plus the engineer to safety it
That would be me. Let's not forget about the Pilz PNOZ Multi safety PLC (or Allen-Bradley GuardLogix, if you prefer) with safety DeviceNet I/O modules for each major subassembly, and DCS on the robot with communication through DeviceNet to the safety PLC so that we can prove it's not going to hit the poor operator.
It costs a lot of money to do something very cheaply.