Safety: Standards, Safeguarding and Cobots
ISO 10218, risk assessment, light-curtain distance, stopping distance, speed and separation monitoring and power and force limiting.
Why robots are dangerous
An industrial robot is strong, fast and can move without warning. It has no idea there is a person there, and the force at the tool of even a small robot can injure. Most accidents happen not during normal automatic running, behind guards, but during teaching, programming, maintenance, fault clearing and set-up, when a person is close to the robot with the guards open. Safety is designed in at the start, for the whole cell: the robot, its tool, the part it carries, the layout and the people who work around it.
| Hazard | Example |
|---|---|
| Impact and crushing | The arm strikes a person or traps them against a fixture, fence or machine |
| Ejection | A dropped or thrown part, a broken tool, a released spring |
| Tool hazards | Sharp edges, welding arc and fume, laser, hot parts, a moving gripper that pinches |
| Unexpected movement | A restart, a program fault, a wrong signal from the PLC, a brake failure |
| Entrapment | A person inside the cell when it starts |
| Electrical, pneumatic, stored energy | The controller cabinet, air in the tool, gravity on an arm when the brakes are released |
| Ergonomic and noise | Loading heavy parts, noise from air exhausts |
The standards
The standards are the common basis of the legal requirements (the EU Machinery Directive and Regulation, OSHA and the US consensus standards, and the rules in other countries). They change, so always use the current edition of the ones that apply to you.
| Standard | What it covers |
|---|---|
| ISO 10218-1 | Safety requirements for the robot itself (the manufacturer’s part) |
| ISO 10218-2 | Safety requirements for the robot system and integration (the integrator’s part): layout, safeguarding, validation |
| ISO/TS 15066 | Collaborative operation: the four methods and the limits for contact with people. The 2025 revision of ISO 10218 brings much of this into the main standard; check the current edition. |
| ISO 12100 | General principles of risk assessment and risk reduction for machinery |
| ISO 13849-1 and IEC 62061 | The design of the safety-related control system: performance levels (PL) and safety integrity levels (SIL) |
| ISO 13855 | Positioning of safeguards: the safety distance calculation used below |
| ISO 13857 | Safety distances to prevent upper and lower limbs reaching dangerous zones (guard heights and openings) |
| ISO 14120 | Design and construction of fixed and movable guards |
| IEC 61496 | Electro-sensitive protective equipment: light curtains and laser scanners |
| ISO 13850 | Emergency stop function |
| ANSI/A3 R15.06 | The US adoption of ISO 10218 for industrial robot systems |
| IEC 60204-1 | Electrical equipment of machines (including stop categories) |
A robot sold as “collaborative” is only a robot built for use in collaborative applications. The application, with its tool and part, has to be assessed and validated. See Industrial Robotics for the way this guide is organized.
Risk assessment
The risk assessment is the heart of robot safety. It identifies the tasks (running, teaching, loading, clearing jams, maintenance, cleaning), the people involved and the hazards for each; estimates the risk from the severity of the harm and the probability of it (which depends on how often people are exposed, how likely a hazardous event is and whether they can avoid it); and chooses measures in order: design it out, then safeguard, then inform and train.
Worked example: a simple risk ranking
Score the severity (1 minor to 4 fatal) and the probability (1 rare to 4 frequent) of each hazard of a palletizing cell, and multiply:
| Hazard | Severity | Probability | Risk | Action |
|---|---|---|---|---|
| Impact by the arm during automatic run | 4 | 2 | 8 | high: needs a safety function |
| Crushing between arm and fixture | 4 | 2 | 8 | high: needs a safety function |
| Ejection of a gripped part | 3 | 2 | 6 | medium: reduce |
| Welding flash or fume | 2 | 3 | 6 | medium: reduce |
| Electric shock in the controller | 4 | 1 | 4 | medium: reduce |
| Trapping inside the cell | 4 | 1 | 4 | medium: reduce |
- The ranking tells you where the safety functions must be strongest. Real assessments use a method from ISO 12100 or ISO 13849 (the risk graph), and treat each task and each person separately.
- Re-do the assessment whenever the cell changes: a new tool, a new fixture, a faster speed or a different operator task.
Safeguarding methods
| Method | How it protects | Notes |
|---|---|---|
| Fixed fences and guards | A physical barrier around the robot’s working area | The simplest and most reliable; heights and openings per ISO 13857 |
| Interlocked doors | Opening a door stops the robot; closing it does not restart it | Coded, tamper-resistant switches; a lock that holds the door until the robot has stopped where the stopping time is long |
| Light curtains | A plane of light across an opening: breaking it stops the robot | Must be at a calculated distance; the opening must be fully closed off elsewhere |
| Laser scanners | A protective field on the floor; warning and protective zones | Good for open sides and for mobile robots |
| Pressure mats | A person standing on the mat stops the robot | Less used; can be bridged by a ladder or trolley |
| Two-hand controls | Both hands on controls keeps them out of the area | For a single operator only |
| Hold-to-run and enabling devices | The robot moves only while a switch is held | The three-position enabling switch on the pendant |
| Speed and force limiting | The robot is made inherently safe to touch | Collaborative operation (below) |
| Safe zones and limits | Software axis and Cartesian limits with a safety rating | Restrict where the robot can go, and how fast, with certified safety functions |
Safety distance for a light curtain
A light curtain stops the robot when a person reaches into the beam. It must be far enough from the hazard that the robot has stopped before the person gets there. ISO 13855 gives the minimum distance:
S = K × T + C
S is the minimum distance in mm from the detection plane to the hazard; K the approach speed of the body (2 000 mm/s for a result up to 500 mm, 1 600 mm/s where the result is above 500 mm); T the total time in seconds from the beam being broken to the robot being stopped (the sum of the response times of the sensor, the controller and the stopping time of the robot); and C an allowance for the reach through the curtain before it detects, for a detection capability d up to 40 mm C = 8 × (d − 14).
Worked example: where does the curtain go?
A light curtain with a 30 mm detection capability. The stopping time is made up of the parts below:
| Part of the stopping time | Time |
|---|---|
| Light curtain response | 0.020 s |
| Safety controller and relay | 0.030 s |
| Robot stopping time (measured) | 0.250 s |
| Total T | 0.300 s |
- C = 8 × (30 − 14) = 128 mm.
- First try K = 2 000 mm/s: S = 2 000 × 0.300 + 128 = 728 mm, above 500 mm, so use K = 1 600 mm/s: S = 1 600 × 0.300 + 128 = 608 mm.
- The stopping time dominates. Cutting the robot’s stopping time to 0.15 s (a faster brake or a more powerful stop) cuts the distance to 428 mm, and a finer curtain helps too (below).
- With the earlier stopping time T = 0.30 s, the distance for different detection capabilities is:
| Detection capability d | C = 8 (d − 14) | S = 1 600 × 0.3 + C |
|---|---|---|
| 14 mm | 0 mm | 480 mm |
| 20 mm | 48 mm | 528 mm |
| 30 mm | 128 mm | 608 mm |
| 40 mm | 208 mm | 688 mm |
The curtain must sit at least that far from the nearest point the robot (or its tool and part) can reach. If the distance is too long for the space, reduce the stopping time (see Payload, Inertia, Speed and Cycle Time), use a finer curtain, or use a physical guard instead.
- Use the measured stopping time of the robot at the worst speed, load and pose, with the safety controller’s response, not a datasheet figure.
- Block access around the curtain: a person must not be able to step over, under or round it. Add a mechanical barrier or more curtains.
- Once the curtain is broken, a deliberate restart (a reset outside the cell, where the whole cell can be seen) is needed unless the arrangement allows an automatic restart and the risk assessment accepts it.
Stopping time and distance
The robot’s stopping time and distance are measured, not calculated, because they depend on the speed, the payload, the pose, the stop type and the brakes. A stop category 0 removes power and the brakes stop the arm (fast and rough); a category 1 brings the arm to a stop under control and then removes power (smoother, often shorter); category 2 stops with power held on (a protective stop, resumable).
Worked example: an estimate
At a tool speed of 1.5 m/s, a 50 ms reaction time and a deceleration of 5 m/s²: the robot travels 1.5 × 0.05 + 1.5² ÷ (2 × 5) = 300 mm in 0.35 s. Halve the deceleration (a heavy load, a worn brake) and the distance rises to 525 mm. Test the real values with the real tool and payload, and re-test after changes and as the brakes wear.
- Brake testing: periodic tests confirm that each brake holds; a failed test must stop the robot.
- A gravity-loaded axis (the shoulder) can drop when the brake is released: secure it before any work under the arm.
- Safe torque off (STO) in the drives removes the ability to produce torque (see Motion Control and Actuators).
Teaching, manual and automatic modes
- Manual reduced speed (T1): the tool speed is limited to 250 mm/s, and the pendant has an emergency stop and a three-position enabling switch: the robot moves only when it is held half-pressed, and stops if released or squeezed hard. At 250 mm/s the tool moves 125 mm in 0.5 s, slow enough for a person to step away.
- Manual high speed (T2), where it exists, is allowed only for trained people with extra precautions.
- Automatic mode runs only with the safeguards in place and the cell closed; entering opens the interlock and stops the robot.
- Only one person should control the robot. The pendant is carried inside the cell; a second person at the door with a key is a hazard if they can start it.
- A person who enters the cell takes the key or a personal lock with them (lock-out), so that nobody can close the door and start the robot.
- Clear the cell and check before returning to automatic: look for people (an entrapment check), then reset.
Collaborative operation
In collaborative operation a person and a robot share a workspace without the fence, but only after a risk assessment shows that the specific application is safe. There are four methods, which can be combined:
| Method | How it protects | Typical use |
|---|---|---|
| Safety-rated monitored stop | The robot stops when a person enters the shared area and resumes automatically when they leave | Loading a part by hand into a robot-served fixture |
| Hand guiding | The operator moves the robot by hand using a guiding device, with an enabling control and limited speed | Teaching; assisted lifting |
| Speed and separation monitoring (SSM) | Sensors track the person; the robot slows and stops as the distance shrinks | Large cells shared by robots and people |
| Power and force limiting (PFL) | The robot limits force, pressure and speed so that contact with a person stays below injury thresholds | Cobots working beside people |
Speed and separation monitoring
The robot must keep a protective separation distance Sp from the person, so that it can stop before they meet. It is the sum of the distance the person may move while the robot reacts and stops (Sh = Kh (Tr + Ts), with Kh = 1.6 m/s), the distance the robot travels in its reaction time (Sr = vr Tr), the robot’s own stopping distance (Ss), and an allowance for the measurement uncertainty and intrusion (C and Z).
Worked example: separation at 0.5 m/s
- Reaction time Tr = 0.15 s; the robot stops from 0.5 m/s at 2 m/s² in Ts = 0.25 s, covering 0.06 m.
- Sh = 1.6 × (0.15 + 0.25) = 0.64 m; Sr = 0.5 × 0.15 = 0.08 m; plus 0.10 m for the allowances: Sp = 0.88 m.
- The table shows how the distance grows with the speed and falls with better braking. The robot slows as a person approaches, so that the distance needed shrinks with the speed.
| Robot speed | Deceleration | Sh (m) | Sr (m) | Ss (m) | Sp |
|---|---|---|---|---|---|
| 0.25 m/s | 2 m/s² | 0.44 | 0.04 | 0.02 | 0.59 m |
| 0.50 m/s | 2 m/s² | 0.64 | 0.08 | 0.06 | 0.88 m |
| 1.00 m/s | 2 m/s² | 1.04 | 0.15 | 0.25 | 1.54 m |
| 0.50 m/s | 5 m/s² | 0.40 | 0.08 | 0.03 | 0.60 m |
Power and force limiting
ISO/TS 15066 gives limits for the force and pressure a robot may exert on each part of the body in contact, with the body regions’ stiffness. For a transient contact the permitted speed follows from a simple model of a spring (the body) struck by the robot’s effective mass meff: the peak force is F = v √(k meff), so vmax = Fmax ÷ √(k meff).
Worked example: how fast may a cobot move?
Take a robot with an effective mass meff of 4 kg (the moving mass at the point of contact, including the payload). With the illustrative body-region data below (force limit Fmax, spring constant k):
| Body region | Fmax | k | vmax | In mm/s |
|---|---|---|---|---|
| Hand and fingers | 140 N | 75 N/mm | 0.26 m/s | 256 mm/s |
| Forearm | 160 N | 40 N/mm | 0.40 m/s | 400 mm/s |
| Chest | 140 N | 25 N/mm | 0.44 m/s | 443 mm/s |
| Face | 65 N | 150 N/mm | 0.08 m/s | 84 mm/s |
- For the hand, vmax = 140 ÷ √(75 000 × 4) = 0.26 m/s. A face contact allows far less: for the face vmax is only 0.08 m/s.
- A heavier effective mass is slower: at 12 kg the hand limit falls to 0.15 m/s. A heavy or sharp tool turns a safe cobot into a dangerous one.
- Do not use these numbers for a real design: the values here are rounded and illustrative. Take the body-region limits, spring constants and the method from the current standard, measure the real forces with a force-pressure meter on the real application, and have the assessment done by a competent person.
- Clamping and trapping hazards remain: a robot that is safe to touch can still pin a hand against a fixture or the table. Avoid gaps of 25 to 120 mm.
- Sharp tools and parts, hot parts and moving machines need their own safeguards even on a cobot.
- Quasi-static and transient contact are treated differently: pinned contact is limited more strictly than a brief bump.
- Safety-rated functions (speed, force and position limits, SSM) must be performance level d, category 3, like any robot safety function.
The safety circuit
The safety devices (emergency stops, gate switches, light curtains, scanners, enabling devices) connect to the robot controller’s safety inputs and to a safety controller or relay that can stop other equipment (conveyors, feeders, a machine). The circuit is designed for a required performance level: robot safety functions are normally required to be at least PL d, category 3 (ISO 13849-1), which means redundant channels with monitoring so that one fault does not lose the safety function.
| Element | Notes |
|---|---|
| Emergency stop | Mushroom pushbuttons on the pendant, at the operator station and at the cell doors; wired to the safety circuit, always effective |
| Gate interlock | Two-channel coded switches; muting only when risk assessment allows |
| Light curtain / scanner | Type 4 (IEC 61496) devices, wired as redundant outputs |
| Safety PLC or relay | Monitors the inputs and the outputs, cross-checks; resets by a deliberate action |
| Safety on the network | PROFIsafe, CIP Safety or FSoE with certified devices; separate from the standard data |
| Robot controller safety functions | Safe limits, safe tool orientation and speed, safe stop: configured and password-protected |
- Keep the PLC’s ordinary outputs out of the safety function: the PLC may fail dangerously; safety must work without it.
- Test every device and every function at commissioning, including a deliberate fault where possible, and record the results (see Commissioning, Maintenance and Troubleshooting).
- See System Integration for the safety circuit of the whole system.
Validation, records and responsibility
- Validate the safety functions by test: stopping times and distances, light-curtain distance, door interlocks, emergency stops, speed limits, safe zones. Record the results and keep them with the cell.
- Who is responsible: the manufacturer for the robot itself; the integrator for the safety of the robot system (the risk assessment, the safeguarding, the validation); and the user for safe use, training and maintenance. A change by the user makes them responsible for it, and needs the assessment reviewed.
- Train everyone who works in or near the cell: operators, maintenance staff, visitors, and the people who clear jams.
- Sign the cell: warning signs, floor markings, instructions at the door, a marked emergency stop at every access point.
- Review after any incident, near miss or change, and at least yearly.
- Marking and legal status: the CE mark (EU/UK), listing or field evaluation (US and elsewhere) and the technical file depend on the region: check the requirements before delivery.
This page is an introduction, not a design guide. Safety distances and risk assessments for a real cell must be done by competent people against the current standards, with the manufacturer’s data.
Related
- Industrial Robotics: the overview of this guide.
- Payload, Inertia, Speed and Cycle Time: stopping time and distance.
- Cell Design, PLC Integration and Feeding: the layout, fence and PLC signals.
- System Integration and Motion Control and Actuators (safe torque off, brakes).
FAQ
Can a cobot work without a fence?
Possibly, but only after a risk assessment of the specific application, including the tool, the workpiece and the speed. Many cobot applications still need safeguarding because of a sharp or heavy payload or a trapping hazard.
How far must a light curtain be from the robot?
S = K T + C (ISO 13855), where T is the total stopping time including the robot’s own, K the approach speed of the body and C an allowance for reaching through. Measure the real stopping time. A 30 mm curtain with a 0.3 s stop needs about 600 mm.
Who is responsible for the safety of a robot cell?
The integrator, with the user, for the whole cell: risk assessment, safeguarding and validation. The robot maker is responsible for the robot itself. Any change to the cell needs the risk assessment reviewed.
Is the pendant’s emergency stop enough?
No. Emergency stops must be at every access point and at the operator station, wired into the safety circuit. The pendant’s own stop and enabling switch cover the person holding the pendant.
References
- ISO 10218-1 and ISO 10218-2, Robotics: safety requirements for industrial robots and robot systems (2025 revision); ISO/TS 15066, Collaborative robots.
- ISO 13855, Positioning of safeguards with respect to the approach speeds of parts of the human body; ISO 13857, ISO 14120, ISO 12100, ISO 13849-1 and IEC 62061; IEC 61496.
- ANSI/A3 R15.06 (US); the HSE and OSHA guidance on robot safety; manufacturers’ safety manuals.
Last reviewed: October 2026. Distances, times and limits on this page are illustrative: use the standards, the manufacturers’ data and measured stopping performance.