When the Routine Was the Hazard

On June 1, 2026, at the Urumqi Botanical Garden in China's Xinjiang region, a Unitree G1 humanoid wearing a blue clown wig performed a scripted martial-arts routine in front of a crowd of children. Mid-routine, it executed a spinning roundhouse kick and struck a young boy in the stomach. The child doubled over; Chinese media reported no serious injury. The video went viral within seventy-two hours, captioned with the usual Terminator jokes. Here is the part the jokes miss: the robot did not malfunction. It executed its choreography exactly as programmed. The child was simply inside the performance envelope, and nothing in the system — not the robot, not the venue, not the handlers — was designed to notice.

This is a robotics post about the most dangerous operating mode in the industry right now, which is not the factory, not the warehouse, and not the home. It is the demo. Public performance is where torque-dense, dynamically unstable machines meet untrained crowds at zero separation distance, with no safeguarding, no risk assessment on file, and no standard that anyone in the deployment chain believes applies to them. Three documented bystander-contact events in China in the first half of 2026 say the gap is no longer theoretical.

Below: the public record, the standards that bracket the gap without closing it, a worked risk-assessment snippet with a fault tree, and five derived requirements that any humanoid performance deployment should be able to produce on request — and currently cannot.

1. The public record

June 1, 2026 — Urumqi Botanical Garden, Xinjiang. A Unitree G1 performing a martial-arts demonstration struck a child in the stomach with a spinning roundhouse kick. The G1 weighs roughly 70 pounds (about 35 kg) and its joints can produce over 100 newton-meters of torque — enough, as Futurism noted in its teardown of the specs, to lift more than 26 pounds at full extension. The child had moved close to the performance area during the routine; the robot continued its scripted sequence. Chinese media reported the child was not seriously injured. Bystander video shows handlers reacting only after contact. (Interesting Engineering, June 5, 2026; Vice, June 5, 2026.)

Earlier in 2026 — public performance, China. Another Unitree G1 lost its balance during a live performance, fell, and — while down — struck a nearby man with uncontrolled limb movements, breaking his nose. A biped that has fallen is not inert: its controller keeps commanding joint torques unless something tells it to stop, and 100 newton-meter actuators flail with authority. (Interesting Engineering, June 5, 2026.)

April 24, 2026 — university sports event, Xi'an, Shaanxi. A humanoid robot in a choreographed dance performance deviated from its routine and unexpectedly grabbed and hugged a female student. The operator attributed the behavior to program errors induced by drone signal interference at the venue. No injury occurred. The OECD's AI Incidents Monitor logged it as a realized AI incident — malfunction of an autonomous system leading to unintended physical contact with a person. (OECD.AI incident registry; Global Times, April 26, 2026; eWEEK, April 27, 2026.)

Three events, three different proximate causes: a scripted motion meeting an intruding bystander, a fall with no post-fall torque suppression, and an RF-induced control corruption. The popular framing treats these as three separate freak occurrences. A safety engineer should read them as one hazard — bystander struck during public humanoid performance — reached through three independent branches of the same unbuilt fault tree.

And the context that makes this urgent rather than merely embarrassing: this is happening at production scale. Shanghai-based Agibot announced its 10,000th humanoid off the line on March 30, 2026, having doubled from 5,000 units in three months. China's Ministry of Industry and Information Technology published its first national standard system for humanoid robots and embodied intelligence in late February 2026, with safety and ethics as one of six pillars — including an explicit requirement that a robot encountering an unfamiliar situation must default to a minimum risk condition rather than thrash unpredictably. (Robotics and Automation News, March 31, 2026.) The standards are arriving. The deployments are not waiting for them.

2. The standards lens

The uncomfortable truth about the Urumqi kick is that no published standard squarely governs a humanoid doing martial arts for a crowd of children in a botanical garden. But that is not the same as saying the engineering obligations are undefined. Four standards families bracket this gap tightly enough that the missing work products are obvious.

2.1 ISO 10218:2025 and ANSI/A3 R15.06-2025 — the controls the demo borrowed nothing from

The 2025 editions of ISO 10218-1 and -2 (published in the U.S. as ANSI/A3 R15.06-2025) are the industrial robot safety standards, and a performance G1 is not an industrial robot, so they do not formally apply. Read them anyway, because they define the control vocabulary the demo skipped entirely: safeguarded space, perimeter safeguarding, speed and separation monitoring, power and force limiting, protective stop functions with defined performance levels. An industrial cell running a 35-kg manipulator with 100 newton-meter joints would have light curtains, area scanners, and a validated stop function before anyone signed the commissioning record. The same machine in a public garden got a wig.

That asymmetry is the point. The hazard moved from the factory to the park; the controls did not move with it.

2.2 ISO/TS 15066 — the number the kick had to beat

The biomechanical limit table that started life in ISO/TS 15066 (and whose substance was absorbed into the 2025 ISO 10218 collaborative requirements) puts hard numbers on permissible human-robot contact. For the abdominal muscle region — precisely where the Urumqi child was struck — the quasi-static force limit is 110 N, and the transient (dynamic impact) limit is twice that, 220 N. Those limits assume contact is unintended but bounded by design: power and force limiting is supposed to guarantee that even a worst-case impact stays under the threshold for the body region at risk.

Nobody has published the contact force of a G1 roundhouse kick, and I will not invent one. But a scripted martial-arts kick is the antithesis of a power-and-force-limited motion: it is a distal limb mass accelerated deliberately to maximize dynamic effect, delivered at abdomen height for an adult — which is chest-to-head height for a small child. If your motion library contains strikes, your deployment either guarantees separation or it has no business near uncontrolled bystanders. There is no third option in the contact-limit math.

2.3 ISO 13482 and ISO 12100 — foreseeable misuse is not optional

ISO 13482 (service robots, FDIS revision in approval) is the nearest in-scope product standard for a robot operating among the public, and its hazard clauses — hazards due to the operational environment, hazards due to incorrect autonomous decisions — describe all three 2026 incidents with uncomfortable precision. ISO 12100, the machinery risk-assessment standard underneath it, requires the analysis to cover reasonably foreseeable misuse, not just intended use.

A child wandering toward an interesting machine is not misuse at all. It is the single most foreseeable event in any public deployment, foreseeable enough that amusement-ride and playground standards treat child intrusion as a design basis, not an exception. A risk assessment for a public humanoid performance that lacks a row for "bystander enters performance envelope mid-routine" was not finished. The Urumqi video is what an unfinished risk assessment looks like at 30 frames per second.

2.4 The emerging stack — ISO 25785-1, MIIT 2026, T/CIE 298-2025

Three further developments close in on the gap. ISO 25785-1, the first standard for industrial mobile robots with actively controlled stability, addresses the failure mode the nose-break incident demonstrated: a legged machine that loses power or balance does not stop being a hazard when it hits the ground. ASTM's F45.06 subcommittee on legged robots is building stability metrics — how much force topples the robot, and what it does about it — for exactly this class. (TechJournal, September 2025.) China's MIIT standard system mandates minimum-risk-condition behavior and force limiting at the national level, and the Beijing Humanoid Robot Innovation Center's T/CIE 298-2025 grading standard gives regulators a capability taxonomy to hang requirements on. (Robotics and Automation News, March 31, 2026.)

None of this is finished. All of it points the same direction: public performance is an operating mode that requires its own safety case, and "it followed the script" will not be an acceptable line item in it.

3. A worked snippet

Here is what the missing risk assessment looks like when you actually write it. Severity (S) and probability (P) ratings follow a generic ISO 12100-style scheme: S1 minor reversible injury, S2 serious reversible, S3 irreversible or fatal; P ratings from P1 (remote) to P4 (near-certain over deployment life).

| ID | Hazardous situation | Hazard source | S | P | Initial risk | Required control | |----|---------------------|---------------|---|---|--------------|------------------| | RA-01 | Bystander (child) enters performance envelope during scripted strike sequence | Deliberate high-velocity limb motion; no intrusion detection gating motion | S2 (child, abdominal/head-height impact) | P4 (children present by design at public demo) | High | Physical barrier at computed separation distance; perception-gated protective stop | | RA-02 | Robot falls during dynamic routine; limbs continue commanded motion while grounded | Loss of balance; no post-fall torque suppression | S2 | P3 (dynamic routines, uneven outdoor surface) | High | Fall detection triggering joint-torque limit / zero-torque within 100 ms | | RA-03 | RF interference corrupts motion commands; robot executes unplanned contact behavior | Shared-spectrum venue (drones, phones); motion authority dependent on wireless link | S2 | P2 | Medium | Link-integrity monitor; degraded-link transition to hold-posture minimum risk condition | | RA-04 | Handler cannot stop robot before contact after intrusion observed | No accessible e-stop with validated stop performance; human reaction time alone | S2 | P4 | High | Hardwired e-stop, stop category 0/1, handler within reach at all times |

The fault tree the three incidents jointly populate:

TOP: Bystander struck during public humanoid performance
└─ OR
   ├─ Branch A: Scripted motion intersects intruding person     [Urumqi, Jun 2026]
   │  └─ AND
   │     ├─ Strike-class motion executes at full dynamics
   │     ├─ Person inside performance envelope
   │     │  └─ No barrier / no separation distance enforced
   │     └─ No perception-gated protective stop
   ├─ Branch B: Post-fall uncontrolled limb motion              [nose injury, 2026]
   │  └─ AND
   │     ├─ Loss of balance during dynamic routine
   │     ├─ Joint torque still commanded after ground contact
   │     └─ Bystander within fallen-robot reach radius
   └─ Branch C: Corrupted control input drives unplanned motion [Xi'an, Apr 2026]
      └─ AND
         ├─ RF interference alters program execution
         ├─ No command plausibility / link-integrity check
         └─ Person within reach during anomalous behavior

Every basic event in that tree is a requirement someone did not write. For Branch A, the separation distance is computable with ISO 13855 logic. Take a kick reach envelope of 1.5 m, a perception-plus-stop time of 0.5 s, and the standard 1.6 m/s human approach speed: minimum separation comes to 1.6 times 0.5 plus 1.5, or 2.3 m — call it 2.5 m of enforced barrier offset, illustrative numbers to be replaced by measured stop performance. The Urumqi child was inside arm's — leg's — reach. The barrier was nonexistent. The calculation was never run.

4. Derived requirements (excerpt)

Five requirements with stable IDs, traceable to the rows and branches above. Any humanoid performance deployment should have these, or their measured-and-validated equivalents, in its safety file.

| Req ID | Requirement | Trace | |--------|-------------|-------| | PDR-001 | The deployment shall enforce a physical separation barrier between the performance envelope and spectators at a distance not less than maximum kinematic reach plus stopping distance, computed per ISO 13855 methodology (illustrative result: 2.5 m for a 1.5 m reach and 0.5 s stop time), validated by measured stop performance before first public run. | RA-01, Branch A | | PDR-002 | The robot shall monitor the performance envelope for human intrusion and shall initiate a protective stop of all strike-class motion within 200 ms of detected intrusion, transitioning to a defined minimum risk condition (hold posture, speed under 0.25 m/s). | RA-01, Branch A | | PDR-003 | Any motion executable in the presence of unsegregated bystanders shall be power-and-force limited such that worst-case transient contact force at any reachable body region does not exceed the ISO/TS 15066 limit for that region (abdominal region: 220 N transient, 110 N quasi-static). Strike-class motions shall be lockout-excluded from bystander-present modes. | RA-01 | | PDR-004 | Upon fall detection (attitude threshold or vertical acceleration signature), the controller shall suppress commanded joint torque to a safe-flail limit within 100 ms and shall require explicit handler re-arm before resuming actuation. | RA-02, Branch B | | PDR-005 | Execution of scripted motion shall not depend on continuous wireless link integrity. On detected link degradation or command implausibility, the robot shall transition to the minimum risk condition within 500 ms. An independent hardwired e-stop channel (stop category 0 or 1) shall remain available to the handler at all times. | RA-03, RA-04, Branch C |

None of these requirements is exotic. PDR-002 is a light curtain wearing perception software. PDR-004 is what the MIIT standard system already calls minimum risk condition. PDR-005 is two decades of industrial wireless-control practice. The engineering is solved; the allocation of the engineering to the demo use case is what is missing.

5. What the headline really tells us

The viral framing — robot goes rogue, kicks child — gets the failure mode exactly backwards, and the backwards version is the comforting one. A rogue robot is a bug; you patch it. The Urumqi robot was not rogue. It was a torque-dense biped executing a strike sequence, correct to specification, in a deployment where the specification had no opinion about children. The Xi'an robot deviated under RF interference that a command-integrity check would have caught. The fallen G1 broke a nose because nobody required its joints to relax on the way down.

Three incidents, three branches, one missing artifact: a deployment risk assessment that treats public performance as an operating mode with its own hazard analysis, its own separation calculation, its own minimum risk condition, and its own stop authority. The standards bodies — ISO with 25785, ASTM F45.06, MIIT with its 2026 system — are converging on exactly this. The companies shipping ten thousand humanoids a quarter should not wait for them to finish. The fault tree is already populated with field data. The next branch gets written either by an engineer or by another child standing too close.

Sources

— Jherrod Thomas, The Lion of Functional Safety™