Development of a Safety and Energy Aware Impedance Controller forCollaborative Robots

Gennaro Raiola1,2 Carlos Alberto Cardenas1 Tadele Shiferaw Tadele1 Theo de Vries1 Stefano Stramigioli1

Abstract— In contexts where robots share their workspacewith humans, safety is of utmost importance. Consequently, inrecent years, a big impulse has been given to the design of hu-man friendly robots by involving both mechanical and controldesign aspects. Regarding controller design, this often involvesintroducing compliance and ensuring asymptotic stability usingan interaction control scheme and passivity theory. Moreover,when human operators physically interact with the robot duringwork, strict safety measures become necessary with some ofthese including power and force limitations [1]. In this paper,a novel impedance control technique for collaborative robots ispresented. The featured controller allows a safe human-robotinteraction through energy and power limitations, assuringpassivity through energy-tanks. The proposed controller isevaluated with a KUKA LWR 4+ arm in a co-manipulationenvironment.

I. INTRODUCTION

Recent advances in the robotics field have accelerated thedevelopment of robots that can operate close to humans.To emphasize this feature, these new type of robots areoften called Cobots, from the neologism of the words col-laborative and robot [2]. Since these robots are expectedto share their workspace with a human operator, physicalcontact may occur for two reasons mainly: accidentally, incase of collisions; or deliberately, if the human operator issupposed to physically interact with the robot during work.In both cases, it is important to guarantee a safe physicalinteraction for injury prevention [3]. In this work, a novelimpedance controller with safety limitations is introducedbased on the preliminary work presented in [4]. The workdone in [4], introduces an impedance controller with safetylimitations which is defined through a risk based safetyanalysis performed following the guideline defined in [5].In particular, power and total energy of the system areconsidered as safety metrics for the analysis. The result isa variable impedance controller for a 1-DOF system whichguarantees safety through energy and power limitation andestablishes passivity and energy consistency of the systemby incorporating an energy-tank as a tool for Passivity-BasedControl (PBC) [6], [7].

In the present work, the impedance controller and theenergy-tank notion from [4], are both extended and general-ized from a single motor to a multi-DOF robot manipulator.Such generalization is made possible thanks to a geometricanalysis performed with skrew theory. Moreover, the energy-

1Robotics and Mechatronics group, University of Twente, Enschede, TheNetherlands.

2Department of Advanced Robotics, Istituto Italiano di Tecnologia,Genoa, Italy.

tank conception is extended from a single to a multi tanks in-stance by taking in account problematics related to the tanksinterconnection. Finally, these contributions are evaluated ina co-manipulation context with the KUKA LWR 4+ both insimulation and on the real system, see Fig. 1.

xy

z

Fig. 1: Experimental setup with the KUKA-LWR 4+ robot.

The rest of this paper is structured as follows. In the nextsection, related work is discussed. In Section III, the safety-aware impedance controller is presented, starting from the1-DOF instance introduced in [4]. Passivity of the controlleris discussed in Section IV. The approach is evaluated with aKUKA LWR 4+ manipulator, whose results are presented inSection V, ending with some final conclusions in Section VI.

II. RELATED WORK

Collaborative robots are expected to operate in unstruc-tured human environments and interact with unknown objects[8]. Thus, controller design should account for safety issuessuch as: introducing compliance to minimize injury in caseof an uncontrolled impact, provide limitations in termsof velocities or forces exerted by the robot, and ensuringasymptotic stability even during interaction [9].

A. Safety criteria and applications in robotics

While addressing the issue of human friendly robots, dif-ferent safety criteria can be defined based on risk assessments[10]. For example, a power based safety metric called HeadImpact Power (HIP) is proposed in [11]. In this work, theprobabilities and the related power values of concussion froman impact on a human head are investigated and presented.Regarding energy criteria instead, the works presented in[12] and [13], identify the maximum allowed energy that can

cause neck fracture and failure to cranial bones, respectively.One of the most widely used safety norms regarding roboticsafety is the Head Injury Criteria (HIC), which was firstproposed within the automotive industry by Versace in [14]and successively adopted in robotics [15]. This metric, alongwith the previously mentioned, have constituted an usefulfoundation for the development and evaluation of safetybased robot controllers [16]–[18]. In [16], the HIC is usedas a safety criteria to identify a performance limit, givenin terms of maximum allowed link velocity. Hence, oneof the control objectives is to guarantee that the desiredtrajectories satisfy a safety velocity limitation. In [17], themaximum impact force that can be exerted by a multi-DOFrobot is used to define a force based safety metric, calledimpact potential. Regarding energy limitations as safetymeasures, [18] uses energy based metrics to design an energyregulation controller that limits the total energy of a robotwithin the required safety limit by modulating the desiredtrajectory reference. Similarly to [18], a controller whichlimits the energy exerted by the robot is defined in thispaper; nevertheless, the energy limitation is applied directlythrough modulation of the controller’s parameters instead ofthe reference trajectory.

B. Stability through passivity

Concerning the stability problem instead, different authorsused passivity theories to design controllers which ensureasymptotic stability of the robot [19], [20]. By definition,passive systems are stable dynamic systems whose totalenergy is less than, or equal to, the sum of its initial energyand any external energy supplied to it by interaction [7].As proven in [21], if the robot is not strictly passive, it isalways possible that a passive environment destabilizes therobot motions and extracts infinite energy from it. Since mosttasks can be defined in terms of energy, different authorsintroduced energy-tank methods to preserve passivity [22]–[24]. By using energy-tanks, the robot can use a certainamount of energy to perform a task, but no more thanthat. Different methodologies have been used to define suchstrategy. In this work, port-Hamiltonian systems theory isused to define energy-tanks similarly to [22], giving thema physical interpretation to better understand the energyexchange between controller and robot. In general, the port-Hamiltonian formulation, gives a theoretic approach whichallows to describe any physical system as a compositionof multiple subsystems which are connected through ports.These ports can be used to track all energy flowing inthe system. The advantage of such approach resides in thepossibility of having systems that are fully Energy-Aware.For this reason, the port-Hamiltonian formulation providesan elegant and simple representation to describe energy-tanksand to study the passivity of systems. In literature, othertechniques have been introduced for passivating systemsthrough energy considerations. In [25] and successively in[26], the passivity observer (PO) and passivity controller(PC) are used to guarantee passive interaction with a hapticinterface. To do so, the PO keeps track of the system’s

energy while the PC compensates eventual spurious energygeneration by injecting damping. Differently, the presentedmethodology with energy-tanks defined through a port-Hamiltonian system, structurally prevents that any actiontaken would result in spurious energy generation, includingthe coupling between the discrete and continuous time, asproven in [27]. Indeed, if the energy in the controller islower bounded, any control action is carried out in a waythat will not generate energy. Therefore, energy can only beinjected in the energy-tank externally (e.g. by the user) andfrom nowhere else [6].

The control scheme presented in this work, begins with abasic impedance controller whose parameters are first definedaccording to certain performance requirements [28]. Theseparameters (i.e. stiffness and damping), are then scaled suchthat safety limits defined in a combined energy and powerbased metrics are met. The resultant variable impedance con-troller is connected to an energy-tank subsystem to guaranteepassivity and energy consistency of the overall system.

III. SAFETY-AWARE IMPEDANCE CONTROL

One of the advantages of using a Cartesian impedancecontroller [29] resides in its clear and simple physical inter-pretation. A Cartesian impedance controller can be seen asa mechanical spring-damper system connected to the robot’send-effector (Fig. 2). This design choice, allows a simpleanalysis of the controller’s energy and power exchanged withthe robot.

A. Background work: Safety-Aware Impedance Control fora 1-DOF system

In the work presented in [4], the concept of a Safety-AwareImpedance Controller was introduced for a 1-DOF robot; anoverview of this concept is introduced in this section as afundamental starting point of the major contributions of thiswork. Consider a simplified robotic system represented by asingle mass, controlled by an elemental impedance controlleras shown in Fig. 2. The total energy of the system is defined

Fig. 2: Impedance controller connected to a mass represent-ing a simple 1-DOF robot.

as the sum of the kinetic energy of the mass, and the potentialenergy of the spring:

Etot = Tk + Vp =1

2mx2 +

1

2kx2e, (1)

where xe = xd − x is the motion error given a desiredset-point xd, m is the mass of the simplified robot, and xrepresents its velocity. Given the total energy of the system(1), the objective is to design an impedance controller which

is aware of the maximum amount of energy that a humancan tolerate without sustaining injury; this is attainable bydesigning a controller that limits the energy interchangedwith the human operator by adjusting the stiffness k withrespect to a maximum allowed energy which is delimited byEmax:

k =

k0 Etot ≤ Emax,

2Emax −mx2

(xd − x)2 Etot > Emax,

(2)

where ko is the maximum controller stiffness which is chosenbased on performance requirements. Once the safe energyrestrictions are assured by stiffness adjustment, the maximumpower that the robot can transfer to a human, during inter-action, can be limited by increasing the dissipative damping.Given the impedance characteristic of the controller, thepower Pc flowing from it to the robot can be written as:

Pc = (k(xd − x)− bx) x. (3)

Therefore, for a fixed controller stiffness value k, the powercan be limited to a maximum value Pmax by defining thedamping b as follows:

b =

b0 Pc ≤ Pmax,

k (xd − x) x− Pmax

x2Pc > Pmax.

(4)

Once the stiffness and damping parameters are determinedwith (2) and (4), respectively, the impedance control law isfinally defined as:

Fc = k (xd − x)− bx. (5)

The overall effect of the chosen control is to enforce acompliant behavior when the energy limits are violated, andto decelerate the robot’s motion if the power limits areexceeded. Moreover, since the two limitations are activatedsimultaneously, the lower limitation could affect the activa-tion of the other safety limit. For example, by imposing asmall power limit, the system would be strongly dampedand so, depending on the reference, the tracking error couldproduce a high spring energy causing the energy limit to beactivated.

B. Contribution: Safety-Aware Impedance Control for aMulti-DOF Robot

In this section, the safety-aware impedance control isextended to a multi-DOF robotic manipulator, which is oneof the main contributions of this work. The Lagrangiandynamic equation for a rigid multi-DOF robot is given as:

M(q)q +C(q, q)q +G(q) = τ , (6)

where M(q) is the inertia matrix, C(q, q) represents theCoriolis and centrifugal terms, G(q) is the gravitationalterm, and τ represents the torques acting on the joints givenby the controller action and the external interaction. Giventwo homogeneous matrices H0

t and H0v , describing the

current and desired end-effector’s configuration, respectively,

Fig. 3: Cartesian impedance control of a robot. A multidi-mensional virtual spring is connected between the current,and desired end-effector’s configuration and damping isadded at each joint.

the Cartesian impedance controller for a multi-DOF robotis physically described by a multidimensional spring withsymmetric stiffness matrix K ∈ R6×6, attempting to co-align these configurations. In order to achieve a satisfactorydynamic behavior, and guarantee robust asymptotic stability,damping is added to the system. Damping can be injectedeither in Cartesian space via a multidimensional dampermatrix B ∈ R6×6, or in joint space via a damper bn on eachDOF. In this work, the latter is taken into consideration, seeFig. 3. With these considerations, the wrench applied on themanipulator due to the virtual spring connection is definedas:

W t =

(mt

f t

)=

(Ko Kc

K>c Kt

)(δθvt

δpvt

), (7)

where δT =[(δθvt )>(δpvt )

>] is an infinitesimal twist invector form and Kt, Ko, and Kc, are the symmetric trans-lational, rotational and coupling stiffness matrices. Given thecomponents of the stiffness matrix, it is possible to definethe respective co-stiffness matrices Gt , Go and Gc as

Gx =1

2tr(Kx)I −Kx, (8)

where tr() is the tensor trace operator. The generalizedwrench exerted by the spring is a function of the relativeconfiguration Hv

t , which can be defined as

Hvt = (Hv

0 )−1 ·H0t =

(Rvt pvt

0> 1

), (9)

and the wrench W t = [mt f t]> exerted on the manipulator

due to the spring is expressed in the coordinates of the end-effector frame, and can be rewritten as [30]:

mt = −2as(GoRvt )− as(GtR

tvp

vt p

vtR

vt )− 2as(Gcp

vtR

vt ),

(10)

f t = −Rtvas(Gtp

vt )R

vt − as(GtR

tvp

vtR

vt )− 2as(GcR

vt ),(11)

where as() is an operator that gives the skew-symmetric partof a square matrix. After coordinate transformation of thewrench to an inertial reference frame Ψ0, it is possible to

transform the wrench into command torques τc for the robotby using the Jacobian transpose:

(W 0)> = Ad>Ht0(W t)>, (12)

τc = J>(q)W 0, (13)

where Ad() is Adjoint of the homogeneous matrix. Thedynamics of the robotic manipulator can be further shapedby adding a damping term B, acting on the joints, and thegravity compensation term G(q) in the command torques:

τc = J>(q)W 0 − Bq + G(q). (14)

The resulting multidimensional Cartesian impedance con-troller (14) can be integrated with the safety metrics pre-sented in Section III-A. In this case, it is first necessary togeneralize the total energy of the system (1) to a multi-DOFinstance. The kinetic energy for a multi-DOF robotic systemis defined as:

Tk(q, q) =1

2q>M(q)q, (15)

while the potential energy of the spatial spring is given by:

Vp(Rvt ,p

vt ) = Vt(R

vt ,p

vt ) + Vo(R

vt ) + Vc(R

vt ,p

vt ), (16)

where Vt(Rvt ,p

vt ), Vo(Rv

t ), and Vc(Rvt ,p

vt ), represent the

translational, rotational, and coupling elements of the poten-tial energy which are computed as [30]:

Vt(Rvt ,p

vt ) = −1

4tr(pvtGtp

vt )−

1

4tr(pvtR

vtGtR

tvp

vt ),

Vo(Rvt ) = −tr(GoR

vt ),

Vc(Rvt ,p

vt ) = tr(GcR

tvp

vt ),

(17)

with Gt, Go, and Gc defined through (8).Analogously to the 1-DOF case, energy limitation is

established by regulating the amount of potential energythat the spatial spring supplies to the system. As it canbe observed, the potential energy components in (17) areall proportional to the co-stiffness matrices Gx (for x =t, o, c). Consequently, by choosing a set of initial co-stiffnessmatrices Gxi , an initial potential energy value is defined, andthe total energy of the system can be regulated by scalingthe co-stiffness matrices with a scaling parameter λ:

Gx = λ ·Gxifor x = t, o, c. (18)

Similarly to (2), the total energy is limited to a maximumallowed value Emax by selecting the scaling parameter λ as:

λ =

1 Etot ≤ Emax,

Emax − Tk(q, q)

Vpi(Rvt ,p

vt )

otherwise,(19)

where Etot, and Vpi(Rvt ,p

vt ) are the total and potential

energies, respectively, due to the initial co-stiffness matricesGxi

. Given (19), the total energy of the system can beexpressed as:

Etot = Tk(q, q) + λVpi(Rvt ,p

vt ). (20)

By scaling the initial potential energy by λ, the total energywill always be less or equal than the maximum allowedenergy value Emax. After computing the new co-stiffnessvalue (18), the power transferred from the controller to therobot can be regulated by adjusting the damping analogouslyto the 1-DOF case (4). If an initial damping matrix Bi ischosen, the power transferred from the controller is given bythe following expression:

Pctot =(J>(q)W 0 − Biq

)>q︸ ︷︷ ︸

Pc

+ G(q)>q︸ ︷︷ ︸Pcg

, (21)

whereW 0 is the wrench acting on the end-effector due to thespatial Cartesian spring, which is scaled by (19). In case of anuncontrolled collision with a human operator, Pc representsthe power that can be transferred to the operator since thepower related to the gravity term Pcg gets dissipated by therobot itself to compensate its weight, and thus, Pc has to belimited below a tolerance value Pmax. The latter is attainedby defining a scaling parameter β as:

β =

1 Pc ≤ Pmax,(J>(q)W 0

)>q − Pmax

q>Biqotherwise.

(22)

Finally, the damping can be defined as:

B = β · Bi. (23)

IV. ASCERTAINING PASSIVITY THROUGHENERGY-TANKS

Passive systems are a class of dynamical systems in whichenergy exchange with the environment plays a central role,since they cannot deliver more energy than what is stored.The connection between the energetic features of a systemand its stability, is delineated by means of PBC [7]. Theimplementation of the safety-aware controllers presented inthe previous sections contradicts the energetic consistencyof impedance control design. The scaling of the parametersin the controller, allows internal energy production, resultingin the loss of passivity of the overall system. Therefore, theenergy-tank based controller implementation presented in [4]for a 1-DOF case, is extended and generalized to a multi-DOF instance, in order to circumvent this issue. As discussedin Section II, energy-tank systems can be described throughthe port-Hamiltonian formulation. In general, energy-tanksare presented as tools that can be added to any task orientedcontroller, in order to guarantee stability in non passive en-vironments. The latter, together with the controller presentedin Section III-B, builds up the so-called Safety and EnergyAware Impedance Controller, which is the major contributionof this work. This conception can be summarized in a multi-layered structure control strategy, illustrated in Fig. 4.

A. Energy-Tank Based Controller for a 1-DOF system

The physical representation of the energy-tank based con-troller for a 1-DOF system is depicted in Fig. 5. The energy-tank H(s) is modeled as a spring with constant stiffness (e.g.

Fig. 4: Layered scheme of the proposed controller. Theoverall controller consists of two main layers: the safetylayer which enforces the energy and power limitations aspresented in Section III-B, and a passivity layer realizedthrough energy-tanks. The motion profile can be generatedeither in Cartesian or joint space.

k = 1) connected to the robot through a transmission MT .This transmission allows power to flow from the controller tothe robot, regulated by the ratio u, whose value is determinedby a computational unit CU .

Fig. 5: 1-DOF energy-tank based controller.

The port-Hamiltonian equation of the energy-tank system,can be expressed as:(

s

p

)=

(0 u

−u 0

)(s

x

), (24)

where p is the momentum of the robot, x is the velocity of therobot, and s is the state of the spring. Given the controlleroutput Fc from (5), the port-Hamiltonian equation in (24)can be used to set the desired transmission ratio u as:

u =−Fcs. (25)

The computational unit CU assures that the power flowsfrom the controller to the robot only if there is energy leftin the tank. Hence, when the tank is empty, the controller’spower output must be zero; in this way, passivity is guaran-teed. Moreover, when power ”flows back” to the controller,the energy-tank can be refilled with the injected energy.Given these considerations, CU can be defined as a simplestate machine:

u =

−Fcs

if (H(s) > ε) ∨ (Pc < 0)) ,

0 otherwise,(26)

where H(s) = 12ks

2 is the potential energy in the tank and εis the minimum amount of energy in the tank before the robotand the controller are decoupled. The state of the spring inH(s) is computed at each time step by integrating s fromthe port-Hamiltonian expression in (24), adjusting in this waythe value of the transmission ratio u. Note that the conditionin (26) allows the computation of u, only when there isenergy left in the tank, or when the power flowing fromthe controller to the robot is negative. The latter condition issatisfied when the tank is being recharged, which will onlyhappen if an external force is applied to the system addingextra energy to the tank.

B. Extension to a Multi-DOF robot

The general 1-DOF simplified case can be extended toa multi-DOF instance, where each joint is examined asthe energy storage phenomenon illustrated in Fig. 5. Thephysical perception of the multi-DOF energy-tank notion isdepicted in Fig. 6.

Fig. 6: Physical depiction of the energy-tank based controllerfor a multi-DOF robot.

Analogously to the 1-DOF case, the port-Hamiltonianformulation for a joint subsystem n can be disclosed as:(

sn

τon

)=

(0 un

−un 0

)(sn

qn

). (27)

whereas in this case, the transmission ratio un is determinedas:

un =

−τcnsn

if (Hn(sn) > ε) ,

−τcnγ2

sn otherwise,(28)

where γ =√

2 · ε, and τcn is the torque computed with thechosen control strategy. Unlike (26), the piecewise functionin (28) does not assign a value of zero to the transmissionratio when the energy-tank is depleted, such that a controlaction still takes place during the depleted state of the tank.This strategy circumvents case where joint n extends itsmotion when Hn(sn) ≤ ε due to the inertial motion of theother links, which may unintentionally recharge the tank in

case. Moreover, the power condition in the upper statement isremoved from the if condition to avoid recharging the tanksdue to the presence of noise in the computation of Pcn.These are obliged adaptations for the multi-DOF instance,that induce passivity preservation of the overall system.

Once the transmission ratio is settled according to theenergy levels in Hn(sn), the torque output sent to joint n iscomputed as:

τon = −un · sn. (29)

V. EXPERIMENTAL RESULTS

To validate the proposed control scheme, two experimentswere conducted on the real platform and in simulation, usingthe KUKA LWR 4+ Fast Research Interface (FRI) [31]embedded in a ROS controller [32]. For both experiments,a Cartesian reference trajectory was defined as a periodicmotion along the y-axis of the base frame (T = 4[s]):

H0v (t) =

p0v(t) =

x

y(t)

z

=

−0.6

0.3sin( 2πT t)

0.6

,

R0v =

0 0 −1

0 1 0

1 0 0

.(30)

For the experiments the controller gains are defined as Kt =1000I3, Ko = 100I3, Kc = 03, B = 50I7, and the safetyparameters as (Emax = 1.0, Pmax = 2.0).

A. Experiment 1: Safe Human-Robot Interaction

In order to evaluate the safety-aware controller and itsperformances while the user interacts with the robot, theexperiment is divided in three parts. In the first part thesafety limitations are not activated. In the second part, thecontroller enforces the limitations reducing both energy andpower below the selected thresholds thanks to the scalingstiffness and damping. In the third part, the user interactswith the robot by constantly applying a force in differentdirections on the robot’s end-effector, while safety limitationsare enabled1. The tracking error for the translation part ‖et‖is computed as the norm of the difference vector pvt , while tocompute the orientation error from the rotation matrix Rv

t ,the angle and axis representation [33] is used. The resultsof the experiment as well as its description are presented inFig. 7 to ease the reading.

B. Experiment 2: Energetic behavior of the tanks

The behavior of the energy-tank notion, under the presenceof an external force, is examined in the following simulatedexperiment in conjunction with the safety layer. In particu-lar, the experiment focuses on the interaction between thecontroller power and the energy-tanks. Fig. 8 shows thecontroller power, scaling damping, and the relevant data

1For a better understanding of the experiment we recommend viewingthe video supplement.

from the first three joints, which are the joints primarilyused by the manipulator for the given motion reference(30). A constant force Fext = −10N is applied on therobot’s tool-tip for one second at t = 15[s] along the y-axis. Consequently, the energy tanks level increases due tothe external force. Moreover, the tanks get refilled when thepower becomes negative. This is a direct consequence ofthe increased damping value acting on the joints (21) and iscoherent with the desired behavior expressed by (28).

VI. CONCLUSION

A safety-aware impedance controller for multi-DOF col-laborative robots is proposed. This controller ensures safetythanks to energy and power limitations, which are enforcedby scaling accordingly stiffness and damping of the con-troller (Fig. 7). The passivity of the controller is assuredby decoupling the controller from the robot through energy-tanks. Energy-tanks provide an easy and elegant solution forthe passivity problem but their presence limits the system au-tonomy by introducing a maximum quantity of consumableenergy after which the controller gets decoupled from therobot. For this reason, in future work, it will be investigatedhow to make an energy-tank system which is aware of theenergy amount needed to perform a specific task, resultingin a more efficient energy-aware controller.

ACKNOWLEDGEMENTS

This project has received funding from the EuropeanUnion’s Horizon 2020 Research and Innovation Programmeunder Grant Agreement No.688857 (SoftPro).

REFERENCES

[1] I. ISO, “Iso 10218-1: 2011: Robots and robotic devices–safety re-quirements for industrial robots–part 1: Robots,” Geneva, Switzerland:International Organization for Standardization, 2011.

[2] J. E. Colgate, M. A. Peshkin, and S. H. Klostermeyer, “Intelligentassist devices in industrial applications: a review,” in IROS, 2003, pp.2516–2521.

[3] A. Bicchi, M. A. Peshkin, and J. E. Colgate, “Safety for physicalhuman–robot interaction,” in Springer handbook of robotics. Springer,2008, pp. 1335–1348.

[4] T. S. Tadele, T. J. de Vries, and S. Stramigioli, “Combining energy andpower based safety metrics in controller design for domestic robots,” inRobotics and Automation (ICRA), 2014 IEEE International Conferenceon. IEEE, 2014, pp. 1209–1214.

[5] C. Harper and G. Virk, “Towards the development of internationalsafety standards for human robot interaction,” International Journalof Social Robotics, vol. 2, no. 3, pp. 229–234, 2010.

[6] G. A. Folkertsma, S. Stramigioli, et al., “Energy in robotics,” Foun-dations and Trends R© in Robotics, vol. 6, no. 3, pp. 140–210, 2017.

[7] R. Ortega, J. A. L. Perez, P. J. Nicklasson, and H. Sira-Ramirez,Passivity-based control of Euler-Lagrange systems: mechanical, elec-trical and electromechanical applications. Springer Science &Business Media, 2013.

[8] R. Alami, A. Albu-Schaffer, A. Bicchi, R. Bischoff, R. Chatila,A. De Luca, A. De Santis, G. Giralt, J. Guiochet, G. Hirzinger, et al.,“Safe and dependable physical human-robot interaction in anthropicdomains: State of the art and challenges,” in Intelligent Robots andSystems, 2006 IEEE/RSJ International Conference on. IEEE, 2006,pp. 1–16.

[9] T. S. Tadele, T. de Vries, and S. Stramigioli, “The safety of domes-tic robotics: A survey of various safety-related publications,” IEEErobotics & automation magazine, vol. 21, no. 3, pp. 134–142, 2014.

Fig. 7: The experiment shows the limitations in term of energy and power as well as the performances in terms of trackingerror. In the first part of the experiment the safety limitations are not applied, the robot is able to track better the reference‖et‖ : (M = 0.0220, SD = 0.0076) , ‖eo‖ : (M = 0.2790, SD = 0.1619). In the second part the safety limits areactive, thus the energy and power are limited to the their maximum values (Emax = 1.0, Pmax = 2.0) thanks to thescaling stiffness (19) and damping (22). As a consequence, the tracking error increases ‖et‖ : (M = 0.0293, SD = 0.084),‖eo‖ : (M = 0.2985, SD = 0.1548). In the last part of the experiment, the user interacts with the robot while the safetylimits are active thus the energy and power limitations guarantee a safe interaction ‖et‖ : (M = 0.0795, SD = 0.1143),‖eo‖ : (M = 0.3216, SD = 0.1645).

Fig. 8: After an initialization phase in which the robot starts tracking the reference, the safety limitations are activated. Aconstant force is applied for one second starting from t = 15s (red area). Consequentially the tracking on the y-axis getsdisrupted as shown in the last plot. The energy levels of the tanks are shown in the fourth plot. At the beginning of theexperiment, their level is initialized at 12[J ] and successively, slowly decreases as the energy gets used by the controller(joint 1 and 3). It is worth noting that joint 2 is not relevant for the chosen motion (its velocity is close to zero) and so itdoes not consume energy from its tank.

[10] M. Wassink and S. Stramigioli, “Towards a novel safety norm fordomestic robotics,” in Intelligent Robots and Systems, 2007. IROS2007. IEEE/RSJ International Conference on. IEEE, 2007, pp. 3354–3359.

[11] J. A. Newman, N. Shewchenko, and E. Welbourne, “A proposed newbiomechanical head injury assessment function-the maximum powerindex.” Stapp car crash journal, vol. 44, pp. 215–247, 2000.

[12] J. L. Wood, “Dynamic response of human cranial bone,” Journal ofbiomechanics, vol. 4, no. 1, pp. 1IN13–2IN312, 1971.

[13] N. Yoganandan, F. Pintar, D. Maiman, J. Cusick, A. Sances, andP. Walsh, “Human head-neck biomechanics under axial tension,”Medical engineering & physics, vol. 18, no. 4, pp. 289–294, 1996.

[14] J. Versace, “A review of the severity index,” SAE Technical Paper,Tech. Rep., 1971.

[15] S. Haddadin, A. Albu-Schaffer, and G. Hirzinger, “Safety analysis for ahuman-friendly manipulator,” International Journal of Social Robotics,vol. 2, no. 3, pp. 235–252, 2010.

[16] A. Bicchi and G. Tonietti, “Fast and” soft-arm” tactics [robot armdesign],” IEEE Robotics & Automation Magazine, vol. 11, no. 2, pp.22–33, 2004.

[17] J. Heinzmann and A. Zelinsky, “Quantitative safety guaranteesfor physical human-robot interaction,” The International Journal ofRobotics Research, vol. 22, no. 7-8, pp. 479–504, 2003.

[18] M. Laffranchi, N. G. Tsagarakis, and D. G. Caldwell, “Safe humanrobot interaction via energy regulation control,” in Intelligent Robotsand Systems, 2009. IROS 2009. IEEE/RSJ International Conferenceon. IEEE, 2009, pp. 35–41.

[19] A. Albu-Schaffer, C. Ott, and G. Hirzinger, “A unified passivity-based control framework for position, torque and impedance control offlexible joint robots,” The international journal of robotics research,vol. 26, no. 1, pp. 23–39, 2007.

[20] A. M. Zanchettin, B. Lacevic, and P. Rocco, “A novel passivity-basedcontrol law for safe human-robot coexistence,” in Intelligent Robotsand Systems (IROS), 2012 IEEE/RSJ International Conference on.IEEE, 2012, pp. 2276–2281.

[21] S. Stramigioli, “Energy-aware robotics,” in Mathematical ControlTheory I. Springer, 2015, pp. 37–50.

[22] F. Ferraguti, N. Preda, A. Manurung, M. Bonfe, O. Lambercy,R. Gassert, R. Muradore, P. Fiorini, and C. Secchi, “An energy tank-based interactive control architecture for autonomous and teleoperatedrobotic surgery,” IEEE Transactions on Robotics, vol. 31, no. 5, pp.1073–1088, 2015.

[23] C. Schindlbeck and S. Haddadin, “Unified passivity-based cartesianforce/impedance control for rigid and flexible joint robots via task-energy tanks,” in Robotics and Automation (ICRA), 2015 IEEE Inter-national Conference on. IEEE, 2015, pp. 440–447.

[24] A. Dietrich, X. Wu, K. Bussmann, C. Ott, A. Albu-Schaffer, andS. Stramigioli, “Passive hierarchical impedance control via energytanks,” IEEE Robotics and Automation Letters, vol. 2, no. 2, pp. 522–529, 2017.

[25] B. Hannaford and J.-H. Ryu, “Time-domain passivity control of hapticinterfaces,” IEEE Transactions on Robotics and Automation, vol. 18,no. 1, pp. 1–10, 2002.

[26] J.-H. Ryu, C. Preusche, B. Hannaford, and G. Hirzinger, “Time domainpassivity control with reference energy following,” IEEE Transactionson Control Systems Technology, vol. 13, no. 5, pp. 737–742, 2005.

[27] S. Stramigioli, C. Secchi, A. J. van der Schaft, and C. Fantuzzi, “Sam-pled data systems passivity and discrete port-hamiltonian systems,”IEEE Transactions on Robotics, vol. 21, no. 4, pp. 574–587, 2005.

[28] T. S. Tadele, T. de Vries, and S. Stramigioli, “Pid motion controltuning rules in a damping injection framework,” in American ControlConference (ACC), 2013. IEEE, 2013, pp. 4957–4962.

[29] N. Hogan, “Impedance control: An approach to manipulation,” inAmerican Control Conference, 1984. IEEE, 1984, pp. 304–313.

[30] S. Stramigioli, Modeling and IPC control of interactive mechanicalsystems a coordinate free approach, 2001.

[31] G. Schreiber, A. Stemmer, and R. Bischoff, “The fast research interfacefor the kuka lightweight robot,” in IEEE Workshop on InnovativeRobot Control Architectures for Demanding (Research) ApplicationsHow to Modify and Enhance Commercial Controllers (ICRA 2010),2010, pp. 15–21.

[32] S. Chitta, E. Marder-Eppstein, W. Meeussen, V. Pradeep,A. Rodrıguez Tsouroukdissian, J. Bohren, D. Coleman, B. Magyar,G. Raiola, M. Ludtke, and E. Fernandez Perdomo, “ros control: Ageneric and simple control framework for ros,” The Journal of Open

Source Software, 2017. [Online]. Available: http://www.theoj.org/joss-papers/joss.00456/10.21105.joss.00456.pdf

[33] B. Siciliano, L. Sciavicco, L. Villani, and G. Oriolo, Robotics: Mod-elling, Planning and Control, ser. Advanced Textbooks in Control andSignal Processing. Springer, 2009.