09.11.19 - ROSCon JP

Eight Steps toSafe AutonomousRobots
Ryan Gariepy, CTO Clearpath Robotics

My History

My History

20052007

2008

2009

Honda of Canada(Intern)

Aeryon Labs(Intern)

Kiva Systems(Intern)

Clearpath Robotics(Founder)My History (Continued)

2010

2012

2014

2019

First for-profit company tosupport ROS

First ROSCon,
OSRF founded

OTTO Motors division
startedOTTO InternationalExpansion

8 Steps to Safer
Autonomous Vehicles

8 Steps

1.What Is Safety?

5. Use Good Mitigations

2.What Is The Environment?

6. Safety By Design

3.Know The Rules &Regulations

7. Safety Architecture & Useof Predictable Code

4.Know Your Risks

8. Use Statistics

What is Safety?

Safety does not mean
‘perfectly polite’ vehicles.

Zero risk is impossible.

What is Safety?

Safety is about keeping
people free from harm.
FIRST-ORDER RISKS

What is Safety?

Safety is about keeping
people free from harm.
SECOND-ORDER RISKS

What is Safety?

As safety increases, speeds decrease AND/OR
space required increases
Robots must be safer than people performing
the same task

No More Machine Operators

Machines have operators

Robots havebystandersEnvironment/ Bystanders

1.Who are your bystanders?

2.How big are they?
3.What clothing are theywearing?

4.How foolish are they?

Standards

National Standards

Type “A”

Principlesof Design

Generic Safety Standards
Safeguards, Aspects of Safety

Type “B”

Specific Machinery Safety Standards

Type “C”

CE, JIS, CSAStandards

ISO 12100(Riskassessment)

Type “A”

ISO 13849 (Safety Control Systems)
IEC 61508 (Functional Safety)

Type “B”

ANSI B56.5 (AGVs)
RIA R15.08 (AMRs)
ISO 13482 (Personal Care Robots)

Type “C”

New Industry - Type C Standards Still In Progress!

Type C standards should havespecific advice on:- Moving object detection- 3D object detection- Vehicle dynamic testing andrestrictions- Proper use of machine learning“A”
Principles
of Design“B”
Generic Safety Standards
Safeguards, Aspects of Safety“C”

But they usually don’t!

Must use Type B or Type A

Specific Machinery Safety Standards

Risk Assessment Formats

ISO 12100 Format

Risk Assessment Formats

ISO 12100 Format

Types of RiskLow Probability

High Probability

LowImpact

Result: Improvement opportunity, not safety issue

Result: Product quality issue, not safety issue

Prioritized: Via kaizen initiatives after release

Prioritized: Via customer feedback before release

HighImpact

Result: Major safety risk, difficult to know

Result: Major safety risk

Prioritized: Needs active investigation

Prioritized: Via safety culture in development team

Types of Risk
Low Probability

High Probability

Low
ImpactResult: Improvement opportunity, not safety issue

Result: Product quality issue, not safety issue

Prioritized: Via kaizen initiatives after release

Prioritized: Via customer feedback before release

HighImpact

Result: Major safety risk, difficult to know

Result: Major safety risk

Prioritized: Needs active investigation

Prioritized: Via safety culture in development teamMitigations

Intrinsic Safety:
Best

Functional Safety:
Standard

Training & Awareness:
Sometimes OK

Protective Equipment
UndesiredIntrinsic Safety
Remember the bystanders?

Intrinsic Safety“Can the bystanders beat the robot in a fight?”

Speed <0.3 m/s or total mass <100 kg?

Other Safety Basics

Safety Lasers

Emergency Stops

Lockouts

Wireless EmergencyStops

Architecture: ISO13849 Levels

Image: iRobotInput(range sensor)

Logic(IF range < threshold
THEN trigger fault)

Output(fault contactor)

Category “B”
Category “1”Architecture: ISO13849 Levels

Image: iRobot

Input(range sensor)

Logic(IF range < threshold
THEN trigger fault)

Output(fault contactor)
Category “2”Test Logic(IF range not change
THEN trigger fault)

Test Output(motor controlenable)

Architecture: ISO13849 Levels

Image: iRobot

Input(range sensor 1)

Logic(IF range < threshold
THEN trigger fault)

Output(fault contactor)
Category “3”Category “4”Input(range sensor 2)

Test Logic(IF range not change
THEN trigger fault)

Test Output(motor controlenable)

Architecture: Navigational Safety Layering

White Box/
Introspectable CodeMulti-Vehicle
Communications

Template
Docking

Neural Network
Docking

Dynamic Object Tracking

Path Projection
Safety-Ratable CodeBase Footprint Checker

Vehicle Dynamics
Management
Safety-Rated
Subsystems

LIDARs & Fieldsets

Black Box Code

Statistics
MTTFd: Mean Time to Dangerous Failure.
MTTF, except only for failures which create hazards

PL: Performance level of safetysystem/subsystem
PLr: Required performance level given risks

RiskAssessment
Item

PLrSystemArchitecture
ISO 13849

IEC 62061

PLMTTFd

Software Testing

Acceptance
Tests

Requirements
Architecture

System Tests

DesignUnit Tests
Development

V-ModelDevelopment

Unit Testing

Simulations

Real World TestingConclusions

Conclusions

1. What Is Safety?
2. What Is The Environment?
3. Know The Rules & Regulations
4. Know Your Risks
5. Use Good Mitigations
6. Safety By Design

More cautious than people, but not ‘perfectly polite’
How foolish are your bystanders?
You will probably need first principles
Look for low-likelihood/high-impactIntrinsic safety best, functional safety OK
Keep it slow and light, have stopping methods

7. Safety Architecture

Build for redundancy and determinism

8. Use Statistics

Don’t trust your eyes, trust the statistics

Questions
Together, We Can Start a
Self-Driving Revolution.
Join us on our mission to change the way materials
move in factories worldwide.

Ryan Gariepy
CTO, Clearpath

ryan@clearpath.ai