RO1 User Manual

4 Safety

4.1 Overview of Safety Features

The Thor robot includes many safety features for operating in hybrid and industrial applications. The exact implementation of these features will depend upon the application and risk assessment. The final performance level of the system will depend on the integration and must be calculated by the integrator.

Thor has parameters for the below settings that can be fully customized for the end application and allow for integration with a wide variety of industrial safety components.

• Joint Collision Thresholds
• Joint Velocity, Acceleration, and Torque limits
• Emergency Stop Inputs
• Safety IO / OSSD
• 3-Position Deadman Switch

4.1.1 Response Time

Thor responds to safety events within the tolerances in the below chart:

Safety Input Event	Worst Case Detection Time	Worst Case Power Off Time	Worst Case Response Time
Internal Emergency Stop	50ms	600ms	600ms
External Emergency Stop	50ms	600ms	600ms
External Safety IO Slow Speed Input	50ms	N/A	600ms
External Safety IO Emergency Stop	50ms	600ms	600ms
Tablet or Browser E-Stop	1000ms*	1600ms*	1600ms*

*Network Latency Dependent

Safety Output Event	Worst Case Response Time
Robot E-Stop	50ms

4.2 Safety Settings

WARNING – Safety Parameters Shall Match the Operating Scenario and the Presence of Persons

All safety-related parameters – speed and slow-speed limits, safety-input assignments, auto-reset behavior, collision-detection thresholds, and payload mass – are safety-critical and shall be configured per the integrator’s ISO 10218-2 risk assessment for the actual operating scenario.

Parameters validated for one scenario – for example automatic or person-excluded (“outside the cage”) operation – shall not be used when a person can be inside the safeguarded space. Parameters safe for an excluded person are not safe for a present person.

After any change, the affected safety functions shall be re-verified before returning to production (settings apply only on “Apply”). Access shall be restricted by PIN/role to authorized personnel.

Using parameters that do not match the actual presence of persons may delay or prevent the safety reaction and expose personnel to hazardous motion

Safety Settings can be accessed by tapping the robot menu, then Settings > Safety.

Settings are locked by default; click the “Unlock” button and re-enter the robot PIN to make the settings here editable.

Safety settings do not take effect until you tap “Apply Settings.”

4.2.1 Speed Limits

4.2.1.1 How Limits Work

Thor has several levels of limits; the robot is always gated to the lowest of all of these:

• Global Limits: defined in Safety settings, which affect tooltip speed and the acceleration, velocity, and torque of joints.
• Speed Modifier % Slider: the robot can be slowed down on an as-needed basis (for instance, to trial a routine) without requiring access to Safety Settings.
• Step-Level Limits: the robot can also apply an alternate set of speed limits only for the duration of a specific step.

All of these settings are described below.

4.2.1.2 Editing Global Limits

The first tab of safety settings allows setting limits on the speed and acceleration of both the tooltip and the joints of the robot.

4.2.1.2.1 Using Factory Presets

By default, you will be presented with the choice of several presets.

The “default” (middle) setting restricts the robot to a tooltip speed of 0.75m/s at full speed or 0.5m/s at slow speed, which is safe for most hybrid settings. Note that an unguarded or partially guarded hybrid setting requires the use of peripheral safety devices, such as area scanners or light curtains, wherever hard guarding is not used. Several other speed restriction settings are available; if there are factors that may require more caution (such as the robot’s payload or end effectors), it may be desirable to select a more conservative setting.

Remember that many factors can affect whether a given speed is safe. Before putting the robot into production, you should always conduct a full safety assessment per ISO 10218-2 to determine the proper values for these settings and any other mitigations required.

To review the values set for these factory presets, you can scroll down.

4.2.1.2.2 Custom Limits

To edit these limits, switch off “Use Factory Preset”; the limits should then become editable:

The following can be customized, both for when the robot operates at its full speed and in a “slow” mode that can be triggered via Safety I/O settings:

• Tooltip Speed: This limits the speed of the tooltip in Cartesian space.
• Per joint:
  • Max velocity: This is the maximum angular change in the joint’s position per second permitted.
  • Max acceleration: This affects the rate at which the joint can change speed. If this is too low, the robot may not be able to achieve the maximum velocity otherwise permitted during the course of a movement.
  • Max torque: The maximum torque that the motor in the joint can exert.

4.2.2 Speed Modifier % Slider

The robot can be slowed down from its maximum as needed inside the robot menu.

This is useful for trying out a routine before putting it into production.

Setting this slider only applies a cap to the maximum limits that would otherwise be set in Safety Settings; movements that were already slower than that are not affected.

4.2.3 Customizing Speed Limits For A Step

When editing a “Move” step, the “Motion Speed” shows the speed of this specific step. This is useful to notice for delicate movements or when required for safety. To change the speed, tap the “Edit Motion Limits” icon.

By tapping “Edit Motion Limits”, several options are available. The motion can be restricted to percentage of the maximum (as with the global speed modifier in the robot menu), or to a new set of custom limits.

Note that these limits apply whether the robot is operating at full speed or at any “slow” speed mode defined in safety settings. The robot will always apply the lowest of all limits in effect. It is also not possible to set torque limits on a per-step basis.

4.3 Safety I/O

In the safety Settings there are two tabs for I/O, Safety Inputs and Safety Outputs. Safety inputs allow you to tie in devices such as area scanners and key switches to discrete inputs onto your control box. Safety outputs allows the robot to indicate safety-critical elements of its status over discrete outputs to other devices like PLCs and other moving equipment that should stop when the robot does.

4.3.1 Configuring Safety Inputs

The sixteen 24V inputs on the control box are all safety-rated and can be used in pairs. Safety devices are connected in pairs to eliminate the possibility of a stray signal keeping the robot operating while actually in an unsafe condition. Therefore, if either of the paired inputs is below 24V, it will be treated as a “low” signal.

The following options are available:

• Safety Function Assignment: Any ports can be assigned to:

  • Emergency Stop when low: Triggers a category-0 stop that brakes the robot and cuts power to arm.
  • Pause when low or when high: Pauses the currently-running routine but does not brake the robot.
  • Slow Speed when low: Makes the robot observe the “Slow Speed” set of limits defined in the “Limits” tab. This is useful, for instance, with an area scanner, to force the robot to move at a reduced speed when people are nearby in a hybrid setting.
  • Reset Safeguards When High: This will reset the effects of any safeguard that does not have auto-reset (see below). This has no effect on emergency stop.

• Auto-Reset: This controls whether the effect of the function, once triggered, should go away (i.e. when we move back from low to high) or whether it requires a separate, explicit Reset. This is useful, for instance, with a sensor on a door to a fence around the robot: one would not want the robot to re-engage or speed up if the door is closed behind someone.

  
  

  

4.3.2 Configuring Safety Outputs

Additionally, the sixteen outputs on the control box are all safety-rated and are also used in pairs to eliminate the possibility of a stray signal keeping the robot operating while actually in an unsafe condition.

The following options are available:

• Emergency Stop
• Reduced Speed mode
• Full Speed mode
• Robot is moving
• Robot is still

4.4 Collisions & Protective Stops

When the robot is running a routine and encounters a collision, it will stop. The routine can be re-started with the “Play” button in the top toolbar. Every time a collision occurs, it will also log the time and force measured, which can be reviewed in the Notification (bell) section.

Collisions are detected with two methods: 1) by monitoring the current coming out of the joint motor to measure torque and find discrepancies, 2) by monitoring an IMU (accelerometer) inside each joint.

4.4.1 Adjusting Collision Sensitivity

Depending on the environment and safety requirements, it may be desirable to change the sensitivity of collision detection. This can be done in the “Collisions” section of Safety IO.

This allows adjusting the thresholds used for both methods: the torque shock threshold (in newton-meters) and the acceleration threshold used by the IMU (in m/s²).

4.5 Setting the Robot’s Payload Mass

The robot’s knowledge of its payload mass affects its ability to balance and sense collisions. It’s important for overall safety to configure the payload as part of setting up a robot cell with Thor.

There are two ways to set the payload:

1. By adding a Set Payload step to a routine
2. By setting the payload parameter within an Actuate Gripper step. This is useful for situations where the payload changes as a result of the gripper.

The payload mass entered should account not only for the mass of the payload itself but also that of any attached end effectors. The spec sheet for the end effector should include this information.

4.6 Implementing Safeguarding Devices

Every safety scanner has a unquie implimentation method. Please consult the manufacturer’s guide for an in-depth procedure on how to install the device. Below is a generic wiring diagram intended to aid with installing a safety scanner.

4.7 3-Position Enabling Deadman Switch

The 3-position enabling Deadman switch is a safety device used to control robot motion during manual or teach operations. It ensures that the robot can only move when the operator is intentionally and safely holding the switch in the correct position.

The switch has three distinct positions:

1. Released (Position 1) When the switch is not pressed, robot motion is disabled. This prevents unintended movement when the operator is not actively engaged.

2. Enabled (Position 2) When the switch is pressed to its middle, neutral position, robot motion is permitted. This is the only position in which manual movement (including ‘Tap to Recover’) or teaching is allowed.

3. Fully Depressed (Position 3) If the switch is squeezed beyond the enabled position—such as during a startle or panic reaction—robot motion is immediately stopped.

   

   

This design provides fail-safe behavior in both loss-of-contact and panic scenarios. Releasing or over-pressing the switch causes a stop, reducing the risk of injury during close-proximity operation.

The 3-position enabling Deadman switch is intended for use only during manual modes (e.g., teach, maintenance, jogging, unbraking, etc) and must be continuously held in the enabled position for robot motion to occur.

4.7.1 Pendant Connection Locations

The electrical connections for the pendant are located on the bottom edge of the tablet and control box, as shown in the connection images.

4.7.1.1 M12 Connection

• The M12 connector is a circular, multi-pin connector located on the underside of the pendant and control box.
• This connection is used for hard-wired communication and power.
• Ensure the M12 cable is fully seated and securely tightened before operation.

4.7.1.2 USB-C Direct Connect

• The USB-C port is located adjacent to the M12 connector on the bottom of the pendant and control box.
• This port supports direct USB-C connection.
• Use only approved USB-C cables to ensure reliable communication and power delivery.