Force-Limited Safety: ISO/TS 15066 in Practice
The standard doesn't certify your cobot deployment as safe. It gives you the framework to prove it is.
Most cobot vendors lead with some version of "no safety cage required." That claim is technically accurate — under specific conditions, after a documented risk assessment, with tooling and speed configured appropriately. What it elides is that the standard governing those conditions is specific, technical, and frequently misapplied.
ISO/TS 15066:2016 — now integrated into ISO 10218-2:2025 — is the international technical specification for collaborative robot systems. It defines the permissible contact forces, pressure limits, speed constraints, and risk assessment requirements that determine whether a cobot deployment is genuinely compliant or just uncaged. Understanding it is mandatory before you remove a fence from any robot cell.
What ISO/TS 15066 actually governs
The standard defines four collaborative operation modes, each with different safety requirements:
1. Safety-rated monitored stop (SRMS) The robot stops when the operator enters the collaborative workspace. Motion resumes only when the operator leaves. This mode doesn't limit force or speed — the robot runs at full speed when the human is absent. It requires a safety-rated presence-sensing system (area scanner, light curtain) that can reliably detect the operator and command a safe stop.
2. Hand guiding The operator physically guides the robot through a task while it follows their movements. Requires a hand-guiding device with an enabling switch and emergency stop capability. Not relevant to most industrial automation deployments.
3. Speed and separation monitoring (SSM) The robot's speed is dynamically reduced as the operator approaches. At minimum separation distance, the robot reaches a safe stop before contact is possible. Requires real-time distance measurement — typically a safety-rated area scanner calculating operator position continuously. Speed and stop-distance calculations must account for robot deceleration time, which is non-trivial for heavier payload robots.
4. Power and force limiting (PFL) The mode most people mean when they say "collaborative robot." The robot operates at speeds and forces that, in the event of contact with a human body, remain below biomechanical injury thresholds. This is the mode that allows cobots to run continuously in the same space as operators without a dynamic separation requirement.
PFL is the most complex mode to validate correctly. It's also the one most frequently deployed without adequate documentation.
The Annex A body-region limits (and why they matter)
ISO/TS 15066 Annex A provides the biomechanical basis for PFL: body-region-specific limits for transient contact force (impact) and quasi-static contact force (clamping). These limits are derived from pain-onset research on the human body.
Key limits from the standard for reference:
| Body region | Transient force limit | Quasi-static force limit | Transient pressure | Quasi-static pressure |
|---|---|---|---|---|
| Skull and forehead | 130 N | 65 N | 130 N/cm² | 65 N/cm² |
| Palm of hand | 140 N | 70 N | 280 N/cm² | 140 N/cm² |
| Back of hand | 60 N | 30 N | 180 N/cm² | 90 N/cm² |
| Finger (dorsal) | 140 N | 70 N | 280 N/cm² | 140 N/cm² |
| Forearm (radius) | 160 N | 80 N | 150 N/cm² | 75 N/cm² |
| Upper arm | 150 N | 75 N | 150 N/cm² | 75 N/cm² |
| Chest | 140 N | 70 N | 105 N/cm² | 52 N/cm² |
Note that quasi-static (clamping) limits are 50% of transient limits for force and pressure. This distinction matters: if the robot contacts a body part and the joint torque sensors don't trigger a stop, the sustained force quickly exceeds the quasi-static threshold even at levels that were compliant as an impact.
The limits apply to the contact event, not the robot's rated force. A UR5e can exert up to 150 N at its TCP at full load. Whether contact with a human is within limits depends on the speed at the moment of contact, the effective mass of the moving payload, the contact geometry (sharp edge vs. flat surface), and which body region is involved.
The four-factor contact assessment
A proper PFL assessment cannot be done by checking a box on a vendor datasheet. It requires analyzing four interacting factors:
Factor 1: Effective payload mass at contact
This is not the robot's rated payload capacity. It is the actual mass of the end-effector assembly plus workpiece, plus the effective inertia of the moving robot arm at the point of contact. For a UR10e running a 4 kg workpiece at 800 mm/s, the effective impact energy depends on the configuration — a fully-extended arm contributes higher effective mass than a configuration near the robot base.
Factor 2: Tool and workpiece geometry
A flat, padded contact surface distributes force over area — pressure stays low even at moderate forces. A tool with a sharp point or edge concentrates all force on a tiny contact area, driving pressure far above limits at the same force level. A standard gripper finger designed for part retention (small contact radius, hard polymer) can exceed the palm pressure limit at forces well below the robot's mechanical maximum.
This is why the "collaborative" label on a robot does not mean any application of that robot is collaborative. The EOAT geometry must be assessed specifically.
Factor 3: TCP speed at the contact location
The robot doesn't contact humans at its maximum programmed path speed — it contacts them at the actual TCP velocity at the instant of contact in the relevant zone. For simple path programs, this may equal the programmed speed. For complex paths with accelerations and decelerations, actual contact speed may be lower or higher depending on where in the motion the contact occurs.
PFL robot controllers implement TCP speed monitoring that compares actual speed against safety-configured limits. These limits must be set based on the mass and geometry analysis, not the default factory setting.
Factor 4: Body region at risk
The assessment must consider which body regions can realistically be reached during normal and fault-condition operation. For a cobot mounted at bench height doing tabletop assembly, the highest-risk regions are hands, forearms, and upper arms. For a cobot mounted at shoulder height, torso and neck regions become relevant.
The risk assessment should map the robot's workspace against operator positions during normal operation, and identify the body regions that can be reached. The most constraining body-region limit for each reachable zone governs the allowable speed and force.
How ISO 10218-2:2025 changes the picture
ISO/TS 15066 was published in 2016 as a technical specification supplementing the ISO 10218 series. In 2025, updated ISO 10218-1 and ISO 10218-2 standards were published, integrating the collaborative robot requirements previously in ISO/TS 15066. This is a significant change for compliance documentation:
- References to ISO/TS 15066 in your risk assessment should be updated to cite ISO 10218-2:2025 Annex E (which carries forward the Annex A force/pressure tables)
- The 2025 standards add clearer guidance on risk assessment procedures for collaborative operations
- Existing deployments assessed under ISO/TS 15066 are not automatically non-compliant, but new deployments should document against the 2025 editions
For compliance purposes, check with your local national standards body — ISO 10218-1:2025 and ISO 10218-2:2025 may have been adopted as EN or ANSI standards in your jurisdiction, which affects legal requirements.
What most deployments miss
The fencing comes down before the assessment is done. This is the single most common compliance failure. The cobot is installed. It runs. No one gets hurt. The risk assessment documentation is written after the fact, or not at all. In a routine machine safety audit, this exposes the plant to significant liability — a workplace injury involving an undocumented collaborative deployment carries different legal consequences than one involving an assessed and documented system.
The speed limit is set from the robot's capabilities, not the application's requirements. Most PFL cobots have a configurable safety speed limit separate from the path program speed. Many deployments leave this at the factory default rather than calculating the appropriate limit for the specific payload and EOAT geometry.
EOAT changes aren't re-assessed. When the tool changes — different gripper, heavier workpiece, modified finger geometry — the original risk assessment is no longer valid. The contact mass, geometry, and speed parameters have changed. A new PFL assessment is required. This is commonly skipped in production environments where tooling changes are frequent.
Dual-check before trust. Cobot force-sensing is the primary safety layer under PFL, but it is not the only one required. ISO 10218-2:2025 expects risk reduction to achieve the required performance level through a combination of inherently safe design (PFL), safeguarding measures (area scanners, enabling devices), and information for use (training, documented procedures). Relying solely on the robot's torque sensors without any complementary measure is unlikely to achieve the required risk reduction for most PFL applications.
The practical compliance floor for a PFL deployment
If you are deploying a cobot in PFL mode, the minimum compliant documentation package includes:
- Risk assessment per ISO 10218-2:2025 (or 2011 + ISO/TS 15066 for legacy) covering the specific application, EOAT, workpiece, and operator positions
- Contact force and pressure analysis per Annex A body-region limits, showing the assessed contact scenario is within limits at the configured speed
- Safety-rated speed monitoring configuration — documented settings in the robot controller, not just the path program speed
- EOAT geometry documentation — dimensions, material, contact radius used in the pressure calculations
- Operator training records — documented training on normal operation, fault response, and the boundaries of the collaborative workspace
- Change management procedure — a written process for re-assessing when EOAT, workpiece, or workspace layout changes
Six documents. If you can't produce them, you have a cobot running without documentation, not a compliant collaborative installation.
For the environments where no amount of PFL design makes collaborative deployment viable — high-speed, high-payload, contaminated cells — the next article in this series covers where cobots fail regardless of the safety configuration.
