A warehouse where every layer knows its place
AMR-Agent is a production-grade warehouse automation system built entirely in simulation. A Siemens S7-1500 safety PLC supervises autonomous forklifts — every command, every sensor reading, and every safety decision flows through a rigorously enforced 5-layer architecture. No shortcuts, no crossed wires, no safety over the network.
The project is not about feature count. It's about correct separation of concerns between safety, control, fleet, and autonomy layers — the kind of discipline that keeps real factory floors running.
The 5-layer architecture
Each layer owns its domain and talks only to its neighbors. This isn't a suggestion — it's enforced by 13 locked architecture invariants recorded in the project's ADR 0001.
Layer 1 — Safety (ISO 13849, F-CPU)
The foundation. A Siemens S7-1500F fail-safe PLC runs the F-program — coded processing on the F-CPU, with two-channel input evaluation where the function demands it (the encoder cross-check, dual-channel e-stop). PROFIsafe is the target fieldbus architecture for the field devices. Safety functions — emergency stop, protective stop, safe torque off — are implemented onboard the vehicle and in the F-CPU, never over the network. The system targets PL d (ISO 13849-1) / SIL 2 (IEC 62061), with every safety function documented with a trigger, a reaction, and an acceptance test.
Key principle: The safety program must remain correct if the standard program halts or misbehaves. Wire NC, program NO.
Layer 2 — Teleoperation (S7-1500, OPC UA)
An operator drives the forklift from a commissioning HMI. Every command travels HMI → S7-1500 standard program → bridge → Gazebo simulation, and every state report returns the same path in reverse. The PLC forms all motion setpoints — traction speed, steer angle, fork height — and enforces soft travel limits and speed caps. OPC UA is the fixed-equipment contract (M1): the PLC is the OPC UA server and clients connect to it — never inverted. In the running fleet, master control reaches vehicles over VDA 5050/MQTT only, and the PLC ↔ vehicle link itself is a plain UDP wire.
Layer 3 — Autonomous Navigation (SLAM, Nav2)
The forklift navigates autonomously on ROS 2 Jazzy. A station graph and waypoint router plan each leg; a pure-pursuit follower drives it, shaped around the tricycle's 1.29 m minimum turning radius — stations are entered forks-first and left in reverse, because turning around inside a rack aisle is how a scanner meets a shelf. Three safety laser scanners provide protective and warning fields, and the roof LiDAR guards the path ahead. The PLC issues a motion envelope — enable and speed ceiling — and the navigation loop closes onboard at ~20 Hz. (The first, AI-built stack used SLAM + Nav2 with Reeds-Shepp planning; it remains in the repo as a runnable reference.)
Layer 4 — Fleet Management (VDA 5050, MQTT)
Four forklifts, twelve stations. The fleet manager assigns transport orders over VDA 5050 / MQTT — the industry standard for AGV communication. Traffic conflicts are prevented by reservation — the floor is granted edge by edge as a released base and extended as corridors drain — and pick/drop run as VDA 5050 node actions the trucks themselves report. The PLC owns the fixed equipment (conveyors, doors, chargers); the fleet manager owns order assignment, traffic, and zone reservation. One datum, one owner.
Layer 5 — LLM Supervision
The road ahead (M7). An LLM agent will supervise the running cell in real time: reading the system state, detecting anomalies, and taking safe actions through the fleet layer only. It will never write actuator outputs, never bypass PLC interlocks, and the system will operate normally with the LLM unreachable. The agent will answer natural language queries about cell status, alert operators to issues, and suggest corrective actions — all within the safety envelope defined by the layers below.
See it in action
M6 — VDA 5050 Fleet Management
The fleet on the wire: Four forklifts under one master control, in one uncut take at the warehouse's true speed — the floor from above, the operator's own fleet screen, and the VDA 5050 wire told one readable line per event. Tasks typed at the operator console become orders carrying pick and drop; the trucks report the cycle WAITING → RUNNING → FINISHED and leg 2 follows the report; the floor is reserved edge by edge; a swap deadlock resolves itself by an automatic step-aside.
M5 — Autonomous Driving
Autonomous navigation: Pick a station, press GO — the waypoint router plans the leg, the pure-pursuit follower drives it, and the roof LiDAR guards the path. Three safety laser scanners provide protective and warning fields. The PLC issues a motion envelope — enable and speed ceiling — and the navigation loop closes onboard at ~20 Hz.
M4 — Teleoperation
Teleoperation from HMI: An operator drives the forklift from the commissioning HMI. The S7-1500 forms every motion setpoint. An obstacle entering the lidar stop zone latches a PLC process stop — cleared only by an edge-triggered monitored reset. HMI heartbeat loss zeros all setpoints within the watchdog period.
Milestones
The project advances gate by gate. A gate closes only when its criterion is observable behavior, not written code.
| Gate | Deliverable | Status |
|---|---|---|
| M0 | Repo skeleton, 13 invariants committed | ✅ |
| M1 | VDA 5050 subset, OPC UA node model | ✅ |
| M2 | Safety requirements spec — every function with trigger, reaction, acceptance test | ✅ |
| M3 | Fixed equipment I/O loop — Gazebo ↔ PLC signal bridge, latency measured | ✅ |
| M4 | Forklift commissioning — teleop from HMI, PLC motion setpoints, lidar stop zone | ✅ |
| M5 | Sensored autonomous forklift — safety scanners, SLAM, Nav2, motion envelope | ✅ |
| M6 | VDA 5050 fleet at scale — 4 forklifts, 12 stations, traffic reservation, pick/drop on the wire | ✅ |
| M7 | LLM operations layer + recorded end-to-end demonstration | ⏳ |
| M8 | Beckhoff/TwinCAT vendor portability — same bridge, different PLC | ⏳ |
How it's built
The project was first built end-to-end by an AI orchestrator delegating work to 7 specialist agents — each with a single responsibility and write access only to its own directory, every task starting as a brief, ending as a report, and passing a verifier before the gate advanced. That approach carried the simulation side far: Gazebo, navigation and the ROS 2 ↔ PLC communication bridge came out strong. The PLC design it produced, however, was both overcomplicated and unrealistic. So the safety-PLC layer was redesigned from scratch under human supervision — the PLC ↔ Gazebo loop first isolated and debugged signal by signal, then the whole vehicle reassembled on it in verified steps, each step frozen with its own measured proof. Both builds live in the repo: the AI-built stack remains runnable as a reference, and the human-supervised rebuild is the system in the demos.
| Agent | Owns | Responsibility |
|---|---|---|
| safety-spec | docs/safety/ |
Safety requirements, acceptance criteria |
| interface | docs/interfaces/ |
VDA 5050 messages, OPC UA nodes, handshake tables |
| plc | plc/ |
Standard and safety program, TIA Portal exports |
| fleet | fleet/ |
Fleet manager, MQTT and OPC UA clients |
| agv-ros2 | agv/ |
VDA 5050 client node, Nav2 bridge |
| sim | sim/ |
Gazebo worlds, launch files, test scenarios |
| verifier | read-only | Checks invariants, gate criteria, layer boundaries |
629 files, 236K lines, 16 ADRs, 161 briefs, 160 reports at the July 2026 snapshot — and counting.
Stack
Siemens S7-1500F · TIA Portal · PLCSIM Advanced · PROFIsafe · OPC UA · ROS 2 Jazzy · Gazebo Harmonic · VDA 5050 · MQTT · Python · ISO 13849-1 · IEC 62061
Related content
Deep-dive writing that came out of this project — a video-backed blog series on the fleet layer, and a standalone guide to the certification procedure.
AGV Fleet Management with VDA 5050 (series)
A zero-to-hero series on the VDA 5050 standard, each post paired with a video. From first principles to a working fleet integration.
- Part 1 — What is VDA 5050?
- Part 2 — MQTT Topics & Message Schemas
- Part 3 — Order Lifecycle & State Machine
- Part 4 — Instant Actions & Connection Watchdog
- Part 5 — Fleet Integration, Traffic & Deadlock
Certifying an Autonomous Forklift (series)
A three-part series on the certification procedure for factory-floor autonomous forklifts — Germany/EU, the United States, and a side-by-side comparison.