Research Track 01 · Standards Map
机器人 SOTIF 的标准地图与证据链 Standards Map and Evidence Chain for Robot SOTIF
机器人预期功能安全不是凭空出现的新概念。它更像是汽车 SOTIF、AI 安全、工业机器人安全、 服务机器人安全和通用移动物理 AI 标准之间正在形成的新交叉地带。
Robot SOTIF is not a concept created from scratch. It is an emerging intersection among automotive SOTIF, AI safety, industrial robot safety, service robot safety, and the standardization of general-purpose mobile physical AI.
1. 官方信号：标准项目已经进入公示 1. Official Signal: A Standard Project Is Now Under Public Consultation
2026 年 6 月 2 日，国家标准委系统发布《机器人与机器人装备 安全要求 第 4 部分：通用移动物理 AI》 拟立项强制性国家标准项目，公示截止日期为 2026 年 7 月 2 日。
On June 2, 2026, China’s national standards platform published a proposed mandatory standard project, Robots and Robotic Devices - Safety Requirements - Part 4: General-Purpose Mobile Physical AI, with public consultation open until July 2, 2026.
这个项目名称本身就很有信息量：它不是只讨论工业机器人，也不是只讨论服务机器人，而是把“通用”“移动”“物理 AI” 放在同一个安全要求框架下。
The title itself is informative. It does not focus only on industrial robots or service robots. It places “general-purpose,” “mobile,” and “physical AI” under one safety-requirements framework.
2. 机器人 SOTIF 与现有标准的关系 2. How Robot SOTIF Relates to Existing Standards
| 标准或框架 | 主要对象 | 对机器人 SOTIF 的价值 | 不能直接替代的原因 |
|---|---|---|---|
| ISO 21448 / GB/T 43267 | 道路车辆预期功能安全 | 提供“无故障但仍危险”的问题框架、场景识别、触发条件和安全论证逻辑 | 机器人任务空间、交互对象和物理形态更开放，不能照搬车辆 ODD |
| ISO/PAS 8800 | 道路车辆 AI 安全 | 把 AI 组件、训练数据、模型不确定性和安全案例纳入讨论 | 仍以道路车辆为主，机器人具身交互和语言任务链需要扩展 |
| ISO 34502 | 自动驾驶场景安全评价框架 | 提供场景工程、评价目标、指标和证据组织方法 | 机器人场景不只是道路交通，还包括室内、园区、家庭、医院、仓储等空间 |
| ISO 10218 / ISO/TS 15066 | 工业机器人与协作机器人安全 | 给出机械危险、接触力、速度限制、协作空间等基础要求 | 主要面向相对受控环境，无法覆盖开放移动物理 AI 的语义与任务风险 |
| ISO 13482 | 个人护理机器人安全 | 关注服务机器人、人体接触、移动辅助等场景 | 对 LLM/VLA 驱动的开放任务理解与跨场景泛化覆盖有限 |
| ISO/CD 25785-1 | 机器人 AI 安全与数据要求草案 | 开始把 AI、数据和机器人安全放到同一语境 | 仍在发展中，需要与 SOTIF 证据链进一步对接 |
| Standard or Framework | Primary Scope | Value for Robot SOTIF | Why It Is Not a Direct Substitute |
|---|---|---|---|
| ISO 21448 / GB/T 43267 | Safety of the intended functionality for road vehicles | Provides the core logic for “no fault, yet unsafe,” including scenario identification, triggering conditions, and safety argumentation | Robot task spaces, interaction targets, and physical forms are more open; vehicle ODD concepts cannot be copied directly |
| ISO/PAS 8800 | AI safety for road vehicles | Brings AI components, training data, model uncertainty, and safety cases into the safety discussion | It remains vehicle-centered; embodied interaction and language-driven task chains require extension |
| ISO 34502 | Scenario-based safety evaluation for automated driving | Offers methods for scenario engineering, evaluation objectives, metrics, and evidence organization | Robot scenarios extend beyond road traffic into homes, hospitals, campuses, warehouses, and mixed public spaces |
| ISO 10218 / ISO/TS 15066 | Industrial and collaborative robot safety | Defines foundations for mechanical hazards, contact forces, speed limits, and collaborative workspaces | It mainly assumes controlled environments and does not fully cover semantic and task-level risks in open mobile physical AI |
| ISO 13482 | Personal care robot safety | Addresses service robots, human contact, mobility assistance, and related use cases | Coverage is limited for open task understanding and cross-scenario generalization driven by LLM/VLA systems |
| ISO/CD 25785-1 | Draft work on AI safety and data requirements for robots | Starts to place AI, data, and robot safety within a shared vocabulary | It is still evolving and needs closer connection to a SOTIF-style evidence chain |
3. 证据链应该怎么搭 3. How the Evidence Chain Should Be Built
对机器人 SOTIF 来说，我建议至少把证据链拆成六层。每一层都要回答一个具体问题，而不是只写“系统经过充分测试”。
For Robot SOTIF, I suggest decomposing the evidence chain into at least six layers. Each layer should answer a concrete question, rather than merely claiming that the system has been “sufficiently tested.”
其中最容易被低估的是第一层和第二层。很多机器人 Demo 看起来很强，是因为场景被默默收窄了； 一旦换地面材质、换人群密度、换用户指令方式、换物体摆放习惯，危险行为就可能出现。
The first two layers are often underestimated. Many robot demos look strong because the scenario has been quietly narrowed. Once floor material, crowd density, instruction style, or object placement changes, hazardous behavior may emerge.
4. 标准校准：哪些引用需要谨慎 4. Standards Calibration: References That Need Care
在公开讨论里，机器人安全经常被快速套到 ISO 10218、ISO/TS 15066 或 ISO 13482 上。 这些标准非常重要，但它们不能自动等价于机器人 SOTIF。
In public discussion, robot safety is often quickly mapped to ISO 10218, ISO/TS 15066, or ISO 13482. These standards are important, but they are not automatically equivalent to Robot SOTIF.
SOTIF 的核心不是“有没有防护栏”“有没有急停按钮”，而是功能在预期使用和可预见误用中是否会因为感知不足、 认知不足、决策不足或场景覆盖不足而导致不可接受风险。
The core of SOTIF is not whether there is a fence or an emergency-stop button. It asks whether the intended function, under intended use and reasonably foreseeable misuse, can create unacceptable risk because of perception insufficiency, cognitive insufficiency, decision insufficiency, or insufficient scenario coverage.
5. 对研究与落地的建议 5. Suggestions for Research and Deployment
- 不要急着发明全新的术语，先把汽车 SOTIF、AI 安全和机器人安全已有框架对齐。
- Do not rush to invent new terminology. First align the existing frameworks from automotive SOTIF, AI safety, and robot safety.
- 不要只做模型能力评测，要建立任务、空间、用户、物理接触和回退策略的联合评价。
- Do not evaluate model capability alone. Evaluate task, space, user, physical contact, and fallback strategy jointly.
- 不要把“运行时监控”当成补丁，它应该成为机器人 SOTIF 安全架构的一部分。
- Do not treat runtime monitoring as a patch. It should be part of the Robot SOTIF safety architecture.
- 不要只追求平均性能，应该公开边界场景、失败案例和不可接受风险的判定逻辑。
- Do not optimize only for average performance. Publicly define boundary scenarios, failure cases, and the logic for judging unacceptable risk.