Begin with the airport hazard picture
An apron combines people, moving equipment, aircraft and time-sensitive work in a constrained environment. An autonomous vehicle must be assessed inside that environment, not only on a closed test track. Consider collision, crushing, load loss, unexpected movement, obstruction and the effects of a stopped vehicle on other traffic. Aircraft proximity, jet blast and restricted visibility can make an otherwise ordinary ground-transport event more consequential.
The airport’s safety management system should provide the framework for identifying hazards, assigning ownership and evaluating proposed changes. In European contexts, Regulation (EU) No 139/2014 is an important part of the aerodrome framework where applicable. In the United Kingdom, CAA guidance such as CAP 642 provides airside safety-management context. Neither reference grants blanket approval to an autonomous vehicle.
Make the intended boundary testable
A statement such as “works in all weather” is not an operational requirement. Define measurable limits and the process for detecting that a limit has been reached. Relevant conditions may include precipitation, standing water, visibility, wind, surface contamination, lighting and sensor cleanliness. The permitted combination matters: a heavy cart train on a wet slope may require different treatment from an unloaded vehicle on level pavement.
Boundary checks should not occur only at the start of a shift. Conditions can change while a task is underway. Decide which changes invalidate a movement, how quickly the system detects them and what response is justified at each location. A controlled stop, a move to an approved refuge and a manual handover are different responses with different hazards.
Separate emergency stops from routine pauses
A routine obstacle stop is not necessarily an emergency stop. The design should distinguish normal yielding, protective intervention, emergency action and a technical fault. Operators need to understand those states without guessing from a generic warning light. Records should preserve the reason for stopping so that repeated operational issues are not hidden inside a single “intervention” count.
Emergency-stop arrangements need clear accessibility and reset rules. Resetting an emergency stop must not be treated as permission to resume the previous task automatically. The load, route and immediate surroundings may have changed. A trained person should follow the applicable procedure to establish that restarting is safe and authorised.
Design the human response as carefully as the vehicle
Remote supervision can involve monitoring, task approval, assistance or direct remote driving. These are not interchangeable functions. Specify which is provided, what communications it needs and what happens when it is unavailable. A supervisor should not be expected to infer hazards from an incomplete camera view or to solve several urgent exceptions at once without a workload assessment.
Local recovery remains important even where a remote centre operates continuously. Someone may need to secure a load, protect a stopped vehicle, inspect a coupling or tow equipment away. Define response availability, access permissions and the equipment required. A recovery plan that depends on an unspecified person “going out to help” is not yet an operational plan.
Use standards within their scope
ISO 3691-4 addresses driverless industrial trucks and their systems within its stated scope. ISO 26262 concerns functional safety for road vehicles; ISO 21448 addresses safety of the intended functionality in its own road-vehicle context. IEC 61508 provides a general functional-safety framework. These references can inform engineering questions, but applicability depends on the product, function and operating environment.
Do not substitute a list of standards for evidence that hazards have been controlled. Ask what the supplier assessed, what assumptions were made, what independent review occurred and which airport interfaces remain the operator’s responsibility. A component-level certificate cannot demonstrate the safety of every payload, route, traffic interaction and recovery activity.
Expand only when the evidence supports it
A trial should have explicit entry conditions, stop criteria and a decision process for changes. Test ordinary service disruption as well as ideal journeys: blocked roads, missing staff, inaccurate task data and unavailable communications. Exercises should be planned safely rather than improvised around live aircraft operations.
Evaluate exposure alongside outcomes. Incident-free operation over a narrow, quiet route says less about busy mixed traffic than the same headline might suggest. Track near misses, abrupt stops, blocked-road duration and recovery effort. If the operating boundary expands, revisit the hazard assessment instead of assuming earlier evidence automatically covers the new conditions. The aim is a transparent safety argument that airport teams can maintain, not a one-time demonstration of impressive behaviour.