ISO 3691-4

ISO 3691-4 – definition

ISO 3691-4 is an international safety standard for driverless industrial trucks and their systems. Its full title is ISO 3691-4:2023, Industrial trucks – Safety requirements and verification – Part 4: Driverless industrial trucks and their systems. It is published by the International Organization for Standardization (ISO).

In mobile robotics, the standard is relevant to autonomous mobile robots (AMRs), automated guided vehicles (AGVs), and other driverless ground vehicles used to move materials or equipment within defined operational environments. It specifies safety requirements and verification methods for the vehicle, its navigation system, operating area, traffic management functions, and interaction with people.

ISO 3691-4 is not a general certification for every unmanned ground vehicle. It applies to driverless industrial trucks and associated systems within its defined scope. A research UGV running ROS 2, SLAM, Nav2, or computer vision does not automatically comply with ISO 3691-4 simply because it performs autonomous navigation.

Scope in mobile robotics and UGV systems

The standard addresses hazards created when a mobile platform moves without a human driver onboard. These hazards include collision with people, unintended motion, loss of localisation, incorrect route execution, sensor failure, and unsafe operation in shared workspaces.

For an AMR or AGV deployment, ISO 3691-4 considers the vehicle as part of a wider system. The safety case therefore includes more than the chassis and its emergency stop circuit.

Vehicle motion, braking, steering, and drive control.
Protective devices, including safety laser scanners, bumpers, and emergency-stop devices.
Detection of people, obstacles, and restricted areas.
Navigation infrastructure, maps, markers, reflectors, or natural-feature localisation.
Operating zones, intersections, docking stations, and charging areas.
Communication with fleet-management or traffic-control systems.
Validation of stopping behaviour, protective fields, and fault responses.

The current (2023) edition of ISO 3691-4 covers both traditional guided vehicles and more autonomous systems that use environmental perception. It therefore has practical relevance for LiDAR-based navigation, visual localisation, and dynamic obstacle detection on UGV platforms.

Safety functions relevant to autonomous navigation

ISO 3691-4 does not prescribe one specific ROS package, LiDAR model, map format, or SLAM algorithm. Instead, it defines safety objectives that must be achieved and verified for the intended use. Engineering teams must derive the implementation from a risk assessment.

A typical autonomous UGV architecture separates operational navigation from safety-related motion control. ROS 2 nodes may calculate paths and velocity commands, but a safety-rated subsystem should be responsible for limiting or stopping hazardous motion where required by the risk assessment.

System function	Typical ROS 2 implementation	Safety engineering consideration
Path planning	Nav2 planner server and global costmap	A planner output is not, by itself, a safety function.
Local obstacle avoidance	Nav2 controller server, local costmap, LiDAR point cloud	Detection performance must be validated for the operating environment.
Velocity command generation	`geometry_msgs/msg/Twist` on `/cmd_vel`	Commanded speed must remain within the validated operating limits.
Emergency stop	Status monitoring only, where exposed to ROS 2	The stop path should not depend solely on non-safety-rated application software.
Localisation	SLAM Toolbox, AMCL, robot_localization, visual localisation	Loss of localisation requires a defined safe state or recovery procedure.

Stopping distance is a central engineering parameter. A simplified physical component is the braking distance:

d_brake = v² / (2a)

Here, v is vehicle speed and a is effective deceleration. A practical protective distance also includes sensing delay, signal processing time, controller response, brake engagement time, and positioning uncertainty. The required protective-field geometry must therefore be determined from measured system behaviour, not assumed from a simulation model.

ISO 3691-4 and ROS 2

ROS 2 is middleware and application infrastructure. It is not a functional-safety certification framework. ROS 2 Humble, Jazzy, and other distributions can be used for non-safety navigation, telemetry, mapping, diagnostics, and mission control, while safety functions are implemented through independently validated hardware and control paths.

For example, a ROS 2 navigation stack can publish velocity commands to a differential-drive UGV. A separate safety controller can supervise motion permission, protective-device status, emergency-stop state, and speed limits before allowing traction output.

# Conceptual velocity limits for an operational ROS 2 navigation layer
controller_server:
  ros__parameters:
    FollowPath:
      max_vel_x: 0.30
      max_vel_theta: 0.80
      acc_lim_x: 0.30
      decel_lim_x: -0.30

These parameters are not evidence of ISO 3691-4 compliance. They are operational settings that must be linked to test results, risk controls, and the actual braking and sensing performance of the integrated vehicle.

Use with Leo Rover and Raph Rover

Leo Rover and Raph Rover can be used as research and integration platforms for evaluating concepts related to ISO 3691-4. Typical work includes safe-speed experiments, LiDAR protective-zone prototyping, localisation-loss handling, fleet coordination, and verification of autonomous behaviour in controlled test areas.

Leo Rover uses a four-wheel skid-steer chassis and supports ROS 2 Humble or newer on its integrated Raspberry Pi compute unit. It can run Nav2, SLAM Toolbox, robot_localization, and sensor drivers for LiDAR, IMU, cameras, or GNSS receivers. However, Leo Rover is not an autonomous vehicle out of the box and should not be represented as ISO 3691-4 compliant without a system-specific assessment and verification process.

Raph Rover is more suitable where a larger payload is needed for additional compute hardware, safety controllers, sensor masts, battery capacity, or industrial sensor integration. The same principle applies: compliance concerns the complete integrated system, operating environment, safety functions, documentation, and validation results.

Verification and documentation

ISO 3691-4 requires verification of applicable safety requirements. For a UGV project, the evidence package should connect hazards, requirements, implementation, and test results.

Risk assessment for the intended environment and operating modes.
System architecture showing safety-related and non-safety-related functions.
Measured stopping performance at relevant payloads, speeds, and surface conditions.
Tests for obstacle detection, protective fields, emergency stop, and restart behaviour.
Procedures for sensor obstruction, communication loss, localisation failure, and low battery.
Configuration control for ROS 2 parameters, firmware, maps, and safety-device settings.

Normative references and standards

The primary reference is ISO 3691-4:2023, published by ISO. It should be read together with the applicable machinery safety framework and the legal requirements of the country where the vehicle is deployed. Related standards may include ISO 12100 for risk assessment and risk reduction, ISO 13849-1 for safety-related parts of control systems, and IEC 60204-1 for electrical equipment of machines.

Source: ISO 3691-4:2023 catalogue entry. ROS 2 interfaces and message definitions should be verified against the documentation for the selected ROS 2 distribution at docs.ros.org.