A massage robot does not decide to stop the way a person decides to ease off. It stops because a sensor crossed a number, and a layer of the machine that the session software cannot touch refused to let the arm go further. That distinction, between judgment and a hard limit, is the entire engineering story behind why one of these machines is safe to lie down on, and it is a narrower question than the category overview at massage robots, which covers what the format is before getting to how any of it actually works.
The pressure you feel is measured, not assumed
Every movement in a session is closed-loop, not open-loop: the arm does not simply execute a pre-recorded path and hope it lands correctly on a given body. Force sensors read the actual contact pressure many times a second and feed that reading back into the system continuously, so the head adjusts as it moves across the contours of a specific person rather than a generic shape. Sestala’s own machines hold to a fixed ceiling within that loop, 70 newtons at the firmest setting, roughly the push of a 7 kg weight resting on skin, and a person chooses anywhere within that range across ten pressure levels, never above it.
A continuous loop is what makes a fixed ceiling meaningful in the first place. A machine that only checked pressure once at the start of a movement could drift upward as it travelled, and a person’s shape is not uniform from one point to the next. Reading force throughout the movement, rather than sampling it once, is what lets the ceiling hold everywhere on the body rather than only at the point it happened to be checked.
Two separate systems decide what happens next
The layer that plans a session and the layer that permits a movement are architecturally separate, and this separation is deliberate rather than incidental. The planning layer decides what a good sequence of movements looks like for a given session, and it is the part of the machine that can be refined and updated over time. The safety layer decides what is allowed at all, and it does not move when the planning layer is updated.
Every proposed movement passes through the safety layer before it happens, not after. A software update to the planning side, however well tested, cannot on its own move the number the safety layer enforces. Changing that number takes a physical intervention by a qualified technician, on the machine itself. Sestala’s own thermal ceiling works the same way: 40°C at the contact surface, fixed outside the session software, alongside the neck excluded from the motion path entirely rather than left to a warning a person has to read and trust.
The stop is not a pause
Pressing the stop control does not lower the pressure or slow the arm down. It halts motion outright, in roughly 0.45 seconds from contact, and the machine stays stopped until the person on the table, and only that person, says otherwise. A machine that quietly resumes on its own after a stop has misunderstood what a stop is for: it is a transfer of control, not a brief interruption.
That control sits within reach of someone lying down, by design and, from January 2027, by law: the EU’s Machinery Regulation, 2023/1230, becomes mandatory that year and sets requirements for exactly this kind of interactive machine. Until then, the honest test is whether a stop control is reachable without sitting up, works with no grace period, and hands control back to the person rather than to the machine’s own judgment about whether it is safe to continue.
The certificate that would settle this does not exist yet
It would be reassuring to say a machine like this is certified the way a factory robot is, and it would not be true. EN ISO 10218-1 and 10218-2, the standards written for collaborative robots that share space with people, explicitly exclude robots built for healthcare use, public access and consumer products from their own scope. A certificate built on that standard describes a robot working next to a trained operator on a factory floor, not a machine holding sustained pressure on a paying member of the public.
EN ISO 13482:2014 is the standard that actually covers physical contact between a robot and a person in a personal-care setting, and it requires a maker to limit the forces involved, but it does not supply the number. It says so directly: no internationally recognised pain or injury threshold existed for this kind of contact when the standard was written. Germany’s DGUV, the statutory accident insurance body, holds the closest thing to real data, a register of roughly 9,000 pressure measurements across 29 body locations on around 100 people, gathered to study accidental industrial contact rather than a requested, paid session. It is genuine research, borrowed for a question it was not built to answer, which is why a manufacturer’s own published numbers, checked against its own stated method, currently matter more than any single certificate on the wall.
A machine that will not say where its ceiling lives, in writing, has not done the work a certificate cannot yet do for it. The same restraint runs through Sestala’s own published limits, covered in full at the force ceiling: a number that cannot be raised is worth more than a demonstration that it usually is not.
