Robot hazards, harms and accountability

Robots are machines that move by themselves, and that simple fact is the root of most robot safety problems. A conventional machine tool does dangerous things in a fixed place; a robot can reach anywhere in its working space, switch from slow to fast motion without warning, resume a program after a pause, and, if it is mobile, travel to where people are. As robots leave fenced factory cells and enter warehouses, hospitals, sidewalks, farms and homes, the people around them are increasingly members of the public rather than trained workers. This course is about the three systems that societies use to keep that risk acceptable: engineering safety, which designs hazards out and controls what remains; law, which sets duties and allocates responsibility when things go wrong; and ethics, which asks whether a deployment is right even when it is legal. ROB-100 introduced robot hazards and ROB-430 and ROB-440 covered collaborative applications and safeguarding a cell. This course goes deeper into the methods, the law and the hard questions. Nothing in it is legal advice: laws change, and real decisions need qualified engineers and lawyers.

A short history of robot accidents

The first recorded death caused by an industrial robot occurred in January 1979 at a Ford casting plant in Flat Rock, Michigan, when Robert Williams was struck by the arm of a parts-retrieval robot while climbing into a storage rack to fetch parts himself because the system was running slowly. A jury later awarded his family damages against the robot's manufacturer, finding that the system lacked adequate safeguards such as alarms or interlocks that would have warned him or stopped the machine. In 1981, Kenji Urada, a maintenance engineer at a Kawasaki plant in Japan, was killed when he stepped over a safety fence to work on a robot that was still energized; the robot pushed him into a grinding machine. These early cases already show the recurring pattern: injuries happen during maintenance, troubleshooting and recovery from faults, when someone is inside the robot's space while it can still move.

Later cases extended the pattern. In 2015 a worker at an auto parts plant in Michigan was killed when a robot entered a section of a line she was working in and crushed her; her family sued several companies that had designed, built and integrated the line, alleging defects that allowed the robot to move into an area it should not have reached. In the same year a contractor installing a robot at a Volkswagen plant in Germany died when the robot struck him inside its cage. Outside factories, a 2018 crash in Tempe, Arizona, in which a test vehicle operated by Uber's self-driving unit struck and killed Elaine Herzberg, became the first pedestrian death involving an automated test vehicle and led to investigations of both the automated system and the human safety driver, who later pleaded guilty to a reduced endangerment charge. In 2023 a robotaxi in San Francisco dragged a pedestrian who had been thrown into its path by another car; the operator later paid penalties to US regulators for incomplete reporting of the event.

Researchers who studied US data on work-related deaths identified about 40 robot-related fatalities between 1992 and 2017, most involving stationary industrial robots and most occurring during maintenance or when workers were inside the robot's space. The numbers are small compared with other machinery, which partly reflects decades of safety standards, but every case was preventable, and the number of robots is growing fast. The International Federation of Robotics reported in 2025 that robot density in manufacturing had reached 307 robots per 10,000 employees in the United States and 241 in Canada, against a world average of 132, based on 2024 data.

Kinds of robot hazards

Hazards are sources of potential harm. A useful habit is to list them by type and by the phase of the robot's life in which they arise. ISO 12100, the general machinery risk assessment standard covered in lesson 2, groups hazards into mechanical, electrical, thermal, noise, vibration, radiation, material and substance, ergonomic, and hazards associated with the environment, plus combinations. For robots, a few deserve special attention.

The last row is what makes modern robots different. A fixed industrial robot repeats the same program, and its hazards can be mapped once. An autonomous mobile robot or a learning-enabled manipulator decides where to go and what to do based on sensor data. Its hazards depend on whether it perceives the world correctly, which in turn depends on lighting, clutter, unusual objects, people who behave unexpectedly and, for learned components, data that may not represent the situation at hand. Safety engineers sometimes call this the problem of the safety of the intended functionality: harm can occur even when no component has failed, because the system's intended behaviour was insufficient for a situation it met. ISO 21448, written for road vehicles, formalizes this idea, and it applies by analogy to other autonomous robots.

Harm, risk and acceptable risk

Risk is the combination of the probability that harm will occur and the severity of that harm. It is never zero. The aim of safety engineering is to reduce risk until it is acceptable, which raises the question of who decides what is acceptable. Three answers coexist. Engineering standards define methods and minimum measures, such as a required performance level for a safety function, that represent the consensus of experts about the state of the art. Law sets general duties: workplace laws require employers to take precautions that are reasonable in the circumstances, product laws require goods to be reasonably safe, and regulators set specific rules for some products. Society and individuals, finally, accept different levels of risk for different activities, and they judge risks imposed on them by others, especially by machines they did not choose, more harshly than risks they take voluntarily.

Canadian occupational health and safety statutes generally require employers to take every precaution reasonable in the circumstances for the protection of workers, as Ontario's Occupational Health and Safety Act puts it, and courts assess compliance by asking whether the employer exercised due diligence: whether it identified the hazard, took reasonable steps and supervised effectively. Since 2004 the Criminal Code has also imposed a legal duty, in section 217.1, on everyone who directs how work is done to take reasonable steps to prevent bodily harm, so that serious failures can lead to criminal negligence charges against organizations and individuals.

Two principles are common in safety thinking. Under ALARP, a term from British law and practice, risk is reduced as low as reasonably practicable, meaning that further measures are required unless their cost is grossly disproportionate to the risk reduction they buy. The related phrase so far as is reasonably practicable appears in many statutes. Neither principle allows risk to be ignored because measures are expensive, and both put the burden on the person creating the risk to show that what remains is justified. A second principle is that risk imposed on people who did not consent and do not benefit, such as pedestrians near a delivery robot, deserves more stringent control than risk accepted by trained workers who chose the job.

Who is accountable?

A robot is a product made by one company, often integrated into a system by another, deployed by an employer or service provider, operated by workers or customers, maintained by technicians and updated by software teams far away. When it causes harm, responsibility can sit with any of them, and modern law has several overlapping mechanisms for deciding who pays and who is punished.

Accountability also has an ethical dimension that lesson 11 explores: when a decision is made by a learning system that no individual fully understands, people worry about a responsibility gap in which harm occurs but no one is clearly to blame. Law has tools for this, such as strict liability, which assigns responsibility without proof of fault, and organizational duties to supervise systems, but the debate is live, and the answers shape how companies design robots. A practical consequence is that organizations increasingly keep detailed records, such as risk assessments, validation reports, logs and change histories, so that they can show what they knew and what they did.

The rest of this course

Lessons 2 to 4 cover the core engineering methods: risk assessment under ISO 12100 and functional safety under ISO 13849-1, IEC 62061 and IEC 61508. Lesson 5 explains machinery law and conformity. Lessons 6 and 7 look at robots that live outside the fence: mobile, service and personal care robots, medical robots and automated vehicles. Lesson 8 covers product liability, recalls and insurance; lesson 9 regulation of AI; lesson 10 cybersecurity as a safety and legal issue; and lesson 11 ethics and the future of work. Lesson 12 brings everything together in a safety case and compliance review for a service robot deployment.

Throughout, keep in mind that safety standards are written by committees of industry experts, regulators and users, and that most are voluntary in themselves but become binding when a law, a regulator, a contract or a court treats them as the expected level of care. Standards are also revised: ISO 10218 was revised in 2025, ISO 13849-1 in 2023 and IEC 62061 in 2021, and older installations were built to older editions. Knowing which edition applies, and what changed, is part of professional practice.

The example shows why risk assessment must consider foreseeable misuse and changes in use, which lesson 2 develops, and why contracts between manufacturers, lessors and deployers increasingly specify who must assess, maintain and report what.