Stop Anywhere

A stop works from any state, and stays stopped.

A Cruise robotaxi at Fifth and Market

2 October 2023 · San Francisco, California

At about 9:30 at night, near Fifth and Market Streets, an unidentified car struck a pedestrian in a crosswalk, who fell into the path of a driverless Cruise car. The Cruise car braked hard and came to a complete stop, with the pedestrian underneath it. Then it moved again: it attempted a pullover maneuver, travelling about 20 feet and reaching 7 mph, dragging the pedestrian with it before coming to a final stop. The state suspended Cruise’s driverless testing permit three weeks later.3

Anti-pattern: No Brakes for Bystanders

The people best placed to stop a machine are often the ones standing next to it, and they’re the ones with no way to do it. The car took its stop as a pause, and a built-in plan decided what happened next. Nobody on the street could override that plan.

Stop Anywhere

Therefore: Anyone responsible for what’s around the machine (its operator, a remote team, or the person standing beside it) can stop it from any state, and the stop holds until someone deliberately releases it.

Without

Warehouse robot

AMR 12 · AISLE 4

Press Start, then try either stop.

With the pattern

Warehouse robot

AMR 12 · AISLE 4

Press Start, then try either stop.

The authority to halt the machine belongs to whoever is in a position to see that it should be halted, and the stop does not expire on its own.

The mechanism

machine is running → an operator releases it

  1. 01Machine is runningIn any mode, attended or not
  2. 02Someone needs it stoppedOperator, bystander, remote support
  3. 03 · Key momentOne control, always liveUnmistakable, and mode-independent
  4. 04The stop latchesIt holds without being held
  5. 05An operator releases itDeliberately, at the point it was triggered
On this page

Design considerations

  • Reserve the look of the stop control. Red on yellow means emergency stop and nothing else, so someone who has never seen this machine still recognizes it.25
  • Make the stop latch. Once pressed, the machine stays stopped. Stopping shouldn't be something you have to keep doing.1
  • Make the reset deliberate and local. The machine can't decide on its own that the emergency is over; a person at the machine has to release it.1
  • Give the stop to the people who are there. Industrial standards assume someone within reach of the machine. A fleet run from a control room, or a car with no driver, breaks that assumption, so the people nearby need a way to stop it too.

In the field

Observed · Automotive. The Cruise car at Fifth and Market stopped itself, then started again with a pedestrian underneath it, and nobody on the street had any way to intervene.3

Illustrative · Automotive. A Waymo car confused by traffic cones asked its remote assistance team for help and got the wrong guidance. It later pulled out, parked partly in the road, then drove off as a roadside assistant walked up to it. Neither the remote team nor the person standing next to it could stop it.4

Based on a news report, not an investigation. It's here for the shape of the failure, not the detail: a machine that asked for help, got the wrong help, and then moved while the person responsible for it was close enough to touch it.

Sources

  1. ISO 13850 emergency stop resetISO 13850, via IDEC/FarnellStandard
  2. IEC 60204-1 actuator coloursIEC 60204-1, via Schneider ElectricStandard
  3. Order of Suspension — Autonomous Vehicle Testing Permit, Driverless Vehicles, Cruise LLCCalifornia Department of Motor Vehicles · 2023Incident
  4. Waymo car filmed as it gets confused by cones, escapes its own support teamAI BusinessArticle
  5. Understanding Symbols: Emergency StopGeoffrey Peckham, In Compliance Magazine · 2015Article
  6. The emergency stop functionIPDArticle