Robot Safety and Standards

Why robots need their own safety

An industrial robot is a fast, strong machine that moves in three dimensions and can change what it does with a new program. That combination makes it different from a press or a conveyor: its reach is large, its next move is not obvious from the outside, and a robot that stands still may only be waiting for a signal. The main hazards are the ones of any moving machinery — being crushed, pinched or struck — plus whatever the robot holds: a welding torch, a knife, a heavy part that can be dropped.

Most protection therefore keeps people and moving robots apart, or makes sure that when they do share space, the robot is slow and weak enough that contact cannot cause injury. Which of the two fits depends on the task, and deciding that is the job of a risk assessment. The ideas behind functional safety in process plants apply here too: a safety function must work when it is needed, and fail toward a safe state when it breaks.

Risk assessment comes first

Every robot application starts with a risk assessment: list the hazards in every phase of the machine's life (normal production, setup, teaching, cleaning, maintenance, fault finding), estimate how likely and how severe harm would be, and reduce each risk until it is acceptable. The general approach is the same as for risk assessment in IT security; for machinery it is described in ISO 12100:2010, "risk assessment and risk reduction", which ISO confirmed in 2022 and is revising (a draft, ISO/DIS 12100.3, is in progress as of October 2026).

The general principle is to remove a hazard by design where you can (a slower robot, a lighter gripper, rounded edges), to guard against what remains (fences, interlocked doors, light curtains, area scanners, safety-rated speed limits), and only then to rely on warnings, instructions and training. A sign that says "do not enter while the robot runs" is the weakest measure, not the first.

The assessment covers the application, not the robot alone. The same arm is harmless while it moves a cardboard box slowly and dangerous while it swings a sharp metal part at full speed. That is why a cobot bought "as safe" is not automatically safe in your cell.

ISO 10218: the robot safety standard

ISO 10218 is the international safety standard for industrial robots, in two parts. Part 1, "Industrial robots" (ISO 10218-1:2025, edition 3), covers the robot itself and is aimed at manufacturers. Part 2, "Industrial robot applications and robot cells" (ISO 10218-2:2025, edition 2), covers the robot together with its tool, workpiece, guarding and surroundings, and is aimed at the integrators who build the robot cell. Both were published in February 2025 and replace the 2011 editions. Europe adopted them as EN ISO 10218-1/-2:2025 without changes; the US adopted them as ANSI/A3 R15.06-2025 (see the law below).

What changed in 2025

According to the forewords of the 2025 editions:

• Part 1 divides robots into Class I and Class II for the functional safety requirements, with a test method for the maximum force of a Class I robot.
• Both parts add cybersecurity requirements: an attacker who can change a safety setting is a safety problem (see below).
• The requirements for collaborative applications, formerly in ISO/TS 15066, are now in the standard itself — most of them in Part 2.
• The words changed: Part 2 no longer uses "collaborative robot" or "collaborative operation". Only the application can be collaborative.

Collaborative applications

In a collaborative application, people and a robot share a workspace while the robot works, without a fence between them, and the risk is kept low by what the robot and its safety system do. "Cobot" (collaborative robot) is still the everyday market name for arms designed for this (see What Is Robotics?), but in ISO 10218:2025 the robot is just a robot: a cobot moving a knife at full speed is not a collaborative application.

The standard names three collaborative capabilities a robot can offer to make such an application safe:

• Hand-guided control: a person moves the robot by hand, through a guiding device on the arm, for example to teach positions.
• Speed and separation monitoring: the robot keeps enough distance from people.
• Power and force limiting: contact is allowed, but the robot cannot push or hit hard enough to cause injury.

Speed and separation monitoring

Speed and separation monitoring (SSM) is a collaborative capability in which sensors such as laser area scanners or safety cameras measure how far people are from the robot, and the safety system slows the robot down as they come closer and stops it before contact is possible. The required distance depends on how fast the robot moves, how long it needs to stop, how fast a person can approach and how uncertain the measurement is; ISO 10218-2:2025 gives the calculation in its normative Annex L.

The example uses a simplified version with assumed numbers — not the formula of the standard — to show why robots near people move slowly:

# Why speed and separation monitoring slows a robot down near people.
# A simplified illustration, NOT the formula of ISO 10218-2:2025 Annex L.
# All numbers are assumptions chosen for this example.
REACTION_S = 0.1     # sensor and controller reaction time (assumed)
BRAKING_S = 0.3      # time the robot needs to brake to a standstill (assumed)
PERSON_SPEED = 1.6   # m/s, assumed walking speed toward the robot
MARGIN_M = 0.2       # extra margin for measurement uncertainty (assumed)

def separation_needed(robot_speed):
    """Return (robot travel, free distance needed) in meters."""
    # full speed during the reaction time, then on average half speed
    robot_travel = robot_speed * REACTION_S + robot_speed * BRAKING_S / 2
    person_travel = PERSON_SPEED * (REACTION_S + BRAKING_S)
    return robot_travel, robot_travel + person_travel + MARGIN_M

print("robot speed   robot travels   separation needed")
for speed in (1.5, 1.0, 0.5, 0.25):
    travel, needed = separation_needed(speed)
    print(f"{speed:5.2f} m/s     {travel:.4f} m        {needed:.4f} m")

robot speed   robot travels   separation needed
 1.50 m/s     0.3750 m        1.2150 m
 1.00 m/s     0.2500 m        1.0900 m
 0.50 m/s     0.1250 m        0.9650 m
 0.25 m/s     0.0625 m        0.9025 m

Two things stand out. Slowing the robot down shrinks the zone it needs, so a cell can stay compact. And the person's own movement during the stopping time is the largest part: a faster-reacting safety system and a robot that brakes quickly matter as much as a low speed. Real values come from measured stopping times and the standard, never from estimates like these.

Power and force limiting

Power and force limiting (PFL) is a collaborative capability in which contact between the robot and a person is allowed, but the robot's speed, force and energy are limited so that a contact stays below the limits the body can tolerate. ISO 10218-2:2025 lists biomechanical limits in its informative Annex M and describes how to validate a PFL application in Annex N. The limits depend on the body region: a hand tolerates more than a face, and a robot that could clamp a hand against a table is riskier than one that only brushes an arm in free space. That is why applications with sharp tools, heavy payloads or contact near the head are often hard to make safe with PFL alone, even on a cobot.

ISO/TS 15066

ISO/TS 15066:2016 is the ISO technical specification for collaborative robot applications that first gave biomechanical limits for power and force limiting. ISO lists it as still current (last confirmed in 2022) and as being revised into ISO 15066-1, but most of its requirements are now part of ISO 10218-2:2025. Older risk assessments and vendor documents cite it; new work starts from ISO 10218.

Stops

A robot can be stopped for safety in different ways, and the differences matter on the shop floor.

Protective stop

A protective stop is a stop triggered by the safety system — for example because an interlocked door opened, a light curtain was interrupted or a person entered a protective zone — after which the robot can resume once the cause is gone and the restart conditions are met. It is part of normal operation: a robot cell may perform dozens of protective stops a day without anything being wrong. A protective stop is not a pause you may walk into without thinking: before entering a cell for maintenance, follow the site's lockout procedure so the robot cannot restart while you are inside.

Monitored standstill

Monitored standstill is the ISO 10218:2025 name for a state in which the robot stands still with its drives still powered, while the safety system checks that it does not move; if it moves anyway, a protective stop follows. It replaces the older "safety-rated monitored stop" (the American standard ANSI/A3 R15.06-2025 also uses the new term). It is useful when a person briefly works next to a waiting robot, for example to put a part in a fixture.

Emergency stops

An emergency stop is different: usually a red button on a yellow background that any person can press when something goes wrong, which brings the machine to a stop and keeps it stopped until it is deliberately reset. It is a complementary measure, not a replacement for guards: a cell that is only safe because someone is ready to press the button is not safe. Every teach pendant has one, and the cell has more of them within reach.

Safety-related control systems

A door interlock, an area scanner or a speed limit only protects anyone if the electronics and software behind it are reliable enough. Two standards describe how to design and rate those safety-related parts of a machine's control system:

• ISO 13849-1:2023 (edition 4) rates a safety function with a performance level from PL a (the lowest) to PL e (the highest).
• IEC 62061:2021 (amended in 2024) does the same for the safety-related control systems of machines, mainly electrical and electronic (the 2021 edition also covers other technologies), with safety integrity levels.

IEC 62061 is the machinery version of the generic functional safety standard IEC 61508 and its safety integrity levels, which the OT topic explains; ISO 13849-1 has its own performance levels, which map roughly onto them. The risk assessment decides which level each safety function needs: a function that protects against a crushing hazard needs a higher level than one that prevents a minor bump. A robot's datasheet therefore lists its safety functions with their ratings, and the integrator checks that each rating is high enough for the application.

Two more standards matter for robots that are not fixed arms:

• ISO 3691-4:2023 covers driverless industrial trucks and their systems, including automated guided vehicles and autonomous mobile robots (a revision is in progress). The mobile robots in a warehouse fall under it.
• ISO 13482:2014 covers personal care robots, such as robots that help people move or carry things; ISO expects to replace it with a new edition soon (as of October 2026).

Cybersecurity is part of safety

A robot controller is an OT asset: it sits on an industrial network, talks to a PLC, and is programmed from an engineering laptop or a teach pendant. Whoever can change its program or safety configuration can change how it moves near people. That is why the 2025 editions of ISO 10218 added cybersecurity requirements, and why robot cells belong in the same security program as the rest of the plant.

The defensive basics are the ones of any OT environment: segment the robot network into its own zone, allow only the connections the cell needs, control who can change programs and safety settings, log changes, and treat remote access by vendors and integrators as a controlled exception. The standard for this is IEC 62443; how safety and security depend on each other is explained on OT Security Fundamentals.

The law

Standards describe how to build a safe robot application; the law says who must make it safe. Two kinds of rules apply almost everywhere: product rules for the maker or integrator who places a machine on the market, and workplace rules for the employer who lets people work with it. In the European Union the product rules for machines are set, from 20 January 2027, by the Machinery Regulation, Regulation (EU) 2023/1230: the EU law that sets the essential health and safety requirements every machine, including a robot application, must meet before it may be placed on the EU market. The details differ per region; this is an overview, not legal advice, and dates are as of October 2026.

from datetime import date

# Regulation (EU) 2023/1230 applies from 20 January 2027 (after the
# corrigendum; the first published text said 14 January).
APPLIES_FROM = date(2027, 1, 20)

def machinery_law(placed_on_market):
    """Which EU machinery law a machine follows, by its market date."""
    if placed_on_market < APPLIES_FROM:
        return "Directive 2006/42/EC"
    return "Regulation (EU) 2023/1230"

for day in (date(2026, 10, 15), date(2027, 1, 19), date(2027, 1, 20)):
    print(day.isoformat(), "->", machinery_law(day))

2026-10-15 -> Directive 2006/42/EC
2027-01-19 -> Directive 2006/42/EC
2027-01-20 -> Regulation (EU) 2023/1230

Working safely around robots

Most people who meet a robot at work did not design its cell. For operators, technicians and the service desk colleague who gets the call "the robot stopped", a few habits matter most:

• Treat a stopped robot as live. It may be in a protective stop or monitored standstill, waiting to continue. Only a lockout of its energy sources, done by the procedure, makes it safe to enter.
• Know why it stopped before resetting. A protective stop has a cause — an open door, a person in a zone, a fault. Resetting without finding it hides the problem until the next time.
• Never defeat a safeguard. A taped-down enabling switch, a door switch held closed with a magnet or a muted scanner turns a safe cell into a dangerous one. Report a safeguard that gets in the way of the work; it usually means the cell needs changing.
• Changes need a new risk assessment. A new gripper, a faster program, a moved fence or an updated safety configuration can invalidate the old assessment.
• Report near misses. A robot that came closer than expected is information the safety engineer needs, not a story to keep quiet.