Walk any trade fair for massage robots and you will hear about capability: more heads, more programmes, more sensors, more of everything a brochure can print. Capability is easy to compare, which is exactly why it dominates the marketing.
The number that actually matters is the one almost nobody prints: the force the machine can never apply. Not rarely. Not unless a setting is raised. Never, whoever is lying on the table and whatever the session software believes would be a good idea.
The category guide is at massage robots. This essay is about the engineering principle behind a force ceiling, and about a standards gap that every serious manufacturer has to answer for itself, because nobody else has answered it for them.
A ceiling is not a setting
Most machines in this category let the person choose a pressure. The difference that matters is what sits above that choice.
A setting can be raised. A ceiling cannot. The ceiling lives in a layer of the machine that is architecturally separate from the software that plans the session. The planning layer proposes a movement; the safety layer grants or refuses it. No menu, no software update, no administrator override and no enthusiastic customer can move what the safety layer permits. Changing the ceiling requires a physical intervention by a qualified technician with the right tools, on the machine itself.
That separation is the whole point. The part of the system that decides what a good session looks like should get better over time - refining its sense of a person’s shape, its paths, its programmes. The part that decides what is permitted should not change at all, because a limit that can be renegotiated by an update is not a limit, it is a preference with a delay.
A limit that can be renegotiated by an update is not a limit. It is a preference with a delay.
Sestala’s own published figures follow this shape: a 70 N force ceiling and a 40°C thermal ceiling at the contact surface, both fixed outside the session software, with the neck excluded from the motion path entirely and a stop response of roughly 0.45 seconds (sestala.com/industry).
The standard that exists does not give you a number
Read from the documents rather than from any manufacturer’s marketing, the standards picture is thinner than the category’s confidence suggests.
EN ISO 13482:2014 is the harmonised European standard that actually covers physical contact between a robot and a person in a personal-care setting, and it appears on the EU’s own harmonised standards register. It requires a manufacturer to limit the forces the machine can exert on a person. It does not supply that number. The standard states plainly that no internationally recognised pain or injury threshold existed for this kind of contact at the time it was written, which leaves each manufacturer to derive and justify its own figure.
EN ISO 10218-1 and 10218-2, the standards written for collaborative industrial robots, explicitly exclude this machine class from their scope on several grounds: robots for healthcare use, robots with public access, and consumer products are all carved out. A certification built on ISO 10218 describes a robot working alongside a trained operator in a factory. It says nothing about a machine touching a paying member of the public on a recovery table, and a manufacturer that leans on it is citing a certificate about a different problem.
The closest thing to real data was built for a different question
Germany’s DGUV, the statutory accident insurance body, holds the most detailed public research on force and human pain thresholds relevant to this category: a register of roughly 9,000 measurements across 29 body locations on around 100 people, gathered using calibrated pressure equipment. It is genuine, careful, published research, and it now informs broader thinking about safe contact force for collaborative robots.
It was built to understand accidental industrial contact - a robot arm striking someone by mistake - not a requested, paid session where firm, sustained pressure is the entire point. Borrowing that data for a massage robot’s force ceiling is a reasonable starting point, not a finished answer, and a manufacturer’s own documentation should say which parts of the borrowed data it validated for this different use rather than presenting it as if the two situations were the same.
The regulation that will eventually catch up
The EU’s Machinery Regulation, 2023/1230, enters mandatory application on 20 January 2027, replacing the current Machinery Directive with updated essential health and safety requirements for machines that interact with people. It will not retroactively fix a machine built before that date, and it will not stop a manufacturer from making a weak claim before it applies. What it does is give a buyer or a venue operator a fixed date after which “we comply with the current directive” stops being a sufficient answer.
Until then, the honest question a venue or a manufacturer should be able to answer, in plain language, is this: what is the number, where does it live in the machine, and what happens if the software is updated tomorrow. A manufacturer that answers precisely, from documents that already exist, did the work. One that answers with reassurance instead of a number did not.
The stop is the same principle, worn on the outside
The force ceiling is internal and invisible. The stop control is its visible equivalent, and it earns the same scrutiny.
A stop has to be within comfortable reach of a person lying on the table, work instantly with no grace period, and once pressed, keep the machine still until the person on the table, and nobody else, says otherwise. A machine that resets itself to running after a stop has misunderstood the point of a stop. It is not a pause. It is a transfer of control to the person on the table, and it stays transferred for as long as they want it to.
A recovery session is still an unfamiliar thing to a lot of people, and an unfamiliar thing invites the imagination to fill in the gaps with whatever is loudest. The industry mostly fills those gaps with capability. We think the honest answer is restraint, stated precisely: the ceiling that cannot be raised, the stop that cannot be overridden, the region the machine will not touch at all. Everything else is a head and a programme.
