Collaborative Robot Safety Explained: ISO 10218:2025, ISO/TS 15066, Power and Force Limiting and Speed and Separation Monitoring

There is no such thing as a safe collaborative robot. There are only safe collaborative applications. That sentence used to be a consultant’s slogan; since February 2025 it is written into the standard. The revised ISO 10218 series dropped “collaborative robot” as a robot property and treats collaboration as something an application does. Collaborative robot safety is therefore a property of the whole cell: the arm, the gripper, the part, the speed, the layout and the people.

This matters now because the transition clock is running. ISO 10218-1 and -2 were republished in 2025, most of ISO/TS 15066 was folded into Part 2, the US adopted the series as ANSI/A3 R15.06-2025, and the EU Machinery Regulation applies from January 2027. Integrators who learned the 2011-era vocabulary are relearning it.

You will leave knowing how the standards stack fits together, how power and force limiting and speed and separation monitoring actually work, how to compute a separation distance, and where real projects fail validation.

What this covers: the 2025 revision, robot classes, the four collaborative methods, PFL contact limits and measurement, the SSM distance formula with a worked example, PL d control architecture, and failure modes.

Context and Background

Industrial robots spent four decades behind fences. The safety model was simple: separate people from motion with guards, interlocked doors and light curtains, and stop everything when a person enters. ISO 10218-1 (the robot) and ISO 10218-2 (the robot system and integration) codified that model, with the 2011 editions becoming the global baseline and the US adopting them as ANSI/RIA R15.06-2012.

The 2011 editions already allowed collaborative operation, but they said little about how much contact was acceptable. ISO/TS 15066, published in 2016, filled that gap. It described four collaborative operation types and, most importantly, a body model with biomechanical limits for force and pressure. Those limits came from volunteer pain-onset studies, notably the DGUV research project run by the University of Mainz with the German Social Accident Insurance’s Institute for Occupational Safety and Health (IFA). That study collected roughly 9,000 pain-threshold measurements from about 100 subjects across 29 body points, according to the IFA pain threshold map.

In February 2025, ISO/TC 299 published the revised ISO 10218-1:2025 and ISO 10218-2:2025, the first major revision since 2011. The documents grew substantially; the ANSI blog summary puts Part 1 at 95 pages (up from 50) and Part 2 at 223 pages (up from 72). The Association for Advancing Automation (A3) published the US adoption, ANSI/A3 R15.06-2025, in three parts, with Part 3 covering users of robot cells.

Collaborative safety never lives alone. The risk assessment method comes from ISO 12100. The reliability of every safety function is graded with Performance Levels from ISO 13849-1, which we unpack in our guide to ISO 13849 performance levels, categories, MTTFd and DC. For process-oriented readers, the parallel world of safety integrity levels is covered in IEC 61508 SIL, PFD and safety PLC architecture.

Most explainers stop at “cobots have force sensors, so they are safe.” My thesis is different. Collaborative safety is dominated by two quantities that marketing rarely mentions: effective moving mass in power and force limiting, and human-side reaction distance in speed and separation monitoring. Get those two right and the rest is paperwork; get them wrong and no torque sensor will save the validation.

The Collaborative Robot Safety Reference Model Under ISO 10218:2025

Direct answer: Collaborative robot safety under ISO 10218:2025 means a risk-assessed application, not a certified robot. Part 1 sets what the robot manufacturer must provide, including robot class and safety functions. Part 2 sets how the integrator applies power and force limiting, speed and separation monitoring or hand guiding, using former ISO/TS 15066 content, and validates the result.

Figure 1: How the collaborative robot safety standards fit together after the 2025 revision. Risk assessment feeds both the robot and the application; every safety function is graded by ISO 13849-1 and closed out by validation.

Read Figure 1 top to bottom. ISO 12100 supplies the risk assessment method that everything else depends on. The robot manufacturer works to ISO 10218-1, which now classifies robots and lists the safety functions they must or may provide. The integrator works to ISO 10218-2, which absorbed most of ISO/TS 15066 and the gripper and load-station guidance from ISO/TR 20218-1 and -2. Every safety function, from either side, is specified with a Performance Level under ISO 13849-1 and then validated by measurement.

Collaboration moved from the robot to the application

The most visible change is vocabulary. According to the German Commission for Occupational Health and Safety and Standardization (KAN), the revised documents removed “collaborative operation” and similar wording because it described the application type, not a mode or property of the robot. The standards no longer speak of a “collaborative robot”, a “collaborative mode” or a “collaborative speed”. ANSI’s summary of R15.06-2025 describes the same shift: “collaborative application” replaces “collaborative robot”.

This is not pedantry. A small power-and-force-limited arm carrying a deburring spindle with an exposed cutter is not collaborative in any meaningful sense, whatever its datasheet says. Conversely, a large conventional robot can participate in a collaborative application if speed and separation monitoring keeps people out of reach of motion. The standard now forces the analysis to start from the task, the tool and the body parts at risk.

The practical consequence for procurement is that a “cobot” label buys you capabilities, not compliance. The robot supplies certified safety functions, such as force monitoring, speed limits and safe zones, each with a stated Performance Level. Whether those functions are adequate is answered only by the application risk assessment and validation measurements on the finished cell.

Robot classes and the Annex C safety function list

ISO 10218-1:2025 introduces robot classes with matching functional safety requirements and test methods. KAN reports that Class I covers robots with a maximum manipulator mass of 10 kg, a maximum force of 50 N and a maximum speed of 250 mm/s; exceeding any of those makes a robot Class II. A 2025 ESREL conference paper adds an important detail: Class I status is determined by the manipulator’s maximum capability without being limited by robot or safety functions. In other words, you cannot software-limit a big robot into Class I.

Class I robots face much lower functional safety requirements, which makes sense: a 10 kg arm that physically cannot exceed 50 N or 250 mm/s has limited capacity to hurt anyone. Nearly every commercial arm marketed as a cobot, carrying a useful payload at useful speed, will land in Class II. That means its safety functions must meet the Performance Levels tabulated for Class II robots.

Those safety functions are listed in Annex C of Part 1. KAN describes three groups: functions that are mandatory, functions that are required only if the robot provides a given capability, and optional functions. For robot applications in Part 2, each safety function can either meet the Annex C1 values or meet a required Performance Level (PLr) derived from a risk assessment using the parameters in Annex C2. The risk assessment method itself can be chosen freely, but it must follow ISO 12100 sub-clause 5.5 and use the mandatory risk parameters.

For context, the 2011 edition took a blunter route. ISO 10218-1:2011 required safety-related control systems to meet PL d with Category 3 architecture per ISO 13849-1, or SIL 2 with a hardware fault tolerance of 1 per IEC 62061, unless the risk assessment justified otherwise. That “PL d, Cat 3” default is still what most integrators mean when they talk about robot safety, and it remains a sensible starting assumption for any function that protects people from a Class II robot. The 2025 edition replaces the single default with a per-function table, so check Annex C for each function rather than assuming.

The four collaborative methods, renamed and regrouped

ISO/TS 15066:2016 described four collaborative operation types: safety-rated monitored stop, hand guiding, speed and separation monitoring (SSM), and power and force limiting (PFL). The 2025 edition regroups them. KAN reports that three safety functions now address collaborative applications: hand guiding control (HGC), SSM and PFL. The monitored stop was dropped from the collaborative list because many non-collaborative applications also need it. ANSI notes that R15.06-2025 renames “safety-rated monitored stop” as “monitored standstill”.

Each method answers a different question:

Monitored standstill asks whether the robot is guaranteed not to move while a person is inside its space, for example during a manual load step. Motion power can remain on, but standstill is monitored by a safety function.
Hand guiding asks whether an operator holding an enabling device can move the robot directly, with speed limited and a stop available at all times.
Speed and separation monitoring asks whether the robot can always stop before it reaches a person. Contact never happens by design.
Power and force limiting asks whether contact, if it happens, stays below biomechanical limits for the body region involved. Contact is permitted by design.

The first two are procedural and relatively easy to validate. The last two are engineered and quantitative, and they are where most of the analysis and most of the failed audits live. The rest of this post focuses on them.

Why the integrator now carries most of the weight

Part 2 grew from 72 to 223 pages for a reason. The application decides payload, tool geometry, approach directions, body regions exposed, layout distances and sensor placement. None of those is known when the robot leaves the factory. By moving TS 15066 content and the ISO/TR 20218 end-effector guidance into Part 2, the standards committee put the requirements where the decisions are made.

ISO/TS 15066:2016 itself is still listed as valid by national standards catalogues at the time of writing, but its role is now historical reference rather than the primary text. New projects should cite ISO 10218-2:2025 and treat TS 15066 as background.

Walk-through: Power and Force Limiting, Speed and Separation Monitoring and the Numbers Behind Them

This section works through the two quantitative methods mechanism by mechanism. Where numbers appear, they are either taken from cited sources or explicitly labelled illustrative. Biomechanical limit values for specific body regions are published in the standard’s body model; they are not reproduced here, and you should take them from your licensed copy of ISO 10218-2:2025 or ISO/TS 15066.

Power and force limiting: contact is allowed, injury is not

Power and force limiting (PFL) accepts that a person and a moving robot may touch. The design goal is that any contact stays below the onset of pain for the body region involved. The robot contributes by limiting joint torques, monitoring external force (via joint torque sensors, motor current models or a force-torque sensor) and stopping or reversing on detected collision. The application contributes by limiting speed, payload and tool sharpness, and by arranging the task so that the most sensitive body regions are never in the path.

The body model in ISO/TS 15066 divides the body into 29 specific body regions. As Fraunhofer IFF researchers summarised in a NIST-hosted IROS 2019 workshop presentation, the model sets absolute limits for quasi-static contact, gives scaling factors for transient contact that vary by body part, and uses the onset of pain as the maximum allowable stress. Force limits apply to blunt contacts; pressure limits apply to semi-sharp contacts. The same source notes that the technical specification does not permit impacts to the head and neck region.

Two contact types drive everything:

Quasi-static contact (clamping or crushing). A body part is trapped between the robot and a fixed object, such as a hand against a fixture. Force builds while the robot keeps pushing or until it detects the contact and stops. The relevant limit is the lower, quasi-static value, and the critical factor is how quickly the robot detects and relieves the force.
Transient contact (free impact). The robot strikes a body part that can move away, such as an arm in free space. The contact lasts only milliseconds, the body recoils, and a higher transient limit applies, derived from the quasi-static value by the body-region scaling factor.

Transient contact is governed by kinetic energy transfer, which is why speed and moving mass matter so much. Clamping is governed by force detection and reaction, which is why fixtures, pinch points and stopping behaviour matter so much.

Figure 2: Power and force limiting validation loop. Each hazard is classified by contact type and body region, parameters are set, and the contact is measured; failures loop back to lower speed, padding or tool redesign.

Figure 2 is the loop every PFL project runs. Notice the branch that exits immediately: if the head or neck can be in the contact path, the answer is redesign, not parameter tuning. Notice also that the loop closes on measurement, not on calculation. Calculation sets the starting parameters; measurement proves them.

Effective mass: the variable that decides transient speed

ISO/TS 15066 models a transient collision as a spring-mass system. The maximum permissible relative speed between robot and body region is given, as reproduced in a 2023 variable impedance control paper on arXiv, by:

v_rel,max = F_max / sqrt(μ · k)

Here F_max is the maximum allowable force for the body region, k is that region’s effective spring constant, and μ is the reduced mass of the two-body system:

μ = (1/m_H + 1/m_R)^-1

m_H is the effective mass of the human body region, and m_R is the effective robot mass, conservatively estimated as:

m_R = M/2 + m_L

where M is the total mass of the robot’s moving parts and m_L is the effective payload, including the tool and the workpiece.

These three lines explain most PFL outcomes. Because speed scales with one over the square root of the reduced mass, and the reduced mass is capped by the lighter of the two bodies, the arm’s moving mass matters less than people expect when the body region is light, and much more when it is heavy.

Illustrative example (not values from the standard). Suppose a robot’s moving parts weigh M = 24 kg and the tool plus part weigh 3 kg. Then m_R = 12 + 3 = 15 kg. Take two hypothetical body regions, one with effective mass 1 kg and one with 40 kg.

Case	m_H	m_R	Reduced mass μ	Relative to 1 kg case
Light region, 3 kg payload	1 kg	15 kg	0.94 kg	baseline
Light region, 8 kg payload	1 kg	20 kg	0.95 kg	about 2% higher μ
Heavy region, 3 kg payload	40 kg	15 kg	10.9 kg	about 11.6 times μ
Heavy region, 8 kg payload	40 kg	20 kg	13.3 kg	about 14.2 times μ

For the light region, nearly tripling the payload barely moves μ, so the permissible speed barely changes. For the heavy region, the same payload change raises μ by about 22%, which lowers the permissible speed by roughly 10% for the same F_max and k. The illustrative takeaway is structural: payload and arm mass matter most for heavy, well-supported body regions such as the torso, and least for light extremities, where the limit itself and the tool geometry dominate.

Do not plug these illustrative numbers into a real design. Use the body-region m_H, k, force and pressure values from the standard, and treat the formula only as a starting point that measurement must confirm.

Pressure, not force, is usually the binding limit

Force limits apply to blunt contact. Pressure limits apply to semi-sharp contact, and pressure is force divided by contact area. A gripper finger edge, a bolt head or a sheet-metal part can concentrate a modest force onto a few square millimetres. That is why PFL projects often pass the force test and fail the pressure test.

The fix is geometric. Round edges, add compliant covers, orient parts so that flat faces lead during motion, and keep sharp features pointing away from operator approach directions. The ISO/TR 20218-1 gripper guidance, now incorporated into Part 2, exists precisely because the end-effector is where most pressure failures originate. A robot that passes with a padded test probe can fail badly with a production gripper carrying a cast part.

Measuring contact: how validation actually happens

PFL validation is done with a force and pressure measurement device that mimics the body region’s stiffness. In practice this is a calibrated load cell behind a spring element of specified stiffness, often with a damping material, plus pressure-sensitive film or an electronic pressure array on the contact face. The device is placed where the hazard analysis says contact can occur, and the robot is driven into it at the programmed speed and payload.

Several details decide whether the measurement is meaningful:

Spring rate must match the body region. A stiff device overstates force; a soft one understates it. Use the stiffness the standard associates with the region under test.
Repeat each test. Contact force varies with joint configuration, approach angle and controller state. Run multiple trials and report the worst case, not the mean.
Test the real tool and part. Pressure depends on the actual contact geometry, so dummy tooling invalidates the test.
Test worst-case poses. Effective mass and stopping behaviour vary across the workspace. A test at the centre of the reach envelope does not cover the extended pose.
Capture both peaks. Transient tests need the impact peak; clamping tests need the sustained force after detection and the time to relief.

The IFA has published measurement guidance alongside its pain-threshold work, and several manufacturers sell dedicated collaborative robot force measurement instruments. Whichever you use, record calibration, setup photographs, parameters and raw traces in the technical file.

Speed and separation monitoring: contact never happens

Speed and separation monitoring (SSM) takes the opposite approach. Sensors track the distance between the robot and any person, and the robot slows or stops so that it always halts before reaching them. Contact is not part of the design, so body-region limits do not apply, and the robot can be large and fast when nobody is near.

The core of SSM is the protective separation distance. ISO/TS 15066 defines it as the sum of six terms, a formulation analysed in detail by Marvel and Norcross at NIST in their 2016 paper “Implementing Speed and Separation Monitoring in Collaborative Robot Workcells” in Robotics and Computer-Integrated Manufacturing. In the commonly used notation:

S_p = S_h + S_r + S_s + C + Z_d + Z_r

S_h is the distance the human travels toward the robot during the robot system’s reaction time T_r plus stopping time T_s. With a constant human speed v_h, it is v_h × (T_r + T_s).
S_r is the distance the robot travels during the reaction time, v_r × T_r.
S_s is the robot’s stopping distance once braking begins.
C is the intrusion distance, the amount a body part can reach past the sensing field before detection, based on ISO 13855.
Z_d is the position uncertainty of the person, which comes from sensor measurement tolerance.
Z_r is the position uncertainty of the robot.

When the person’s speed is not measured, ISO/TS 15066 directs the designer to the human approach speeds of ISO 13855, where 1,600 mm/s is the familiar walking-approach value. Implementations in the research literature use the same 1.6 m/s figure, for example the Rochester Institute of Technology time-of-flight SSM study on arXiv.

Figure 3: The six components of the speed and separation monitoring protective separation distance. Human travel, robot travel and stopping distance grow with time; intrusion and uncertainty terms are fixed margins added on top.

Figure 3 shows why SSM is a timing problem first and a geometry problem second. Three of the six terms grow with reaction and stopping time. The other three are fixed margins. The decision at the right of the figure runs every safety cycle: if the measured separation exceeds S_p, motion continues; if not, the robot slows or stops.

Worked SSM example (illustrative)

The following numbers are illustrative only. They are chosen to be plausible for a scanner-guarded cell, but every real value must come from the robot manufacturer’s stopping data, the sensor datasheet, ISO 13855 and your own measurements.

Assume:

Human approach speed v_h = 1,600 mm/s (not monitored, so the ISO 13855 walking value is used).
System reaction time T_r = 0.10 s (scanner response plus safety controller cycle plus robot controller response).
Robot stopping time T_s = 0.30 s at full programmed speed.
Robot speed toward the person v_r = 1,000 mm/s.
Robot stopping distance S_s = 150 mm at that speed.
Intrusion distance C = 850 mm (assumed for a low-mounted horizontal scanner field; derive yours from the current ISO 13855).
Sensor uncertainty Z_d = 100 mm; robot position uncertainty Z_r = 20 mm.

Then:

S_h = 1,600 × (0.10 + 0.30) = 640 mm
S_r = 1,000 × 0.10 = 100 mm
S_p = 640 + 100 + 150 + 850 + 100 + 20 = 1,860 mm

Now cut robot speed to 250 mm/s near people. Suppose the stopping time drops to 0.15 s and stopping distance to 30 mm (again illustrative):

S_h = 1,600 × (0.10 + 0.15) = 400 mm
S_r = 250 × 0.10 = 25 mm
S_p = 400 + 25 + 30 + 850 + 100 + 20 = 1,425 mm

Quartering the robot’s speed shrank the distance by only about 23%. The human travel term and the intrusion term together account for 1,490 mm of the first result and 1,250 mm of the second. This is the central lesson of SSM: the robot’s own speed is often not the dominant term. Reaction time, which multiplies human speed, and the intrusion distance, which depends on sensor mounting and resolution, usually are.

Three design moves follow directly. Shorten reaction time with a faster scanner response setting and a safety controller with a short cycle. Reduce C by choosing sensor resolution and mounting height that ISO 13855 rewards. And reduce stopping time, which shrinks both S_h and S_s, by staging speed reductions before the protective stop rather than braking from full speed.

Static versus dynamic SSM

The simplest SSM implementation uses fixed zones. A safety laser scanner defines a warning field and a protective field; entry into the first triggers a safety-rated reduced speed, and entry into the second triggers a protective stop. Each field is sized from the S_p calculation for the speed the robot is allowed in that state. This is static SSM, and it is how most industrial cells work today.

Dynamic SSM computes S_p continuously from the robot’s actual speed and direction and the person’s tracked position. It allows much tighter layouts, because the robot moving away from a person needs almost no separation. It also demands far more of the sensing and safety logic: 3D sensing with safety-rated performance, robot speed and position available as safety signals, and a validated calculation running in the safety domain. The research literature, including the NIST work, has explored this extensively, but certified dynamic SSM products remain fewer and more specialised than static zone systems.

Hand guiding and monitored standstill in brief

Hand guiding control lets an operator move the robot directly, typically through a guiding device near the end-effector that includes an enabling switch and an emergency stop. The robot runs at a safety-limited speed while guided, and releasing the enabling device stops motion. The risk assessment must still consider what the rest of the arm hits while the operator focuses on the tool.

Monitored standstill is the simplest collaborative-style function. The robot stops before a person enters the shared space, standstill is monitored by a safety function while the person works, and automatic motion resumes only when the person leaves. It is common in manual load stations, where the ISO/TR 20218-2 guidance now incorporated in Part 2 applies.

The safety control chain behind every collaborative function

Every PFL limit and every SSM zone is only as trustworthy as the control chain that enforces it. That chain runs from sensor to safety logic to the drives and brakes, and its reliability is expressed as a Performance Level under ISO 13849-1.

Figure 4: A speed and separation monitoring sequence. The scanner reports zone violations over two channels, the safety controller requests reduced speed and then a protective stop with safe torque off, and restart depends on the risk assessment.

Figure 4 traces one approach. A person entering the warning zone triggers a reduced-speed request; the robot controller ramps down to a monitored speed. Entering the protective zone triggers a stop. A common pattern is a controlled stop with power available, followed by safe torque off (STO) once motion has ended, which corresponds to stop category 1 in IEC 60204-1. The safety controller cross-checks both channels throughout. Whether the robot may restart automatically when the person leaves is a risk assessment decision, not a default.

In Category 3 architecture, a single fault must not cause loss of the safety function, and faults are detected where reasonably practicable. In practice that means two independent channels from sensor to output, cross-monitoring in the safety controller, and diagnostic coverage on contactors, brakes or drive STO inputs. The arithmetic of mean time to dangerous failure (MTTFd), diagnostic coverage (DC) and common-cause failure scoring that turns an architecture into a PL is covered in our ISO 13849 performance level guide.

Two signals deserve special attention in collaborative cells. The first is robot speed and position as safety signals: SSM depends on them, so they must come from the robot’s safety-rated monitoring, not from its motion planner. The second is the force or torque estimate used for PFL: it must be a safety function with a stated PL, not the same estimate the motion controller uses for compliant behaviour. The compliance techniques in our post on impedance and admittance control for compliant manipulation improve contact behaviour, but they are performance functions, not safety functions.

The 2025 revision also adds cybersecurity requirements tied to robot safety. The rationale is simple: a safety configuration that can be altered over the network is not a reliable safety function. Expect to protect safety parameters with access control and checksums, log configuration changes, and treat the safety configuration file as a controlled document. Humanoid and mobile platforms raise further issues; our Digit 5 safety architecture reference design shows how dynamically stable robots fall outside the statically stable assumption that ISO 10218 makes.

Trade-offs, Gotchas, and What Goes Wrong

Collaborative applications fail in predictable ways. Most failures are not exotic sensor faults; they are mismatches between what was validated and what actually runs on the shop floor.

Validated with the wrong tool or part. The cell passed PFL measurements with an early gripper prototype or a light sample part. Production uses a heavier part with sharper edges. Effective mass rises, contact area shrinks, and both force and pressure limits are exceeded. Any change to tool, part or payload must trigger re-measurement.

Clamping near fixtures. Transient contact in free space is rarely the binding case. Quasi-static clamping against a fixture, conveyor edge or the robot’s own links usually is, because the body part cannot recoil. Pinch points between the robot’s elbow and a column are classic findings in validation audits.

Speed limits that do not apply everywhere. A reduced Cartesian speed limit on the tool centre point does not limit the speed of the elbow during a large joint move. If the elbow can strike the operator, the limit must cover the relevant links, or the motion must be constrained so the elbow cannot reach the operator zone.

Reaction time measured once, at best. SSM distances depend on reaction and stopping times, and stopping times vary with payload, speed, pose and brake wear. Using a stopping time measured at light payload in a mid-reach pose understates S_s and S_h for the worst case. Use manufacturer worst-case stopping data and verify periodically.

Sensor blind spots and muting. Floor-mounted scanners do not see people leaning over a table, and 3D sensors can be shadowed by the robot itself or by carts. Muting a field for material flow can open a gap that a person can follow through. Every muting condition needs its own risk assessment.

Restart behaviour. Automatic restart after a person leaves the protective field is efficient, but if the field cannot detect a person who has remained inside the cell, restart becomes the hazard. Detection of presence, not just entry, decides whether auto-restart is acceptable.

Configuration drift. Safety parameters are edited during commissioning and never locked. A later change for cycle time quietly raises a speed limit. Checksums, access levels and a change-control procedure are the cure, and the 2025 cybersecurity requirements push in the same direction.

Treating the cobot label as a safety argument. The most expensive mistake is commercial. A project budgets for a cobot and no guarding, then discovers that the tool, part or cycle time makes PFL impossible, and fencing or SSM must be added late. Run the contact analysis before committing to the layout.

Practical Recommendations

Start every collaborative project with the task, not the robot. List each step where a person and the robot share space, the body regions that could be involved, and whether contact would be transient or clamping. That list decides whether PFL is viable, whether SSM is needed, or whether a conventional guarded cell with a monitored-standstill load station is the honest answer.

Pick the method per hazard, not per cell. Many productive cells combine methods: SSM keeps the robot fast when nobody is near, PFL covers the residual contact risk at the shared workstation, and monitored standstill handles manual loading. Combining them is normal and often gives the best cycle time.

Write the ISO 12100 risk assessment against ISO 10218-2:2025, not the 2011 edition, for new projects. Existing cells built to the 2011 edition do not automatically need recertification, but significant modifications and new placements on the market should trigger reassessment, especially in the EU as the Machinery Regulation (EU) 2023/1230 applies from 20 January 2027.

Treat the robot manufacturer’s safety manual as an input with stated limits. Note the PL of each safety function you rely on, the stopping time and distance data, and the conditions under which they were measured.

Checklist:

[ ] Task-based hazard list with body regions and contact types for every shared step.
[ ] Head and neck excluded from any possible contact path by design.
[ ] Robot class and Annex C safety function PLs recorded from the manufacturer’s documentation.
[ ] PLr for each application safety function derived per Annex C1 or C2.
[ ] PFL parameters measured with the production tool and part at worst-case poses, with repeated trials.
[ ] SSM distances calculated from worst-case stopping data and ISO 13855 intrusion values.
[ ] Safety configuration locked with checksum, access control and change procedure.
[ ] Periodic re-verification of stopping performance and sensor fields scheduled.

Frequently Asked Questions

Is ISO/TS 15066 still valid after ISO 10218:2025?

Most of its requirements were incorporated into ISO 10218-2:2025, which is now the primary reference for collaborative applications. National catalogues still listed ISO/TS 15066:2016 as valid when we checked, so you may see it cited in older risk assessments and supplier documents. For new projects, design and document against ISO 10218-2:2025, and treat TS 15066 as background that explains the origin of the body model and the separation distance formula. Check your national standards body for formal status changes, because withdrawal decisions can lag publication of the replacing standard.

What is the difference between power and force limiting and speed and separation monitoring?

Power and force limiting permits contact between robot and person but limits force and pressure below biomechanical thresholds for the body region involved. Speed and separation monitoring prevents contact by tracking distance and stopping the robot before it reaches a person. PFL suits slow, light, close-in work such as assembly assistance. SSM suits larger, faster robots where people approach occasionally. Many cells combine them, using SSM for speed when the area is clear and PFL at the shared workstation where contact cannot be excluded.

Does a cobot need a safety fence?

Not necessarily, but the robot alone never answers that question. ISO 10218:2025 treats collaboration as a property of the application. If the risk assessment shows that all foreseeable contacts stay within biomechanical limits, or that separation monitoring always stops the robot first, fencing may not be needed. If the tool has a cutting edge, the part is heavy or sharp, or the cycle time demands high speed, guarding or sensor-based safeguarding is likely required even with a collaborative-capable arm.

What Performance Level does a collaborative robot safety function need?

The 2011 edition of ISO 10218-1 defaulted safety-related control systems to PL d with Category 3 architecture, or SIL 2 with hardware fault tolerance of 1, unless risk assessment justified otherwise. The 2025 edition replaces that single default with per-function requirements in Annex C of Part 1. For applications, Part 2 lets you either meet the Annex C1 values or derive a PLr from a risk assessment using Annex C2 parameters. PL d remains the common level for functions that protect people from Class II robots.

How is the speed and separation monitoring distance calculated?

The protective separation distance is the sum of human travel during reaction and stopping time, robot travel during reaction time, robot stopping distance, the intrusion distance from ISO 13855, and sensor and robot position uncertainties. When human speed is not measured, 1,600 mm/s from ISO 13855 is typically used. Reaction and stopping times usually dominate, because they multiply human speed. Slowing the robot helps less than shortening reaction time and reducing intrusion distance through better sensor placement and resolution.

What changed for robot manufacturers in ISO 10218-1:2025?

Part 1 introduces robot classes, with Class I covering robots of up to 10 kg manipulator mass, 50 N force and 250 mm/s speed based on physical capability, and Class II covering everything else. It lists safety functions in Annex C with associated Performance Levels, specifies requirements for power and force limiting, speed and separation monitoring and hand guiding at robot level, adds a normal stop function, and introduces cybersecurity requirements related to safety. Functional safety requirements are stated explicitly rather than implied.

Collaborative Robot Safety Explained: ISO 10218, ISO/TS 15066, Power and Force Limiting and Speed and Separation Monitoring (2026)