Whenever a machine works without a rider — in an orchard, a solar farm, a park or beside a road — the first question a buyer asks is also the right one: how does it stay safe around people, animals and property? A spinning cutting deck that navigates on its own is only useful if you can trust it to stop when something is wrong. This field note explains exactly how the safety system on WANJI autonomous mowers is built, what the machine does when a sensor or signal fails, and what the technology can and cannot do. The short version: the machine never depends on a single sensor. Its safety design is a four-layer safety net, and every layer is a backup for the one in front of it.
Why one sensor is never enough
A consumer robot vacuum can afford to bump a chair leg. An autonomous mower cannot afford to bump a person, a vehicle, a fence post or a low cable. Any single sensing technology has a blind spot: satellite positioning disappears under a canopy, a camera struggles in strong backlight, LiDAR can be degraded by heavy rain, and a contact bumper only knows there is an obstacle after touching it. Relying on any one of them alone means a single failure leaves the machine unprotected.
WANJI’s design principle is therefore multi-level redundancy with a cascaded fallback. In normal operation all four layers run at the same time. If a sensor or signal at any layer becomes abnormal, the system gives priority to stopping the machine or switching to degraded operation — risk is never quietly handed to the next layer without action.
The four layers at a glance
Layer 1 — Positioning integrity. “I know where I am.” RTK is checked before the machine trusts its own location.
Layer 2 — Route boundary. “I have not drifted off course.” A deviation beyond 1.5 m triggers a stop.
Layer 3 — Active obstacle avoidance. “Nothing dangerous is ahead.” LiDAR, radar and camera are fused to slow and stop before contact.
Layer 4 — Mechanical fallback. “If I touch something, I stop.” A contact bumper is the last line of defence.
Layer 1: RTK positioning integrity check
The mower follows a pre-planned route using RTK centimetre-level positioning (WANJI mowers use the NAV-L3 multi-constellation, multi-frequency GNSS receiver, with about 2 cm accuracy when it has a clear view of the sky). When the RTK fix is stable, the machine knows with high confidence whether it is inside the working area and whether it is on the prescribed path.
When the signal is affected by trees, buildings, obstructions or electromagnetic interference, the system judges the position as “untrustworthy” rather than guessing. The safety response is deliberately conservative:
• It stops movement first, so it never keeps driving while its own location is uncertain;
• If positioning is not restored for an extended period, it remains stopped and prompts for inspection, resuming only after a trustworthy fix returns.
This is why we are explicit that the machines mow open orchard rows and the corridors between solar panels, and do not claim continuous autonomous operation directly under heavy canopy or solid panels — there is no safe RTK fix to trust. (The options for GNSS-shaded sites are covered in our buyer FAQ.)
Layer 2: route deviation detection
On the premise that RTK positioning is trustworthy, the controller continuously compares its live position against the planned route. If the machine deviates from that route by more than 1.5 metres, it is judged to have left the safe working area or to be behaving abnormally, and it stops immediately.
This layer catches failures that have nothing to do with satellites: positioning drift, wheel slip on wet grass, terrain changes and external interference. Together with the electronic geofence (a virtual boundary that needs no buried wire), it prevents the machine from wandering into roads, water, crops or other non-working zones even if it is still receiving a perfectly good satellite signal.
Layer 3: active obstacle avoidance — LiDAR + radar + camera fused
The third layer perceives the front and surrounding environment in real time using three complementary sensors that cross-confirm one another:
• LiDAR builds precise distance and contour data for nearby obstacles.
• Radar continuously measures object distance and speed, and keeps working reliably in rain, fog, dust and low light.
• Camera provides visual recognition of the obstacle type and the surrounding scene.
When the fused system judges that a collision is imminent, the machine slows down in advance and stops. Unlike a physical bumper, this is an active perception layer: it completes the avoidance before any contact, which both prevents the collision and reduces wear. Because the three sensors cross-confirm, one sensor being temporarily degraded — the camera in strong backlight, or the LiDAR in a heavy downpour — does not disable the layer; radar and the remaining sensors still provide cover.
The layer recognises both static obstacles (posts, trees, equipment, combiner boxes) and dynamic obstacles (a person walking in, a vehicle, an animal). It is not limited by a boundary wire, which is what makes wire-free operation on open sites and irregular fields practical. Multi-sensor cross-confirmation is also what keeps perception reliable at night, in backlight and under tree shade.
Layer 4: the bumper strip as mechanical fallback
The fourth layer is deliberately the simplest. A physical contact bumper strip runs along the mower and requires no algorithm at all. In the abnormal event that the fused perception layer has not triggered in time — an extreme obstruction, a sensor fault — the instant the machine physically contacts an object, the bumper triggers an immediate emergency stop. The response path is extremely short, it works at point-blank range, and it protects both the machine and whatever it touched. It is a last resort, but a last resort that cannot fail because of software.
How the layers take over in sequence
Trigger → action
1 · RTK untrustworthy / positioning abnormal → stop and wait for recovery.
2 · Route deviation over 1.5 m → stop; prevent leaving the work area.
3 · Fused sensors predict a collision → slow in advance, then stop.
4 · Physical contact with an obstacle → instant emergency stop.
The full logic runs like this. Under normal conditions all four layers work simultaneously and the machine follows its planned route. If RTK becomes abnormal, Layer 1 intervenes first, so the machine never drives on untrustworthy positioning. If positioning is normal but the path is abnormal, Layer 2 stops it leaving the area. If the path is normal but an obstacle lies ahead, Layer 3 avoids it in advance. Only if the first three layers all fail to trigger in time does Layer 4, the bumper, provide the final stop.
What happens if one layer fails?
The system is designed around the single-point-failure question from the start. When RTK is untrustworthy, the machine simply will not keep driving on that positioning. Within Layer 3, LiDAR, radar and camera cross-confirm, so one degraded sensor does not blind the whole layer. And if the perception layer itself is abnormal, the 1.5 m route-deviation check and the physical bumper still remain as independent fallbacks. The default action throughout is the same: when in doubt, stop. A stopped machine is safe; a machine guessing its way through uncertainty is not.
What this means on a real site — and the honest limits
Four-layer protection is a serious engineering safeguard, but it is not magic, and we would rather set expectations correctly:
• WANJI mowers run as supervised autonomous machines. The operator plans routes, keeps the work area managed and can always take the 2.4 G remote override; autonomy removes the rider, it does not remove site management.
• Thin low-hanging or overhead wires and cables at height are hard for horizontal sensors to see; such hazards should be secured, marked or pre-mapped during the first site walk (the optional Locator mapping device helps record them).
• Small children and pets should be kept out of an active mowing area just as with any powered garden or farm equipment, per the operator manual. The sensors reduce risk dramatically; they are not a substitute for a fenced site and basic supervision.
• First-time clearing of heavy woody brush is a job for the flail-deck WJ-T-900A, not the all-electric R1; matching the right machine to the vegetation is itself a safety decision.
If you are specifying machines for a public park, a solar O&M contract, a working orchard or a grant-funded project, we are happy to confirm the safety configuration, sensor list and operating boundaries for your exact site in writing.
What does the mower do if it loses the satellite signal under trees?
Layer 1 flags the position as untrustworthy and the machine stops rather than driving blind. If the fix is not restored it stays stopped and raises a prompt; work resumes automatically only when trustworthy RTK returns. Continuous autonomous work directly under heavy canopy is not claimed.
Can it detect people and animals moving into its path?
Yes — Layer 3 fuses LiDAR, radar and camera to recognise dynamic obstacles and slows and stops before reaching them. As with all powered equipment, bystanders and animals should still be kept out of the active mowing area.
Does obstacle avoidance work at night or in rain and dust?
Radar maintains distance and speed measurement through rain, fog, dust and low light, and the sensors cross-confirm, so one sensor being degraded (for example the camera in strong backlight) does not disable avoidance.
How does it avoid leaving the planned work area?
Two independent measures: an electronic geofence virtual boundary with no buried wire, and Layer 2 route-deviation detection, which stops the machine the moment it is more than 1.5 m off the planned route — even if satellite reception itself is fine.
What stops it if every electronic layer misses something?
A physical contact bumper strip, Layer 4, triggers an instant emergency stop on first touch. It needs no software and exists specifically as the last-resort mechanical safeguard.