Mobile Manipulators Are Outrunning the Safety Standards Written for Them

Machine safety in industrial settings rests on decades of accumulated practice, and that practice is organised around two well-developed cases. A stationary robot arm is made safe by separation: fencing, interlocks, and a defined space nobody occupies while it moves — or, in collaborative configurations, by strict limits on force and speed validated against injury thresholds. A mobile platform moving through a facility is made safe by perception and motion rules: sensors that detect obstacles, speed limits by zone, stopping distances calculated for the load. A mobile manipulator is both, and its hazards are not the sum of the two. The arm's reach envelope moves with the base, so the space that must stay clear is defined relative to a machine that does not stay put. Stability changes with arm extension and payload, so a stopping distance validated with the arm stowed may not hold with it extended. And the interaction case that dominates real deployments — a person and a machine occupying the same aisle, each adjusting to the other — is exactly the one that neither framework was written to cover, because in one framework the person is excluded and in the other the machine yields and stops. Standards work addressing the combined case is underway, and the ordinary consequence of an unfinished standard is that certification bodies apply the closest existing framework and add conditions. In practice this produces integrator-specific safety cases: a deployment is approved on the strength of a risk assessment for that site, that layout and that task, which is defensible engineering and does not transfer. Move the same machine to another building and much of the assessment is repeated from the start. The commercial effect is a per-deployment cost that does not fall with volume, which is the specific dynamic that keeps a technology in pilots. The economics of a fleet depend on the tenth installation costing far less than the first, and a safety case rebuilt each time prevents exactly that. The bottleneck for this class of machine is not capability; the arms and the navigation work. It is the absence of a certification path that lets a proven configuration be deployed again without being re-proven.