Autonomous mobile robots: known safety nonconformance versus a quarterly release
Your company operates 140 autonomous mobile robots in a fulfilment centre shared with warehouse staff. The internal safety specification, referenced in the customer contract, states that a robot shall stop within 0.3 m of any obstruction taller than 50 mm. A field engineer reviewing 400 randomly sampled navigation logs finds 9 events where the perception stack classified a fallen cardboard box as 'floor clutter' and the robot traversed the location at 1.2 m/s without stopping. The sample was drawn from 60 days of logs across the fleet. The fix touches the perception model and requires re-validating a 4,000-image labelled test set plus 200 hours of on-site trials. Product management proposes the next quarterly release, eleven weeks out, noting that no injuries have occurred and that aisles are restricted to trained staff. You are the engineer asked to approve the deferral.
1. How would you assess the risk and what interim controls would you require while the fix is developed?
Read the worked answer
The requirement is explicit: stop within 0.3 m of any obstruction taller than 50 mm. A traverse at 1.2 m/s past such an object is a nonconformance, not a nuisance, and the first step is to size it properly rather than argue from the sample.
Nine events in 400 sampled logs is a rate, not a fleet figure. Determine how the 400 were selected, then extrapolate against total robot-hours and, critically, against exposure: how often does a >50 mm object appear in an aisle when a person is present? Severity at 1.2 m/s with a loaded AMR against a person is potentially serious; probability is small but not negligible. 'No injuries yet' is absence of evidence, not evidence of low risk, and trained staff still walk those aisles.
Interim controls, before any code changes: reduce aisle speed to a level where a certified stopping path (safety-rated scanner plus mechanical bumper, assessed independently of the perception stack) still satisfies the clearance requirement; physically exclude the affected zones where clutter recurs; and disable autonomous traversal where the perception stack is the only safeguard. Give each control an owner, a review date, and a criterion for removal. Document the controls alongside the hazard, because they are now part of the safety case.
2. What do you document and who needs to be told, given that the contract references the internal safety specification?
Read the worked answer
A known nonconformance against a contractually referenced safety specification is a contractual matter and likely a regulatory one. Silence is not an option available to you.
Produce a written problem report containing: the requirement identifier quoted exactly; the observed behaviour with the log identifiers and a couple of representative excerpts; the classification counts (detected versus missed) and the sampling method so a reader can judge the extrapolation; the interim controls with owners and dates; the corrective action plan including the re-validation scope; and the risk assessment with the residual risk of waiting eleven weeks stated plainly.
Notify your own quality and safety functions so the item enters the hazard analysis and the risk file, and notify the customer's operations and safety contact. The customer's staff are the people exposed, and they need enough information to change their procedures even if the fix is weeks away; telling them only that a fix is coming leaves the hazard unmanaged. Preserve the raw logs and the analysis, since they are the evidence base for whatever happens next. Approval, deferral, and acceptance of residual risk should each be a named signature, not a meeting consensus.
3. If management proceeds with the eleven-week deferral over your objection, what are your professional obligations?
Read the worked answer
The obligation is to hold the public safety interest above schedule and commercial convenience, and to be truthful about what you know. Concretely, that means several things.
First, state your recommendation in writing with the technical basis, and make clear which interim controls you consider necessary for the deferral to be tolerable. A deferral with speed limits and zone exclusions is a different risk than a deferral with nothing.
Second, escalate in writing up the management chain, keeping copies outside company systems you may lose access to. Escalation is not insubordination; it is the mechanism the organisation is supposed to have.
Third, do not sign or endorse anything you believe to be false, such as a declaration that the system conforms to the internal specification, or a release approval that says the hazard is closed. Decline in writing and give the reason.
Fourth, if the exposure to people remains serious and unaddressed after escalation, report to the appropriate external authority or notified body. That is a serious step and you document the reasoning, but the duty to protect the public does not stop at the org chart. Resigning is not required; leaving a documented dissent is what protects both the public and you.