Safety assurance is the procedure for showing that a robot system is safe enough to run. Industrial robots have a settled, numerical standards stack, but none certifies a learned policy, so what ships is a verifiable safety layer around itSource 31.

A robotic welding cell on a factory floor, seen from above, enclosed by red weld curtains and yellow and black guard posts.
A robotic weld cell behind machine guarding and weld curtains. Fencing people out is the oldest safeguard; robots that work without a fence use one of four collaborative modes.
Photo: WireCrafters / Wikimedia Commons. Licence: CC BY-SA 4.0.

Fenceless robots use four collaborative modes, two of them quantitative

Marvel and Norcross summarise the four scenarios from ISO/TS 15066 (2016). Two are procedural: a safety-rated monitored stop permits no motion while a person is present, and hand guiding gives the operator the control channel. Two are quantitative: speed and separation monitoring keeps a computed distance between robot and person, while power and force limiting gives up distance and bounds the contactSource 5.

Pick a mode under "How it keeps you safe" below, then drag "Robot speed" under "Keeps its distance". The bar under the drawing recomposes the protective separation distance from the four terms of Marvel and Norcross's NIST equationSource 5.

Collaborative robot safety
A faster robot needs a bigger gap from people
How it keeps you safe

At this speed the robot needs a gap of about 1.4 metres; you are 1.6 metres away, so it keeps working.

Adjust more
  • It keeps moving: 0.10 metres
  • Braking: 0.05 metres
  • Safety margin: 0.95 metres
  • You walk in while it reacts: 0.32 metres
Lit: the scanner’s zoneneeds 1.42 m, you stand at 1.60 m

illustrative

Robots working beside people must either keep their distance or move gently enough that a bump stays under a safe force limit.
How this was made

Speed and separation monitoring. The robot and the person may both move, and the safety system holds a protective separation distance between them that recomposes continuously from the robot speed, the operator approach speed and the system reaction time. Closing below it triggers a safety-rated stop.

Speed and separation monitoring is available at these speeds, but power and force limiting is not: an impact at this robot speed would exceed the contact-force limit, so contact must be prevented rather than survived.

  • Protective separation: 1.42 m
  • Operator travel, v_H(T_R + T_S): 0.32 m
  • Robot travel before braking, v_R T_R: 0.10 m
  • Braking, B: 0.05 m
  • Margin and uncertainty, C + Z_R + Z_S: 0.95 m

“Stops when you step in” is a safety-rated monitored stop; “You guide it by hand” is hand guiding; “Keeps its distance” is speed and separation monitoring; “Gentle enough to bump” is power and force limiting. In the drawing, a floor scanner guards a zone: the whole cell for a monitored stop, and for separation monitoring a zone as long as the protective separation distance, its four terms laid on the ruler from the tool. A run walks the mannequin in; when it crosses the zone’s edge the arm keeps moving for the reaction time, brakes, and stops with the margin left between them. The bump gauge’s pad stands in for a thigh, and its needle holds the peak force of a bump at the robot’s speed. Runs play 8 times slower than real time; where the walk starts, the tray and the fixture, and the guiding push (0.15 m at 0.4 m/s) are the drawing’s own choices.

Separation model: S = v_H(T_R + T_S) + v_R T_R + B + (C + Z_R + Z_S), the rough early-draft approximation restated by Marvel and Norcross. Teaching choices: C = 0.85 m, selected at the normal-multibeam minimum, not a universal margin (the paper also gives 1200 mm for a single-height beam and a conditional two-handed-control reduction to 250 mm); constant robot deceleration 10 m/s², reusing an acceleration example rather than a measured braking profile; robot default 1.00 m/s and operator default 1.60 m/s, with both sliders choosing 0 to 2 m/s in 0.05 m/s steps. The paper records both 1600 and 2000 mm/s, qualifies the 1600 option by separation greater than 500 mm, allows direct measurement, and later urges considering 2000 mm/s; this choice does not resolve that context. Also chosen: T_R = 0.1 s (a 100 Hz period is 0.01 s, not this delay), Z_R + Z_S = 0.10 m, workcell separation 1.60 m, and an energy-balance contact model with 4 kg effective mass and 25 kN/m stiffness. The existing force-limit label is contact-force limit 255 N (thigh, transient contact; research basis: 75th-percentile force pain threshold, Han 2024). These calculations are illustrative, not measurements or safety certification.

At 1.00 m/s robot speed and 1.60 m/s operator approach, the protective separation distance is 1.42 m against a 1.60 m workcell: 0.32 m of operator travel, 0.10 m of robot travel before braking, 0.05 m of braking, and 0.95 m of intrusion margin and position uncertainty.

Current workcell settings
mode
Speed and separation monitoring
robot speed
1.00 m/s
operator approach
1.60 m/s
protective separation
1.42 m
peak contact force
316 N
workcell separation
1.60 m
Separation formula as restated by Marvel and Norcross; margins, speeds and the contact model are illustrative teaching choices.

ISO/TS 15066, published in 2016, supplemented the 2011 ISO 10218 for collaborative operation and is now marked for revisionSource 4. The 2025 revision of ISO 10218 integrated it normatively and introduced new classifications for collaborative applications, Hartmann and colleagues reportSource 32.

Separation criteria assume a person approaching at 1600 to 2000 mm/s

Marvel and Norcross reproduce the ISO 13855:2010 decision criteria: an intrusion margin of at least 850 mm for a normal approach protected by multiple separate beams, against 1200 mm for a single-height beam. A two-handed control device may reduce the margin to 250 mm, but they exclude typical two-handed teach pendants from that exception and doubt that stationary-machinery criteria transfer to robotsSource 5.

For operator approach they call 1600 mm/s a worst-case assumption and report a 2000 mm/s stationary-machinery maximum, with the 1600 mm/s option only when separation is greater than 500 mm. Approach speed may be measured directly; otherwise it is typically assumed constant and directed toward the robot. They add that 2000 mm/s may be more prudent for rapid motions and detection uncertainty, and a risk assessment may call for a faster approachSource 5.

The instrument is an authored teaching model whose defaults are not certified limits: C = 0.85 m, 10 m/s² deceleration, a 0.1 s reaction delay, 0.1 m position uncertainty and a 1.6 m workcell. A 100 Hz update period is 0.01 s, which says nothing about detect-to-command latency. The NIST paper calls its early-draft equation a rough approximation and requires traceable stopping-time and braking-distance measurements for a real robotSource 5.

Force limits rest on measured pain thresholds by body region

Haddadin, Albu-Schäffer and Hirzinger made the force question empirical with crash-test impactsSource 6. Later pain-threshold studies, such as Han and colleagues' 37-subject impactor tests, report limits by body region and contact geometrySource 7. A power-and-force-limited application therefore attaches a measured number to a named body part, the value the contact-force lab in the control module also readsSource 7.

Risk assessment comes first, and a compliant robot does not make a compliant cell

Risk assessment begins with ISO 12100, the general-principles standard for machinery safety, at edition 1 since 2010 and due to be replaced by a revision now in draftSource 1. Its abstract describes the procedure: identify the hazards, estimate and evaluate the risks, then reduce them, documenting and verifying each stepSource 1. The reduction measures form a hierarchy: design the hazard out, guard against what remains, then inform the operator, the "3-step approach" OSHA's manual reproduces from the robot industry associationSource 15.

The robot-specific layer splits liability in two. ISO 10218-1 covers the robot as partly completed machinery, the manufacturer's obligation; ISO 10218-2 covers the application and its cell, the integrator'sSource 2 Source 3. Both were republished in February 2025 at editions 3 and 2, the first major revision since 2011. The US adoption, ANSI/A3 R15.06-2025, added a Part 3, approved on October 7, 2025, that gives guidance to users of industrial robot cellsSource 34 Source 33.

Safety controls carry rated integrity levels, and an emergency stop cannot detect a hazard

Functional safety grades the control system that enforces these requirements. IEC 61508, whose Part 1 is at edition 2 from 2010, is the generic standard for electrical, electronic and programmable systems that carry out safety functions, rated by safety integrity levelSource 9. ISO 13849-1, at edition 4 from 2023, is the machinery counterpart for safety-related control parts, including software, rated by performance level; it defers low-demand operation to IEC 61508Source 8.

ISO 13850, at edition 3 from 2015, specifies the emergency stop independently of the energy source and names IEC 60204-1, at its 2016 edition, for the electrical realisationSource 10 Source 11. The button cannot detect a hazard; it waits for a person to see one and press. In stop category 0 the actuators lose power and the brakes engage, while in category 1 power is maintained through a controlled stopSource 5.

A red mushroom-head Siemens emergency-stop button on a round yellow collar, set into a dark machine-control panel beside a keypad.
A Siemens emergency-stop actuator on a machine control panel. It acts only after a person has seen the hazard and pressed it.
Photo: Stahlkocher / Wikimedia Commons. Licence: CC BY-SA 3.0.

For mobile robots, ISO 3691-4, at edition 2 from 2023, covers driverless industrial trucks, naming automated guided vehicles and autonomous mobile robots among its examplesSource 12. In the United States the R15.08 series covers industrial mobile robots, with Part 1 published in 2020 and Part 2 in 2023Source 13.

The humanoid standard is still a committee draft at stage 30.60

A humanoid falls, a hazard class the industrial documents were not written for. ISO/CD 25785-1 covers industrial mobile robots that need active control to remain balanced, including bipedal machinesSource 14. It is a committee draft: the comment period closed on 8 July 2026, and in late October 2026 the catalogue still showed stage 30.60, with edition 1 unpublished and no date for the next stageSource 14. A parallel technical report for the United States and Canada, ANSI/A3 TR R15.108, is under development for dynamically stable industrial mobile robots including humanoidsSource 35.

Until those documents are agreed, a humanoid deployed beside people runs under a risk assessment that invents its own treatment of fall risk. Agility reports that Digit 5 avoids people, stops or sits down under an independent safety controller, and that Digit passed an independent field evaluation on a customer production line against safety standards administered by OSHASource 35. Brooks predicts that without new types of mechanical systems walking humanoids "will remain too unsafe to be in close proximity to real humans"Source 36.

OSHA's technical manual chapter on industrial robots covers safeguarding devices, the teach-pendant hazard and lockout and tagout, with accident descriptionsSource 15. NIOSH counted 41 robot-related workplace fatalities in the United States from 1992 to 2017. Most involved stationary robots (83%) striking the worker under their own power (78%), often during maintenanceSource 37.

A learned policy cannot be certified, because it has no written specification

A safety integrity level and a performance level are both assigned to a safety functionSource 8. Both presume a verifiable specification of what the function must do, and a development process that avoids systematic faults, the design errors that redundant hardware cannot remove.

A policy trained from demonstrations has neither: its weights encode behaviour with no separable statement of intent, and no process avoids systematic faults in a function nobody wrote down. Luckcuck and colleagues find testing and simulation insufficient evidence for certifying autonomous robotsSource 38. Kalra and Paddock calculate that existing fleets would need tens and sometimes hundreds of years of driving to demonstrate autonomous-vehicle reliabilitySource 29, and deployment numbers show the same distance.

A verifiable safety filter can wrap an unverifiable policy

What ships instead puts something simple enough to verify between the black-box policy and the actuators, with authority to override. ISO/IEC TR 5469 (2024) names this use: non-AI safety related functions that ensure safety for AI-controlled equipmentSource 31.

The formal instance is the safety filter. A control barrier function defines a set the system must stay inside and turns forward invariance of that set into a constraint on the commanded input, enforced each stepSource 16. Wabersich and colleagues survey the family, including reachability and predictive variants, and describe a filter that takes a proposed input from any source and modifies it as little as necessarySource 17.

Safety filter
A safety filter changes the path only where it must
50%
Faint: the policy's path. Dark: what the pen drewAim inside · pen held at the fence

Schematic: the filter's rule on an illustrative stroke

A sealed policy proposes the path. The fence, simple enough to check, moves the pen only where it would enter, and by the least amount.
How this was made

A learned policy has no written specification to certify, so what ships puts something simple enough to verify between the policy and the actuators. A safety filter is the formal version: a control barrier function defines a set the system must stay inside and turns staying inside it into a constraint on each command, and Wabersich and colleagues describe a filter that takes a proposed input from any source and modifies it as little as necessary.

The drawing is that rule as a bench. The sealed box, with no window and a tamper seal, stands for the policy: it swings the arm, and the arm's spindle is where the policy aims. The pen hangs from the spindle on a spring. The ring fence round the darker keep-out zone, lit, is the filter. Outside the fence the pen sits under the spindle and draws the proposal unchanged. When the aim goes inside, the fence stops the pen and the spring pulls it along the fence to the point nearest the aim: the smallest change that keeps it out. The faint line is the proposal; the dark ink is what was drawn, and the two differ only round the fence.

Schematic: the stroke, the zone and the bench are illustrative, and no number is claimed. A real filter acts on commanded velocities or torques at every control step, against a set worked out from the robot's dynamics; the least-change rule is the same.

Rule from Ames and colleagues (2019) and Wabersich and colleagues (2023).

In 2026 the pattern reached vision-language-action policies. VLPSA wraps π0.5 in a full-body CBF-QP safety filter without retraining, and on SafeLIBERO it raised collision avoidance from 23.1% to 91.2% while surpassing the base policy's task successSource 39.

Barrier functions now reach slender robots, and industrial limiters remain the norm

Barrier functions are also being adapted to bodies that rigid-arm controllers handle poorly. In September 2026, Zijian Cai, Daniela Rus, Cecilia Laschi and colleagues weighted the control barrier functions along a slender hyper-redundant robot to enforce obstacle constraints while correcting tracking errors from uneven loading. On a circular path-following task with obstacles, fixed weights cut the root-mean-square tracking error of the unweighted method by up to 59.6% in simulation and 87.7% in physical experimentsSource 30.

Photograph of a slender robot of white frames linked by pairs of flexible racks, curving across a black background, with labels for Fixed Base, PLA Racks, Embedded Motor and Lighthouse Deck.
Cai and colleagues' hyper-redundant robot: five segments that extend and bend as their motors drive paired flexible racks. Weighted barrier functions kept it clear of obstacles while correcting its tracking.
Paper figure: Zijian Cai et al. / arXiv. Licence: CC BY 4.0.

The industrial instance is cruder and far more widely deployed: force limiting in the actuator, velocity limiting in the drive, and workspace limiting in the safety controller. The standards above know how to rate those mechanisms, whatever generated the trajectory. Guardrails inside a model are no substitute: RoboPAIR jailbroke LLM-controlled robots, often with 100% attack success, including a deployed Unitree Go2Source 40.

A safety case argues for what testing cannot show

What the wrapper leaves over gets a safety case: a structured, documented argument that a system is acceptably safe in a stated environment, with evidence attached to each step. UL 4600, at edition 3 from March 2023, applies the approach to autonomous productsSource 18. The Goal Structuring Notation community standard, version 3, supplies the usual notation, decomposing a top-level goal into subgoals that each rest on cited evidenceSource 19. For ML components, AMLAS supplies safety case patterns and a process for generating the evidence baseSource 41.

An argument built to conclude that a system is safe will usually reach that conclusion, and Koopman argues that "safe enough" means more than crashes divided by milesSource 27. The alternative is a rule set formal enough to check, which Shalev-Shwartz, Shammah and Shashua proposed as responsibility-sensitive safetySource 28. Robotics is inheriting that decade-long autonomous vehicles argument late.

Conformal prediction and monitors tell a learned system when to stop or ask

Conformal prediction turns any model's raw output into a prediction set with a guaranteed coverage rate under exchangeability. Vovk, Gammerman and Shafer built the frameworkSource 20, and Angelopoulos and Bates's tutorial carried it into general machine-learning practiceSource 21. In KnowNo, Ren and colleagues calibrate a language-model planner conformally so that the robot asks a human for help when its prediction set is ambiguous, with a statistical guarantee on task completionSource 22.

Three-column diagram: a person asks a robot arm to put the bowl in the microwave; the planner scores four next steps, conformal prediction keeps two above its threshold, and the robot asks which one, plastic or metal; photos at right show the test environments.
Told to put the bowl in the microwave with a plastic and a metal bowl in view, KnowNo keeps two plans above its conformal threshold and asks which bowl is meant.
Paper figure: Allen Z. Ren et al. / arXiv. Licence: CC BY 4.0.

Out-of-distribution detection asks whether the observation resembles anything the policy was trained on. Sinha and colleagues run a fast anomaly detector on the live observation stream to trigger a reactive fallback while slower reasoning catches upSource 23. Runtime monitoring generalises both: Farid and colleagues detect trajectory-predictor failures by their effect on the planner, with guarantees on false-positive and false-negative ratesSource 24.

The ASIMOV benchmark tests semantic safety in robotics agents, from payload and reach limits to judging from stereo images whether a person is close enough to require a stopSource 25. Gemini Robotics ER 2, in public preview, reports 97.9% safety-instruction-following accuracy and 93.0% on 1 m human proximitySource 26.

EU rules for learned safety components apply from January 2027

From 20 January 2027, the EU Machinery Regulation lists "safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions" in Annex I Part A. Its recitals call for third-party conformity assessment of such componentsSource 42. The AI Act's rules for high-risk AI systems embedded in the regulated products of its Annex I apply from 2 August 2028, after the AI Omnibus extended the transitionSource 43.

Robot safety rules by date
Industrial standards landed in 2025; EU law applies from 2027
ISO 10218 robot safety standard, parts 1 and 2US adoption, ANSI/A3 R15.06-2025, three partsHumanoid draft ISO/CD 25785-1next stage not datedEU Machinery Regulation, learned safety parts20 January 2027EU AI Act, high-risk AI in regulated products2 August 202820252026202720282029
Standards are dated by publication, the humanoid draft by the close of comments, and the two EU laws by the day they apply.
How this was made
Each date is from the rule's own record: ISO's catalogue for the standards and the humanoid draft, the A3 store for the US adoption, the corrected Official Journal text for the Machinery Regulation and the European Commission's AI Act page. The Machinery Regulation lists safety components that use machine learning in Annex I Part A, and its recitals say a third party should assess them. The humanoid draft's later stages carry no dates in ISO's catalogue.

Five robot safety rules by date: ISO 10218 parts 1 and 2 were published on 5 February 2025; the US adoption, ANSI/A3 R15.06-2025, was published with all three parts on 29 October 2025; the humanoid committee draft ISO/CD 25785-1 closed its comment period on 8 July 2026, with no date yet for its next stage; the EU Machinery Regulation, which lists machine-learning safety components, applies from 20 January 2027; and the AI Act's rules for high-risk AI in regulated products apply from 2 August 2028.

Every rule and its date
rulewhat happeneddate
ISO 10218-1:2025 and ISO 10218-2:2025published5 February 2025
ANSI/A3 R15.06-2025, parts 1 to 3published29 October 2025
ISO/CD 25785-1, the humanoid draftcomment period closed; next stage not dated8 July 2026
EU Machinery Regulation 2023/1230applies20 January 2027
EU AI Act, high-risk AI in Annex I productsapplies2 August 2028
ISO 2025, ISO 2025, A3 2025, ISO 2026, Union 2023, Commission 2026.

Three missing pieces block certification of learned systems

The first missing piece is a specification language in which a manipulation task's safety requirement can be written precisely enough to checkSource 38. The second is a humanoid standard past committee draft, giving fall risk an agreed treatmentSource 14. The third is a published assurance case for a deployed learned system, complete enough that an outsider could dispute a specific stepSource 41.

A position paper from October 2026, by researchers at Scuola Superiore Sant'Anna, MIT CSAIL and four other universities, asks for the same kind of evidence on the human side of the interaction. Niccolò Pagliarani, Maximilian Stölzle, Daniela Rus, Matteo Cianchetti and colleagues argue that a claim that a robot is trustworthy around people should rest on evidence for three properties in the intended setting: bounded physical risk, behavior that people can anticipate, and expectations that match what the robot has shown it can and cannot do. In their view these should guide design and evaluation from the outset, and the paper offers candidate evaluation criteria as a research agenda, with no new measurementsSource 44.