safeguard failed. The essential outcome remains clear, however, because a person was able to enter a hazardous operating area and the robot was able to resume movement while he remained there.
Section 208 of Queensland’s Work Health and Safety Regulation 2011 establishes specific requirements for guarding plant. Where access is unnecessary, guarding should be a permanently fixed physical barrier, while areas requiring access should generally be protected by an interlocked barrier that prevents access while the area presents a risk.
Where fixed or interlocked physical barriers are not reasonably practicable, other arrangements may include safety rated presence detection. Light curtains, laser scanners, pressure mats and similar devices must be properly designed, positioned and validated for the plant’s stopping time and the ways a person could approach the danger zone.
A packaging cell may require several complementary controls, including fixed perimeter guarding, interlocked access gates, trapped key systems, safety rated presence detection and controlled reset arrangements. Restart should require a deliberate action from outside the danger zone by a person who can verify that the entire operating area is clear.
Closing an access gate should not automatically restart the machine. Clearing a sensor should not automatically restore hazardous movement, and a reset control should not be positioned where the operator cannot see the area being reactivated.
Emergency stops remain necessary, but they are consequence limitation controls. They do not replace isolation, effective guarding or prevention of access while hazardous movement remains possible.
Video placement: Embed Workplace Health and Safety Queensland’s Machinery gu
The Worker’s Decision Was Relevant, but It Was Not the Whole Explanation
The court accepted that Mr Lin entered the conveyor on his own initiative. That fact belongs in any fair account of the incident, but it should not become the end of the investigation.
A safety system must account for reasonably foreseeable mistakes, shortcuts and responses to abnormal plant behaviour. The hierarchy of control exists because instruction, training and supervision are less reliable than preventing access or automatically removing hazardous energy.
If a danger zone is physically accessible, the machine repeatedly stops and entering the area appears to be the quickest way to identify the problem, reliance on a procedure alone leaves the final control inside the worker’s head. That is a poor location for the only barrier against a fast and powerful robot.
An interlocked guard does not excuse unsafe conduct. It prevents an error in judgement from becoming a crushing injury.
The relevant question is not simply, “Why did the worker climb into the conveyor?”
The better questions are why entry remained possible, why hazardous movement could resume, what fault recovery method workers had been given and whether similar interventions had previously occurred without consequence.
When a Fault Becomes Normal Work
Intermittent faults can quietly become part of the production routine. Workers learn which sensor to wipe, which carton to move and which reset sequence usually gets the line going again.
Each successful informal intervention reinforces the belief that the task is manageable. The absence of injury becomes mistaken for evidence that the method is safe.
Fault records should therefore be treated as safety information, not merely maintenance or production data. Repeated stoppages, emergency stop activations, guard interlock trips, resets and manual interventions can reveal deteriorating plant, unsuitable processes or workarounds developing on the floor.
A defined threshold should require the plant to be removed from service. For a high consequence machine, two unexplained stoppages in ten minutes should not be allowed to drift into a third attempt under the same conditions.
What Organisations Should Review Now
Businesses operating automated or remotely controlled plant should examine every situation in which a worker could approach or enter a hazardous operating envelope.
The review must cover abnormal and non-production activities because that is where the designed sequence and actual work frequently part company.
The following matters warrant immediate attention:
Map every crushing, trapping, shearing and impact zone associated with robotic arms, conveyors, transfer points and adjoining machines. The assessment should consider the full reach, speed and possible unexpected movement of the plant.
Review every operating mode, including setup, cleaning, adjustment, jam clearing, sensor inspection, fault finding, maintenance, testing and recovery after an emergency stop. A control that only protects workers during normal production is incomplete.
Verify that fixed guards, interlocked gates and presence sensing systems prevent hazardous movement as designed. Functional testing should include foreseeable defeat, bypass and failure scenarios.
Confirm that opening a guard or interrupting a presence sensing device brings the plant to a safe state. Restoring the guard should not automatically restart the machine.
Review personal isolation procedures against every available energy source. Workers should be able to isolate, lock, dissipate stored energy and verify the isolation without entering the danger zone first.
Establish clear escalation thresholds for repeated or unexplained faults. Plant that continues to malfunction should be withdrawn from service until inspected and released by an authorised competent person.
Examine historical fault, maintenance, emergency stop and interlock data for repeated intervention patterns. Informal workarounds should be treated as evidence of a control gap, even where no injury has occurred.
Audit all open actions arising from plant risk assessments, commissioning reviews and incident investigations. High consequence actions should remain visible to management and officers until implementation has been independently verified.
Confirm that workers and contractors understand the difference between stopping, emergency stopping and isolating plant. Competence should be demonstrated through practical verification rather than attendance at a presentation.
Ensure officers receive meaningful information about automated plant presenting fatal or catastrophic hazards. Governance reporting should identify overdue actions, recurring faults, failed safety devices and the status of independent plant validation.
The Managing the risks of plant in the workplace Code of Practice 2021 provides Queensland businesses with detailed guidance on guarding, isolation, maintenance, inspection and safe operation. It should be applied to the actual plant and work methods, rather than filed beside the risk assessment that everyone assumes someone else finished.
The Lesson From Narangba
This incident did not require an obscure technical failure or an extraordinary chain of events. A packaging line stopped repeatedly, a worker entered the machinery to inspect a sensor, and the robotic arm restarted while he was inside.
The danger had reportedly been assessed as very high before the incident. Isolation had been recommended, but the recommendation was not converted into an operating control.
Mr Lin survived because another worker intervened and because the machine struck and trapped him in a way that remained survivable. His survival does not demonstrate that the system was adequate because it demonstrates how close that system came to producing a fatality.
Automation can remove hazardous manual work, improve consistency and increase production. It can also apply substantial force with perfect repetition, complete indifference and no understanding that a person has entered its path.
The machine did what the system allowed it to do. The failure was allowing it to do so while a worker was inside.
Comments