Automated Driving In-Plant is a Level 4 (SAE L4) autonomous driving solution that enables driverless movement of new vehicles inside production plants and vehicle logistics centres. It was developed by the Swiss company Embotech in collaboration with BMW Group.
How it works
The solution is based on infrastructure-based autonomy — the intelligence resides in the plant, not in the vehicle. External sensors and a cloud architecture work together with Embotech's perception, prediction and planning software, allowing vehicles to operate in complex industrial environments.
Safety is provided by a separate, deterministic safety architecture, independently certified by TÜV SÜD, which defines and enforces the safety boundary (the basis of the Level 4 certification).
Deployment
The project began as a pilot in 2022 and expanded to four BMW Group sites: Dingolfing, Leipzig and Regensburg in Germany and MINI Plant Oxford in the UK. The system moves approximately 3,500 vehicles per day with more than 99.5% availability, operating 24/7. In October 2026, Embotech and BMW Group announced reaching one million vehicles moved without a driver.
Embotech commercial brand: Automated Vehicle Marshalling (AVM)
Embotech markets this solution commercially as Automated Vehicle Marshalling (AVM); "Automated Driving In-Plant" is the name used by BMW Group. It is the same solution. According to the manufacturer, AVM is the only TÜV SÜD safety-certified solution of its class globally and has run in 24/7 production since 2022.
Centimetre-level vehicle localisation relies on LiDAR scanners mounted in the plant infrastructure — the vehicle needs no onboard sensors or self-driving system. Trajectories are transmitted wirelessly to the vehicle ten times per second. The system handles mixed traffic (with workers, AGVs and forklifts) at certified speeds up to 30 km/h and coordinates the fleet through a Fleet Management System integrated with the plant backend.
The manufacturer also lists further use cases: factory grounds, vehicle logistics centres, logistics yards and valet parking, and — as a development direction — autonomously transporting "skateboard" chassis platforms to production islands in flexible, modular assembly architectures.
A Control Stack is the set of software components responsible for control logic, motion planning, command execution, and coordination of a robot's actuators. It receives high-level goals or waypoints (from planning or AI layers) and translates them into low-level actuator commands, closed-loop feedback control, and safety checks. Common implementations include MoveIt (arm manipulation), Nav2 (mobile navigation), and custom whole-body control stacks for humanoids.
A Perception Stack encompasses the software layers that process data from cameras, LiDARs, IMUs, microphones, and other sensors in order to recognise the surrounding environment, perform localisation, detect and track objects, and interpret the scene. It is typically the first processing stage in an autonomous robot's data pipeline, feeding its outputs to planning and control stacks.
Fleet Management software encompasses tools designed for managing a fleet of robots: task allocation and scheduling, status monitoring, over-the-air (OTA) firmware and software updates, error handling, and multi-unit coordination. It provides a centralised operations layer above individual robot controllers and is critical in warehouse automation, last-mile delivery, and industrial inspection deployments.
The real-time control role describes software responsible for closed control loops executed at a guaranteed, deterministic frequency — typically 1 to 10 kHz for current/torque loops in actuators. Unlike soft real-time, in a hard real-time regime missing a deadline is treated as a system error. Implemented on deterministic kernels (Linux PREEMPT_RT, QNX Neutrino RTOS) or dedicated microcontrollers. Critical for biped balance stability, force control, impedance control and functional safety.
The functional safety role describes software responsible for ensuring that a robot operating alongside humans does not cause harm even in the event of hardware failure, software error or unforeseen environmental event. The safety component implements: deterministic execution of critical tasks (hard timing determinism), fault containment, continuous system integrity monitoring, transitions to safe failure states, and compliance with functional safety standards — IEC 61508 (SIL), ISO 13849 (Performance Level), ISO/IEC TR 5469 (AI in safety systems). It typically runs on an isolated hardware subsystem (e.g. an FSI island) independent of the main compute stack.
Embotech commercial brand: Automated Vehicle Marshalling (AVM). BMW Group plants: Dingolfing, Leipzig, Regensburg, Spartanburg, Debrecen and MINI Plant Oxford; Embotech site in Dübendorf; proof-of-concept with Cariad. Over 1 million vehicles moved driverless, about 3,500 per day, >99.5% availability.
License family: Proprietary – Commercial
No version history.