Cobot Safety & Risk Assessment
ISO/TS 15066 Compliance & Force Limiting

1. Cobot Safety Fundamentals

Collaborative robots, commonly referred to as cobots, are designed to operate in shared workspaces with human workers without the traditional safety fencing required by conventional industrial robots. However, the term "collaborative" does not inherently mean "safe." A cobot is only as safe as the complete application it is integrated into -- including the end effector, the workpiece, the process parameters, and the workspace layout. The robot itself is merely one component of a collaborative system that must be holistically evaluated for risk.

The foundational safety standards governing collaborative robot applications form a hierarchy. ISO 10218-1 specifies safety requirements for the robot itself, while ISO 10218-2 addresses the robot system and its integration into a cell. ISO/TS 15066 is the critical technical specification that provides detailed guidance on implementing the four collaborative operation modes, including the biomechanical force and pressure thresholds that define the boundary between safe and injurious contact.

A pervasive misconception in the industry is that purchasing a "collaborative robot" from a manufacturer like Universal Robots, FANUC, ABB, or KUKA automatically results in a safe application. In reality, the integrator bears the primary responsibility for ensuring the complete robotic cell -- robot, tooling, workpiece, and environment -- meets the applicable safety requirements. A cobot wielding a sharp deburring tool at maximum speed is no safer than an industrial robot performing the same task.

2. The Four Collaborative Operation Modes

ISO 10218-1/2 defines four collaborative operation modes, each with distinct safety characteristics, performance trade-offs, and implementation requirements. Most real-world applications employ one primary mode, though hybrid approaches combining multiple modes within a single application are increasingly common. The selection of the appropriate mode depends on the risk assessment outcome, the required robot speed and payload, and the nature of human-robot interaction.

2.1 Safety-Rated Monitored Stop (SMS)

In this mode, the robot operates at full industrial speed and payload capacity but comes to a complete, safety-rated stop whenever a human enters the collaborative workspace. The robot may only resume motion after the human has exited the workspace and an explicit restart command is issued. This mode is implemented through safety-rated area scanners, light curtains, or pressure-sensitive mats that define the collaborative zone boundary.

Safety-rated monitored stop is the simplest mode to implement and validate. It is best suited for applications where human intervention is infrequent and predictable -- for example, a loading/unloading task where the operator places parts, steps back, and the robot processes them at full speed. The key requirements are that the robot's stopping distance and stopping time must be verified and documented, and the safety-rated sensors detecting human presence must achieve Performance Level d (PLd) or Safety Integrity Level 2 (SIL 2) as a minimum.

2.2 Hand Guiding (HG)

Hand guiding allows a human operator to physically manipulate the robot to teach positions or perform tasks by grasping a hand-guiding device mounted on the robot's end effector flange. The robot must be equipped with a safety-rated enabling device that the operator holds to permit motion. When the enabling device is released, the robot executes a safety-rated monitored stop. Hand guiding mode typically operates at reduced speeds (maximum 250 mm/s as a common practice) and is most commonly used for programming cobots through physical demonstration.

2.3 Speed & Separation Monitoring (SSM)

Speed and separation monitoring dynamically adjusts the robot's speed based on the measured distance between the robot and the nearest human. When the human is far from the robot, the robot operates at higher speeds. As the human approaches, the robot decelerates proportionally and stops completely if the minimum protective separation distance is breached. This mode allows the robot to maintain productive speeds when the human is not nearby, while ensuring safety when the human is close.

SSM requires safety-rated sensing systems capable of measuring human-robot distance in real-time with sufficient accuracy and update frequency. Common implementations use 3D safety-rated cameras (e.g., SICK safeVisionary2, Pilz SafetyEYE) or LiDAR-based area scanners operating at SIL 2/PLd. The mathematical relationship between speed, separation distance, and stopping characteristics is defined in ISO/TS 15066 and discussed in detail in Section 5.

2.4 Power & Force Limiting (PFL)

Power and force limiting is the most commonly associated mode with "cobots" and allows intentional and unintentional contact between the robot and human. The robot's design limits the forces and pressures exerted during contact to values below the biomechanical pain and injury thresholds defined in ISO/TS 15066. This mode permits the closest human-robot collaboration but imposes the most significant constraints on robot speed, payload, and end-effector design.

PFL cobots achieve force limitation through a combination of mechanical design (lightweight arms, compliant joints, rounded surfaces), torque sensing in each joint, and safety-rated control systems that detect contact and trigger protective stops. The force and pressure limits depend on the specific body region contacted and whether the contact is transient (impact) or quasi-static (clamping).

3. ISO/TS 15066 Biomechanical Limits

ISO/TS 15066 Annex A provides the biomechanical data that forms the quantitative foundation for power and force limiting applications. The limits are derived from pain onset research conducted by the University of Mainz and define the maximum permissible force and pressure for contact with 29 specific body regions. Two contact scenarios are distinguished: transient contact (impact where the body part can recoil freely) and quasi-static contact (clamping where the body part is trapped between the robot and a fixed surface).

3.1 Transient vs. Quasi-Static Contact

Transient contact occurs when the robot strikes a human body part and the person can move away from the contact. The body part recoils freely and the contact duration is brief -- typically less than 500 milliseconds. Because the energy is absorbed over a short duration and the person can deflect, transient force limits are higher than quasi-static limits. The effective mass of the body part and its ability to recoil are key factors.

Quasi-static contact occurs when a body part becomes clamped or trapped between the robot (or its tooling/workpiece) and a fixed object such as a table, fixture, or structural element. The person cannot move away, so the full force is applied to the trapped tissue. Quasi-static limits are significantly lower and represent the more conservative -- and more dangerous -- contact scenario. Eliminating clamping points through workspace design is always the preferred first measure.

3.2 Force Limits by Body Region -- Head & Torso

3.3 Force Limits by Body Region -- Upper Extremities

3.4 Force Limits by Body Region -- Lower Extremities

4. Risk Assessment Methodology (ISO 12100)

Every collaborative robot application requires a risk assessment per ISO 12100 (Safety of machinery -- General principles for design -- Risk assessment and risk reduction). The risk assessment is not a one-time event but an iterative process that begins during concept design and continues through integration, validation, and any subsequent modification of the robotic cell. The integrator is legally and normatively responsible for the risk assessment of the complete system.

4.1 The Risk Assessment Process

1. Define the limits of the machinery: Document the intended use, the foreseeable misuse, the spatial limits (reach envelope, collaborative workspace), time limits (cycle time, shift duration), and all relevant operating modes including teaching, automatic, and maintenance.
2. Hazard identification: Systematically identify all hazards associated with the cobot cell. This includes mechanical hazards (crushing, impact, shearing, entanglement), electrical hazards, thermal hazards from welding or heated workpieces, hazards from emitted materials (sparks, chips), and ergonomic hazards. Use a structured approach such as task analysis, where each human task within the collaborative workspace is analyzed for potential hazard exposure.
3. Risk estimation: For each identified hazard, estimate the risk as a combination of the severity of potential harm and the probability of that harm occurring. Probability factors include frequency and duration of exposure, the probability of the hazardous event occurring, and the possibility of avoiding or limiting the harm.
4. Risk evaluation: Compare the estimated risk against risk acceptance criteria to determine whether risk reduction is required. Risks deemed unacceptable must be reduced through the three-step method (inherently safe design, safeguarding, information for use).
5. Risk reduction: Apply risk reduction measures following the hierarchy: (a) inherently safe design measures -- eliminate the hazard or reduce risk by design choices; (b) safeguarding and complementary protective measures -- guards, safety devices, and safety-rated control functions; (c) information for use -- warnings, labels, training requirements, and PPE specifications.

4.2 Hazard Identification Checklist for Cobot Cells

5. Speed & Separation Monitoring

Speed and separation monitoring (SSM) is the most technically demanding collaborative mode to implement correctly. The fundamental principle is straightforward: the robot must always maintain sufficient distance from the nearest human to stop completely before contact occurs, even in the worst-case scenario of a single safety system fault. The mathematical formulation of the minimum protective separation distance is defined in ISO/TS 15066 Clause 5.5.4.

5.1 Minimum Protective Separation Distance Formula

5.2 SSM Implementation Parameters

6. Power & Force Limiting Validation

Validating that a PFL cobot application complies with ISO/TS 15066 force and pressure limits requires systematic measurement of actual contact forces generated during representative collision scenarios. This is not a theoretical exercise -- physical measurement with calibrated force and pressure measurement devices is mandatory. The validation must cover all reasonably foreseeable contact scenarios, including worst-case conditions of maximum speed, maximum payload, and most hazardous end-effector geometry.

6.1 Measurement Equipment

The primary measurement device for PFL validation is a biofidelic force and pressure measurement system that simulates the mechanical response of human tissue. The device must represent the stiffness and damping characteristics of the body region being evaluated. Two widely-used systems are:

• PILZ PRMS (Power and Force Limiting Measurement System): A spring-damper system calibrated to human body region stiffness values from ISO/TS 15066. Measures peak transient force, quasi-static force, and contact pressure. Provides automated pass/fail evaluation against configurable body region thresholds.
• IFA (Institut fur Arbeitsschutz) CBSF Measurement Device: The reference measurement system developed by DGUV (German Social Accident Insurance). Uses calibrated spring elements representing different body region stiffnesses with integrated force sensors and pressure measurement films.

6.2 Effective Mass & Transfer Energy Calculation

6.3 Body Region Spring Constants

7. Safety-Rated Sensors & Light Curtains

Safety-rated sensors form the perception layer of collaborative robot safety systems. These devices must be certified to the required Performance Level (PLd or PLe per ISO 13849-1) or Safety Integrity Level (SIL 2 or SIL 3 per IEC 62061) and are subject to rigorous verification requirements. Using non-safety-rated sensors for safety-critical functions is a fundamental violation that invalidates the risk assessment and CE marking.

7.1 Sensor Technologies for Cobot Applications

7.2 Sensor Selection Guidelines

Selecting the appropriate safety sensor requires matching the detection technology to the collaborative mode, the environmental conditions, and the required response time. Critical selection factors include:

• Detection reliability in the operating environment: Welding applications produce intense light, spatter, and smoke that can blind optical sensors. Safety radar (e.g., Inxpect Safe Radar) is immune to these conditions. Similarly, dusty environments in woodworking or cement manufacturing may require technologies beyond optical light curtains.
• Minimum object detection capability: For hand and finger detection near PFL cobots, sensors must reliably detect objects as small as 40 mm (a finger). Light curtains with 14 mm beam resolution or 3D cameras with appropriate voxel resolution are required.
• Blanking and muting requirements: Applications where material flows in and out of the detection zone (e.g., conveyor entry/exit points) require configurable blanking zones or muting sensors that temporarily suppress detection in defined areas without compromising overall safety integrity.
• Response time budget: The sensor's response time directly impacts the minimum separation distance in SSM mode. A sensor with 120 ms response time versus one with 40 ms response time can change the required separation distance by 130+ mm at 1.6 m/s human approach speed.

8. Hand Guiding Requirements

Hand guiding mode enables intuitive robot programming and collaborative manipulation tasks where the human physically leads the robot through trajectories. ISO 10218-1 Clause 5.5.3 specifies the minimum requirements for hand guiding implementation, which are often underestimated by integrators.

8.1 Mandatory Requirements

• Hand guiding device: A dedicated physical interface located at or near the end effector that provides the operator with direct control over the robot's motion. This device must include a safety-rated enabling device (dead-man switch) and an emergency stop button within immediate reach of the operator.
• Speed limitation: Robot speed must be limited to a safe value during hand guiding. While ISO 10218-1 does not specify an absolute maximum, the risk assessment must determine the appropriate speed limit. Common practice limits hand guiding to 250 mm/s TCP speed.
• Force limitation: The forces required to guide the robot must be ergonomically acceptable. Excessive resistance causes operator fatigue and reduces teaching accuracy. Most cobot manufacturers implement "freedrive" or "gravity compensation" modes that minimize the guiding forces to 5-15 N.
• Safety-rated enabling device: The enabling device must be a three-position device per ISO 10218-1 Clause 5.8.3. Position 1 = off, Position 2 = enabled (held), Position 3 = off (panic squeeze). The robot must execute a safety-rated stop when the enabling device is released from Position 2 or squeezed through to Position 3.
• Emergency stop: An emergency stop button must be accessible to the operator performing hand guiding, without requiring the operator to release the guiding device to reach it. Ideally integrated into the hand guiding device itself.

9. Application-Specific Risk Examples

9.1 Cobot Palletizing

Palletizing is one of the highest-volume cobot applications. The robot picks boxes from a conveyor and stacks them on pallets. Key risk considerations include the weight and geometry of the boxes (heavy boxes increase effective robot mass during contact), the height of the pallet stack (reaching overhead creates clamping hazards with the pallet and overhead structures), and the presence of the conveyor system (a rigid structure creating trap points). Typical mitigation combines SSM for the approach zone with PFL during the actual stacking operation, and a safety-rated monitored stop if the human enters the immediate pallet zone.

9.2 Machine Tending

In machine tending, the cobot loads and unloads parts from CNC machines, presses, or injection molding machines. The primary risk is the machine itself -- its door, spindle, and clamping mechanisms are not collaborative and present severe crush hazards. The risk assessment must address the interface between the cobot cell and the machine. Best practice uses SMS mode: the cobot operates at full speed while the machine door is closed, and stops immediately if a human enters the loading zone. The machine door interlock must be integrated into the cobot's safety system.

9.3 Screwdriving & Assembly

Collaborative assembly with screwdriving tools presents stabbing and puncture hazards from the screwdriver bit. Even at low forces, a pointed bit concentrating force on a small area can exceed the pressure limits of ISO/TS 15066 for vulnerable body regions like the face or hands. Mitigation strategies include retractable bit covers that only expose the bit during active driving, orientation constraints that prevent the bit from pointing toward the operator, and approach speed limits when the bit is exposed.

9.4 Welding Cobots

Collaborative welding applications introduce thermal hazards (arc radiation, spatter, hot workpieces), fume exposure, and electrical hazards in addition to the mechanical contact risks. Most collaborative welding applications use SSM with a generous separation distance rather than PFL, because the thermal and radiation hazards cannot be mitigated by force limitation alone. The welding arc must be enclosed or the operator must wear appropriate PPE, and the risk assessment must address the full spectrum of welding-specific hazards per ISO 10218-2 Annex G.

10. Common Mistakes in Cobot Safety

Based on our experience auditing over 200 cobot installations across APAC, the following errors are observed repeatedly. Each represents a potential compliance failure and, more importantly, a genuine risk to worker safety.

Additional Frequent Errors

• Incomplete hazard identification: Focusing only on robot contact and ignoring secondary hazards such as ejected workpieces, gripper failure (part drop), pneumatic line whip, or sharp edges on the mounting structure.
• Insufficient documentation: Risk assessment exists as a verbal understanding rather than a formal written document. This fails both regulatory and legal requirements. See Section 13 for documentation requirements.
• Non-safety-rated sensors used for safety functions: Standard industrial cameras or proximity sensors used for human detection in SSM mode without safety certification. These devices have no guaranteed detection reliability, response time, or failure mode behavior.
• Modification without reassessment: Changing the end effector, workpiece, robot program (speed, trajectory), or workspace layout without updating the risk assessment. Any modification that could affect safety requires reassessment and revalidation.
• No periodic re-evaluation: Safety systems degrade over time. Sensors drift, mechanical components wear, and operator behaviors evolve. Regular re-evaluation (annually at minimum, or after any incident) is essential.

11. CE Marking for Cobot Cells

In the European Economic Area (and in many APAC countries that reference EU harmonized standards), a collaborative robot cell is considered a "partly completed machinery" or "machinery" under the EU Machinery Directive 2006/42/EC (and its successor, the EU Machinery Regulation 2023/1230 effective from January 2027). The integrator who assembles the complete robotic cell -- combining the cobot, end effector, safety devices, and workstation -- becomes the manufacturer of the machinery and bears the legal obligation to CE mark the complete assembly.

11.1 CE Marking Steps for Cobot Cells

1. Identify applicable directives: Machinery Directive 2006/42/EC (primary), Low Voltage Directive 2014/35/EU (electrical safety), EMC Directive 2014/30/EU (electromagnetic compatibility). For cobot cells with laser-based sensors: Laser Safety Directive may apply.
2. Apply harmonized standards: ISO 10218-1 (robot), ISO 10218-2 (robot system), ISO/TS 15066 (collaborative operation), ISO 13849-1/2 (safety-related control systems), IEC 62061 (SIL-based alternative to ISO 13849), ISO 12100 (risk assessment).
3. Perform risk assessment: Complete ISO 12100 risk assessment as described in Section 4. This is the mandatory foundation of the CE marking process.
4. Design and implement safety measures: Based on risk assessment outcomes, design the safety system architecture, select safety-rated components, and implement safety-related control functions at the required Performance Level.
5. Validate safety functions: Perform physical validation testing including force/pressure measurements (PFL), stopping distance/time measurements (SMS/SSM), and sensor detection verification. Document all measurement results.
6. Compile technical file: Assemble the complete technical documentation including general description, risk assessment, safety system design calculations, component datasheets, validation test reports, and instructions for use.
7. Draft Declaration of Conformity: The formal statement that the machinery meets all applicable directive requirements. Signed by the manufacturer (integrator) with legal responsibility.
8. Affix CE marking: Apply the CE mark to the machinery with the required visual dimensions and placement.

12. Validation & Testing Procedures

Validation testing provides the objective evidence that the cobot cell achieves the safety performance determined by the risk assessment. Testing must be conducted after the cell is fully assembled and configured in its final production state -- including the production end effector, workpiece (or representative dummy), and all safety devices.

12.1 PFL Force & Pressure Measurement Protocol

1. Identify measurement scenarios: For each reasonably foreseeable contact scenario identified in the risk assessment, define the body region, contact type (transient/quasi-static), robot configuration (joint angles), robot speed, and payload.
2. Configure measurement device: Set up the force/pressure measurement device with the spring element corresponding to the target body region stiffness. Position the device at the contact point identified in the scenario analysis.
3. Execute measurement: Run the robot program through the identified contact scenario, allowing the robot to contact the measurement device. For each scenario, perform a minimum of 3 measurements (5 recommended) and record the peak force, quasi-static force, and contact pressure.
4. Evaluate results: Compare the maximum measured values against the ISO/TS 15066 limits for the applicable body region and contact type. All measurements must be below the specified thresholds. If any measurement exceeds a threshold, the application fails validation and must be redesigned (lower speed, different trajectory, modified end effector).
5. Document results: Record all measurement conditions, device configuration, measurement values, and pass/fail determinations in the validation report.

12.2 Stopping Performance Verification

12.3 Sensor Function Verification

Every safety-rated sensor in the cobot cell must be tested to verify correct operation under the actual application conditions. This includes:

• Detection capability: Verify that the sensor reliably detects a test object of the minimum size specified in the risk assessment (e.g., 40 mm diameter for finger detection, 200 mm for body detection) at all positions within the defined detection zone.
• Response time: Measure the actual end-to-end response time from test object entry to robot stop command. Compare against the value used in the separation distance calculation.
• Environmental interference: Test sensor performance under actual production conditions including ambient light, reflections, dust, vibration, and electromagnetic interference from nearby equipment.
• Fault response: Verify that sensor faults (blocked optics, misalignment, wiring fault) result in the correct safety response -- typically a Category 1 stop followed by lockout.

13. Documentation Requirements

Complete documentation is not merely a bureaucratic requirement -- it is the legal evidence that the cobot cell meets its safety obligations. In the event of an accident, the first question from regulators and legal counsel will be "show us the risk assessment." The absence of proper documentation creates an irrebuttable presumption of negligence in most jurisdictions.

13.1 Required Documents

14. APAC Safety Regulations for Cobots

The regulatory landscape for collaborative robots varies significantly across APAC markets. While many countries reference ISO 10218 and ISO/TS 15066, the local adoption status, enforcement mechanisms, and additional requirements differ. Understanding these differences is critical for companies deploying cobots across multiple APAC facilities.

14.1 Regulatory Framework by Country

14.2 Vietnam-Specific Guidance

Vietnam's regulatory framework for collaborative robots is evolving but currently relies on a combination of general occupational safety legislation and voluntary adoption of international standards. Key considerations for cobot deployment in Vietnam include:

• Decree 44/2016/ND-CP on occupational safety and health inspection requires employers to perform risk assessments for workplace hazards, which explicitly includes machinery. While the decree does not specifically reference collaborative robots, its general provisions apply to all industrial equipment.
• TCVN standards (Vietnamese national standards) include adoptions of ISO 10218, but compliance is generally voluntary rather than mandatory unless specified in a specific industry regulation or by the local labor inspectorate.
• Foreign-invested factories in Vietnam often apply their home-country safety standards (EU, Japanese, Korean) which may exceed local requirements. This is particularly common for Japanese and Korean manufacturers operating in Vietnamese industrial zones, who apply JIS B 8433 or KS B ISO 10218 to their Vietnamese operations.
• Practical recommendation: Regardless of the local regulatory minimum, Seraphim Vietnam recommends designing all cobot installations in Vietnam to full ISO 10218-2 and ISO/TS 15066 compliance. This provides the highest level of worker safety, satisfies export market requirements, and provides legal protection in the event of an incident. The incremental cost of full compliance versus a minimal approach is typically less than 10% of the total cell cost.

14.3 Export Considerations

Manufacturers operating cobot cells in Vietnam that produce goods for export to the EU, Japan, or other markets with strict machinery safety requirements should consider that customer audits increasingly include evaluation of production equipment safety. European OEMs sourcing from Vietnamese suppliers may require evidence of CE-equivalent compliance for production machinery, including cobot cells, as part of their supplier qualification process. Proactive compliance avoids costly retrofitting when customer requirements escalate.