Robot Safety Standards / RFP Guide

5-2. "ISO 3691-4" Conformity and Safety Measures

1. Performance Requirements for AGV/AMR Safety Devices and ISO 3691-4 Standards

The global de facto standard in the safety design of AGVs (Automated Guided Vehicles) and AMRs (Autonomous Mobile Robots) is ISO 3691-4:2020 (Safety requirements for driverless industrial trucks and their systems). Unlike conventional guidelines, it strictly regulates not only the performance of standalone sensors but also "how safety functions are guaranteed as an entire system (functional safety)."

1.1 Functional Safety Requirements in ISO 3691-4 (PL / SIL)

ISO 3691-4 requires the "Safety-related Control System (SCS)" of mobile robots to secure a Performance Level (PL) based on ISO 13849-1.

• Speed/Steering Control and Safe Stop Functions: In principle, reliability of PL d or higher (Category 3 or higher) is mandatory.
• Obligation for Duplication (Redundancy): When a safety sensor (such as LiDAR) detects a person, the circuits leading to signal transmission and brake control must be duplicated, requiring a structure where safety functions are not lost due to a single failure.

1.2 Major Safety Devices and Performance Requirements

A multi-layered protection system combining the following safety devices is constructed according to the robot's speed, inertial weight, and traveling area.

Safety Device	Main Role and Installation Criteria	Performance Requirements Demanded by ISO 3691-4 / Standards
2D Safety Laser Scanner (LiDAR)	Detection of main obstacles and personnel (Primary safety sensor)	・Conformity to safety standards (IEC 61496 Type 3 / PL d) is mandatory. ・Must be able to variably control "warning zones" and "emergency stop zones" in real-time according to speed. ・Must be able to detect without omission obstacles from the floor surface up to a specified height (generally 150mm to 200mm or less).
Safety Bumper (Contact Detection)	Covering LiDAR's blind spots / Emergency stop upon physical contact	・A mechanical switch must reliably activate upon contact and immediately stop the vehicle (equivalent to PL d). ・Must possess a "push-in allowance (cushioning)" greater than the braking distance until the vehicle completely stops.
3D Camera / 3D Detection Sensor	Detection of 3D obstacles upward and diagonally (e.g., forklift forks)	・Spatial detection of "cargo floating above the floor" or "a person's head/upper body" that cannot be detected by 2D-LiDAR. ・Must have strong resistance against malfunctions caused by ambient light (sunlight or diffused reflections of lighting).
Emergency Stop Button (E-STOP)	Manual emergency full stop	・Red button + yellow background structure conforming to ISO 13850. ・Placed in positions easily accessible from all directions of the vehicle (front/rear, left/right, etc.), and must instantly cut off power (Category 0 or 1 stop) when operated.

1.3 Design Rules for "Detection Zones (Protective Fields)" Demanded by ISO 3691-4

ISO 3691-4 stipulates that simply attaching a sensor is not enough; it mandates an agreement between "the distance required for the robot to stop" and "the detection area of the sensor."

• Speed-linked Zone Switching: A function that automatically switches the shape and length of the scanning area according to the robot's motion vector during straight travel, turning, and acceleration/deceleration is mandatory.
• Protection of Blind Spot Areas: If the detection zone in the direction of travel is not covered even during turning or reversing, the travel speed must be drastically reduced, or physical protection using a safety bumper is required.

1.4 "Operating Modes" and Restrictions for Coexisting with People

• Low-speed Travel Restriction (Speed Relaxation Requirement): In areas shared and approached closely by workers (coexistence zones), operations are stipulated to lower collision risks to an acceptable level by restricting the vehicle's maximum speed to 0.3m/s (approx. 1.08km/h) or less, etc., instead of narrowing the detection range of safety sensors.
• Prohibition of Automatic Restart: After an emergency stop by a safety sensor or E-STOP, even if the obstacle is removed, the robot must not automatically suddenly start; it is required to go through a reset signal or a slow-speed restart procedure after safety confirmation.

2. ISO 3691-4 Conformity Confirmation and Certification Checkpoints

When procuring and introducing an AGV/AMR made overseas or domestically, even if the catalog states "ISO 3691-4 compliant," the most important thing is to ascertain the "presence of third-party certification" and "whether it is compliant not just for the robot alone but including on-site operation."

2.1 Document Check for Proof of Conformity (Document Review)

Confirm whether it is merely a manufacturer's self-declaration (voluntary inspection) or certified by a reliable third-party certification body.

• Presence of a certificate issued by a third-party certification body (TÜV, SGS, UL, etc.):
  • For overseas-made equipment, check if "ISO 3691-4:2020" is clearly stated as the technical basis in the "Declaration of Conformity (DoC)" for CE marking.
  • Confirm whether a "Certificate of Conformity" issued by a certification body can be presented.
• Verification report for functional safety (PL d / SIL 2):
  • Is a "Functional Safety Calculation Sheet" or evaluation report based on ISO 13849-1 prepared, demonstrating that the safety control circuits are duplicated (equivalent to PL d)?
• Risk Assessment (RA) Report:
  • Is a "Risk Evaluation Report" in which the manufacturer has extracted and mitigated the hazard sources of the standalone equipment included in the delivery documents?

2.2 Hardware and Safety Function Check (Actual Machine Evaluation)

Confirm with the actual machine whether the equipment meets the safety technical requirements of ISO 3691-4 at the hardware level.

Check Item	Confirmation Content Based on ISO 3691-4
Selection of Safety Scanner (LiDAR)	Is the 2D-LiDAR used "for safety (IEC 61496 Type 3 / PL d compliant product)"? (*General industrial measurement LiDAR is not permitted).
Emergency Stop Switch (E-STOP)	Does it have a red button on a yellow background structure, and when the button is pressed, is the main power (motor power) physically cut off (Category 0/1 stop) without going through software?
Detection of Load Collapse and Height Direction	Can cargo floating above the floor and upper protrusions be correctly detected by 3D cameras or ultrasonic sensors (blind spot countermeasure for 2D-LiDAR)?
Braking at Maximum Load and Maximum Speed	While traveling at maximum speed fully loaded with cargo, is the distance from when LiDAR detects a person until stopping contained "within the length of the detection zone"?
Manual Reset Mechanism	When an obstacle is removed after an emergency stop or person detection, does it have a structure where it will not automatically restart, but will only restart after intervening with a manual reset operation following safety confirmation?

2.3 System Integration (SI) and "On-site Conformity" Check

ISO 3691-4 is a standard that includes not only the "standalone robot" but also the "entire system (installation environment)." Even if the equipment is compliant, if the on-site map settings or layout are inappropriate, it constitutes a compliance violation (increased accident risk).

• Validity of Zone Classification:
  • Are the boundaries of dedicated areas (inside fences), coexistence areas, and work areas correctly defined in the system?
• Clearance (Gaps) and Entrapment Risk:
  • Is a safety clearance (escape area) of at least 0.5m secured between the robot driving path and walls, pillars, and racks? In narrow parts where this cannot be secured, is the robot set to decelerate and travel slowly?
• System Interlock:
  • When linked with automatic doors, shutters, vertical material conveyors (VMC), etc., is there a sequence that fails to the safe side (stops) in the event of a communication error?

2.4 Final Checklist for the Introduction Process

These are confirmation items that should be presented to and requested from the System Integrator (SIer) or vendor when considering introduction.

1. "Will you create and submit a risk assessment for the entire system (Residual Risk Report) that includes the environment of this introduction?"
2. "Will you provide safe operation manuals and conduct educational training for the workers?"
3. "Are the procedures for re-verification (validation) of safety zones defined for when map changes or layout changes are made?"

3. Description Examples and Vendor Checklist for RFPs and Order Specifications

In Request for Proposals (RFP) and order specifications presented to vendors when introducing AGV/AMRs, here are description examples and a checklist to clearly specify the required performance and deliverables without leaving "ISO 3691-4 conformity" and "on-site safety requirements" ambiguous.

3.1 Example Description of "Safety Requirements" in RFP / Order Specifications

[Clause Name: Safety Conformity and Functional Requirements for Automated Guided Robot (AGV/AMR) Systems]

1. Conformity to Basic Safety Standards:
   • This system (vehicle main body, system control, ground equipment) must conform to ISO 3691-4:2020 (Safety requirements for driverless industrial trucks and their systems).
   • The main safety control circuits (speed detection, steering, emergency stop circuits) of the vehicle main body must meet functional safety standards of ISO 13849-1 Performance Level d (PL d / Category 3) or higher.
   • Upon delivery, a certificate of conformity from a third-party certification body (TÜV, SGS, UL, etc.), or a Declaration of Conformity (DoC) from your company and technical basis documents must be submitted.
2. Requirements for Safety Devices and Protective Functions:
   • Primary Safety Sensor: Must be equipped with a "2D-LiDAR for safety" conforming to IEC 61496 Type 3 / PL d as standard, and possess a control mechanism capable of automatically switching protective areas (protective zones) linked to travel speed and turning angles.
   • 3D Blind Spot Protection: To detect areas outside the horizontal detection plane of the 2D-LiDAR (pallet forks floating above the floor, upper overhangs, etc.), complementary detection devices such as 3D cameras or ultrasonic sensors must be provided.
   • Emergency Stop Function: Emergency stop buttons (E-STOP) conforming to ISO 13850 must be placed in multiple locations on the vehicle (positions visible and operable from all directions), and when pressed, must mechanically and directly cut off the motor drive power (Category 0/1 stop).
   • Manual Reset: After person detection and the release of an emergency stop, automatic starting of the vehicle must be prohibited, and the sequence must be such that it restarts after safety confirmation through a manual reset by a worker (or release of a prescribed interlock).
3. On-site System Integration (SI) and Construction Safety:
   • Depending on the environmental conditions of the introduction area (driving paths, unloading stations), zone classifications (dedicated areas / coexistence areas / work areas) based on ISO 3691-4 must be correctly set and reflected in the map data.
   • In narrow locations where a safety clearance distance (escape width) of at least 0.5m cannot be secured between walls, pillars, and existing equipment, control must be implemented to automatically restrict the speed to a safe speed (0.3m/s or less).

3.2 Vendor Selection / RFP Checklist

These are check items to confirm when selecting a vendor and receiving specifications.

Confirmation Category	Check Item	Required Content / Confirmation of Submission
Documents / Certificates	Confirmation of Third-Party Certification	Can a CE Mark/DoC or a copy of an ISO 3691-4 conformity certificate issued by a third-party certification body (such as TÜV) be submitted?
	Basis for Functional Safety Calculation	Are functional safety calculation results for PL d based on ISO 13849-1 (SISTEMA report, etc.) shown?
	Risk Evaluation Report	Is a "Risk Assessment (RA) Report" covering the vehicle main body and the on-site environment included in the deliverables?
Hardware	LiDAR Standard Selection	Is the equipped LiDAR not for general-purpose measurement but a "Safety standard compliant product (Type 3 / PL d)"?
	Braking Distance and Deceleration	Is the "emergency stop distance" from full load/maximum speed completed "within the LiDAR detection area"?
	Contact Protection (Bumper)	Is the structure designed to physically make an emergency stop upon contact with a bumper or in a LiDAR blind spot?
System / Operation	Zone Setting / Clearance	Is an "automatic deceleration/slow-speed program" implemented for areas with an escape width of less than 0.5m?
	Linkage / Interlock	Is the design such that it falls to the "safe side (stops)" when communication with automatic doors, fire shutters, VMCs, etc., is interrupted?
	Operational Support / Training	Will a "Safe Operation Educational Program" after installation and "Re-verification Procedure Manual for Layout Changes" be provided?