STATERA Library · Series 07 · Volume 12 · Chapter 03 · EN
Source: https://github.com/Statera-Library/07_Vol_12_Safety_Architecture/blob/main/Chapter_03_ISO_3691_4/Chapter_03_ISO_3691_4_EN.md

Volume 12. Safety Architecture

Chapter 03. ISO 3691-4

03.01. AMR Safety Requirements

ISO 3691-4 establishes safety requirements for driverless industrial trucks and their systems, including automated guided vehicles and autonomous mobile robots operating in industrial environments. For an AMR, safety must be treated as a system-level property rather than as a single sensor or emergency-stop function. The vehicle, control system, protective devices, operating environment, payload, human interaction, and foreseeable misuse must therefore be considered together throughout the safety lifecycle.

The fundamental safety objective is to prevent unacceptable risk when an AMR moves, starts, stops, turns, docks, transfers loads, or performs other automated functions. Hazardous situations may arise from collision, crushing, trapping, shearing, unexpected motion, excessive speed, unstable loads, loss of control, or failure of sensing and braking functions. Safety requirements must consequently address both normal operation and reasonably foreseeable abnormal conditions.

Risk assessment begins by defining the intended use of the AMR, its operating zones, permitted speeds, payload range, environmental conditions, and expected interactions with people and other machines. Designers must identify hazardous events associated with each operating state and determine suitable risk-reduction measures. The resulting requirements should be traceable from identified hazards through safety functions, implementation, verification, and final validation of the complete vehicle.

AMR motion represents the primary source of kinetic hazard. Maximum travel speed, acceleration, deceleration, turning behavior, braking distance, vehicle mass, payload, and surface conditions influence the severity and probability of collision. Safety design therefore cannot define speed independently of sensing and braking capability. The allowable motion envelope must remain compatible with the distance required to detect a hazard, process the safety signal, initiate braking, and bring the vehicle to a safe state.

Personnel detection is essential where AMRs share space with workers. Safety-rated protective devices must detect persons or obstacles within defined protective fields and initiate the required safety response before hazardous contact occurs. The geometry of these fields depends on vehicle speed, direction of travel, stopping performance, sensor response time, control-system delay, and environmental uncertainty. Protective coverage must also consider turning, reverse travel, and vehicle overhang.

Stopping performance must be established under representative worst-case conditions rather than ideal laboratory conditions. The total stopping distance includes sensing delay, safety-controller processing time, communication delay, actuator response, brake engagement, and physical braking distance. Vehicle mass, payload, floor friction, slope, tire condition, and brake degradation can significantly change this distance. Validation should therefore demonstrate adequate stopping margins throughout the defined operating envelope.

An AMR must provide safety-related control functions that remain effective when ordinary navigation or mission-control functions fail. A failure in localization, route planning, artificial intelligence, fleet communication, or application software must not directly defeat the independent mechanisms responsible for preventing hazardous motion. Safety-related functions should be sufficiently separated from non-safety functions so that complex autonomy can fail without removing the vehicle\'s fundamental protective capability.

Emergency stopping provides an additional means for rapidly terminating hazardous movement when intervention is required. Emergency-stop devices must be accessible, clearly identifiable, and integrated into a safety-related control path appropriate to the risk. Activation should place the AMR in a defined safe condition and prevent automatic restart. Resetting the emergency-stop device should only permit subsequent restart; it should not itself command the vehicle to resume motion.

Unexpected startup must also be controlled. After power restoration, emergency-stop reset, protective-device recovery, communication restoration, or software restart, the AMR should not initiate hazardous movement without satisfying defined restart conditions. The control architecture must distinguish between recovery of system availability and authorization of motion. This prevents a person who entered the operating area during a stopped condition from being exposed to an unexpected vehicle restart.

Direction-dependent protection is important because an AMR may travel forward, backward, sideways, or along curved trajectories depending on its drivetrain. Protective fields should correspond to the actual direction and velocity of motion rather than remaining fixed around the chassis. For omnidirectional platforms, the safety concept becomes especially demanding because hazardous motion can develop along multiple axes. Safety coverage must therefore follow the commanded and physically possible movement envelope.

Load handling introduces additional hazards beyond vehicle movement. Payload dimensions can change the effective footprint, obstruct sensors, shift the center of gravity, or create crushing and collision points not present on the unloaded vehicle. Safety requirements should define allowable load mass, geometry, position, retention, and transfer conditions. Where load state affects sensing or stability, the AMR must adapt its permitted speed, protective field, or operating mode accordingly.

Stability must be maintained during acceleration, braking, turning, ramp travel, and payload transfer. A vehicle that remains collision-safe can still create severe hazards if it tips or loses its load. Mechanical dimensions, center-of-gravity limits, wheel arrangement, suspension behavior, payload position, and permissible gradients must therefore be incorporated into the safety analysis. Operational restrictions should prevent combinations of speed, load, and slope that exceed validated stability limits.

Operating zones can be used to adapt AMR behavior to environmental risk. A vehicle may require different speed limits or safety functions in pedestrian areas, restricted aisles, docking stations, intersections, elevators, automatic doors, or machine interfaces. Zone-dependent behavior must be implemented predictably and verified so that an incorrect localization or mission command cannot silently authorize unsafe motion. Safety-related zone information requires appropriate integrity where it influences risk reduction.

Interfaces with conveyors, doors, lifts, manipulators, charging systems, and production equipment create combined-system hazards. The AMR must not assume that another machine is safe merely because communication has been established. Handshake conditions should confirm that required states are satisfied before movement or load transfer begins. Loss of an interlock, invalid communication, or contradictory state information should lead to a controlled response rather than continued operation based on stale commands.

Safety-related communication must account for message corruption, repetition, loss, delay, incorrect sequence, and unintended addressing when communication contributes to a safety function. Ordinary Ethernet, wireless links, or fleet-management messages should not automatically be treated as safety-rated information. Where remote commands influence hazardous movement, the architecture must ensure that communication failures cannot bypass local protective functions or leave the AMR moving without valid safety supervision.

Environmental conditions directly affect safety performance. Dust, water, fog, sunlight, reflective surfaces, temperature, vibration, floor contamination, narrow passages, and outdoor weather can degrade sensors or braking behavior. The safety concept should define environmental limits and detect conditions that make continued autonomous operation unsafe. If required protective performance cannot be maintained, the vehicle should transition to a reduced-performance state or stop rather than relying on uncertain perception.

Diagnostics are required to detect faults that could compromise safety functions. Relevant failures include sensor obstruction, wiring faults, loss of power, controller malfunction, brake degradation, communication errors, invalid configuration, and disagreement between redundant signals. Diagnostic coverage should be designed according to the required safety performance, and detected faults should produce a defined reaction. Fault logging also supports maintenance, verification, incident investigation, and continued safety assurance.

Manual, maintenance, setup, recovery, and automatic modes require clearly defined behavior because different hazards exist in each state. Maintenance personnel may work closer to actuators and exposed mechanisms than normal operators, while recovery procedures may require limited movement after a fault. Mode selection should therefore prevent unintended transitions and restrict speed or functionality where necessary. Authorization may also be required for modes that reduce normal protective measures.

Verification confirms that individual safety requirements have been implemented correctly, while validation demonstrates that the integrated AMR achieves acceptable safety in its intended operating environment. Testing should include protective-field activation, stopping distance, emergency stopping, restart prevention, sensor faults, communication loss, payload variations, gradients, turning maneuvers, and representative environmental conditions. Worst-case combinations are particularly important because isolated component tests may underestimate system-level risk.

Safety documentation should preserve traceability among hazards, risk assessments, safety requirements, architecture, hardware and software implementation, test procedures, results, limitations, and operating instructions. Configuration control is equally important because changes to software, sensors, braking parameters, payloads, wheel dimensions, or operating speeds can invalidate previous safety evidence. Safety approval should therefore apply to a controlled configuration rather than to an abstract AMR platform.

For modern AMRs using AI-based perception and planning, the distinction between autonomous intelligence and safety enforcement is especially important. AI may improve object recognition, semantic understanding, trajectory planning, and operational efficiency, but safety-critical protective functions require predictable behavior and demonstrable integrity. A robust architecture allows advanced autonomy to propose motion while an independent safety layer supervises whether that motion remains inside an authorized safety envelope.

The practical objective of ISO 3691-4-oriented design is therefore not merely to make an AMR stop when an obstacle appears. It is to establish a coherent safety architecture in which hazardous motion is continuously constrained by validated sensing, safe speed, stopping capability, control integrity, diagnostics, operating rules, and human-accessible intervention. This system perspective provides the foundation for the subsequent design of obstacle detection, speed and separation monitoring, safe-speed functions, and certification activities defined within the ISO 3691-4 chapter structure.

03.02. Obstacle Detection Requirements

Obstacle detection for an autonomous mobile robot is a safety-related capability that prevents hazardous contact with people, equipment, structures, and unexpected objects within the vehicle's travel path. Under an ISO 3691-4-oriented safety architecture, detection must be coordinated with vehicle speed, direction, braking capability, operating mode, and environmental conditions. The objective is not merely to perceive an obstacle, but to initiate a sufficiently early and reliable safety response.

The required detection area must cover the space in which an obstacle could create a hazardous situation before the AMR can reach a safe state. This area depends on the vehicle footprint, direction of travel, maximum permitted speed, stopping distance, steering behavior, and possible overhang from carried loads. Protective coverage should therefore represent the actual motion envelope rather than a simple fixed region located only in front of the vehicle.

A protective field must provide sufficient distance for the complete safety reaction sequence. When an obstacle enters the relevant field, the system requires time for sensor detection, signal processing, safety communication, controller evaluation, actuator response, and mechanical braking. The AMR continues moving during these intervals. Protective distance must consequently include the distance traveled during total response time together with the physical braking distance and appropriate safety margins.

Detection requirements should distinguish between warning behavior and safety-related protective action. A warning field may cause the AMR to reduce speed, issue an audible or visual indication, or prepare for a controlled stop before an obstacle reaches the primary protective field. Entry into the protective field requires the defined safety response. This layered arrangement can improve operational efficiency while preserving the independent protection needed to prevent hazardous contact.

Vehicle speed and obstacle detection are directly coupled. A faster AMR requires a larger protective distance because both reaction distance and braking distance increase as speed rises. Conversely, reduced-speed operation can permit smaller protective fields where narrow passages or docking operations make large fields impractical. Dynamic field selection can therefore associate predefined safety-rated detection zones with validated speed ranges, provided transitions between fields remain controlled and fail-safe.

Direction of travel must be considered whenever protective fields are selected. Forward motion requires protection ahead of the vehicle, while reverse motion requires equivalent protection at the rear. Vehicles capable of lateral or omnidirectional movement require additional side coverage because hazardous motion may occur along multiple axes. During turning, the swept path of the chassis and payload can extend beyond the straight-line footprint, requiring protective areas that account for rotational movement.

Safety laser scanners and safety LiDAR systems are commonly suitable for detecting objects within defined two-dimensional protective fields around an AMR. Their configuration should consider scanning geometry, angular resolution, detection capability, response time, mounting height, field coverage, and diagnostic functions. Sensor placement must minimize blind regions caused by wheels, bumpers, structural components, payload mechanisms, or other equipment mounted on the vehicle.

A single sensing plane may not detect every relevant obstacle. Objects located above or below the scanner plane, suspended structures, protruding shelves, forklift forks, low-profile objects, or unusual payloads can remain outside the effective detection region. The safety assessment must therefore determine which obstacle geometries are reasonably foreseeable and whether additional scanners, bumpers, three-dimensional sensors, mechanical protection, or operational restrictions are required.

Detection of people requires particular attention because human movement is less predictable than fixed infrastructure. Workers may enter the AMR path from doorways, intersections, workstations, or between stored materials. Protective fields should provide sufficient coverage for foreseeable approach directions and should not depend solely on the autonomous navigation system's semantic classification. Safety protection should respond to occupancy or intrusion according to its validated detection principle.

Blind spots should be identified systematically during vehicle-level safety analysis. Sensor mounting positions that appear adequate in a CAD model may create hidden regions after bumpers, covers, payloads, manipulators, charging hardware, or accessories are installed. Blind regions can also change according to steering angle or load configuration. Verification should therefore evaluate the complete production configuration rather than considering each protective sensor independently.

Payload dimensions may significantly alter obstacle detection requirements. A pallet, container, manipulator, inspection module, or other payload can extend beyond the AMR base and become the first part of the system capable of contacting a person or object. Protective fields must account for this enlarged envelope. Where payload geometry changes between missions, the safety system may require validated field sets associated with known payload configurations.

Obstacle detection must remain effective during braking and turning, not only during steady straight-line travel. An AMR can continue rotating while decelerating, causing corners or payload edges to sweep into nearby space. The safety design should therefore evaluate the complete stopping trajectory. Protective coverage and stopping-distance validation should reflect the combined longitudinal, lateral, and rotational motion that can occur after a safety stop request has been generated.

Environmental conditions can influence sensor performance and must be included in detection requirements. Dust, water droplets, fog, direct sunlight, reflective materials, dark surfaces, contamination, vibration, temperature variation, and outdoor weather may affect different sensing technologies in different ways. The operating specification should define conditions under which required detection performance is maintained and the response when sensor reliability can no longer be assured.

Sensor contamination is particularly important for AMRs operating continuously in warehouses, factories, outdoor facilities, or mixed environments. Dirt, condensation, packaging material, or accidental obstruction can reduce the effective field of view. Safety-related sensors should provide diagnostic mechanisms where applicable, while the system should define appropriate reactions to detected degradation. Maintenance procedures should also specify inspection and cleaning intervals necessary to preserve validated performance.

Fault detection must prevent a failed protective sensor from being interpreted as a clear travel path. Relevant faults include loss of power, internal sensor failure, disconnected wiring, communication interruption, invalid configuration, blocked optics, and inconsistent safety outputs. The safety controller should supervise safety-related signals and transition the AMR to an appropriate safe condition when the required protective capability becomes unavailable.

Redundant or complementary sensing may be required when a single device cannot provide adequate coverage or integrity. Multiple scanners can protect different sides of the vehicle, while additional sensing technologies may address geometries that are difficult for a particular scanner arrangement. Redundancy should not simply duplicate sensors without analysis. Common mounting locations, shared power supplies, environmental influences, communication paths, and systematic configuration errors can create common-cause failures.

The autonomous perception system and the safety obstacle-detection system should have clearly defined responsibilities. Cameras, 3D LiDAR, radar, and AI perception may provide rich environmental understanding for navigation and trajectory planning, but their presence does not automatically make them safety-rated protective devices. A robust architecture allows advanced perception to optimize motion while independently validated safety functions constrain motion whenever required protective conditions are violated.

Intersections and areas with restricted visibility require special consideration because people or vehicles can enter the AMR path rapidly from directions not visible along the nominal travel corridor. The system may use reduced-speed zones, expanded protective fields, infrastructure interfaces, or other validated measures to maintain adequate separation. Detection design should consider the combined movement of the AMR and approaching objects rather than assuming that obstacles remain stationary.

Docking and load-transfer operations create a different obstacle-detection problem because the AMR intentionally approaches fixed equipment at very small distances. A normal protective field could prevent the vehicle from completing the maneuver. Safety design may therefore use validated reduced-speed modes, alternative protective fields, controlled muting concepts where applicable, or machine interlocks. Such functions must not create an unrestricted path that allows personnel to enter a hazardous area unnoticed.

Field switching must be deterministic and associated with verified operating conditions. Selection may depend on travel direction, speed range, steering state, operating zone, payload configuration, or docking mode. An incorrect field selection can be equivalent to losing the protective function entirely. The safety architecture should therefore supervise field-selection logic and ensure that uncertain, inconsistent, or invalid selection conditions result in a conservative protective state.

Obstacle detection also requires coordination with the braking system. Detecting an obstacle within the correct field provides little protection if braking torque is insufficient or delayed. Validation should measure actual stopping performance with representative payloads, speeds, floor surfaces, tire conditions, gradients, and system delays. Protective-field dimensions should then be established using verified vehicle-level stopping behavior rather than theoretical braking capability alone.

Testing should include objects positioned at field boundaries, different approach angles, representative object geometries, direction changes, maximum validated speeds, turning maneuvers, sensor faults, and relevant environmental conditions. Tests should confirm both detection and the resulting vehicle response. Particular attention should be given to transitions between warning fields, protective fields, reduced-speed operation, and complete stopping because errors frequently occur at boundaries between operating states.

Configuration management is essential because changes to speed limits, scanner mounting, protective-field geometry, braking parameters, wheel dimensions, payload configuration, control software, or sensor firmware can alter the validated detection performance. Safety-related parameters should therefore be controlled and traceable. Unauthorized or accidental configuration changes must not silently reduce protective coverage or permit operation beyond the conditions used during safety validation.

Effective obstacle detection ultimately forms a coordinated chain from environmental intrusion to safe vehicle response. The sensor detects a relevant object, the safety logic evaluates the condition, the control system requests the required reaction, and the braking system brings the AMR into an acceptable safe state before hazardous contact occurs. This chain provides the basis for the subsequent treatment of speed and separation monitoring, safe-speed design, and ISO 3691-4 certification within the safety architecture.

03.03. Speed and Separation Monitoring

Speed and separation monitoring is a safety strategy that controls AMR motion according to the available distance between the vehicle and people, obstacles, or other hazardous objects. Within an ISO 3691-4-oriented architecture, separation distance is directly related to vehicle speed and stopping capability. As separation decreases, the permitted speed must be reduced so that the AMR can always reach an appropriate safe state before hazardous contact occurs.

The fundamental relationship is based on the distance traveled before the vehicle becomes stationary. This includes distance traveled during sensor response, safety logic processing, communication, controller reaction, actuator activation, and mechanical braking. Additional margins are required for measurement uncertainty and operating variation. A protective distance must therefore be established from the complete safety reaction chain rather than from braking distance alone.

Speed monitoring determines whether actual vehicle velocity remains within the limit permitted for the current safety condition. The monitored value should represent physical vehicle motion with sufficient integrity for the required safety function. Commanded velocity alone may be inadequate because wheel slip, controller faults, drivetrain behavior, gradients, or incorrect feedback can cause actual movement to differ from the requested motion.

Separation monitoring determines whether sufficient space remains between the AMR and a detected person or obstacle. Safety scanners or other suitable protective devices can establish monitored zones around the vehicle. When an object crosses defined boundaries, the safety system changes the permitted operating condition. The objective is to preserve enough distance for deceleration and stopping while avoiding unnecessary stops when adequate separation remains available.

A practical implementation commonly uses multiple distance zones. An outer zone can provide early awareness and initiate moderate speed reduction, while an intermediate zone can impose a lower safe speed. Entry into the innermost protective zone can require a safety stop. The exact number and geometry of zones depend on vehicle characteristics and risk assessment, but every transition must preserve sufficient stopping margin for the corresponding speed.

The relationship between speed and separation is dynamic rather than fixed. At higher speed, the AMR requires greater separation because reaction distance and braking distance increase. As speed decreases, the required protective distance can also decrease within validated limits. This relationship allows an AMR to travel efficiently in open areas while automatically adopting more conservative motion when approaching people, intersections, narrow passages, or workstations.

Protective separation must consider the relative motion of both the AMR and the approaching object. A person walking toward the vehicle can reduce available separation more quickly than a stationary obstacle. Similarly, another mobile robot or industrial vehicle may approach from an intersecting trajectory. Safety analysis should therefore consider reasonably foreseeable approach velocities and directions rather than treating every detected object as stationary.

Direction-dependent monitoring is necessary because the relevant protective distance changes with vehicle movement. Forward travel requires monitoring of the forward motion envelope, while reverse travel requires corresponding rear protection. Lateral and omnidirectional AMRs require side protection as well. During turning, the monitored region must account for the swept path of the chassis and any payload extending beyond the base vehicle.

Braking performance establishes an essential physical boundary for separation monitoring. Even a perfectly functioning sensor cannot prevent collision if the available distance is shorter than the distance required to stop. Actual stopping performance should therefore be characterized across representative vehicle masses, payloads, speeds, floor conditions, tire states, gradients, and braking-system tolerances. Conservative values should be used when defining safety-related separation thresholds.

Acceleration also requires supervision because rapid acceleration can invalidate a protective field that was selected for a lower speed. The safety architecture should prevent the AMR from accelerating beyond the speed supported by the currently active protective zone. When a larger protective field becomes available, acceleration may be permitted according to defined transition logic. This maintains consistency between actual kinetic behavior and available detection distance.

Dynamic protective-field switching can coordinate safety scanner geometry with vehicle velocity. Different predefined fields may be selected for low-, medium-, and high-speed operation, with larger fields associated with higher speeds. Field selection should be safety-related where it contributes to risk reduction. Invalid field selection, inconsistent speed information, or loss of the required field should cause a conservative response rather than continued operation.

The monitored speed should include relevant directional and rotational components. For a differential-drive AMR, turning can cause one side of the chassis to move faster than another. Omnidirectional platforms can combine longitudinal, lateral, and rotational movement simultaneously. Safety assessment should therefore consider the velocity of the portions of the vehicle that could contact a person, rather than relying only on the translational speed reported at the vehicle center.

Payload configuration can modify both separation requirements and permissible speed. A large pallet may extend the collision envelope, while a heavy payload may increase braking distance and alter vehicle stability. A tall or offset payload can also influence safe cornering speed. When payload conditions vary significantly, the safety system may require different validated speed limits, protective fields, or operating profiles associated with known load configurations.

Reduced-speed operation is particularly important in areas where full protective separation cannot be maintained. Narrow aisles, docking stations, transfer points, elevators, doors, and machine interfaces may require the AMR to approach fixed structures closely. In such areas, validated reduced-speed modes can decrease stopping distance and permit controlled operation while maintaining the safety measures required for foreseeable human access.

Intersections represent a demanding case because a person or vehicle can enter the AMR path laterally with little warning. The safety concept may require reduced approach speed, expanded protective fields, infrastructure-based information, or combinations of these measures. The selected strategy should ensure that sufficient separation remains available even when the approaching object was initially outside the direct travel corridor or partially obscured.

Human interaction requires conservative assumptions because people can stop, accelerate, reverse direction, or enter the vehicle path unexpectedly. The safety system should not depend on predictions that a person will continue along an expected trajectory. Advanced perception may support navigation decisions, but safety-related separation should remain based on validated protective principles and should transition toward reduced speed or stopping when required separation cannot be assured.

Safety-related speed information must be sufficiently reliable. Encoder signals, motor feedback, safety-rated motion monitoring, or other appropriate sources may be used depending on the architecture. Faults such as implausible speed values, disagreement between redundant channels, missing feedback, incorrect scaling, or communication loss should be detected. If actual speed cannot be confirmed, continued motion at an assumed safe velocity may not provide adequate protection.

Latency must be included explicitly in separation calculations. Sensor acquisition, internal filtering, network transmission, safety-controller execution, drive communication, brake command generation, and actuator response all consume time. Even small delays become significant as vehicle speed increases. The safety distance should therefore use verified worst-case or appropriately conservative timing values for the complete sensing-to-stop path rather than average processing latency.

Environmental conditions can affect both separation measurement and stopping behavior. Dust, water, sunlight, reflective surfaces, temperature, vibration, floor contamination, and gradients may degrade sensor performance or reduce tire-to-floor friction. A separation strategy validated on a clean, dry, level floor cannot automatically be assumed safe in every operating environment. Environmental limits and degraded operating modes should therefore be defined.

Fault responses must preserve the relationship between speed and available protection. Loss of a protective scanner, invalid field selection, brake degradation, speed-monitoring failure, or safety communication error can make the current operating speed unacceptable. The AMR should respond by reducing speed or transitioning to a safe stop according to the remaining verified capability. A fault must not silently leave high-speed motion operating with reduced protective coverage.

Restart behavior is also part of separation monitoring. After a protective stop, the AMR should not automatically accelerate simply because an obstacle leaves the innermost field. The system should verify that required protective zones are clear, relevant safety devices are operational, and the permitted speed corresponds to the available separation. Controlled restart logic prevents rapid transitions from a stopped condition directly into an inadequately protected high-speed state.

Verification should measure the complete relationship among detected distance, actual speed, system reaction time, deceleration, and final stopping position. Tests should cover maximum permitted speeds, representative payloads, direction changes, turning, field transitions, approaching objects, sensor faults, braking variations, and relevant environmental conditions. Boundary cases are especially important because unsafe behavior can occur when speed and protective-field states change nearly simultaneously.

Configuration control must protect safety-related speed limits, field dimensions, switching thresholds, braking parameters, sensor mounting data, wheel dimensions, and controller timing assumptions. Changes to any of these parameters can alter the validated separation distance. Software updates or mechanical modifications should therefore trigger assessment of whether existing safety evidence remains valid before the revised AMR configuration is released for operation.

An effective speed and separation monitoring architecture forms a closed safety relationship between perception, distance, motion, and braking. Protective sensing determines available separation, safety logic establishes the permitted motion state, speed monitoring verifies actual behavior, and the braking system provides the final physical risk reduction. Maintaining this relationship continuously allows the AMR to remain productive while ensuring that decreasing separation leads predictably from normal travel to reduced speed and, when necessary, a safe stop.

03.04. Safe Speed Design

Safe speed design for an autonomous mobile robot defines the maximum motion that can be permitted while maintaining an acceptable level of risk under specific operating conditions. Within an ISO 3691-4-oriented architecture, safe speed is not a single fixed vehicle parameter. It is a system-level limit determined by stopping capability, protective sensing, separation distance, payload, direction of travel, environmental conditions, and foreseeable interaction with people.

The central design principle is that the AMR must never travel faster than its protective system can safely supervise. At any permitted speed, obstacle detection, safety processing, actuator response, and braking must collectively provide enough time and distance to prevent hazardous contact. A speed value is therefore considered safe only when the complete sensing-to-stop chain has been validated for the corresponding operating condition.

Safe speed begins with characterization of actual vehicle dynamics. Maximum velocity, acceleration, deceleration, braking response, steering behavior, rotational velocity, vehicle mass, and drivetrain characteristics must be understood. The analysis should use physical vehicle behavior rather than commanded values alone. Variations caused by payload, tire condition, floor friction, gradient, component tolerance, and brake degradation must be included when establishing conservative speed limits.

Stopping distance provides one of the most important constraints on safe speed. Total stopping distance includes the distance traveled during sensing, processing, communication, control response, brake activation, and mechanical deceleration. Because these contributions increase the required protective distance, speed limits should be calculated using validated worst-case or appropriately conservative response values rather than nominal laboratory measurements.

Protective-field geometry and safe speed must be designed together. A larger detection field can support higher vehicle speed because hazards can be detected earlier, while a smaller field generally requires reduced speed. This relationship allows predefined combinations of speed limits and protective fields. Each combination should demonstrate that the AMR can transition to the required safe state before a person or obstacle can be reached.

Multiple operating speed levels can provide a practical balance between safety and productivity. Normal speed may be permitted in open areas with sufficient protective coverage, while reduced speed can be applied near people, intersections, workstations, doors, or restricted passages. A very low controlled speed may be required for docking or load transfer. A protective-zone intrusion can ultimately require complete stopping when continued motion cannot be safely permitted.

Transitions between speed levels are safety-relevant because acceleration can rapidly invalidate the protection available for a lower-speed state. The AMR should not increase speed until the protective field and other conditions required for the higher speed have been confirmed. Conversely, when available protection decreases, speed reduction must occur early enough to satisfy the new limit before the smaller separation distance becomes hazardous.

Actual speed should be monitored independently of the high-level motion command where required by the safety architecture. Wheel encoders, motor feedback, safety-rated motion monitoring, or other appropriate signals can provide information about physical movement. The safety function should detect excessive speed, implausible measurements, missing feedback, or disagreement between monitored channels and initiate a defined response when the permitted limit cannot be guaranteed.

Safe speed must consider direction as well as magnitude. Forward and reverse travel may have different sensing coverage or braking characteristics, producing different permissible limits. Omnidirectional AMRs additionally require consideration of lateral movement. During turning, rotational motion can cause corners of the chassis or payload to move faster than the vehicle reference point, so safe-speed assessment should consider the motion of the complete collision envelope.

Curved trajectories introduce additional constraints because centrifugal effects, tire friction, steering dynamics, and payload position influence stability. A speed that is acceptable during straight travel may be excessive during a tight turn. Safe speed design should therefore coordinate translational velocity with curvature or rotational rate where necessary, particularly for vehicles carrying tall, heavy, offset, or otherwise stability-sensitive payloads.

Payload mass directly affects kinetic energy and may increase the distance required for controlled stopping. Payload geometry can also enlarge the vehicle footprint, modify sensor visibility, or shift the center of gravity. Safe-speed limits should therefore be validated for defined payload ranges rather than assuming that unloaded vehicle performance represents every operating condition. Different payload classes may require different safety-related operating profiles.

Floor conditions are another important factor because braking capability depends on available tire-to-surface friction. Dry industrial flooring, wet surfaces, dust, oil contamination, ramps, uneven terrain, and outdoor surfaces can produce significantly different stopping behavior. If the AMR operates across multiple surface conditions, safe speed should reflect the lowest validated braking capability or the system should apply appropriately validated condition-dependent limits.

Gradient affects both stopping and stability. A descending AMR may require more distance to stop, while an ascending vehicle can experience different traction and drive loading. Cross-slopes can influence lateral stability, especially with elevated payloads. Safe-speed validation should therefore include the permitted gradient range and should restrict speed or operation when slope conditions exceed those represented by the established safety evidence.

Human interaction often requires lower speeds because people can move unpredictably and may enter the vehicle path with limited warning. Areas with frequent pedestrian traffic should use speed limits consistent with available detection and separation. Advanced perception can improve prediction and navigation, but safe-speed enforcement should not depend solely on assumptions about human intent. Loss of sufficient separation should cause predictable deceleration or stopping.

Intersections, blind corners, doorways, and narrow passages require special speed consideration because detection range may be restricted. An AMR approaching an occluded intersection at high speed may have insufficient distance to respond to a person entering laterally. Reduced approach speed, expanded sensing, infrastructure support, or combinations of these measures can be used to preserve an adequate safety margin in limited-visibility environments.

Docking operations typically require intentional approach toward fixed equipment and therefore benefit from a dedicated low-speed mode. The docking speed should be low enough to limit stopping distance and collision energy while supporting accurate positioning. Entry into docking mode should depend on validated conditions such as location, field selection, interface state, and docking authorization rather than being activated merely by a non-safety mission command.

Safety-related speed limits should remain independent of productivity demands. Fleet-management software, route optimization, AI planners, or mission controllers may request faster travel to improve throughput, but these systems should not override validated safety constraints. A layered architecture allows autonomy to select motion within an authorized envelope while a separate safety function limits or rejects commands that would exceed the permitted safe-speed state.

Communication delays must be considered when speed control depends on distributed controllers. Sensor data, safety messages, drive commands, and feedback may travel through networks before a reaction occurs. The worst relevant latency contributes to reaction distance and therefore affects the maximum safe speed. Loss, excessive delay, or corruption of safety-related communication should result in a defined conservative response rather than continued unrestricted motion.

Safe-speed supervision must also address faults in the braking and propulsion systems. Brake degradation, drive-controller failure, unintended torque, encoder faults, or incorrect velocity scaling can invalidate previously established limits. Diagnostics should detect relevant failures where required, and the AMR should reduce speed or stop when the remaining verified capability is insufficient to support the current operating state.

Environmental degradation can require automatic reduction of permitted speed. Dust, rain, fog, strong sunlight, contamination, vibration, temperature, or other conditions may reduce sensor performance or braking consistency. Where such degradation can be detected or operationally identified, a degraded mode may apply lower speed limits and larger safety margins. If required protective performance cannot be assured, continued autonomous motion should not be permitted.

Restart and recovery behavior must prevent immediate return to high speed after a protective stop or fault. Before acceleration, the system should confirm that protective sensing is available, required fields are clear, safety-related speed feedback is valid, braking capability is available, and the current operating mode authorizes movement. Speed should then increase through controlled transitions rather than bypassing intermediate protective conditions.

Verification of safe speed requires vehicle-level testing rather than software inspection alone. Tests should measure actual speed, reaction time, deceleration, stopping distance, field transitions, turning behavior, and final stopping position. Representative payloads, floor surfaces, gradients, travel directions, sensor conditions, and fault scenarios should be included. Boundary conditions near speed-transition thresholds require particular attention.

Safety margins should account for manufacturing variation, component aging, measurement error, timing uncertainty, and foreseeable deterioration over the service life. A speed limit that is safe only when every component performs at its nominal value is not sufficiently robust. Conservative assumptions and periodic maintenance verification help ensure that validated stopping and sensing performance remain available as the AMR accumulates operating time.

Configuration management is essential because changes to wheel diameter, gearing, motor control, braking parameters, sensor fields, payload limits, software timing, or maximum speed can alter the safety relationship. Safety-related parameters should be controlled, documented, and traceable. Modifications should trigger an assessment of affected safety evidence and, where necessary, renewed verification before the changed configuration enters operation.

Safe speed design ultimately establishes a continuously enforced relationship among vehicle motion, protective sensing, separation, braking, stability, environment, and operating context. The objective is not simply to make an AMR move slowly, but to permit the highest motion level that remains demonstrably safe under validated conditions. This provides the final technical foundation for integrating obstacle detection, speed and separation monitoring, safe motion control, and the subsequent ISO 3691-4 certification process.

03.05. ISO 3691-4 Certification

ISO 3691-4 certification provides a structured means of demonstrating that a driverless industrial truck or autonomous mobile robot satisfies applicable safety requirements for its intended operation. Certification is not achieved by testing a safety scanner or emergency-stop circuit alone. It requires evidence that the complete AMR, its safety functions, control architecture, braking behavior, operating modes, interfaces, and documentation form a coherent and validated safety system.

The certification process should begin by defining the product and its intended use. Vehicle type, maximum speed, payload range, operating environment, permitted gradients, travel directions, docking functions, human interaction, and interfaces with external equipment establish the boundaries of assessment. These assumptions become part of the safety basis, because certification evidence is valid only for the configuration and operating conditions that were actually evaluated.

Risk assessment establishes the connection between foreseeable hazards and the safety measures implemented by the AMR. Hazards associated with collision, crushing, trapping, unexpected motion, excessive speed, unstable loads, braking failure, and human access must be considered. The assessment should show how identified risks are reduced through protective sensing, speed limitation, stopping functions, mechanical design, operating restrictions, diagnostics, and other safety measures.

Safety requirements derived from the risk assessment should be documented and traceable to their implementation. Each relevant requirement should identify the condition being controlled, the required safety response, and the hardware or software responsible for achieving it. Traceability allows an assessor to follow the path from a hazardous situation to the corresponding safety function and then to the verification evidence demonstrating that the function performs as intended.

The safety architecture must clearly distinguish safety-related functions from ordinary autonomy and mission functions. Navigation, localization, route planning, fleet management, artificial intelligence, and application software may determine where and how the AMR should move, but failure of these functions must not remove essential protection against hazardous motion. Certification therefore evaluates whether independent safety mechanisms can constrain or stop motion when non-safety control behaves incorrectly.

Protective sensing represents a major part of ISO 3691-4-oriented assessment. Safety laser scanners, safety LiDAR, bumpers, or other protective devices must provide the coverage required by the vehicle motion envelope. Their mounting position, protective-field geometry, response time, diagnostic behavior, and interaction with vehicle speed should be documented. Blind areas and limitations must be identified and addressed through design measures or operating restrictions.

Obstacle-detection verification should demonstrate that relevant objects can be detected before hazardous contact occurs. Testing should include representative approach directions, field boundaries, turning trajectories, reverse travel, payload overhang, and foreseeable obstacle geometries. The assessment should consider the complete vehicle rather than an isolated sensor because chassis shape, accessories, payloads, and installation tolerances can alter effective protective coverage.

Speed and separation monitoring must be supported by evidence showing that permitted vehicle speed remains compatible with available protective distance. Where multiple protective fields or speed levels are used, the relationship among field selection, actual speed, separation distance, and safety response must be verified. Incorrect field selection, excessive speed, or loss of valid speed information should result in a defined conservative response rather than uncontrolled continued motion.

Safe-speed verification requires measurement of actual vehicle behavior. Commanded velocity alone does not demonstrate safe motion because drivetrain response, wheel slip, gradients, payload, and control faults can produce different physical movement. Tests should confirm maximum permitted speed, reduced-speed modes, acceleration transitions, turning behavior, and any low-speed operating modes used for docking, maintenance, recovery, or other special operations.

Stopping performance is fundamental to certification because protective distances depend on the AMR\'s ability to reach a safe state before contact. Total stopping behavior includes sensor response, processing delay, communication latency, controller reaction, brake activation, and mechanical deceleration. Tests should use representative or conservative combinations of vehicle mass, payload, speed, floor condition, tire state, gradient, and other factors that influence stopping distance.

Emergency-stop functions must be evaluated as part of the integrated vehicle safety system. Emergency-stop devices should be accessible and identifiable, and activation must produce the defined safe response. The assessment should confirm that resetting an emergency stop does not itself restart hazardous motion. Restart should require appropriate conditions to be satisfied so that personnel are not exposed to unexpected movement following an intervention.

Restart prevention should also be verified after protective stops, power interruptions, communication failures, controller resets, and recovery from detected faults. Restoration of a signal or safety device should not automatically authorize motion. Certification evidence should demonstrate that the control system distinguishes between restoration of system availability and permission to move, with predictable transition logic between stopped, reduced-speed, and normal operating states.

Operating modes require explicit assessment because automatic, manual, maintenance, setup, docking, and recovery modes may expose people to different hazards. Mode selection should be controlled, and reduced protective measures should be accompanied by appropriate restrictions such as limited speed or restricted functionality. Tests should verify that unintended mode transitions cannot bypass safety functions or enable hazardous motion without the required authorization.

Load handling and vehicle stability should be included where they affect the AMR safety concept. Payload mass, dimensions, retention, center of gravity, and overhang can influence braking distance, turning stability, sensor coverage, and collision geometry. Certification should therefore reflect the validated payload envelope. Operating limits should prevent combinations of load, speed, direction, and gradient that exceed demonstrated stability or stopping capability.

Interfaces with conveyors, doors, elevators, manipulators, charging stations, and other machinery require verification of their safety-related behavior. Handshake signals and interlocks should place the combined system into predictable states before movement or load transfer is permitted. Loss, contradiction, or delay of interface information should not create uncontrolled motion. Responsibility boundaries between the AMR and external equipment should be documented.

Communication used in safety-related functions must be assessed according to its safety role. Message loss, corruption, excessive delay, repetition, sequence errors, or loss of connection can affect the validity of safety decisions. The design should demonstrate that communication failures lead to appropriate responses. Ordinary wireless or Ethernet connectivity should not be assumed to provide safety integrity unless the safety architecture explicitly provides the necessary protective mechanisms.

Diagnostic functions provide evidence that faults capable of compromising safety are detected and managed. Relevant cases can include protective-sensor failure, wiring faults, invalid speed feedback, brake degradation, communication errors, incorrect configuration, or controller malfunction. Fault-injection and diagnostic testing can demonstrate that detected failures cause the specified reduced-speed condition, controlled stop, or other defined safe reaction.

Environmental validation should represent the conditions in which the certified AMR is intended to operate. Temperature, vibration, dust, water, illumination, reflective surfaces, floor contamination, gradients, and other relevant factors may influence sensing, braking, electronics, or mechanical behavior. Where operation outside validated conditions could reduce safety performance, environmental limitations should be clearly specified in technical and operating documentation.

Electrical and control-system evidence should demonstrate that safety-related components are correctly integrated and that power or signal faults do not create uncontrolled hazardous motion. Wiring, power distribution, protective devices, safety outputs, drive interfaces, and braking circuits should be examined according to their safety relevance. Design documentation should correspond to the actual production configuration used for verification and certification testing.

Software associated with safety-related behavior requires controlled development and configuration. Safety parameters such as speed limits, protective fields, braking thresholds, timing values, mode logic, and diagnostic responses should be identifiable and protected against unintended modification. Software versions used during testing must be recorded so that certification results remain traceable to the released vehicle configuration rather than to an undefined development state.

Verification planning should connect each safety requirement with an appropriate analysis, inspection, or test method. Component-level tests demonstrate individual behavior, while vehicle-level tests confirm that timing, sensing, control, and mechanics interact correctly. Certification evidence becomes stronger when requirements, test procedures, acceptance criteria, measured results, anomalies, and corrective actions are maintained as a consistent traceable set.

Validation should reproduce representative operational scenarios rather than relying entirely on controlled component tests. The AMR should be evaluated during normal travel, turning, reversing, obstacle encounters, pedestrian interaction, docking, load transfer, mode changes, protective stops, and fault conditions. Boundary and worst-case scenarios are particularly important because safety weaknesses often appear during transitions or combinations of conditions rather than during steady operation.

Technical documentation is a central certification deliverable. It should describe the AMR configuration, intended use, safety architecture, risk assessment, safety functions, protective devices, operating limits, test methods, verification results, maintenance requirements, residual risks, and user instructions. Drawings, software versions, safety parameters, and configuration records should allow the assessed system to be identified and reproduced.

Configuration management must continue after certification because modifications can invalidate previously established safety evidence. Changes to sensors, mounting positions, protective fields, maximum speed, braking parameters, wheel dimensions, payload limits, control software, firmware, or external interfaces should be assessed for safety impact. Significant changes may require additional verification or renewed certification activities before the modified AMR is released.

Certification should therefore be understood as evidence-based confirmation of an integrated safety architecture rather than a one-time product test. Risk assessment defines what must be protected, safety requirements define the necessary behavior, engineering implements the protective functions, and verification demonstrates their performance. Controlled documentation and configuration then preserve the validity of that evidence throughout production and operation.

For an AMR, successful ISO 3691-4 certification ultimately depends on maintaining a traceable chain from hazard identification to validated safe behavior. Obstacle detection establishes protective awareness, speed and separation monitoring controls available motion, safe-speed design constrains kinetic risk, and stopping functions bring the vehicle to a safe state when protection is required. Together, these elements complete the ISO 3691-4 chapter structure and provide the technical basis for demonstrating safe AMR operation.

---

Author: Richard Minsoo Go

LinkedIn: Richard Minsoo Go