STATERA Library · Series 07 · Volume 22 · HRS-010 · EN
Source: https://github.com/Statera-Library/07_Vol_22_Robotics_Engineering_Standards/blob/main/HRS_010_Manipulator/HRS_010_Manipulator_EN.md

Volume 22. Hills Robotics Engineering Standards

Chapter 10. HRS-010 Manipulator

10.01. Servo Network Standard

The servo network shall provide a deterministic and maintainable communication architecture for all manipulator joint actuators, servo drives, motor controllers, and associated feedback devices. The network shall support coordinated multi-axis motion while preserving predictable command latency, synchronized feedback acquisition, fault containment, and diagnostic visibility throughout the manipulator lifecycle.

EtherCAT shall be the preferred servo communication technology for manipulators requiring tightly synchronized multi-axis motion, high update rates, or distributed servo control. CAN FD may be applied to lower-bandwidth actuators, auxiliary axes, grippers, or mechanisms where deterministic cyclic performance remains adequate. Conventional CAN shall be restricted primarily to legacy devices or interfaces whose bandwidth and timing requirements justify its use.

The servo network architecture shall separate real-time motion traffic from general-purpose robot communication whenever practical. Joint position, velocity, torque, current, status, and synchronized control commands shall remain within the deterministic motion domain, while configuration, logging, visualization, maintenance, and non-critical application data should be handled through separate Ethernet, CAN, or higher-level robot communication paths.

A manipulator shall use a clearly defined master-to-drive topology. The motion controller or real-time control computer shall act as the authoritative source for cyclic servo commands, while each drive shall have a unique and traceable network identity. Device addresses, axis numbers, joint names, physical connector locations, and software identifiers shall be mapped consistently so that electrical drawings, software configuration, diagnostics, and service documentation identify the same axis.

Servo communication cycle time shall be established from the manipulator control bandwidth, number of axes, drive capability, payload dynamics, and required trajectory accuracy. The selected cycle shall include sufficient timing margin for command transmission, feedback collection, synchronization, controller computation, and network jitter. Cycle-time assumptions shall be documented and verified under maximum configured network load rather than only under nominal laboratory conditions.

All axes participating in coordinated motion shall operate from a common time reference or equivalent synchronization mechanism. EtherCAT Distributed Clocks or an approved functionally equivalent mechanism should be used where sub-millisecond coordination is required. Synchronization performance shall be validated at the end devices because acceptable master timing alone does not demonstrate that actual actuator command execution and feedback sampling are sufficiently aligned.

The network shall define standardized process data for each servo axis. At minimum, the interface should provide control state, commanded position or velocity or torque, measured position, measured velocity, measured torque or current, drive state, fault state, temperature information when available, and communication health. Scaling, units, signed representation, byte order, valid ranges, and update behavior shall be explicitly specified.

Servo operating states shall follow a controlled transition model covering initialization, communication establishment, servo-disabled state, servo-ready state, motion-enabled state, controlled stop, fault reaction, and recovery. Motion shall not begin solely because network communication becomes available. The controller shall verify required drive states, encoder validity, safety conditions, configuration compatibility, and axis readiness before enabling torque or accepting coordinated trajectory commands.

Communication faults shall cause deterministic and documented reactions. Loss of cyclic commands, excessive packet errors, synchronization failure, stale feedback, invalid process data, or disappearance of a servo node shall be detected within specified time limits. Each axis shall implement an appropriate watchdog, while the supervisory controller shall determine whether the resulting system reaction requires controlled deceleration, torque disable, holding behavior, or immediate safety intervention.

Network fault handling shall distinguish communication integrity from functional safety. A standard EtherCAT or CAN communication channel shall not be treated as a safety mechanism unless an approved safety protocol and certified components are explicitly implemented. Emergency stop, protective stop, safe torque off, safe brake control, and other safety functions shall follow the manipulator safety architecture independently of ordinary servo command availability.

Physical network design shall account for the electrical environment created by motors, inverters, brakes, and rapidly switched power electronics. Servo communication cables shall use approved impedance, shielding, connector, and termination practices appropriate to the selected protocol. Communication harnesses shall be routed with adequate separation from motor phase conductors and other high-noise circuits, while shield termination and grounding shall follow the applicable grounding and EMC standards.

Cable routing through moving joints shall consider continuous flexing, torsion, minimum bend radius, abrasion, strain relief, and expected manipulator motion cycles. Connectors located near joints shall be mechanically retained against vibration and repeated motion. Cable length, connector count, intermediate couplers, slip rings, and flexible cable sections shall remain within the electrical and signal-integrity limits specified for the selected servo network technology.

The servo power domain and servo communication domain shall be documented together even when physically separated. Designers shall identify drive supply voltage, control supply, encoder or feedback supply, communication interfaces, grounding references, brake circuits, and safety interfaces for every axis. Power sequencing shall prevent undefined drive behavior during startup, shutdown, brownout, controller reset, or partial restoration of manipulator electrical power.

Network utilization shall include engineering margin for future configuration changes and diagnostic traffic. The design shall not depend on theoretical maximum bandwidth as its normal operating point. Additional axes, higher feedback rates, drive diagnostics, tool-mounted actuators, and end-effector interfaces shall be considered when establishing capacity. Any topology change affecting deterministic timing shall require communication performance verification before release.

Servo network diagnostics shall expose sufficient information to identify intermittent and persistent failures without unnecessary component replacement. Required diagnostic data should include node state, communication error counters, synchronization deviation, watchdog events, drive faults, bus voltage where available, motor current, temperature, encoder status, and reset history. Diagnostic timestamps shall be correlated with the robot controller time base whenever technically practical.

Commissioning shall verify node identity, axis mapping, communication state transitions, command direction, encoder polarity, position scaling, velocity scaling, torque scaling, synchronization, watchdog behavior, and fault recovery before unrestricted motion is permitted. Initial movement shall use controlled speed and torque limits. Each joint shall be confirmed individually before coordinated multi-axis operation, and incorrect mapping shall be treated as a release-blocking defect.

Configuration data shall be version controlled as part of the manipulator electrical and software baseline. This includes servo drive parameters, network topology, device descriptions, process-data mapping, axis identifiers, communication cycle settings, synchronization parameters, watchdog values, and firmware compatibility information. Replacement of a drive or actuator shall not require undocumented manual reconstruction of production parameters.

Changes to servo firmware, network cycle time, topology, process-data mapping, actuator type, encoder configuration, or control mode shall trigger an impact assessment. Changes capable of affecting timing, stability, motion accuracy, fault response, or safety interaction shall require regression testing at axis and manipulator level. Production release shall maintain traceability between hardware revision, drive firmware, controller software, and network configuration.

Verification shall include nominal operation and intentionally introduced fault conditions. Testing shall demonstrate startup, shutdown, repeated enable and disable cycles, maximum axis activity, maximum expected network loading, communication interruption, node loss, controller restart, power cycling, synchronization disturbance, and recovery behavior. Acceptance criteria shall be measurable and reproducible rather than based solely on observation of apparently normal robot motion.

The approved servo network implementation shall ultimately provide a common engineering baseline across manipulator products while allowing controlled variation for axis count, actuator performance, and application requirements. Compliance shall be demonstrated through architecture documentation, configuration records, electrical drawings, network measurements, diagnostic evidence, and test results, enabling reliable integration with the broader robotics electrical architecture defined by the engineering standards structure.

10.02. End Effector Interface Standard

The end-effector interface shall provide a standardized mechanical, electrical, communication, and control boundary between the manipulator wrist and interchangeable tools. The interface shall support grippers, vacuum devices, inspection sensors, process tools, and application-specific mechanisms while maintaining predictable integration behavior. Its definition shall minimize redesign when tools are replaced and preserve compatibility across approved manipulator configurations.

The interface specification shall clearly separate mechanical attachment, electrical power, communication, discrete control, sensing, grounding, and safety functions. Each function shall have defined connection points and ownership boundaries between the manipulator and end effector. Interface documentation shall identify which requirements are mandatory for every tool and which are optional according to tool class, power demand, communication method, or operational risk.

Mechanical attachment shall establish a repeatable tool coordinate relationship and withstand the maximum expected payload, static load, dynamic acceleration, external process force, and emergency-stop loading. Mounting geometry, bolt pattern, locating features, allowable moment, center-of-gravity envelope, and fastening requirements shall be specified. Tool installation shall not rely on uncontrolled mechanical compliance or undocumented alignment procedures.

The end-effector electrical interface shall provide approved voltage rails appropriate to the manipulator architecture. Typical tool power may include regulated low-voltage supplies for sensors and logic and a separate actuator supply for motors, valves, solenoids, or pumps. Available voltage, continuous current, peak current, allowable inrush current, power quality, and total tool power budget shall be explicitly defined for each interface configuration.

Every tool power output shall incorporate suitable circuit protection and shall remain within the rated capacity of the wrist harness, connector contacts, upstream protection device, and manipulator power distribution system. High-current loads shall not be connected to signal or auxiliary power contacts. Tool designers shall document normal consumption, transient demand, startup behavior, regenerative behavior where applicable, and the electrical state expected during shutdown or emergency conditions.

The connector system shall use approved industrial or robotics-grade components selected for current rating, voltage rating, mating-cycle life, vibration, environmental exposure, and service requirements. Power and signal pin assignments shall be standardized to prevent product-specific wiring variations. Unused contacts shall remain reserved or explicitly designated rather than being reassigned without controlled interface revision and compatibility assessment.

Connector keying and pin allocation shall prevent reasonably foreseeable incorrect connections. Power, ground, communication, safety, and discrete I/O contacts shall be clearly identified in drawings and service documentation. Where practical, connector sequencing shall ensure protective ground or reference connections are established appropriately relative to energized circuits. Hot-plug operation shall be prohibited unless both the electrical architecture and connected devices are specifically designed and validated for it.

Communication between the manipulator controller and an intelligent end effector shall use an approved interface such as EtherCAT, CAN FD, CAN, Ethernet, IO-Link, or another explicitly qualified protocol. Protocol selection shall reflect required control bandwidth, latency, determinism, diagnostic capability, cable complexity, and tool interoperability. Real-time actuator control shall not be assigned to a non-deterministic interface without documented performance justification.

The logical interface shall define standardized commands, states, feedback signals, and diagnostic information independently of the physical communication technology where practical. A gripper, for example, should expose consistent concepts such as enable, open, close, target position, force request, actual position, object detection, ready state, and fault state. Application software should not require unnecessary hardware-specific behavior for equivalent classes of end effectors.

Tool identification shall be supported when interchangeable or automatically exchanged tools are used. An intelligent tool should provide a unique type identifier, hardware revision, firmware revision, serial number, and relevant capability information. The manipulator controller shall verify compatibility before enabling tool motion or process power. Unknown, incompatible, or incorrectly configured tools shall enter a defined restricted or fault state rather than operating with assumed parameters.

Discrete input and output channels may be provided for simple devices such as pneumatic valves, proximity switches, vacuum switches, trigger signals, or status indicators. Voltage levels, sourcing or sinking behavior, current limits, logic polarity, default states, filtering, and diagnostic behavior shall be standardized. Outputs connected to inductive loads shall include suitable suppression so that switching transients do not disturb communication or manipulator control electronics.

End-effector sensing may include force, torque, pressure, vacuum, proximity, temperature, position, vision, tactile, or process-specific measurements. Sensor interfaces shall define supply voltage, signal type, sampling requirement, scaling, units, accuracy expectations, and synchronization needs. Sensors used directly for closed-loop motion or force control shall receive timing treatment appropriate to their control function rather than being handled only as asynchronous application data.

Grounding and shielding shall follow the manipulator grounding architecture and shall avoid creating uncontrolled return-current paths through the tool flange, communication shield, or sensor reference. Protective grounding, power return, signal reference, and cable shield functions shall be distinguished where required. Shield termination and cable routing shall be designed to tolerate electromagnetic interference generated by motors, solenoids, pumps, welding equipment, and other process loads.

The wrist harness and tool cable shall accommodate the full manipulator workspace without excessive bending, twisting, stretching, abrasion, or interference with adjacent structures. Minimum bend radius, torsional capability, strain relief, connector orientation, cable retention, and expected flex life shall be considered during design. Cable routing shall also prevent the tool harness from entering pinch points or becoming a collision hazard during normal robot motion.

Safety-related tool functions shall remain consistent with the manipulator safety architecture. Removal of ordinary communication shall not be assumed to provide a safe state unless explicitly validated. Tools presenting crushing, cutting, heating, stored-energy, vacuum, or other hazards shall define their behavior during emergency stop, protective stop, safe torque off, power loss, communication loss, and controller restart. Residual energy shall be considered in the safe-state definition.

Automatic tool changers shall control the sequence of mechanical locking, electrical connection, tool identification, communication establishment, power application, and operational enable. The controller shall verify successful mechanical retention before allowing hazardous tool operation. Unlocking shall be inhibited while conditions could cause unintended release, and the system shall provide positive status information distinguishing locked, unlocked, transitional, and fault conditions.

The end-effector state model shall provide predictable behavior during startup, normal operation, controlled stop, fault reaction, reset, and shutdown. Power restoration or communication recovery shall not automatically initiate hazardous motion. Command values and output states after reset shall be defined, and stale commands shall not be reused without validation. The manipulator controller shall confirm tool readiness before resuming coordinated robot operation.

Diagnostic information shall support rapid isolation of failures at the tool, connector, harness, communication, and power levels. Where supported, diagnostics should include tool presence, supply voltage, current consumption, communication state, sensor validity, actuator status, temperature, fault code, and cycle count. Fault records should use timestamps correlated with the robot controller so that manipulator and end-effector events can be analyzed together.

Commissioning shall verify mechanical installation, connector engagement, pin assignment, grounding, power polarity, voltage level, current consumption, communication configuration, tool identification, command direction, sensor scaling, state transitions, and safety behavior. Initial operation shall use restricted speed, force, and power where applicable. Tool functionality shall be confirmed before unrestricted coordinated operation of the manipulator is authorized.

Interface verification shall include nominal operation and representative fault conditions such as connector interruption, communication loss, sensor failure, actuator overload, power interruption, tool removal, incorrect identification, and controller restart. Automatic tool changers shall additionally be tested for incomplete engagement and failed locking sequences. Acceptance criteria shall demonstrate repeatable mechanical, electrical, communication, control, and safety behavior.

Interface drawings, pin assignments, connector specifications, power budgets, communication parameters, tool identification data, firmware compatibility, and validation results shall be maintained under configuration and version control. Any change affecting mounting geometry, connector assignment, voltage, current capacity, protocol, data mapping, or safety behavior shall undergo an impact assessment before release to prevent incompatible combinations of manipulators and tools.

The standardized end-effector interface shall ultimately enable approved tools to be integrated, replaced, serviced, and upgraded without uncontrolled modification of the manipulator electrical architecture. Compliance shall be demonstrated through interface-control documentation, electrical drawings, mechanical definitions, configuration records, diagnostic evidence, and validation results, establishing a scalable engineering baseline for grippers, sensors, process tools, and future robotic end effectors.

10.03. Tool Changer Standard

The tool changer shall provide a standardized, repeatable, and fail-safe mechanism for automatically or manually coupling interchangeable end effectors to a manipulator. It shall integrate mechanical locking, electrical connection, communication, identification, and safety functions into a controlled interface. The design shall permit approved tools to be exchanged without uncontrolled modification of the manipulator or tool-side architecture.

The tool changer architecture shall consist of a robot-side master interface and a tool-side mating interface with defined mechanical and electrical boundaries. Both sides shall use standardized mounting geometry, locating features, connector positions, and interface orientation. The arrangement shall prevent incorrect assembly and shall maintain compatibility among approved grippers, sensors, process tools, inspection devices, and application-specific end effectors.

Mechanical coupling shall provide sufficient retention force and stiffness for the maximum rated payload, center-of-gravity offset, acceleration, process force, vibration, and emergency-stop loading. The locking mechanism shall prevent unintended separation under all specified operating conditions. Structural ratings shall include appropriate engineering margin, and the permissible payload and moment envelope shall be documented for each approved tool changer configuration.

The coupling interface shall provide repeatable positioning between the manipulator flange and the installed tool. Locating pins, tapered surfaces, kinematic features, or equivalent alignment mechanisms shall control translational and rotational positioning before final locking. Repeatability requirements shall reflect the needs of robotic calibration, vision-guided manipulation, process accuracy, and tool-center-point consistency after repeated exchange cycles.

The locking mechanism may use pneumatic, electric, mechanical, or another approved actuation method, but its state shall be positively detectable. The system shall distinguish unlocked, engaging, locked, releasing, and fault conditions where applicable. A command to lock shall not itself be considered evidence of successful retention; the controller shall verify independent locking feedback before permitting unrestricted manipulator or tool operation.

Tool release shall be inhibited whenever release could create a hazardous condition. Unlocking shall normally require the manipulator to be within an approved exchange position, the tool to be supported by a tool station or equivalent structure, hazardous tool motion to be disabled, and the applicable process energy to be removed. Loss of ordinary control power or communication shall not cause unintended mechanical release.

The electrical interface shall connect only after sufficient mechanical alignment has been established. Connector design shall tolerate the specified mating cycles while preventing bent contacts, partial engagement, contamination, and excessive insertion force. Power, ground, communication, safety, and discrete I/O contacts shall use standardized assignments, and the interface shall comply with the applicable end-effector electrical interface requirements.

Electrical power shall be applied according to a controlled sequence. Tool power outputs shall remain disabled during uncontrolled mating or separation unless the connector system is specifically rated and validated for energized connection. After mechanical locking is confirmed, the controller may establish communication, verify tool identity and compatibility, and then enable the required power domains according to the defined startup sequence.

The tool changer shall support approved communication interfaces required by connected tools, such as EtherCAT, CAN FD, CAN, Ethernet, IO-Link, or discrete I/O. Communication continuity through the coupling interface shall satisfy the bandwidth, latency, signal-integrity, and diagnostic requirements of the selected protocol. Contact resistance, shielding, grounding, and repeated mating shall not degrade communication beyond established acceptance limits.

Automatic tool identification shall be implemented where multiple interchangeable tools are used. The tool-side interface should provide a unique tool type, serial number, hardware revision, firmware revision, and capability information where applicable. The manipulator controller shall compare the detected identity against the requested tool and approved configuration before enabling operation, preventing an incorrectly docked or incompatible tool from being used.

The automatic exchange sequence shall follow a controlled state model. A typical sequence includes approach to the tool station, alignment, mechanical engagement, locking, lock verification, electrical connection confirmation, tool identification, communication establishment, power enable, functional readiness verification, and departure. Tool removal shall execute the corresponding safe sequence in reverse while ensuring that stored energy and unsupported loads are properly controlled.

The manipulator shall not leave the tool station until successful attachment has been verified. Verification shall include the required mechanical lock signals and, where applicable, tool presence, electrical connection, communication state, identification, power status, and tool readiness. Failure of any mandatory condition shall prevent normal departure and generate a diagnostic state requiring controlled recovery rather than repeated uncontrolled attachment attempts.

Tool stations shall maintain predictable tool position and orientation for automated docking. Their mechanical design shall support the tool mass without damaging alignment features, connectors, hoses, cables, or functional surfaces. Station tolerances shall be compatible with manipulator positioning capability and tool changer capture range. The docking area shall also provide adequate clearance to avoid collisions during approach, engagement, release, and withdrawal.

Pneumatic tool changers shall define operating pressure, allowable pressure range, air quality, flow requirements, loss-of-pressure behavior, and any stored pneumatic energy. Where pneumatic pressure maintains or actuates locking, the mechanical design shall prevent unsafe release following pressure loss. Pressure switches or equivalent monitoring should be provided when pneumatic availability is necessary for reliable locking, unlocking, or tool operation.

Electrical or motor-driven locking mechanisms shall define supply voltage, peak current, actuation time, stall protection, position sensing, and behavior following power loss. The design shall prevent continuous actuator energization from becoming the sole means of retaining the tool unless explicitly justified and validated. Where stored mechanical energy is used for retention, its release behavior during service and emergency conditions shall be documented.

Safety functions shall be coordinated with the manipulator safety architecture. Emergency stop, protective stop, safe torque off, power loss, communication loss, or controller reset shall place the tool changer and attached tool into defined safe states. Tool release shall not be initiated solely by a safety stop unless release itself is the validated safe action. Residual pneumatic, electrical, gravitational, or spring energy shall be considered.

Sensors used to confirm attachment shall be positioned and designed so that false-positive lock indication is minimized. Where the consequence of unintended tool separation is significant, independent or diverse confirmation methods should be considered. Sensor plausibility shall be evaluated by the controller, and contradictory states such as simultaneous locked and unlocked indications shall be treated as faults rather than interpreted as valid operating states.

Cable, hose, and connector routing around the tool changer shall accommodate the manipulator workspace without excessive bending, torsion, abrasion, pinching, or interference. Service loops shall not enter the coupling surfaces or collision envelope. Routing shall preserve required bend radius and strain relief, while pneumatic lines and electrical conductors shall be protected from damage during repeated docking and undocking operations.

Diagnostics shall provide sufficient information to distinguish mechanical, electrical, pneumatic, communication, identification, and tool-side faults. Relevant information should include lock state, unlock state, tool presence, supply status, pneumatic pressure where applicable, communication status, detected tool identity, cycle count, fault code, and timestamp. Diagnostic events shall be correlated with manipulator controller records to support maintenance and root-cause analysis.

The tool changer shall have defined inspection and preventive maintenance requirements based on exchange-cycle count, operating environment, payload, and manufacturer limitations. Inspection shall address locking surfaces, locating features, fasteners, connector contacts, seals, pneumatic components, sensors, cables, contamination, wear, and mechanical damage. Components reaching specified wear limits shall be replaced before coupling performance becomes unreliable.

Commissioning shall verify mounting, alignment, lock and unlock operation, electrical continuity, communication, tool identification, sensor plausibility, power sequencing, and safety interlocks. Initial exchange testing shall be conducted at restricted manipulator speed and with controlled payload conditions. Multiple consecutive exchange cycles shall demonstrate repeatable attachment, identification, operation, release, and recovery before automatic production operation is authorized.

Validation shall include nominal exchanges and representative fault injection. Tests shall address incomplete engagement, failed locking, incorrect tool identity, communication interruption, power loss, pneumatic pressure loss, sensor disagreement, blocked release, controller restart, and interrupted exchange sequences. The system shall demonstrate that each fault produces a predictable state and that recovery can be performed without uncontrolled tool motion or release.

Tool changer geometry, load ratings, connector assignments, pneumatic parameters, communication configuration, identification data, firmware compatibility, inspection intervals, and validation results shall be maintained under configuration control. Changes affecting mechanical retention, interface alignment, connector design, locking logic, tool identification, or safety behavior shall undergo impact assessment and regression testing before release.

The standardized tool changer shall provide a common engineering baseline for scalable manipulator applications while supporting controlled variation in payload, tool type, communication technology, and process requirements. Compliance shall be demonstrated through mechanical drawings, interface specifications, electrical documentation, configuration records, safety analysis, diagnostic evidence, cycle testing, and validation results throughout the manipulator lifecycle.

10.04. Manipulator Safety Rule

The manipulator safety architecture shall protect personnel, equipment, payloads, and surrounding systems throughout installation, commissioning, automatic operation, manual operation, maintenance, recovery, and shutdown. Safety shall be treated as an independent engineering function rather than an application-software feature. Hazard reduction shall combine inherently safe design, protective measures, safety-rated control functions, and documented operating procedures.

Safety requirements shall be derived from a documented risk assessment covering foreseeable manipulator motions, payloads, end effectors, operating environments, human interaction, stored energy, and failure conditions. Hazards shall include crushing, trapping, impact, shearing, unexpected motion, dropped tools or payloads, electrical energy, pneumatic energy, thermal sources, and process-specific risks introduced by the attached end effector.

The safety design shall establish clearly defined operational modes such as automatic operation, manual operation, teaching, maintenance, recovery, and disabled states. Each mode shall define permitted motion, speed, torque or force limits, command sources, protective devices, and operator authority. Transition between modes shall be controlled so that changing mode cannot unexpectedly initiate motion or bypass an active safety function.

Emergency stop functions shall provide rapid initiation of the defined safe response when an emergency condition is recognized. Emergency-stop devices shall be readily accessible and shall remain effective independently of ordinary application software. Resetting an emergency stop shall not automatically restart manipulator motion. A separate deliberate command shall be required after the system verifies that applicable safety and operational conditions have been restored.

Safe Torque Off shall be used where removal of motor-generated torque is required to prevent hazardous actuator motion. STO shall act through an appropriate safety-rated path and shall not depend solely on standard network commands or non-safety software. The design shall consider whether gravity, springs, pneumatic pressure, external loads, or stored mechanical energy can continue to produce hazardous movement after actuator torque is removed.

Vertical or gravity-loaded axes shall receive special consideration because disabling motor torque may permit uncontrolled descent. Where necessary, safety-rated brakes, counterbalance mechanisms, mechanical restraints, or equivalent protective measures shall prevent hazardous movement. Brake control shall define engagement and release sequencing, feedback monitoring, stopping capability, wear considerations, and behavior during power or communication loss.

Protective stop functions shall stop hazardous manipulator movement when a protective device or monitored safety condition is activated while allowing controlled recovery where appropriate. The required stopping behavior shall be selected according to the hazard and machine architecture. Protective stop logic shall coordinate with guards, safety scanners, interlocks, enabling devices, and other safety inputs without relying on ordinary application-state assumptions.

Safety-related speed, position, direction, and workspace limits may be applied where the risk assessment requires controlled motion rather than complete torque removal. Such functions shall use appropriately validated sensing and safety logic. Software-only motion limits in the normal robot controller shall not be considered equivalent to safety-rated limits unless the complete implementation satisfies the required safety integrity and validation criteria.

The manipulator workspace shall be evaluated for crushing and trapping zones between moving links, the robot base, tooling, fixtures, walls, equipment, and other stationary structures. Mechanical layout and motion planning should eliminate or reduce such zones where practical. Remaining hazards shall be controlled through guarding, monitored access, safe separation, restricted motion, warnings, or other measures justified by the risk assessment.

End effectors shall be included in the manipulator safety boundary because the attached tool can fundamentally change system hazards. Grippers, vacuum devices, cutters, heated tools, process equipment, and heavy payload interfaces shall define their safe behavior during emergency stop, protective stop, power loss, communication loss, and controller reset. Tool hazards shall be reassessed whenever the approved end-effector configuration changes.

Tool changers shall prevent unintended tool release during normal operation and safety events. Mechanical retention shall remain secure when ordinary control power or communication is lost unless release is explicitly established as the safe action. Tool unlock commands shall be interlocked with manipulator position, tool support, motion state, process-energy state, and lock feedback so that a suspended tool or payload cannot be unintentionally released.

Safety-related communication shall be separated conceptually from ordinary manipulator control communication. Standard EtherCAT, CAN, Ethernet, ROS 2, or equivalent communication shall not by itself be treated as a safety channel. Where safety functions are transmitted through a network, an approved safety communication mechanism and suitable safety-rated devices shall be used according to the required safety architecture.

Safety inputs and outputs shall fail toward a defined safe condition where technically appropriate. Broken wiring, loss of power, invalid state combinations, communication interruption, and sensor disagreement shall be detectable when required by the safety concept. Safety logic shall identify implausible combinations rather than silently accepting them, and diagnostic coverage shall be sufficient to support the safety integrity required for the function.

Restart and recovery behavior shall be explicitly controlled. Restoration of electrical power, communication, servo readiness, pneumatic pressure, or safety inputs shall not automatically cause hazardous motion. Following a safety event, the controller shall verify the relevant stop condition, tool state, axis state, workspace condition, and safety devices before accepting a deliberate restart command from an authorized control source.

Manual and teaching operations shall apply reduced-risk conditions appropriate to close human interaction. Where required, reduced speed, limited force, hold-to-run controls, enabling devices, restricted workspace, or equivalent measures shall be applied. Manual commands shall remain predictable and clearly associated with the selected axis or coordinate system so that maintenance or teaching personnel are not exposed to unexpected motion.

Safety-related sensors and devices shall be positioned to provide the coverage assumed by the risk assessment. Safety scanners, interlocks, emergency-stop devices, enabling switches, brake feedback, lock sensors, and other protective components shall not be located where normal equipment configuration can easily defeat their function. Installation tolerances, response time, diagnostic capability, environmental limitations, and field of detection shall be documented.

Stopping performance shall be verified using representative manipulator configurations, payloads, speeds, trajectories, and end effectors. Safety distance calculations shall use measured or validated stopping time and stopping distance rather than unsupported assumptions. Changes to payload capability, servo tuning, braking, actuator hardware, tool mass, control cycle, or safety logic shall trigger evaluation of whether existing stopping-performance data remain valid.

Electrical and pneumatic energy isolation shall support safe maintenance and service. The architecture shall identify energy sources that can produce movement or other hazards after normal shutdown, including battery supplies, DC bus energy, compressed air, vacuum, springs, suspended axes, and stored mechanical loads. Service procedures shall define isolation, discharge, restraint, verification, and restoration of these energy sources.

Safety diagnostics shall provide sufficient information to identify the cause of a safety-related stop without encouraging bypass of protective functions. Diagnostic records should include the triggering device, safety state, relevant axis condition, brake or STO status, tool state, communication condition, fault code, and timestamp. Safety events should be correlated with manipulator controller logs to support investigation and corrective action.

Commissioning shall verify every safety function before unrestricted manipulator operation is authorized. Testing shall include emergency stops, protective stops, STO, brake behavior, safety interlocks, mode selection, enabling devices, restart prevention, tool retention, communication faults, and applicable workspace monitoring. Tests shall be performed under controlled conditions and shall confirm both the intended response and diagnostic indication.

Validation shall include representative single faults and foreseeable combinations identified by the safety analysis. Tests should address sensor faults, broken connections, power interruption, controller restart, communication loss, brake faults, incorrect tool states, and interrupted recovery sequences. The system shall demonstrate predictable transition to or maintenance of the required safe state without uncontrolled manipulator or tool motion.

Safety functions, parameters, wiring, device types, firmware, network configuration, stopping data, risk assessments, and validation results shall be maintained under configuration control. Any modification affecting actuators, brakes, tools, payload limits, safety devices, software, communication, workspace, or operating modes shall undergo documented impact assessment before release. Safety-relevant changes shall receive regression testing appropriate to their potential effect.

Periodic inspection and proof testing shall confirm that protective functions remain effective throughout the manipulator lifecycle. Inspection intervals shall consider operating hours, motion cycles, environmental exposure, component manufacturer requirements, and observed wear. Emergency-stop devices, brakes, interlocks, cables, connectors, sensors, tool retention, and safety communication shall be maintained before degradation compromises the validated safety concept.

The manipulator safety rule shall ultimately establish a common engineering baseline across manipulator products while permitting controlled adaptation to payload, reach, tool type, operating environment, and human interaction. Compliance shall be demonstrated through risk assessment, architecture documentation, safety schematics, configuration records, measured stopping performance, commissioning evidence, fault testing, and validation throughout the system lifecycle.

10.05. Manipulator Test Requirement

The manipulator test program shall verify that the complete manipulator satisfies its mechanical, electrical, communication, control, safety, and performance requirements before release. Testing shall cover the integrated system rather than individual components alone and shall include representative actuators, servo drives, sensors, end effectors, tool changers, harnesses, controllers, and safety devices under controlled and traceable conditions.

A documented test plan shall define the configuration under test, test objectives, equipment, procedures, environmental conditions, acceptance criteria, data to be recorded, and responsibilities for execution and approval. Each requirement shall be traceable to one or more verification activities. Test results shall identify hardware revision, software version, firmware, calibration data, network configuration, payload, tooling, and any deviations from the approved baseline.

Pre-test inspection shall confirm that the manipulator is correctly assembled and safe to energize. Mechanical fasteners, joint modules, cable routing, connectors, grounding, protective devices, lubrication, tool attachment, and physical damage shall be checked before powered testing begins. Electrical inspection shall verify supply polarity, insulation, protective grounding, fuse ratings, wiring continuity, and absence of unintended short circuits.

Power-up testing shall verify the complete startup sequence from initial energy application through controller initialization, communication establishment, servo readiness, safety-system initialization, and operational enable. Supply voltages, inrush current, steady-state current, DC bus behavior, and abnormal startup conditions shall be monitored. Unexpected actuator movement during startup, reset, communication recovery, or power restoration shall constitute a critical failure.

Servo network testing shall verify node discovery, axis identification, process-data mapping, communication cycle time, synchronization, command transmission, feedback acquisition, watchdog behavior, and diagnostic reporting. Testing shall be performed under representative and maximum configured communication loads. Packet errors, synchronization deviations, stale feedback, interrupted communication, and individual node loss shall produce the defined controller response.

Each joint shall be tested individually before coordinated multi-axis motion is authorized. Joint testing shall confirm direction, encoder polarity, position scaling, velocity scaling, torque or current scaling, travel limits, brake operation where applicable, and correspondence between physical joint identity and software axis assignment. Initial movements shall use restricted speed, acceleration, and torque to reduce risk from configuration or assembly errors.

Positioning performance shall be evaluated throughout the specified workspace using representative poses and trajectories. Tests shall measure positioning accuracy, repeatability, trajectory tracking, settling behavior, and joint-level error where applicable. Results shall be compared with documented product requirements rather than subjective observation. Tool-center-point accuracy shall be evaluated when the manipulator application depends on calibrated end-effector positioning.

Velocity and acceleration testing shall confirm that commanded motion can be achieved without instability, excessive tracking error, abnormal vibration, unexpected current limitation, or violation of mechanical constraints. Tests shall include representative combinations of joint motion because multi-axis dynamics can differ significantly from single-axis operation. Maximum operating conditions shall only be tested after lower-risk operating ranges have been successfully verified.

Payload testing shall verify operation across the approved load range and center-of-gravity envelope. Representative payloads shall be evaluated at demanding manipulator poses and trajectories where joint torque, structural deflection, braking, and thermal loading are significant. Testing shall confirm stable motion, acceptable tracking, secure payload retention, and controlled stopping without exceeding actuator, drive, structural, or tool-interface limits.

End-effector interface testing shall verify mechanical attachment, electrical power, communication, discrete I/O, sensing, grounding, identification, and safety behavior for representative approved tools. Power consumption and transient current shall remain within the defined interface budget. Communication and sensor signals shall remain reliable throughout manipulator motion, and cable routing shall not produce excessive bending, abrasion, pinching, or interference.

Tool changer testing shall verify alignment, mechanical engagement, locking, lock confirmation, electrical connection, tool identification, communication establishment, power sequencing, release, and recovery. Multiple consecutive exchange cycles shall demonstrate repeatability. Fault tests shall include incomplete engagement, failed locking, incorrect tool identity, interrupted communication, power loss, sensor disagreement, and blocked release without unintended tool separation.

Safety testing shall verify emergency stop, protective stop, Safe Torque Off, brake control, safety interlocks, mode selection, enabling devices, restart prevention, workspace monitoring, and tool retention as applicable. Safety functions shall be tested independently from normal application logic. Reset of a safety condition shall not automatically restart hazardous movement, and all safety responses shall correspond to the approved safety architecture.

Stopping performance shall be measured under representative worst-case combinations of speed, payload, tool mass, pose, and motion direction. Stopping time and stopping distance shall be recorded for safety-related stop functions and compared with established acceptance criteria. Where safety distance depends on stopping performance, measured or validated values shall be used to confirm that protective devices provide sufficient separation.

Fault-injection testing shall intentionally introduce representative electrical, communication, sensor, actuator, and control failures. Conditions should include power interruption, communication loss, servo-node loss, encoder or sensor invalidity, controller restart, brake fault indications, tool communication failure, and inconsistent safety inputs. The manipulator shall transition predictably to the defined controlled or safe state without uncontrolled motion.

Power-cycle and recovery testing shall verify behavior during normal shutdown, abrupt power interruption, low-voltage conditions, controller reset, network restart, and restoration of external utilities such as pneumatic pressure. Recovery of power or communication shall not automatically enable hazardous motion. Stored commands shall be invalidated where required, and deliberate operator action shall be necessary before normal operation resumes.

Thermal testing shall evaluate actuator, servo-drive, controller, power-distribution, connector, and cable temperatures during representative continuous and cyclic operation. Testing shall include payload and motion profiles capable of producing significant sustained loading. Temperatures shall remain within approved component and system limits, and thermal protection or derating functions shall operate predictably when their thresholds are approached.

Electrical robustness testing shall evaluate voltage variation, transient loading, grounding behavior, and power-distribution stability during simultaneous actuator operation. Where required by the product specification, conducted and radiated electromagnetic compatibility testing shall verify that servo drives, motors, communication networks, sensors, and end-effectors operate without unacceptable mutual interference. Communication errors shall be monitored during these tests.

Harness and connector testing shall confirm that manipulator motion does not create excessive cable tension, torsion, bend-radius violation, abrasion, connector movement, or intermittent electrical contact. Testing shall exercise representative full-workspace trajectories and repeated motion cycles. Particular attention shall be given to wrist wiring, moving joints, tool interfaces, and other locations subject to continuous flexing or repeated mechanical stress.

Durability and cycle testing shall demonstrate that the manipulator maintains required functionality over a defined number of representative motion cycles. Test profiles should include repeated joint reversals, payload handling, tool operation, and tool exchange where applicable. Wear, backlash, positioning performance, cable condition, connector integrity, brake behavior, temperatures, diagnostic trends, and emerging faults shall be monitored throughout the test.

Diagnostic testing shall verify that system faults are detected, classified, recorded, and presented with sufficient information for troubleshooting. Logs should identify affected axis or device, fault code, operating state, relevant electrical or communication condition, and timestamp. Diagnostic records from servo drives, safety controllers, end effectors, tool changers, and the main robot controller should be time-correlated where technically practical.

Regression testing shall be required when changes affect actuators, servo tuning, mechanical structure, harnesses, connectors, controller hardware, communication timing, firmware, software, safety logic, end-effector interfaces, or tool changer behavior. The regression scope shall be determined by documented impact assessment. Previously approved results shall not automatically remain valid when a modification can influence the tested characteristic.

All test equipment shall have suitable measurement range, resolution, accuracy, and calibration status for the parameter being verified. Test automation may be used to improve repeatability and data collection, but automated procedures shall preserve traceability to requirements and acceptance criteria. Raw measurements, processed results, software scripts where applicable, photographs, logs, and anomaly records shall be retained as verification evidence.

Test failures and anomalies shall be documented and classified before product release. Corrective actions shall identify the affected requirement, root cause, implemented modification, and required retest scope. A failed test shall not be closed solely because subsequent operation appears normal. Closure shall require objective evidence that the failure mechanism has been corrected or formally accepted through the engineering change process.

Final acceptance shall require completion of mandatory functional, performance, interface, safety, fault, and durability verification applicable to the product configuration. Test reports shall clearly identify passed requirements, unresolved deviations, approved limitations, and configuration-specific conditions. Release authorization shall be based on documented evidence demonstrating that the tested manipulator configuration satisfies its defined engineering baseline.

The manipulator test requirement shall establish a reusable verification framework across manipulator products while permitting controlled adaptation to axis count, payload, reach, actuator technology, end-effector type, and application environment. Compliance shall be demonstrated through approved test plans, traceable procedures, calibrated measurements, recorded results, fault-injection evidence, regression testing, and formally released verification reports.

Author: Richard Minsoo Go

LinkedIn: Richard Minsoo Go