Safety and Assurance

An industrial robot cell is one of the few places in engineering where the question "is this safe" has a procedural answer. There is a method for finding the hazards, a standard for the robot, a second standard for the cell it sits in, a rating scheme for the control system that enforces the safety functions, and a regulator whose inspectors will ask to see the paperwork. Robot learning arrived into that world with a component none of it can accommodate, and has mostly declined to notice.

This module is the two halves of that problem joined at one seam. The settled half is the standards stack, which is more specific and more numerical than most people outside factory automation expect. The open half is what a team ships when the settled half has no category for the thing they built.

Four ways to share a workspace

The oldest answer was a fence. What replaced it, for robots designed to work beside people, is a set of four collaborative operating modes, and they differ in what each one actually constrains.

Select each mode below, then drag the robot-speed slider under speed and separation monitoring and watch the protective separation distance recompose from its four terms.

Two of the four are procedural: a safety-rated monitored stop permits no motion while a person is present, and hand guiding gives the operator the control channel. The other two are quantitative, and they are quantitative in opposite directions. Speed and separation monitoringspeed and separation monitoringThe collaborative operating mode in which a robot and a person may both move at the same time, with a safety system continuously maintaining a protective separation distance between them and issuing a safety-rated stop if that distance is closed. Marvel and Norcross restate the distance in public as a sum of four terms: the operator travel during the reaction and stopping intervals, the robot travel before braking begins, the braking distance itself, and an intrusion margin plus the position uncertainty of both parties. Because the braking term is quadratic in the robot speed, the distance grows faster than the speed does. keeps a computed distance between the robot and the person. Power and force limitingpower and force limitingThe collaborative operating mode that permits contact between a robot and a person and makes it safe by bounding what the contact can do, rather than by preventing it. The threshold is biomechanical and stated per body region, which is what turns a marketing word into a claim with numbers behind it: Haddadin, Albu-Schaeffer and Hirzinger established the measurement tradition with impact experiments on the human-robot collision itself, and later force-threshold studies report limits by body region and contact geometry. A cobot certified under this mode has been measured, not merely described. abandons distance entirely and bounds the contact instead.

ISO/TS 15066, published in 2016, is the technical specification for collaborative operation ISO 2016↓ISO/TS 15066:2016, Robots and robotic devices — Collaborative robotsISO, ISO Technical Specification (public catalogue entry), 2016. Its own catalogue entry places it as a supplement to ISO 10218 rather than a replacement, and it is paywalled, so the separation model in the instrument above is not read from it. It is read from Marvel and Norcross, who published an open-access analysis at NIST that restates the protective-separation equation and its terms Marvel 2017↓Implementing speed and separation monitoring in collaborative robot workcellsJeremy A. Marvel, Rick Norcross, Robotics and Computer-Integrated Manufacturing, 2017. Their paper is also where the instrument's sourced constants come from: an intrusion margin of at least 850 mm for a normal approach protected by multiple separate beams, and a 1.6 m/s worst-case operator speed used when the operator's approach is not measured directly.

The force half rests on a different literature. Haddadin, Albu-Schäffer and Hirzinger ran the impact experiments that made the question empirical rather than rhetorical Haddadin 2009↓Requirements for Safe Robots: Measurements, Analysis and New InsightsSami Haddadin, Alin Albu-Schäffer, Gerd Hirzinger, The International Journal of Robotics Research, 2009, and later threshold studies report force limits by body region and contact geometry Han 2024↓Evaluation of force pain thresholds to ensure collision safety in worker-robot collaborative operationsD. Han, M. Y. Park, J. Choi et al., Frontiers in Robotics and AI, 2024. This is what makes "cobot" a claim rather than a category: a power-and-force-limited application has a measured number attached to a named body part, and the same figure appears on the contact-force lab in the control module, read from the same shared source so the two pages cannot drift apart.

The stack the standards actually form

Risk assessmentrisk assessmentThe machinery-safety procedure that turns an informal worry about a machine into a documented engineering obligation. ISO 12100:2010 is the general-principles standard behind it: its public abstract describes procedures for identifying hazards and for estimating and evaluating the risks associated with them across the phases of a machine life cycle, together with guidance on documenting and verifying what the assessment concluded. Its output is a record of which hazards were found, what was done about each, and why the residual risk was judged acceptable, which is what makes safety auditable rather than asserted. is the entry point and it is a method, not a document. ISO 12100, at edition 1 and unrevised since 2010, is the general-principles standard for machinery safety, and its public abstract describes exactly the procedure: identify the hazards, estimate and evaluate the risks, then reduce them, with the documentation and verification of that process treated as part of the work ISO 2010↓ISO 12100:2010, Safety of machinery — General principles for design — Risk assessment and risk reductionISO, ISO International Standard (public catalogue entry), 2010. The ordering of the reduction measures is the part worth internalising, because it is a hierarchy rather than a menu: design the hazard out first, guard against what remains, and only then fall back on telling the operator about it.

The robot-specific layer splits in two, and the split decides liability. ISO 10218-1 covers the robot as a piece of partly completed machinery, which is the manufacturer's obligation; ISO 10218-2 covers the application and the cell it is integrated into, which is the integrator's ISO 2025↓ISO 10218-1:2025, Robotics — Safety requirements — Part 1: Industrial robotsISO, ISO International Standard (public catalogue entry), 2025 ISO 2025↓ISO 10218-2:2025, Robotics — Safety requirements — Part 2: Industrial robot applications and robot cellsISO, ISO International Standard (public catalogue entry), 2025. Both were revised and republished in February 2025, the first major revision since 2011, at editions 3 and 2 respectively. The practical consequence is that buying a compliant robot buys you nothing at the cell level: a certified arm on an uncertified end effector in an unassessed workspace is an unsafe application built from a safe component, and the paperwork says whose problem that is.

Functional safetyfunctional safetyThe part of a system’s safety that depends on its control system doing the right thing, as opposed to safety that comes from inherent design or physical guarding. Two standards frame it for machinery: IEC 61508:2010 is the generic standard for electrical, electronic and programmable electronic safety-related systems, and ISO 13849-1:2023 gives a design methodology for the safety-related parts of machine control systems, including software, deferring low-demand operation to the IEC 61508 series. Both frame a safety function as something specified in advance and then argued to have been correctly implemented. is the layer that grades the control system enforcing all of this. Two standards frame it. IEC 61508, whose Part 1 is at edition 2 from 2010, is the generic standard for electrical, electronic and programmable electronic safety-related systems, and assigns each safety function a safety integrity levelsafety integrity levelThe IEC 61508:2010 rating of how much confidence a safety function warrants, assigned to the function rather than to the component that implements it. Reaching a level requires more than a measured failure rate: the series also demands the avoidance of systematic faults, which are the design and specification errors that no amount of redundant hardware removes. That requirement is why a learned policy cannot be assigned one. The evidence a level needs is a verifiable specification of what the function must do, and a policy trained from demonstrations has behaviour instead of a specification. IEC 2010↓IEC 61508-1:2010, Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 1: General requirementsIEC, IEC International Standard (public catalogue entry), 2010. ISO 13849-1, revised to edition 4 in 2023, is the machinery-sector counterpart, giving a design methodology for the safety-related parts of control systems including software, with a performance levelperformance levelThe ISO 13849-1:2023 counterpart of a safety integrity level, and the rating a machinery integrator in Europe most often has to satisfy. It grades a safety-related control function on a discrete scale, and the standard supplies the design methodology by which a claimed level is justified rather than asserted. Like the IEC 61508 levels, it presumes a specification of the function that can be checked against an implementation, which is exactly what a learned policy does not provide. as its rating; its own abstract defers low-demand operation back to the IEC 61508 series ISO 2023↓ISO 13849-1:2023, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for designISO, ISO International Standard (public catalogue entry), 2023.

The emergency stopemergency stopA machine function, initiated by a single human action, that brings a hazardous motion to a halt. ISO 13850:2015 specifies the functional requirements and design principles for it independently of the energy the machine uses, and names IEC 60204-1:2016 for the electrical realisation. Two properties are commonly misunderstood: it is a complement to guarding rather than a substitute for it, since it depends on a person noticing the hazard in time, and stopping is not the same as removing power, which is why the electrical standard distinguishes stop categories. is worth stating precisely, because it is the safety function most often misunderstood by people who have only seen the button. ISO 13850, at edition 3 from 2015, specifies it independently of the machine's energy source and names IEC 60204-1, at its own 2016 edition, for the electrical realisation ISO 2015↓ISO 13850:2015, Safety of machinery — Emergency stop function — Principles for designISO, ISO International Standard (public catalogue entry), 2015 IEC 2016↓IEC 60204-1:2016, Safety of machinery — Electrical equipment of machines — Part 1: General requirementsIEC, IEC International Standard (public catalogue entry), 2016. A button cannot notice anything: it waits for a person to see the hazard and press, so it does no work at all in the cases a guard is there to cover, where nobody is watching. Stopping a machine is also not the same operation as removing its power, which is why the electrical standard distinguishes stop categories at all.

Mobile robots are covered by their own documents, because a machine that drives away from its cell has no cell. ISO 3691-4, at edition 2 from 2023, covers driverless industrial trucks and their systems, naming automated guided vehicles and autonomous mobile robots among its examples ISO 2023↓ISO 3691-4:2023, Industrial trucks — Safety requirements and verification — Part 4: Driverless industrial trucks and their systemsISO, ISO International Standard (public catalogue entry), 2023, and in the United States the R15.08 series covers industrial mobile robots, with Part 1 published in 2020 for the robot and Part 2 in 2023 for systems and applications Automation 2026↓Robot Safety Standard DocumentsAssociation for Advancing Automation, A3 (automate.org), as of 2026-08-22.

None of these documents is free, and this article does not pretend to have read them. Every claim above is traceable to a public catalogue entry, a public abstract, or the published research literature. That is a real ceiling on the depth available here, and it is the honest one, because the alternative is paraphrasing a paywalled clause from a secondary source and hoping.

The humanoid gap, and the standard that is not finished

A humanoid falls. That is the hazard class the industrial documents above were not written for, and until recently there was nothing addressing it directly. There is now a project: ISO/CD 25785-1 covers safety requirements for industrial mobile robots with actively controlled stability, defined in its own abstract as robots that require active control to remain balanced and could become unstable without power, explicitly including bipedal machines ISO 2026↓ISO/CD 25785-1, Robotics — Safety requirements for dynamically stable industrial mobile robots (legged, wheeled, or other forms of locomotion) — Part 1: RobotsISO, ISO Committee Draft, stage 30.60 (public catalogue entry), 2026.

It is a committee draft. The catalogue shows it at stage 30.60, close of the comment period, with edition 1 not yet published. That is genuinely useful to know and it is not the same as coverage. Anyone deploying a humanoid beside a person in 2026 is doing so under a risk assessment that has to invent its own treatment of fall risk, because the standard that will eventually supply one has not been agreed yet. In the meantime the free and public regulator guidance is worth more than it looks: OSHA's technical manual chapter on industrial robots covers safeguarding devices, the teach-pendant hazard, and lockout and tagout under the hazardous-energy rule, and its incident descriptions are a better education in how people actually get hurt than any standard Administration 2026↓OSHA Technical Manual, Section IV: Chapter 4, Industrial Robot Systems and Industrial Robot System SafetyOccupational Safety and Health Administration, U.S. Department of Labor, as of 2026-08-22.

Why a learned policy cannot be certified

Here is the seam. A safety integrity level and a performance level are both assigned to a safety function, and both presume two things about it. The first is a verifiable specification: a statement of what the function must do, against which an implementation can be checked. The second is the avoidance of systematic faults, which are the design and specification errors that no amount of redundant hardware removes, and which the standards attack with process requirements on how the thing was developed.

A policy trained from demonstrations has neither. It has behaviour, which is not a specification, and its weights encode no separable statement of intent that anyone could check an implementation against. There is no development process that avoids systematic faults in a function nobody wrote down. This is not a gap that better testing closes: the reliability gap module lays out what deployment numbers actually look like, and Kalra and Paddock's calculation for autonomous vehicles is the general form of the argument, since demonstrating a low failure rate by driving requires more miles than a fleet can accumulate in a working lifetime Kalra 2016↓Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?Nidhi Kalra, Susan M. Paddock, Transportation Research Part A, 2016.

So a learned policy is not certified. What ships is an architecture that routes around the question.

The pattern: a verifiable layer wrapping an unverifiable one

The load-bearing idea of this module is that safety and capability are assigned to different components. The policy is allowed to be a black box, and something simple enough to be verified sits between it and the actuators, with the authority to override.

The formal instance is the safety filter. A control barrier functioncontrol barrier functionA scalar function of the state, positive on a set you want the system to stay inside, whose derivative condition can be enforced as a constraint on the commanded input, so forward invariance of the safe set becomes a linear constraint in an optimisation the controller solves each step. Ames and colleagues survey the theory and its applications. Its practical importance is architectural: because the constraint filters whatever input arrives, an arbitrary and unverified controller can be wrapped by a verified one, and the guarantee belongs to the wrapper. defines a set the system must stay inside and turns forward invariance of that set into a constraint on the commanded input, which the controller enforces each step Ames 2019↓Control Barrier Functions: Theory and ApplicationsAaron D. Ames, Samuel Coogan, Magnus Egerstedt et al., ECC 2019. Wabersich and colleagues survey the family, including the reachability and predictive variants, and name the architecture directly: a filter that accepts a proposed input from any source and modifies it as little as necessary to keep the system safe Wabersich 2023↓Data-Driven Safety Filters: Hamilton-Jacobi Reachability, Control Barrier Functions, and Predictive Methods for Uncertain SystemsKim P. Wabersich, Andrew J. Taylor, Jason J. Choi et al., IEEE Control Systems Magazine, 2023. The guarantee belongs to the filter, and it holds whatever produced the proposal, which is precisely why the policy is permitted to be unverifiable.

The industrial instance of the same pattern is cruder and much more widely deployed: force limiting in the actuator, velocity limiting in the drive, and workspace limiting in the safety controller. Those are the mechanisms the standards above already know how to rate, and they do not care what generated the trajectory. A learned policy running inside a power-and-force-limited envelope inherits a safety property it did not earn, which is a good deal, and it is also the reason so many humanoid demonstrations happen at speeds that look oddly slow.

The assurance case, for what testing cannot reach

The wrapper does not answer everything, and the honest response to what it leaves over is an argument rather than a number. That tradition is the safety casesafety caseA structured, documented argument that a system is acceptably safe for a given application in a given environment, with the evidence for each step of the argument attached to it. The tradition exists because testing alone cannot reach the confidence an autonomous system needs, so the artifact is an argument rather than a test report. UL 4600 applies the approach to autonomous products, and the Goal Structuring Notation community standard gives the graphical notation the argument is usually written in, with goals decomposed into subgoals until each rests on cited evidence.: a structured, documented argument that a system is acceptably safe in a stated environment, with evidence attached to each step. UL 4600 applies the approach to autonomous products and is at edition 3, published in March 2023 Engagement 2023↓UL 4600, Standard for Evaluation of Autonomous Products, Edition 3UL Standards & Engagement, UL Standard (public catalogue entry), 2023, and the Goal Structuring Notation community standard, at version 3, supplies the notation such arguments are usually written in, decomposing a top-level goal into subgoals until each rests on cited evidence Group 2021↓Goal Structuring Notation Community Standard (Version 3)SCSC Assurance Case Working Group, Safety-Critical Systems Club, 2021.

The criticism is as old as the practice and it is worth carrying: an argument built to conclude that a system is safe will usually reach that conclusion, and Koopman has spent years on what "safe enough" can be made to mean when the number itself is contested Koopman 2026↓What's the Deal with Safe Enough Autonomous Vehicles?Philip Koopman, Safe Autonomy (Substack), 2026. The alternative on offer is a rule set formal enough to check, which is what Shalev-Shwartz, Shammah and Shashua proposed with responsibility-sensitive safety Shalev-Shwartz 2017↓On a Formal Model of Safe and Scalable Self-driving CarsShai Shalev-Shwartz, Shaked Shammah, Amnon Shashua, 2017. The autonomous vehicles module carries that disagreement in full, because the AV industry has been having this argument for a decade. Robotics is inheriting it late, with the advantage of knowing how it went.

The machine-learning half of the wrapper

The wrapper does not have to be classical. Several techniques belong in it that are ML-native, and they are the reason this module sits in a robot-learning wiki rather than a machinery-safety one.

Conformal predictionconformal predictionA distribution-free procedure that converts any model’s raw score into a prediction set with a guaranteed coverage rate: choose a target such as 95 percent, calibrate a threshold on held-out data, and the resulting sets contain the true answer at that rate under exchangeability, whatever the model is. Vovk, Gammerman and Shafer developed the framework; Angelopoulos and Bates wrote the tutorial that carried it into machine-learning practice. Its value for robotics is that the size of the set is a calibrated statement of uncertainty, so a policy can be made to ask for help exactly when its set is ambiguous. is the strongest of them, because it produces a calibrated statement rather than a score. The procedure turns any model's raw output into a prediction set with a guaranteed coverage rate under exchangeability, whatever the underlying model is: Vovk, Gammerman and Shafer built the framework Vovk 2022↓Algorithmic Learning in a Random WorldVladimir Vovk, Alexander Gammerman, Glenn Shafer, Springer, 2nd edition, 2022, and Angelopoulos and Bates wrote the tutorial that carried it into general machine-learning practice Angelopoulos 2021↓A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty QuantificationAnastasios N. Angelopoulos, Stephen Bates, 2021. Its robotics payoff is abstention with a number on it. KnowNo is the clearest instance: Ren and colleagues calibrate a language-model planner's uncertainty conformally so that the robot asks a human for help exactly when its prediction set is ambiguous, with a statistical guarantee on task completion Ren 2023↓Robots That Ask For Help: Uncertainty Alignment for Large Language Model PlannersAllen Z. Ren, Anushri Dixit, Alexandra Bodrova et al., CoRL 2023. A robot that knows when to stop is worth more than one that is slightly more often right.

Out-of-distribution detectionout-of-distribution detectionDeciding, at run time, whether the input a model is being asked about resembles the data it was trained on, so that a policy can decline rather than extrapolate. In robotics the detector runs on the live observation stream and its output gates the policy: Sinha and colleagues use a fast anomaly detector on the observation to trigger a reactive fallback plan while the slower reasoning runs, which is the practical shape of the technique. It answers a different question from uncertainty in the output, and a policy can be confidently wrong on an input it has never seen. answers the adjacent question, which is whether the observation resembles anything the policy was trained on at all. Sinha and colleagues run a fast anomaly detector on the live observation stream to trigger a reactive fallback while slower reasoning catches up, which is the practical shape of the technique in a control loop Sinha 2024↓Real-Time Anomaly Detection and Reactive Planning with Large Language ModelsRohan Sinha, Amine Elhafsi, Christopher Agia et al., RSS 2024. Runtime monitoring generalises both: Farid and colleagues detect failures of a trajectory predictor in a way that is task-relevant rather than accuracy-relevant, with statistical guarantees, on the argument that a prediction error only matters when it changes what the planner would do Farid 2022↓Task-Relevant Failure Detection for Trajectory Predictors in Autonomous VehiclesAlec Farid, Sushant Veer, Boris Ivanovic et al., CoRL 2022.

The commercial systems have converged on the same shape. ASIMOV is a benchmark and evaluation harness for agentic systems on safety-critical robotics tasks, from judging whether a requested action is within the robot's physical limits to deciding from camera images whether a person is close enough to require a stop Google DeepMind 2026↓Asimov Agentic Safety EvaluationGoogle DeepMind, 2026, and Gemini Robotics ER 2 ships semantic safety evaluation as a named capability rather than a research result Google DeepMind 2026↓Gemini Robotics ER 2Google DeepMind, 2026. In each case the safety property belongs to a component that is not the policy, which is the pattern of this whole module stated once more.

What would actually close this

Three things, none of them close. A specification language in which a manipulation task's safety requirement can be written down precisely enough to check, which is the missing input every certification scheme above assumes exists. A humanoid standard past committee draft, so that fall risk has an agreed treatment rather than a per-integrator invention. And a published assurance case for a deployed learned system, complete enough that someone outside the company could disagree with a specific step in it.

Until then the honest description of the state of the art is narrower than the marketing and more useful. Nobody certifies the policy. They certify the box around it, they bound what the box permits, and they argue about the remainder in public if they are being careful and in private if they are not.