工业人形机器人安全认证难，因跌倒本身就是危险，需重新定义安全机制。
Toward Certified Functional Safety for Industrial Humanoid Robots: The Fail-Passive Gap and a Feasibility Study
- 用外部安全链定位机器人侧无法认证的故障被动缺口。
- 实测表明人形机器人无法实现完全安全断电，因平衡依赖持续控制。
- 适合关注工业安全、人形机器人落地的工程师和研究者。
工业级人形机器人面临的核心瓶颈并非运动或操作能力，而是腿部平台功能安全认证的不成熟。根本原因在于：腿式机器人的安全状态是主动维持的，违背了ISO 13849-1 / EN 60204-1中“断电即安全”的假设——对行走双足机器人断电将导致失控跌倒，因此传统断电本身即为风险。我们称此为‘故障被动缺口’。通过使用经认证的外部安全链（光幕、急停、安全输入、安全PLC、无线PROFIsafe），可精确定位该缺口：因外部链可量化（PFHD、DC、CCF、PL/SILCL），剩余不可认证部分被锁定在机器人侧反应链。基于西门子安全型S7-1500急停参考系统，我们验证其可认证的反应子系统为接触器式断电（停止类别0），而这正是平衡型人形机器人无法采用的方案。本文不声称实现端到端的认证等级PLe/SIL3。在3m×1.5m半封闭工作区的Unitree G1 EDU抓取放置单元上完成验证，提出针对人形机器人的主动安全状态分析（跌倒即危险、单支撑停止边界、平衡策略残余风险、ISO 13855间距要求）及溯源标记的时间预算。将工业软件定义自动化（SDA）控制器部署于机器人本体，与平衡策略共置，使机器人侧PROFINET/PROFIsafe接收标准化至IEC 61131-3接口；但由于G1自身计算单元非安全级硬件，该端点仍非认证安全运行时，进一步凸显而非解决故障被动缺口，将其精准定位至SDA至平衡策略接口。
原文摘要 · Abstract (English)
Industrial humanoid robots are constrained less by locomotion or manipulation capability than by the immaturity of functional safety certification for legged platforms. The root difficulty is that the safe state of a legged robot is an actively-controlled state, which violates the fail-passive assumption underlying ISO~13849-1 / EN~60204-1: removing power from a walking biped causes an uncontrolled fall, so classical de-energization is itself a hazard. We term this the fail-passive gap and use a certified external safety chain (light curtain, emergency stop, fail-safe input, fail-safe PLC, and wireless PROFIsafe) as an instrument to locate it precisely: because the external chain is closed and quantifiable with established methods (PFHD, DC, CCF, PL/SILCL), the residual uncertifiable element is pinpointed to the robot-side reaction chain. Using a Siemens fail-safe S7-1500 emergency-stop reference, we show its certifiable Reaction subsystem is contactor-based power removal (Stop Category~0)---exactly the element a balancing humanoid cannot have. We deliberately do not claim end-to-end certified PL~e / SIL~3. We validate the approach on a Unitree G1 EDU pick-and-place cell in a 3m x 1.5m semi-enclosed workspace, and contribute a humanoid-specific analysis of the active safe state (fall-as-hazard, single-support stop bounds, balancing-policy residual risk, ISO~13855 separation) and a provenance-labeled timing budget. Hosting an industrial software-defined automation (SDA) controller on the robot, co-located with the balancing policy, moves robot-side PROFINET/PROFIsafe reception onto a standardized IEC~61131-3 interface; because the G1's onboard compute is not safety-rated hardware, this endpoint is not a certified safety runtime, which reinforces rather than resolves the fail-passive gap and localizes it to the SDA-to-balancing-policy interface.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。