Foreword. This Test Protocol is new in the VRS 2026 edition and is the Field & Outdoor sector’s extension of VRS-GEN-203, the intrinsic demonstration protocol. Outdoor machines work where the ground is not flat, the light is not controlled, the air is not clean and nobody is near enough to press a stop button: farms, construction sites, mines, pipelines and survey routes. The sector’s anchor regimes — agricultural highly-automated machinery, earth-moving autonomous machine systems, driverless industrial trucks — test the things that fail in those conditions: detection of a person entering the work zone at working speed with a working load on working ground, a boundary the machine will not cross even when it no longer knows exactly where it is, stability on the slope the manufacturer claims, sensors that are muddy or blinded by sun, and the stored energy in an implement when someone has to service it in a field. This Protocol borrows those tests as witnessed steps, with the manufacturer’s own targets, slopes, obscurants and recovery gear, and every apparatus at the declared value. It carries only what the intrinsic steps do not already witness. Steps run between Parts E and F of VRS-GEN-203, in the same session, on the same feed, into the same export. Standards carry no step identifiers; every step here names the VRS-FLD-201 subclause that requires it. As a protocol it is versioned vX.Y.Z (VRS-GEN-004 §5.4). Requirements use “shall”.
Introduction
The Field & Outdoor anchor set is ISO 18497 for highly-automated agricultural machinery, ISO 17757 for autonomous and semi-autonomous earth-moving machine systems, ISO 3691-4 for driverless industrial trucks operating in yards, and ISO 12100 for the classes none of those fit. What they share, and what distinguishes them from the indoor regimes, is the insistence that a safety function be validated in the operating environment: on the slope, in the mud, in the dust, with the implement fitted and the hopper full. The intrinsic protocol witnesses that each declared safety function exists and acts on a reference floor; this Protocol witnesses that it still acts where the declaration says the machine will work.
The Protocol also witnesses two things indoor sectors never need: what happens when the machine loses its satellite fix or its radio link at speed, and what a field crew must do to repair or recover a machine where there is no workshop. Both are timed and both use the manufacturer’s own field kit and recovery gear. The environmental sample is conditional on the weather at the site; a session in fine weather records it as not present and loses nothing else.
1 Scope
This Protocol specifies the Field & Outdoor demonstration steps by which the criteria of VRS-FLD-201 Clause 6 are demonstrated at the Certified tier, for every application class of VRS-FLD-201 §7.3 (agricultural · construction/earthmoving · mining · inspection/survey). It applies to every Certified Field & Outdoor assessment, by every Certified route of VRS-GEN-003 §6.9.
It specifies: how this Protocol relates to VRS-GEN-203 (Clause 4); the envelope the manufacturer declares before the session (Clause 5); the steps (Clause 6); and a worked example (Clause 7). Annex A maps every VRS-FLD-201 criterion to its intrinsic steps, its sector steps, or neither.
It does not: repeat any session requirement, step, marking rule or record rule of VRS-GEN-203, all of which apply unchanged; define any criterion, point, ceiling or ladder (VRS-FLD-201); or define the Field & Outdoor information pack (VRS-GEN-013). No step places a person in the work zone as a detection target or under an implement; human-sized and prone test targets stand in. Destructive rollover and tests to failure are excluded; stability is witnessed at the declared limits only.
2 Normative references
-
VRS-GEN-203, Demonstration Protocol — Intrinsic — session requirements (Clause 4), step rules (Clause 5), marks and scores (Clause 7), Session Record (Clause 8), all of which apply to this Protocol.
-
VRS-FLD-201, Field & Outdoor — AR Assessment Protocol — the criteria whose Certified rows this Protocol serves; application classes (§7.3).
-
VRS-FLD-001, Field & Outdoor Sector Standard — the declared envelope and class fields.
-
- VRS-GEN-101, Safety — the intrinsic safety criteria the Field & Outdoor pool contributes to.
-
- VRS-GEN-102, Reliability & Durability — the intrinsic environmental-sample step that also serves VRS-FLD-201 §6.5.
-
- VRS-GEN-103, Serviceability & Support — the intrinsic module-swap and fault-recovery steps that serve parts of VRS-FLD-201 §6.7.
-
VRS-GEN-003, Governance Charter and Independence — Certified routes and route parity (§6.9).
3 Terms and definitions
Terms defined in VRS-GEN-001 and VRS-GEN-203 apply. In addition:
3.1 worst terrain — the declared travel surface (soft, wet, rutted, gravel, slope) on which the manufacturer declares the safety functions to work, supplied as a sample large enough for the stopping distance.
3.2 human-sized target — a test target at the declared adult height and width, moved on a line or trolley, standing in for a person entering the work zone.
3.3 prone-profile target — a low, long test target at declared dimensions standing in for a person lying in the path, optionally part-obscured by declared vegetation or material.
3.4 standoff — the declared distance from a configured boundary at which the machine slows or stops.
3.5 positioning-denied fallback — the declared behaviour when satellite positioning is degraded or lost.
3.6 side-slope — the declared maximum lateral inclination the machine traverses laden without lifting an uphill wheel or track.
3.7 implement — a declared working attachment (deck, blade, bucket, boom, sprayer, drill) with its own motion or stored energy.
3.8 lock-out — the declared means of preventing implement motion during service, with its indicator.
3.9 field tool kit — the declared set of tools carried with or available to the machine at a remote site.
3.10 recovery means — the declared method and attachment points by which a stranded machine is moved (tow, winch, lift).
4 Relationship to the intrinsic protocol
4.1 This Protocol shall be run only as part of a session under VRS-GEN-203. Every requirement of VRS-GEN-203 Clause 4 applies to every step here without repetition or exception.
4.2 Position in the session. The steps of Clause 6 shall run after VRS-GEN-203 Part E and before VRS-GEN-203 Part F, so that one continuous recording and one export cover both protocols. The endurance sample opened in VRS-GEN-203 Part C continues to run through this Protocol.
4.3 Step identifiers. Steps shall carry identifiers of the form FLD-110.nn; they are Session
Record step identifiers under the same rules as VRS-GEN-203 §5.1 and shall never be reused.
4.4 Required by. Every step shall name the VRS-FLD-201 subclause(s) whose Certified row it serves. VRS-FLD-201 carries no reference back to this Protocol.
4.5 Classes and declared subjects. Each step lists the application classes it applies to. A step whose class is not in the assessed envelope shall not be run. A step whose subject the manufacturer has not declared shall be marked not declared and has no effect on any score (VRS-GEN-203 §3.10). Parts 1, 2, 3 and 7 shall be run for every Field & Outdoor assessment; Part 5 shall be run where an implement or stored-energy system exists (VRS-FLD-201 §7.3).
4.6 Bound. The sum of step bounds for one class shall not exceed 120 min. Marks, failure, declined steps, continuation sessions and the Session Record follow VRS-GEN-203 Clauses 5, 7 and 8.
4.7 Criteria witnessed by intrinsic steps. Where a sector criterion’s Certified row is already witnessed by intrinsic steps, Annex A names them and the criterion is scored from those marks together with any sector steps listed. VRS-FLD-201 §6.1 (anchor conformity) has no step of its own: its Certified row is confirmed by the marks of the detection, boundary and stability steps of Parts 1 to 3, which are the anchor regimes’ own environment-validation tests witnessed live.
4.8 People in the work zone. No step shall place a person in the protective zone as a detection target, in the path of motion, under or beside an implement in motion, or on the machine during a stability step; test targets stand in (VRS-GEN-203 §4.8). A step so performed shall be marked not achieved and the ground recorded.
4.9 Stability steps. Slope and side-slope steps shall be run at the declared limits only, never beyond them, on a slope with a run-off and with any declared roll-over protective structure fitted; the observer may end a step at the first sign of wheel or track lift and mark the outcome to that point.
4.10 Admissibility of a mark. A step’s mark shall be inadmissible, and the step shall be marked not achieved, where the dimension, mass, speed, force or condition it depends on was not shown on camera, or where the configuration demonstrated differs from the assessed one. The observer shall record the ground.
5 The declared envelope
5.1 Before the session the manufacturer shall have declared, in the information pack and per assessed application class: maximum speed (m/s) on the reference surface and on the worst terrain; maximum payload or implement load (kg); the worst terrain and the declared soft-ground sample; the human-sized and prone-profile target dimensions (mm); the protective-zone geometry and declared stopping distance (m) on the worst terrain; the boundary standoff (m) and the positioning-denied fallback with its stop distance (m); maximum slope and side-slope (degrees or %) laden and the speeds for each; obstacle or step capability (mm); the obscuration degree and low-light or glare condition; each implement with its service position, lock-out and stored-energy system; the field tool kit and field-repair time (min); the recovery means and points; the lost-link fail-safe and distance (m); and the tele-operation authentication and hand-over method.
5.2 Every apparatus in Clause 6 shall be sized from those declarations and no other source (VRS-GEN-203 §4.7). A parameter not declared makes the steps that depend on it not declared (4.5); a manufacturer that declares a smaller envelope demonstrates a smaller envelope and is scored against it under VRS-FLD-201.
5.3 The declared envelope shall match the one recorded for the rating (VRS-FLD-001, VRS-GEN-009); a step demonstrated at a value other than the declared one shall be inadmissible (4.10).
6 The steps
Columns: ID — Session Record step identifier · Step — outcome to witness · Classes — application classes the step applies to (4.5) · Witness — means (VRS-GEN-203 §3.13) · Apparatus — manufacturer-supplied, at declared value · Bound — minutes · Required by — VRS-FLD-201 subclause(s) served.
6.1 Part 1 — Person-in-zone detection at speed, load and terrain
The intrinsic detection step runs unladen on a reference floor. Here the machine is laden, at working speed, on the worst declared terrain, and the target is a person-sized object entering from the side or lying in the path.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.01 | Human-sized target entering the zone at speed and load. Laden to the declared maximum payload or implement load, at the declared maximum speed on the declared worst terrain sample, a human-sized test target (declared height and width, on a line or trolley) enters the declared protective zone from the side; the machine stops before contact and within marks set at the declared stopping distance for that terrain; the feed shows the stop and its trigger. | all | CAM+FEED+APP | Human-sized test target at declared dimensions on a line or trolley; worst-terrain sample; marks at the declared stopping distance; declared load | 10 min | Required by VRS-FLD-201 §6.2; §6.1 |
| FLD-110.02 | Target stationary in the path, low and prone profile. A prone-profile target (declared low height and length) lies stationary in the path on the worst terrain; the laden machine approaches at the declared maximum speed and stops before contact; repeated with the target partly obscured by the declared vegetation or material height. | all | CAM+FEED+APP | Prone-profile target; declared vegetation or material sample | 8 min | Required by VRS-FLD-201 §6.2; §6.1 |
6.2 Part 2 — Geofence and excursion behaviour
A boundary the machine will not cross — including when it no longer knows where it is.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.03 | Boundary approach and crossing refusal. The machine is driven autonomously toward a configured boundary marked on the ground at three points including a corner; it slows and stops or turns at the declared standoff without crossing; the feed shows the boundary state; a manual command to cross is refused or produces the declared behaviour. | all | CAM+FEED+APP | Boundary marked on the ground at the configured positions | 8 min | Required by VRS-FLD-201 §6.3; §6.1 |
| FLD-110.04 | GNSS-degraded fallback at the boundary. With satellite positioning degraded or denied by the manufacturer’s own means (antenna shrouded, receiver disabled, declared test mode) while near the boundary, the machine enters its declared fallback (stop, hold, dead-reckon to a stop within a declared distance); the feed shows the positioning-quality state and the fallback. | all | CAM+FEED+APP | Manufacturer’s means of degrading positioning | 8 min | Required by VRS-FLD-201 §6.3; §6.8 |
6.3 Part 3 — Slope, rollover and terrain stability
Run at the declared limits only (4.9), laden, with the manufacturer’s inclinometer on camera. No test is run to failure.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.05 | Maximum slope, laden, ascending and descending. Laden to the declared maximum, the machine ascends and descends the declared maximum slope at the declared speed for that slope, stops mid-slope on command and holds without rolling or sliding; slope shown on camera with an inclinometer. | all | CAM+FEED+APP | Slope at the declared maximum with inclinometer; declared load | 8 min | Required by VRS-FLD-201 §6.4; §6.1 |
| FLD-110.06 | Side-slope and soft-ground behaviour. Laden, the machine traverses the declared maximum side-slope at the declared speed without lifting an uphill wheel or track (shown on camera against a reference); on a declared soft-ground sample it either proceeds within the declared sinkage or stops and alerts as declared; where a step or obstacle capability is declared, it negotiates the obstacle at the declared dimension. | all | CAM+FEED+APP | Side-slope at the declared angle; soft-ground sample; obstacle at the declared dimension | 10 min | Required by VRS-FLD-201 §6.4; §6.1 |
6.4 Part 4 — Weather-degraded perception
Extends the intrinsic degraded-sensing step with the outdoor obscurants and light the manufacturer declares; the second step is conditional on the weather at the site.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.07 | Obscured and low-light perception. With the primary sensors obscured to the declared degree (water spray, dust or the declared obscurant applied by the manufacturer’s means) and separately at the declared low-light or glare condition, the machine enters its declared safe state (slow, stop, refuse to start) and the feed shows the perception-quality state and the safe state. | all | CAM+FEED+APP | Obscurant or spray at the declared degree; the declared lighting condition; the manufacturer’s light meter | 8 min | Required by VRS-FLD-201 §6.5; §6.3 |
| FLD-110.08 | Declared weather condition present at the site. Where a declared rain, dust, temperature or wind condition is present at the site and can be shown safely, the machine performs its representative task in it and the feed shows the condition and the machine’s state. | all | CAM+FEED | The site condition; the manufacturer’s meter where applicable | 8 min | Required by VRS-FLD-201 §6.5 — Conditional — recorded as not present otherwise |
6.5 Part 5 — Implement and stored-energy hazards during service
Run where an implement or stored-energy system exists. The hazard in field service is not the drive — it is the deck, the boom, the accumulator.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.09 | Implement lock-out and service-position interlock. The declared implement (mower deck, blade, bucket, boom, sprayer arm) is placed in its declared service position; the declared lock-out is applied and shown; a command to move the implement is refused while locked out; with the service-position interlock open, the machine refuses to drive or run the implement. | all | CAM+FEED | The declared implement and lock-out means | 8 min | Required by VRS-FLD-201 §6.6 — Run where an implement exists |
| FLD-110.10 | Stored-energy isolation. Hydraulic, pneumatic or spring stored energy is isolated and released by the declared procedure from the manual; the gauge or indicator shows zero or the declared safe value on camera; the accumulator or spring cannot move the implement after isolation. | all | CAM+FEED+APP | The machine’s own gauge or indicator | 6 min | Required by VRS-FLD-201 §6.6 — Run where a stored-energy system exists |
6.6 Part 6 — Remote-site recovery and serviceability
Outdoors, on the worst terrain, with the field tool kit only. A machine that can be repaired only in a workshop is unavailable for the season.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.11 | Field module swap in the field. One declared field-replaceable module (sensor, drive, controller, battery or implement drive) is replaced outdoors on the worst terrain with the declared field tool kit only, per the manual; time from video against the declared field-repair time; the machine returns to service. | all | CAM+FEED | Spare module; the declared field tool kit | 15 min | Required by VRS-FLD-201 §6.7 |
| FLD-110.12 | Stranded-unit recovery procedure. With the machine faulted or de-energised on the worst terrain, the declared recovery procedure is walked through and its physical steps performed: brake release or freewheel, tow or lift points shown, recovery mode entered, and the declared alert sent; the machine is moved a declared distance by the declared recovery means. | all | CAM+FEED+APP | The declared recovery means (tow vehicle, winch or lift) and points | 8 min | Required by VRS-FLD-201 §6.7 |
6.7 Part 7 — Link, positioning and tele-operation integrity
Extends the intrinsic lost-link step: at speed, laden, on terrain, with the fail-safe distance marked; and the tele-operation console’s authentication and hand-over.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| FLD-110.13 | Lost link at speed on terrain. Laden, at the declared maximum speed on the worst terrain, the teleoperation or fleet link is cut by the manufacturer’s own means; the machine performs its declared fail-safe (stop, hold, return) within the declared distance, marked on the ground; the feed shows link state and the fail-safe. | all | CAM+FEED+APP | Means of cutting the link; marks at the declared fail-safe distance | 8 min | Required by VRS-FLD-201 §6.8 |
| FLD-110.14 | Tele-operation authentication and take-over. A tele-operation session is started; it requires the declared operator authentication; a second, unauthenticated attempt to take control is refused; a take-over by an authorised second operator follows the declared hand-over; every event appears on the feed and in the log. | all | FEED | Manufacturer’s tele-operation console | 6 min | Required by VRS-FLD-201 §6.8 |
6.8 Timing budget. All 14 steps sum to 119 min. Per class, with every applicable step declared: agricultural 119 min · construction/earthmoving 119 min · mining 119 min · inspection/survey 119 min. Every class is within the 120 min bound of 4.6.
7 Worked example (informative)
A manufacturer of a hypothetical autonomous orchard sprayer (class: agricultural) declares: 2.5 m/s maximum on gravel track, 1.5 m/s on wet grass (worst terrain) and 1.0 m/s on the 15 % maximum slope; 800 kg tank load; a human-sized target of 1 700 × 500 mm and a prone target of 300 × 1 700 mm; 3.0 m stopping distance on wet grass; a 1.5 m boundary standoff with a dead-reckon-to-stop within 5 m on positioning loss; 10° side-slope; 150 mm obstacle capability; a spray-boom implement with a fold-and-pin lock-out and a hydraulic accumulator with a bleed valve; a 30 min field-repair time with the on-board kit; tow points and a freewheel lever with a 20 m tow; lost-link stop within 2 m; and tele-operation by named operator login with a hand-over prompt.
After VRS-GEN-203 Part E the sector steps run from 12:40 on the wet-grass test strip. FLD-110.01: tank full, 1.5 m/s, the 1 700 mm target crosses on a line, stop at 2.6 m against 3.0 m (achieved). FLD-110.02: prone target stationary, stop; half-hidden by 250 mm grass, stop (achieved). FLD-110.03: boundary approached at three points, stops at 1.6, 1.5 and 1.7 m; manual cross refused (achieved). FLD-110.04: antenna shrouded 4 m from the boundary, dead-reckon stop at 3.2 m, positioning state red on the feed (achieved). FLD-110.05: 15 % slope shown on the inclinometer, ascend, descend, mid-slope hold, no roll (achieved). FLD-110.06: 10° side-slope, no wheel lift against the reference; soft plot, sinks 40 mm within the 60 mm declared and proceeds; 150 mm timber crossed (achieved). FLD-110.07: lidar sprayed, slows then stops with a perception alert; at 8 lux on the meter, refuses to start as declared (achieved). FLD-110.08: light rain present, task performed, rain state on the feed (achieved). FLD-110.09: boom folded and pinned, indicator shown, boom command refused; pin out, drive refused (achieved). FLD-110.10: accumulator bled, gauge zero on camera, boom does not move when unlatched (achieved). FLD-110.11: nozzle-controller module swapped on the grass with the on-board kit in 24 min against 30 (achieved). FLD-110.12: machine de-energised, freewheel lever, tow points shown, alert sent, towed 20 m by the yard tractor (achieved). FLD-110.13: link cut at 1.5 m/s laden, stop in 1.4 m against 2 m (achieved). FLD-110.14: operator login required, second console refused, hand-over prompt accepted, four log events (achieved). Sector time 104 min; VRS-GEN-203 Part F follows.
The reviewer scores VRS-FLD-201 §6.2 from FLD-110.01 and FLD-110.02 with GEN-203.09; §6.3 from FLD-110.03, FLD-110.04 and FLD-110.07 with GEN-203.13; §6.1 is confirmed by those marks with Part 3; §6.4 from FLD-110.05 and FLD-110.06 with GEN-203.17 and GEN-203.22; §6.5 from FLD-110.07 and FLD-110.08 with GEN-203.14 and GEN-203.39; §6.6 from FLD-110.09 and FLD-110.10; §6.7 from FLD-110.11 and FLD-110.12 with the intrinsic serviceability steps; §6.8 from FLD-110.04, FLD-110.13 and FLD-110.14 with GEN-203.15 and GEN-203.32. No number in this example is a requirement; every apparatus value came from the manufacturer’s own declaration.
Annex A (normative) — Criterion coverage
Every criterion of VRS-FLD-201 Clause 6 appears once with the intrinsic steps (VRS-GEN-203) and the sector steps (this Protocol) that witness it, or the statement that it has none.
| Criterion | Subclause | Witnessed by |
|---|---|---|
| FLD-1 Anchor conformity | VRS-FLD-201 §6.1 | no step of its own — confirmed by the marks of FLD-110.01, FLD-110.02, FLD-110.03, FLD-110.05, FLD-110.06 (Clause 4.7) |
| FLD-2 Person-in-zone detection and stop at speed and load | VRS-FLD-201 §6.2 | intrinsic GEN-203.09; sector FLD-110.01, FLD-110.02 |
| FLD-3 Zone-boundary enforcement and excursion behaviour | VRS-FLD-201 §6.3 | intrinsic GEN-203.13; sector FLD-110.03, FLD-110.04, FLD-110.07 |
| FLD-4 Slope, rollover and terrain stability at limits | VRS-FLD-201 §6.4 | intrinsic GEN-203.17, GEN-203.22; sector FLD-110.05, FLD-110.06 |
| FLD-5 Weather-degraded perception and fail-safe | VRS-FLD-201 §6.5 | intrinsic GEN-203.14, GEN-203.39; sector FLD-110.07, FLD-110.08 |
| FLD-6 Implement and stored-energy hazards during service | VRS-FLD-201 §6.6 | sector FLD-110.09, FLD-110.10 |
| FLD-7 Remote-site recovery and serviceability | VRS-FLD-201 §6.7 | intrinsic GEN-203.28, GEN-203.29, GEN-203.30; sector FLD-110.11, FLD-110.12 |
| FLD-8 Link, GNSS and tele-operation integrity | VRS-FLD-201 §6.8 | intrinsic GEN-203.15, GEN-203.32; sector FLD-110.04, FLD-110.13, FLD-110.14 |
| FLD-9 Field-context incident record | VRS-FLD-201 §6.9 | no step — scored at the Certified tier from the Verified evidence |
Bibliography
- ISO 18497-1:2024, Agricultural machinery and tractors — Safety of partially automated, semi-autonomous and autonomous machinery — Part 1: Machine design principles and vocabulary.
- ISO 18497-2:2024, Agricultural machinery and tractors — Safety of partially automated, semi-autonomous and autonomous machinery — Part 2: Design principles for obstacle protection systems.
- ISO 17757:2019, Earth-moving machinery and mining — Autonomous and semi-autonomous machine system safety.
- ISO 3691-4:2023, Industrial trucks — Safety requirements and verification — Part 4: Driverless industrial trucks and their systems.
- ISO 12100:2010, Safety of machinery — General principles for design — Risk assessment and risk reduction.
- ISO 3471:2008, Earth-moving machinery — Roll-over protective structures — Laboratory tests and performance requirements.
- ISO 13849-1:2023, Safety of machinery — Safety-related parts of control systems — Part 1: General principles for design.
- ISO 4413:2010, Hydraulic fluid power — General rules and safety requirements for systems and their components.
- ISO 14982:2024, Agricultural and forestry machinery — Electromagnetic compatibility — Test methods and acceptance criteria.
- IEC 62443-4-2:2019, Security for industrial automation and control systems — Part 4-2: Technical security requirements for IACS components.
Change history
| Date | Version | Status | Change | Authority |
|---|---|---|---|---|
| 2026-09-16 | 1.0.0 (draft) | Draft | Created for the VRS 2026 edition (rewrite Batch D; sector demonstration protocol). 14 steps in 7 Parts extending VRS-GEN-203 for the Field & Outdoor criteria of VRS-FLD-201: human-sized and prone-profile targets at speed, load and worst terrain; boundary approach and positioning-denied fallback; maximum slope and side-slope laden with soft ground and obstacle; obscured and low-light perception plus the conditional site-weather sample; implement lock-out and stored-energy isolation; field module swap and stranded-unit recovery timed; lost link at speed and tele-operation authentication. No person in any work zone; stability at declared limits only, never to failure. Annex A covers all 9 criteria. | Rewrite instructions §6 (VRS-XXX-110); sector traceability matrix (FLD derived demonstration steps); CEO ruling 2026-09-15 that standards carry no catalogue identifiers |