ISO 3691-4 Compliance in AMR Drive Units: Sourcing for STO, SLS, and SBC

Scope and limits

This guide is written for OEM procurement, safety engineering, and supplier quality teams sourcing AMR drive units for mixed-traffic industrial facilities.

It is not a legal opinion, a notified-body ruling, or a substitute for a vehicle-level risk assessment. The correct performance level, safety architecture, and validation plan still depend on payload, maximum speed, stopping distance, floor condition, slope, region of sale, and the final safety PLC / scanner architecture.

Compliance challenge

As AMR adoption grows, CE marking and market-access projects increasingly map driverless industrial truck safety cases to ISO 3691-4:2023.

The expensive procurement mistake is sourcing a standard industrial drive unit and trying to add safety only in software. If the drive cannot participate in the safety-related control system, the vehicle team must compensate with external safety relays, redundant speed sensing, brake monitoring, and extra validation.

Key conclusions for procurement

• STO is the baseline safety function: Safe Torque Off must be available as a hardware safety function, not only as a software stop command.
• SLS is a feedback evidence problem: standard encoders can support motion control, but safe speed monitoring needs diagnostic coverage accepted in the vehicle-level safety case.
• Brake evidence must be testable: ask how brake engagement, release, slip, and wear are diagnosed before awarding a supplier.
• Component cost is not total safety cost: a cheaper non-safety-rated drive can move cost into wiring, redundant sensing, safety PLC programming, and certification rework.

Procurement action checklist

• STO verification: confirm hardware-based, dual-channel Safe Torque Off inputs and request the certificate scope.
• Encoder rating: confirm whether the encoder or speed-monitoring channel is suitable for the required PL/SIL target and ask for diagnostic coverage assumptions.
• Brake diagnostics: confirm support for Safe Brake Control and Safe Brake Test, including proof-test interval guidance.
• Documentation: request safety manual, FMEDA report, certificate, wiring examples, and excluded-use assumptions.
• Communication protocol: confirm discrete safety I/O, FSoE, PROFIsafe, or another interface accepted by the chosen safety PLC.
• Integration gate: do not release sample PO until the supplier names safety function boundaries and restart behavior.

Application boundaries

• Safety-rated drive evidence is normally mandatory for AMRs sharing workspace with people in warehouses, hospitals, and factories.
• Heavy-payload AMRs need stricter stopping-distance and brake-holding evidence because kinetic energy raises crushing and trapping risk.
• EU-bound vehicles must manage machinery conformity obligations; ISO 3691-4 provides the relevant driverless industrial truck safety structure.
• A standard drive may be sufficient for fenced AGV systems where human entry stops the line at the perimeter.
• A standard drive may be sufficient for lightweight educational or R&D robots in controlled laboratory conditions.

Validation and maintenance

Procurement is only the first gate. AMR teams still need site acceptance tests, stopping-distance records, SLS boundary tests, brake checks, and maintenance rules that keep the safety function valid over the fleet lifecycle.

• Dynamic STO verification: trigger an emergency stop while the AMR is moving at maximum payload and record stopping distance.
• SLS boundary testing: force the vehicle into a speed-limited zone and verify that overspeed triggers the intended fault response.
• Safe Brake Test planning: verify that the brake can hold torque without slip and define what fault state is raised when slip is detected.
• Maintenance trigger: tie brake wear, encoder faults, and STO diagnostics to fleet service actions instead of treating them as generic drive alarms.

FAQ: sourcing ISO 3691-4 compliant drives

• Can we achieve ISO 3691-4 compliance by just using a Safety LiDAR? No. A scanner can detect and signal, but the drive unit still needs a controlled safe state such as hardware STO.
• Can we calculate safe speed in the main CPU using a standard encoder? Not by itself. SLS normally needs safe speed feedback or an independent monitor accepted by the vehicle-level risk assessment.
• Why do safety-rated drive units cost more? The premium covers redundant hardware, diagnostic firmware, safety manuals, certification testing, controlled production, and liability around the stated safety function.
• What should buyers ask first? Ask for certificate scope, safety manual, FMEDA data, STO wiring, encoder diagnostic assumptions, brake test method, and proof-test intervals.
• What is the fastest no-regret action? Add STO, SLS feedback, SBC/SBT evidence, and restart behavior as RFQ gates before supplier down-selection.

Next step for your fleet

If your shortlist contains both standard and safety-rated drive units, request an engineering review before sample PO release. Bring the drive certificate scope, encoder datasheet, brake wiring diagram, and intended stop-category logic.