What risk assessment is required for human–robot collaboration?

Human robot collaboration requires a documented, application-specific risk assessment of the complete robot system and every task involving foreseeable human interaction. The assessment must identify hazards, estimate and evaluate risks, select protective measures, and verify that those measures reduce risk adequately before operation. A robot’s collaborative designation or built-in force limitation does not establish the safety of the installed application.

The assessment boundary includes the robot, end effector, workpiece, fixtures, control system, surrounding machinery, and access routes. It also covers setup, teaching, cleaning, fault recovery, maintenance, and foreseeable misuse. A cell that performs safely during automatic production can present a different exposure when someone retrieves a dropped part or clears a jam.

Which standards define the assessment?

ISO 12100 provides the general machinery risk assessment and risk reduction framework. It establishes the sequence: determine machine limits, identify hazards, estimate risk, evaluate whether reduction is necessary, and apply protective measures. Risk reduction follows a hierarchy, beginning with inherently safe design, then safeguarding and complementary measures, followed by information for use.

ISO 10218 addresses industrial robot safety, with separate parts covering robots and robot applications and cells. The application assessment must connect the robot’s documented capabilities and restrictions to its actual integration. Component documentation cannot establish whether a gripper, fixture, process, or surrounding layout creates an unacceptable hazard.

ISO/TS 15066 provides collaborative application guidance, including material relevant to human contact and biomechanical limits. Its use must be considered alongside the applicable edition of ISO 10218; requirements and guidance have evolved between editions. Record the editions used, establish which provisions apply, and resolve differences before treating older collaborative guidance as the acceptance basis.

These documents support a technical safety assessment. Whether a particular standard has a specific regulatory or contractual role depends on the installation and applicable framework. A defensible assessment identifies its standards basis explicitly, rather than referring generally to “cobot compliance.”

Define the task before assigning a risk level

A useful assessment starts with a task description detailed enough to reconstruct the exposure. “Manual loading beside a robot” leaves too much unspecified. Record where the hand enters, whether the robot moves during loading, what holds the component, and what initiates the next cycle.

For each task, define the robot’s operating mode, permitted movement, payload, tooling, process conditions, and expected human position. Include the limits of the collaborative workspace and adjacent areas from which a person could reach a hazard. Separate tasks when their protective measures differ; teaching and automatic production rarely justify identical assumptions.

Risk estimation considers the potential severity of harm, exposure to the hazard, and the possibility of avoiding or limiting harm. The chosen scoring method should make these judgments traceable. A low estimated probability needs evidence, particularly where access is frequent or avoidance is restricted by a fixture, wall, or workbench.

Consider a robot presenting a metal housing for manual inspection. Contact with a rounded robot link differs from contact with the housing’s unfinished edge. If the housing can trap a hand against the inspection nest, the assessment must address sustained compression as well as impact. One risk score for “robot collision” would conceal these distinct mechanisms.

Choose protective measures around the interaction

Collaborative operation uses protective approaches suited to particular interactions. Different portions of a cycle can use different approaches, provided transitions are controlled and validated. The terminology and detailed requirements should follow the selected standards editions.

A monitored stop does not eliminate hazards from a hot component, a suspended load, or a pressurized gripper. Hand guiding does not justify unrestricted automatic movement near a person. Power and force limiting requires scrutiny wherever sharp features, small contact areas, or trapping make contact unacceptable.

The assessment should also examine foreseeable boundary failures. A person reaching around a scanner’s field, a reflective component affecting detection, or an unexpected restart after a cleared protective field can defeat assumptions that appear sound in the normal cycle.

Contact assessment needs geometry, motion, and body location

Where contact remains foreseeable, identify the exposed body regions and distinguish transient impact from quasi-static contact. Transient contact involves an impact without sustained trapping. Quasi-static contact involves compression or clamping that restricts withdrawal. A trajectory can produce either condition depending on nearby structures and the person’s posture.

A robot’s configured force threshold is not a measured human contact force. Controller settings, joint torque estimates, and tool-center-point limits describe aspects of robot behavior. The resulting contact depends on robot configuration, moving mass, payload, speed, controller response, and the mechanical properties of the contact surfaces.

Pressure introduces a separate concern. A broad padded surface and a narrow metal edge can produce very different local pressures at the same total force. Padding must be assessed for compression, attachment, durability, and whether it bottoms out under the relevant contact. Covering a hazard does not automatically remove it.

The contact assessment should therefore establish:

• Credible contact locations along the robot, tool, and carried workpiece, including intermediate links that approach a person during rotation.
• The exposed body region and whether surrounding equipment allows withdrawal. Restricted escape can change an otherwise brief impact into a trapping event.
• Relevant combinations of speed, payload, reach, posture, and contact geometry, with a reasoned basis for selecting the most demanding test conditions.
• Any contact scenario that must be prevented through design or safeguarding because contact-based limits do not provide an adequate acceptance basis.

Contact testing needs suitable measurement equipment and a documented method representing the relevant body-region compliance and contact condition. Record force and pressure where applicable, along with instrument characteristics, calibration status, setup, and uncertainty. A single impact test at an accessible point does not validate every trajectory or body region.

Separation distances must reflect actual stopping behavior

For speed and separation monitoring, the protective distance must account for human approach during system response and robot stopping, robot movement before standstill, and relevant detection and position uncertainties. Sensor placement must cover credible access paths and account for reaching over, under, or around the monitored region.

Stopping performance changes with speed, load, robot posture, and motion direction. Use substantiated stopping data for the assessed conditions and confirm that the installed system meets the assumptions. A nominal braking time alone omits detection delay, communications, safety logic, and other delays in the protective chain.

Monitor the hazardous geometry, not merely the programmed tool center point. An elbow can move toward a person while the tool moves away. A long workpiece can extend beyond the robot’s monitored envelope. If the safety system represents these objects through simplified shapes, the assessment must establish that those shapes cover the actual hazardous volume.

Validation also needs to address loss of detection, obstructed fields, and transitions between speed zones. The required safe response must follow a detected fault or separation violation within the assumptions used to establish the distance.

Validate the complete safety function

A protective function is a chain from sensing through logic to the final action that controls the hazard. Its required reliability follows from the risk assessment and applicable requirements. ISO 13849 or IEC 62061 provides relevant methods for safety-related control systems where applicable; the selected method and required performance must be documented.

Validation should demonstrate both correct behavior and adequate fault response. Examples include stopping when a protective field is entered, preventing unexpected restart, detecting a relevant device fault, and ensuring that a mode change does not bypass the intended protection. An emergency stop is a complementary measure, not a substitute for protection during routine interaction.

Mechanical and process hazards require their own evidence. Gripper retention during power loss, release of stored pneumatic energy, dropped components, ejected fragments, and exposure to welding or laser processes cannot be resolved solely through robot motion limits.

Acceptance criteria should exist before testing. Otherwise, an observed result can be mistaken for a pass simply because no obvious incident occurred. Any failure requires a documented correction and reassessment of the affected hazards, followed by appropriate verification.

What the assessment record must demonstrate

The record should allow a reviewer to connect each significant hazard to a protective measure and its validation evidence. It should identify the system assessed, task boundaries, foreseeable interactions, risk estimation method, assumptions, and remaining restrictions. Supporting records need enough detail to reproduce the relevant configuration.

Useful evidence includes layout drawings, tooling and payload specifications, safety function descriptions, stopping measurements, contact test results where relevant, and the validated safety parameter set. Distinguish measured results from supplier data and engineering assumptions. An assumption that affects acceptance needs a clear justification or a verification action.

Residual risks belong in the operating information, but instructions cannot compensate for a reasonably practicable design measure that was omitted. If routine recovery requires entry into a trapping zone, the assessment must establish a safe recovery method rather than merely warning against contact.

Changes that reopen the assessment

A validated application has defined limits. A heavier part, replacement gripper, increased speed, relocated fixture, or revised program can invalidate the evidence supporting those limits. Even a component with the same mass can introduce a sharper edge, shift the center of gravity, or increase the distance that projects into shared space.

Change control should identify which hazards, protective functions, and validation results are affected. A software revision that changes a motion path deserves review even when safety settings remain unchanged. Replacement protective devices also need assessment where response time, field geometry, or diagnostic behavior differs.

Release for operation requires closure of unresolved safety actions and a record of the validated configuration. Subsequent deviations, unexpected contacts, and stopping-performance changes should feed back into the assessment, because they provide evidence that the original operating assumptions need revision.