Quick answer
A cobot is not “safe because you bought it”: the object of safety is the whole cell—arm, EOAT, part, speed, layout, and walk paths
Before go-live deliverables: hazard ID, risk assessment, measures, residual risk, verification records; fenceless claims especially cannot pass on talk alone
ISO/TS 15066: guidance frame for force/pressure and separation in collaborative applications; cells beside people often also reference ISO 10218 / ISO/TS 15066—Roooll does not replace the full texts or issue a “compliance certificate”
Changeover can force re-assessment: new gripper, mass, path, or people zone can void the old file
Align purchase scope: Safety & I/O
Fenceless” is easy to remember; shop-floor incidents rarely appear in brochures. Risk assessment answers who can meet what, at what energy, how often, and how the system stops when measures fail. Put those four questions in the kickoff notes—more useful than arguing whether something “is collaborative.
Collaborative ≠ inherently safe
“Collaborative” names a design intent and function set that can allow shared space. It is not a waiver for the cell. Sharp parts, grip force, drops, spinning tools, heat, and cable snags can outrank the arm body as hazards. Draw the boundary to heaviest part + tool + adapter TCP, max credible speed, and places people can stand.
Three common misreads: treating brochure “force limiting” as a cell certificate; treating slow teach motion as proof the automatic mode is safe; treating “a person may stand beside” as “a person may reach in anytime.” All three fail in week one of production.
Suggested path before go-live (checklist thinking, not a certificate ritual)
Freeze task and modes: what paths run in auto / manual / reduced, and who may enter
Hazard walk: arm + EOAT + part + layout + temporary maintenance postures together
Score: likelihood × severity on your company’s matrix (method can be internal, but consistent)
Pick the collaborative method mix: monitored stop, hand guiding, speed-and-separation, PFL—usually a mix, not one checkbox
Verify: force/pressure or separation checks, e-stop and interlocks, with instruments and conditions logged
Documents and change control: changeover triggers enter process discipline
Skip 5–6 and you mostly have meeting minutes.
Whole-cell scope checklist (tick first)
| In this assessment? | Item | Notes |
|---|---|---|
| □ | Arm, controller, teach pendant | Including safety-function firmware version |
| □ | EOAT (gripper / vacuum / weld / sand) | Grip force, sharp edges, rotating parts |
| □ | Parts and trays | Drop radius, sharp, hot |
| □ | Base, table, sliding rail | Anchoring and tip-over |
| □ | Conveyor / door / machine interfaces | Interlock logic |
| □ | Walk and operator positions | Including temporary maintenance postures |
| □ | Speeds and modes | Manual, automatic, reduced |
Most often missed: temporary maintenance postures and full-load drop radius. If you only photograph the normal stance, tool-change and chip-clear put people where you never assessed.
Four collaborative methods (high-level, for division of labor)
Standards discussions often name four methods (use the standard’s names; this is only a floor reminder): safety-rated monitored stop, hand guiding, speed and separation monitoring, power and force limiting (PFL). Most “fenceless” marketing leans on PFL, but real cells mix: slow on approach, force-limit on contact, doors still interlocked. Ask which combination is claimed, then how it will be verified.
| Common claim | Ask next |
|---|---|
| “PFL everywhere” | Are max speed, heaviest part, and sharpest edge inside the verified case? |
| “Slow only when close” | What is the degraded mode if the area sensor fails? |
| “Hand guiding” | Is automatic mode assessed separately—do not conflate |
| “Door interlock + collaborative inside” | Is motion-forbidden-when-open written clearly? |
Hazard ID (floor list)
Crush and shear: arm vs table, fingers vs fixture, door vs arm
Impact: high-speed points toward elbow/head stand zones
Grip and puncture: fingertip force, vacuum fail then whip
Drop: full-load landing radius and bounce
Process: weld fume/arc, sanding dust, hot plastic
Electrical / pneumatic: e-stop loop, valve fail state
Misuse: teach without speed limit, bypassed interlocks
Walk the worst credible case: heaviest part, fastest credible speed, worst grip, newcomer stance. Empty-arm slow motion is not an assessment.
Power and force limiting: mindset, not a fake body-region table
PFL’s idea: for reasonably foreseeable contact, keep force and pressure inside guidance values, with speed, shape, padding, and stop strategy together. Body-region guidance lives in the standard’s tables—do not paste internet numbers as “Roooll measured” or “plant verified.” Verification belongs to a method-competent integrator/safety engineer for your contact cases, with instruments and conditions on record. Sharp tools void “force-limited arm” marketing: limiting is about the contact energy path, not a magic shield.
A verification record should answer at least: which contact type (quasi-static / transient), which tool/part pose, what speed, how many repeats, what happens on fail. If those five are missing, purchasing should bounce “force tested” claims.
Hierarchy of measures (think in order)
Eliminate: remove needless sharp tooling or hazardous paths
Substitute: fixture presentation so people enter less
Engineering: speed/force limits, light curtains / scanners, interlocked doors
Administrative: lockout, permits, training
PPE: residual only—not the sole measure
The common inversion is gloves and warning signs first, speed limits later. Upside-down hierarchy makes residual-risk text hard to defend.
Document deliverables (gate before go-live)
| Deliverable | Why | If missing |
|---|---|---|
| Hazard and risk matrix | Proves ID happened | No evidence in a dispute |
| Measures and residual risk | Proves more than marketing | Fenceless on talk alone |
| Verification (force/pressure or separation) | Proves functions work as designed | Fake parameters found in week one |
| Layout and people zones | Shift handoff | Ad-hoc standing |
| Change-control table | Changeover re-opens assessment | New gripper, old file |
| Operate and clear-jam steps | Reduces bypass temptation | Night shift bypasses interlocks |
Changeover and re-assessment triggers
Open a re-assessment by default—not “close enough”—when any of these happen: EOAT swap or big grip-force change; part mass/CoG shift; TCP speed or path into a new people zone; add sanding/welding process hazards; move the base or rail stroke. High-mix lines need “recipe change → safety change” in process discipline.
Example: palletizing from 8 kg cartons to 15 kg, or a flat sanding disc to a sharp profile wheel—even if the arm is unchanged, the assessed object changed.
Division of labor with the purchase guide
This page is go-live checklist thinking; which I/O, devices, and assessment person-days belong in the first quote sits in Safety & I/O. People-zone layout: Workcell layout. EOAT geometry into the assessment: End-effector. Model shortlist via Comparison / Product Advisor—passing payload shortlist is not passing safety assessment.
