Robots should make degraded mode impossible to miss

In deployment, I’d rather have a robot visibly enter a degraded mode than quietly continue while camera, lidar, or actuator feedback is unreliable. That mode should mean lower speed, a smaller permitted workspace, fewer autonomous actions, and human confirmation before anything consequential—not merely a lower confidence score buried in logs.

The objection is real: false alarms create downtime, interrupt warehouse flow, and can make operators dismiss warnings. But graceful task completion is not graceful if the system is concealing uncertainty. An illustrative warehouse case would be an AMR slowing and requesting confirmation after intermittent lidar dropouts; that seems preferable to improvising around an unseen obstacle. ISO 3691-4 includes protective stops and related control concepts, though application-specific risk assessment still matters.

What policies have worked in your deployments, and where would you allow continued operation instead?

The human-confirmation part is harder than it sounds. If the alert arrives without a clear reason or a safe recovery action, operators just become a manual exception queue. Degraded mode needs an obvious diagnosis and a bounded next step, not only a red light.

I agree in principle, but every interruption has a customer-facing cost. I’d reserve mandatory confirmation for failures that change the robot’s safety envelope; a weak camera signal during a low-risk, fenced task should not halt the whole workflow.

Silent uncertainty is a terrible security property as well as a safety problem. An attacker, bad calibration, or simple sensor obstruction can all look like ordinary noise. Visible state changes make monitoring and incident review much more credible.

Worth separating the engineering preference from a standards claim. ISO 3691-4 is relevant to industrial driverless trucks and includes protective-stop concepts, but it does not establish one universal degraded-mode policy for hospitals or outdoor inspection.

There’s a failure mode on the other side: confirmation fatigue. If the robot asks for approval every time perception gets slightly worse, people will approve reflexively. I’d want risk-tiered thresholds and a hard cap on what degraded mode is allowed to do.

The interface matters as much as the threshold. “Lidar confidence low” is for engineers; “stopped because the aisle edge is uncertain” gives a floor worker something actionable. Otherwise the system teaches people to ignore its vocabulary.

Procurement teams will ask whether this is a configurable feature, a validated safety function, or an operator preference. Those are very different commitments. I’d want the failure policy documented in the deployment risk assessment rather than left to site-level tuning.

For outdoor inspection, I’d tolerate more graceful completion if the robot can retreat to a known-safe point and upload partial results. Requiring a person for every uncertain frame could turn a useful inspection into an expensive babysitting job.

If the robot cannot say what it has lost, it probably has no business deciding what it can safely continue doing. Slow, narrow, and boring beats clever right up until the first thing it failed to notice.