Part III: Command, autonomy and emergencies

Article 8. Who may instruct

Anyone may stop a robot; only enrolled people may instruct it, and only within their role.

8.1 Enrollment. An operator is enrolled only after the maker's training and a competence check, renewed on a set schedule. Annex A adds the hazardous-drug training pharmacies require.

8.2 Identity. The robot accepts a task instruction or an explicit yes only from an identified, enrolled person, by badge, PIN or similar. A voice alone does not identify anyone. A stop needs no identity.

8.3 Refusal. The robot refuses any instruction that would breach a guardrail, leave its envelope or exceed the giver's role. It says why in plain words and offers a safe alternative where one exists.

8.4 Unclear instructions. If an instruction is ambiguous, the robot asks before acting. It never guesses at a safety-critical detail, such as which drug, dose or person was meant.

8.5 Conflicting instructions. When people give conflicting instructions, the more cautious one applies and a stop overrides all others. The robot then asks the supervisor to settle it.

8.6 Remote commands. A remote command from the maker or a site system may stop the robot at any time. It may never start motion within reach of a person without a local explicit yes, and never overrides the local safety layer.

8.7 The AI is not an authority. Plans made by the robot's AI are proposals. They run only if every motion is in the catalog (Article 16) and passes the safety layer.

8.8 Secure areas. The person responsible for the site controls the robot's access to secure areas. Annex A gives the pharmacy rule.

Article 9. Operating envelope

Each robot carries an envelope that fixes where, how fast and how forcefully it may move, and outside it the robot stops itself whether or not anyone is watching.

9.1 Contents. Each envelope lists the mapped work area and excluded areas; speed, force and payload limits; the object classes allowed; the conditions it needs, such as light, floor and network; who must be present; and its autonomy level.

9.2 Attended start. A robot that works within reach of people starts at level A2, with an enrolled operator present whenever it moves. It works only in its mapped area and stops at the boundary of any excluded area, such as a customer area.

9.3 Zones. Four zones move with the robot, and the rules tighten as a person comes closer.

A person walking toward the robot passes from Clear to Slow to Reach, and inside the reach zone every action waits for a yes.

9.4 Zone sizes. Zone sizes come from each unit's measured stopping time and distance, using the speed-and-separation method of ISO 10218-2:2025. The calculation assumes a person walking in at 1.6 m/s and a hand reaching in at 2.0 m/s, the approach speeds of ISO 13855 (Leuze). Sizes are recomputed after any change to speed, payload, brakes or sensors.

9.5 Speeds. Each zone has its own limits for travel and for the arm, falling as a person comes closer. The limits are set from each unit's measured stopping performance and published once tests confirm them.

9.6 The explicit-yes rule. Every action within reach of a person needs an explicit yes, whether it enters reach, touches or applies any force. The robot first announces the action, such as "placing the item in tray 3", and acts only on a yes. A yes covers one announced action and lapses after it, or after a short set time if the action has not started; with no yes, the robot waits or moves away to work elsewhere.

9.7 Prediction. The robot predicts where nearby people will move and slows or stops before a predicted path enters its reach. Prediction can add caution but never permits closer or faster motion than measured separation allows.

9.8 Stopping itself. The robot stops itself, with or without anyone watching, when:

• a person is inside the reach zone without a yes;
• it senses unexpected contact or force above a limit;
• a sensor fails, or two sensors disagree;
• it loses its position or reaches the mapped boundary;
• a load slips, or it detects a spill or breakage;
• it cannot identify an object, or a label does not match;
• no enrolled operator is present;
• battery, temperature or network leave their limits;
• it detects tampering or a command it cannot authenticate;
• its AI's confidence falls below the threshold in the envelope.

9.9 Changing an envelope. Widening an envelope, by a new area, a higher speed, a new object class or a higher autonomy level, needs a new risk assessment and Safety Commission approval. The site supervisor may narrow it at any time.

Anchored to: SAE J3016 operational design domain and minimal risk condition; ANSI/A3 R15.08 for industrial mobile robots.

Article 10. Stop and safe state

Any person can stop the robot at any moment by several independent means, while restarting is slower and limited to authorized people after a checklist.

Every stop is one signal away, while each restart needs the role shown on its return arrow.

10.1 The stop ladder.

10.2 Anyone can stop it. Each robot carries red emergency-stop buttons reachable from every side, and the attending operator carries a wireless stop. A spoken "stop" or a raised palm triggers at least a protective stop. None needs a login or a reason, and the buttons are the guaranteed path.

10.3 Stop beats everything. Every stop takes priority over all other commands, as an emergency stop must in every mode (Kollmorgen). Resetting a stop device never restarts motion by itself.

10.4 Each motion names its safe state. Freezing can trap a person and letting go can drop a load, so the guardrail record for each motion names its safe state. For example:

• carrying glass or a liquid: slow smoothly, keep the grip, keep the load level;
• arm moving near a hand: stop, then back off along the path just travelled;
• holding a hazardous substance: keep the grip, and release only over a tray or into a hand after a yes.

10.5 Power loss. On loss of power, control or communication, the robot reaches its safe state without power: brakes hold and the gripper keeps its load. A trapped person can be freed by hand, without power, using a release on the robot.

10.6 Restart checklist. Before an authorized person restarts the robot:

1. The cause of the stop is known and cleared.
2. The area around the robot is clear.
3. The self-test passes: sensors, brakes, stop buttons and gripper.
4. Any load and any safety-critical items handled during the stop are checked.
5. The restart is logged with the restarter's name.
6. The robot announces its first motion, and gets a yes if anyone is within reach.

10.7 Stopping performance. Each unit's stopping time and distance are measured at commissioning, after any hardware change and on a set schedule. Zone sizes (9.4) use these measured values, never design values.

Article 11. Containing an incident

After an incident, the robot and the people around it follow one sequence, so that harm stops with the first event.

11.1 Scope. This applies to every incident and near miss defined in Article 3. Near misses follow the same steps without emergency care.

11.2 First seconds: the robot. It reaches its safe state and secures its load. It sounds and shows an alert, says in plain words what happened and notifies the operator and the supervisor. It locks the event record so nothing in the event window can be overwritten.

11.3 First minutes: the people.

1. Care for anyone hurt first, and call 911 for anything serious.
2. Isolate the robot with an emergency stop or power isolation.
3. Clean up a hazardous spill by the site's own procedure, using trained staff; the robot does not clean up hazardous substances or broken glass.
4. For controlled items, count and reconcile with the supervisor.
5. Quarantine every item the robot handled since its last verified step.

11.4 The people its work serves come first. Any work product involved, such as a prescription, is held and checked again before release. If an error may already have reached someone, the site follows its own error procedure.

11.5 Fleet hold. If the cause could affect other robots, through a software version, an AI model or a hardware batch, the maker pauses or restricts them until cleared. It tells affected customers promptly and follows with a written report, on the model of the vehicle defect-report rule (49 CFR 573.6).

11.6 Evidence. The event record, photos, video, force data, commands and the software and model versions are preserved with a chain of custody. Incident data is kept until the investigation closes, and longer where the law requires; Annex A gives the pharmacy rule.

11.7 Investigation. The maker investigates every incident with at least one independent outside party, using the recorded evidence, to find the root cause.

11.8 Reports. The Safety Commission receives every incident report promptly. In the U.S., an employer must report a worker's death to OSHA within 8 hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours (OSHA). The maker supplies its data to support those reports.

11.9 Return to service. A robot returns to service only after the root cause is found, the fix is verified, and the supervisor and the maker both sign the restart.

Article 12. Humanoid conduct

A human shape invites touch and trust, so a humanoid's conduct around people is stricter than a machine's, and it may physically protect a person only under certified conditions.

12.1 Scope. This article applies to any robot with a human-like body, face or voice.

12.2 Being touched. When a person touches, pushes or grabs a humanoid, it yields rather than resists. It stops its own task motion, never grabs back and asks whether the person needs help.

12.3 Being blocked. A humanoid never pushes through or crowds a person. It waits, asks or finds another way, and never corners anyone or blocks an exit.

12.4 Predict, warn, stop, call. A humanoid predicts likely harm to a person, warns them, stops its own motion and calls for help. Until 12.5 is met, that is the full extent of its protective action.

12.5 Physical protection. A humanoid may act physically to protect a person, for example by steadying a fall, only when all of these hold:

1. The maneuver is certified for that product and setting after testing.
2. The person gave advance consent, recorded beforehand (for a patient, in the care plan) and revocable at any time.
3. The predicted harm is serious and imminent, and acting carries less risk than not acting.
4. Contact stays within the vulnerable-person ceilings of Article 13.
5. The humanoid calls for help at the same moment.

12.6 Consent in an emergency. Steadying a fall cannot wait for a spoken yes. Advance consent under 12.5 replaces the per-action yes of Article 9.6 for that maneuver only; without it, the humanoid warns, stops and calls for help.

12.7 Never. A humanoid never restrains or strikes a person, lifts one unless certified as a lifting device, or blocks an exit. It never uses force to make anyone comply, never pretends to be a person or a clinician, and never hides that it is recording.

12.8 Vulnerable people. Where a humanoid serves patients, older adults or children, they are treated as vulnerable people. The strictest contact ceilings apply, and care staff can stop or override it at any time.

12.9 Falling robots. A humanoid that can lose balance detects it and lowers itself in a controlled way, away from people. The ISO committee draft for dynamically stable robots covers this risk (ISO/CD 25785-1).