Operational safeguards vs safety-rated functions

1. Engineering problem

Robots near people need protection that works when the main software fails. Operational safeguards (speed limits, collision monitors, geofences) lower the chance of harm. A safety-rated function is one designed, implemented and validated to a safety standard with a defined integrity level, using certified components. Mixing them up is the most serious mistake in this area.

2. When is this needed?

• Deciding what to build and what to buy certified.
• Before operating near people.
• Reviewing a risk assessment.

3. Selection and design decisions

The Nav2 Collision Monitor README (jazzy, read 2026-11-06) states the distinction plainly: the node provides “an additional level of robot safety”, bypassing the costmap and trajectory planners to prevent collisions at the emergency-stop level, analogous to a safety scanner feeding a certified controller, but “this node is done at the CPU level with any form of sensor. As such, this does not provide hard real-time safety certifications”. Its models are stop (stop if more than N points are inside a zone), slowdown (limit speed by a percentage) and approach (keep at least M seconds to collision); zones are polygons, circles or velocity-dependent polygons, and when several trigger the most aggressive wins. Safety standards (for example ISO 13849-1, IEC 61508, ISO 10218 for industrial robots, ISO 3691-4 for driverless industrial trucks) define what a safety function is and how it is validated. The standards themselves (paywalled) were not read for this page, and it makes no claim about what any of them requires. What was read, in the Wikipedia overviews of 2026-11-06 (secondary sources): ISO 13849 applies to the safety-related parts of machinery control systems, with Part 1 on design and Part 2 on validation, and is meant for high or continuous demand rates; IEC 61508 is a basic functional-safety standard for all industries built on a safety life cycle and a probabilistic treatment of failures, with four safety integrity levels (SIL 4 the most dependable); ISO 10218 covers industrial robots (Part 1) and robot applications and cells (Part 2), with new editions published in February 2025, and ISO/TS 15066 (2016) addresses collaborative robots. A personnel-safety function must be designed and certified against the standards that apply to your product and market.

4. Advantages and disadvantages

• Operational safeguards are cheap and flexible and must not be sold or described as personnel protection.
• Certified components cost more, limit flexibility and give a defensible safety case.
• Both are used together: the safeguard avoids most events, the safety function covers the rest.

5. Requirements and constraints

• Whether people can be near the robot is decided by a risk assessment, not by the software team.
• Any function that protects people uses certified hardware designed for that purpose.
• The reaction time and stopping distance (below) fit inside the protective zone at maximum speed.

6. Architecture

risk assessment ─▶ required protection ─▶ certified safety function (scanner + safety controller + safe stop)
                                  └▶ operational safeguards (collision monitor, speed limits) on top

7. Implementation

1. Do a risk assessment with qualified safety engineers.
2. List which hazards need safety-rated functions and which need operational measures.
3. Compute stopping distance and zone sizes (below).
4. Implement and validate each at its own level.
5. Document the difference in user and maintenance manuals.

def stopping_distance(v, t_react, decel, margin=0.0):
    return v * t_react + v * v / (2 * decel) + margin       # reaction travel + braking distance (+ margin)
zone = 1.0                                                   # metres: protective zone in front of the robot
for v in (0.5, 1.0, 1.5, 2.0):
    s = stopping_distance(v, 0.25, 1.5, 0.1)
    print(f"speed {v:.1f} m/s: reaction 0.25 s, deceleration 1.5 m/s^2 -> stops in {s:.2f} m", "inside the 1.0 m zone" if s <= zone else "EXCEEDS the 1.0 m zone")
t_ttc = 1.5
print(f"an approach-type limiter keeping {t_ttc} s to collision at 1.0 m/s keeps at least {1.0 * t_ttc:.1f} m clear")

Printed (checked by the site’s tests):

speed 0.5 m/s: reaction 0.25 s, deceleration 1.5 m/s^2 -> stops in 0.31 m inside the 1.0 m zone
speed 1.0 m/s: reaction 0.25 s, deceleration 1.5 m/s^2 -> stops in 0.68 m inside the 1.0 m zone
speed 1.5 m/s: reaction 0.25 s, deceleration 1.5 m/s^2 -> stops in 1.23 m EXCEEDS the 1.0 m zone
speed 2.0 m/s: reaction 0.25 s, deceleration 1.5 m/s^2 -> stops in 1.93 m EXCEEDS the 1.0 m zone
an approach-type limiter keeping 1.5 s to collision at 1.0 m/s keeps at least 1.5 m clear

Reading it: with 0.25 s of reaction time, 1.5 m/s² of deceleration and a 0.1 m margin, the stopping distance is 0.31 m at 0.5 m/s, 0.68 m at 1.0 m/s, 1.23 m at 1.5 m/s and 1.93 m at 2.0 m/s, so a 1.0 m zone is enough up to somewhere above 1.0 m/s and not at 1.5 m/s. An approach-type limiter keeping 1.5 s to collision at 1.0 m/s keeps 1.5 m clear. These are illustrative numbers, not a safety design.

8. Real examples

• Warehouse AMR: a certified safety scanner and safety controller protect people; the Collision Monitor additionally slows the robot early to avoid needing the emergency stop.

9. Failure scenarios

• Describing a software collision monitor as a safety system.
• A zone smaller than the stopping distance at maximum speed.
• Safety function and the main computer sharing a single failure.

10. Troubleshooting

1. If the robot stops too late in tests, recompute the stopping distance with measured reaction time and deceleration.
2. If the monitor triggers often, check its zones against the speed.
3. Involve the safety engineer when anything near people changes.

11. Validation

• The calculation prints the lines shown (executed by the site tests).
• Stopping tests show the measured distance below the zone at maximum speed with margin.
• A safety engineer has signed off the allocation of hazards to functions.

12. Engineering checklist

• Risk assessment done
• Hazard allocation to safety-rated or operational
• Zones above stopping distance
• Certified components for personnel protection
• Documentation states the difference

13. Further references

• Nav2 Collision Monitor README (jazzy): nav2_collision_monitor, read 2026-11-06.
• Wikipedia overviews, read 2026-11-06 (secondary): ISO 13849, IEC 61508, ISO 10218, Safety integrity level.

Related on FixTheRobot