IR Category: Safety Incidents

Foreword. IR Category Standard for safety — the heaviest-weighted category of the Intrinsic Rating (category weights live in the VRS-GEN-005 master and its data twin, never here). This edition scores the category as a sum of integer points across ten safety criteria (SF-1…SF-10, 100 points; Clause 6), each earned against a plain-language ladder and bounded by an evidence tier — Unverified, Verified or Certified (Clause 7). It supersedes the rate-based model of the 0.x drafts: no formula, no statistical blend, no qualitative bands. Requirements use “shall”.

Introduction

A robot’s safety is the single most loss-relevant fact about it. This Standard turns “how safe is this model?” into a repeatable number by asking ten questions — has the maker identified its hazards, are its protective functions rated, does the machine reach a safe state on command and on failure, does it hold up at its declared limits, and what has actually happened in the field — and awarding integer points for each. The points sum to a category total of 0–100. What a robot can earn is bounded by how well its evidence is substantiated: public documents alone reach the Unverified ceiling, a manufacturer evidence pack reaches the Verified ceiling, and a witnessed demonstration reaches the Certified ceiling. The category rewards safety that is designed in and shown, not safety that is merely asserted.

1 Scope

1.1 This Standard defines, for the safety intrinsic category: what the category measures (Clause 4); the scoring basis (Clause 5); the ten criteria SF-1…SF-10 with their point ladders and tier ceilings (Clause 6); the evidence admissible at each tier (Clause 7); the determination procedure (Clause 8); a worked example (Clause 9); and the assessor checklist (Clause 10).

1.2 The category shall be assessed at one of three tiers — Unverified, Verified, Certified — and each criterion states the maximum points reachable at each tier. The category tier is the tier whose evidence bar the assessed evidence meets (Clause 8). An Application Rating tier shall not exceed the Intrinsic Rating tier.

1.3 This Standard excludes category weighting and aggregation into the Intrinsic Rating (VRS-GEN-005 §6), sector re-weighting (the sector -201 protocols) and the evidence-grade definitions (VRS-GEN-012). It does not itself assign the Intrinsic Rating.

2 Normative references

• VRS-GEN-001, Vocabulary and Terminology — robot and safety-function terms.
• VRS-GEN-005, Intrinsic Rating — Methodology — point aggregation, tiers, cold-start parity and the company-wide fallback rule (§6).
• VRS-GEN-009, Robot Risk Passport and Registry Schema — the record that carries the category result (Clause 8).
• VRS-GEN-012, Evidence Grades and Data Requirements — evidence kinds and the tier evidence bars.
• ISO 10218-1:2025 / ISO 10218-2:2025, Robotics — Safety requirements (industrial robots; robot applications) — hazard vocabulary and safety-function classes (absorbs ISO/TS 15066:2016).
• ISO 3691-4:2023, Industrial trucks — Driverless industrial trucks and their systems.
• ISO 13482:2014, Robots and robotic devices — Safety requirements for personal care robots (in revision; cite the edition in force at assessment).
• ISO 12100:2010, Safety of machinery — General principles for design — Risk assessment and risk reduction (hazard, hazardous event and harm definitions).
• ISO 13849-1:2023, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design (performance level, PL).
• IEC 62061:2021, Safety of machinery — Functional safety of safety-related control systems (SIL).
• OSHA 29 CFR Part 1904, Recording and Reporting Occupational Injuries and Illnesses — severity vocabulary for field-safety records.

3 Terms and definitions

Terms per VRS-GEN-001 and ISO 12100:2010 (hazard, hazardous situation, hazardous event, harm). Locally:

• safety function — a function whose failure increases risk (ISO 10218-1 / ISO 13849-1 vocabulary: protective stop, speed and separation monitoring, power and force limiting, hand guiding, emergency stop), with a rated performance level (PL, ISO 13849-1) or safety integrity level (SIL, IEC 62061).
• safe state — the declared state the machine enters on command or on a detected fault, in which hazardous motion has stopped and energy is held or removed as declared.
• incident — a hazardous event in which the robot’s behaviour or state was a contributing factor and which caused harm, or would have but for chance or an independent safeguard (a near-miss).
• tier — the evidence stringency at which the category is assessed: Unverified (public evidence only), Verified (manufacturer evidence pack examined), Certified (behaviour witnessed).
• ceiling — the maximum points a criterion can award at a given tier; points earned are capped at the ceiling of the assessed tier.
• evidence bar — the minimum evidence a criterion requires before any points are awarded; below it the criterion scores 0.
• company-wide fallback — where model-specific evidence is unavailable, the substitute points a criterion allows from manufacturer-wide evidence (VRS-GEN-005 §6); marked in the criterion row.
• certificate rung — a ladder step earned by a publicly verifiable third-party certificate (registrar entry or certificate number) in lieu of a witnessed demonstration.

4 What this category measures

4.1 The category measures the model’s safety: the completeness of its hazard analysis, the architecture and rated performance of its safety functions, its behaviour at declared limits and under degraded conditions, its stability and mechanical protections, its software change control, its independent-assessment coverage, and its field-safety record and remediation conduct.

4.2 It measures both design and evidence and record: whether a protective function exists and is rated (SF-1…SF-3, SF-7), whether it performs at the declared limits and fails safe (SF-4…SF-6), whether an independent body has assessed it (SF-8), and what has happened in service (SF-9, SF-10). A criterion is scored only to the tier its evidence supports.

4.3 The category shall be assessed at model granularity (manufacturer + model + declared major variant). Evidence shall not be pooled across models that differ in safety-relevant hardware or safety-software version unless the manufacturer declares them one model for safety purposes and evidence supports that declaration.

5 Scoring basis

5.1 The category score shall be the sum of integer points awarded across the ten criteria SF-1…SF-10 (Clause 6). The maximum is 100 points. There is no rate formula and no statistical blend; the point range of each criterion sizes its importance. Aggregation of this total into the Intrinsic Rating, tier rules and the cold-start parity and company-wide fallback rules are defined once in VRS-GEN-005 §6 and are not restated here.

5.2 Each criterion awards points against a ladder of rungs, highest first, decidable by inspection, measurement, test or documented evidence (VRS-GEN-002 §7.1). The assessor shall award the highest rung the evidence supports.

5.3 Each criterion states three ceilings — Unverified, Verified, Certified. Points earned shall be capped at the ceiling of the tier at which the criterion’s evidence is assessed. A criterion may reach a higher tier than another; the category tier is recorded per Clause 8.

5.4 Each criterion states an evidence bar. Where the bar is not met the criterion scores 0; no evidence is 0 points, never a null or a discard.

5.5 A criterion marked not applicable by class for the model’s form (Clause 6 Applicability row) is excluded from the score and from the totals; the reachable maximum is reduced accordingly and recorded (Clause 8). For the safety category all ten criteria apply to all classes.

5.6 Where a criterion offers a company-wide fallback, manufacturer-wide evidence may earn the stated fallback points when model-specific evidence is unavailable (VRS-GEN-005 §6); the substitution shall be recorded.

6 Criteria

6.0 Summary. Points and tier ceilings per criterion; totals reproduce by addition.

6.1 SF-1 Risk assessment completeness (0–8)

6.2 SF-2 Safety-function architecture and rated performance (0–12)

6.3 SF-3 Emergency stop and safe-state behaviour (0–10)

6.4 SF-4 Primary protective function at declared limits (0–18)

6.5 SF-5 Degraded-condition and fail-safe behaviour (0–10)

6.6 SF-6 Stability and mechanical hazard protections (0–8)

6.7 SF-7 Safety-related software change control (0–6)

6.8 SF-8 Third-party safety assessment coverage (0–10)

6.9 SF-9 Field safety record (0–12)

6.10 SF-10 Field safety notice and remediation conduct (0–6)

7 Evidence by tier

7.1 Unverified. The assessor works only from evidence anyone can obtain without the manufacturer’s cooperation: datasheets and manuals, published declarations of conformity and their cited standards, public certificate registers and class marks, and — for the field-record criteria — public regulator, recall and incident databases and verified press. Each criterion’s Unverified ceiling is the most an honest reading of such evidence can earn; the category tier is Unverified.

7.2 Verified. The assessor additionally examines a manufacturer evidence pack: the risk assessment, the safety-function specification with PL/SIL ratings, functional-safety validation reports, third-party test reports and certificates, the safety-software change history, and the model-specific incident register with its exposure figures. Verified ceilings apply only to criteria whose pack items are present and examined; the category tier is Verified.

7.3 Certified. The assessor witnesses the declared behaviour: e-stop from each device into the safe state, the primary protective function at each declared limit with claim-sized apparatus, degraded-condition and fail-safe responses, and stability and mechanical protections on a test object. Documentary criteria (SF-1, SF-7) and record criteria (SF-8, SF-9, SF-10) carry their Certified points from the Verified evidence. The category tier is Certified.

7.4 Certificate rung. Where a criterion names a certificate rung (SF-3, SF-4, SF-8), a publicly verifiable accredited third-party certificate — identified by registrar entry or certificate number — earns the stated rung without a witnessed demonstration; an unverifiable certificate shall not.

7.5 Field-record regime rule. For SF-9 and SF-10 the reachable Unverified ceiling depends on the reporting regime the model operates under. Where a mandatory public incident-reporting regime covers the model — declared by the sector protocol (e.g. medical device reports and recalls, aviation occurrence databases) — the assessor may treat the public record as complete and the Unverified ceiling is the full criterion range. Where no such regime applies, a recorded null-result search of the public databases, with its coverage stated, earns the criterion’s null-result rung. A search that is not recorded shall not earn it.

7.6 Company-wide fallback. Where a criterion offers a company-wide fallback (SF-9, SF-10) and model-specific evidence is unavailable, manufacturer-wide records earn the stated fallback points (VRS-GEN-005 §6); the substitution shall be recorded per Clause 8.

8 Determination procedure

Step 1 — Fix the tier and applicability. Record the tier at which each criterion is assessed (Clause 7) and, per 5.5, the set of any not-applicable criteria; for the safety category all ten apply.

Step 2 — Award points. For each criterion, the assessor shall award the highest ladder rung the evidence supports (Clause 6) and shall cap the award at the ceiling of that criterion’s assessed tier (5.3). Where the evidence bar is not met, the award shall be 0 (5.4).

Step 3 — Record substitutions. Where a company-wide fallback is used (SF-9, SF-10), record the substitution and the fallback points (7.6).

Step 4 — Sum. The category score shall be the sum of the capped per-criterion points. With no not-applicable criteria the reachable maximum is 100; otherwise it is 100 minus the ranges of the excluded criteria, and this reachable maximum shall be recorded alongside the score.

Step 5 — Record the tier reached. The category tier is the lowest tier among the criteria that determined the score (a score resting on any Unverified criterion is an Unverified-tier result).

Step 6 — Output and passport binding. Record, for the model’s Robot Risk Passport safety-category record (VRS-GEN-009): the category score, the per-criterion points, the ceiling reached and tier for each criterion, the not-applicable set and reachable maximum, and the company-wide substitutions, so that an underwriter or lender can reproduce and audit the score from the passport alone. The per-criterion points carry the frequency and severity loss drivers; residual value, recoverability and obsolescence are the finance drivers of economics_residual (VRS-GEN-107) and serviceability (VRS-GEN-103) and shall not be inferred from this score.

9 Worked example (fictional model)

“Northline AMR-7”, a warehouse AMR, assessed at the Verified tier: a manufacturer evidence pack is examined but no behaviour is witnessed. All ten criteria apply (reachable maximum at Verified = 79).

The safety-category total is 76 of a reachable 79 at the Verified tier. Two points are lost at SF-9 (one remediated minor-incident history rather than a clean record) and at SF-2 (one hazard’s function rated but not yet third-party-assessed, which the pack’s ceiling of 9 already bounds). To reach the SF-4 rung of 18 or the SF-3 rung of 10 the model would have to be assessed at the Certified tier, where the primary protective function and each e-stop device are witnessed. The score, the per-criterion points, the ceiling and tier reached for each criterion, and the empty not-applicable set are recorded to the passport (Step 6).

10 Assessor checklist

• [ ] Model granularity confirmed and safety-software version scope declared (4.3).
• [ ] Assessment tier fixed per criterion; not-applicable set recorded (Step 1); reachable maximum recorded.
• [ ] SF-1 risk-assessment completeness scored; a dated risk assessment exists (evidence bar).
• [ ] SF-2 safety-function architecture and PL/SIL ratings scored; function list declared (evidence bar).
• [ ] SF-3 e-stop and safe-state behaviour scored; certificate rung applied only if publicly verifiable (7.4).
• [ ] SF-4 primary protective function at declared limits scored; limits declared numerically (evidence bar).
• [ ] SF-5 degraded-condition and fail-safe behaviour scored.
• [ ] SF-6 stability and mechanical protections scored; stability limits declared (evidence bar).
• [ ] SF-7 safety-related software change control scored; rated version declared (evidence bar).
• [ ] SF-8 third-party assessment coverage scored (0 is valid).
• [ ] SF-9 field safety record scored; regime rule and null-result rung applied per 7.5; exposure or null-result search recorded.
• [ ] SF-10 notice and remediation conduct scored; regime rule per 7.5.
• [ ] Company-wide substitutions recorded (Step 3; 7.6).
• [ ] Each award capped at the assessed-tier ceiling (5.3); no-evidence criteria scored 0, never null (5.4).
• [ ] Score, per-criterion points, tier and ceiling reached recorded to the passport (Step 6).

Bibliography

• ISO 10218-1:2025 and ISO 10218-2:2025, Robotics — Safety requirements — Part 1: Industrial robots; Part 2: Industrial robot applications and robot cells (absorbing ISO/TS 15066:2016).
• ISO 3691-4:2023, Industrial trucks — Safety requirements and verification — Part 4: Driverless industrial trucks and their systems.
• ISO 13482:2014, Robots and robotic devices — Safety requirements for personal care robots.
• ISO 12100:2010, Safety of machinery — General principles for design — Risk assessment and risk reduction.
• ISO 13849-1:2023, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design.
• IEC 62061:2021, Safety of machinery — Functional safety of safety-related control systems.
• ANSI/RIA R15.08-1-2020, Industrial Mobile Robots — Safety Requirements — Part 1.
• OSHA, 29 CFR Part 1904, Recording and Reporting Occupational Injuries and Illnesses (2024 edition).
• UL 3300:2022, Outline of Investigation for Service, Communication, Information, Education and Entertainment (SCIEE) Robots.

Change history