Minimal Risk Condition

An MRC is a pre-programmed, low-energy state that minimizes the potential for harm to people, property, and the agent itself. It is the ultimate fallback when the system can no longer guarantee safe nominal operation.

• Triggering Events: System faults, sensor occlusion, ODD violations, or loss of the heartbeat signal.
• Key Distinction: It is a condition, not just an action. A complete stop in a blind aisle is an action, but it is not a safe condition. The MRC must be a location and state of being.

The most common MRC is an immediate, controlled stop. This is a Category 0 or 1 stop per safety standards like ISO 13850, designed to remove power from actuators and engage brakes without delay.

• Execution: Power is cut to motion actuators, and safety brakes are engaged.
• Goal: Achieve a zero-kinetic-energy state as quickly as mechanically possible.
• Contrast: This differs from a normal operational stop, which may decelerate smoothly to preserve cargo.

When an immediate stop creates a new hazard (e.g., blocking a fire exit or an intersection), a more sophisticated MRC involves autonomous transit to a designated safe zone.

• Safe Zone: A pre-mapped, physically demarcated area where a stopped agent poses minimal risk.
• Degraded Operation: The agent may move at a drastically reduced speed using a separate, high-integrity safety controller.
• Example: A mobile robot in a hospital corridor that loses localization may autonomously creep to a designated charging alcove rather than stopping in the middle of a patient transport path.

An MRC is the final output of a Run-Time Assurance (RTA) system. The RTA acts as an unbypassable safety monitor that continuously verifies the actions of the primary autonomy stack against a set of inviolable safety rules.

• Safety Invariant: A formal rule like 'always maintain a 10cm distance from humans.'
• RTA Action: If the primary controller's command would violate an invariant, the RTA intercepts and forces a transition to the MRC.
• Architecture: This creates a decoupled safety channel, ensuring a complex autonomy bug cannot prevent the execution of the MRC.

A critical trigger for an MRC is the loss of the heartbeat signal from the fleet orchestrator. If an agent cannot confirm the safety of the broader system state, it must assume the worst.

• Watchdog Timer: A hardware timer on the agent is reset by each received heartbeat. If the timer expires, the MRC is triggered directly at the hardware level.
• Network Agnostic: The MRC execution must be entirely on-device and not dependent on network connectivity.
• Recovery: The agent remains in its MRC until a valid, authenticated command to exit is received over a restored connection.

The definition of an appropriate MRC is entirely dependent on the system's Operational Design Domain (ODD) . An MRC that is safe in a warehouse is catastrophic on a highway.

• Warehouse ODD: MRC is typically an immediate stop and brake engagement on a flat floor.
• Highway ODD: An immediate stop is unsafe. The MRC is a 'minimal risk maneuver' to safely pull over to the shoulder.
• Aerial ODD: The MRC is an immediate, controlled descent and landing at the current position.

The MRC is executed as a controlled stop in a safe location. The vehicle must autonomously identify a non-hazardous area—such as a highway shoulder or parking lane—and come to a complete halt.

• Trigger events: Sensor occlusion, geofence violation, system degradation
• Execution: Gradual deceleration with hazard lights activated
• Fallback: If no safe stop zone is reachable, the vehicle performs a minimal risk maneuver at the lowest feasible speed
• Standard reference: ISO 26262 and ISO 21448 (SOTIF) govern the validation of these transitions

Autonomous Mobile Robots in intralogistics default to an emergency stop followed by a safe standstill. Unlike on-road vehicles, the MRC often involves immediate braking due to the proximity of human co-workers.

• Safety-rated sensors: LiDAR safety zones and physical bumpers trigger Category 0 or 1 stops per IEC 60204-1
• Safe standstill: Motors are de-energized but the agent remains powered and communicative
• Recovery protocol: A human operator must physically inspect and manually clear the MRC before the agent rejoins the fleet
• Zone integration: MRC triggers can be geofenced to specific warehouse zones with different stop profiles

Drones implement MRC through controlled descent and landing or return-to-home (RTH) protocols. The system must account for remaining battery capacity and terrain before selecting a safe termination point.

• Loss of C2 link: Automatic RTH after a configurable timeout, following a pre-planned geofenced corridor
• Low battery MRC: The flight controller calculates the energy required to reach the home point plus a safety margin; if insufficient, it executes an immediate landing at the current position
• Geospatial awareness: No-fly zones and terrain elevation data are integrated into the descent path planner
• Regulatory alignment: EASA and FAA require MRC demonstrations for BVLOS certification

In medical robotics, the MRC is a passive hold state where the manipulator maintains its position with zero applied force, allowing the surgeon to safely retract or reposition the instrument.

• Trigger conditions: Power fluctuation, kinematic singularity, force-torque limit exceeded
• Passive hold: Joints are back-driven or locked with minimal holding torque; no autonomous motion is permitted
• Redundant braking: Dual-channel safety relays and mechanical brakes engage if the passive hold fails
• Standard: IEC 60601-1 and IEC 62304 govern the software safety architecture, requiring MRC transitions to be deterministic and verifiable

Fixed industrial manipulators transition to a safety-rated monitored stop where power is maintained at the joints but motion is actively held at zero velocity. This preserves positional context for rapid recovery.

• Stop categories: Category 2 (controlled stop with power maintained) vs. Category 0 (immediate power removal) per IEC 60204-1
• Safety PLC: A dedicated safety controller continuously monitors speed, position, and torque against configurable limits
• Collaborative mode: In cobot applications, the MRC may transition to a hand-guided mode rather than a full stop, allowing the operator to physically reposition the arm
• Validation: MRC transitions must be tested under maximum load and speed conditions to verify stopping distance and time

Uncrewed surface vessels (USVs) implement MRC as a loiter or station-keeping maneuver. The vessel maintains position using dynamic positioning or drifts in a designated safe area while awaiting human intervention.

• COLREGS compliance: The MRC must not create a collision hazard for other vessels; the USV may need to navigate to a safe loiter zone before stopping
• Propulsion state: Engines remain idling to maintain station-keeping capability against current and wind
• Communications: AIS and satellite beacons continue broadcasting position; the MRC is a known, predictable state for nearby traffic
• Autonomous fallback: If station-keeping fails due to severe weather, the vessel may execute a beaching or anchor deployment as a final MRC

A design principle ensuring that a system defaults to a condition that minimizes harm in the event of a failure. Unlike an MRC—which is a specific, pre-planned stable state—a fail-safe state is a broader architectural pattern. Examples include:

• A robotic arm engaging mechanical brakes upon power loss
• A drone initiating a controlled descent rather than free-falling
• A conveyor system halting immediately when a safety light curtain is breached The fail-safe principle mandates that energy removal or system interruption must result in a safe condition, not an uncontrolled one.

The specific set of operating conditions under which an autonomous system is designed to function safely. An MRC is triggered precisely when an agent exits its ODD. Key ODD parameters include:

• Geographic boundaries: Geofenced areas, mapped corridors
• Environmental conditions: Weather, lighting, temperature ranges
• Operational constraints: Maximum speed, payload weight, road surface types
• Temporal restrictions: Daytime-only operation, shift schedules When any ODD boundary is breached, the system must detect the violation and transition to its pre-defined MRC without human intervention.

A real-time safety mechanism that continuously monitors an autonomous system's actions and intervenes to prevent violations of predefined safety invariants. RTA acts as an independent safety envelope around the primary controller:

• Unobtrusive monitoring: Does not interfere during nominal operation
• Hard constraints: Enforces absolute boundaries (e.g., maximum velocity, geofence limits)
• MRC triggering: If the primary system fails to correct a violation, RTA forces a transition to the Minimal Risk Condition RTA is often implemented on a separate, functionally isolated hardware module to ensure it remains operational even if the main compute unit fails.

A hardware or software timer that triggers a system reset or safe-state transition if it is not periodically reset by the main control program. This prevents the system from hanging indefinitely in an unsafe state. In autonomous agents:

• The main control loop must pet the watchdog at a fixed frequency
• If the agent's software crashes or freezes, the timer expires
• Expiration forces an immediate transition to the Minimal Risk Condition
• External watchdog chips are preferred over internal software timers for functional safety certification under standards like ISO 26262 and IEC 61508.

A periodic signal sent from an agent to the central orchestrator confirming it is still operational and connected. The absence of a heartbeat triggers a loss-of-communications safety protocol:

• Frequency: Typically 1-10 Hz depending on latency requirements
• Payload: May include minimal telemetry (battery level, current state, position)
• Timeout action: If N consecutive heartbeats are missed, the orchestrator assumes the agent is compromised and commands other agents to avoid its last known position
• Onboard MRC: Simultaneously, the agent itself should detect the communication loss and independently execute its Minimal Risk Condition.

A physical or digital emergency mechanism that immediately cuts all power to actuators or terminates all active processes. Unlike an MRC—which is a controlled, graceful transition—a kill switch provides an instantaneous, guaranteed halt:

• Physical E-Stop: Wired directly to motor contactors, bypassing all software
• Wireless Kill: Radio-frequency triggered shutdown for drones and mobile robots
• Software Kill: API command that terminates all processes and engages brakes Kill switches are a last-resort safety layer. An MRC is preferred for non-catastrophic failures because it preserves system state and enables faster recovery.