Separate work allocation from protective functions
A fleet service can allocate jobs, sequence access and maintain a shared operational picture. Machine-level control must still perform its validated functions within the approved operating conditions. A scheduler’s “route clear” message is not a substitute for obstacle detection, protective stopping or the machine manufacturer’s operating instructions.
Likewise, a remote stop request sent through an ordinary data connection must not be described as equivalent to a validated emergency-stop function. Response time, communication failure and system architecture matter. Farms should establish these distinctions with competent suppliers and advisers before considering simultaneous autonomous operations.
Represent the space that machines actually need
A point on a map is insufficient for a moving vehicle with an implement. Account for width, swept turns, stopping behavior and the space needed to recover from a blocked route. Ground conditions can reduce usable width further: the hard-looking shoulder of a track may not support the machine’s load.
Identify constrained resources such as gates, narrow lanes, loading points and service areas. A conceptual reservation process can request access, grant it, confirm entry and record exit. However, expiry of a digital reservation must not be treated as proof that the physical area is empty. An unreported machine may still be there.
A checked crossing sequence
- Request access using the accepted task and route version.
- Confirm availability and the applicable entry conditions.
- Receive acknowledgment from the intended machine.
- Observe entry and retain the area’s occupied state.
- Release only after a reliable exit or a supervised clearance.
Freshness belongs beside every position
Every reported position needs a timestamp and a quality state. If a machine stops communicating, its last marker must become visibly stale rather than continuing to look live. Predicting where it might be can help an operator reason about the situation, but a prediction must remain clearly different from an observation.
Coordinate time as carefully as space. Device clock errors can make recent data appear old or reorder events incorrectly. Log both event time and receipt time where appropriate. This helps distinguish a delayed message from a machine that really changed state after the latest instruction.
Handle communications as a field condition
Coverage may change behind trees, buildings or terrain. Cellular service, local radio and Wi-Fi each have limitations. Assess the complete communication path, including the remote service and the farm network, rather than relying on a signal indicator at the vehicle. A healthy connection to one component does not establish that a command reached its destination.
Each machine needs defined behavior for degraded or lost communications, consistent with its validated system and operating procedure. The fleet layer should stop assigning conflicting new work and make uncertainty visible. It should not improvise a universal “continue” or “stop” instruction across machines with different capabilities and risk assessments.
| Interface | Question to resolve | Evidence to retain |
|---|---|---|
| Task service to machine | Which plan was accepted? | Identifier, revision and acknowledgment |
| Machine to fleet map | How current is this state? | Timestamp and quality flags |
| Shared-area coordination | Who controls release? | Entry, exit and clearance records |
Leave a route for the exception
Machines can block one another without colliding. One waits at a gate while another occupies the only turning space needed to leave. Avoid these deadlocks by reviewing entry and exit together, and by providing suitable holding areas. A recovery route should be assessed before it becomes urgently necessary.
Energy and servicing also affect coordination. A machine leaving for charging may invalidate assumptions about who completes the remaining coverage. Reallocation must preserve completed areas and evidence quality, rather than sending another machine to repeat the whole task. Record why work moved and which machine accepted the remainder.
Keep the supervisor’s picture understandable
Show the accepted task, current machine state and unresolved constraints in plain language. ROS 2 and the Open Robotics ecosystem offer useful software concepts, but a software platform is not proof of an agricultural safety case. ISO 18497 and ISO 25119 are relevant standards families to discuss with qualified specialists; applicability and current editions require checking.
Exception note: one machine disappears from the fleet view
Mark its state as uncertain, protect shared-area assumptions and follow the agreed machine-specific response. Obtain reliable clearance before reallocating its occupied route or task area.
Next: supervise the interrupted pass
Background references: Open Robotics, ROS documentation and ISO. This article is not an operating procedure or a safety certification.