An Online Toolkit for Applications Featuring Collaborative Robots Across Different Domains

Collaborative robots (cobots) are being applied in areas such as healthcare, rehabilitation, agriculture and logistics, beyond the typical manufacturing setting. This is leading to a marked increase in the number of cobot stakeholders with little or no experience in traditional safety engineering. Considering the importance of human safety in collaborative robotic applications, this is currently proving to be a barrier to more widespread cobot usage. A web-based Toolkit that targets cobot end-users and manufacturers with varying levels of safety expertise was developed, helping them to understand how to consider the safety of their cobot applications. In this work, we will provide an overview of the state of the art for ensuring cobot safety, highlight the support provided by the “COVR Toolkit” and introduce three examples where third parties applied the Toolkit for their collaborative robotics application.


I. INTRODUCTION
H UMAN-ROBOT collaboration (HRC) represents a synergistic combination of collaborative robots (cobots) with humans, with a focus towards facilitating processes and supporting the humans in their work. Recent research activities [1] have led to many advances, particularly with respect to the integration of safety features in robot control systems and multimodal interfaces for intuitive human-robot interaction. Recent statistics indicate that robots are being deployed for applications beyond manufacturing, including logistics, construction, inspection and maintenance, and even medical uses [2]. This larger scope of applications is serving to remove traditional boundaries between industrial and service robots, as discussed in [3], consequently broadening the HRC concept beyond the industrial domain. Another current trend in robotics is the application of artificial intelligence and machine learning techniques for typical challenges such as perception in unstructured environments, behavioral adaptation, and improved interaction with humans. Taken together, there is an overall increase in the number of robotics stakeholders working on collaborative applications and who have little or no experience in safety engineering.
The flexibility of current robotics technologies means that the same robotic hardware can be used for a variety of applications, e.g., both in the industrial or in the healthcare domains. This "cross-domain" nature of robotics is a boon to robot manufacturers and users alike, but presents special challenges from the perspective of safety and standardization. International standards represent the state of the art and best practices. In the European Union, the application of harmonized standards, while voluntary, confer upon users the assumption of conformity to essential health and safety requirements. In an increasingly uncertain world, such assumption of conformity is a helpful way for manufacturers to ensure that their system is safe. Standards are currently organized according to specific domains. As an example, there are separate standards for industrial robots used in manufacturing and for robots used for healthcare and rehabilitation activities. Although it is now possible to use the same robotic hardware for different domains, they can be subject to different and not entirely synchronized requirements, based on the domain the robot is being used (e.g., using an exoskeleton in the factory or for rehabilitation purposes). This creates uncertainty for manufacturers and end-users alike.
Previous work [4], [5] has addressed the challenge arising due to the cross-domain nature of cobots through the introduction of the concept of safety skills. This term has recently been refined and referred to as "safety-relevant HRC skills, HRC skills"-in the development of a CEN Workshop Agreement [6]. It is defined as an abstract representation of the ability of an HRC application to reduce a risk, irrespective of the implementation. It builds on the idea that mechanical hazards can be similar and independent of the domain of the application, and is supported to a certain extent by current cross-references between standards from different domains (e.g., the ISO/TR 23482-1 [7], which relates to service robots, references the ISO/TS 15066 [8], which is specific for industrial robots). This approach is particularly useful when considering how to execute a system level validation measurement (SLVM) of an HRC application. The how-to guides for executing SLVM are known as system level validation protocols, hereafter referred to as "protocols".
The main contribution of this article is to describe the COVR Toolkit that supports various cobot stakeholders in understanding and validating the safety of their application. The article provides examples from three COVR awards on how they used the Toolkit and reports on feedback for improvements that were suggested by Toolkit users. This article is structured as follows. We begin with an overview on the state of the art for ensuring safety of HRC applications and a description of a specific lifecycle model for the design and implementation of HRC applications as the motivation for the Toolkit. This will be followed by a description of the Toolkit as a freely available website to support robotics stakeholders across all their life cycle activities. Then, we introduce three exemplary COVR award projects, highlight their use of the Toolkit and feedback they provided. The article will end with an outlook on future developments of the Toolkit including COVR Hubs as a means for community-building beyond the end of the project.

A. Essential Health and Safety Requirements for Human-Robot Interaction
Within the European Union, the EC Machinery Directive MD/2006/42 specifies the essential health and safety requirements for all machines (including collaborative robots for all domains such as manufacturing, healthcare or rehabilitation) introduced to the market. This directive also explains the requirements for achieving self-conformity (via the CE mark [9]) and references harmonized standards for further guidance about the essential health and safety. While conformity to these harmonized standards is not compulsory, their application does offer manufacturers a high degree of certainty that their systems are safe and in the event of an accident, puts the burden of proof or negligence misdeed on the regulatory body and not the manufacturer. Given this situation, robotics system integrators and manufacturers often choose this path and conform with harmonized standards.
Additionally, the EU regulation 2017/745 (European Parliament and Council of the European Union, 2017), also known as the medical device regulation (MDR) [10] needs to be observed by robots used in healthcare and rehabilitation. The MDR emphasizes safety and performance across the lifetime of the application.
The challenges arising due to the transversal nature of robots with respect to domains have been discussed in [11]. In particular, it is not always clear for manufacturers or end-users which standards are applicable to their systems or how to deal with conflicting recommendations from different standards.
Previous research has addressed the challenge of considering safety in HRC applications through the use of model-based approaches, either in combination with automated techniques for identifying risks and considering erroneous human behavior [12] or in combination with traditional fault-tree analysis [13]. An extensive list of guidelines for prevention of mechanical hazards for HRC applications in the industrial domain are developed in [14]. Such approaches have proven to be useful in reducing the overall number of mechanical hazards in specific applications, but are still limited to the industrial domain.
In the healthcare domain, researchers have used musculoskeletal modeling [15] and numerical simulations [16] as a means to identify loads on joints and other structures to assess the effects of specific device designs [17] and assess risks associated with incorrect alignment or an incorrectly implemented limitations to the ranges of motion [18], [19]. These simulation-based approaches all suffer from uncertainties regarding the validity of model behavior, due to underlying assumptions regarding, for example, human joint mechanics or tissue characteristics.
The agricultural domain is affected by the increasing introduction of robotics and automation, aimed at increasing productivity through automated execution of operations, such as harvesting, weeding, and pruning [20]. However, the so-called "Agriculture 4.0" revolution is still far from its full implementation [21]. Nevertheless, agricultural robotics is widely addressed by the scientific literature of the last decades, with HRC representing one emerging topic: in [22], HRC safety and ergonomics issues are extensively discussed from the perspective of the agricultural domain; in [23], issues deriving from farm workspace sharing are analyzed, proposing guidelines for HRC strategies; [24] reports a detailed review of cooperative robotics in agriculture including a comprehensive summary of HRC-related studies.
The authors believe that one way to support the robotics community in evaluating the safety of HRC applications is to provide detailed instructions on how to measure the efficacy of implemented safety measures. This is a trend increasingly seen in recent standardization activities. As an example, the recent final draft international standard (FDIS) version of the ISO/FDIS 10218-2 [24], published in 2021 and currently in evaluation, has added information to guide users through the process of executing a validation measurement for when the operating mode power and force limiting is used. Other standards which also define testing procedures include the ISO/TR 23482-1, the ISO 3691-4 [25], and the ISO 18646 series. The ISO/TR 23482-1 specifies test methods to verify compliance to the requirements of 13482, and is applicable to personal care robots. The ISO 3691-4 is intended to be used for driverless industrial trucks and automatically guided vehicles. It defines procedures to test the stability of the vehicle, as well as for human detection. Guidance for measuring rated speeds and stopping characteristics is provided by the ISO 18646-1 [26]. Additionally, the ISO 18646-2 [27] specifies methods to evaluate obstacle detection and obstacle avoidance functionalities. Navigating which standards apply for which applications can be challenging for novice robotics stakeholders, especially in situations where the same robotic hardware is used in multiple domains. Concerning medical robotics, specific standards have to be considered, even concerning the risk assessment: while ISO 12100 [28] is the type A reference standard for the safety of machinery and describes the related risk assessment process, ISO 14971 [29] introduces the concept of benefit-risk analysis and provides instructions for the risk management process, which are both crucial for all the medical products. The standards from the IEC 60601 series address the different categories of medical electrical equipment. IEC 60601-1 [30] reports the main safety and performance requirements, which are complemented and, eventually, replaced, by more specific standards of the series. Particularly for robotic devices, IEC 80601-2-77 [31] addresses robotically assisted surgical equipment, while IEC 80601-2-78 [32] focusses on medical robots for rehabilitation, assessment, compensation or alleviation.

B. Life Cycle Model for HRC Applications
For the development and deployment of HRC applications, six particular life cycle phases can be identified. Their relation to the generic life cycle model is shown in Fig. 1. This six-phase model served as the basis for the development of the COVR Toolkit, which aims to be the most comprehensive resource for supporting robot stakeholders in ensuring the safety of their HRC applications. In the following, we will describe these six phases in detail, highlighting stakeholder needs.
The first life cycle phase pertains to users seeking inspiration from available solutions, to identify the state of the art. In particular, stakeholders are interested in learning about the safety challenges and how they were handled. We expect the level of background knowledge to vary across stakeholders, so any offering should be simple enough for novices to understand, while also offering enough details that are of relevance for more expert users.
During the second life cycle phase "requirements specifications," stakeholders are interested in identifying which standards, regulations, or laws are applicable to their system. As in phase 1, we expect stakeholders to have varying levels of expertise and background knowledge, whereby here it would be more important to cater to those with a lower level of experience.
A typical task during the third life cycle phase, "design" is the execution of a risk analysis. This is often carried out in correspondence to ISO 12100 [28] and includes the sub-tasks of identification of hazards, calculation of risk, and identification of risk reduction measures (RRM). Although the execution of risk analyses is common within industry, novel HRC applications feature additional hazards that can be confusing. We expect that stakeholders interested in support for execution for a risk analysis to have a wide variety of expertise, whereby a focus on novice users is preferable.
Phase 4 "implementation" spans all activities prior to normal operation, such as commissioning and software testing. In the following phase, "verification/validation," a validation measurement is typically executed. This serves as proof that the implemented RRM are sufficient to meet safety requirements. Therefore, this phase should address the how-to aspect of such validation measurements.
During phase 6 "operation," it is important to observe the system performance and adapt the risk assessment if necessary. Additionally, any change to the system also needs to be reviewed, to identify whether the risk analysis needs updating or if new validation measurements are necessary.
The toolkit was developed to systematically address the safety related needs of stakeholders in all of the life cycle phases for the design and implementation of HRC applications. Further details on specific engineering tasks involved in each phase have been reported in [33]. To the best of the authors' knowledge, there are no comparable online services or guides that systematically support coboteers along all these life cycle phases.

C. Cross-Domain Safety Skills Approach
As previously mentioned, six HRC safety skills were identified through a top-down and bottom-up approach [4]. The top-down method analyzed existing standards to identify operating modes or methods for safeguarding HRC applications. The bottom-up approach defined a large range of HRC applications from a variety of domains and then identified possible risk mitigation methods for typical hazards. HRC safety skills are an abstract representation of the ability of an application to reduce a risk defined irrespective of the implementation and can be validated for specific applications at a system level. These skills are: maintain safe distance, maintain dynamic stability, limit physical interaction energy, limit range of movement, maintain proper alignment, and limit restraining energy. It is important to underline that these HRC safety skills are not meant to replace existing definitions or supersede available standards. They were designed to simplify system level safety validation and allow for the development of protocols that are transversal with respect to robot application domains. An overview of the relationship between operating modes from existing standards and the six safety skills is reported in [5].

III. COVR TOOLKIT AS A KNOWLEDGE BASE
The COVR Toolkit (www.safearoundrobots.com) is a webaccessible knowledge base (see Fig. 2) for cobot stakeholders interested in safety of HRC applications [33]. The first version consisted of a simple database to identify applicable standards and regulations based on the robot type and application domain of an HRC application. It also featured a database of system level validation methods, which could be filtered according to their domain, safety skill involved, and type of robotic device.
From 2019-2021, the Toolkit was updated in yearly cycles to systematically address the needs of several stakeholders along the different life cycle phases. In the following, the various aspects of the Toolkit and their relation to the lifecycle phases from the previous section will be described.

A. Phase 1 Support-Case Stories
Case stories in the Toolkit are meant to support coboteers during phase 1 "Inspiration and technology scan" of the lifecycle for cobot development. The Toolkit currently features over 50 case stories. These downloadable pdf documents compactly describe challenges, solutions and lessons learned from the projects funded by the COVR consortium (COVR awards). In order to create value for the target community, these case stories feature a high level of transparency regarding safety challenges and considerations. Although case stories are intentionally kept brief, they often link to other documents such as detailed project deliverables with experimental data or risk assessments. Case stories are intended to be understandable by people with a low level of HRC safety background knowledge, whereas the additional documents are targeted towards stakeholders with higher levels of expertise.

B. Phase 2 Support-Directives and Standards
To support robotics stakeholders during phase 2 activities, the Toolkit features the subsection "directives and standards." It works as a filter to identify directives and standards relevant for a specific combination of operating domain and type of robot components. The filter currently differentiates between combinations of six different types of cobot devices. The filters match the level of detail needed to differentiate between different directives and standards, and are intended to be nonetheless simple and understandable for novice robotics stakeholders.

C. Phase 3 and 4 Support-Risk Assessment
It is necessary to conduct a risk assessment for all HRC applications, and there was genuine interest, especially among novice robotics stakeholders, in practical support with this activity. This section corresponds to phase 3, and in the case of changes to an operating system, phase 4 of the life cycle model. The risk assessment section summarizes the individual steps for executing a risk assessment. It features a number of short explanatory videos describing typical hazards and mentioning possible corresponding risk mitigation methods.
While many companies have safety experts who are well versed in the execution of a risk assessment for typical machines, they often have less experience with HRC applications. This was the rationale behind the practical examples of typical hazards, as well as a downloadable risk assessment template. This section was also designed for stakeholders with varying levels of background knowledge. Expert stakeholders will appreciate best practice examples, while non-experts are targeted through the videos and step-by-step explanations.

D. Phase 5 Support-Protocols
Over thirty different step-by-step guides, called protocols, were specifically developed to explain how to execute SLVM for HRC applications based on the types of robot device and the applied HRC safety skill. The section protocols features a filtering tool similar to the directives and standards section, to help users to find applicable protocols. In the case of protocols, there is no filter for domain (e.g., healthcare, manufacturing, or logistics), in contrast to the directives and standards section, since protocols are meant to be valid across all domains. Any applicationspecific attributes that should be considered when executing an SLVM (e.g., specification of certain situations/environments) are identified within the protocols themselves. Protocols can be downloaded and used when planning and executing SLVM during phase 5 of the life cycle model. To provide additional support to novice stakeholders, a number of online videos have been created and linked to the corresponding protocol.

E. General Background Information-Test Equipment, Publications, Legal Tool and FAQs
In addition to the Toolkit sub-sections that correspond directly to the life cycle model, there are four further features that provide useful background information for stakeholders. The section "test equipment" contains a database of measurement equipment that is suitable for the execution of SLVM and is closely related to the protocols. Whereas protocols are by design measurement equipment agnostic, users have indicated that they would also appreciate support in finding suitable measuring equipment. The database can be filtered according to the specific physical dimension to be measured, such as pressure, distance, etc. The library is the result of market research, but should not be considered as an endorsement for any specific manufacturer. The section also solicits Toolkit stakeholders to suggest new devices to be included in the database.
The "publications" section of the Toolkit lists over 90 different publications, that are relevant to cobot safety. The publications were initially curated by the COVR consortium based on their research and experience. External users can also submit suggestions for additions. This section is targeted towards the academic community.
The most recent addition to the COVR Toolkit is the legal tool. It is designed to provide guidance to users on the legal and legislative aspects of cobots. It is strongly based on the output of the COVR Award "LEGARA," which is white paper published by the law firm CO:Play [34]. The legal tool covers topics such as the European legislative landscape, CE marking, liability for accidents, and legal risk assessments. Interestingly it also explains the legal value of voluntary documents, such as standards or protocols.
For stakeholders with a lower level of robotics expertise, the COVR toolkit also features a frequently asked questions (FAQ) section. Here, key terms and concepts are explained.

IV. COVR AWARD PROJECTS AND TOOLKIT USAGE
The COVR Project provided over 5 million Euros in funding to third parties (so-called COVR Awards) to act as beta testers of the Toolkit while developing their own cobot application. They were asked to use the toolkit and protocols in order to identify gaps and errors, or to add their specific domain knowledge to the Toolkit. In total, 60 projects featuring 108 organizations from 14 European countries were funded. The organizations included 40 technology developers, 36 universities/research organizations, 14 end-users, 12 integrators, and 6 other types of organizations. While the majority of the COVR Awards were focused on the domains, of manufacturing, healthcare, rehabilitation, and logistics, there was a long tail of other projects, focusing on application areas such as recycling, professional services, agriculture, construction, and food service.
In this section, we will briefly present three COVR Awards, highlighting their usage and feedback to the Toolkit. In particular, by way of example, we report about projects that feature a collaborative robot for different domains of application (specifically industrial, agriculture, and rehabilitation). Table I gives the key attributes of the three projects, leading to the following observations. 1) Similar robotic devices can be used in a variety of applications and domains with very different associated standards. 2) Depending on the application and the domain, safety issues can be different and require specific strategies.
3) The COVR Toolkit and, in particular, the "skill-based" transversal approach are appropriate to deal with the different issues and challenges.  Fig. 3. Overview of the cobot workstation, different potential workspaces, and products associated with them. The various combinations can lead to potentially different hazards for a human working collaboratively in the workstation.

1) Introduction of Partners, Project Goals, Relevant Domain:
The CoSMo project aimed to enable system integrators to efficiently perform the risk assessment for a potentially large number of cobot applications in industrial manufacturing. In particular, the solution focused on how an applications engineer can review and update the risk analysis of a robotic cell after it has been adapted to manufacture new products. The project included two partners, namely the CoR-Lab of Bielefeld University and the Weidmüller Interface GmbH & Company KG. The CoR-Lab is interested in topics related to cognitive and social robots that interact intuitively with humans, while Weidmüller is a leading company in industrial connectivity.
Weidmüller uses modular cobot workstations (see Fig. 3) to produce various types of terminal blocks from the product range. A dedicated goal is to minimize the time required for setting up and adjusting the machine to new products. This is achieved by using exchangeable workspaces, which can produce different types of terminals (see Fig. 3, right, Products). The robot with its attached gripper tool moves along the individual stations (max. 4) of the workspace (see Fig. 3, workspaces 1-4) and is primarily used for material handling. An exemplary assembly process is explained in the following: a terminal insert is assembled from station to station and pressed into the terminal housing at the last station by using a pneumatic pressing device. The finished terminal is inspected by a camera and, if free of defects, is placed in the cardboard box. Otherwise, it is placed in the container for defective terminals via a metal chute. Then the process starts all over again. When the cardboard box is full, it is pushed via chute to a printing device, which prints the contents of the box on the label. The carton then slides over the carton chute to the removal point. If a different type of terminal can be produced by the already installed workspace, only the program of the production process is adapted. Otherwise, the modular workspace must be replaced, and the corresponding robot program must be loaded.
The basic frame of the machine is made of aluminum profiles. Furthermore, a UR3e robot from Universal Robots, a gripper from Zimmer, a camera from Cognex, a pressing device, a programmable logic controller (PLC), a touch display, and a Weidmüller workspace module are installed. Additionally, there are two carton chutes (infeed and outfeed of the machine) and a printing device for marking the carton labels.
The Universal Robot control software was used to program the UR3e robot arm, which also controls the connected gripper. The PCL is programmed with U-Create Studio, while Proconweb is used for the visualization of the touch display, which are software tools developed by Weidmüller. For quality control, the Cognex Insight Explorer camera software was used.
In general, the application has a high degree of variability. One workstation can be physically composed with different workspaces to produce a set of different products. The geometrical properties of the products combined with the properties of the tool (while being grasped and handled by the cobot), may result in potentially different risks.
2) Project Outcome: CoR-Lab and Weidmüller did a comprehensive literature survey on normative safety requirements for modularized workstations to review the current state of the art and regulations for such installations. Based on this survey, a semiautomatic process as illustrated in Fig. 4 was sketched in the CoSMo project, extending on earlier ideas by [35], [36], [37], and [38] to reduce the effort of a risk analysis for cobot workstations. This process is based on the hypothesis that through the modularity of Weidmüller's robot workcell the complexity of the cobot workstation can be constrained by a dimension reduction that maps essential safety-relevant properties such as sharp geometries, edges and narrow distances of the modular elements as well as their composition into an abstract design space that allows simulation and reasoning. This space covers only the safety-relevant aspects required for the risk analysis, such as the geometrical abstractions, the typical human behavior, the robot behavior, and the overall (assembly) process. In that space, risks are analyzed, and RRMs are applied in an iterative process to optimize the design configuration, until only acceptable risks remain. Finally, the physical set-up is adapted to the optimized abstract design and the COVR Protocols can be used to verify the risks and the effectiveness of the RRMs.
Within the CoSMo project, a model-based simulation of the cobot workstation for a representative manufacturing process at Weidmüller and a risk analysis plugin were developed in visual components to interactively support hazard identification and risk mapping. Using knowledge about the safety properties of the modular elements of the system, the prototypical plugin supports to some extent an automatic analysis of potential risks for a particular configuration of the modular cobot workstation. For instance, an automatic process can be applied to find risks that are caused by not keeping minimal distances between the robot's tool and the elements with associated hazards in the workstation.
Following these ideas, the award beneficiaries believe that the safety of modular cobot workstations can be analyzed with respect to their safety aspects already during the digital design phase. This reduces the amount of necessary real-world construction iterations. In addition to that, the automatic hazard identification and risk analysis processes might lead to an automatic classification of configurations that stay within the already analyzed safety envelope of the system under nominal conditions.

3) Toolkit Usage and Feedback:
In order to check the biomechanical limit values, there is currently no other option than to perform the corresponding measurements according to the protocols. Even with the usage of the developed risk analysis approach, the measurements require a comparably high personnel effort and are time-consuming. More practical would be a modelbased simulation and analysis tool that could make the physical measurements obsolete. Further, the CoSMo consortium asked to add references in the protocols regarding the information on the measuring instruments, provided in the COVR Toolkit under "test equipment." From the CoSMo perspective, the COVR Toolkit offered an excellent entry point for the safe design of cobot applications. The document finder is easy to use and provides a good overview of the guidelines, standards and protocols, thus, offering a suitable introduction to the subject for beginners. The protocols guide the user in a structured way through the measurement and show what to pay attention to. Following up on the ideas developed in CoSMo, strategies dealing with high variability, entailing many measurements and information on how to deal with hazardous situations that cannot be measured due to the dimensions of the measuring instruments or a contact area that is too large seem to be required for the manufacturing applications considered in this project.  with an indoor hydroponic culture. The issue belongs to the agricultural domain from a perspective still not covered by the standards, mainly characterized by the indoor environment. The solution was developed through the collaboration of three main partners: Hepenix Ltd. as a robot integrator, SZTAKI research and technology organization and Green Drops Farm Ltd. as an end-user focused on the commercialization of hydroponic culture solutions. The base hydroponic system "Green Drops Hidropónia" developed by Green Drops Farm consists of a modular tower with an internal pump circulating the liquid; the modules have several cultivation layers, which feature holes for the insertion of mesh pots for plant cultivation. The tower can rotate within its base vase, permitting access to all the plants from one side by rotating the tower. The robotic apparatus consists of a serial manipulator Universal Robots UR5 equipped with a Robotiq 2F-85 gripper and integrated onto an automated guided vehicle. This mobile cobot is able to move and operate autonomously in a workspace in which several Hidropónia towers may be included (see Fig. 5). Essential customized add-ons of the robotic solution are: a dock frame to be used as a reference for the positioning of the mobile robot with respect to the Hidropónia tower, specific plant supports (so called "clips") for the robotized manipulation of the plants; and latch-based locking systems to fix the angular position of the tower during the manipulation of the plants. The obtained mobile robot is expected to move around in the workspace, approach the Hidropónia tower, and rotate the tower in order to access to any of the cultivation holes. Besides the development of a suitable and reliable robotic solution, the focus of the project was to assess the safety of the application, aiming at safe human-robot interaction.
2) Project Outcome: As an application belonging to the agricultural domain, but characterized by an indoor environment, Fig. 6. Impact test simulating the finger crush hazard with latch during rotation of the Hidropónia tower, with covers for risk reduction highlighted.
there are currently no known domain-specific type-C standards. As this situation is common to several emerging cobot applications, the decision was made to instead consider industrial robotics type-C standards (i.e., ISO 10218-1 [39], ISO 10218-2 [40], ISO 3691-4, ISO/TS 15066). The risk assessment identified a series of hazards as the most critical from the perspective of workspace sharing and HRC. These were analyzed and mitigated by appropriated RRMs, as described in the following section. a) Finger pinch hazard with gripper: A careless operator may operate with their hands too close to robot gripper; due to the bar linkage-based structure of the gripper, the closing motion may pinch one or more operator fingers. This hazard was eliminated by applying a customized cover onto the gripper. b) Finger pinch hazard during locking with latch: The finger of the operator may be pinched when the robot closes a mechanical latch. This hazard was also eliminated by applying a customized cover, preventing the insertion of the finger in the hazardous space. c) Finger crush hazard with latch during the rotation of the Hidropónia tower: When the cobot rotates the tower, a hand or finger may be crushed between the two parts of the mechanical latch. As a first RRM, an electromagnetic force and displacement sensor was developed and equipped as a mechanical interface between the robot and the gripper. Moreover, the crush scenario was tested by referring to COVR protocol "test robot arm for collision with fixed object (crush)," by using a GTE KMG 500-75 force gauge and Fujifilm prescale films for biofidelic force and pressure measurements, in order to compare the results with the safety thresholds reported in Appendix A of ISO/TS 15066 (see Fig. 6). d) Hand injury hazard during plant loading and unloading with the plant support: This hazard is related to the possible impact of the plants with the hand during their manipulation performed by the robot. In this case, by using the same equipment of the test previously described, the COVR protocol "Test robot arm for collision with movable object (impact)" was considered. Although the results were significantly lower than the thresholds reported in [8] in the case of plant removal, the tests related to plant insertion exhibited the occurrence of scratches due to the break of the plant support, with the consequence that the measured pressures were above the acceptable thresholds. To mitigate this risk and keep contact pressures low, the plant support was redesigned, in order to break cleanly in case of impact at a specific zone of the clip.
3) Toolkit Usage and Feedback: The toolkit was a fundamental source for the development of the project. In particular, the force and pressure tests that were executed for the validation of the hazardous human-robot contact scenarios were based on two protocols available on the toolkit. These validation protocols build on an emerging testing approach for the validation of human-robot contact in different scenarios. Due to the importance of these issues in the viewpoint of HRC implementations, the COVR research group devoted great effort to the analysis of those testing procedures [41], resulting in reliable and comprehensive validation protocols that deal with several human-robot contact scenarios.

C. DOROTHY Project 1) Introduction of Partners, Project Goals, Relevant Domain:
The DOROTHY project was aimed at assessing the safety of a rehabilitation robot based on two industrial cobots. The RE-HAROB therapeutic system [42], which was the subject of the DOROTHY project has been developed in previous research projects and is based on two cobots which are generally used in industry. The two cobots attach to a patient's elbow and wrist to execute movements programmed by a therapist (see Fig. 7). The system is intended to be used for upper limb therapy of hemiparetic patients. The physiotherapist teaches the equipment by performing the relevant movements on the patient, which are then recorded and repeated by the device. The project was executed by DARPAMOTION Ltd. and Budapest University of Technology and Economics from Hungary.
Since requirements and circumstances regarding safety are very different in medical applications compared to cobots in industry, the award project focused on uncovering the challenges and possibilities of using industrial cobots for a medical device. Based on a risk assessment, a safety validation protocol was developed for one of the identified risks, namely the risk of exceeding the anatomical range of motion or overreaching. 2) Project Outcome: The REHAROB system is not the only medical device based on industrial cobots. An analysis of commercial and non-commercial robot systems was executed, describing three commercial medical robot systems using industrial robots (CyberKnife, ROSA, YOMI), eight commercial medical robot systems using industrial cobots (ARTAS iX, Sculptura, CARLO, TMS-Cobot, Modus V, iYU Pro, EMMA, ROBERT) and seven noncommercial medical robot systems using industrial cobots (ALEX, RAINER, Cobot for Doppler Sonography, DynamicDentalArm, BROCA, Chinese robot dentist, inRehaRob). Some of the main results of this analysis were: 1) Industrial cobots are frequently used for the development of new medical systems as they are low in cost and support fast prototyping. 2) There is one medically certified cobot on the market, namely the KUKA LBR MED (KUKA AG, Augsburg, Germany). The advantage of using this medically certified cobot for new systems is the reduced need for engineering development time and testing. The disadvantages are the higher purchase cost compared to other industrial cobots and the undetermined intended use.
3) The development process of medical systems is as individual as their application. Industrial cobots can be a simple and economical way to develop a medical robot that moves objects or body parts freely in space and is constrained under contact impedance. One of the risks identified in the risk analysis was an unnatural joint angle in the wrist or elbow caused by improper trajectory calculation. During such a hazardous situation, the patient might suffer joint injuries. The award beneficiaries decided to further investigate this risk and develop a safety validation protocol for the skill of limiting the joint's range of motion. To reliably assess the human joint angles created by the robot trajectory, an instrumented dummy representing the patient's arm was developed. The dummy arm is attached to a wooden frame at the dummy shoulder joint (see Fig. 8). It consists of a three-dimensional printed structure combined with rolling bearings with inner and outer aluminum bushings as joints.
The joints are equipped with rotary sensors and all necessary cables as well as the signal processing unit are routed though the inside of the dummy. Brake plugs and push-buttons are implemented for safe transportation, zero offset calibration and alteration of the system to represent left-or right-side anatomy.
To account for a wide range of patient anthropometrics, the arm length and shoulder height can be adjusted from the 5th percentile female to 95th percentile male using the adjustment options in the frame for shoulder height adjustment and spring preloaded latches for arm length adjustment.
A safety validation protocol was then developed using this dummy arm and a self-developed data analysis sheet. The protocol user can determine the allowed ranges of joint motion and test a medical robot system's safety by employing the validation protocol in combination with the dummy and data analysis sheet. The joint ranges of motion are defined before the test as prohibited ranges and precaution zones. After the therapeutic motion exercises that are to be assessed were executed by the robot system connected to the dummy test rig, the data analysis sheet will present the protocol user with an overview of the movement durations in the riskless zone, precautionary zone and prohibited zone of all relevant joint angles. The safety validation is passed if the duration of prohibited zones in all angles is equal to 0%.
3) Toolkit Usage and Feedback: The award beneficiaries used the toolkit to collect information on cobot safety assessment and identified a missing link between device type and standards, which was then corrected.
An analysis of industrial cobot systems in medical systems was performed. A short summary of the analysis and a link to the complete analysis can be found in a case story on the COVR toolkit.
The risk of overreaching and exceeding joint range of motion was identified as a risk that had not yet been addressed in the Toolkit protocols in combination with the robot type robotic arm. The award beneficiaries then developed the safety validation protocol for this combination, defined the dummy arm as required test equipment, and provided the data analysis sheet as support for the protocol execution. This protocol and the information about the testing equipment are now available on toolkit.

D. Feedback and Standardization Activities
COVR awardees and all toolkit users were asked to anonymously provide feedback on the Toolkit and protocols via custom-made online questionnaires. The toolkit user survey has three main sections to collect information about the respondent and their toolkit usage, to understand their satisfaction (via an abbreviated version of the usability, satisfaction and ease of use (USE) questionnaire [43]), and to allow open-ended suggestions for improvement.
The questionnaires were used to systematically collect indepth information about the usage and user experience of the various COVR elements.
We received 75 responses through the online toolkit user survey. The Toolkit was reportedly used regularly, with the subsections "directives and standards," "protocols," and "risk assessment" being viewed the most (see Fig. 9).
Questions on whether and how much time was saved through using the Toolkit were introduced at a later point in time to the survey. Therefore, these questions only were answered by 37 respondents. Of these 37 respondents, 92% indicated that time   savings were possible, with the majority estimating that the time saved is in the range of a few days (see Fig. 10).
The survey questions focusing on usability indicate a positive appreciation of the toolkit, with none (0%) of the respondents reporting that they are never satisfied by the quality of the tools and documents in the toolkit (see Fig. 11).
Building on toolkit contents, two separate standardization activities were initiated in late 2020. At the European level, a CEN workshop agreement (CEN-CWA) titled "guidelines for the development and use of safety testing procedures in HRC" was developed [6]. This document describes the motivation for cross-domain protocols and provides the overall structure of protocols so to support future developments. Furthermore, the ISO/PAS (publicly available specification) 5672 "robotic devices-test methods for measuring forces and pressures in human-robot contacts and collisions," focusing on the protocol for measurement of power and force limited robots, was developed and is currently in the final commenting and approval phases. These activities have resulted in hundreds of individual comments from leading international experts on the concepts of the protocols and safety skills, as well as on the contents of specific protocols. The CEN-CWA was published in January 2022, and the ISO/PAS is expected to be published by the end of 2022.

V. CONCLUSION
This article deals with the topic of ensuring safety for new robotics applications featuring HRC. The cross-domain nature of robotics increasingly makes it difficult for robotics end-users and system integrators to identify relevant requirements, standards, and regulations.
The EU-funded project COVR has developed a web-based Toolkit designed to offer stakeholders with a wide range of background knowledge and expertise support along various phases of the development lifecycle. The toolkit builds on the concept of safety skills to offer users a high degree of certainty regarding the relevant health and safety requirements, as well as practical guides for how to execute a risk analysis and how to perform SLVMs with various types of measuring equipment.
A major goal of COVR is building consensus with all relevant stakeholders, across Europe and the world. As new technologies are emerging, the regulatory background will develop and existing standards will be modified or new documents will be developed. It is therefore pivotal to maintain and update the toolkit. To address this challenge as the project ends, a community of so-called COVR Hubs is being created. The COVR Hubs members will maintain the toolkit, offer services related to HRC validation and share best practices to ensure sustainability and continued engagement with the protocols in the near future. Through the COVR Hubs we will be able to continue the discussion with relevant stakeholders from standardization, occupational and health insurance, safety verification bodies, and national regulation agencies, and the robotics community.