Part IV: Physical interaction

Article 13. Contact classes and body limits

Every contact between a robot and a person is intended, incidental or a collision, and all three stay under ceilings set at a fraction of the body-region limits in ISO 10218-2:2025.

13.1 Contact classes. The classes are defined in Article 3. For a robot in the Shared class, the only intended contact is a handover into a person's hand after an explicit yes.

13.2 Reference limits. ISO 10218-2:2025 Annex M, formerly part of ISO/TS 15066, lists pain-onset limits for 29 body regions, for clamping and for impact (analysis). For hands and fingers, the clamping force limit is 140 N (Robotiq) and the impact limit is 280 N (study). Annex M is informative, but it is the industry benchmark.

13.3 Ceilings. Any contact, planned or not, stays at or below half the Annex M value for the body region, and at or below a quarter for a vulnerable person. Ceilings cover pressure as well as force, measured at the contact point including any held object.

13.4 Head, face and neck. No contact with the head, face or neck is planned for any task, and the robot does not lift or carry anything at head height while a person is within reach.

13.5 Clamping is the worst case. A hand pinned against a shelf, bin or wall cannot recoil, which is why its clamping limit is half its impact limit. The robot never moves toward a hand near a fixed surface, and pinch gaps between its arm, gripper and fixed objects are designed out.

13.6 Proof by measurement. Ceilings are proven by measuring force and pressure at the worst-case contact points, at full operating speed, by the method in ISO 10218-2:2025 Annex N (Robotiq). Measurements are repeated after any change that affects motion, and on a schedule.

13.7 Soft parts count. The stiffness of soft grippers and covers is part of a robot's certified configuration. Wear, cuts or hardening change contact forces, so soft parts are inspected and replaced on schedule (17.5).

13.8 Consent. Intended contact always needs an explicit yes (9.6). Robots built for touch get their own contact limits, including how pressure may build and how long it may last, in their profiles.

Article 14. Rebound and debounce

When a robot senses contact it reacts first and classifies second, and no filtering may delay a stop.

14.1 Detecting contact. The arm detects contact by at least two independent means, such as joint-torque sensing and a tactile skin or gripper-force sensing. A mobile base uses bumpers and its own sensing. One credible signal from any of them triggers the reaction.

14.2 Rebound: the reaction. Within one control cycle of the first credible signal, as a design target, the robot:

1. stops all motion toward the person or object;
2. switches the arm to compliant mode, so it yields to pressure;
3. backs off along the path it just travelled, to relieve any clamp;
4. keeps its grip on any load (14.4);
5. holds in a protective stop and says what happened.

14.3 Limits on rebound. The back-off is short and slow, with its distance and speed set by test, and runs only along the path just travelled, which is known to be clear. A second contact during the back-off stops it at once.

14.4 Never drop to escape. The robot never drops a hazardous substance, a glass container or a liquid in reaction to contact. The gripper holds the load at the lightest secure grip while the arm yields, and releases it only over a tray or into a hand after a yes.

14.5 No debounce on stopping. A single credible signal triggers the reaction. The robot does not wait to confirm, average or check it with the AI first, and false stops are an accepted cost.

14.6 Debounce on resuming. Debounce applies only to resuming. The contact signal must read clear for a set time, the cause must be known, and an operator must say yes before the robot moves again (10.6).

14.7 Classify afterwards. After reacting, the robot classifies the event: intended, incidental or collision; clamp or impact; the likely body region and the peak force. The classification feeds the incident record and the review of limits, never the reaction itself.

14.8 Repeated contact. Repeated incidental contacts within one shift put the robot in a protective stop for a supervisor review. Repeated contact means the envelope or the layout needs to change.

14.9 Contact with objects. Unplanned contact with shelves, bins or stock triggers the same reaction. The robot then checks the object before continuing, and a knocked or damaged container of a safety-critical item is treated as an incident.

Article 15. Objects and surroundings

A robot handles every object by its class, and the rules for hazardous substances, controlled items, glass and liquids override speed and convenience.

15.1 Identify before touching. The robot identifies each object by code, label and vision before grasping it, and stops to ask if they disagree. Annex A gives the pharmacy requirement.

15.2 Object classes.

15.3 Hazardous substances. A robot handles hazardous substances only in sealed containers, unless its setting profile allows more, and never in a way that could release them. Annex A gives the stricter pharmacy rule for hazardous drugs.

15.4 Controlled items. Controlled items, such as controlled substances, keep an unbroken chain of custody. The robot scans each one at every hand-off, never leaves one outside secure storage unattended, stops the workflow and alerts the supervisor on any count discrepancy, and never edits custody or inventory records. Annex A gives the pharmacy rules.

15.5 Grip and feedback. The gripper sets its stiffness and grip force by object class. It senses slip and corrects its grip within limits that protect glass and packaging, and it logs the peak force of every grasp.

15.6 Leaving things stable. Objects are placed fully supported, never overhanging an edge, on the floor or in a walkway. Shelves and trays are never loaded past their rating.

15.7 Keeping the room safe. The robot keeps aisles and exits clear and never blocks an exit, eyewash station or fire extinguisher. It reports floor hazards such as spills or cords, and parks and charges only at its marked dock.

15.8 Every step on record. At each workflow step the robot captures a photo, a video clip and an AI check, for robot and human work alike, building one audit trail per work item. A failed check holds that item for the supervisor.

15.9 Lots and recalls. The robot keeps batch or lot numbers traceable to each work item, so a recalled lot can be found and quarantined.

Article 16. Motion guardrail catalog

A robot performs only the motions its catalog lists, each tied to its guardrail records, and refuses any motion not listed.

16.1 A closed list. A motion the AI plans must match a catalog entry and pass the safety layer, or it does not run. The robot never improvises a new way of doing a step, even when the result would look the same.

16.2 What each entry holds. Each catalog entry names the motion, the workflow steps it serves, its main hazards, its safe state and its guardrail records. Annex B shows a catalog for a robot working in a pharmacy.

16.3 Adding a motion. A new motion enters the catalog only after a risk assessment, tests and its guardrail records. A motion that brings a person within reach or handles a hazardous object also needs Safety Commission approval.

Article 17. Hardware, energy, software and security

A robot is built so that the failure of any single part, the AI included, still leaves it safe.

17.1 Independent safety layer. Stopping, speed and separation, force limiting and zone limits run on safety-rated hardware and software separate from the AI. The AI can make limits stricter but can never loosen or bypass them.

17.2 Redundancy. Person detection and the stop function each have at least two independent channels, so one failed sensor cannot hide a person.

17.3 Fail-safe defaults. Any detected fault sends the robot to its safe state. Safety functions meet the performance level the risk assessment requires under ISO 13849-1, and are checked at every start-up.

17.4 Batteries and energy. Batteries are monitored for temperature, voltage and damage, and charge only at the dock. A battery fault isolates power and alerts staff, and maintenance uses energy lock-out (OSHA).

17.5 Soft parts. Soft grippers and covers are safety parts. Their stiffness, wear, cuts and hardening are inspected on schedule, and they are replaced before they change contact forces.

17.6 Software and AI models. Every software and model release is versioned, signed and passes the safety regression tests before installation. Updates never install while the robot moves, and a failed update rolls back. Nothing learned in the field changes motion limits or safety behavior without a new release.

17.7 Cybersecurity. Commands are authenticated, and remote access runs only through the maker's secured, logged channel. A remote command never overrides the local safety layer, and signs of intrusion send the robot to its safe state.

17.8 Personal data. Cameras that read labels can capture personal or health information. In U.S. health care, a vendor that stores such data for a provider is a HIPAA business associate (HHS), so the maker signs a business associate agreement first. Images are encrypted, access is logged and only what each step needs is kept.

17.9 Retention. Records are kept at least as long as the law requires, and incident data until the investigation closes. Annex A gives the pharmacy periods.

17.10 Certification. Each maker certifies to the product standards that fit its robots, such as ISO/FDIS 13482 for service robots (in final ballot), ANSI/A3 R15.08 for industrial mobile robots and UL 3300 for service robots used near the public.