Robots and robotic devices Safety requirements for nonindustrial robots Non-medical personal care robot

Transcription

1 DRAFT INTERNATIONAL STANDARD ISO/DIS ISO/TC 184/SC 2 Secretariat: SIS Voting begins on Voting terminates on INTERNATIONAL ORGANIZATION FOR STANDARDIZATION МЕЖДУНАРОДНАЯ ОРГАНИЗАЦИЯ ПО СТАНДАРТИЗАЦИИ ORGANISATION INTERNATIONALE DE NORMALISATION Robots and robotic devices Safety requirements for nonindustrial robots Non-medical personal care robot Robots et composants robotiques Exigences de sécurité Robots non médicaux pour les soins personnels ICS ISO/CEN PARALLEL PROCESSING This draft has been developed within the International Organization for Standardization (ISO), and processed under the ISO-lead mode of collaboration as defined in the Vienna Agreement. This draft is hereby submitted to the ISO member bodies and to the CEN member bodies for a parallel five-month enquiry. Should this draft be accepted, a final draft, established on the basis of comments received, will be submitted to a parallel two-month approval vote in ISO and formal vote in CEN. To expedite distribution, this document is circulated as received from the committee secretariat. ISO Central Secretariat work of editing and text composition will be undertaken at publication stage. Pour accélérer la distribution, le présent document est distribué tel qu'il est parvenu du secrétariat du comité. Le travail de rédaction et de composition de texte sera effectué au Secrétariat central de l'iso au stade de publication. THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH. IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME STANDARDS TO WHICH REFERENCE MAY BE MADE IN NATIONAL REGULATIONS. RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION. International Organization for Standardization, 2011

2 Copyright notice This ISO document is a Draft International Standard and is copyright-protected by ISO. Except as permitted under the applicable laws of the user s country, neither this ISO draft nor any extract from it may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, photocopying, recording or otherwise, without prior written permission being secured. Requests for permission to reproduce should be addressed to either ISO at the address below or ISO s member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel Fax copyright@iso.org Web Reproduction may be subject to royalty payments or a licensing agreement. Violators may be prosecuted. ii ISO 2011 All rights reserved

3 Contents Page Foreword...iv Introduction...v 1 Scope Normative references Terms and definitions Risk assessment General Hazard identification Risk evaluation Safety requirements and/or protective measures General Hazards related to charging battery Energy storage and supply Hazards due to robot shape Emissions Electromagnetic interference Stress, posture and usage hazards Hazards due to robot motion Insufficient durability Incorrect autonomous actions Contact with moving components Safety-related control system requirements General Robot stopping Software-controlled limits to the robot workspace Singularity protection Speed restriction and safety-related speed control Safety-related environmental sensing Force restriction and safety-related force control Actuating controls Command devices Verification and validation Information for use General Instruction handbook Marking...47 Annex A (informative) List of significant hazards for personal care robots...48 Annex B (informative) Safety criteria for personal care robots...56 Annex C (informative) Examples of functional tasks for personal care robots...57 Annex D (informative) Risk assessment examples for personal care robots...60 Annex E (informative) Equivalent validation methods...83 Bibliography...85 ISO 2011 All rights reserved iii

4 Foreword ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. ISO was prepared by Technical Committee ISO/TC 184, Automation systems and integration, Subcommittee SC 2, Robots and robotic devices. This International Standard is complementary and in addition to ISO :2006 which covers the robot in industrial environments only. This new International Standard includes additional information in line with the ISO standard and adopts the approach proposed in the ISO and IEC standards to formulate a safety standard for robots and robotic devices in personal care to specify the conditions for physical human-robot contact. This International Standard includes five Annexes, all are informative. iv ISO 2011 All rights reserved

5 Introduction This International standard has been created in recognition of the particular hazards presented by newly emerging robots and robotic devices for new applications in non-industrial environments for providing services rather than manufacturing applications in industrial applications. This standard focuses on the safety requirements for personal care robot applications. This document is a type C standard as stated in ISO The machinery concerned and the extent to which hazards, hazardous situations or hazardous events are covered are indicated in the scope of this document. When requirements of this type C standard are different from those which are stated in type A or B standards, the requirements of this type C standard take precedence over the requirements of the other standards for machines that have been designed and built according to the requirements of this type C standard. It is recognised that robots and robotic devices in personal care applications require close human-robot interaction and collaborations as well as physical human-robot contact. The personal care robots have been categorised into non-medical and medical applications. This standard deals with personal care robots in nonmedical applications. Hazards are well recognized and the sources of the hazards are frequently unique to particular robot systems. The number and types of hazards are directly related to the nature of the robot application, the complexity of the installation, and the level of human-robot interaction incorporated. The risks associated with these hazards vary with the type of robot used and its purpose, and the way in which it is installed, programmed, operated, and maintained. Not all of the hazards identified by this International Standard apply to every personal care robot, and nor will the level of risk associated with a given hazardous situation be the same from robot to robot. Consequently, the safety requirements and/or protective measures may vary from what is specified in this International Standard. A risk assessment shall be conducted to determine what the protective measures should be when they do not meet safety requirements and/or protective measures specified in this International Standard and for the particular application being considered. For the purpose of understanding the requirements in this International Standard, a word syntax convention is used to denote absolute requirements from recommended practices or suggested actions. The word shall is used to identify requirements necessary for compliance with the standard. Such requirements will be accomplished unless an alternative instruction is provided or a suitable alternative is determined by a risk assessment process. The word should is used to identify suggestions, recommended actions, or possible solutions for requirements, but alternatives are possible and the suggested actions are not absolute. In recognition of the variable nature of hazards with personal care robot applications, this International Standard provides guidance for the assurance of safety in the design and construction of the non-medical personal care robot as well as the integration, installation and use of the robots during their full life cycle. Since safety in the use of personal care robots is influenced by the design of the particular robot system, a supplementary, though equally important, purpose is to provide guidelines for the Information for use of personal care robots and robotic devices. This International Standard is not applicable to robots for industrial environments, or to robots manufactured prior to its publication date. Providing for a safe personal care robot system requires the cooperation of a variety of stakeholders those corporate entities that share a responsibility for ensuring the safety of the overall robot system. Stakeholders may be identified as being manufacturers, suppliers, integrators, certifiers, and users, and the requirements may be assigned to one of the stakeholders, but overlapping responsibilities can involve multiple stakeholders in the same requirements. While using this International Standard, the reader is cautioned that all of the ISO 2011 All rights reserved v

6 requirements identified may apply to them, even if not specifically addressed by assigned stakeholder tasks. Future revisions of this international standard may include more specific requirements on particular types of personal care robots as well as more complete numeric data for different categories of people (children, elderly persons, pregnant women, etc). vi ISO 2011 All rights reserved

7 DRAFT INTERNATIONAL STANDARD ISO/DIS Robots and robotic devices Safety requirements for nonindustrial robots Non-medical personal care robot 1 Scope This International Standard specifies requirements and guidelines for the inherent safe design, protective measures, and Information for use of personal care robots, as defined in Clause 3.1 and it has a special focus on three types of personal care robots, namely mobile servant robot (as defined in Clause 3.3), physical assistant robot (as defined in Clause 3.4), and person carrier robot (as defined in Clause 3.5). These robots typically perform tasks as exemplified in Annex C. The standard describes hazards associated with the use of these robots, and provides requirements to eliminate, or adequately reduce, the risks associated with these hazards. All the significant hazards are presented in Annex A (List of significant hazards for personal care robots) and this standard describes how they should be dealt with for each personal care robot type. Personal care robotic devices are also covered by this standard and should be treated as personal care robots. Personal care robots may need to adhere to additional standards and regulations where appropriate; for example motor vehicle regulations when person carrier robots are operating on public roads. This International Standard covers human-robot physical contact applications. It is limited to earthbound robots. This International standard does not apply to: Marine robots and flying robots; Industrial robots, which are covered in ISO 10218; Medical applications; Military applications; Public peace applications. The scope of this International Standard is limited primarily to human care related hazards but where appropriate, includes domestic animals or property, when the personal care robot is properly installed and maintained and used for its intended purpose or under conditions which can reasonably be foreseen. 2 Normative references The following referenced standards are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO , Mechanical vibration and shock -- Evaluation of human exposure to whole-body vibration -- Part 1: General requirements ISO 2011 All rights reserved 1

8 ISO , Mechanical vibration and shock -- Evaluation of human exposure to whole-body vibration -- Part 2: Vibration in buildings (1 Hz to 80 Hz) ISO , Mechanical vibration and shock -- Evaluation of human exposure to whole-body vibration -- Part 4: Guidelines for the evaluation of the effects of vibration and rotational motion on passenger and crew comfort in fixed-guideway transport systems ISO , Mechanical vibration and shock -- Evaluation of human exposure to whole-body vibration -- Part 5: Method for evaluation of vibration containing multiple shocks ISO 3746:, Acoustics Determination of sound power levels of noise sources using sound pressure Survey method using an enveloping measurement surface over a reflecting plane ISO , Graphical symbols -- Safety colours and safety signs -- Part 1: Design principles for safety signs and safety markings ISO , Safety devices for protection against excessive pressure Part 1: Safety valves ISO , Safety devices for protection against excessive pressure Part 2: Bursting disc safety devices ISO , Safety devices for protection against excessive pressure Part 3: Safety valves and bursting disc safety devices in combination ISO :, Safety devices for protection against excessive pressure Part 4: Pilot-operated safety valves ISO , Safety devices for protection against excessive pressure Part 5: Controlled safety pressure relief systems ISO , Safety devices for protection against excessive pressure Part 6: Application, selection and installation of bursting disc safety devices ISO , Safety devices for protection against excessive pressure Part 7: Common data ISO , Safety devices for protection against excessive pressure Part 9: Application and installation of safety devices excluding stand-alone bursting disc safety devices ISO 4413, Hydraulic fluid power - General rules and safety requirements for systems and their components ISO 4414, Pneumatic fluid power - General rules and safety requirements for systems and their components ISO 7000, Graphical symbols for use on equipment Index and synopsis ISO 8373, Robots and robotic devices Vocabulary ISO 11202, Acoustics -- Noise emitted by machinery and equipment -- Determination of emission sound pressure levels at a work station and at other specified positions applying approximate environmental corrections ISO 12100, Safety of machinery General principles for design Risk assessment and risk reduction ISO , Safety of machinery Safety-related parts of control systems Part 1: General principles for design ISO 13850, Safety of machinery Emergency stop Principles for design ISO 13855, Safety of machinery Positioning of protective equipment with respect to the approach speeds of parts of the human body 2 ISO 2011 All rights reserved

9 ISO 14119, Safety of machinery Interlocking devices associated with guards Principles for design and selection ISO , Ergonomic design for the safety of machinery Part 2: Principles for determining the dimensions required for access openings IEC , Safety of machinery Electrical equipment of machines Part 1: General requirements IEC , Safety of laser products Part 1: Equipment classification and requirements IEC , Safety of machinery Indication, marking and actuation Part 1: Requirements for visual, acoustic and tactile signals IEC , Safety of machinery Indication, marking and actuation Part 2: Requirements for marking IEC , Safety of machinery Indication, marking and actuation Part 3: Requirements for the location and operation of actuators IEC 62061, Safety of machinery Functional safety of safety-related electrical, electronic and programmable electronic control systems IEC 62471, Photobiological safety of lamps and lamp systems EN 1525, Safety of industrial trucks Driverless trucks and their systems 3 Terms and definitions For the purposes of this document, the definitions given in ISO 12100, ISO 8373 and the following apply. 3.1 personal care robot service robot that allows physical contact with humans for the purpose of aiding actions or performing actions that contribute directly towards improvement in the quality of life of individuals, excluding medical applications NOTE Typical types of personal care robots include: mobile servant robot (Clause 3.3), physical assistant robot (Clause 3.4) and person carrier robot (Clause 3.5). 3.2 medical robot robot or a robotic device intended to be used as a medical device 3.3 mobile servant robot personal care robot that is capable of moving freely to perform an intended task and/or handling objects (with or without a manipulator) 3.4 physical assistant robot personal care robot that assists a person to perform required tasks, to provide supplementation or augmentation capabilities. A physical assistant robot is designed to bring the functionality of a weak person or an elderly person, to that which can be performed by an able-bodied person, as well as to augment the performance of an able-bodied user NOTE 1 A physical assistant robot may be sub-classified into the following two types, restrained type or restraint-free type, depending upon its configuration. The restraint type secures the human during operation of the personal care robot whereas the restraint-free allows the human to move freely without restraint. ISO 2011 All rights reserved 3

10 NOTE 2 Physical assistant robots (restrained type): A personal care robot that is typically worn by a human or fastened to a human in order to supplement or augment the person s physical ability, depending upon the physical situation or physical impairment levels. Examples include wearable suits or exoskeletons for workers to overcome physical fatigue or mobility robots for elderly persons. 3.5 person carrier robot personal care robot with the purpose of transporting humans to a different location by means of autonomous navigation, guidance and locomotion NOTE The robot may possess a cabin or may be equipped with a seat or footboard. 3.6 controlled stop type of interruption of operation that allows an orderly cessation of motion for safeguarding purposes, and which retains the program logic to facilitate a restart 3.7 safety-related obstacle person, animal or other object in the vicinity of the personal care robot with which there is the likelihood of a collision occurring leading to a hazardous situation 3.8 Terms related to being close to personal care robots proximity distance between the physical surfaces of a personal care robot and another object in its external environment (including humans). Three qualitative ranges, namely close, far, and unreachable are defined for the proximity of a robot with an external object working space three dimensional (3D) volume encompassing the movements of all the robot parts through their axes during normal intended operation maximum space volume which can be swept by the moving parts of the robot as defined by the manufacturer, plus the volume which can be swept by the end-effector and the workpiece. For mobile platforms, this volume can be considered to be equal with the full volume that could be theoretically reached by travelling restricted space (inherent safety) portion of the maximum volume confined by limiting devices that establish boundaries which will not be exceeded. EXAMPLE For mobile platforms this volume can be limited by special markers on floors and walls, or by software limits defined in the internal map. NOTE Adapted from ISO 8373, definition safeguarded space (functional safety) volume defined by perimeter safeguarding devices, or volume which leads to a safe state, when an obstacle is detected inside this volume. NOTE Safe state can also be a stop, motion at reduced velocity, etc. 4 ISO 2011 All rights reserved

11 3.9 contact zero proximity distance between robot and an object in its external environment. NOTE For x being the minimum distance between the personal care robot and the nearest obstacle to it, the following classifications apply: contact: x = 0, with or without force close: x < safeguarded space far: safeguarded space < x < restricted space unreachable: x > restricted space non-contact sensing sensing capability that does not require contact with the objects (including humans) in the environment contact sensing sensing capability that requires contact with the objects (including humans) in the environment intended contact planned touching between an object and the personal care robot for performing the required task of the robot allowed contact any touching with a personal robot that causes no harm or damage 3.10 relative speed absolute speed given as the vector sum of the velocities of both the robot with its moving parts and the objects in the external environment (including humans) that may also be moving NOTE 1 In the safety cases, the minimum relative speed between the closest points on both the robot and the object sides are of most concern. NOTE 2 In a mobile servant robot, the absolute relative speed will be the vector sum of the robot body, the robot manipulator and the object about to be touched, and will give rise to the relative speed of concern safety-rated speed a limit placed either on the speed of a point relative to the personal care robot, or on the speed of one or more axes having a specified sufficient safety-related performance safety-rated reduced speed limit safety-rated speed where the speed limit is set to the value specified for reduced speed reduced speed control robot motion control where the speed is limited to a sufficiently low value as determined by risk assessment. NOTE Reduced speed is intended to allow persons sufficient time to either withdraw from the hazardous motion or allow the personal care robot to stop without causing harm or damage 3.12 safety-related surface conditions adverse circumstances of travel surfaces for mobile robots that are associated with human safety EXAMPLE Surface conditions by which person carrier robots may roll over or slip causing injury or damage. ISO 2011 All rights reserved 5

12 3.13 verification confirmation through the provision of objective evidence that the specified requirements of the personal care robot have been fulfilled NOTE Adapted from ISO 9000:2005, definition validation confirmation through the provision of objective evidence that the requirements for specific intended use or application of the personal care robot have been fulfilled. NOTE Adapted from ISO 9000:2005, definition command device any device that enables the operator or a user to control the robot NOTE This can be a teach pendant, a remote control station, as well as force sensors on the robot or any other kind of device that allows commands to be communicated to the robot Terms related to operational modes manual mode operating mode in which the robot is operated by direct human intervention via, for example, pushbuttons or a joystick, and that excludes automatic operation autonomous mode operating mode in which the robot functions without external control 3.17 operator person designated to make parameter and program changes and to start, monitor and stop the intended operation of the personal care robot NOTE Adapted from ISO 8373, definition user either the operator of the personal care robot or the beneficiary of the service provided by the personal care robot NOTE In some applications, a user could be both the operator and the beneficiary software limits restrictions to the operation of the robot defined in the logic of the control system singularity occurrence whenever the rank of the Jacobian matrix becomes less than full rank NOTE 2 Mathematically, in a singular configuration the joint velocity in joint space may become infinite to maintain Cartesian velocity. In actual operation, motions defined in Cartesian space that pass near singularities can produce high axis speeds which can lead to hazardous situations [ISO , definition 3.22] 6 ISO 2011 All rights reserved

13 3.21 electro-sensitive protective equipment (ESPE) assembly of devices and/or components working together for protective tripping or presence-sensing purposes and comprising as a minimum a sensing device; controlling/monitoring devices; output signal switching devices [IEC :2004, definition 3.5] NOTE ESPEs refer only to non-contact sensing devices pressure-sensitive protective equipment (PSPE) assembly of devices and components triggered using the mechanical activated trip method to provide protection under hazardous situations NOTE PSPE is the collective name for a variety of pressure-sensitive components as defined in this Clause pressure-sensitive edge safety device of the mechanically activated trip type intended to detect the touch of a person or part of a person and comprising a) sensor(s) which generates a signal when pressure is applied to part of its surface, where 1) the length is greater than the width, 2) the cross section throughout the pressure-sensitive area is constant, 3) the width of the cross section is greater than 8 mm, 4) the effective sensing surface is deformed locally to actuate the sensor(s), and b) control unit, which responds to the signal from the sensor and generates an output signal(s) to the control system of a machine See Figure 1. ISO 2011 All rights reserved 7

14 Figure 1 Pressure-sensitive edge or bar applied to a machine NOTE The width of the sensor's cross section is usually 80 mm. [ISO :2005, definition 3.1] 8 ISO 2011 All rights reserved

15 pressure-sensitive bar safety device comprising a) sensor(s) which generates a signal when pressure is applied to part of its surface, where 1) the length is greater than the width, 2) the cross section throughout the pressure-sensitive area is constant, 3) the width of the cross section is greater than 8 mm, 4) the effective sensing surface moves as a whole to actuate the sensor(s), and b) control unit, which responds to the signal from the sensor and generates an output signal(s) to the control system of a machine See Figure 1. NOTE 1 NOTE 2 sensor(s). The width of the sensor's cross section is usually 80 mm. The surface of a pressure-sensitive bar can also deform locally but the deformation does not actuate the [ISO :2005, definition 3.2] pressure-sensitive protective device safety device of the mechanically actuated trip type which can also act as an impeding device intended to detect the touch of a person or part of a person NOTE 1 It consists of a sensor(s) which generates a signal when pressure is applied to part of its outer surface, and a control unit, which responds to the signal from the sensor and generates an output signal(s) to the control system of a machine. NOTE 2 Impeding device is defined in ISO 12100:2010, 3.29 NOTE 3 Pressure-sensitive protective devices can be used as tripping devices as well as presence-sensing devices as defined in ISO 12100:2010, NOTE 4 Adapted from ISO :2006, definition pressure-sensitive bumper pressure-sensitive protective device with a sensor whose characteristics are a cross-section throughout the pressure-sensitive area that can be regular or irregular, a cross-section width usually greater than 80 mm, and an effective sensing surface that is deformed locally or that can move as a whole [ISO :2006, definition 3.1.1] pressure-sensitive plate pressure-sensitive protective device with a sensor whose characteristics are an effective sensing surface that is normally, but not necessarily, flat, an effective sensing surface width usually greater than 80 mm, and an effective sensing surface that moves as a whole NOTE Adapted from ISO :2006, definition ISO 2011 All rights reserved 9

16 pressure-sensitive wire pressure-sensitive protective device with a sensor whose characteristics are a wire, cord, rope, or cable held in tension, and where a change in the tension is detected to give an output signal [ISO :2006, definition 3.1.3] 4 Risk assessment 4.1 General ISO provides requirements and guidance in performing risk assessment including risk analysis which is centred by hazard identification. In performing the risk assessment, the decision of whether a risk is acceptable or not depends on the application and the intended use of the personal care robot. The requirements contained in Clause 5 have been derived from the iterative process of applying safety measures, in accordance with the general principles for designing personal care robots described in ISO 12100, to the hazards identified in Annex A. 4.2 Hazard identification Annex A contains lists of typical hazards that can be present with the three types of personal care robots focussed upon in this standard. These lists should not be considered all-inclusive; personal care robot systems may also present other hazards as a result of their particular design. Hazard identification shall give particular consideration to: a) unexpected travel surface conditions in the case of mobile robots; b) uncertainty of objects to be handled in the case of mobile servant robots; c) conformity to the human anatomy and its variability in the case of physical assistant robots. d) normal but unexpected movement of the personal care robot e) unexpected movement of humans, animals and other objects f) unintended movement of the personal care robot The risk assessment shall consider in particular, manipulators and end-effectors of the personal care robot, and they shall be given the same requirements as for the robots. If necessary: the manipulator speed shall be restricted or controlled according to Clause 6.4; and the safe state of the end-effector(s) shall be taken over if a safe state of the personal care robot is required. 4.3 Risk evaluation A risk evaluation shall be carried out on those hazards identified under Clause 4.2 with careful attention paid to various human-robot contact situations. The risk analysis shall be carried out to identify any further hazards that may be present in a particular personal care robot. The remaining risk by the personal care robot, after all remedial protective measures have been adopted, shall be evaluated and proven that it is sufficiently low. 10 ISO 2011 All rights reserved

17 Results of experimentation can be drawn upon to show sufficient accountability of allowed contact. If numeric values are used for specific applications, an appropriate validation of referring to them shall be provided. NOTE 1 Studies 1 have been carried out on pain tolerance limits of adults and robot-human collisions on various parts of the human body to study significant injury mechanisms. NOTE 2 More complete numeric data for different categories of people (children, elderly persons, pregnant women, etc) and personal care robot application (mobile servant, physical assistant, person carrier, etc) are being determined and will be included in a future revision. 5 Safety requirements and/or protective measures 5.1 General Personal care robots shall comply with the safety requirements and/or protective measures of this clause. Once the hazards associated with a personal care robotic application have been identified using the methods described in Clause 4, the robot shall be designed to ensure that the risk from those hazards is as low as reasonably practicable. A personal care robot shall be designed according to the principles of ISO for all hazards identified for its application. Where those hazards are mitigated by measures defined in this standard, the requirements of this standard shall be applied. Where hazards are mitigated by measures that are not described in this document, other requirements as determined by risk assessment shall be applied and these measures shall achieve at least the same level of risk reduction as the measures described in this standard. Any suitable and practicable measures shall be achieved to protect any person, animal or other objects in the proximity of the robot from any potential hazards and to ensure the user s safety for continuous use of the personal care robot as much as reasonably practicable. The provision of inherently safe design measures is the first and most important step in the risk reduction process because such inherent characteristics of the machine are likely to remain effective, whereas experience has shown that even well-designed safeguarding may fail or be violated, and Information for use may not be followed. Inherently safe design measures avoid hazards by reducing or eliminating risks through a suitable choice of design features of the personal care robot itself, and/or interaction between the exposed persons and the robot. Adding safeguards, and/or protective measures is the second preference for risk reduction. As a large number of risks arise due to the possible dynamic interactions between humans and the personal care robot, a protective control function of the robot may significantly reduce a particular type of risk. When specific risk reduction is achieved by the use of safety-related control functions, more detailed requirements are provided in Clause 6 of this standard. The residual risks, after inherent safe design and protective measures have been incorporated, shall be provided in the Instruction Handbook. The Information for use for each hazard is provided at Sub-clause 5.x.4 1 Human-robot interaction and impacts research: Y. Yamada, K. Suita, K. Imaia, H. Ikedab and N. Sugimotob, A failure-to-safety robot system for human-robot coexistence, Robotics and Autonomous Systems, Volume 18, Issues 1-2, pp , Y. Yamada, Y. Hirasawa, S. Y. Huang, Y. Umetani, K. Suita, Human-Robot Contact in the Safeguarding Space, IEEE/ASME Trans. on Mechatronics, Vol.2, No.4, pp , S. Haddadin, A. Albu-Schäffer, M. Frommberger, J. Rossmann, and G. Hirzinger, The DLR Crash Report: Towards a Standard Crash-Testing Protocol, for Robot Safety - Part I: Results, 2009 IEEE International Conference on Robotics and Automation, Kobe International Conference Center, Kobe, Japan, May 12-17, S. Haddadin, A. Albu-Schäffer, and G. Hirzinger, Soft-tissue injury in robotics, ICRA S. Haddadin, A. Albu-Schäffer, F Haddadin, Jurgen Rossmann and G. Hirzinger, Experimental safety study on soft-tissue injury in robotics, RAM, ISO 2011 All rights reserved 11

18 or 5.x.x.4 of each Clause 5.x or 5.x.x (respectively) whereas general Information for use is provided in Clause 8. The satisfaction of the safety requirements of this clause can be verified by one or more methods, such as: A: Visual inspection; B: Practical test; C: Measurement; D: Observation during operation; E: Examination of circuit diagrams; F: Examination of software function blocks and/or software documentation; G: Review of task based risk assessment; H: Examination of layout drawings and relevant documents. Recommended methods of verification and validation of various requirements for the significant hazards are shown in Sub-clause 5.x.5 or 5.x.x.5 of each Clause 5.x or 5.x.x (respectively) at the end of each clause, in the form of which of the methods A, B, etc. that are applicable, corresponding to the methods listed above. 5.2 Hazards related to charging battery General If a personal care robot is equipped with a battery charging system, persons shall be protected against hazards due to accidental contact with the charging connections on the robot and its charging systems which should be in compliance with IEC , IEC 60529, IEC , and EN to -4 as appropriate. Also the charging system shall prevent any hazards arising because of overloading or charging of deeply discharged batteries Inherently safe design Where applicable charging contacts shall be located in such a way that they cannot be accidently touched. Furthermore charging contacts and plugs should be designed in a way that accidently touching live parts is prevented (e.g. caps for plugs and outlets). Battery voltages and charging currents shall be chosen to be as low as reasonably practicable. Charging systems shall be designed in such a way that the correct charging of the battery is automatically supervised and thus hazards caused by overloading or charging of deeply discharged batteries are prevented Safeguarding and complementary protective measures The following measures shall apply: a) charging systems shall be designed in such a way that the charging connections are only activated when the personal care robot is connected to them b) display the indication of the charging status or give a signal when the battery is fully charged. 12 ISO 2011 All rights reserved

19 5.2.4 Information for use Information for use shall contain instructions for battery charging Verification and validation The following verification and validation methods apply: B, C, D, E. 5.3 Energy storage and supply Contact with high energy parts General A means of isolating any hazardous energy sources (e.g. electrical, mechanical, hydraulic, pneumatic, chemical and thermal) shall be provided. Such hazardous energy sources must be clearly identified and the isolators must be capable of being locked if reconnection could endanger persons. The isolators must also be capable of being locked where an operator is unable, from any of the points to which he has access, to check that the energy is still cut off. The robot electrical equipment shall be designed and constructed according to the relevant requirements of IEC Any exposed person shall be protected from direct or indirect contact with live parts on the robot Inherently safe design One or more of the following measures shall apply: a) use of protective extra-low voltage sources for electrical equipment; b) use of low level pressures for pneumatic/hydraulic equipment Safeguarding and complementary protective measures Compliance shall be with IEC (for electrical equipment), ISO 4414 (for pneumatic equipment) and, ISO 4413 (for hydraulic equipment). Use of the appropriate IP class shall be in compliance with IEC for electrical equipment to prevent human contact during all phases of operation of the personal care robot. Use of heat dissipation mechanisms (for example: heat sinks, air flow). If fans are used, fan control devices are suggested Information for use Warning markings shall be put on the personal care robot complying with IEC (Parts 1-3), see Table 1. The Information for use shall describe the residual risks relevant to the high energy parts. ISO 2011 All rights reserved 13

20 Table 1 Warning markings Reference and symbol Title Function ISO 7010-W012 Warning; Electricity To warn of a hazard from electricity ISO 7010-W001 General warning sign To signify a general warning ISO 7010-W017 Warning; Hot surface To warn of a hazard from a hot surface Verification and validation The following verification and validation methods apply: A, B, C, E, H Uncontrolled release of stored energy General A means shall be provided for the controlled release of stored hazardous energy. NOTE Stored energy can occur in air and hydraulic pressure accumulators, capacitors, batteries, springs, counter balances, flywheels, etc Inherently safe design The following measures shall apply: a) energy optimisation shall be adopted to minimise the energy needs of the robot; b) stored energy shall be kept to as low a level as reasonably practicable, to minimise the hazard Safeguarding and complementary protective measures The design and installation of guards/covers shall be based on risk assessment to minimise the risk of harm to humans during any release of energy. The robot shall be provided with the means to regulate its energy supply so as to prevent over-heating or over-currents caused by overloads, short circuits, clothes which envelop the heat source of the robot, or device malfunction Information for use Labels shall be affixed to identify all the stored energy hazards and their locations. 14 ISO 2011 All rights reserved

21 Verification and validation The following verification and validation methods apply: B, D, E, H Power failure or shutdown General Power failure or shutdown of a personal care robot shall not lead to any unacceptable risk, and re-initiation of power shall not lead to any hazardous motion. Maintenance procedures may be enforced following such power failures or shutdowns, if deemed necessary by risk assessment (see Clause 8.2.5). Special consideration shall be taken to ensure the following: a) Personal care robots equipped with manipulators shall be designed to ensure that they do not cause harm due to manipulator movement or dropped loads in the event of failure or shutdown of power to the manipulator. This shall be achieved regardless of the power supply technology (e.g. electrical, hydraulic, pneumatic, vacuum, etc); b) Personal care robots equipped with mobile platforms shall be designed to ensure that they do not cause harm due to robot travel following failure or shutdown of power (e.g. runaway). This shall be achieved regardless of the robot travel mechanism technology (e.g. wheels, tracks, legs); c) The personal care robot that is capable of cutting its actuation power off temporarily shall be designed to ensure that it does not cause unacceptable risk from the robot parts or its components being dropped in case of power loss or change; d) Movement without drive power: any personal car robot, or parts of it, shall be provided with the means to be moved without drive power by a single person, for either escape or rescue, as determined by risk assessment. NOTE See IEC for electrical power supply requirements Inherently safe design One or more of the following measures shall apply: a) use of the de-energise to apply principle in the design of braking mechanisms to all moving parts b) internal storage of sufficient energy to allow recovery to a safe state following power failure/shutdown; Measures to avoid unexpected start-up can be found in ISO Safeguarding and complementary protective measures Means to provide an uninterruptable power source shall be made where appropriate Information for use The Information for use shall describe the residual risks relevant to power failure or shutdown Verification and validation The following verification and validation methods apply: B, D, E, H. ISO 2011 All rights reserved 15

22 5.4 Hazards due to robot shape General The following requirements shall be met: a) The personal care robot and its parts shall be designed to avoid the potential for accidents that could cause crushing, cutting, or other severing injuries. EXAMPLE Exoskeleton straps shall be designed not to cause injuries, such as cutting or abrasion. b) The personal care robot shall be designed to ensure that robot parts do not fall off in any hazardous manner. Also collisions with other objects shall be considered Inherently safe design Sharp edges and points shall be avoided in the design of the personal care robot according to ISO Holes or gaps in the accessible part of the robot shall be designed so that the insertion of any part of the human body is prevented in compliance with ISO and ISO , including the use of fixed/movable guards around wheels. The robot s joints (e.g. those in the manipulator) shall be designed in a way that parts of the human body cannot be crushed when the joint is moved. This can be done by changing the robot geometry as well as by restricting the joint limits Safeguarding and complementary protective measures One or more of the following requirements shall be met: a) Pressure-sensitive protective equipment (PSPE), e.g., pressure-sensitive edges, bars, devices, bumpers, plates, wires, etc, shall be used to prevent hazardous impacts. These contact sensing devices shall comply with Clause 6.6.3, in accordance with the robot s risk assessment. If used as an object sensing device, the elements shall comply with Clause 6.1 and shall be mounted as described in EN 1525; b) Electro-sensitive protective equipment (ESPE): if used as the primary sensing device, such non-contact sensing devices shall have an appropriate reliability in their operation and mounting, and shall comply with Clause 6.6.2, in accordance with the robot s risk assessment. Sensing persons, animals or other objects in the path of the personal care robot within the sensing field in the main direction of travel shall cause the robot to stop (in compliance with Clauses 6.1 and 6.2) prior to contact between the robot structure and the person or object; c) cushioning on sharp edges and points shall be provided to eliminate shearing, stabbing, cutting hazards and reduce impact hazards; see the Note in Clause d) since the applicable standards like the ISO series are not intended for small children and infants, therefore stronger (more demanding) requirements for detection (lower pressure for bumper actuation, smaller resolution of ESPE in order to detect the smaller limbs of children) shall be considered when deemed necessary by risk assessment. NOTE ISO presents examples of how the presence of children can be dealt with Information for use The residual risks, after inherent safe design and protective measures have been incorporated associated with the shape of a personal care robot, shall be provided in the Instruction Handbook. Warnings and instructions mitigating shape-related risks shall comply with ISO and ISO ISO 2011 All rights reserved

23 The Information for use shall contain instructions for protective equipment (such as gloves, etc.) needed for handling, using, operating, etc the personal care robot Verification and validation The following verification and validation methods apply: A, G, H. 5.5 Emissions Hazardous noise General Any person near the personal care robot shall be protected from noise that could directly cause hearing loss, stress, discomfort, loss of balance or consciousness of the user, or similar disorders arising from the robot s operation. The level of acoustic noise emitted by the personal care robot shall be sufficiently low that no special protective equipment needs to be worn. The personal care robot shall comply with noise emission standards appropriate to its intended purpose (see for example, ISO 1996, ISO 3740, ISO 11200, ISO/TS 15666, ISO 15667). NOTE Acoustic environmental noise assessment can be found in ISO 1996 Parts 1 and Inherently safe design One or more of the following requirements shall be met: a) low-noise components the robot can be constructed with components which are inherently silent in their operation; b) appropriate operational behaviour robot actions and/or motions can be designed to be as quiet as practicable, given the required tasks of the robot; c) sound-absorbing materials the robot can be constructed with materials that absorb acoustic noise and prevent its emission to the outside environment Safeguarding and complementary protective measures One or more of the following measures shall apply; a) additional sound absorbing materials, for example foam, baffles, curtains, coatings to prevent emitting noise; b) use of active noise cancellation (anti-noise) mechanisms Information for use Information for use shall contain appropriate instructions, and visible warning labels shall be placed on a personal care robot to protect the hearing of humans within a defined range, if the robot emits intensive sound energies Verification and validation The following verification and validation methods apply: B, H. ISO 2011 All rights reserved 17

24 The measurement, declaration and verification of noise emission values shall be made according to ISO 3746 or ISO as appropriate Hazardous vibrations General A personal care robot user shall be protected from harmful indirect or direct vibrations from the robot in use so that his/her physical conditions are looked after during its operation. a) A robot user shall be protected from harmful vibrations that could cause vibration-related injuries such as tendon inflammation, backache, discomfort, neurosis, arthritis, or similar disorders of any kind due to continuous use of the robot; b) Unintended vibration between 0.5 Hz and 80 Hz can cause problems for health, comfort and perception. Vibrations between 0.1 Hz to 0.5 Hz can cause motion sickness and therefore personal care robot designs shall comply with all applicable parts of ISO Inherently safe design These may include, but not be limited to, the following measures: a) the robot can be designed to minimise the vibration produced by mechanical components; b) any seating on the personal care robot can be designed with mechanisms to absorb vibration; c) select and use vibration absorbing materials within the design to limit the extent to which humans are exposed to the vibration sources within the robot; d) restrict the movement of the personal care robot to appropriate velocities which cause no or minimal vibration Safeguarding and complementary protective measures In particular, additional countermeasures (e.g. shock absorbers) are recommended if a personal care robot operator is in direct contact with the robot (e.g. person carrier robot and/or physical assistant robot) Information for use Information for use shall contain specification of the vibrating components and which protective equipment needs to be worn by the user Verification and validation The following verification and validation methods apply: C, D Hazardous substances and fluids General A personal care robot user shall be protected from emissions of any poisonous or noxious materials or solvents from the robot body surface, or even within its body if the solvent is highly volatile, that may cause burns or any kind of irritation (see for example ISO ); Generally the personal care robot should be designed so that no special protective equipment against hazardous substances and fluids needs to be worn by the user; 18 ISO 2011 All rights reserved

25 All material that may cause allergies should not be used at a surface which contacts human skin during normal use of the personal care robot. NOTE Nickel, chromium and some types of rubber may cause allergic reactions Inherently safe design These may include, but not be limited to, the following measures: a) elimination or avoidance of potentially hazardous substances and fluids such as oil, cooling fluid, and dust arising from brake abrasion within the robot; b) design of the robot to contain substances internally rather than releasing them into the external environment Safeguarding and complementary protective measures These may include but not be limited to: a) measures to detect loss of hazardous substances and fluids (e.g. oil, etc.) if hazardous substances or fluids are needed for operation; b) shut-off valves or fuses to seal leaking fluid pipes Information for use Information for use shall be provided about any hazardous substances inside the robot. If necessary instructions for taking precautions during use, handling, maintenance and disassembly of the robot shall be given. If allergenic materials are used, the information about the materials shall be provided Verification and validation The following verification and validation methods apply: G, H Extreme temperatures General A robot user shall be protected from heat (either high or low temperatures) emitted by the robot or its components that may cause burns, chilblains, stress, discomfort, or similar disorders of any kind. The surface temperatures of parts that may be touched should stay within the range 10 C and 43 C as stated in ISO parts 1-3. Furthermore, it should be considered, which body part comes in contact with the robot surface (e.g., hand, foot or face), the kind of the surface (e.g., metal, wood or plastic), and the structure of the surface; Inherently safe design This may include, but not be limited to the following: a) elimination or avoidance of extreme heat sources within the robot; b) choosing materials and their textures with appropriate thermal conductivities. ISO 2011 All rights reserved 19

26 Safeguarding and complementary protective measures This may include, but not be limited to: a) reducing (or increasing) the surface temperature with an appropriate cooling (or heating) system; b) isolation or the application of guards (see ISO 14119) Information for use Information for use shall contain warnings and markings on the hot/cold parts having extreme temperatures in compliance with ISO If necessary, instructions for taking precautions during use, handling, maintenance and disassembly of the personal care robot shall be given Verification and validation The following verification and validation methods apply: C, D Hazardous non-ionising radiation General Emissions by hazardous ultrasonic, laser and light sources shall be prevented. Light sources other than lasers shall be designed to not exceed the exposure limit for users, in accordance with IEC Inherently safe design The use of lasers shall not exceed class 1, in accordance with IEC , unless a higher class of laser is needed and the results of a risk assessment determine that an alternative class is appropriate Safeguarding and complementary protective measures The personal care robot shall be designed to have protective shutters and/or removable guards if deemed necessary via risk assessment. Also, for example laser beams, when used as sensing devices, should not beam into the direction where eyes are likely to be. Functions controlling laser-based transducers shall comply with Clause 6.1, in accordance with the robot s risk assessment Information for use Information for use shall provide details of potentially hazardous emissions likely to be encountered by persons and, where appropriate, domestic animals or property in the operational environments of the personal care robot. The Information for use shall advise not to look directly into light, shall give information for personal protective devices and other special behaviour. Also markings on the robot shall be attached and their meaning shall be described in the Information for use Verification and validation The following verification and validation methods apply: C, D, G Hazardous ionising radiation General Personal care robot users and third parties shall be protected from ionising radiation emitted by the robot or its components. Exposure to such radiation shall be minimised to avoid any harmful physical injuries or disorders. 20 ISO 2011 All rights reserved

27 Mechanisms producing ionising radiation should not normally be used in any (non-medical) personal care robot. If such a mechanism is essential for the robot s application (i.e. where there is no alternative method of achieving the application objectives) then special protection requirements shall be developed (for example guidelines, see ISO 2919, ISO 3925, ISO 14152) Inherently safe design Provision of shielding shall be made by increasing the thickness of structural and mechanical parts, walls and panels (for example guidelines, see ISO 6385, and ISO 7212). The power of the radiation source should be limited to the lowest level sufficient for proper functioning of the personal care robot. Design the source so that the beam is concentrated only on the target Safeguarding and complementary protective measures There are no recommended measures for safeguarding with respect to this hazard Information for use Information for use shall address the emission produced by the personal care robot. Any radiation source shall be labelled with warnings about the kinds of hazards the source can cause, taking into account any safeguarding measures Verification and validation The following verification and validation methods apply: C, H. 5.6 Electromagnetic interference General For all reasonable foreseeable electromagnetic disturbances, hazardous robot motion and unsafe system states caused by a disturbed safety function, shall be prevented. The personal care robot should comply with all relevant standards for EMC tests, such as, IEC , IEC , IEC , IEC and IEC Deviations shall be acceptable if determined by risk assessment and the decisions made are documented. In addition IEC/TS may be useful for providing a methodology for the achievement of functional safety of electrical and electronic systems including equipment with regard to electromagnetic phenomena. The personal care robot shall comply with all spectrum regulations that are applicable Inherently safe design The function(s) having a direct contribution to safety mentioned in Clause 6.1 shall be designed to meet the electromagnetic immunity requirements of Clause in IEC Non-safety-critical function(s) of the robot system should meet IEC or IEC according to the intended operating environment Safeguarding and complementary protective measures The risk shall be reduced to an acceptable level by electromagnetic shielding. ISO 2011 All rights reserved 21

28 NOTE All mechanisms that act as EM radiation sources can be monitored for total power (current/voltage) consumption, or for active emission (for example, wrap-around sensors) and if EM emissions exceed design limits then one or more of the mechanisms shall be shut down (de-energised, isolated) until compliance occurs Information for use Information for use shall provide necessary information of the property of the radiating electromagnetic waves as well as the property of the electromagnetic waves which can potentially cause interference Verification and validation The following verification and validation methods apply: C. 5.7 Stress, posture and usage hazards General In the risk assessment, hazards due to stress, posture and usage shall be identified, and the personal care robot s design shall ensure that the risk of any such hazard is minimised. This may be achieved by, but may not be limited to, the following requirements: a) a robot shall be designed to minimise or reduce mental or physical stress or strain to its user, over continuous duration of its use, including (but not limited to) uncomfortable usage or posture, operational environments that would directly cause physical fatigue, tendon inflammation, mental or nervous distress, or similar disease or disorders of any kind; b) the design of the robot shall take into account typical body sizes of the intended user population, in order to avoid physically demanding body postures or to ensure easy operation. ISO describes how principles of ergonomic factors by construction of workstations at machinery should be applied. This should be considered when building a personal care robot, where somebody sits on or stands in front of the personal care robot. c) user interfaces such as controls, signalling or data display elements, shall be designed to be easily understood so that clear and unambiguous interaction between the human and the robot is possible; d) the robot shall comply with ergonomics standards appropriate to its intended purpose (see ISO , ISO , ISO , ISO , ISO to -3) Inherently safe design This may include, but not be limited to: a) the design and location of actuating controls, which should ensure that they can be operated without physical stress or discomfort; b) the proper ergonomic design and location of the seat, which should ensure that good posture can be maintained during operation of the robot; c) commanding devices that are detachable or hand-held instead of being permanently attached to the robot in an inappropriate position; d) reduction of noise and uniform acoustic stimulation; e) provision of adequate lighting; f) designing the robot to avoid need for sustained attention in order to detect critical signals as far as reasonably practicable or over a long period of time; 22 ISO 2011 All rights reserved

29 g) adequate display design; h) reduction of signal uncertainty and improvement of detectability Safeguarding and complementary protective measures One or more of the following measures should apply: a) Use of shock absorbing (suspension) mechanisms; b) Use of posture supports Information for use The Information for use shall contain instructions about the correct way to operate the actuating controls and how to use the personal care robot. The Information for use shall include the need for proper training to avoid operator travel time being longer than recommended Verification and validation The following verification and validation methods apply: A, C, D, H. 5.8 Hazards due to robot motion General The risk of hazards due to the motion of the personal care robot shall be reduced to an acceptable level. Robot components shall be designed, constructed, secured, or contained so that the risks of hazards caused by breaking or loosening, or releasing stored energy are reduced to acceptable levels. Exposed persons shall be protected from hazardous movement of the personal care robot, such as rollovers and runaways, under normal usage and operation of the robot, curves, inclines, and similar operational conditions in its working environment Mechanical instability General The following requirements shall be met: a) The personal care robot shall be designed to minimise mechanical instability (such as overturning, falling or excessive leaning when in motion). Personal care robots shall be designed to have sufficient stability to allow them to be used in their specified conditions of use. Specific stability requirements for particular robot types in particular situations are specified in Clauses ; b) The personal care robot shall be designed so that no extraordinary actions or procedures are required by the user in order to maintain its mechanical stability; c) Mechanical stability shall not be affected in any phase of the robot s life cycle (including handling, transportation installation, use, de-commissioning, and dismantling); d) The robot shall comply with mechanical stability standards appropriate to its intended purpose (e.g., for mobile personal care robots, see ISO and ISO for static and dynamic stabilities of wheelchairs); e) Stability shall be maintained against static and dynamic forces from any moving parts and loads of the robots (e.g. extendible manipulators). ISO 2011 All rights reserved 23

30 Inherently safe design This may include, but not be limited to the following: a) use of appropriate lightweight design and materials for robot construction where reasonably practicable b) designing the ground support area to be as large as reasonably practicable; c) designing the centre of gravity of the robot to be as low as reasonably practicable; d) designing the robot to ensure that mechanical resonance effects cannot lead to instability; e) adoption of measures described in ISO 12100; f) designing the masses of moving parts, especially the manipulator, to be as low as possible Safeguarding and complementary protective measures Protective measures may include one or more of the following: a) means to prevent the onset of instability; b) means to monitor onset of instability and act (or not) to prevent harm; c) means to prevent harm in cases of overturning or falling; d) means to limit the velocity or range of the manipulator; e) means to prevent overload. EXAMPLES Tilt sensors, harnesses, roll-bars, feedback control. Any control systems performing the above functions shall comply with Clause 6.1, in accordance with the robot s risk assessment Information for use The Information for use shall contain limits of use for the robot concerning slope of travel surface, speed, payload, etc Verification and validation The following verification and validation methods apply: B, D. NOTE For lift chairs, ISO 7176 is applicable, but testing of personal care robots could also include user lift capabilities Instability during travel General A personal care robot capable of travel shall be designed to ensure that it does not cause any hazardous rollovers, runaways, nor drops of its body parts or loads being carried during travel. This shall be achieved for all basic travel patterns (forward/backward travels, rotations, turns/u-turns, accelerations, and decelerations) in its specified operating environments, at any intended speed of the robot, which is determined depending on its specific application type and design. 24 ISO 2011 All rights reserved

31 For personal care robots that travel autonomously, the control system shall be designed to ensure, as far as reasonably practicable, travel stability under foreseeable conditions. Any person close to the personal care robot shall be protected from the robot falling or rolling over Inherently safe design One or more of the following measures shall apply: a) design of the mass distribution within the personal care robot to ensure that the robot cannot overturn even when turning at maximum speed on the worst case travel surface gradient identified within the intended environment specified for the robot; b) design of the travel actuators (wheels, legs/feet, etc.) shall ensure that sufficient adhesion with the terrain is maintained over all terrain types, even on slippery surfaces, etc. as defined in the specification of intended environmental conditions for the robot; c) design of the stability of the robot to ensure that it does not overturn when travelling over uneven terrain, up to the worst case limits defined within the intended environmental conditions specified for the robot Safeguarding and complementary protective measures The following measures shall apply to applicable personal care robots: a) travel surface and geometry detection as described in Clause 6.6.4; b) the robot shall be able to assess whether or not it is capable of travelling through the planned paths or regions; c) means to protect the robot from falling due to different elevations (e.g. stairways, holes, etc), or from rolling over, shall be provided for the intended operational environments (see Clause 6.6.4); d) restriction of the maximum speed of the personal care robot within limits that ensure the robot will not overturn even when attempting to turn on a worst-case travel surface gradient identified within the intended environment specified for the robot; e) availability of seat belts in person carrier robots. Any control systems performing the above functions shall comply with Clause 6.1, in accordance with the robot s risk assessment Information for use Information for use shall specify conditions of the environment under which the personal care robot can operate. For environmental conditions that might lead to hazardous situations but are likely to be found in situations where the robot performs its tasks, the Information for use shall contain warnings. Such warnings signals may consist of audio, visual, vibrations, or any combination of signals in case of any failure(s) of electronically controlled systems including low-battery level. For person carrier robots, Information for use shall be provided to the user (passenger) with appropriate instruction and warnings to encourage the user to wear the protective means provided (i.e., seatbelt, helmet, etc.). Proper training shall be provided to avoid abnormal and abrupt operations, for example sudden turns, accelerations/ decelerations. ISO 2011 All rights reserved 25

32 Verification and validation The following verification and validation methods apply: B, D. Travel stability performance shall be evaluated under various surface friction coefficients according to the results of risk assessment (surface conditions, such as carpets, metal tiles, plastic laminates and turfs) Instability while carrying loads General Any person close to the personal care robot shall be protected from falling objects when the robot performs tasks as well as while carrying up to maximum loads Inherently safe design One or more of the following measures shall apply: a) the holders, placement areas, racks, etc, on the personal care robot, but especially end effectors such as grippers or robotic hands, shall be designed to avoid the potential for accidents by lost loads; b) risks can be reduced by selecting form fitting designs instead of force/friction fitting devices; c) limiting devices shall avoid handling of excessive loads Safeguarding and complementary protective measures One or more of the following measures shall apply: a) loads can be tied or locked down by bolting or latching devices or held by a gripping device; b) the maximum acceleration rate should be commensurate with requirements for load stability during normal operation; c) for normal operation, including a controlled stop or an emergency stop, the deceleration rate should be commensurate with requirements for load stability; d) for emergency operation, the maximum deceleration rate shall be commensurate with emergency stop dynamic criteria including the requirements for load stability and retention. Any control systems performing the above functions shall comply with Clause 6.1, in accordance with the robot s risk assessment Information for use Information for use shall contain information about size, weight and type of loads that may be carried. Instructions for fastening loads shall be provided Verification and validation The performance of hands, grippers and fittings shall be determined by a series of extreme movements, such as acceleration, stops and u-turns of the mobile personal care robot and fast manipulator movements. All tests shall be carried out with maximum load and with the maximum speed. The following verification and validation methods apply: B, D. 26 ISO 2011 All rights reserved

33 5.8.5 Instability in case of collision General Users or other objects (including other people) shall be protected from hazardous movements after or during a collision. A collision between a personal care robot and any other obstacle should not cause instability of the personal care robot. a) Risk assessment shall determine the allowable maximum values of the appropriate parameters (such as contact force) that evaluate the risk caused by contact over the entire operational range; NOTE The maximum values will vary depending on application and need to be obtained by the manufacturer. More complete numeric data for different categories of people (children, elderly, pregnant women, etc) and application (mobile servant robot, physical assistant robot, person carrier robot, etc) are being determined and will be included in a future revision. b) A personal care robot shall be designed to ensure that it does not cause any hazardous rollovers, runaways, or detachment of robot body parts, even when it receives any collision forces or obstacle detection signals during its motion, up to the limits specified for its intended operation Inherently safe design One or more of the following measures shall apply: a) design of the mass distribution and shape of the robot so that unintended collisions within the maximum expected limits do not result in overturning; b) use of soft materials to absorb forces which lead to hazardous instability Safeguarding and complementary protective measures One or more of the following measures shall apply: a) use of air-bags or seat belts to prevent harm in case of robot overturns; b) design of braking performance of the mobile platform of the robot to prevent runaway under a collision of the maximum expected force (see Clause 6.6.4); c) design of the motion behaviour of the robot to minimise impact forces (see Clause 6.5); d) use of speed restriction control algorithms, watchdog safety and speed restriction circuits, and/or devices to minimize instability and impact forces during collisions (see Clause 6.5); e) use of non-contact sensing ESPE to avoid collisions (see Clause 6.6.2) Information for use The Information for use shall contain details of all parameters that evaluate the extent of risk-like forces and collision scenarios that can be tolerated Verification and validation The following verification and validation methods apply: B, D, G. The braking performance shall be evaluated by measuring the stopping distance at a given surface friction coefficient. ISO 2011 All rights reserved 27

34 5.8.6 Instability during embarkation/ disembarkation General In case of a person carrier robot, the robot shall be designed to ensure that it does not roll over or run away while a passenger is getting on or getting off the robot under intended use situations Inherently safe design One or more of the following measures apply: a) design of the mass distribution and shape of the robot so that embarkation/disembarkation does not result in overturning; b) design of the braking performance of the mobile platform of the robot to prevent runaway during passenger embarkation/ disembarkation Safeguarding and complementary protective measures One or more of the following measures apply: a) The robot shall be designed to include measures for active stability control that is capable of adjusting the balance of the robot to counteract any fluctuations to the centre of gravity during passenger embarkation/ disembarkation according to Clause 6.1; b) The robot shall be in the appropriate configuration before starting embarkation/ disembarkation under normal situations; c) The robot shall be designed to be moved into a sufficiently safe configuration to allow disembarkation in emergency situations Information for use Information for use shall contain instructions about embarkation/disembarkation procedures and precautions to be undertaken by the user. It shall also contain information about the necessary configuration of the robot for embarkation Verification and validation The following verification and validation methods apply: B, D Collision with safety-related obstacles General Personal care robots shall be designed such that the risk of hazardous collisions with safety-related obstacles (e.g., persons, pets, etc) is as low as reasonably practicable; see the Note in Clause a). A risk assessment shall be made including procedures of how to manage collisions between a personal care robot and safety-related obstacles. A personal care robot which is capable of travelling autonomously shall have an obstacle avoidance capability with sufficient performance to ensure that the robot can avoid static obstacles in its travel path, or come to a safe stop without colliding with them. The response time of the sensing functions and the safety-related control system shall be capable of stopping the robot prior to impact between the robot structure and other mounted equipment and an obstruction being sensed in advance of the moving robot in the main direction of travel. 28 ISO 2011 All rights reserved

35 Control systems performing safety-related obstacle avoidance shall comply with the general safety performance requirements of Clause 6, in accordance with the risk assessment Inherently safe design One or more of the following measures shall apply (see also Clause 5.8.5): a) Limitation of the travel speed of the robot to an inherently safe maximum; b) Use of soft materials to reduce impact forces Safeguarding and complementary protective measures In order to avoid possible collisions, one or more of the following measures shall be applied: a) executing a controlled stop (see Clause ), when a safety-related obstacle is in the robot s restricted space; b) controlling the speed of the robot (see Clause 6.5); c) defining a minimum distance in accordance with ISO between the personal care robot and a safety-related obstacle and stop the robot, based upon robot types and/or robot applications, if this distance is not maintained. This can be achieved by position and speed controlling (see Clause 6.5) or by functions that avoid the safety-related obstacle (e.g. tactile sensors) see Clause 6.6; NOTE Annex B present safety criteria for personal care robots. d) hand-guiding or steering the personal care robot. In this case, the risk assessment shall consider if all collisions with the robot can be avoided. The effects of possible collisions shall be reduced by adopting appropriate measures; for example: e) by using collision detection systems able to implement real-time and immediate reactions (see Clause 6.6.3); f) moving parts shall be designed so that acceptable impact energy cannot be exceeded Information for use Personal care robot documentation shall provide an overview of the collision avoidance behaviour of the robot. Where any degree of manual control is required for collision avoidance, user documentation shall specify any force or speed limits applied by collision avoidance control systems Verification and validation The following verification and validation methods apply: C, D, E, F Hazardous physical contact during human-robot interaction General When tactile interaction between a human and robot is intended during the use of a personal care robot, functions to guarantee human safety during the tactile interaction shall be identified by risk assessment; see the Note in Clause The following aspects shall be taken in consideration: a) detection of humans in the robot s maximum space; ISO 2011 All rights reserved 29

36 b) during the intended tactile interaction, the physical reaction from the robot to humans shall be designed to be as low as reasonably practicable; c) the robot shall be designed, as reasonably practicable, to avoid unintended tactile interaction with other parts of the robot other than those intended for the interaction Inherently safe design In all application tasks involving physical human-robot interaction, a personal care robot shall be designed to reduce as reasonably practicable any levels of skin-robot friction, shear stresses, dynamic shocks, torques, arcs of centre of gravity, weight-bearing transfers and supports of the human body Safeguarding and complementary protective measures Safety-related force limiting control as mentioned in Clause Information for use Instructions shall be provided in the documentation as to how users should operate the robot in order to avoid injury, and warnings shall be provided about the potential injuries that might be sustained if the instructions are not obeyed Verification and validation The following verification and validation methods apply: C, D, G. 5.9 Insufficient durability General Personal care robots shall be designed and built in such a way that their components are selected and assembled in agreement with the applicable standards such that they can withstand the effects to be expected. The following shall be taken into consideration: mechanical stresses materials and their properties vibration and other emissions environmental conditions foreseeable situations derived from the normal operation and operation under abnormal situations (like unexpected turns, accelerations decelerations, collisions, tumbling and adverse environmental conditions) including foreseeable misuse scenarios and situations. A personal care robot shall be designed in a way thermal fatigue is prevented as well as other damage from overheating such as inflammation. The minimum mechanical reliability/durability requirements of the robot shall be determined by its risk assessment Inherently safe design One or more of the following measures shall apply: 30 ISO 2011 All rights reserved

37 a) mechanical failure shall be prevented by adherence to appropriate standards such as ISO 13823, ISO and ISO (informative); b) overload prevention measures should be incorporated into a personal care robot s design, including those mechanisms described ISO If used, the mechanisms shall comply with appropriate established standards, for example, the design of pressure-limiting valves, depending on the fluid technology (hydraulic, pneumatic, etc.) used, shall comply with appropriate international standards, including (but not limited to) ISO 4126 Parts 1-7 and 9; c) fatigue limits for robot components that are subject to variable stresses shall comply with appropriate standards; d) static and dynamic balancing of rotating components shall comply with appropriate international standards; e) the design of electrical devices, especially electrical harnesses and connectors shall take into account the expected number of use cycles; f) inclusion of passive heat dissipation (e.g. by conduction or convection) Safeguarding and complementary protective measures One or more of the following measures apply: a) control functions to monitor/ regulate the applied forces as mentioned in Clause 6.7; b) control functions to monitor/ regulate that the functionality of the electrical cables and connectors is correct; c) use of active heat dissipation methods (e.g. with fans or other cooling systems); d) where necessary, temperatures inside the personal care robot, especially near heat sources shall be monitored. The robot shall react in an appropriate way (e.g. shutting itself off in a safe manner), if temperature limits, determined by risk assessment are exceeded; e) in case the available internal energy or stored power, e.g. battery power, falls below a certain threshold, 1) the robot shall notify its status to the user and/or operator by suitable means such as audio, light, vibration, etc. indications; 2) come into a safe state automatically in case the battery power level falls further lower. If the robot s risk assessment determines that insufficient mechanical reliability/durability presents a significant hazard risk, then any control functions described in items a) to e) which are selected as safeguards shall comply with Clause Information for use If replacement of the electrical connection harness is required in order to protect the personal care robot from unwanted electrical noise caused by the harness, the use limit of the electrical connection harness shall be depicted in the Information for use based upon the frequency of the connection/ disconnection of the harness. If electrical power is supplied directly (with electrical cables), the use limit of the electrical connector shall be depicted in the Information for use based upon its frequency of connection/ disconnection Verification and validation The following verification and validation methods apply: E, H. ISO 2011 All rights reserved 31

38 5.10 Incorrect autonomous actions General A personal care robot that is designed to make autonomous decisions and actions, shall be designed to ensure that wrong decisions and incorrect actions do not cause an unacceptable risk of harm. EXAMPLE A mobile servant robot grasping the wrong drink and serving water instead of coffee in a cup may be an acceptable risk, whereas serving a broken glass container may be an unacceptable risk. The risk of harm occurring as an effect of incorrect decisions can be lowered either by increasing the liability of the decision (e.g. by better sensors) or by limiting the effect of a wrong decision (e.g. by narrowing the limits of use) Inherently safe design One or more of the following requirements shall be met: a) constraining the operational scenarios to ensure incorrect actions cannot lead to unacceptable harm; b) use of unique identifiers to identify objects, travel paths, etc Safeguards and complementary protective measures One or more of the following requirements shall be met: a) the capability/ liability of sensors and sensing algorithms shall be increased to a level where no unacceptable risk occurs; b) identification algorithms shall be designed in a way that the probability of a certain decision being correct (e.g. probability of having identified a certain object correctly) is calculated and can be monitored. Decisions with a high uncertainty shall be re-evaluated with better conditions, or external assistance shall be sought or a controlled stop shall be initiated; c) validity checks shall be made on all safety-related decisions; EXAMPLE 1 The correct identification of an object can be checked by taking into account the place where it is found or the time and place where this object was seen the last time. EXAMPLE 2 A person carrier robot can double check the user commands (by requesting reconfirmations) to ensure that the navigation requested is appropriate. d) decisions shall be verified by diverse sensing principles. All robot functions implementing requirements a) to d) shall comply with Clause 6.1, in accordance with the robot s risk assessment Documentation The limits of use shall exclude situations in which decisions cause an unacceptable risk of any harm, taking into account foreseeable misuse. The documentation shall inform about the sensing and decision making capabilities of the personal care robot and shall give instructions how to prevent harm from taking wrong actions and decisions Verification and validation The following verification and validation methods apply: B, C, D, F. 32 ISO 2011 All rights reserved

39 5.11 Contact with moving components General Personal care robots shall be designed so that the risk of hazards caused by exposure to components such as motor shafts, gears, drive belts, wheels, tracks or linkages is acceptable Inherently safe design One or more of the following design measures shall apply: a) The robot shall be designed with the minimum number of accessible moving parts. b) The robot shall be designed with moving parts in which components such as motor shafts, gears, drive belts, wheels, tracks or linkages are not exposed Safeguards and complementary protective measures Hazards due to moving parts shall be prevented either by fixed guards or by movable guards. One or more of the following protective measures shall be satisfied: a) Where fixed guards are used, the following requirements shall apply: 1) Fixed guards shall be installed so that they can be opened or removed only with tools. 2) Their fixing system shall remain attached to the guards or to the robot when the guards are removed. 3) Where possible guards must be incapable of remaining in place without their fixings. b) Where movable guards are used, the following requirements shall apply: 1) Movable guards shall be placed securely so that they do become removed easily; 2) Movable guards shall be interlocked with the hazardous movements in such a way that hazardous movements come to a stop before the hazards can be reached in accordance with ISO c) Enclosures shall be used to provide protection against rotating components if deemed necessary by risk assessment Documentation Where fixed or movable guards are incorporated into a robot design, documentation shall include all instructions necessary for their correct installation, adjustment and removal Verification and Validation The following verification and validation methods apply: A, B, H. 6 Safety-related control system requirements 6.1 General Where protective measures are implemented through a control system, the requirements of Clause 6 shall apply. The required performance level (PL) or safety integrity level (SIL) of the control system functions (electric, hydraulic, pneumatic, and software) of a personal care robot shall be determined by risk assessment and shall comply with either ISO or IEC ISO 2011 All rights reserved 33

40 Requirements in these standards should be used for the respective safety-related systems for which they are intended. An appropriate overview about safety-related control system performance shall be included in the Information for use. Other standards offering alternative performance requirements, such as control reliability, may also be used (such as Clause in ANSI /RIA R ). When using these alternative standards to design safetyrelated control systems an equivalent level of risk reduction shall be achieved. If one or more of the following functions are used for risk reduction instead of inherent safety measures, a PL or a SIL shall be defined for each of the used functions: a) Cooling fan control (5.9.3c); b) Energy management (5.9.3e); c) Temperature control (5.9.3c, 5.9.3d); d) Laser-based transducer control ( ); e) Static stability control ( ); f) Dynamic stability control ( , ); g) Collision management ( , ); h) Embarkation management ( a); i) Safety-related force limiting control (5.9.3a, 6.7); j) Fault monitoring/diagnostics (5.9.3b); k) Robot application functions (5.10.3); l) Emergency stop ( ); m) Controlled stop ( ); n) Software-controlled limits to the robot workspace (6.3); o) Speed restriction and safety-related speed control (6.5); p) Non-contact sensing (5.4.3b, 6.6.2); q) Contact sensing (5.4.3a, 6.6.3); r) Force restriction and safety-related force control (6.7). The associated requirements from ISO or IEC shall be met. 6.2 Robot stopping The personal care robot shall be designed to ensure that it comes to a safe stop without causing any hazardous rollovers, runaways, or drops of robot parts and loads in case of an intended braking at any speed. The halt states may vary depending upon a robot type, and thus the halt states of a robot shall be defined by the robot manufacturer. If the halt state is achieved and maintained by the robot s normal speed control function, the function shall comply with Clause 6.1. When the halt state is achieved by an independent stopping function, it shall be achieved only by a braking mechanism, to which the following requirements shall be applied: 34 ISO 2011 All rights reserved

41 a) it shall operate on interruption of the power supply, where applicable; b) it shall stop the personal care robot within the operating range of the supplied object detection device(s) taking into account the specified limits on all parameters such as, load, speed, travel surface coefficient of friction and gradient and wear condition of the robot s parts; c) it shall maintain the personal care robot and its maximum allowable load stationary on the maximum operational travel surface gradient specified by the manufacturer; d) it shall operate on loss of critical control functions Robot stopping functions General The personal care robot shall have a controlled stop function. An independent emergency stop function shall be installed if it is required by the risk assessment. Optionally these functions can have provision for the connection of external protective devices, and an emergency stop output signal may be provided. Table 2 provides a comparison between emergency stop and controlled stop functions. NOTE In some applications, a controlled stop includes providing driving power to maintain system stability. An example of this could be a walking personal assistant robot. Table 2 Comparison of emergency and controlled stops Emergency stop Controlled stop Purpose Emergency Safeguarding or risk reduction Location initiation mechanism Initiation Safety-related system performance of Operator has quick, unobstructed access Manual Shall meet performance in Clause 6.1 For controlled stops initiated by noncontact sensing, initiation distances are determined by the minimum (safe) distance formulas described in ISO Manual, automatic or may be automatically initiated by a safetyrelated function Shall meet performance in Clause 6.1 Reset Manual only Manual or automatic Use frequency Infrequent Often to infrequent Effect Emergency stop Remove energy sources to stop propagating the hazardous situation Safely control the safeguarded hazard If an emergency stop capability is required, each command device capable of initiating robot motion or other hazardous situation shall have a manually initiated emergency stop function that: a) complies with requirements of Clause 6.1 and IEC and takes precedence over all other robot controls; b) causes all controlled hazards to stop; ISO 2011 All rights reserved 35

42 c) removes drive power from the robot actuators if the robot is in a condition of the safe stand-still; d) provides capability for controlling hazards controlled by the robot system; e) remains active until it is reset; and f) shall only be reset by manual action that does not cause a restart after resetting, but shall only permit a restart to occur; Selection of a category 0 or category 1 stop for the function shall be determined from the risk assessment according to IEC When an emergency stop output signal is provided: the output shall continue to function when the robot power is removed; or if the output does not continue to function when the robot power supply is removed, an emergency stop signal shall be generated. The emergency stop device shall be in accordance with IEC and ISO Controlled stop The personal care robot shall have one or more controlled stop functions. The categories of these stop functions (as described in IEC ) shall be determined by risk assessment for the application. These stop functions should control the safeguarded hazards by causing a stop of all robot motion, removing or controlling power to the robot drive actuators, and allowing for the control of any other hazard controlled by the robot system. The stop may be initiated manually or by control logic. In case of manual initiation, the restart shall be initiated manually. The controlled stop function performance shall comply with the requirements of Clause 6.1. The robot may have a controlled stop function using stop category 2 as described in IEC , that does not result in drive power being removed but does require monitoring of the stand-still condition after the robot stops. Any unintended motion of the robot in the safe stand-still condition or failure of the controlled stop function should result in a category 0 stop, according to IEC , as determined by risk assessment. The safe stand-still and monitoring function performance shall comply with Clause 6.1. NOTE This can include a monitored category 2 stop function according to IEC provided by an electric power drive system, which corresponds to a safe operational stop according to IEC Software-controlled limits to the robot workspace Space limiting is used to define a geometric volume for either constraining the robot motion within the defined volume, or for preventing the robot from entering it (inclusion and exclusion zones). Software limits are permitted as a means to define and reduce the restricted space, provided they can affect a stop of the robot at full rated load and speed. The restricted space shall be bounded by the actual expected stopping position that accounts for the stopping distance travel. The manufacturer shall state the capability in the Information for use and shall disable the software limits if this capability is not supported. Control programs that monitor and perform joint and space limiting functions based on software limits shall comply with Clause 6.1 and be changeable only by authorized personnel. If the software limit is violated, a safe state shall be initiated. Motion during a limit violation shall be under restricted speed control as described in Clause 6.5. Information on the active settings and configuration of the safety limits shall be capable of being viewed and documented with a unique identifier so that changes to the configuration can be easily identified. 36 ISO 2011 All rights reserved

43 6.4 Singularity protection The robot shall be provided with the means to avoid or pass through singularities without inducing unacceptable risk or damage as determined by risk assessment. 6.5 Speed restriction and safety-related speed control The allowable speed of the personal care robot s accessible moving parts shall be determined by risk assessment. Where practicable the speed of the end-effectors of the manipulator and robot parts shall: be restricted by the design of the robot such that it lacks the physical power to be able to exceed the maximum speed; or use feedback control to ensure that the maximum speeds of the moving parts do not exceed the specified limits. The speed of the personal care robot shall be controllable at selectable speeds. When provided, safety-rated speed control shall be designed and constructed so that in the event of a fault, the speed of the manipulator s end-effector and other robot parts shall not exceed the defined limits and a safe state shall be issued when a fault occurs. The performance of the safety-rated speed control shall comply with Clause Safety-related environmental sensing General An appropriate object detection function shall be incorporated within the personal care robot following a proper risk assessment for the intended use. The objects to be detected may include humans, animals, and other objects in the environment. Object detection devices shall be applied to ensure admissible distances or contact forces between a human or object and a robot. These sensing devices which are used as the input part of safety-related control systems shall be as described in Clause Non-contact sensing If ESPE or non-contact sensing devices are used to detect safety-related obstacles in the proximity of the personal care robot they shall comply with Clause 6.1. ESPE or non-contact sensing devices shall ensure the operational distances and reduce relative speeds to maintain the required level of safety. Safety distances shall be determined by measuring the relative speed between the human body parts and the hazard point, the stopping time, and other relevant factors to ensure reliable intended contacts at all times Contact sensing The functional safety performance of the contact sensing device shall comply with Clause 6.1, unless safe contact is ensured by an inherently safe design by for example, using soft robot materials or having suitably designed mechanisms. NOTE 1 ISO presents principles on pressure sensitive protective devices such as mats and floors for persons weighing more than 20 kg. NOTE 2 ISO presents principles on pressure sensitive protective devices such as edges and bars, to detect objects such as fingers, hands, legs, heads or torsos. NOTE 3 ISO presents principles for the design and testing of pressure-sensitive bumpers, plates, wires and similar devices. ISO 2011 All rights reserved 37

44 The intended contact forces shall be limited to appropriate values as determined by risk assessment; it is advisable to obtain these limits by relying on the tolerance of other technical standards and the tolerances based on ergonomics experimentation Travel surface and geometry detection The functional safety performance of the travel surface and geometry detection system shall comply with Clause 6.1. Any personal care robot capable of autonomous travel shall be capable of detecting the surface geometry and conditions such as uneven terrain, stairs, slippery areas, etc. The robot shall be designed with a means (on-board or off-board) of detecting the surface geometry and travel conditions, and shall be able to detect and judge whether it is capable of travelling through the detected paths or regions. Surface condition detection performance shall be sufficient to allow the robot to evaluate its braking performance in the direction of its intended travel paths. The minimum surface detection performance shall be determined by risk assessment. Braking performance shall be evaluated in such a way that the robot is capable of detecting and avoiding potentially hazardous surface conditions in the path of its travel; functions for travel surface detection and braking distance determination shall be according to Clause 6.1 and all foreseeable operating conditions shall be considered. The following functions shall be provided: a) use of sensors to detect terrain type and travel surface conditions; b) use of software limits within motion or braking algorithms to restrict robot speed such that it can always stop or turn safely; c) prioritisation and scheduling of processing tasks to ensure that travel surface detection can always be performed even under conditions of maximum computational workload; d) where the environment of a personal care robot is equipped with markers, tags, and/or magnetic tapes that can be securely detected by a robot, they shall be placed in sufficient quantity and locations that the robot shall have no blind spots. In order to evaluate the robot performance, it is recommended that various types of surface obstacles (i.e., gaps, bumps, and/or steps) be placed between the robot and its travel destination, then the robot performance shall be checked as to whether it can safely avoid the adverse surface conditions or safely stop without getting stuck. 6.7 Force restriction and safety-related force control The force exerted on a human or surrounding objects by any part of the person care robot shall be controlled within the maximum safe contact criteria such as force limits. Quantitative requirements on the maximum safe contact force/torque should be well-examined by ergonomic experimentation. The limits of the exerted force during unintended contact with a person may differ with application and shall be determined by risk assessment. If the force exceeds the design limits, an appropriate reaction shall be initiated, which does not cause any hazardous situation. The functional safety performance of safety-related force controllers shall comply with Clause ISO 2011 All rights reserved

45 6.8 Actuating controls General Actuating controls that initiate power or motion shall be designed and constructed to meet the performance criteria mentioned in Clause Status indication, Clause Labelling and Clause Protection from unintended operation. The following verification and validation methods apply to the design of actuators: C, E Status indication The status of the actuating controls shall be indicated at all times, e.g. power on, operational mode, fault detected, etc. In the case of remote controls, each control unit shall clearly identify the parts of the personal care robot to be controlled from that unit. The remote control system must be designed and constructed in such a way as to affect only: the parts of the robot in question; the functions in question. A remote controlled personal care robot must be designed and constructed in such a way that it will respond only to signals from the intended control units. The following verification and validation methods apply: A, B Labelling Actuating controls shall be labelled to clearly indicate their function in compliance with ISO The following verification and validation method applies: A, B Single point of control The robot control system shall be designed and constructed so that when the personal care robot is placed under manual control or remote control, initiation of the robot motion or change of the local control selection from any other source shall be prevented. The following verification and validation method applies: B, D, E Protection from unintended operation Actuating controls shall be constructed or located so as to prevent unintended operation. For example, an appropriately designed push-button or key selector switches in appropriate locations may be used Protection against unauthorized use If necessary, steps must be taken to prevent unauthorised use of controls. Means (e.g. password protection) shall be provided for preventing any unauthorized use as determined by risk assessment; for example use of anti-vandalism methods such as key cards and fingerprint recognition devices to avoid unintended robot starts or moves. The manufacturer should consider different levels of access for different users. ISO 2011 All rights reserved 39

46 6.8.7 Operational mode General A personal care robot shall be designed to operate in manual mode or operate in both manual and autonomous modes. (i.e., any robot designed for autonomous operation shall also be designed to operate under manual control.) Changeover between manual and autonomous modes shall be selected by a secure means that locks and exclusively enables only the selected mode; e.g. a key operated switch or other means that provides an equivalent security (i.e. supervisory control). The means of mode selection shall: unambiguously indicate the selected operating mode; and by itself not initiate robot motion or other hazards. Selected operating modes can be visual light signals, audible sound signals, vibrations or other signals so that the robot operator can easily recognise the mode selected. The control or operating mode selected must not override the emergency stop. When switching between modes, any suspended safety functions shall be returned to their full functionality. When provided for safetyrelated purposes, the output(s) shall comply with the requirements of Clause 6.2 Safety-related robot stopping performance. If, for certain operations, the personal care robot must be able to operate with a guard displaced or removed and/or a protective device disabled, the control or operating mode selector must simultaneously: disable all other control or operating modes; permit operation of hazardous functions only by control devices requiring sustained action (hold-to-run); permit the operation of hazardous functions only in reduced risk (e.g. low speed, low force, etc) conditions while preventing hazards from linked sequences; prevent any operation of hazardous functions by voluntary or involuntary action on the machine's sensors. In addition, the operator shall control any moving parts only by means of actuating controls or command devices that are tethered or attached to the robot. Remote controls (see Clauses and 6.8.7) or cableless/detachable command devices (see Clause 6.9.5) shall not be used while the robot is in this mode. Cable lengths for tethered controls operating in this mode shall not exceed the maximum length, width or height of the robot (whichever is greatest). If any of the above conditions become invalid during operation with guards removed, the robot shall perform an emergency stop in accordance with Clause Instructions for operation of the robot in this mode, and warnings regarding any hazards related to operation with guards removed, shall be placed in its Information for Use (see Clause 8) Autonomous mode A personal care robot moves automatically or autonomously under this operational mode. The required safety functions for the autonomous mode defined by risk assessment shall be active and not violated before starting this mode e.g. collision management (Clause 5.8.7), speed restriction and safety-related speed control (Clause 6.5), and environmental sensing (Clause 6.6). There may be scenarios in which human (manual) operation is undertaken within this mode, and that autonomy intervenes in the manual operation. In such a case, where the autonomous process overrides the commands made by the operator, the robot shall be equipped with a means to provide noticeable indication of 40 ISO 2011 All rights reserved

47 the override status to the operator. Override indications (e.g. visible light, audible sound, vibrations, etc.) shall be designed to be easily recognised by the operator. The following verification and validation methods apply: A, D, E Manual mode Manual mode shall meet the requirements of Clause 5.8 and shall allow a robot to be operated by human intervention. Information for use shall contain appropriate instructions and warnings that the operation with manual navigation/ guidance is being performed. A risk assessment shall be carried out to determine which safeguards and protective measures should be active in manual mode to mitigate certain hazards. 6.9 Command devices General When command devices, for example, joysticks, operator control panels, sip-and-puff devices, voice and gesture recognition systems, and/or other means are used to control the personal care robot s functions, they shall have an appropriate reliability in their operation. Whether the command device is tethered or untethered to the robot, its electrical connection to the robot shall not cause hazards. Command devices shall provide control of individual or combined robot functions during manual and semi-autonomous robot control modes. When command devices are in use during manual or semi-autonomous operation, the autonomous operation of functions under the operator s control shall be deactivated. The operator shall be completely responsible for the allowable functions when the robot is under his control Connection and disconnection On connection, disconnection or reconnection of any command device, or if connection problems of the command device occur, the personal care robot shall not cause any harm to the operator or third party. NOTE 1 This includes any correctly performed disconnection of the command devices whether the disconnection is intentional or not. NOTE 2 In the case where a controlled stop or an emergency stop is controlled by means of a command device only, the robot shall come to a controlled stop or a safe state automatically, after an allowable time is lapsed without any confirmation signal. The following verification and validation method applies: A, C, D, E Command device for multiple robots The control and switching of control for multiple personal care robots with one command device shall not cause any harm to the user or any third party. The command device shall control one or more robots independently or at the same time. It shall be clearly visible to the operator which command device controls which personal care robot. Each robot shall be selected before a command can be sent to it. An unexpected start up of any robots not activated shall be prevented. The following verification and validation method applies: A, B, E Multiple command devices Changing the control from one command device to another shall not cause an unacceptable risk to the operator or third party. ISO 2011 All rights reserved 41

48 Only one command device shall have control authority at any time. Before control can be transferred from one command device to another, an explicit changeover action shall be necessary. Each possible command control should always allow a controlled stop. It shall be clearly visible on all control devices, which one is currently active and which is not. The following verification and validation method applies: B, D, E Cableless or detachable command device Where pendant or other teaching devices have no cables connecting to the personal care robot s control system or they may be detached, the following shall apply: a) a visual indication shall be provided that the command device is active, e.g., at the device display; b) loss of communication shall not cause unacceptable risk for all robots being controlled using manual mode (or an autonomous mode where a partial manual mode is used). Any safety action taken shall conclude with a controlled stop; c) when applicable, the maximum response time for data communication (including error correction) and for loss of communication, shall be stated in the Information for use; d) confusion between active and inactive emergency stop devices shall be avoided by providing appropriate storage or design capabilities. Information for use shall contain a description of the storage or design feature. The following verification and validation method applies: A, C, D, E. 7 Verification and validation The risk assessment of a personal care robot (see Clause 4) identifies the required probability of failure for each of its identified hazards. These probability requirements determine whether or not the robot shall be designed in accordance with a safety assurance standard (refer to Clauses 5 and 6), and therefore what activities are necessary for verification and validation. Robot manufacturers shall perform appropriate endurance tests to ensure that the working period is as long as the designed operating life time. The robot manufacturers shall perform load bearing and impact resistance tests in consideration with typical daily use. All safety requirements shall be validated in accordance with their associated validation guidelines. 8 Information for use 8.1 General Information for use shall contain all information and instructions necessary to ensure safe and correct use of the system and shall provide information and warnings to the user about any residual risks. It shall consist of items such as documents, signs, signals, symbols or diagrams, used to convey important safety-related information to the user. Markings (e.g. signs, symbols, etc) and instructional material (e.g. manuals for operation, maintenance, etc) shall be provided by the manufacturer in accordance with ISO 7000, ISO 12100, and IEC When provided, machine warning devices (e.g. audible and visual signals) shall be in accordance with ISO and IEC ISO 2011 All rights reserved

49 The style and content of the different parts of the Information for use should reflect the level of education, technical understanding and competence of the intended user. It should be written in a language appropriate for the intended users. The information shall reflect both the intended use of the personal care robot system and all foreseeable misuse. Where required to mitigate a hazard, the information shall include: a) training requirements; b) personal and third-party protective equipment requirements; and c) requirements for additional guards or protective devices (see ISO 12100). The Information for use of the personal care robot system shall be in accordance with ISO NOTE 1 See also IEC :2001 for structuring and presentation of the Information for use. NOTE 2 See also IEC : 2000, Clause Instruction handbook General The Instruction handbook shall take account of the different phases of the personal care robot s life cyle, including transportation, assembly and installation, commissioning, operational use (including start up, shutdown, setting, teaching / programming or operational mode changeover, operation, cleaning, fault finding and maintenance), de-commissioning, dismantling and final disposal. The instruction handbook shall include the interfaces (physical, mechanical, functional, etc) between the personal care robot system, the intended user and the robot s operational environment. In particular, the instruction handbook shall include information relevant to Clauses through to Clause Handling Information relating to transport, handling and storage of the personal care robot system, e.g.: a) storage conditions for the robot; b) dimensions, mass, position of the centre of gravity; c) indications for handling, e.g. drawings indicating application points for lifting (manually or by equipment) as appropriate Assembly and commissioning Information relating to assembly and commissioning of the personal care robot system, e.g.: a) assembly, set-up and mounting conditions; b) space needed for operation and maintenance; c) permissible environmental conditions (e.g. indoors, outdoors, dust, wind, temperature, moisture, vibration, electromagnetic radiation, etc.); ISO 2011 All rights reserved 43

50 d) instructions for connecting the robot system to power supplies (particularly about protection against electrical overloading); e) advice about cleaning and maintenance; f) if necessary, recommendations about protective measures which have to be taken by the user; e.g. additional safeguards (see ISO 12100), safety distances (see ISO 13857), safety signs and signals; g) instructions for how the initial test and examination of the robot system and its guarding system are to be carried out before first use and being placed into routine operation, including functional testing of reduced speed control systems System information Information relating to the personal care robot system itself, e.g.: a) detailed description of the robot, its fittings, its guards and/or protective devices; b) comprehensive range of applications for which the personal care robot is intended, including prohibited usages, if any, taking into account possible variations of the robot if appropriate; c) safety requirements specification describing the safety functions performed by the control system and their safety integrity, stopping mechanisms, safety controllers, safe communications, etc; d) other control functions and user interfaces; e) diagrams (layout, control, electrical, hydraulic, pneumatic etc); f) data concerning other hazards, for example, EM radiation, gases, vapours, dust and vibration generated with reference to the measuring methods used; g) technical documentation about electrical equipment (see IEC series); h) specifications for equipotential bonding requirements (grounding). Electrical ground (equalising potential) shall be provided in accordance with IEC ; i) documents attesting that the robot system complies with mandatory requirements; j) end effector (if necessary), load analysis, energy losses and human intervention considerations Use of the system Information relating to the use of the personal care robot system, e.g.: a) intended use; b) where the robot is intended for professional use, information on the level of required qualification and experience of the user, and robot specific training that will be necessary before using the robot; c) where the robot is intended for personal use, information on user-specific requirements such as, e.g. mental and/or physical fitness/state, age limitations, etc. of the user to operate the personal care robot; d) where applicable, type of energy source, and where batteries are used the recharging limitations and associated hazards; e) task zones and associated residual risks (see ISO 11161); f) risks which could not be eliminated by the protective measures taken by the designer; 44 ISO 2011 All rights reserved

51 g) particular risks which may be generated by certain operations, by the use of certain fittings, and about specific safeguards which are necessary for such situations; h) reasonably foreseeable misuse and prohibited usages; i) description of controls (actuators), enabling devices and controlled stops; j) modes and means for stopping (especially the emergency stop, when fitted); k) fault identification and location, repair, and re-starting after an intervention; l) personal protective equipment which need to be used and the training required; m) instructions for any test or examination necessary after change of component parts or addition of optional equipment (both hardware and software) which can affect the safety functions Maintenance Only authorized personnel shall be permitted to maintain, repair, adjust and inspect personal care robots. Modifications and/or additions to hardware or software, which affect rated capacity, safe operation, or any emergency control or device, shall not be performed without the manufacturer s verifiable approval. Where such authorization is granted, capacity, operation, and maintenance instruction plates, tags, or decals shall be changed accordingly; Care shall be taken to ensure that all replacement parts are interchangeable with the original parts and of a quality and performance at least equal to that provided in the original equipment. Information for maintenance shall be provided; this should include: a) nature and frequency of inspections for safety functions (for example when unexpected power failure occurs); b) instructions relating to maintenance operations which require a definite technical knowledge or particular skills and hence should be carried out exclusively by skilled persons (e.g. maintenance staff, specialists, etc); c) instructions relating to maintenance operations (e.g. replacement of consumable parts) which do not require specific skills and hence may be carried out by general lay users; d) drawings and diagrams enabling maintenance personnel to carry out their task rationally (especially fault finding tasks) De-commissioning Information relating to de-commissioning, dismantling and disposal Emergency situations & procedures Information for emergency situations and procedures, e.g.: a) type of fire-fighting equipment to be used; b) warning about possible emission or leakage of harmful substance(s); and if possible, c) means to fight their effects; d) emergency stop if deemed necessary; ISO 2011 All rights reserved 45

52 e) range of stopping options Robot specific Information specific to the personal care robot, for example: a) information according to ISO 9946; b) information according to ISO 9283; c) additional information specific to personal care robots required (mobile servant, physical assistant, and person carrier) Quality and compliance statements Wherever compliance with a standard has been used as the basis for any part of the safety case statements, marks, logos, compliance certificate numbers, and other words or symbols necessary to indicate that compliance has been achieved to the required level shall be provided. Quality and compliance statements for the personal care robot may include the following categories, depending on the product or application in question: a) certificates of product s compliance with functional safety standards, e.g. ISO or IEC 62061; b) certificates of manufacturer s compliance with quality assurance standards, e.g. ISO 9000:2005; c) manufacturing quality symbols, e.g. EC or BSI Kite-marks ; d) electromagnetic compatibility, e.g. EC Directives, IEC, ISO, CENELEC standards; e) electrostatic Immunity (inability to generate sparks); f) telecommunications interface/protocol standards, e.g. for remote controls/locks, wireless communication links, remote sensors; g) electrical power supply and connector standards; h) other connector standards, e.g. mechanical connectors; i) environmental compatibility standards, e.g. disposal or recycling standards; j) bio-compatibility/ medical sterility; k) materials safety, e.g. for toxicity, bio-degradability, life limits; l) fireproofing; m) waterproofing / humidity tolerance; n) corrosion resistance, e.g. to materials handled by the robot, battery acids, etc.; o) acoustic compatibility standards, for devices such as sonar sensors; p) radiation emissions and tolerance (e.g. for home, workplace or industrial applications); q) user interfaces (e.g. conformance of signs and symbols graphics); r) user access (security, childproofing, un-authorised use). 46 ISO 2011 All rights reserved

53 8.3 Marking The personal care robot shall be marked visibly, legibly and indelibly with the following minimum particulars: a) the business name and full address of the manufacturer and, where applicable, his authorised representative; b) designation of the personal care robot; c) designation of series or type; d) serial number, if any; e) the year of construction, that is the year in which the manufacturing process is completed. ISO 2011 All rights reserved 47

54 Annex A (informative) List of significant hazards for personal care robots One of the essential steps in performing a risk assessment, as described in ISO 12100, is a hazard identification analysis. This form of analysis is a systematic procedure to identify potential hazards that can be caused by a system or machine, based on some aspect of its general specification. Systematic procedures can involve analysis of its functional specifications or interfaces, of hazards experienced with similar products already developed, or they may use comprehensive sets/lists of generic hazard types. Given the wide range of possible applications of personal care robots, it is not practicable to produce a single list of hazards that can provide comprehensive coverage of all relevant hazards. However, it is possible to provide a minimum list of hazards that all applications should aim to account for in the results produced by following any specific hazard identification methodology as described above. For each category of personal care robot covered by this standard, a list has been provided in this Annex as a recommendation for the minimum coverage that should be achieved by any given hazard identification exercise. The results of the specific hazard identification methodology should be compared with the relevant list, and if the results are found not to cover the entire set of hazards in the list then the hazard identification results should be extended or augmented to cover the remaining hazards. While this procedure is not a normative requirement for compliance with this standard, it is recommended as a way of achieving a basic level of quality in the hazard identification process for any personal care robot. Tables A.1 A.3 cover mobile servant robots, physical assistant robots and person carrier robots, respectively. Each table provides basic coverage of all the hazards for which requirements have been defined in Clauses 5 and 6. Table A.1 Mobile servant robot No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 1 mechanical hazard mobile servant robot machinery mobility crushing bumper and surroundings 2 gravity, stability crushing main body and floor 3 acceleration (kinetic energy) being run over main body and floor 4 angular parts stabbing end tip 5 moving elements crushing 6 rotating elements drawing-in end effector and objects tyre and main body 48 ISO 2011 All rights reserved

55 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 7 sharp edges cutting or severing covering etc. 8 electrical hazards electromagnetic phenomena effects on medical implants associated circuit 9 electrostatic phenomena electric shock outer covering 10 live parts, terminals of battery electric shock terminals of battery 11 overload fire associated circuit 12 parts which have become live under fault conditions electric shock conductive covering 13 short-circuit fire battery 14 network disconnection runaway wireless comm. device 15 thermal hazards systems and circuits with high temperature burn heat dissipation sinks 16 noise hazards 17 vibration hazards 18 radiation hazards optical radiation damage to eyes laser range sensor 19 material/ substance hazards sensitization outer covering 20 fume sensitization lubrication part 21 ergonomic hazards design or location of indicators and visual displays units discomfort display 22 posture musculoskeletal disorder handle, etc 23 visibility any other as a consequence of human error exterior ISO 2011 All rights reserved 49

56 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 24 hazards associated with operational environment dust any other as a consequence of effect caused by the sources of hazards on the machine or parts of the robot mobile mechanism relevant IP protection rating required (IEC 60529) 25 dust any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot catching fire associated circuit relevant IP protection rating required (IEC electromagnetic disturbance any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot: runaway bumper and surroundings, tyre and main body 27 snow, water tyre slipping tyre relevant IP protection rating required (IEC 60529) 28 moisture, snow, water any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot: short circuit due to water electric circuit 29 heat source burn outer covering 30 low-stability structure 31 vandalism falling/ crushing 32 pet's gnaw, etc. pet 33 step falling / crushing main body, movable part main body, movable part mass / shape of main body 34 combination of hazards unexpected motion due to human contact falling main body elderly person 50 ISO 2011 All rights reserved

57 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 35 Destroying or destabilizing objects in the environment cutting, crushing, impact, electrical shock moving parts of the robot and the environment 36 Control system wrong actions and decisions of the robot crushing, impact and other harms sensors of the robot 37 software bug runaway control software Table A.2 Physical assistant robot No 1 Hazard item mechanical hazard Personal care robot type physical assistant robots Source of hazard falling objects 2 own weight Hazard sample Potential consequence impact 3 falling objects impact 4 5 thermal hazards runaway of robots (control malfunction) objects or materials with a high or low temperature musculoskeletal disorder musculoskeletal disorder burn/ chill electrical 6 hazards 7 emergency stop musculoskeletal 8 9 material/subs tance hazard ergonomic hazards Associated hazardous area, zone end effector and floor main body main body and floor main body main body live parts shock, burn main body allergic material mental overload/ underload disorder cutis inflammation 10 effort, posture fatigue fatigue, stress 11 visibility fatigue, stress 12 design, location or identification of control devices musculoskeletal disorder main body main body main body task environment task environment main body Remark 13 software bug runaway control software ISO 2011 All rights reserved 51

58 Table A.3 Person carrier robot No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 1 2 mechanical hazard person carrier robot in normal operation same contexts as in the mobile servant robot applicable to surrounding persons machinery mobility gravity, stability crushing impact main body and environment person and floor 3 acceleration (kinetic energy) impact person and wall 4 rotating elements drawing-in tyre and main body 5 robot mobility slipping, tripping and falling main body 6 height from the ground slipping, tripping, and falling floor when disembarking from the vehicle 7 electrical hazards electromagnetic phenomena effects on medical implants associated circuits 8 electrostatic phenomena electric shock outer covering 9 live parts electric shock 10 overload fire terminals of battery associated circuit 11 parts which have become live under fault conditions electric shock conductive covering 12 short-circuit fire battery 13 thermal hazards circuit with high temperature burn heat dissipation of circuits 52 ISO 2011 All rights reserved

59 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 14 noise hazards 15 vibration hazards mobile equipment discomfort, loss of awareness cabin 16 radiation hazards 17 material/subst ance hazards sensitization covering possibly in touch with person 18 fume sensitization lubrication part 19 gas breathing difficulties/ suffocation source of energy 20 ergonomic hazards design or location of indicators and visual displays units discomfort display 21 design, location or identification of control devices fatigue, stress console 22 posture discomfort, fatigue, stress cabin 23 visibility any other as a consequence of human error 24 cooped-up discomfort, stress, fear, trauma cabin 25 overspeed discomfort, stress, fear, trauma cabin 26 hazards associated with operational environment dust any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot mobile mechanism ISO 2011 All rights reserved 53

60 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 27 electrical hazards dust any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot associated circuits 28 electromagnetic disturbance any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot person and environment 29 snow, water slipping tyre 30 moisture, snow, water any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot electric circuits 31 temperature burn covering 32 temperature any other as a consequence of effect caused by the sources of the hazards on the robot or parts of the robot associated circuits 33 surrounding rigid structure impact with the structure person and the structure 34 other people, bicycle fall due to collision with the surroundings other people, bicycle 35 car being run over person and robot 36 child's vandalism falling / crushing main body, movable part 37 pet's gnaw, etc. pet main body, movable part 54 ISO 2011 All rights reserved

61 No Hazard item Personal care robot type Source of hazard Hazard sample Potential consequence Associated hazardous area, zone Remark 38 big step fall from the step step 39 small-sized step fall due to imbalance step 40 pollution infection disease main body 41 combination of hazards warning from robot accident without attention to abnormal operation abnormal operation warning measures 42 mismatch with person's reflective performance fall due to imbalance control algorithm 43 software bug runaway control software 44 impact collision falling due to abnormal operation manoeuvre 45 impact collision falling due to sudden emergency stop 46 impact collision falling due to brake malfunction 47 impact collision falling due to lowbattery power ISO 2011 All rights reserved 55

62 Annex B (informative) Safety criteria for personal care robots Determination of safety distance d s in conjunction with relative speed (Estimated maximum relative speed of human or human body part) (Stopping time of personal care robot) + α(consideration of other factors eg. allowed contact criteria) Figure B.1 Safety distance and maximum relative speed in the proximity of the personal care robot The safety distance d s shall be determined by risk assessment to ensure safe contact in the event of unintended contact. d s may differ depending on applications and various ways of relative speed are permitted outside of d s. 56 ISO 2011 All rights reserved

63 Annex C (informative) Examples of functional tasks for personal care robots Class of mobile servant robot Mobile servant robot in domestic environments or public buildings Table C.1 Mobile servant robots Functional tasks that need to be performed Travelling in domestic environments or public buildings while avoiding collisions with stationary and moving obstacles. This may include pose-to-pose motion and full area coverage. Interaction with humans including object exchange. The robot can have an active or passive role. Handling of small and medium sized objects, including grasping, manipulating, transporting, placing and handing over the object Handling large objects possibly having constraints, e.g. opening a door, a window, a drawer, a dish-washer etc. which may include travelling in order to extend the workspace Table C.2 Physical assistant robots Class of physical assistant robot Functional tasks that need to be performed Leg motion assistive device Applying cooperative control to user s thighs in order to control the stride and to achieve comfortable walking. Body weight supportive device Reducing the load on leg, hip, knees, and ankles while standing or walking by supporting part of the user s bodyweight. ISO 2011 All rights reserved 57

64 Exoskeleton wearable robot Physically supporting a person and manipulating body parts through direct interaction and fixtures to a person, e.g., straps or clamps. Enabling the user to carry loads above average human strength. Wearable robot Providing fixture directly to a person without invasion, e.g., straps and clamps to provide direct interaction for dexterous manipulation. Enabling the user to carry loads similar to that of an able bodied person. 58 ISO 2011 All rights reserved

65 Class of person carrier robot Carrier with passenger standing on the foothold Table C.3 Person carrier robots Functional tasks that need to be performed Physically transporting a person from one location to another on smooth surface, either autonomously or manually, using wheeled mobile platform. The travel direction is controlled by shifting the passenger s weight on the base foothold. Legged passenger carrier Physically transporting a person from one location to another on any 3D surfaces, either autonomously or manually, using legged mobile platform. Carrier whose passenger sits on a monocycle Physically transporting a person from one location to another on smooth surface, either autonomously or manually, using a wheeled mobile platform. The travel direction is controlled by shifting the passenger s weight. Wheeled passenger carrier Physically transporting a person from one location to another on smooth surfaces, either autonomously or manually, using a wheeled mobile platform. ISO 2011 All rights reserved 59