From Public-Demo Incident to Bystander-Safety Contract: A Cross-Standards Framework for Speed-and-Separation and Power-and-Force Requirement Derivation in Untethered Humanoid Robots

I. Introduction

The deployment of untethered, full-size humanoid robots into public and semi-public environments accelerated sharply through 2025 and into 2026, driven by production volumes that were until recently confined to research laboratories. Several Chinese manufacturers now report annual humanoid output in the thousands of units, and public demonstrations — choreographed dance, martial-arts routines, greeting and interaction shows — have become the dominant marketing channel for the category [3]. These demonstrations place torque-dense, dynamically balanced bipedal machines among untrained crowds at separation distances approaching zero, frequently with children present by design.

A cluster of bystander-contact events in the first half of 2026 makes the resulting hazard concrete rather than hypothetical. On 1 June 2026, at the Urumqi Botanical Garden in China's Xinjiang region, a Unitree G1 humanoid performing a scripted martial-arts routine executed a spinning roundhouse kick and struck a young child in the abdomen; the child doubled over, and handlers reacted only after contact [1]. Earlier in 2026, a separate G1 lost its balance during a live performance, fell, and — while grounded — struck a nearby adult with uncontrolled limb motion, fracturing the man's nose [1]. On 24 April 2026, at a university event in Xi'an, a humanoid in a dance routine deviated from its program, reportedly under radio-frequency interference, and grasped a student; the event was logged by the OECD AI Incidents Monitor as a realized incident of unintended physical contact [2].

The popular framing of these events — robot goes rogue — inverts the engineering reality. In at least the Urumqi case, the robot did not malfunction: it executed its programmed choreography correctly. The child was simply inside the performance envelope, and nothing in the deployment — not the robot's controller, not the venue layout, not the handler protocol — was designed to notice or to intervene. The three events share three distinct proximate causes — a scripted motion intersecting an intruding bystander, a post-fall absence of joint-torque suppression, and a corrupted control input — but a safety engineer should read them as a single hazard, bystander struck during public humanoid performance, reached through three independent branches of one fault tree that was never drawn.

The standards landscape brackets this gap tightly but does not close it. ISO 10218-1:2025 and ISO 10218-2:2025 (published in the United States as ANSI/A3 R15.06-2025) define the safety vocabulary of safeguarded space, speed-and-separation monitoring, and power-and-force limiting [4], [5], and ISO/TS 15066:2016 supplies the biomechanical contact-limit tables that power-and-force limiting must respect [6]. But these instruments scope themselves to industrial robots, and a performance humanoid is not, by their own definitions, an industrial robot. ISO 13855:2024 provides the separation-distance methodology that any speed-and-separation argument depends on, but it assumes a guarded, fixed machine with a detection device, not a free-roaming biped among a crowd [7]. ISO 13482:2014 is the nearest in-scope product standard for a robot operating among the public, yet recent analysis demonstrates that it omits the bystander, crowd, and proxemic hazards that define public space [8], [25]. ISO 12100:2010 obliges the manufacturer to consider reasonably foreseeable misuse — of which a child approaching an interesting machine is the paradigmatic case [9] — but it is a generic methodology, not an allocation. The first standard written specifically for dynamically stable legged machines, ISO/CD 25785-1, remains a committee draft as of mid-2026 [11].

The contribution of this paper is a method that closes the loop. First, we propose a six-step cross-standards framework that ingests public-record incident evidence and produces a set of verifiable, mode-gated bystander-safety requirements with an allocated protective-stop performance level. Second, we formalize two contracts as numbered equations: an ISO 13855-style protective separation distance specialized to a striking kinematic envelope, and an ISO/TS 15066 transient-contact-force constraint used to prove that strike-class motions cannot be made power-and-force compliant and must therefore be lockout-excluded from bystander-present modes. Third, we demonstrate the framework end-to-end on the 2026 Unitree G1 demonstration cluster, producing a fault tree, a requirements table with performance-level allocation, and five traceable derived requirements. We are deliberate about what the framework cannot do: it converts a deterministic safeguarding problem into requirements, but it does not certify the learned, possibly non-deterministic behavior policies that increasingly drive these machines, and it does not address the social and proxemic dimensions of public-space safety that lie outside any current robotic-safety standard.

The remainder of the paper is organized as follows. Section II reviews prior art in physical human-robot interaction safety, speed-and-separation monitoring, power-and-force limiting, and humanoid fall control. Section III presents the six-step framework with its two governing equations. Section IV applies the framework to the worked Unitree G1 example. Section V discusses limitations, threats to validity, and where the standards lens stops. Section VI concludes.

II. Background and Related Work

A. Physical Human-Robot Interaction Safety

The foundations of physical human-robot interaction (pHRI) safety were laid in the mid-2000s. De Santis and colleagues compiled an atlas of pHRI that organized the field around the dual objectives of injury avoidance and useful interaction [13], and Bicchi and Tonietti argued that intrinsically compliant actuation could decouple the safety-versus-performance trade-off by limiting transferable energy at the hardware level [14]. The dominant control-side response is the collision detection, isolation, and reaction pipeline surveyed comprehensively by Haddadin, De Luca, and Albu-Schäffer, who review model-based methods that use only proprioceptive sensing to detect an unexpected contact and trigger a reaction within a few control cycles, and who quantify the contact forces achievable under various reaction strategies [12]. This body of work establishes a central premise of the present paper: contact detection and reaction are mature, but they are necessary, not sufficient — a detected contact during a deliberately accelerated strike is already an injury.

B. The Four Collaborative Methods and ISO/TS 15066

ISO/TS 15066:2016 defines four collaborative operation methods: safety-rated monitored stop, hand guiding, speed-and-separation monitoring (SSM), and power-and-force limiting (PFL) [6]. SSM maintains a minimum protective separation distance between operator and robot and reduces robot speed as the distance closes; PFL bounds the robot so that any contact stays below a biomechanical limit specific to the body region at risk. The technical specification tabulates quasi-static and transient force and pressure limits for 29 body locations; the abdominal region, for example, carries a quasi-static force limit of 110 N and a transient limit of twice that value [6]. Critically, Behrens and colleagues demonstrated through a 112-subject human-trial study that the ISO/TS 15066 limits are largely preliminary, derived from an unverified literature survey, and that pain thresholds differ significantly by body region and by sex — a result that constrains how confidently any PFL argument can be made for a heterogeneous public that includes children [19]. Rosenstrauch and colleagues, and subsequent reviews of ISO/TS 15066 hazard analysis, further show that conformance to the limit tables does not by itself guarantee safety for heavier or faster machines [20].

C. Speed-and-Separation Monitoring

The SSM minimum-protective-distance methodology derives directly from the safeguard-positioning logic of ISO 13855 [7]. Marvel and Norcross provided the canonical engineering treatment of implementing SSM in collaborative workcells, analyzing the protective-distance equation, its input parameters, and its sensitivity, and identifying the latency budget that an external observer system must meet [15]. Byner, Matthias, and Ding extended static SSM to a dynamic formulation in which the permissible robot velocity is computed online as a function of both the separation distance and the direction of robot motion, substantially improving productivity while preserving the protective guarantee [16]. Recent work has pushed SSM toward richer perception — robust safety zones for manipulators with uncertain dynamics [21], adaptive zone-switching, and binocular- and depth-vision human tracking [26] — and Lucci and colleagues showed that SSM and PFL can be combined in a single controller that uses separation distance to gate speed and falls back to force-limited contact only when separation cannot be maintained [17]. Zanchettin and colleagues formalized the safety metrics and control laws that underlie collaborative manufacturing cells [18]. The common assumption across this literature is a known, instrumented workspace; none of it addresses a free-roaming biped in an uninstrumented public garden.

D. Humanoid Fall Control and Legged-Machine Stability

A dynamically balanced biped that loses stability does not become inert on contact with the ground: its controller continues to command joint torques unless explicitly told to stop. Subburaman and colleagues survey the control of humanoid fall-over and organize the field into fall prediction, fall avoidance, and damage-minimizing falling strategies [23]. Li and colleagues present a minimized-falling-damage method that reshapes the impact posture to reduce peak forces [24]. This work targets damage to the robot; the complementary safety case — protecting a bystander within the fallen machine's reach radius while its actuators are still energized — is precisely the gap that the nose-fracture incident [1] exposes and that ISO/CD 25785-1 for actively-stable mobile robots is being written to address [11].

E. Public Space, Service Robots, and the Standards Gap

Salvini, Paez-Granados, and Billard analyzed the safety of mobile robots serving in public spaces and identified concrete gaps in EN ISO 13482:2014, arguing that the standard implicitly assumes private-space hazards and lacks requirements to protect pedestrians and bystanders; they enumerate three properties of public space — crowds, social and proxemic norms, and human misbehavior — that current standards do not capture [25]. Safety barrier functions and control-barrier-function methods offer a formal, run-time route to enforce separation and velocity constraints on a manipulator or mobile base [22], and provide a candidate enforcement mechanism for the behavior-policy gates we derive in Section III. What the literature lacks, and what this paper supplies, is a structured translation from a specific public-demonstration contact incident to an allocated, verifiable requirement set keyed to the operating mode in which the incident occurred.

III. Approach: A Six-Step Framework

We propose a six-step framework, sketched in Fig. 1, that ingests public-record incident evidence and the robot's declared capabilities and produces a mode-gated bystander-safety requirement set with an allocated protective-stop performance level. The framework treats public performance as a distinct operating mode that demands its own hazard analysis, separation contract, contact-force budget, and stop authority, by analogy to the way an automated-driving system treats each region of its operational design domain.

A. Step S1 — Operating-Mode and Foreseeable-Misuse Declaration

The first step declares the operating mode under analysis and enumerates, per ISO 12100 [9], the reasonably foreseeable misuse events specific to that mode. For public performance, the controlling misuse event is not exotic: a bystander — most foreseeably a child — enters the performance envelope mid-routine. ISO 12100 makes consideration of foreseeable misuse mandatory, not optional [9]; a public-performance risk assessment lacking a row for bystander intrusion is, by the standard's own logic, incomplete. The output of S1 is an operating-mode definition and a misuse register that seeds the hazard analysis.

B. Step S2 — Reachable Kinematic Envelope Characterization

The second step characterizes the robot's reachable kinematic envelope in the declared mode: the maximum reach L_k of any limb that can execute a contact-capable motion, and the peak tip speed v_r achievable within that envelope. For a strike-class motion — a kick or punch deliberately accelerating a distal limb mass to maximize dynamic effect — v_r is large and L_k spans the full leg or arm. These quantities are read from the manufacturer's declared joint torques and link geometry; for the worked example, the G1's roughly 35 kg mass and joint torques exceeding 100 N·m define an envelope whose distal speed is far above any power-and-force-limited regime [1].

C. Step S3 — Biomechanical Contact-Limit Allocation

The third step allocates the ISO/TS 15066 biomechanical contact limits to the reachable body regions of the exposed population [6], [19]. Because public demonstrations expose children, the framework requires that the limit for the most vulnerable reachable region govern: a strike delivered at adult-abdomen height arrives at chest-to-head height on a small child, so the chest, neck, and skull limits — not the abdomen limit — become controlling. The transient contact force produced by a contact event is modeled, following the ISO/TS 15066 spring-mass treatment, as

where v_rel is the relative speed at contact, k is the effective contact stiffness of the body region, and μ is the effective two-body reduced mass formed from the human body-region mass m_h and the effective robot mass m_r. Requiring F_t ≤ F_lim for the governing region yields a maximum admissible contact speed v_rel,max = F_lim / √(k μ). The framework's decision rule is then immediate: if the strike-class tip speed v_r from S2 exceeds v_rel,max — which it does for any deliberate strike — the motion cannot be made PFL-compliant and must be lockout-excluded from any bystander-present mode. PFL is not available as a safeguard for strike-class motion; only separation (S4) or motion removal remains.

D. Step S4 — Protective Separation-Distance Contract

When PFL is unavailable, the framework falls back to speed-and-separation monitoring and computes the minimum protective separation distance using an ISO 13855 / ISO/TS 15066 formulation specialized to a striking envelope [7], [15], [16]:

where v_h is the human approach speed (ISO 13855 prescribes 1.6 m/s for walking approach and 2.0 m/s for upper-limb motion [7]), T_r is the control-system reaction time from intrusion detection to stop command, T_s is the actuation and mechanical stopping time, L_k is the maximum kinematic reach of the strike envelope from S2, C is an intrusion allowance, and Z_d and Z_r are position-uncertainty terms for the detection device and the robot, respectively. The output of S4 is an enforced physical barrier offset, or an equivalently validated perception-gated boundary, set no smaller than S_p. Equation (2) reduces, in the limit of perfect detection and zero uncertainty, to the intuitive "reach plus stopping travel" distance familiar from guarding practice, but it forces every term — especially the reaction-plus-stop latency T_r + T_s, which must be a measured value — into the open.

E. Step S5 — Mode-Gated Behavior Policy and Minimum-Risk Condition

The fifth step instantiates a behavior policy that gates motion on the conditions established in S3 and S4 and defines the minimum-risk condition (MRC) the robot enters when a gate is violated. Three gates follow directly from the three branches of the public-record fault tree (Section IV). The intrusion gate G_sep suspends all strike-class motion and transitions to a hold posture at a bounded speed when a bystander is detected inside S_p. The fall gate G_fall suppresses commanded joint torque to a safe-flail limit upon fall detection. The integrity gate G_link transitions to the MRC on detected control-link degradation or command implausibility. The MRC itself — a stable, low-energy hold posture — is mandated for embodied-intelligence systems in the emerging Chinese national standard system for humanoids [3], and is the behavioral analog of the safe state in functional-safety practice. Candidate enforcement mechanisms for these gates include safety-rated monitored stops [4], [5] and run-time control-barrier-function filters that render the safe set forward-invariant [22].

F. Step S6 — Protective-Stop Performance-Level Allocation and Verification

The sixth step allocates a performance level (PL) to the protective-stop function per ISO 13849-1 and specifies its verification [10]. Following the severity, frequency-of-exposure, and possibility-of-avoidance risk-graph of ISO 13849-1, a strike-class hazard against a child (severe, often irreversible injury — S2) at a public demonstration (high frequency of exposure, children present by design — F2) with limited possibility of avoidance (P2) places the protective-stop function at PL d, requiring a corresponding category-3 architecture with a probability of dangerous failure per hour (PFH_d) in the 10⁻⁷ to 10⁻⁶ band [10]. Verification follows ISO 10218-2 integration practice [5]: the measured stop time T_s feeding equation (2) is validated by test, the lockout of strike-class motion in bystander-present modes is verified by inspection of the motion library, and the separation distance is validated against the measured detection and stop performance before first public run.

IV. Worked Example: The Unitree G1 Demonstration Cluster

We apply the framework to the 2026 Unitree G1 public-demonstration cluster [1], [2]. The functional thread is execute a scripted performance routine in a public venue with uncontrolled bystanders. We treat three failure modes jointly: a strike-class motion intersecting an intruding bystander (Urumqi kick), post-fall uncontrolled limb motion (nose fracture), and corrupted control input driving unplanned contact (Xi'an interference).

A. S1 — Operating Mode and Misuse

The operating mode is public martial-arts/dance performance, children present. The controlling foreseeable-misuse event per ISO 12100 [9] is child enters performance envelope during scripted routine. We add robot loses balance on uneven outdoor surface and shared-spectrum venue corrupts wireless control as two further mode-specific events drawn from the public record [1], [2].

B. S2 — Reachable Envelope

From the declared specifications, the G1 weighs approximately 35 kg with joint torques exceeding 100 N·m [1]. We take a strike-class reach envelope of L_k = 1.5 m (a kicking leg at full extension) and note that the distal tip speed of a roundhouse kick is well above 1 m/s — orders of magnitude above any PFL-admissible contact speed, as S3 will confirm.

C. S3 — Contact-Limit Allocation and the PFL Verdict

The Urumqi strike landed at the adult-abdomen height of the choreography, which is chest-to-head height on a small child; the governing ISO/TS 15066 limits are therefore the chest and skull/face limits, which are lower than the 110 N quasi-static / 220 N transient abdominal values and are, per Behrens et al., uncertain for pediatric subjects [6], [19]. Evaluating equation (1) with any plausible effective stiffness and reduced mass for a chest-height contact, the admissible contact speed v_rel,max = F_lim/√(kμ) falls well below the tip speed of a deliberate kick. We do not invent the G1's measured kick force, which has not been published [1]; the framework does not require it. The structural conclusion is sufficient and certain: a strike-class motion cannot satisfy equation (1) for the governing body region, so PFL is unavailable and strike-class motion must be lockout-excluded from the bystander-present mode. This is the formal statement of the blog-level observation that if your motion library contains strikes, your deployment either guarantees separation or it has no business near uncontrolled bystanders.

D. S4 — Separation Distance

With PFL excluded, we compute the protective separation distance from equation (2). Using the ISO 13855 walking-approach speed v_h = 1.6 m/s [7], an illustrative reaction-plus-stop latency T_r + T_s = 0.5 s, the reach L_k = 1.5 m, and, for transparency, setting the intrusion and uncertainty terms C = Z_d = Z_r = 0 in this illustrative pass, we obtain

S_p = (1.6)(0.5) + 1.5 = 0.8 + 1.5 = 2.3 m,

which we round up to an enforced 2.5 m barrier offset to absorb the omitted margins. These are illustrative figures, to be replaced by measured stop performance and measured detection latency before deployment; the point is that the calculation is elementary and that, in the Urumqi event, it was never run — the child was inside leg's reach, and the barrier was nonexistent [1]. Table I lists the controlling ISO/TS 15066 limits for the reachable regions, and Table II lists the derived requirements with their PL allocation.

E. S5 — Behavior-Policy Gates

The three gates instantiate as follows. G_sep: on detection of a bystander inside S_p = 2.5 m, the controller initiates a protective stop of all strike-class motion within a bounded latency and transitions to a hold posture below 0.25 m/s. G_fall: on fall detection (attitude threshold or vertical-acceleration signature), the controller suppresses commanded joint torque to a safe-flail limit within 100 ms and requires explicit handler re-arm before resuming actuation [23], [24]. G_link: on detected control-link degradation or command implausibility, the robot transitions to the MRC within 500 ms, with an independent hardwired emergency-stop channel available to the handler at all times [4], [5].

F. S6 — Fault Tree, Allocation, and Closure

Fig. 2 sketches the fault tree for the top event bystander struck during public humanoid performance, with the three branches corresponding to the three public-record events [1], [2]. Each branch is an AND-decomposition whose basic events are precisely the requirements that were never written. The protective-stop function on the G_sep branch is allocated PL d / category 3 per the ISO 13849-1 risk graph of Section III-F [10], with a target PFH_d below 10⁻⁶. Table II collects the five derived requirements, each traced to a branch and a governing clause.

None of these requirements is technologically exotic. PDR-002 is an industrial light curtain expressed in perception software; PDR-004 is the minimum-risk-condition behavior already mandated by the emerging national humanoid standard system [3]; PDR-005 is two decades of industrial wireless-control practice. The engineering is solved. What is missing is the allocation of that engineering to the public-performance operating mode — exactly the loop the framework closes.

V. Discussion

A. Limitations

The framework is a translation method, not a certification. It converts incident evidence and declared capability into a requirement set, but the correctness of the resulting separation distance and contact-force budget depends entirely on measured inputs — stop time T_s, detection latency T_r, effective stiffness k — that the framework demands but does not itself supply. The numerical separation distance in Section IV-D is explicitly illustrative; substituting a realistic 1.0 s reaction-plus-stop latency, for instance, nearly doubles the v_h(T_r+T_s) term and pushes S_p past 3 m. A second limitation is the pediatric-applicability gap: the ISO/TS 15066 limits are preliminary and were not derived for children [19], so Table I should be read as conservative placeholders, not as validated thresholds for the exposed population.

B. Threats to Validity

The principal threat to validity is reliance on press and incident-registry accounts of the 2026 events [1], [2], which lack the instrumented detail of a formal investigation; we have therefore avoided any inference that requires a measured contact force and have grounded the central S3 verdict in the structural impossibility of PFL-compliant strikes, which holds independent of the specific force value. A second threat is scope transfer: ISO 10218 and ISO/TS 15066 are industrial-robot standards [4], [5], [6], and applying their vocabulary to a performance humanoid is an argument by analogy until ISO/CD 25785-1 is published [11]. We regard this transfer as defensible precisely because the hazard — a torque-dense articulated machine contacting a human — is the same hazard the industrial standards were written to control; the deployment context changed, but the physics did not.

C. Where the Standards Lens Stops

The framework treats public performance as a deterministic safeguarding problem, and for the strike, fall, and link-integrity branches that treatment is sound. But two dimensions lie beyond it. First, the behavior policies driving modern humanoids are increasingly learned and may be non-deterministic; a safety case built on a fixed motion library does not bound a policy that can generate novel motions, and the Xi'an interference event [2] hints at how brittle the mapping from intended to executed behavior can be. Run-time control-barrier-function enforcement [22] partially addresses this by constraining outputs regardless of policy, but the assurance of the learned policy itself is an open problem that no current robotic-safety standard closes. Second, as Salvini and colleagues argue, public space introduces crowd dynamics, social-proxemic expectations, and human misbehavior that EN ISO 13482 does not capture [25]; a separation distance enforced against a single approaching pedestrian does not generalize cleanly to a dense, mobile crowd of children. The framework should be read as the deterministic floor of a public-deployment safety case, not its ceiling.

VI. Conclusion and Future Work

A cluster of bystander-contact events involving untethered humanoid robots in public demonstrations during the first half of 2026 exposed a gap that is not a gap in technology but a gap in allocation: the safeguarding methods of ISO 10218-2, ISO/TS 15066, and ISO 13855 are mature, yet none had been applied to the public-performance operating mode in which the incidents occurred. We presented a six-step cross-standards framework that closes the loop from a contact incident to a verifiable, mode-gated requirement set, formalized two contracts — a transient-contact-force constraint that proves strike-class motion cannot be power-and-force limited, and a separation-distance contract that sets the enforced barrier — and demonstrated the framework end-to-end on the Unitree G1 cluster, deriving five traceable requirements with an allocated PL d protective-stop function.

Future work proceeds along three lines. The first is empirical: a measured database of humanoid contact forces and stop times, including pediatric-relevant biomechanical limits, would replace the illustrative inputs of Section IV with validated ones and resolve the pediatric-applicability gap in ISO/TS 15066. The second is methodological: extending the framework's deterministic gates with assurance arguments for learned behavior policies, coupling the run-time control-barrier-function layer to a claim-based safety case in the manner now common for automated driving. The third is regulatory: as ISO/CD 25785-1 for dynamically stable mobile robots and the emerging national humanoid standard systems move toward publication [3], [11], the framework offers a ready template for the public-performance clauses those standards will need. The fault tree is already populated with field data; the next branch will be written either by an engineer or by another bystander standing too close.