Cobot risk assessment checklist: ISO/TS 15066 before fenceless go-live

No fence is easy to remember. The floor still has to say who can meet what, with how much energy, how often, and how it stops if that fails. A cobot is not safe for the whole cell just because it is called collaborative. The part, the tool, and where people stand all sit inside the robotic arm assessment.

Roooll r-Core collaborative robot (standard), 5kg payload, ±0.02mm repeatability, 922mm reach; precision assembly and QC.

Fenceless” is easy to remember; shop-floor incidents rarely appear in brochures. Risk assessment answers who can meet what, at what energy, how often, and how the system stops when measures fail. Put those four questions in the kickoff notes—more useful than arguing whether something “is collaborative.

Collaborative ≠ inherently safe

“Collaborative” names a design intent and function set that can allow shared space. It is not a waiver for the cell. Sharp parts, grip force, drops, spinning tools, heat, and cable snags can outrank the arm body as hazards. Draw the boundary to heaviest part + tool + adapter TCP, max credible speed, and places people can stand.

Three common misreads: treating brochure “force limiting” as a cell certificate; treating slow teach motion as proof the automatic mode is safe; treating “a person may stand beside” as “a person may reach in anytime.” All three fail in week one of production.

What datasheet EV1.4 can verify (no invented force newtons)

Roooll functional-safety design references ISO 10218, ISO 13849, and ISO 15066 (datasheet EV1.4 certification summary). That is a design statement, not “buying the arm certifies the cell,” and not a fenceless certificate. The datasheet does not publish PFL newtons or body-region tables you can paste into a contract—those tests still belong to your contact cases. Do not paste internet numbers as Roooll measurements.

Hardware bounds the datasheet *does* give for an RFQ:

ItemDatasheet EV1.4
Tool I/ODI 2 / DO 2 / AI 1 / AO 1
Tool power24 V / 1.5 A
External cabinet I/ODI 16 / DO 16 / AI 2 / AO 2 / high-speed pulse input 2
Cabinet I/O power24 V / 1.5 A
Standard commsI/O, TCP/IP, Modbus TCP/RTU
Optional fieldbusCC-Link IE Field Basic, Profinet, Ethernet/IP, EtherCAT
Arm ingressMostly IP54, optional IP65; integrated r-Lite · C / r-Core · C are IP54 (no IP65 option)
Cabinet / teach pendant / safety boxIP54 each
Typical TCP speedr-Lite / r-Core: 1 m/s; r-Reach: 1.5 m/s; r-Max 16: 1 m/s; r-Max 20 / r-Ultra: 2 m/s

Tool I/O is only two DI and two DO. If the floor needs grip-seated, vacuum OK, vent done, vision NG, conveyor permit, plus open/close commands, the flange will run out of points—use the cabinet 16/16 or add a module. How to write that gap into the first quote is in Safety & I/O. r-Lite · C and r-Core · C integrate the cabinet into the base; the wiring story is not the same as an external cabinet. TCP speed is a motion spec, not cell cycle time; do not invert 1 m/s into seconds per loop.

Suggested path before go-live (checklist thinking, not a certificate ritual)

Freeze task and modes: what paths run in auto / manual / reduced, and who may enter

Hazard walk: arm + EOAT + part + layout + temporary maintenance postures together

Score: likelihood × severity on your company’s matrix (method can be internal, but consistent)

Pick the collaborative method mix: monitored stop, hand guiding, speed-and-separation, PFL—usually a mix, not one checkbox

Verify: force/pressure or separation checks, e-stop and interlocks, with instruments and conditions logged

Documents and change control: changeover triggers enter process discipline

Skip 5–6 and you mostly have meeting minutes.

Whole-cell scope checklist (tick first)

In this assessment?ItemNotes
□Arm, controller, teach pendantIncluding safety-function firmware version
□EOAT (gripper / vacuum / weld / sand)Grip force, sharp edges, rotating parts
□Parts and traysDrop radius, sharp, hot
□Base, table, sliding railAnchoring and tip-over
□Conveyor / door / machine interfacesInterlock logic
□Walk and operator positionsIncluding temporary maintenance postures
□Speeds and modesManual, automatic, reduced

Most often missed: temporary maintenance postures and full-load drop radius. If you only photograph the normal stance, tool-change and chip-clear put people where you never assessed.

Four collaborative methods (high-level, for division of labor)

Standards discussions often name four methods (use the standard’s names; this is only a floor reminder): safety-rated monitored stop, hand guiding, speed and separation monitoring, power and force limiting (PFL). Most “fenceless” marketing leans on PFL, but real cells mix: slow on approach, force-limit on contact, doors still interlocked. Ask which combination is claimed, then how it will be verified.

Common claimAsk next
“PFL everywhere”Are max speed, heaviest part, and sharpest edge inside the verified case?
“Slow only when close”What is the degraded mode if the area sensor fails?
“Hand guiding”Is automatic mode assessed separately—do not conflate
“Door interlock + collaborative inside”Is motion-forbidden-when-open written clearly?

Hazard ID (floor list)

Crush and shear: arm vs table, fingers vs fixture, door vs arm

Impact: high-speed points toward elbow/head stand zones

Grip and puncture: fingertip force, vacuum fail then whip

Drop: full-load landing radius and bounce

Process: weld fume/arc, sanding dust, hot plastic

Electrical / pneumatic: e-stop loop, valve fail state

Misuse: teach without speed limit, bypassed interlocks

Walk the worst credible case: heaviest part, fastest credible speed, worst grip, newcomer stance. Empty-arm slow motion is not an assessment.

Power and force limiting: mindset, not a fake body-region table

PFL’s idea: for reasonably foreseeable contact, keep force and pressure inside guidance values, with speed, shape, padding, and stop strategy together. Body-region guidance lives in the standard’s tables—do not paste internet numbers as “Roooll measured” or “plant verified.” Verification belongs to a method-competent integrator/safety engineer for your contact cases, with instruments and conditions on record. Sharp tools void “force-limited arm” marketing: limiting is about the contact energy path, not a magic shield.

A verification record should answer at least: which contact type (quasi-static / transient), which tool/part pose, what speed, how many repeats, what happens on fail. If those five are missing, purchasing should bounce “force tested” claims.

Hierarchy of measures (think in order)

Eliminate: remove needless sharp tooling or hazardous paths

Substitute: fixture presentation so people enter less

Engineering: speed/force limits, light curtains / scanners, interlocked doors

Administrative: lockout, permits, training

PPE: residual only—not the sole measure

The common inversion is gloves and warning signs first, speed limits later. Upside-down hierarchy makes residual-risk text hard to defend.

Document deliverables (gate before go-live)

DeliverableWhyIf missing
Hazard and risk matrixProves ID happenedNo evidence in a dispute
Measures and residual riskProves more than marketingFenceless on talk alone
Verification (force/pressure or separation)Proves functions work as designedFake parameters found in week one
Layout and people zonesShift handoffAd-hoc standing
Change-control tableChangeover re-opens assessmentNew gripper, old file
Operate and clear-jam stepsReduces bypass temptationNight shift bypasses interlocks

Changeover and re-assessment triggers

Open a re-assessment by default—not “close enough”—when any of these happen: EOAT swap or big grip-force change; part mass/CoG shift; TCP speed or path into a new people zone; add sanding/welding process hazards; move the base or rail stroke. High-mix lines need “recipe change → safety change” in process discipline.

Example: palletizing from 8 kg cartons to 15 kg, or a flat sanding disc to a sharp profile wheel—even if the arm is unchanged, the assessed object changed.

Division of labor with the purchase guide

This page is go-live checklist thinking; which I/O, devices, and assessment person-days belong in the first quote sits in Safety & I/O. People-zone layout: Workcell layout. EOAT geometry into the assessment: End-effector. Model shortlist via Comparison / Product Advisor—passing payload shortlist is not passing safety assessment.

FAQ

Does buying a cobot mean fenceless?
Not necessarily. It depends on whole-cell risk and verification; some cells still need local fencing or zones.
Is ISO/TS 15066 a certificate?
No. It is a guidance framework; compliance argument stays with the project parties. Roooll pages do not replace the full standard.
Is force limiting absolutely safe for people?
No. Sharp edges, grip, drops, and high-speed impact can still injure. Datasheet EV1.4 also does not publish newtons you can paste into a contract.
Who signs for production release?
Follow your company roles and local rules; at least assessor, verification record, and a production release gate—titles vary.
Do software updates need re-test?
If safety functions, speed/force parameters, or interlock logic change, put them under change control and decide on re-test.
Is paperwork-only assessment enough?
Paper ID is required; paper without verification records usually cannot support fenceless production release.

Next steps

Purchase scope: Safety & I/O

People zones: Workcell layout

Layout sketch / tool photos / people-zone clip: Contact us

Share article

New possibilities for your next cobot deployment.

Explore new ways to move your decision forward—with clarity, confidence, and less second-guessing. You don't need every detail settled before you loop in procurement or engineering. When the guides have pointed the way, the paths below help you take the next step together.