Safety
A 40 kg robot with a 48 V battery and 120 N·m joints can break bones, crush fingers and start a fire. This page puts numbers on those hazards and walks through the layers that are meant to stop each fault, so you can see what each layer is for and what happens when one is missing.
The idea in one picture
Section titled “The idea in one picture”A car keeps you safe with several things at once: brakes, a seatbelt, airbags, crumple zones. None is perfect, but a crash has to get past all of them to hurt you. Robot safety works the same way, and it is called defence in depth. This page asks two questions: how much harm can Marvin Bot do, in numbers; and which layer stops each kind of fault.
Three kinds of energy make a humanoid dangerous: potential energy (40 kg with its centre of mass about 0.8 m up: m g h ≈ 41 × 9.81 × 0.8 ≈ 320 J, released in a fall), kinetic energy and force from the actuators (a 120 N·m knee squeezes a finger 5 cm from its axis with 120 / 0.05 = 2,400 N), and chemical energy in the battery (630 Wh is 2.3 MJ, 2.3 million joules, released as heat if cells go into thermal runaway, a self-feeding overheating). No single measure covers all three, so safety comes in layers: each catches some faults, and the layers behind it catch what it misses.
Playground 1: hazard energy explorer
Section titled “Playground 1: hazard energy explorer”How hard can a robot hit before it hurts? The best published numbers come from ISO/TS 15066, a technical specification for collaborative robots (cobots: industrial robot arms designed to work beside people). It lists, for each part of the body, the force at which pressing or bumping starts to hurt. We borrow those numbers as a yardstick.
Start here: pick a preset and compare the top bar and the Estimated peak force readout with the limits: red means above the body region’s threshold, green below it. Then choose your own scenario and body region. The model treats the contact as two masses meeting through a spring (the body region’s stiffness), the model ISO/TS 15066 uses for transient contact.[1][2]
From first principles
Section titled “From first principles”Energy, speed and force
Section titled “Energy, speed and force”fall: v = √(2 g h) E = m g h
swing: v = ω r J = m L² / 3 (uniform rod about one end) mR = J / r²
contact: μ = (1/mH + 1/mR)⁻¹ Fpeak = v √(μ k) Emax = Fmax² / (2k)
pinch: F = τ / r
- v: contact speed (m/s); g = 9.81 m/s²; h: drop height (m); ω: joint speed (rad/s); r: distance from the joint to the contact (m).
- J: the limb’s moment of inertia about the joint (kg·m²). mR: the robot’s effective mass at the contact: how heavy the limb “feels” at that point. A long arm swung from the shoulder feels about a third of its mass at the fingertip.
- mH, k: the body region’s effective mass and stiffness (how many newtons it takes to squash it by a millimetre) from ISO/TS 15066 (for example chest 40 kg and 25 N/mm; hand 0.6 kg and 75 N/mm).[2] μ: the reduced mass of the two-body collision (a combined mass, always smaller than the lighter of the two).
- The force formula comes from energy: the relative kinetic energy ½μv² is stored in the spring as ½kx², and F = kx. ISO/TS 15066 uses the same relation, solved for speed, to set the highest permitted relative speed vmax = Fmax / √(μk).[1][2]
What the thresholds mean. ISO/TS 15066 lists, for each body region, a maximum quasi-static force (the body is clamped and pressed) and allows transient contact (a brief impact where the body can move away) at higher values, commonly applied as twice the quasi-static figure, except for the skull, forehead and face, where no factor is applied.[1][12] The figures used here come from a published reproduction of the standard’s tables, not from the standard’s own text.
These values come from studies of the onset of pain in adult volunteers, for industrial robots working beside trained workers; they are not injury thresholds and they do not cover falls. The playground uses them only to give a sense of scale: almost every Marvin Bot scenario exceeds them by a wide margin, which is the point. The robot is not a collaborative robot, and people must stay out of its reach while it is powered.
Fire. A lithium-ion cell that is overcharged, shorted, crushed or overheated can enter thermal runaway: it heats itself, vents flammable gas and can ignite its neighbours.[9] The BMS, the Class-T fuse and the charging rules are there to keep cells far from those conditions; once a pack is burning, getting people away is the response, not fighting it.
Playground 2: e-stop chain and fault tree
Section titled “Playground 2: e-stop chain and fault tree”Now the layers themselves. A watchdog is a timer that must be reset regularly by the control program; if the program freezes and stops resetting it, the watchdog cuts motor power. A gantry is an overhead frame with a harness that catches the robot if it falls during testing.
Start here: choose a fault. The diagram shows each safety layer in the order it would act; a layer either does not see this kind of fault (faded), catches it (green), or has been removed by you (struck through). Remove layers to see what the next one down must do, and what state the robot ends in.
Stop categories
Section titled “Stop categories”IEC 60204-1, the standard for the electrical equipment of machines, names three ways to stop a machine:[4][5]
- Category 0: remove power from the actuators at once (an uncontrolled stop).
- Category 1: a controlled stop with power still available, then remove power once stopped.
- Category 2: a controlled stop that leaves power on.
For a walking robot the choice is not obvious: cutting power (category 0) makes it fall, while a controlled stop (category 1) needs a working controller. Marvin Bot’s design uses both: software faults lead to damping or sitting down, then cutting power; the hardware e-stop and watchdog cut power immediately, and the gantry catches the robot in early testing.
ISO 13850 covers the design of the e-stop function itself (a latching red actuator on a yellow background, category 0 or 1, reset only by deliberate action).[3]
How Marvin Bot does it
Section titled “How Marvin Bot does it”Testing practice (from docs/safety.md)
Section titled “Testing practice (from docs/safety.md)”- First actuator tests with the actuator or limb clamped to the bench, hands out of its range whenever the driver is enabled; low torque limits and gains first, raised only after the motion is checked. The CAN driver is untested: check every command at low limits.
- Test the e-stop before each session. Lift the robot with two people or a hoist.
- All early standing and walking on a gantry with a harness that catches the robot before its knees touch the floor; free walking only after phase 4’s gantry tests, in a clear area with padding and nobody within 2 m.
- One person operates; one person holds the e-stop and does nothing else.
- Policies run first in simulation (Isaac Lab and the MuJoCo cross-check) with the same limits, rates and latency as the robot.
Battery handling
Section titled “Battery handling”- Charge on a non-flammable surface, attended, at 4.1 V per cell for everyday use (4.2 V only when range is needed). Lower charge voltage also slows ageing.[10]
- Store at about half charge in a fire-resistant container away from exits.
docs/safety.mdsays about 50%; Battery University suggests about 40% for storage.[11] - Do not use a pack that is swollen, damaged, or has been in a hard fall until it has been inspected.
- If a pack swells, smokes or hisses: cut power only if that is safe, move away, keep others out and call emergency services. A lithium-ion fire cannot be put out reliably with a small extinguisher.
- The BMS reports to the computer, and the robot sits down and cuts actuator power at about 15% charge.
Standards worth reading (and what they do not say)
Section titled “Standards worth reading (and what they do not say)”| Standard | What it covers | Relevance to Marvin Bot |
|---|---|---|
| ISO 13850:2015[3] | design principles of the emergency stop function | directly useful for the e-stop button, latching and reset |
| IEC 60204-1:2016[4] | electrical equipment of machines; stop categories 0, 1, 2 | vocabulary for stops; much of it is for mains-powered machinery |
| ISO 10218-1 and -2 (2025 editions)[6] | safety of industrial robots and their applications | a reference for safety functions; scope is industrial robots, not humanoids among the public |
| ISO/TS 15066:2016[1] | collaborative industrial robots; body-region force and pressure thresholds | source of the thresholds in Playground 1; written for fixed-base cobots |
| ISO 13482:2014[7] | safety of personal care robots, including mobile and person-carrier robots | closer to a robot moving among people than the industrial standards |
| IEC 62133-2:2017[8] | safety requirements and tests for portable lithium cells and batteries | what to look for on cells and packs you buy; a self-built pack is untested |
Standards for legged and humanoid robots working near people are still being developed; check the current state with ISO’s robotics committee (TC 299) before relying on any of the above. Reading these documents helps you think about hazards in a structured way. It does not make a robot compliant, and a self-built research robot will not be.
Trade-offs and alternatives
Section titled “Trade-offs and alternatives”| Choice | For | Against |
|---|---|---|
| E-stop opens a contactor; computer stays up (chosen) | logs and state survive; restart is quick | the robot falls when actuator power goes: needs the gantry and padding |
| E-stop cuts everything | simplest; nothing stays energised | every stop reboots the computer; the cause of the stop may be lost |
| E-stop commands damping first (category 1) | softer fall | depends on a working controller and CAN; must still be backed by a category 0 cut |
| Watchdog relay in hardware (chosen) | catches a hung controller without relying on it | needs a heartbeat output and tuning of its timeout |
| Software watchdog only | no extra part | cannot act if the process or computer that runs it has hung |
Decisions you can make here
Section titled “Decisions you can make here”- Software torque and speed limits for each test phase. Trade: low limits make early tests gentler (Playground 1 shows the speed at which an arm reaches a body-region threshold), but too low and the robot cannot stand or catch itself, so limits rise phase by phase.
- Watchdog and command timeout values (to be set on the bench). Trade: a short timeout cuts power sooner after a hang, but a normal hiccup in timing may trip it and drop the robot.
- Stop behaviour: what a software fault does (hold, damp, sit, cut), and in which order. Trade: a controlled stop falls more softly but relies on working software; an immediate cut always works but the robot drops.
- Padding, clear area and leaving the gantry. Trade: more padding and a bigger clear area cost mass and space; leaving the gantry early speeds up testing but removes the one layer that stops falls.
- Battery charging and storage routine. Trade: charging to 4.1 V and storing partly charged cost a little range and convenience, for a slower-ageing and safer pack.
Built from your settings above. Paste it into an issue, a design discussion or an AI assistant session.
Next: 13 The robot description starts the simulation stage: the single set of files that describes the robot’s joints, limits and masses, from which the simulators and the limits on this page are built.
Further reading
Section titled “Further reading”- Ghanbarzadeh and Najafi, Safe physical human-robot interaction through variable impedance control based on ISO/TS 15066: a readable account of the body model, the speed limit formula and effective mass.
- Machinery Safety 101, emergency stop series: practical explanations of ISO 13850 and IEC 60204-1 stop categories.
- Battery University, BU-304a: Safety concerns with Li-ion: thermal runaway and what protection circuits do.
- 09 Power and battery: the fuse, precharge, contactor and keep-alive path that the e-stop acts on.
Sources
Section titled “Sources”- ISO/TS 15066:2016 Robots and robotic devices: Collaborative robots (catalogue page; standard text not reviewed) — used for: body-region force thresholds, transient vs quasi-static contact, the speed-limit model.
- A. Ghanbarzadeh, E. Najafi, Safe physical human-robot interaction through variable impedance control based on ISO/TS 15066, arXiv:2311.13814, 2023 — used for: table of ISO/TS 15066 maximum permissible force, effective spring constant and effective mass per body region; vmax = F/√(μk); reduced mass.
- ISO 13850:2015 Safety of machinery: Emergency stop function, principles for design (catalogue page) — used for: what the e-stop standard covers.
- IEC 60204-1:2016 Safety of machinery: Electrical equipment of machines (catalogue page) — used for: stop categories 0, 1 and 2.
- Machinery Safety 101, Emergency stop series — used for: plain-language definitions of the stop categories and the e-stop function.
- ISO 10218-1:2025 Robotics: Safety requirements, Part 1: Industrial robots (catalogue page) — used for: scope of the industrial robot safety standard.
- ISO 13482:2014 Robots and robotic devices: Safety requirements for personal care robots (catalogue page) — used for: existence and scope of a personal-care robot standard.
- IEC 62133-2:2017 Safety requirements for portable sealed secondary lithium cells and batteries (catalogue page) — used for: the battery safety standard to look for on bought cells.
- Battery University, BU-304a Safety concerns with Li-ion — used for: thermal runaway causes.
- Battery University, BU-808 How to prolong lithium-based batteries — used for: lower charge voltage extends cycle life.
- Battery University, BU-702 How to store batteries — used for: storage at about 40% state of charge.
- R. Zanella, F. Califano, S. Stramigioli, Physical human-robot interaction: a critical review of safety constraints, arXiv:2601.19462, 2026 — used for: transient limits taken as twice the quasi-static values except for the skull, forehead and face (no factor).