Speed and Separation Monitoring (SSM)

The Protective Separation Distance (PSD) is the minimum dynamic distance that must be maintained between a robot and a human to allow the robot to stop safely before contact occurs. It is not a fixed barrier but a constantly calculated value based on:

• Robot stopping distance: A function of its current speed, deceleration capability, and system response time.
• Human intrusion speed: The maximum anticipated speed of a human moving towards the hazard zone (typically assumed to be 1.6 m/s or 2.0 m/s per ISO/TS 15066).
• Sensor uncertainty: The positional error or latency of the perception system.

The PSD is continuously recalculated. If the measured distance falls below the PSD, the system triggers a protective stop.

This is the sensory foundation of SSM, responsible for detecting and tracking humans within the collaborative workspace. It typically employs a fusion of technologies to create a real-time volumetric model:

• Safety-rated laser scanners (2D/3D LIDAR): Often used to create protective fields or light curtains at floor level.
• Time-of-Flight (ToF) or structured light 3D cameras: Provide dense point clouds for full-body tracking.
• Depth-sensing RGB-D cameras: Combine color and depth for enhanced human pose estimation.

Key requirements include high update rates (>30 Hz), low latency, and functional safety certification (e.g., PL d/SIL 2) to ensure reliable human detection under varying lighting and occlusion conditions.

The core control loop of SSM dynamically modulates the robot's speed based on the real-time separation distance. It is not a simple on/off switch but a continuous scaling function:

• Speed is inversely proportional to distance: As a human approaches, the robot slows down.
• Multiple speed zones: The workspace is often divided into zones (e.g., warning, reduced speed, stop) with corresponding maximum velocity limits.
• Safe-rated motion controller: This supervisory function must be executed on a safety-certified PLC or motion controller that can override the robot's standard operating speed. The control signal is part of a safety-rated communication protocol like PROFIsafe or CIP Safety.

SSM cannot be implemented with standard industrial PCs alone. It requires a dedicated safety hardware architecture to meet performance levels (PL) per ISO 13849. This includes:

• Safety PLC or Safety Controller: Executes the PSD calculation and speed supervision logic with guaranteed deterministic timing.
• Safe Torque Off (STO) & Safe Stop (SS1/SS2) circuits: Physically interrupt motor power or initiate controlled stops.
• Safety-rated I/O modules: For connecting emergency stops and enabling devices.
• Redundant or diverse sensor channels: To detect and manage single faults within the perception system without compromising safety. This hardware ensures functional safety, meaning the system reliably performs its safety function even in the event of a foreseeable fault.

SSM systems define specific monitored volumes within the robot cell. These are not merely physical fences but dynamically active sensing regions:

• Collaborative workspace: The volume where the robot and human are intended to work simultaneously. Full SSM is active here.
• Warning zones: Outer perimeters where human detection triggers a speed reduction or auditory warning.
• Protective stop zones: The inner volume where intrusion triggers an immediate, safe stop.
• Robot-restricted zones: Volumes where the robot is prohibited from entering while a human is present, often defined via 3D camera-based volume monitoring. Zone configuration is critical for task efficiency and is performed during the risk assessment.

Before deployment, a comprehensive risk assessment specific to SSM is mandatory per ISO 12100 and ISO/TS 15066. This process determines the required Performance Level (PL) and validates all assumptions:

• Hazard identification: Pinpointing all potential contact scenarios (e.g., pinch points, impact with end-effector).
• Determination of PSD parameters: Justifying the chosen human intrusion speed, robot deceleration, and total system response time (including sensor latency and controller cycle time).
• Validation testing: Physically verifying that the robot stops before contact under worst-case conditions using test tools like the ISO/TS 15066 force/pressure measurement apparatus. Documentation of this process is a legal requirement for compliance.

The core challenge is accurately tracking human position and velocity in real-time to calculate the protective separation distance. This involves:

• Sensor fusion from 3D cameras, LiDAR, and depth sensors to create a reliable volumetric model of the human.
• Predicting future human motion using algorithms for human motion forecasting to anticipate where the person will be, not just where they are. A prediction error of even 200ms can be the difference between a safe stop and a hazardous contact.
• Handling occlusions when the human is partially hidden by machinery, which requires probabilistic estimation of their likely position.

The protective separation distance (PSD) is not a fixed value but a dynamic calculation defined by standards like ISO/TS 15066. It must account for:

• Robot stopping distance: A function of its current speed, inertia, and brake performance.
• Human intrusion speed: The maximum expected speed of a person moving into the workspace (often assumed to be 1.6 m/s or walking speed).
• System latency: The total delay from sensor measurement to robot actuator response. The formula is: PSD = (Robot Reaction Time + Robot Stopping Time) * (Robot Speed + Human Speed) + Intrusion Distance. Miscalculating any variable compromises safety.

The robot must execute speed scaling and emergency stops with extreme reliability and precision. Key engineering hurdles include:

• Deterministic real-time control loops that guarantee a maximum response time (e.g., <10ms) to a safety-rated sensor input.
• Smooth, jerk-limited deceleration to avoid damaging the robot's payload or causing instability.
• Torque monitoring at the joint level to detect and react to unexpected collisions even before the separation distance is breached, acting as a complementary safety layer to SSM.

SSM requires continuous volumetric monitoring of the entire collaborative workspace. Implementation challenges are:

• Defining dynamic safety zones that can change based on the robot's task. For example, the separation distance may be larger when the robot is moving a heavy payload.
• Differentiating between humans and inanimate objects to avoid unnecessary stops when a non-hazardous object enters the zone.
• Multi-human tracking, where the system must monitor several people simultaneously and calculate the PSD for the closest individual, significantly increasing computational load.

Not all sensors are suitable for SSM. The implementation must use Safety-Rated Laser Scanners (SRLS) or vision systems certified to Performance Level d (PLd) or Category 3 according to ISO 13849. Challenges include:

• Sensor placement to eliminate blind spots while avoiding accidental triggering.
• Environmental robustness: Sensors must perform reliably in variable lighting, with reflective surfaces, dust, or steam present.
• Redundancy and diagnostic coverage to ensure a single sensor failure does not lead to a loss of the safety function, often requiring dual-channel monitoring systems.

Proving an SSM system is safe requires exhaustive risk assessment and validation testing that is more complex than for static safeguards. This involves:

• Worst-case scenario testing with humans moving at maximum intrusion speed from blind spots.
• Quantitative measurement of system latency and stopping distance under all payload and speed conditions.
• Documented verification that the implemented system meets the calculated protective separation distance in every possible robot state, a process that is critical for regulatory compliance but time-consuming and costly.

Power and Force Limiting (PFL) is a collaborative robot safety mode designed for applications where brief, incidental contact is permissible. The robot's inherent mechanical design or control software actively limits the kinetic energy and force of its movements to biologically safe thresholds, as defined in standards like ISO/TS 15066. This enables safe physical collaboration, such as hand-guiding or co-manipulation of objects.

• Key Mechanism: Uses torque sensors in joints or current monitoring in motors to cap output force.
• Contrast with SSM: While SSM prevents contact by maintaining distance, PFL assumes contact may occur and ensures it is not injurious.
• Application: Ideal for assembly tasks where the robot and human work directly on the same component.

ISO/TS 15066 is the pivotal international technical specification providing safety requirements and guidance for collaborative robot systems. It operationalizes the four collaborative modes defined in ISO 10218-1/2, including SSM and PFL. The standard provides the scientific basis for safety, including:

• Pain Threshold Data: Publishes biomechanical limits for transient and quasi-static contact on 29 body regions.
• SSM Formulas: Defines the protective separation distance calculation, which sums robot stopping distance, human intrusion distance, and a safety buffer.
• Validation Protocols: Specifies methods for measuring and verifying speed, force, and pressure in collaborative applications.

A Collaborative Robot (Cobot) is a robot designed from the ground up to operate safely in a shared workspace with humans, without the need for traditional fixed safety cages. Key design features enable this, including:

• Inherently Safe Design: Rounded edges, minimized pinch points, and back-drivable, force-limited joints.
• Sensor Integration: Equipped with vision systems, lidar, or skin-like tactile sensors for environmental awareness.
• Safety-Rated Control: Implements certified safety functions like SSM and PFL directly in the robot controller.

Cobots are distinct from traditional industrial robots retrofitted with external sensors for collaboration; safety is a core architectural principle.

Human Motion Forecasting is the machine learning task of predicting a human's future trajectory or body pose sequence based on observed past motion. This capability is critical for advanced SSM systems to move beyond reactive stopping and enable predictive speed control.

• Input: A time-series of skeletal keypoints from a pose estimation system.
• Output: Predicted future positions over a short time horizon (e.g., 1-3 seconds).
• Model Types: Often uses recurrent neural networks (RNNs), temporal convolutional networks (TCNs), or graph neural networks (GNNs) to model skeletal dynamics.

By anticipating where a human will be, the robot can proactively slow down or alter its path earlier, maintaining smoother, more efficient operation while preserving safety.

Safety-Rated Monitored Stop is a collaborative operating mode where the robot comes to a complete, verified stop when a human enters a predefined collaborative workspace. It is one of the four core collaborative modes defined in robot safety standards (ISO 10218).

• Mechanism: Upon intrusion detection (e.g., via a light curtain or area scanner), the robot controller executes a safe stop and monitors that zero motion is maintained.
• Restart: Work can only resume after the human has left the zone and a manual restart is initiated.
• Comparison to SSM: This is a simpler, binary stop/go protocol. SSM is more advanced, allowing continuous operation at a speed modulated by the separation distance.

The Protective Separation Distance (Sp) is the dynamic safety zone that an SSM system actively maintains between a robot and a human. It is not a fixed parameter but is calculated in real-time according to the formula in ISO/TS 15066: Sp = S + C + Zd + Zr.

• S (Stopping Distance): Distance the robot travels after a stop signal is issued.
• C (Intrusion Distance): Distance a human can move toward the robot before protective measures activate.
• Zd & Zr (Positional Uncertainties): Buffers accounting for measurement errors in the human and robot tracking systems.

The robot's speed is continuously adjusted so that it can always stop before Sp reaches zero, guaranteeing no contact.