The fail-safe assumption that breaks on two legs

Classical machine safety rests on a simple idea: if something goes wrong, remove the energy. Industrial robots are built around it. Every axis carries a power-off brake, and the safe state is the de-energised state. A 2026 feasibility study on certifying industrial humanoids calls this assumption “fail-passive”, and argues that it inverts on a biped: “Removing power from a walking biped produces an uncontrolled fall, which is itself a hazard.” For a humanoid, the safe state is an actively balanced standstill, and that needs power, sensors and a working control policy.

The risk is concrete. Agility Robotics’ Digit, a 1.8 m, 65 kg machine by MIT Technology Review’s figures, collapsed on a trade-show floor while handling totes in 2025. Industry guidance on the ISO 25785-1 draft puts rough numbers on the hazard: a 1.7 m robot moving at 1.5 m/s could land within about two metres, depending on speed, load and floor angle. That is the zone brakes, controllers and stop logic have to shrink.

Where the brake sits in a joint

In a rotary joint module the brake almost always sits on the motor side, at the rear of the motor shaft next to the encoder, before the reducer. That placement is a matter of leverage. A brake on the high-speed shaft only has to hold motor torque, and the reducer multiplies it. As an illustration, a 5 N·m brake behind a 50:1 reducer can hold on the order of 250 N·m at the joint output, before losses. A brake on the output side would need the full joint torque in one disc. The catch is that the reducer’s teeth and flexspline stay in the load path when the brake holds, so a hard fall onto a locked joint loads the gearbox as well as the brake.

Spring-applied or permanent magnet

Two electromagnetic designs dominate robot joints. Both are power-off brakes: they hold when de-energised and release when current flows. In a spring-applied brake, springs press an armature plate against a friction rotor, and an energised coil pulls the armature back to free the shaft. In a permanent-magnet brake, a magnet holds the armature against the hub, and current in the coil cancels the magnet’s field to release it.

The trade-offs matter more in a humanoid than in a factory arm. Permanent-magnet brakes offer near-zero backlash and the most torque in the smallest package, but Design World notes they are usually specified for holding only, need a steady current within roughly ±10% of rated voltage, and are sensitive to temperature. Spring-applied brakes have a little play between rotor and hub, but they tolerate dynamic stops, run on friction linings that wear slowly, and need only about a quarter of their pull-in voltage to stay released. For a robot that must hold every brake open all day on a battery, that last point counts.

Thin, light and cheap to hold open

Brake suppliers now pitch at humanoids by name, and the selling point is thickness. KEB makes the case plainly: a humanoid hip module has to fit motor, gearbox, encoder, drive electronics and holding brake inside the width of a human hip. Its COMBISTOP S1 Flat brakes are 12 to 15 mm thick with 3.4 to 10.8 N·m of holding torque over two sizes, a large bore for cables through the joint axis, and no rare-earth magnets. Kendrion’s slim permanent-magnet line spans 2.7 to 17 N·m, and Miki Pulley’s BXR spring-applied brakes claim about two-thirds the thickness of standard designs.

Power is the other budget. Every spring-applied or permanent-magnet brake draws current for as long as the joint moves. KEB puts a 12-joint battery robot at 40 to 50 W just to hold its brakes open, and recommends dropping the coil voltage after release. Miki Pulley’s small BXR-LE pulls in at 24 VDC and holds at 7 VDC. At the miniature end, Motion Control Tips describes a 7 g brake that releases at about 4 W and stays released at 0.34 W. Across 30 or more joints, those watts come straight out of runtime, which is one reason brake choice is made joint by joint, not robot-wide.

Stopping without falling

Brakes alone do not make a humanoid safe to stop. The industry answer, so far, is to decide how the robot stops, and let brakes cover the case where everything else has failed.

• Category 0: power off now. The classic industrial stop. On a biped it produces the uncontrolled fall that makes the fail-passive model break down, unless the joints lock in a stable pose.
• Category 1: stop, then cut power. This is what Agility adopted for Digit’s emergency stop, according to heise: actuators keep power long enough for the robot to “stop gently and safely without falling over”, behind a safety PLC rated Performance Level d and FailSafe over EtherCAT.
• Controlled descent. Digit’s newer behaviour puts down what it carries and drops to its hands and knees before powering down, per MIT Technology Review. Guidance on the ISO 25785-1 draft calls this kind of kneeling posture a zero-energy pose.
• Brakes as the last line. The Association for Advancing Automation argues that if other safety systems malfunction, “mechanical joint brakes must prevent a full collapse”, while stressing that no single component is enough.

The standards are catching up. ISO 25785-1, covering industrial mobile robots with actively controlled stability (legged, wheeled or otherwise), was still a committee draft in 2026. Summaries of the draft say it asks for controlled descent rather than collapse, warnings before power loss where possible, and defined behaviour when an emergency stop is triggered. Industry estimates put publication in late 2026 or 2027. Wheeled humanoids sit in an easier place: as A3 notes, they stop rather than fall.

What to ask a supplier

Humanoid makers rarely publish which joints carry brakes, so buyers and integrators should ask. Useful questions: which joints are braked (arms holding a payload and the hip and knee pitch axes matter most), whether the brake is rated for dynamic stops or holding only, the holding torque at the joint output after the reducer, the power drawn to keep all brakes released, and what the robot does on an emergency stop and on a sudden loss of battery power. The answers say more about deployment readiness than a peak-torque figure does.

FAQ

Sources