Safety Requirements

How a Moving Arm Hurts People

• OSHA sorts robot hazards into types. One is being struck by the arm, or caught between it and something else⁷.
• Another is crushing or trapping: a hand, an arm or another body part caught between the robot, its tool or the workpiece and other equipment⁷.
• A third is being hit by something flying loose, such as a part the arm releases or a gripper that fails⁷.
• OSHA says robot contact with sensitive parts of the body, such as the face, temples and throat, is to be prevented or avoided⁸.

Other Ways to Get Hurt

• The xArm manual warns about items dropping when the power goes off by accident, or when the arm grips them unsteadily⁹.
• It also says to be careful when the arm is running too fast⁹.
• The arm and the control box get hot while they run. Do not handle or touch them during operation, or straight after it¹⁰.
• Never put your fingers into the connector for the tool at the end of the arm¹⁰.

Electrical Hazards

• To avoid an electric shock, do not connect or disconnect the arm cable while the arm is connected to external AC power¹¹.
• The control box must be powered off while its electrical interface is being wired¹².
• The power supply inside the controller may keep a high voltage for several hours after the controller is shut down. Avoid taking it apart¹³.

The Rules

• No people, and no other equipment, should be in the working area while the arm is in operation¹.
• While the system is running, an arm that seems to have stopped may be waiting for a signal and about to act. Count it as moving².
• A line should be drawn to mark the arm's range of motion, including the reach of its tools, such as grippers and suction cups¹⁴.
• The working range the manual shows does not include the tool at the end of the arm¹⁵.
• The manual says the device and the system must be checked before each use¹⁶.
• Operators must be trained to use UFACTORY Studio and the SDKs correctly, and each operator should read the user manual carefully¹⁷.

When Accidents Happen

• OSHA says many robot accidents happen during work that is not routine, such as programming, maintenance, testing, setup or adjustment, when a person may be inside the robot's working envelope¹⁸.
• In manual mode, a person moves the arm's joints by hand to reach and record positions¹⁹.
• If the arm's mounting direction is set wrongly, the arm cannot tell accurately which way gravity acts, and it can move uncontrolled in manual mode²⁰.

The Emergency Stop

• The emergency stop button is on the control box³.
• The control box must be placed outside the arm's working range, so that the button can be pressed in an emergency²¹. The manual says the controller should sit at a height of 0.6 m to 1.5 m²².
• Pressing the button powers off the arm, and its power light goes out²³.
• The manual says the arm's posture will slightly brake and fall²⁴.
• The manual says the emergency stop should not be used as a risk reduction measure²⁵. Rely instead on the first rule: no people in the working area while the arm is in operation¹.
• The STOP button in UFACTORY Studio is not the same thing. Studio calls it a software stop: it stops the arm and clears its queued commands, and the power stays on⁴.

What to Do in an Emergency

1. Press the emergency stop button on the control box. The manual says to press it when the arm is in an accident or running abnormally³²⁴.
2. Keep clear of the arm and of anything under it. Its posture brakes slightly and falls²⁴, and the manual names a workpiece dropping from the tool as a danger when power is cut²⁶.
3. Leave the restart to a trained operator. The manual says operators must be trained¹⁷.
4. Before a restart, make sure the restart or reset motions will not hit any obstacle²⁷.
5. Restarting takes two steps: turn the button in the direction of its arrow to power the arm, then enable the arm with the Enable button in UFACTORY Studio²⁸.

The Brakes

• The arm's joint modules contain brakes that hold its pose when the power goes out²⁹.
• The manual describes the emergency stop in two ways that do not fit together. It says the arm's power is removed within 300 ms. It also calls the same button a Stop Category 1 stop, which slows the arm with drive power on, and gives stopping times of up to 885 ms. It does not explain how the two fit³⁰.
• The manual says to take protective measures when the brakes are released²⁹.

"Collaborative" Does Not Mean Safe Here

• UFACTORY's product page calls the xArm a collaborative robot, while the xArm manual says no people should be in the working area when the arm is in operation. Neither source says how the two fit together³¹.
• The manual makes whoever integrates the arm responsible for a risk assessment of the complete system, and for a safe distance between people and the arm when they interact with it³².
• Do not count collision detection as a validated safeguard either. This project's advice is to treat it as a controller function you can configure, not a validated safeguard, and never to let it replace protective devices chosen by a risk assessment³³.
• IntelliMake's S11 system watches factory operations and safety with AI vision³⁴. Until its safety function is documented and verified, this project's advice is not to treat S11 or the cameras as one³⁵.

Rely Only on Safeguards Someone Has Confirmed

• Safeguards such as guards and extra stop buttons are checked, not taken on trust. The manual says the arm and its peripheral protection system must be tested and inspected before production, and the device and system checked before each use¹⁶.
• This project's advice: do not rely on a safeguard nobody has confirmed. Act as though it does not exist, and stay out of the arm's working area while it runs⁵.

Two Safety Inputs: Emergency and Protective

• The control box has two fixed safety inputs. The emergency stop input is used only for the device's emergency stop. The protective stop input is used for all types of safety protection³⁷.
• Both kinds of stop halt the arm's motion. An emergency stop stops the program, needs a manual reset and is meant for infrequent use. A protective stop suspends the program, resets automatically or by hand, and has no limit on how often it is used³⁸.
• As configured by default, the arm can be operated without any additional safety equipment³⁹.
• The manual says most applications need one or more additional emergency stop buttons, and that an arm used with other machines needs a common emergency stop circuit most of the time⁴⁰.
• Its example of a basic protective stop device is a door switch: when the door is open, the arm stops. It names a safety pad or a safety laser scanner as an example of automatic recovery⁴¹.

Errors Stop the Arm

• When there is an error in the arm's hardware, in the control box software or in sending commands, Studio's manual says the arm stops working at once and discards the control box's cached commands. The errors must be cleared by hand before normal work resumes⁴².
• Three error codes belong to emergency stops: error code C1 means the control box's emergency stop button is pushed in, and error code C3 that the emergency stop button of the three-state switch is pressed. C2 is also an emergency-stop code: the Studio manual as read on 2026-10-13 says an emergency stop button is pushed in, where until that date it said the control box's emergency input had been triggered⁴³⁴⁴.
• This project's advice: do not ground, bridge or rewire the control box's emergency input (EI) or safeguard stop input (SI) terminals to clear an error or to resume after a stop, whatever text Studio shows. Wiring is installation work⁴⁵⁴⁶.

Collision Detection

• UFACTORY's collision detection compares each joint's actual current with the current a dynamic model predicts, and triggers when the difference passes a preset threshold⁴⁷.
• Studio's Settings page says that when the torque deviation at a joint goes beyond a normal range during motion, the arm stops by itself. It gives sensitivity levels 1 to 5: the higher the level, the smaller the extra torque needed to trigger collision protection⁴⁸.
• The same page says an inaccurate load or mounting direction may cause false alarms. Once those settings are confirmed, sensitivity may be lowered for some high-load or high-speed moves, but lowering it below 3 is not recommended⁴⁸.
• This project's advice: treat collision detection as a controller function you can configure, not a validated safeguard. It must not replace risk-assessed protective devices wired to the emergency and protective stop inputs³³.

The Safety Boundary and Reduced Mode

• With the Safety Boundary on, the arm's working range in Cartesian space can be limited. If the tool center point goes beyond the set boundary, the arm stops moving, and the user can then move it back inside⁴⁹.
• With Reduced Mode on, the arm's maximum linear speed, maximum joint speed and joint range are limited. A controller input set as Reduced Mode puts the arm into reduced mode when it is triggered⁵⁰.
• The same advice covers both: they are configurable controller functions, not validated safeguards³³.

Teaching by Hand

• In Studio's Manual Mode the joints can be moved freely by hand to reach and record positions. Studio says it can also be used to drag the arm away from a danger zone¹⁹.
• Before turning manual mode on, confirm that the mounting direction and the payload are set correctly. Otherwise the gravity compensation is inaccurate and the arm may not stay still; Studio's Live Control page says it will be dangerous⁵¹.
• If the mounting direction is set wrongly, the arm triggers collision warnings and stops often, and moves uncontrolled once it enters manual mode⁵².

Risk Assessment Belongs to Each Installation

• The xArm manual does not cover designing, installing and operating a complete robot system. The complete system must be designed and installed under the safety standards and regulations of the country where the arm is installed⁵³.
• A safety assessment is required each time the arm is installed, and a complete one must be recorded each time it is re-installed and debugged⁵⁴.
• Connecting the arm with other machinery may increase risk. The manual says to make sure a consistent and complete safety assessment is carried out for the whole installation⁵⁵.
• OSHA says a risk assessment should be done and documented at every stage of a robot application: design, manufacturing, integrating, operating and maintaining⁵⁶.

How People and Robots Can Share Space

• OSHA names three collaborative technologies: speed and separation monitoring, hand-guided controls, and power and force limiting. OSHA notes that ANSI/RIA R15.06-2012 refers to the safety-rated monitored stop as a fourth type, and says it is not used alone but only together with one or more of the other three⁵⁷.
• In power and force limiting, contact between the robot application and a worker is expected. OSHA says it is permitted when contact forces and pressures are limited so that there will be no injury. These applications usually run at much lower speeds and payloads than the robot can manage⁵⁸.
• OSHA separates transient contact, where the body part is free to move away, from quasi-static contact, where a fixed object holds it in place, as when it is trapped or pinched between the robot and a fixture⁵⁹.
• OSHA's administrative controls for collaborative applications may include written entry and exit procedures, lockout and tagout procedures, marking out the collaborative space, for example with painted floor lines, and signs warning that it is a collaborative robot application⁶⁰.

Stopping, Mounting and Restarting

• Studio's STOP, the SDK's set_state(4) and the SDK's emergency_stop() are software stops. This project's advice is never to count one as an emergency stop or a safeguard in the S6 risk assessment³⁶.
• The arm must be installed on a shockproof, sturdy surface with its bolts checked for tightness. The manual says that surface should withstand at least 10 times the full torsion of the base joint and at least 5 times the arm's weight⁶¹.
• After an emergency stop, the manual gives two restart steps: power the arm up by turning the button in the direction of the arrow, then enable it with the Enable button in Studio or with motion_enable(true) in the Python SDK⁶².
• Yet a table elsewhere in the same manual says an emergency stop's "Need re-initiation" is "Only releasing the brake". The manual does not say how the two relate⁶³.

Which Safeguards You Can Count On

• The arm's default configuration uses no additional safety equipment³⁹. Extra emergency stop buttons and protective devices such as door switches are added for the installation and wired to the control box's two safety inputs³⁷⁴⁰⁴¹.
• The manual says preliminary testing and inspection of the arm and its peripheral protection system before production is essential, and that the device and system must be checked before each use¹⁶.
• Never connect a safety signal to a non-safety PLC. The manual warns that an invalid safety stop function may result in serious injury or death⁶⁴.
• This project's advice: do not rely on a safeguard nobody has confirmed. Act as though it does not exist, and stay out of the arm's working area while it runs⁵.

Stop Categories

• The manual assigns a stop category to three safety inputs. The control box's emergency stop button and its emergency input, EI, are Stop Category 1. Its safeguard stop input, SI, is Stop Category 2⁴⁶.
• Both categories slow the robot down with drive power on, which lets it stop without leaving its current path⁶⁷.

How Far the Arm Travels Before It Stops

The manual's Stop Category 1 table names no arm model. Its figures were measured with the arm fully extended horizontally, at 100% speed (joint speed 180 °/s), with a 5 kg payload at the tool center point⁶⁸⁶⁹⁷⁰:

• Joint 1, moving horizontally, travels 0.62 rad and takes 521 ms to stop⁶⁸.
• Joint 2 travels 1.12 rad and takes 885 ms, measured with the robot moving downwards⁶⁹.
• Joint 3 travels 0.67 rad and takes 577 ms, also measured moving downwards⁷⁰.
• Sources disagree. The manual also says the arm's power is removed within 300 ms of pressing the emergency stop, while calling the same button Stop Category 1, a powered deceleration that lasts up to 885 ms. It does not explain how the two fit³⁰.
• This project's advice: do not use these figures for S6 separation distances without knowing which arm and configuration they were measured on. If the risk assessment needs stopping data, measure the S6 arm's own stopping behavior at the cell⁷¹.

Wiring Safety Signals

• Every safety input and output comes as a redundant pair, kept in two separate branches. The manual says a single I/O failure should not result in the loss of safety features³⁷.
• For a light curtain on the protective interface, the reset must be made from outside the safety zone with a two-channel button. In the manual's example the reset input is CI0, which must also be configured in UFACTORY Studio⁷².
• In the manual's protective stop with a reset button, CI0 is set as Safeguard Reset in UFACTORY Studio⁷³. The manual says that to resume motion SI0 and SI1 are connected to GND and motion is triggered by connecting CI0 to GND, and that to pause motion SI0 and SI1 are disconnected from GND⁷⁴.
• Never connect a safety signal to a non-safety PLC. The manual warns that an invalid safety stop function may result in serious injury or death⁶⁴.
• The configurable inputs CI0 to CI7 can be set to Stop Moving, Safeguard Reset and Reduced Mode. The general inputs DI0 to DI7 cannot⁶⁵.
• Configured input functions are triggered by a low signal. Stop Moving stops the arm. Safeguard Reset resumes motion from the protective stop state and, in Studio's words, "Should work with SI". An input set as Manual Mode lets the arm be dragged freely while the signal stays low⁷⁵.

Collision Detection in Practice

• UFACTORY says false collision triggers are often related to the tool's load, center of mass, mounting direction and friction parameters. It recommends updating the payload after each pick and each release in pick-and-place programs, and reloading the joint friction parameters after the control box is replaced⁷⁶.
• On xArm 5/6/7 arms those friction parameters are stored in the arm and reloaded by pressing and releasing the emergency stop. On xArm 5/6/7 arms before XX1300 they are stored in the controller, and reloading them needs technical support⁷⁷.
• UFACTORY's documents disagree on the sensitivity range. Studio's Settings page says levels 1 to 5. Studio's glossary and the Python SDK say 0 to 5, and the glossary says 0 turns collision detection off⁶⁶.
• The SDK's notes on set_collision_sensitivity say not to use it unless required, and that the setting is lost at reboot unless saved with save_conf⁷⁸.
• Collision detection can be switched on or off in Studio's Advanced Settings. That page needs a password, and Studio's manual documents the default one⁷⁹.
• With Collision Rebound on, the arm rebounds backward a certain distance after it hits an obstacle. With it off and collision detection on, the arm stays where the collision was detected⁸⁰.
• Self-collision detection can model the tool as a cylinder or a cuboid, and error code C22 reports a self-collision⁸¹.

Software States and Software Stops

• Setting controller state 4 (STOP) ends any execution at once, and the arm takes no new command until the state is set back to STANDBY. The arm also enters state 4 by itself when any error occurs. Setting state 6 makes an immediate decelerated stop⁸².
• When a critical setting such as the mode, payload, TCP offset or collision sensitivity changes, the controller enters state 5 and accepts no command until state 0 is set⁸³.
• The SDK's emergency_stop() is the sequence set_state(4), motion_enable(True), set_state(0), and it does not clear errors by itself⁸⁴.
• Studio's STOP is a software stop, and the power is still on after it⁴. This project's advice: never count Studio's STOP, set_state(4) or emergency_stop() as an emergency stop or safeguard in the S6 risk assessment³⁶.
• In Studio's simulated-arm mode a real arm must still be connected, settings made there apply to the real arm, and the unlock-joint button unlocks the real joints⁸⁵.
• In servo mode the arm moves to each joint target at the fastest speed (180°/s) with no buffer, running only the latest target it receives. UFACTORY warns, for safety, not to give a distant target at once⁸⁶.

What OSHA Adds

• In speed and separation monitoring, a presence-sensing device detects workers coming in. At a minimum the robot application stops during the intrusion; some integrations slow it first and stop it before contact can happen. When speed is used for safety, OSHA says it should have a safety function that monitors it is not exceeded⁸⁷.
• OSHA says robot contact with the face, temples, throat and other sensitive body regions is to be prevented or avoided⁸.
• Some robots have built-in safety functions that cannot be seen, and OSHA says trained professionals should verify how safety functions are configured. External measures such as interlocked guards, light curtains and laser scanners need to be verified visually, validated and documented as present and working⁸⁸.
• OSHA says a collaborative application could also need a protective stop, force limiting, speed limiting, soft axis-limiting, space limiting and position limiting, and that the risk assessment should decide which⁸⁹.

Before You Rely on the Arm's Safety Behavior

• What the arm does when it meets an obstacle or nears a limit depends on its settings: collision detection and its sensitivity⁴⁸, collision rebound⁸⁰, the safety boundary⁴⁹, reduced mode⁵⁰, and which CI inputs are set as Stop Moving, Safeguard Reset or Reduced Mode⁶⁵.
• Check the payload and mounting direction as well. UFACTORY ties false collision triggers to them⁷⁶, and a wrong mounting direction causes uncontrolled motion in manual mode⁵².
• Read the arm's serial number. This project's advice is to read it before relying on any figure the sources disagree on, because UFACTORY tells four xArm 6 versions apart by it⁹⁰. On arms from XF1300, XI1300 or XS1300 onward, a built-in IMU detects the direction of gravity and the software warns when the set mounting direction differs from it by more than 10°⁵². On arms before XX1300 the friction parameters are stored in the controller, and reloading them needs technical support⁷⁷.
• Do not alter the controller safety configuration. The manual says a modified configuration makes the whole robot system a new system, and every safety review, such as the risk assessment, must be updated⁹¹.

The Certificate Trail

• The xArm manual says "The xArm 6 robot is certified and tested by SGS" and has passed EU CE certification. It lists MD 2006/42/EC, EMC 2004/108/EC, EN ISO 10218-1:2011, EN 60204-1:2018, EN ISO 12100:2010, EN 61000-6-2:2005 and EN 61000-6-4:2007+A1:2011⁹².
• The SGS machinery verification the manual links covers "UFACTORY Robotic Arm", model numbers XI13 and XI15, and found the tested samples in conformity with EN ISO 10218-1:2011, EN 60204-1:2018 and EN ISO 12100:2010. It says the CE mark can be affixed, under the manufacturer's responsibility, after an EC Declaration of Conformity is completed⁹³.
• No EU Declaration of Conformity for the xArm 6 is among the sources, although the manual says the arm has passed EU CE certification and both SGS verifications make the CE mark conditional on one⁹⁴.
• The linked SGS EMC verification, for the same model numbers, names the 2019 editions of EN IEC 61000-6-2 and 61000-6-4 under Directive 2014/30/EU⁹⁵. The manual's own list names the older editions under 2004/108/EC, and its EMC section lists both without saying which apply⁹⁶.
• Compare model numbers before you rely on a certificate. The SGS verifications name XI13 and XI15⁹³⁹⁵. UFACTORY lists the xArm 6 as XI1305, and the manual says it applies to XF1305, XI1305 and XS1305⁹⁷. An arm's serial number tells you its model: the letter I marks an xArm 6⁹⁸.
• So the evidence shows verification against ISO 10218-1:2011, not the 2025 edition. That is an inference, from the edition both documents name and A3's statement that the 2025 editions replace the 2011 ones⁹⁹.
• No xArm manual chapter, product page or Studio manual states an ISO 13849-1 Performance Level or Category, or an IEC 62061 SIL, for any xArm safety function, and none mentions TÜV certification. Do not assume any¹⁰⁰. The manual's standards list does not include ISO/TS 15066¹⁰¹.

Power and Force Limiting

• OSHA says contact limits for power and force limiting must be set by risk assessment, using the pressure and force tables in Annex A of RIA TR 15.606, the US adoption of ISO/TS 15066¹⁰².
• The UFACTORY sources do not say whether the xArm 6 is suitable or validated for power and force limiting. They give no contact force or pressure figures for it, and no force threshold for any collision sensitivity level¹⁰³.
• OSHA says the safety functions a collaborative application needs, such as force limiting, speed limiting or space limiting, should be determined during the risk assessment⁸⁹.

The Stop Data and S6

• The manual's Stop Category 1 figures are identical to those in UFACTORY's 850 manual, and both give the test payload as the robot's maximum, 5 kg¹⁰⁴.
• That 5 kg matches the xArm 6's maximum payload, and neither the xArm 5's 3 kg nor the xArm 7's 3.5 kg. This is Inferred: the table itself does not say which model was tested¹⁰⁵.
• The sources give no stop data for Joints 4 to 6, other speeds or payloads, Stop Category 2 (the SI safeguard stop), or stopping after a collision. A separation-distance calculation at S6 needs them¹⁰⁶.
• The manual says the arm will "slightly brake and fall" on an emergency stop, but the sources do not say how far, at which joints, or how long the brakes take to engage¹⁰⁷.
• This project's advice: if the risk assessment needs stopping data, measure the S6 arm's own stopping behavior at the cell rather than use the manual's figures without knowing what they were measured on⁷¹.

Integrator Duties and Modification

• The integrator's duties also include interfacing other machines and additional safety devices if the risk assessment defines them, setting up the right safety functions in software, and specifying instructions for use¹⁰⁸.
• Do not alter the controller safety configuration. The manual says a modified configuration makes the entire robot system a new system, and every safety review, such as the risk assessment, must be updated⁹¹.
• Only UFACTORY may repair the arm. After a repair, checks must confirm the required safety level, and every safety function must be tested¹⁰⁹. The manual says to replace faulty parts only with the same part number or UFACTORY-approved equivalents, and to document all maintenance in writing¹¹⁰.
• Studio advises choosing a mounting place with the cylindrical volume directly above and below the base in mind. It says moving the wrist joint close to that volume makes joints move fast even when the arm moves slowly, and makes a risk assessment difficult¹¹¹.
• The UFACTORY sources give no intended-use or foreseeable-misuse statement for the xArm 6 beyond the environmental conditions and general warnings¹¹², and name no specific pinch or crush points on it¹¹³. Identifying them falls to the risk assessment of the complete system, which the manual makes the integrator's duty³².

The Liability Sentence

• As published, the manual's Limitation of Liability section says safety information "must be construed as a warranty by UFACTORY" that the xArm will not cause injury or damage even if every safety instruction is followed. The wording sits under a heading about limiting liability. Do not read it as a guarantee of safety¹¹⁴.

The S6 Agent and the Safety Settings

• An agent driving the arm through the Python SDK could change collision sensitivity, including to 0, which turns detection off, as well as collision rebound, reduced mode and the safety boundary. Under the manual's own warning, that makes a new system whose safety reviews must be updated¹¹⁵.
• This project's advice: deny the S6 agent those calls, or gate them behind human approval¹¹⁶.
• The UFACTORY sources do not say whether the software safety functions are enforced independently of the motion-command path, and describe the safety boundary only for the tool center point. So do not assume a separate layer checks an agent's motion commands¹¹⁷.
• The SDK's reduced-mode and boundary calls need firmware 1.2.0 or above; the fence-mode and collision-rebound calls need 1.2.11 or above, so check the arm's firmware before an agent relies on them¹¹⁸.
• In servo mode the arm moves to each joint target at its fastest speed, 180 °/s, with no buffer, and UFACTORY says, for safety, not to give a distant target at once¹¹⁹.
• Do not use Studio's simulated-arm mode as the agent's simulation substrate: it needs a real arm connected, its settings apply to the real arm, and its unlock-joint button unlocks the real joints¹²⁰.