ISO Standards and Robot Safety: Why Force Limiting is Crucial for Commercial Certification

In industrial robotics, the historical boundary separating humans from high-speed machinery was simple and physical: the safety perimeter fence.

For half a century, traditional six-axis industrial arms operated behind heavy steel mesh enclosures, interlocking optical light curtains, and safety area laser scanners. The regulatory framework governed by standards like ISO 10218-1/2 was deterministic: if a human breached the optical threshold, safe-torque-off (STO) circuitry cut primary inverter power within milliseconds, mechanically arresting the arm via dynamic friction brakes before human flesh could encounter moving steel.

General-purpose humanoid robots render physical safety fences obsolete.

A bipedal humanoid cannot fulfill its economic brief if it is locked inside a cage. By definition, platforms like Figure 02, Tesla Optimus, Agility Digit, and Apptronik Apollo are engineered to share the exact physical workspaces, narrow corridors, and assembly stations designed for human beings. They must walk alongside warehouse material handlers, hand components directly to automotive line workers, and navigate shared logistics corridors.

The moment physical barriers are eliminated, safety transitions from a simple problem of physical exclusion to a complex problem of contact biomechanics, functional safety architecture, and real-time contact force regulation.

A 70 kg bipedal robot swinging an arm while carrying a 10 kg workpiece possesses sufficient kinetic energy (Ek​=21​mv2) to deliver fatal blunt-force trauma to a human skull or crush ribs against a steel stanchion.

To deploy outside of tightly controlled pilot sandboxes and achieve true global commercial scaling, humanoid manufacturers must navigate the demanding gauntlet of international functional safety standards—most notably ISO 10218-1/2, ISO/TS 15066, and the overarching machinery directive ISO 13849-1.

Central to this certification is Power and Force Limiting (PFL): the engineering principle that contact between robot and human can be legally permitted, provided contact forces remain strictly below human biomechanical pain and injury thresholds.

Key Architectural Takeaways

• The Collaborative Transition: Moving humanoids out of safety cages requires shifting from classical separation monitoring to Power and Force Limiting (PFL) and Speed and Separation Monitoring (SSM).

• Biomechanical Pressure Floors (ISO/TS 15066): Establishes explicit maximum permissible force (N) and pressure (N/cm2) thresholds across 29 distinct human body zones, dividing contact into quasi-static (clamping/crushing) and transient (dynamic impact) events.

• The Functional Safety Mandate (ISO 13849-1): Safety-critical force limiting cannot rely on standard software code or consumer-grade operating systems; it requires redundant, deterministic architectures certified to Performance Level d (PL d), Category 3 or 4.

• Mechatronic Compliance vs. Sensor Bandwidth: Electronic motor current monitoring alone is too slow ($>20\text{ ms}$) to arrest transient impact shocks; compliant skins, Series Elastic Actuators (SEA), and quasi-direct drives are required to absorb initial kinetic spikes mechanically.

• The Fall Risk Dilemma: Traditional cobot standards assume fixed mounting bases; humanoids introduce the novel hazard of whole-body tipping, where the robot itself becomes an uncontrolled falling mass.

Quick Specs: ISO Safety Frameworks Governing Humanoid Robotics

Biomechanical Contact Mechanics: Decoding ISO/TS 15066 Thresholds

To pass a commercial CE mark or OSHA safety audit, a humanoid robot operating in proximity to humans cannot rely on subjective claims of safety. It must comply with the quantitative biomechanical impact limits established in ISO/TS 15066 Annex A.

ISO/TS 15066 human contact limits chart. Source: ResearchGate

These limits were developed through extensive trauma research conducted by the University of Mainz, measuring the onset of pain and soft-tissue deformation across diverse human volunteers. The standard classifies contact into two distinct physical phenomena:

Phenomenon 1: Transient Contact (Dynamic Free-Collision Shock)

• Occurs when a moving robot limb strikes a human who is free to recoil or step backward without physical obstruction.

• Duration is brief (typically lasting $<50$ milliseconds).

• The human body dissipates kinetic energy through momentum transfer and anatomical recoil.

• Because the body yields, higher instantaneous dynamic forces are legally permissible (typically 2x the quasi-static limit).

↓ (Physical Confinement Hazard)

Phenomenon 2: Quasi-Static Contact (Pinching, Clamping, and Crushing)

• Occurs when a robot limb traps a human operator against a rigid structure—such as an automotive chassis, a steel shelving post, or a conveyor frame.

• Contact duration is continuous until motor torque is reversed or relieved.

• The risk of skeletal fracture, deep muscle tearing, and vascular damage is severe.

• The permissible force and localized pressure limits are strictly curtailed.

Selected Biomechanical Limits (ISO/TS 15066 Reference Table)

The Kinetic Energy Formula for Force Limiting: To ensure a moving humanoid link does not exceed transient force limits during an accidental impact, the kinetic energy of the moving robot must not exceed the maximum energy transfer limit (Emax​) of the specific anatomical region:

Where vrel​ is the relative closing velocity between robot and human, and meq​ is the effective reduced mass of the robot limb:

If a 70 kg humanoid moves its arm at $1.5\text{ m/s}$, the instantaneous kinetic energy can easily exceed 40 to 60 Joules. The maximum permissible energy transfer to a human chest under ISO/TS 15066 is a mere 1.40 Joules.

This mathematical reality proves that software velocity caps alone cannot certify a rigid humanoid. Certification demands real-time dynamic force limiting, structural padding, and mechanical compliance.

The Functional Safety Architecture: Why the AI Cannot Handle Safety

A critical architectural distinction that separate enterprise-grade humanoids from academic prototypes is the strict segregation between the Cognitive AI Brain and the Functional Safety System.

A modern humanoid running a Vision-Language-Action (VLA) foundation model operates on complex, probabilistic operating stacks: Ubuntu Linux, ROS 2, CUDA drivers, and deep neural transformer weights running across multi-core GPUs.

Under ISO 13849-1, a safety-related part of a control system (SRP/CS) must achieve Performance Level d (PL d) or Performance Level e (PL e). This requires proving deterministic execution, dual-channel hardware redundancy, diagnostic coverage exceeding 90%, and a probability of dangerous failure per hour (PFHD​) below 10−6.

Full-body safety skin on humanoid hand. Source: Facebook

An AI model cannot be certified to ISO 13849 PL d. A neural network is fundamentally non-deterministic: it can hallucinate, experience memory-bus contention, or suffer from unexpected inference latency spikes.

Consequently, production humanoid architectures utilize a Dual-Ring System Architecture:

Ring 1: Non-Deterministic Cognitive Plane (System 2: High-Level Planning)

• Runs on high-power NVIDIA Jetson Thor or dual-GPU SoCs.

• Ingests RGB-D camera streams, runs foundation vision-language models, performs SLAM pathfinding, and plans manipulative trajectories.

• Communicates desired Cartesian trajectories via asynchronous messaging buses.

↓ (The Certified Safety Boundary)

Ring 2: Deterministic Functional Safety Plane (System 1: Hardware-Locked Safety Watchdog)

• Runs entirely on ASIL-D / SIL-3 certified safety microcontrollers (such as Infineon AURIX TC397 or TI Hercules) executing strict Real-Time Operating Systems (RTOS) or bare-metal logic.

• Ingests dual, redundant, optically isolated hardware encoders, 6-axis force/torque load cells, and hardwired E-stop circuits.

• Operates at 1,000 Hz (1 ms cycle times) with zero operating system jitter.

• The Safety Override: The safety core continuously monitors the command vector coming from the AI GPU against physical limits. If the AI commands an acceleration that violates ISO/TS 15066 force limits, or if a joint torque sensor detects unexpected resistance exceeding 140 N, the safety controller executes a hardware-level override: cutting PWM gate-drive pulses to motor inverters via hardware Safe Torque Off (STO) and engaging mechanical spring-applied holding brakes.

Mechatronic Strategies for Force Limiting: Stopping Before Breaking Flesh

To keep contact forces below biomechanical thresholds, humanoid engineers implement three complementary mechatronic layers:

Layer 1: Quasi-Direct Drive (QDD) and Low Gear Ratios

• The Challenge: High-ratio gearboxes (such as 160:1 strain wave gears) have high reflected inertia (Ireflected​=N2⋅Irotor​). When a robot limb strikes a human, the rotor cannot be quickly backdriven. The joint behaves as a rigid steel bar during the first 10 to 20 milliseconds of impact.

• The Solution: Humanoids like Unitree G1 and 1X NEO utilize low reduction ratios (typically 6:1 to 30:1) with high-torque-density motors.

• The Safety Impact: Low reflected inertia provides high passive backdrivability. An unexpected impact physically backdrives the motor rotor, transferring kinetic energy into electrical regeneration and mechanical compliance before software even registers the strike.

↓ (Structural Energy Dissipation)

Layer 2: Tactile Electronic Skins and Compliant Enclosures

• The Physical Buffer: Force is pressure multiplied by area ($F=P\times A$). Contacting a human with a sharp 2 mm aluminum bracket concentrates force onto a microscopic area, immediately exceeding the 140 N/cm2 pressure limit.

• The Solution: Humanoids are wrapped in energy-absorbing elastomeric shells, 3D-lattice cellular cores, and continuous tactile skins (such as capacitive or optical arrays).

• The Safety Impact: The compressible padding increases the contact area ($A$) while extending the deceleration time window ($\Delta t$) of the impact. Extending impact duration from 5 milliseconds to 25 milliseconds reduces peak dynamic impact force by over 70%, keeping transient forces well below ISO/TS 15066 thresholds.

↓ (Active Closed-Loop Compensation)

Layer 3: Redundant Joint-Torque Sensing and Impedance Control

• Rather than estimating torque indirectly from motor phase current (which is corrupted by gear friction and thermal resistance changes), safety-certified joints embed dual strain-gauge torque sensors directly on the output shaft.

• The safety processor executes active impedance control: the joint acts as a programmable virtual spring-damper. If external force deviates from the expected model by more than 10 N, the joint yields compliantly, matching the motion of the contacting human.

The Novel Humanoid Hazard: Whole-Body Fall and Crush Mechanics

While standard collaborative robot arms (cobots) like Universal Robots UR10 or FANUC CRX are bolted securely to concrete floors or heavy mobile pedestals, humanoid bipeds introduce an entirely new class of industrial risk: uncontrolled bipedal falls.

If a 70 kg humanoid suffers a sudden power loss, algorithmic balance failure, or floor slip, it does not safely lock in place. It becomes an unconstrained, top-heavy inverted pendulum that collapses under gravity.

Dynamic Fall Progression:
Locomotion Disruption (Floor slip, joint stall, or sensor dropout)
↓
Zero-Moment Point (ZMP) Divergence (Center of mass leaves polygon of support)
↓
Uncontrolled Gravitational Collapse (70 kg falling mass hits concrete at >2.5 m/s)
↓
Catastrophic Impact (Potential 3,000+ N dynamic crush risk on nearby humans)

Traditional ISO 10218 standards do not adequately address mobile tipping hazards. To satisfy international safety regulators, humanoid manufacturers are developing Active Fall Mitigation Policies:

Phase 1: Dynamic Collapse Detection (Under 30 Milliseconds)

• The safety IMU and joint encoders detect an irreversible divergence in the robot’s Zero-Moment Point (ZMP).

• The control system confirms that recovery stepping is mechanically impossible within available joint torque limits.

↓ (Kinematic Trajectory Reconfiguration)

Phase 2: Active Self-Tucking and Energy Dissipation

• Instead of cutting motor power immediately (which turns the robot into an unpredictable ragdoll), the safety controller commands an active emergency crouch profile.

• The knees and hips fold rapidly to drop the robot’s center of mass close to the floor, reducing falling height and impact velocity.

• The arms sweep inward across the torso to shield delicate head-mounted sensors and prevent outstretched limbs from striking nearby personnel.

↓ (Safe Hardware Isolation)

Phase 3: Controlled Decoupling and Brake Engagement

• Milliseconds prior to ground impact, the system executes Safe Torque Off (STO) and engages mechanical joint brakes.

• Kinetic energy is absorbed by the robot’s cellular exterior padding and structural sacrificial bumpers, preventing the chassis from bouncing or rolling across the floor.

Real-World Certification Footprint: Active Safety Testing

The physical validation of collaborative safety protocols, tactile collision stops, and ISO-compliant force limiting is visible in testing laboratories:

Collaborative Safety & Contact Testing Video Reference:

Watch functional force-limiting and skin sensor architectures in collaborative trials: Fraunhofer IFF: Testing Safety and Human-Robot Contact Limits under ISO/TS 15066

• Key Observation Points:

  • Calibrated mechanical impact pendulums measuring peak dynamic force and pressure on human-analogue load cells.

  • Rapid deceleration of moving robot links upon contact with tactile sensor skin arrays.

  • Functional safety controllers executing safe stops within allowable millisecond time horizons.

Engineering Verdict & Field Evaluation

Power & Force Limiting (PFL): Pros & Operational Strengths

• Fenceless Enterprise Deployment: The only legal framework under international law that allows humanoids to work alongside human workers without physical barriers.

• Preserves Facility Footprint: Eliminates the need for expensive factory redesigns, safety fences, and light curtains, enabling robots to slot into existing human assembly lines.

• Higher Social Acceptance: Workers interact with humanoids confidently when they know the machine will compliantly stop upon contact rather than pushing through resistance.

Power & Force Limiting (PFL): Limitations & Engineering Risks

• Severe Operational Speed Caps: Meeting strict ISO/TS 15066 force limits requires capping limb transit speeds at 0.5 to 1.0 m/s in shared zones, reducing operational throughput.

• High Hardware Bill-of-Materials Cost: Demands redundant, SIL-certified joint torque sensors, safety PLCs, and tactile skins that can add $15,000 to $25,000 to the robot’s base manufacturing cost.

• Regulatory Ambiguity: Existing standards (ISO 10218 / TS 15066) were written for stationary arms and wheeled AGVs; mobile, multi-DoF bipeds face lengthy certification audits while standards committees draft humanoid-specific guidelines.

The Bot.to Benchmark Verdict:

Force limiting and functional safety compliance are the ultimate gatekeepers of the commercial humanoid industry. An enterprise humanoid that boasts flawless AI reasoning but lacks certified Performance Level d (PL d) force limiting cannot legally operate in a Tier-1 automotive plant or unionized logistics facility.

The companies that conquer the market will not necessarily have the flashiest social-media demo videos. They will be the companies that engineer hardware-enforced functional safety systems—combining quasi-direct drive compliance, energy-absorbing tactile skins, and SIL-rated safety watchdogs that satisfy the strict biomechanical mandates of ISO/TS 15066.

Frequently Asked Questions (FAQ)

Q: What is ISO/TS 15066, and why is it important for humanoid robots?

A: ISO/TS 15066 is the international technical specification that defines safety requirements for collaborative robots working directly alongside humans without safety fences. It establishes explicit, mathematically verified biomechanical pain and injury thresholds (maximum permissible force and pressure) across 29 specific areas of the human body, serving as the benchmark for certifying safe human-robot contact.

Q: Can a humanoid robot’s safety system be controlled entirely by its main AI model?

A: No. Under international machinery safety standards (ISO 13849-1), safety-critical systems must achieve Performance Level d (PL d) or higher, requiring deterministic execution and dual-channel hardware redundancy. Large AI models (such as Vision-Language-Action transformers) are non-deterministic and run on complex operating systems that cannot be certified. Safety functions must be enforced by dedicated, certified safety microcontrollers that can override the AI in milliseconds.

Q: What is the difference between transient contact and quasi-static contact?

A: Transient contact is a dynamic, short-duration impact (lasting less than 50 ms) where the human body is free to recoil or step away, allowing higher dynamic forces to be safely absorbed. Quasi-static contact occurs when a robot pins or clamps a human against a rigid surface (like a table, conveyor, or wall); because the human cannot move, permissible force limits are set significantly lower to prevent crushing and broken bones.

Q: What is Safe Torque Off (STO), and how does it protect workers?

A: Safe Torque Off (STO) is a hardware-level safety function that immediately cuts electrical power to the motor inverters, ensuring that the motor can no longer generate rotational force or torque. Unlike a software-controlled stop, STO is hardwired and guaranteed to work even if the robot’s software crashes or freezes completely.

Explore related platforms and technical profiles in the Bot.to Humanoid Directory or read our direct hardware breakdown: Humanoid Robot Economics: Calculating Payback Periods Against a $25/Hour Human Worker.