The Nervous System

4 The Nervous System

Purpose

Physical AI stack focus for this chapter.

Why must a moving machine keep checking its commands when its learned model stops responding?

A learned model can pause for a fraction of a second while it interprets a scene, but the machine carrying it keeps moving, and a loaded base covers tens of centimeters in that pause. Every delay between a decision and the current it becomes is therefore paid in clearance. A general-purpose computer hides such delays behind queues, retries, and priorities. A moving machine cannot, because a command that arrives late acts on a body that has already moved, and a check that waits on the model it checks protects nothing once that model stalls. Treating timing and communication as implementation details produces machines whose safeguards share a processor, a supply rail, or a memory bus with the model they guard, and so fail together with it. A machine that acts on learned decisions therefore needs a timed path between proposal and actuator whose delays are bounded, whose checks never wait on the proposer, and whose grant of authority to each proposal expires on its own. At the causal boundary, time granted to a proposal becomes motion that software cannot recall.

Learning Objectives

• Explain why the permission path’s independence from the proposer is a requirement to be demonstrated rather than a property of separate processors
• Derive update rates and loop placement from actuator time constants, the phase lag of sampling and transport delay, and proposal renewal limits
• Evaluate mailbox exchanges for bounded reads, complete payloads, and proposal freshness when the writer stalls
• Size a chunk lease between the renewal floor and the pre-brake ceiling, and explain why a host heartbeat cannot renew it
• Distinguish measured latency percentiles from response-time bounds that include computation, blocking, and interference
• Compare position, velocity, torque, and impedance commands by what each leaves the permission path to check
• Evaluate interface timing violations using handoff records that distinguish allocated budgets, supporting evidence, and unresolved bounds

4.1 The Multi-Rate Bridge

The running machine joins two computational regimes that run on clocks roughly three orders of magnitude apart. A deep neural network processes camera frames into action proposals over tens to hundreds of milliseconds, with latency that fluctuates from frame to frame. An electric motor drive, by contrast, regulates winding current every few tens of microseconds, in a loop that can never pause because the mass it moves keeps its momentum whether or not a new command arrives. The architectural layer between them, the machine’s Nervous System, routes action proposals downward toward the actuators, streams physical telemetry back up, and arbitrates whether any proposal is permitted to move the hardware. Industrial motion control, avionics, and automotive engineering solved similar coordination problems decades ago for classical feedback controllers whose worst-case execution times were statically bounded before deployment (Kopetz 2011). Learned proposers break those classical assumptions. Their inference latencies have long tails, their software runtimes can stall unexpectedly, and their outputs can fail in ways that cannot be exhaustively enumerated at design time.

This asymmetry sets the chapter’s central design question, which The Cognitive Brain left open with two proposers (a chunk policy and an intent model, either of which can stall, miss its deadline, or misjudge the target). The question is how long the physical plant may keep executing the last valid proposal when an inference step stalls or drops a frame. That duration cannot be an arbitrary software timeout or the proposer’s own schedule; it must follow from the machine’s stopping distance and mechanical limits. Section 4.2 shows why the timed path to the actuators must remain independent of unbounded interference and stalls from deliberative inference, and states the two-processor split that meets this requirement as a hypothesis the machine’s silicon must still confirm under load, while section 4.3 derives the rate of each tier from a physical time constant and passes proposals between tiers through a mailbox that never blocks the faster reader. Section 4.4 then answers the central question with the chunk lease, the bounded interval during which an admitted proposal may keep driving the actuators, priced in the stopping budget, and section 4.5 bounds the computation and the drive network (the fieldbus) on which that price depends. Because bounded timing still requires exclusive control of the actuators and survival under host faults, section 4.6 and section 4.7 keep the permission path the sole writer of the drives and alive when the proposer fails, section 4.8 states the execution contract its checks must meet however fast the proposer runs, and the handoff record of section 4.9 locates every limit at one of five interfaces, coupling this layer’s lease to the stopping distance of the Body and the renewal rate of the Brain.

On the sense-plan-act (S·P·A) triad (The Sense–Plan–Act Paradigm), proposals cross from Plan to Act only through the permission path.

The running machine, the warehouse mobile manipulator, shows the gap concretely. It regulates current through its brushless motor windings thousands of times per second, whereas the vision-language-action (VLA) policies that plan its grasp on a conveyor-belt mug need orders of magnitude longer to evaluate each frame. If motor regulation ever blocks on deliberative reasoning, or contends for shared memory without a bound on its wait, a heavy inference burst can push the control loop past its hard deadline. Moving mass and electromagnetic coils force one conclusion. The Brain needs time to deliberate, while the Body needs continuous control.

Coupling these domains across a shared blocking execution path forces the fast loop to inherit the tail latency of the slow one. If the motor control loop stalls waiting for inference or drains an outdated FIFO queue of stale setpoints, the resulting actuation commands arrive at a physical body that has already moved past the target state. Unmanaged transport delay (\(\PureTransportDelay\)) also injects phase lag directly into the feedback loop, adding \(\DelayPhaseLag = \AngularFrequency \PureTransportDelay\) radians at angular frequency \(\AngularFrequency\). That lag erodes the loop’s phase margin, the extra lag it can absorb before its corrections start to reinforce the motion instead of damping it (made precise in section 4.3.1). The Nervous System must bound these end-to-end transport delays deterministically while ensuring that high-rate local control remains autonomous whenever high-level deliberation stalls.

Each tier runs at least ten times faster than the one above it, and none may wait on a slower one.

To enforce this isolation, the Nervous System splits work across four tiers, separating what each tier controls alongside how often it runs. Each tier runs decoupled from the tiers above it, so fast safety and stabilization loops never wait on slower deliberative tiers:

1. Actuator current and velocity regulation: Dedicated motor drives close the inner winding-current and joint-velocity loops locally in hardware. Field-oriented control (FOC)¹ aligns the stator voltage vector with the rotor’s magnetic flux in every carrier period (the switching period of the drive’s pulse-width modulation, or PWM), so the winding produces the commanded torque within a few current-loop samples.
2. Permission and position supervision: The deterministic real-time supervisory controller verifies proposal freshness and kinematic limits, sends admitted position setpoints across the fieldbus, checks tracking error against physical safety envelopes, and commands a fail-safe stopping trajectory if proposal authority expires.
3. Action-chunk policy: The learned mid-level policy emits a short sequence of future waypoints (an action chunk), giving local controllers a continuous motion segment to track between discrete inference steps.
4. Intent planning: Slower vision-language or task-planning models read camera frames and language instructions to set high-level goals, steering the action-chunk policy without directly touching drive setpoints.

¹ Field-Oriented Control (FOC): The drive rotates the three measured phase currents into a frame that turns with the rotor’s magnetic field, where torque and flux become two slowly varying currents that ordinary proportional-integral loops can hold. The rotation needs a fresh rotor angle in every carrier period, so the loop cannot wait on anything slower than its own sensors. That is why the current loop runs inside the drive, beside the encoder and the current shunts, and why no proposer, however fast, ever sits inside it.

Section 4.3.1 gives each tier its rate, while one rule holds all four together and comes first: a stalled or crashed proposer must never block or delay a lower tier’s checks. Conventional computing architectures break that rule because they rely on shared processors, unified memory buses, and multi-level caches managed by general-purpose operating systems. In such environments, hardware isolation is weak. When a large deep neural network streams gigabytes of model weights from DRAM across a shared memory fabric, its high-throughput direct memory access (DMA) bursts contend directly with real-time telemetry and control packets. Because hardware bus transactions cannot be preempted by software thread priorities, control packets queue up at the memory controller. A control path that shares an execution environment with machine learning runtimes is also exposed to operating-system jitter, because kernel page faults, garbage collection cycles, driver interrupts, and thermal frequency throttling can each stall execution for tens of milliseconds. Physical stability therefore demands an architecture in which local control loops keep updating the actuators on schedule whatever delays the inference path suffers.

Learned proposers need tens to hundreds of milliseconds to convert raw camera frames into spatial action plans. In the physical domain, an electromagnetic motor winding has an electrical time constant (\(\ElectricalTimeConstant = \PhaseInductance/\PhaseResistance\)) of a few milliseconds, 2.7 ms for the running machine’s direct-drive hub motors (Electrical time constants, back-EMF, and current clamping), while its moving links carry substantial kinetic energy (\(\KineticEnergy = \frac{1}{2} \Mass \BodySpeed^2\)). Delaying or dropping an actuation command by a fraction of a second can exhaust the clearance before a new inference cycle finishes. On the warehouse robot the mismatch appears in two mechanical domains:

• The base (Class 1) cruises at up to its 1.5 m/s drive limit (illustrative; see the Reader Guide). At this speed, it travels 60 mm during a single 40 ms action-chunk inference, and 503 mm across one 336 ms intent-model inference cycle. Unless an independent supervisory process monitors plant telemetry and commands braking, the chassis travels half a meter open-loop before deliberative planning produces an updated command, nearly half the rack-end clear distance on the machine card.
• The arm (Class 2) couples motor rotors to joints through high-ratio gearboxes, reflecting rotor inertia back to the joint output as \(\GearReductionRatio^2 \RotorInertia\), the scaling derived in Reflected rotor inertia and optimal inertia matching. The drives keep closing their own joint loops when the proposer stalls, but they keep tracking the last admitted command. If that command was set for a grasp on a conveyor mug or a turn of a door latch the scene no longer matches, the reflected inertia and the drives together keep pressing the mechanism into the contact, and contact forces escalate rapidly. Whether this interaction breaches structural limits depends on the contact compliance, surface friction, and mechanical response times alongside the reflected inertia.

↩︎ The intent model’s inference latency, priced from its compute-bound prefill and its bandwidth-bound weight sweeps, is established in The memory wall.

Software discipline, operating system thread priorities, and runtime exception handlers cannot by themselves keep the plant safe. Safety requires an explicit, physically deterministic computing, memory, and communication fabric. That fabric forms the Nervous System of the five-level machine model (The Machine in Five Levels), hosting the dedicated permission path so the physical plant retains a measured, feasible response whenever higher-level inference pauses or fails. Its primary design requirement is an interface whose temporal bounds, command authority, and fault responses can be verified directly against the machine’s physical safety budget; enforcement algorithms later turn these requirements into per-tick admission decisions, while the mechanisms of this layer fix the contracts those decisions must satisfy.

↪ The per-tick admission decisions that must satisfy these contracts are developed in The Per-Tick Gatekeeper.

4.2 The Independence Requirement and the Two-Processor Hypothesis

When an inference model suffers a transient stall or drops a frame, the robot can safely reject the stale proposal and fall back to local control; when a permission check stalls, however, the delay burns directly through the machine’s stopping budget, regardless of whether the processor eventually catches up. The two workloads therefore optimize for different guarantees. A neural chunk policy needs high compute throughput and memory bandwidth to stream motion proposals at its target renewal rate, whereas the permission path needs a strict, provable upper bound on the time required to validate and dispatch each step.

Standard operating-system schedulers decide which ready task executes next, but software priority alone cannot guarantee deterministic timing. Raising a control task’s priority reduces processor contention, yet it cannot prevent microarchitectural delays. A sudden page fault suspends execution while the virtual memory subsystem resolves the missing page; lock contention on shared kernel primitives leaves a real-time thread waiting behind uncritical background tasks; and memory requests stall at the arbiter while DMA transfers from a GPU or neural accelerator saturate the system interconnect. Long inference latency tails² therefore threaten closed-loop stability even when average proposal latency remains well within nominal bounds.

² Inference Latency Distribution: The median and \(\text{p99}\) alone do not fix the exceedance probability at a given deadline, which must be measured or modeled separately. Tail-model assumptions and exceedance estimates require representative workload data and an account of dependence and uncertainty; Extreme Value Theory and Tail Risk develops these conditions.

³ Worst-Case Execution Time (WCET): A static WCET is a bound proved over every path through the binary and every state the processor’s caches and pipeline can be in; analyzers compute it by abstract interpretation of the code against a model of that hardware (Wilhelm et al. 2008). Caches, branch predictors, and shared buses make that model either pessimistic or intractable, so a timed path earns a tight bound by avoiding them. The bounded sources listed in section 4.5.1 therefore favor tightly coupled memory and fixed pipelines, giving up average speed for a bound that analysis can prove.

Wilhelm, Reinhard, Jakob Engblom, Andreas Ermedahl, Niklas Holsti, Stephan Thesing, David Whalley, Guillem Bernat, et al. 2008. “The Worst-Case Execution-Time Problem: Overview of Methods and Survey of Tools.” ACM Transactions on Embedded Computing Systems 7 (3): 36:1–53. https://doi.org/10.1145/1347375.1347389.

Timing guarantees throughout this chapter use the standard terms of real-time scheduling (Buttazzo 2011; Kopetz 2011), where each term names a part of the permission tick’s cycle. The permission tick runs as a periodic task \(\RealTimeTaskIndex\) released once every period \(\TaskPeriod_i\), set here to 1 ms. Each release is a single job that must finish before its relative deadline \(\TaskRelativeDeadline_i\), measured from the release instant and set here to 400 μs. The deadline is shorter than the period so that each admitted setpoint is ready within the cycle that computed it rather than one tick later, a delay whose cost section 4.3.1 prices, and so that the rest of the period stays free for lower-priority work. A deadline is hard when a single miss can cause a physical hazard, as on the permission tick, where one late check adds one more millisecond of unchecked motion. The total wall-clock time from task release to job completion is its response time \(\WorstCaseResponseTime_i\), and the part of that response time spent running the task’s own instructions is bounded above by its worst-case execution time (WCET)³ \(\WorstCaseExecutionTime_i\).

Definition 4.1: Worst-case execution time

Worst-case execution time is the longest time a task can take to run to completion on a given processor, over every admissible input and every state its caches, pipeline, and buses can be in, with no other task competing for the processor.

1. Significance: It is the \(\WorstCaseExecutionTime_i\) term of every response bound in this chapter, and every margin above it is sized on it. The permission tick declares 250 μs against an unloaded run of 135 μs, so the 115 μs between them is a claim that analysis must justify before the 400 μs deadline, and the stopping budget behind it, can rely on the number.
2. Distinction: Unlike a mean or a high percentile such as \(\text{p99}\), which describe the executions a test happened to reach, the WCET covers every admissible path and processor state. A declared WCET is a third quantity, a number the design commits to, which evidence must show is no smaller than the true one.
3. Common pitfall: Recording the largest measured execution time as the WCET. A measured maximum can refute a declared bound but never establish it, because a test campaign reaches only some of the processor states in which the code can run (Wilhelm et al. 2008).

The rest of the response time is spent waiting rather than running. Blocking \(\TaskBlockingTime_i\) is the time a task spends waiting for a lower-priority task to release a shared hardware or software resource, whereas interference \(\TaskInterferenceTime_i\) is the time taken by higher-priority tasks, kernel interrupts, and exception handlers that preempt the job. Because blocking and interference vary from one release to the next, the exact timing of recurring events shifts from cycle to cycle, a variation called jitter. Task releases, sensor samples, and job completions each have their own jitter, so a tick released on schedule can still miss its completion deadline if its internal wait times fluctuate. Later, section 4.5.1 combines \(\WorstCaseExecutionTime_i\), \(\TaskBlockingTime_i\), and \(\TaskInterferenceTime_i\) into a provable bound on \(\WorstCaseResponseTime_i\).

Placed on one axis, the terms separate an illustrative unloaded observation from the bound the schedule assumes (figure 1). The unloaded run of 135 μs is an illustrative observation, not a reported measurement; the 115 μs above it, up to the declared 250 μs, is a claim that WCET analysis must certify; and the slack from there to the 400 μs deadline is all the room left for blocking and interference. Underneath, the base covers 1.5 mm during every tick at its 1.5 m/s drive limit, so each of these microsecond terms is ultimately paid in millimeters.

Figure 1: One permission tick: A job is released at the start of each 1 ms period and must finish by its 400 μs deadline. The unloaded run of 135 μs is an illustrative observation, not a reported measurement; the declared WCET of 250 μs is the bound the schedule assumes, and the hatched 115 μs between them is what WCET analysis must justify. The slack to the deadline is the budget for blocking and interference. The bottom row counts the base’s travel on the same axis, 1.5 mm per tick at the 1.5 m/s drive limit.

Blocking introduces an architectural vulnerability that priority schemes alone cannot resolve. In priority inversion, a high-priority task waits for a shared resource held by a low-priority task, while medium-priority tasks that need no shared resource preempt the lock holder and so starve the high-priority task for as long as they run. Only a real-time locking protocol, such as priority inheritance or priority ceiling emulation, can bound that wait. The recurring resets of the 1997 Mars Pathfinder spacecraft are the canonical case of an inversion left unbounded; war story 4.1 in section 4.5.1 traces it once the response-time bound it violated is in hand.

POSIX real-time extensions (such as SCHED_FIFO priority scheduling and memory locking via mlockall()), real-time Linux kernels (PREEMPT_RT), and dual-kernel architectures (such as Xenomai) target specific software sources of delay. Locking physical memory via mlockall() eliminates demand paging inside the timed control loop; assigning processor affinity confines threads to specific CPU cores to avoid migration latency and cache thrashing; and priority inheritance elevates a low-priority lock holder’s priority whenever a high-priority task requests its mutex. These operating-system mechanisms, however, guarantee determinism only when supported by proper configuration, bounded system calls, and verified timing evidence.

↪ The scheduling, interrupt, and memory mechanisms whose formal contribution enters a response bound are developed in Real-Time Timers, Watchdogs, and Schedulability.

Shared hardware introduces delays that operating-system software priorities cannot control. A control task cannot read an optical encoder buffer while a high-bandwidth peripheral monopolizes a shared PCI Express (PCIe) link or system memory bus. Any physical infrastructure that two processing domains share, whether system memory, power regulation, a thermal path, or a reference oscillator, can delay or silence the permission path without a single software fault. Cataloging those physical couplings and gathering the evidence required to verify their isolation belongs to placement (Two Paths and the Resources They Share). The requirement that analysis tests can be stated now. Under any workload the proposer can generate, the permission path must meet its response bound and keep its authority to refuse an unsafe motion. This chapter calls that requirement independence.

The running machine meets the independence requirement by putting the two paths on two processors, a hypothesis it must still test (figure 2). An application processor runs perception, the 2 Hz intent model, and the 20 Hz chunk policy. A separate safety microcontroller unit (MCU) runs the permission path and alone drives the motors. Between them runs a board link, a serial peripheral interface (SPI) or Controller Area Network with Flexible Data-rate (CAN FD) bus carrying framed packets with cyclic redundancy checks (CRCs) and sequence numbers. The link is treated as a black channel, one the endpoints do not trust, so each frame carries its own integrity and timing checks (section 4.4.1). The two paths share no processor cores, caches, or memory buses, and the learned proposers on the host have no memory-mapped input/output (MMIO) access to the drive registers. Candidate chunks cross the link into the MCU’s own SRAM through a double buffer. A receive DMA transfer fills a private receive buffer, and the receive interrupt copies each checked frame into a single mailbox slot guarded by a sequence lock, or seqlock, whose protocol section 4.3.2 develops. A 1 kHz permission tick reads that slot, checks each proposal’s freshness, lease, and kinematic limits against measured encoder feedback, and is the only code that can send an admitted setpoint to the drives. The host is an unprivileged client; the microcontroller, with a short and cycle-counted loop, is the part whose worst-case execution time can be bounded.

Physical separation onto separate chips represents one realization. A single system-on-chip can also host both paths, provided that on-chip interconnects, cache partitioning, and memory controllers demonstrate equivalent response bounds and fault containment under stress. Choosing between discrete silicon and partitioned on-chip cores is the central placement trade-off, and until loaded experiments settle it, physical separation remains a foundational design hypothesis. Scheduling both paths on shared processor cores introduces the problem of mixed-criticality scheduling, in which each task carries execution-time bounds of graduated assurance levels and the operating system guarantees each deadline only under the bound its own criticality demands, allowing the proposer to overrun while the permission path executes deterministically (Vestal 2007). Sharing memory on a single die also demands explicit memory-bandwidth regulation to prevent tensor accelerators from starving real-time safety routines.

Vestal, Steve. 2007. “Preemptive Scheduling of Multi-Criticality Systems with Varying Degrees of Execution Time Assurance.” IEEE International Real-Time Systems Symposium (RTSS), 239–43. https://doi.org/10.1109/RTSS.2007.47.

↪ Mixed-criticality scheduling, memory-bandwidth regulation, and the other remedies for shared-die contention are developed in Silicon Isolation Decisions.

Figure 2: The two-processor implementation: The application processor runs the learned proposers and has no access to the drive registers. Proposals cross a black-channel board link as framed packets into a double buffer in the microcontroller’s own memory. The receive DMA fills a private receive buffer, and the receive interrupt copies each checked frame into the seqlock-guarded mailbox slot, so the processors share no memory. The permission tick reads the latest proposal, checks it against measured state, freshness, and the lease, and sends only an admitted command to the drives, which close their own current and velocity loops. Measured state returns to the application processor as telemetry over the same link.

Designating an embedded controller as a safety microcontroller claims far more than physical separation on a circuit board. It denotes a device developed, qualified, and assessed under the IEC 61508 functional-safety standard, accompanied by a safety manual specifying its certified integrity level and the operational conditions that support depends on (International Electrotechnical Commission 2010b). At the silicon level, a safety MCU integrates specialized hardware redundancy to detect internal faults autonomously: dual processor cores execute in lockstep while a comparator flags divergent execution; error-correcting codes (ECC) protect internal SRAM and flash memories against single-event upsets; a hardware memory protection unit (MPU) confines each task to its assigned memory range; and analog monitors continuously watch the clock and supply voltages. Built-in self-tests run at power-up and periodically during operation to verify internal logic. An external watchdog timer, clocked by its own oscillator and serviced within a strict time window or through challenge-response messages, monitors the core. Because the watchdog relies on an independent clock source, a physical fault that stops the microcontroller’s oscillator cannot stall the watchdog, allowing it to detect that silent processor failure and command a qualified out-of-band response. Successful physical containment still depends on the response path, its surviving power, and the actuator premises.

International Electrotechnical Commission. 2010a. IEC 61508:2010: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems. International Electrotechnical Commission.

International Organization for Standardization. 2023. ISO 13849-1:2023: Safety of Machinery, Safety-Related Parts of Control Systems, Part 1: General Principles for Design. International Organization for Standardization.

Two different protections meet at this microcontroller, and keeping them apart explains the standards that follow. The chunk lease protects the stopping budget against a proposer that stalls or misbehaves. The rated claim that the machine will not strike a person rests elsewhere, on the independent protective path of Delay consumes stopping clearance (a certified safety scanner wired to the drives, with its own sensing, timing, and power) and on the drives’ certified stop functions. Hardware diagnostic features alone do not confer a safety rating on the robot. Under functional safety standards, integrity belongs to a specific safety function, such as revoking actuator authority when a lease expires, rather than to an individual chip. The industrial standard IEC 61508 classifies safety functions by Safety Integrity Level (SIL 1 through SIL 4), where each numerical increment demands approximately an order-of-magnitude reduction in the allowable rate of dangerous failure (International Electrotechnical Commission 2010a). The machinery standard ISO 13849-1 grades safety functions by Performance Level (PL a through PL e) (International Organization for Standardization 2023). A Performance Level combines four architectural factors: the structural Category (ranging from single-channel architectures using well-tried components in Categories B and 1, through single channels with periodic diagnostic testing in Category 2, to dual-channel redundant designs in Categories 3 and 4 where no single hardware fault defeats safety enforcement); component reliability, quantified as the mean time to dangerous failure; diagnostic coverage, defining the fraction of dangerous failures detected by internal testing; and physical defenses against common-cause failure, where a shared disturbance disables redundant channels simultaneously. The safety microcontroller contributes certified failure rates and diagnostic coverage to this calculation, while the target Performance Level is dictated by the severity and exposure of the physical hazard the safety function must mitigate.

↪ The Performance Level each certified stop and speed function of the running machine must reach is developed in Certified safety functions beneath the permission path.

The physical architecture of the robot makes a deliberate engineering trade-off that functional safety certification must evaluate. Its permission path executes real-time performance tasks, validating trajectory proposals and interpolating admitted waypoints into drive setpoints, alongside the safety function intended for qualification: revoking actuator authority and commanding a safe stop when a chunk lease expires or the host heartbeat falls silent. The algorithmic admission checks themselves carry no formal safety rating, which is why the protective claim stays with the scanner and the drive stop circuits (Certified safety functions beneath the permission path). Standard functional-safety practice keeps complex control algorithms out of the certified safety channel, relying instead on an independent monitoring channel to satisfy Category 3 and Category 4 redundancy requirements. Modern motor drives supply part of that second channel through integrated hardware safety functions such as Safe Stop 1 (SS1), which brakes the motor under drive control and then removes torque.

↪ How Safe Stop 1 and the other drive safety functions realize the industrial stop categories is developed in Industrial stop categories and the safe torque off trap.

Any hardware split must keep the permission path the sole writer of the actuators and bound its check time across all expected hardware and software faults. Putting the two paths on separate chips is the cleanest way to start, though empirical timing evidence under load must still confirm that isolation. Separate processors, however, run on asynchronous clocks at very different rates, so the link between them must pass trajectory updates continuously without ever forcing the fast permission reader to wait on the slower host writer.

4.3 Multi-Rate Cadences

A motor drive cannot wait for the next camera-based proposal before regulating winding current. Conversely, forcing a learned policy to evaluate at current-loop rates wastes compute without generating fresher sensory observations. Decoupling these cadences allows each workload to meet its distinct physical or computational deadline, provided the boundary interface preserves data freshness and never blocks local real-time control.

4.3.1 Physical time constants and sampling phase lag

The mobile manipulator’s motor inverters regulate winding current every 50 μs (20 kHz), while its chunk policy requires 40 ms at p99 latency to ingest camera frames and generate an action chunk. No single cadence can serve both the winding’s electromagnetic dynamics and the cost of deep visual inference. The four tiers named in section 4.1 therefore each take their rate from a different time constant:

1. Inner Commutation and Current Loop (20 kHz, 50 μs cycle): The PWM carrier frequency, selected to balance switching losses, current ripple, and acoustic noise, fixes the sampling instants. Phase currents are sampled once per carrier period at its midpoint, so a 20 kHz carrier yields \(\SamplingPeriod =\) 50 μs. The stator winding’s electrical time constant establishes the plant pole that the current regulator must compensate. For the hub motors, \(\ElectricalTimeConstant = \PhaseInductance/\PhaseResistance =\) 2.7 ms (Electrical time constants, back-EMF, and current clamping) places that pole near 59 Hz. The closed-loop current bandwidth is tuned well above this pole and at least a factor of ten below the sampling rate, reaching at most about 2 kHz (Franklin et al. 1998). This loop executes directly within drive silicon and commands electromagnetic torque through the motor controller.
2. Permission and Position-Supervision Tick (1 kHz, 1000 μs \(\pm\) 10 μs cycle): The rate here is set by distance rather than by a plant pole. Each tick of detection delay is base travel the stopping budget must absorb, and each tick must also supply the drives a fresh position setpoint. At one tick per millisecond both demands are met with the margins quantified below, while the drives close the subordinate velocity and current loops.
3. Action-Chunk Policy Stream (20 Hz, 50 ms cycle): Bridging observation age and mechanical execution, the local policy emits receding-horizon action chunks (\(\ActionChunkHorizon =\) 16 waypoints spaced 25 ms apart). On this machine, the policy is a compact visuomotor network following the Action Chunking with Transformers (ACT) architecture, which decodes an entire chunk in a single forward pass; Action chunking priced it against the iterative diffusion and flow-matching heads that trade more passes for expressiveness. Each pass must stream the model’s weights from memory on the application processor’s accelerator, which caps the pass rate near \(\PolicyPassRate \le \SustainedMemoryBandwidth/\WeightMemory\). Because one pass yields all 16 setpoints, that sweep is paid once per chunk rather than once per setpoint, which is what lets the policy renew at this rate.
4. Multimodal Intent Planner (2 Hz, 500 ms cycle): A high-capacity VLA model turns camera frames and a natural-language instruction into task goals and navigation targets. Its period is set by the prefill and weight sweeps of The memory wall, not by any plant dynamics, which is why it may steer the chunk policy but never hold a chunk lease, the authority to keep driving the actuators that section 4.4 sizes in tens of milliseconds.

The two proposer cadences reflect mainstream action-chunking and VLA architectures as of 2026, and their frequencies will shift as models and accelerators evolve. The method developed below does not depend on them. It anchors the lease’s lower limit to what the proposer can supply and its upper limit to the physical stopping budget.

The current-loop rate follows directly from the winding’s electrical time constant \(\PhaseInductance/\PhaseResistance\), and the loop closes within the drive’s local inverter. The harder timing question arises one level up, at the joint. There, inertia and structural compliance set the required closed-loop bandwidth, and every digital stage between sensor and actuator (sampling, computation, bus transport) exacts a penalty in phase lag. The crossover frequency \(\CrossoverFrequency\) marks the point where open-loop gain equals unity. At this frequency, the phase margin⁴ defines the maximum additional phase lag the system can absorb before feedback transitions from stabilizing attenuation to self-reinforcing oscillation.

⁴ Phase Margin: Bode (1945) introduced gain and phase margins to measure how far a feedback amplifier sits from instability, turning the stability criterion of Nyquist (1932) into a practical design margin. In cyber-physical loops, delay erodes the modeled phase reserve and can destabilize the loop under its nominal assumptions. Establishing actual damping and stability requires the complete sampled plant, compensation, and timing response. Because a pure transport or compute delay \(\PureTransportDelay\) subtracts \(\CrossoverFrequency \PureTransportDelay\) radians of phase regardless of cause, bus cycles, compute stages, and zero-order holds all draw from the same finite phase budget.

Bode, Hendrik W. 1945. Network Analysis and Feedback Amplifier Design. D. Van Nostrand Company.

Nyquist, Harry. 1932. “Regeneration Theory.” Bell System Technical Journal 11 (1): 126–47. https://doi.org/10.1002/j.1538-7305.1932.tb02344.x.

Excess phase lag causes corrective control torques to arrive out of phase with physical joint motion, eventually turning stabilizing negative feedback into unstable positive feedback (Nyquist 1932). Closing a feedback loop across the permission tick accumulates three distinct sources of latency. The discrete sample-and-hold introduces an effective transport delay equal to half the sample period (\(\SamplingPeriod/2\)); the enforcer requires compute time (\(\EnforcerComputeTime\)) to evaluate constraints; and the resulting command incurs fieldbus transit latency (\(\CommandTransportTime\)) before reaching the drive. Because a pure delay \(\PureTransportDelay\) removes \(\AngularFrequency \PureTransportDelay\) radians of phase across all frequencies, these stages collectively erode the phase margin at crossover according to equation 1, the total-delay relation given in Discrete-time sampling and zero-order hold phase lag: \[\DelayPhaseLag = \CrossoverFrequency\left(\frac{\SamplingPeriod}{2} + \EnforcerComputeTime + \CommandTransportTime\right) \tag{1}\]

Consider an illustrative joint-loop crossover of 20 Hz and a design phase erosion allowance of 5\(^\circ\). A 1 ms tick’s sample-and-hold accounts for 3.6\(^\circ\), which fits comfortably within the budget. However, the 1 ms fieldbus transit cycle contributes 7.2\(^\circ\) on its own, and the enforcer’s declared worst-case execution time of 250 μs adds another 1.8\(^\circ\). The combined delay of 1.75 ms imposes 12.6\(^\circ\) of phase lag, 2.5× the allowance. If the controller delays output release until the subsequent tick boundary, total phase erosion escalates to 18\(^\circ\) over 2.5 ms. Because the phase budget tolerates at most 0.69 ms of total delay, less than a single bus cycle, no increase in tick frequency can keep a 20 Hz loop closed across this communication bus within its erosion allowance. The loop might remain stable, but it would spend phase margin the design never allocated to delay. Given 1.75 ms of unavoidable transit and processing latency, a 1 ms tick stays within the chosen phase erosion allowance only at crossover frequencies no greater than 7.9 Hz. Reducing the tick rate to \(500\text{ Hz}\) increases the sample-and-hold penalty alone to 7.2\(^\circ\), whereas driving the tick frequency toward infinity still leaves the bus transport penalty untouched. Loop placement, rather than clock scaling, resolves this architectural constraint.

The bus cycle alone spends more phase than the loop can spare.

Consequently, the machine closes its high-rate joint velocity and current loops directly within the decentralized motor drives, where co-located encoder sampling bypasses the fieldbus entirely. The centralized 1 ms permission tick operates strictly as a supervisor and trajectory setpoint generator. This decouples the tick from joint-level phase margin constraints, replacing them with two distinct systems requirements. First, as a safety supervisor, each millisecond of detection delay incurs 1.5 mm of unbraked base travel at maximum drive velocity, directly consuming clearance from the stopping budget (notebook 4.1). Second, as a setpoint source, the tick must evaluate the admitted trajectory frequently enough to supply smooth kinematic references to the drives. Transport delay along this reference path introduces tracking lag rather than eroding the drive loop’s phase margin, because the reference sits outside the feedback loop. Any outer supervisory corrections closed across the bus, such as cartesian compliance trims, must restrict their crossover bandwidth below 7.9 Hz.

Closing those loops in the drive is a hardware arrangement rather than merely a firmware setting. The fastest loop sits beside its sensor and its switch, so phase current is measured and switched next to the winding with no host processor in the loop, and dedicated PWM timers in the same silicon enforce the gap between complementary switch transitions that keeps the power bridge from shorting.⁵ The running machine’s brushless hub drives follow this arrangement at a larger scale; the small stepper-motor driver of figure 3 shows it on one chip.

⁵ Dead-Time Delay: The interval in which both switches of a half-bridge leg are off, so the leg never shorts the DC bus, is the inverter dead time introduced in Electrical time constants, back-EMF, and current clamping. Dedicated pulse-width modulation timers insert it in hardware (\(100\text{--}500\text{ ns}\)) on every transition, and drive firmware applies online volt-second compensation for the voltage error it introduces.

Figure 3: Integrated motor-driver silicon: A Trinamic TMC2209 stepper-motor driver in a quad flat no-lead (QFN) package, with a low-value current-sense resistor (marked R110) beside it on the board. The chip carries its own power transistors and current regulation, so the winding current is measured and switched next to the motor it drives rather than by the host processor. A photograph shows the placement; the timing of the current loop is a property of the silicon that the datasheet and measurement must establish. (Photo: Phiarc, Wikimedia Commons, CC BY-SA 4.0).

Perception pipelines feeding the policy stream execute at intermediate cadences constrained by optical physics, sensor exposure durations, and relative scene velocity. In a typical \(300\text{ lux}\) warehouse lighting environment requiring a 15 ms exposure, the robot base traveling at its 1.5 m/s drive limit covers \(\ExposureTravelDistance = \SpeedAtDetection\,\ExposureDuration =\) 22.5 mm while the shutter is open. Resulting image-plane blur interacts with scene depth and optical geometry, setting physical limits on feature tracking. The achievable signal-to-noise ratio, spatial motion blur, and image preprocessing latency jointly establish the feasible sensing cadence for visual control, a trade-off Sensor Perception develops. For the permission path the exposure matters as time. An observation is dated at its exposure midpoint, so half the exposure is already part of its age before any processing begins, and that age is the first interval the lease budget must charge (table 1).

The chunk-policy generation rate must satisfy the proposal-supply budget set in Action chunking. For our mobile manipulator, a 20 Hz renewal cycle paired with an \(\ActionChunkHorizon =\) 16 waypoint horizon (Zhao et al. 2023) bridges visual perception and high-rate actuation. The 50 ms renewal period matches 2 discrete setpoint steps of 25 ms, so every scheduled renewal lands on a setpoint boundary, provided the handoff between the two clocks never makes the faster reader wait.

Zhao, Tony Z., Vikash Kumar, Sergey Levine, and Chelsea Finn. 2023. “Learning Fine-Grained Bimanual Manipulation with Low-Cost Hardware.” Robotics: Science and Systems (RSS). https://doi.org/10.15607/RSS.2023.XIX.016.

4.3.2 Lock-free and wait-free mailbox exchanges

If a 1 kHz safety loop blocks on a mutual exclusion lock held by a 20 Hz neural network runtime, one page fault or scheduling hiccup in the runtime becomes an unbounded priority inversion, and the hard real-time controller misses its cycle deadline. Because the tiers run on different processors at different rates, every exchange across a rate boundary must give the faster reader bounded, nonblocking access. Panel (b) of figure 4 follows the remedy developed here, the mailbox, through a clean exchange, a write preempted by the tick, and a stalled host, and in none of the three does the reader wait. Panel (a), which shows what the tick does when the proposer stops renewing altogether, returns in section 4.4 once the lease that governs it is defined.

Standard inter-process communication libraries rarely provide deterministic execution bounds out of the box. Message serialization, dynamic memory allocation, intermediate queueing, and thread scheduling can each introduce unpredictable delivery stalls. While shared memory eliminates buffer copying and kernel context switches, it requires concurrency controls to prevent the reader from ingesting partially written, inconsistent command payloads. The communication protocol must strictly bound the consumer’s execution time, even when the producer stalls at the most unfavorable point in its write cycle.

While a first-in, first-out (FIFO) queue guarantees sequential message delivery, message ordering is the wrong semantic model for physical motion control. If the control consumer falls behind the rate of production, queued motion plans represent progressively stale physical state estimates. Backpressure, the queue’s way of slowing a producer, cannot pause moving mass. The real-time enforcer requires the freshest complete proposal, paired with a strict temporal deadline. This principle does not prevent the controller from buffering the future waypoints of an already admitted trajectory; those waypoints follow an explicit execution schedule governed by a valid lease. Rather, it prevents treating the delayed consumption of historical commands as valid control inputs. Real-time distributed systems distinguish these two communication semantics. An event message is queued and consumed exactly once, where dropping a message loses state history, whereas a state message represents current environmental state and updates in place, allowing new observations to overwrite older ones without queuing (Kopetz 2011). The proposal mailbox implements state-message semantics via a single-slot seqlock, following the non-blocking write protocol of Kopetz and Reisinger (1993) to ensure mutual independence between writer progress and reader execution.

Figure 4: Multi-rate cadence and the mailbox exchange: (a) The running machine’s clocks during a proposer stall, to scale. The chunk policy renews every 50 ms and needs 40 ms; the admitted chunk supplies a setpoint every 25 ms. When the third renewal never completes, the tick keeps executing the admitted chunk only until the 60 ms lease from the last admission lapses; the tick, bus, and brake onset then put the fallback stop 82 ms after that admission. (b) The single-slot seqlock in the microcontroller’s own memory, in event order. The receive interrupt makes the counter odd, copies a checked frame, and makes it even; the tick accepts a copy only when it reads the same even value before and after. A tick that preempts a write reads an odd value and keeps its last validated chunk, and a stalled application processor leaves the slot unchanged while the lease runs.

A baseline nonblocking exchange uses a single-producer single-consumer (SPSC) seqlock mailbox⁶ in the microcontroller’s own static memory. The proposal first crosses the board-level link as a framed packet, which a DMA transfer lands in a private receive buffer. A receive interrupt outside the tick checks the frame’s CRC and sequence number and copies the proposal into the mailbox slot. Both participants therefore execute on the microcontroller, the receive interrupt as writer and the permission tick as reader, and the application processor never touches mailbox memory.

⁶ Versioned Read: Lamport (1977) showed that a reader can detect a concurrent, overlapping write without acquiring mutual exclusion locks. By incrementing a version counter before and after updating payload data, and having the reader sample the counter in reverse order, any mismatch reliably flags a torn read.

Lamport, Leslie. 1977. “Concurrent Reading and Writing.” Communications of the ACM 20 (11): 806–11. https://doi.org/10.1145/359863.359878.

↪ The boundary contract that keeps the application processor out of the microcontroller’s mailbox memory is developed in The Boundary Contract.

The writer increments the sequence counter to an odd value, copies the checked frame into the slot, and increments the counter to an even value using store-release memory ordering. The reader makes exactly one bounded read attempt per control cycle and rejects the snapshot if the counter begins odd or changes before the read finishes. A snapshot that passes becomes the active chunk only after its integrity, freshness, and physical-admissibility checks succeed, and the tick then interpolates it into setpoints (section 4.4.2). A rejected read leaves the previously admitted chunk in force, so the reader never blocks on the writer. Because the timer tick has higher priority than the receive interrupt, a tick that arrives mid-write sees the odd counter, discards the torn read in \(\mathcal{O}(1)\) time without spinning, and keeps executing the active chunk for as long as its lease and evidence remain valid. A crashed or stalled application processor cannot leave the counter odd, because it never writes the slot. Its failure appears only as an absence of incoming frames, and the active chunk’s lease expires on schedule.

Formally, the reader validates the snapshot using two boundary counter observations: \[\ReadStartSequenceCount \equiv \ReadEndSequenceCount \equiv 0 \pmod 2 \quad \text{and} \quad \ReadStartSequenceCount = \ReadEndSequenceCount,\] where an odd count signals an active write and a value mismatch signals preemption during the copy. Unlike mutexes or semaphores, this protocol never suspends either participant. Because the reader never retries within a single tick, its computational overhead remains strictly \(\mathcal{O}(1)\) regardless of writer activity. Correct execution requires that memory loads occur in strict programmatic order. Within a single core arbitrating between an interrupt handler and the periodic tick, compiler optimization barriers prevent instruction reordering. However, when a DMA engine or a second processor core writes the slot directly, hardware memory barriers become mandatory. On Arm Cortex-M profile cores, this requires the full-system data memory barrier instruction (DMB) (ARM Limited 2012). Omitting this barrier allows out-of-order execution pipelines to speculatively load payload fields before validating the sequence counter, silently allowing torn data into the control loop.

ARM Limited. 2012. ARM Cortex-M Programming Guide to Memory Barrier Instructions. Application Note 321, ARM DAI 0321A. ARM Limited.

⁷ Wait-Free: Herlihy (1991) defined an implementation as wait-free when every operation finishes in a bounded number of its own steps, whatever the other processes do. That is stronger than lock-free progress, which guarantees only that some operation completes while a particular one may retry indefinitely. The one-attempt seqlock read is bounded but can come back empty-handed; the slot mailbox is bounded and always returns a complete snapshot, and the extra slot is the price of that second property.

Herlihy, Maurice. 1991. “Wait-Free Synchronization.” ACM Transactions on Programming Languages and Systems 13 (1): 124–49. https://doi.org/10.1145/114005.102808.

A wait-free three-slot mailbox⁷ can avoid read/write collisions by assigning separate slots to the writer, the published proposal, and the reader. Atomic publication transfers slot ownership; it must never let the writer overwrite the reader’s active slot. Unlike the one-attempt seqlock, this design can provide a complete published snapshot without discarding a collided read. Its extra storage and ownership protocol must still be checked on the target hardware. Simpson’s four-slot mechanism reaches the same guarantee, a complete snapshot for a reader that never waits, using only single-bit control variables written with ordinary stores and no atomic read-modify-write instruction (Simpson 1990). Neither design makes an old proposal fresh or extends its lease.

Sequential diagnostic telemetry, by contrast, operates under event semantics. A single-producer single-consumer (SPSC) ring buffer preserves an ordered log of events until its bounded capacity fills, whereas the proposal mailbox exposes only the latest complete candidate state. The permission interface relies on these bounded-access guarantees to eliminate wait states; it intentionally discards historical command queues.

↪ The memory-ordering primitives, cache-line padding, and slot-ownership protocols that implement both exchanges are developed in Heterogeneous SoC Mailboxes, Memory Barriers, and Zero-Copy IPC.

Macenski, Steven, Tully Foote, Brian Gerkey, Chris Lalancette, and William Woodall. 2022. “Robot Operating System 2: Design, Architecture, and Uses in the Wild.” Science Robotics 7 (66): eabm6074. https://doi.org/10.1126/scirobotics.abm6074.

Object Management Group. 2015. Data Distribution Service (DDS), Version 1.4. Object Management Group.

Casini, Daniel, Tobias Blaß, Ingo Lütkebohle, and Björn B. Brandenburg. 2019. “Response-Time Analysis of ROS 2 Processing Chains Under Reservation-Based Scheduling.” 31st Euromicro Conference on Real-Time Systems (ECRTS 2019), Leibniz international proceedings in informatics (LIPIcs), vol. 133: 6:1–23. https://doi.org/10.4230/LIPIcs.ECRTS.2019.6.

ros2_control Development Team. 2025. Realtime_tools: Tools for Hard Real-Time Threads in Ros2_control. GitHub repository.

No robotics middleware setting can stand in for the chunk lease, because none derives its parameters from the physical stopping budget and none executes on the consumer’s own hardware clock at the point of actuation. Middleware can still approximate the mailbox’s state-message semantics, and the mapping shows how far configuration goes. In ROS 2, communication relies on the Data Distribution Service (DDS) or equivalent publish-subscribe transports (Macenski et al. 2022), whose Quality-of-Service (QoS) policies reflect real-time contracts only partially (Object Management Group 2015). Configuring a keep-last history depth of one provides state-message semantics by retaining only the freshest sample. Selecting best-effort reliability drops lost packets rather than triggering retransmissions, avoiding the burst of stale samples that reliable delivery releases after network blips. A DDS deadline policy raises notification events when sample inter-arrival times exceed a threshold, acting as an alerting heartbeat without enforcing authority revocation. Similarly, a DDS lifespan policy purges samples whose age exceeds a configured threshold, but this mechanism relies on synchronized network clocks, defaults to arrival timestamps when synchronization degrades, and controls only message transport rather than granted actuation authority. Callback scheduling within middleware executors also introduces variable dispatch jitter, requiring dedicated response-time analyses across end-to-end processing chains (Casini et al. 2019). At the direct hardware interface, the ros2_control framework implements a nonblocking realtime buffer using a single try-lock attempt: if the writer holds the mutex, the read aborts and the controller retains its prior command (ros2_control Development Team 2025), mimicking the one-attempt semantics of a seqlock. Regardless of middleware abstractions, the physical permission path must independently enforce its own freshness checks and lease bounds.

↪ The inverse failure, middleware that reports healthy delivery while transmitting stale payload data, is developed in Spatial Belief Failure Modes and Map Corruption.

Because the receive interrupt write routine is brief and resumes immediately after the tick completes, an access collision discards at most one read attempt without delaying the tick. However, if the upstream link halts completely, the mailbox slot remains unchanged across thousands of consecutive ticks. Bounded reader execution time does not guarantee bounded publication latency. The system therefore requires an explicit physical policy governing how long a previously admitted motion chunk may continue commanding actuators. Under the first law, irreversibility (principle 1), every millisecond that a stalled proposal retains actuation authority produces physical displacement that cannot be retracted. That exposure has to be priced against the stopping budget, which makes the length of a proposal’s authority the next design decision.

4.4 Chunk Lease Sizing from the Stopping Budget

A learned policy runtime can stall for many reasons: a page fault, thermal throttling on the vision accelerator, memory fragmentation, or an uncaught exception in perception preprocessing. The robot does not stop when its software does. A loaded base keeps its momentum (\(\LinearMomentum = \Mass \SpeedAtDetection\)) and covers 1.5 mm every millisecond at the drive limit, while the downstream controller keeps converting the remaining waypoints of the last admitted chunk into setpoints. To keep an unrenewed chunk from driving the machine into an obstacle, the permission path must end that chunk’s authority on its own hardware clock, whether or not the proposer ever reports its failure. How long it should wait before doing so is a question about distance, not software.

Definition 4.2: Chunk lease

Chunk lease is the interval, counted on the permission path’s own clock from a chunk’s admission, during which that admitted chunk may keep driving the actuators without a successful replacement; when it expires, the permission path ends the chunk’s authority and commands the state-matched fallback, a stop profile chosen from the machine’s measured speed and pose.

1. Significance: The lease enters the pre-brake delay \(\PrebrakeDelay\) of the stopping budget, so each millisecond of it costs \(\SpeedAtDetection\) of clear distance, 1.5 mm at the running machine’s drive limit. The machine’s 60 ms lease, with the tick and bus cycle that detect and deliver its expiry, adds 93 mm to the stopping budget (notebook 4.1).
2. Distinction: Unlike a heartbeat timeout, which shows only that the host is alive, a lease is renewed only by a freshly admitted proposal, and its length is derived from the plant rather than configured: above the proposer’s renewal floor and below the stopping budget’s ceiling. Unlike an evidence deadline, it bounds how long one motion segment may execute, not how long the observation behind it stays valid.
3. Common pitfall: Lengthening the lease to ride out proposer hiccups. A longer lease buys continuity with clearance, and a lease that reaches the pre-brake ceiling commits the machine to motion it can no longer stop in time.

In classical distributed systems, a lease grants bounded access to a shared digital resource, such as a distributed lock or cache entry, expiring automatically if the leaseholder crashes (Gray and Cheriton 1989). In physical AI, the leased resource is the kinetic authority to move mass through space. Because physical motion cannot be undone, the duration of a lease must be formally derived from the physical stopping budget. The distance covered during the lease, the detection latency, the fieldbus transit, and the brake onset, together with the braking distance itself, must fit within the available clearance \(\ClearDistance\) after the localization uncertainty and protective margin are subtracted. Rearranging the stopping-distance relation of equation 2.2, \(\SpeedAtDetection\,\PrebrakeDelay + \SpeedAtDetection^2/2\CredibleBrakingDeceleration + \LocalizationBound + \ProtectiveClearanceMargin \le \ClearDistance\), and dividing the remaining pre-braking distance by vehicle velocity yields the pre-brake ceiling, representing the maximum tolerable delay \(\PrebrakeDelay\) before physical braking deceleration must commence: \[\PrebrakeDelay \le \frac{\ClearDistance - \LocalizationBound - \ProtectiveClearanceMargin - \SpeedAtDetection^2/2\CredibleBrakingDeceleration}{\SpeedAtDetection} \tag{2}\] where \(\SpeedAtDetection\) represents operating velocity, \(\CredibleBrakingDeceleration\) denotes verified braking deceleration, and \(\LocalizationBound\) and \(\ProtectiveClearanceMargin\) represent the localization uncertainty and safety clearance of that formulation. As operating speed \(\SpeedAtDetection\) decreases, the required braking distance shrinks quadratically while the velocity divisor decreases linearly, causing the pre-brake ceiling to expand toward infinity at rest. At maximum operating speed, however, every millisecond allocated to the lease path consumes exactly \(\SpeedAtDetection\) units of stopping clearance.

Panel (a) of figure 4 draws the lease on the running machine’s own clocks. The chunk policy renews twice and then stalls; the tick keeps executing the last admitted chunk only until the lease counted from that admission lapses, and the next tick, one bus cycle, and the brake onset then bring the fallback stop. Notebook 4.1 evaluates equation 2 for the mobile manipulator at its drive limit and prices that sequence inside it.

Napkin Math 4.1: The price of a lease

Problem: In the illustrative aisle scenario, the warehouse mobile manipulator cruises at its drive limit toward a person who has stepped out from a rack end and stopped. The permission path admits one last chunk and then receives no admissible replacement. How much time remains before braking must begin, and how much of it, and of the clear distance, does the chunk lease spend?

Variables:

• Speed \(\SpeedAtDetection =\) 1.5 m/s, the drive limit (illustrative); braking deceleration \(\CredibleBrakingDeceleration =\) 2 m/s², loaded on a dry floor (illustrative).
• Clear distance \(\ClearDistance =\) 1.10 m (illustrative), less localization error \(\LocalizationBound =\) 50 mm (illustrative) and protective clearance \(\ProtectiveClearanceMargin =\) 100 mm (chosen).
• Brake onset \(\ActuatorResponseTime =\) 20 ms (illustrative); permission tick \(\PermissionLoopPeriod =\) 1 ms (chosen); bus cycle \(\CommandTransportTime =\) 1 ms (illustrative).
• Chunk lease \(\ChunkLease =\) 60 ms; renewal period \(\ChunkRenewalPeriod =\) 50 ms with a 5 ms variation allowance \(\RenewalJitterAllowance\) (all chosen).

Math: The braking term and the ceiling of equation 2: \[\frac{v^2}{2a_{\text{brake}}} = \frac{(1.5\ \text{m/s})^2}{2 \times 2\ \text{m/s}^2} = 562.5\ \text{mm}\] \[\tau_{\text{delay}} \le \frac{1100 - 150 - 562.5\ \text{mm}}{1.5\ \text{m/s}} = 258.3\ \text{ms}\] The stopping-budget terms that Kinetic Momentum already charged (braking, the localization and clearance overheads, and onset travel \(\SpeedAtDetection\,\ActuatorResponseTime =\) 30 mm) hold 742.5 mm of the clear distance. The lease path, lease plus the tick that notices its expiry plus the bus cycle that delivers the stop, is the next term: \[v\,(T_{\text{lease}} + T_{\text{tick}} + T_{\text{bus}}) = 1.5\ \text{m/s} \times (60 + 1 + 1)\ \text{ms} = 93\ \text{mm}\] \[742.5 + 93 = 835.5\ \text{mm}, \quad 1100 - 835.5 = 264.5\ \text{mm}\] In time, from the last admission to brake onset, and against the ceiling: \[62 + 20 = 82\ \text{ms}, \quad 258.3 - 82 = 176.3\ \text{ms}\] Continuous tracking also sets a floor under the lease: \[T_{\text{chunk}} + T_{\text{jitter}} = 50 + 5 = 55\ \text{ms} < T_{\text{lease}} = 60\ \text{ms}\]

Systems insight: A chunk lease is a term in the stopping budget, not a timeout chosen for convenience. Each millisecond added to it costs 1.5 mm of clear distance at the drive limit, distance that the observation age and the stop profile still need, so the lease sits just above its renewal floor rather than anywhere under the ceiling.

The renewal floor is the lease duration needed to cover the budgeted inter-arrival interval between successful admissions without starving trajectory execution. Because this floor cannot rely solely on the model’s 99th-percentile (\(\text{p99}\)) inference latency, it must accommodate bus transit, validation overhead, and mailbox synchronization jitter. If a renewal fails to arrive before the lease expires, the system terminates trajectory tracking rather than granting an unearned extension. The 176.3 ms remaining under the pre-brake ceiling is not spare margin either. It must still absorb the observation’s age at admission, which section 4.9.1 charges against it, and the jerk limits of the braking profile.

Every charge in this budget is an interval between the four boundary events introduced in The end-to-end sense-to-actuation latency pipeline. Capture dates an observation at its exposure midpoint, dispatch hands that evidence to the proposer, admission accepts a chunk built on it and starts the chunk’s lease, and brake onset marks the first physical braking force at the drives. Between these four events lie three intervals, each derived in exactly one chapter (table 1). Only row 3, the stalled-proposer response, is derived here, from the lease notebook. Rows 1 and 2 enter Part I as allocations: the observation age that The latency waterfall will build stage by stage, and the dispatch-to-admission interval that The board-link budget and the dispatch-to-admission interval will charge to the board link and the validator. Later chapters charge time against these events and this table rather than keeping their own stage lists.

Table 1: The capture-to-brake-onset timing budget of the running machine: Four events bound three intervals, and each interval is derived in one chapter. Rows 1 and 3 together form the 133.6 ms pre-brake delay of the stopping budget; row 2 is the allocation that budget must still pay for. Row 2 charges the whole inference after dispatch, although its vision stage already lies in row 1, so the sum is conservative. Every value is an allocation or an illustrative stage time to qualify on the loaded machine, not a measurement.

Interval	Opens at	Closes at	What it contains	Allocation	Derived in
1. Observation age \(\ObservationAge\)	capture	dispatch	Half the exposure, readout, transport, DMA, image signal processing, perception backbone, hand-off to the proposer	51.6 ms	The latency waterfall
2. Dispatch to admission \(\DispatchAdmissionInterval\)	dispatch	admission	Proposer inference (charged in full), board link, deserialization, whole-plan validation, activation, wait for the next tick	63.3 ms	The board-link budget and the dispatch-to-admission interval
1 + 2. Replacement latency \(\Latency\)	capture	admission	Rows 1 and 2; validation is counted once, inside row 2	114.9 ms	Action chunk horizons and reaction lag
3. Stalled-proposer response	admission	brake onset	Chunk lease, one permission tick, one fieldbus cycle, brake onset	82 ms	section 4.4
1 + 2 + 3. Capture to brake onset	capture	brake onset	All three intervals	196.9 ms	Sizing the composite stopping budget

The table also shows why the stopping budget and the lease rule charge different ages. The stopping budget’s pre-brake delay sums rows 1 and 3 and leaves row 2 to be paid from the spare that the elementary budget of Delay consumes stopping clearance left, because row 2’s length depends on where the proposer and the permission path run, a decision The board-link budget and the dispatch-to-admission interval makes. A renewal cannot defer that payment. A replacement chunk spends row 2 before its lease even starts, so the evidence age that the lease rule of section 4.9.1 charges at admission is rows 1 and 2 together.

4.4.1 Supervisory timers and proposal wire contracts

Granting a fresh lease at admission without charging the time the observation already spent in inference and board-link transit, or waiting on a single timeout while a hung policy thread sits inside a live host kernel, lets the drives keep tracking a trajectory whose sensory evidence is already stale or whose producer has stopped updating. Evidence keeps aging from capture onward, and admitting a chunk starts its lease on the microcontroller’s clock without rolling that age back; because neither the dispatch timestamp nor the newly granted lease accounts for the dispatch-to-admission interval, the evidence-age check must charge row 2 of table 1 explicitly. Authority over an admitted chunk then ends at the earliest of four events: its evidence freshness deadline passes, its lease expires without a successful replacement, the host heartbeat times out, or an independent safety reflex such as the protective scanner path detects an obstacle. None of these waits for the others, and which fires first depends on the scene. At the conveyor, the tracked evidence horizon that Two proposers and the evidence horizon computed is several times longer than the lease, so there a stalled chunk loses its authority to the lease. The chunk lease bounds how long one admitted motion segment may execute. How long the strategic goal stays meaningful is a separate grant, the intent lease of The Intent Lease Specification and Contract, and neither is the nominal planning horizon.

↩︎ The freshness deadline that bounds how old evidence may be at actuation is established in Measurement Freshness.

Three independent supervisory timers guard the exchange, and each monitors a distinct failure domain:

1. The chunk lease (\(\ChunkLease =\) 60 ms): Bounds how long an admitted proposal may command actuators. Only a freshly validated, admitted proposal chunk renews the lease. Its duration is derived directly from the physical stopping budget, sitting between the renewal floor and the pre-brake ceiling (notebook 4.1).
2. The host heartbeat (\(\HostHeartbeatRate =\) 100 Hz, timeout 30 ms): Asserts that the application processor operating system kernel and user-space runtime remain alive. Expiry of this timeout revokes the active proposal without waiting for the chunk lease. Heartbeat pulses never renew the chunk lease, because a live process can easily suffer algorithmic livelock or produce corrupted, out-of-distribution setpoints.
3. The microcontroller self-watchdog (\(\SelfWatchdogTimeout =\) 5 ms): Monitors whether the permission path completes its required checks within the watchdog interval. The permission loop feeds this hardware watchdog only upon successfully completing all verification checks in a tick; a hung enforcer trips the watchdog even if timer interrupts continue firing (section 4.10).

A watchdog refresh confirms only that the specific task servicing the timer is still executing. In Bookout v. Toyota (2013), litigation centered on whether a timer-tick interrupt could continue petting a watchdog while application-level control tasks had hung (Barr 2013). Although federal investigations by NASA and NHTSA identified no electronic mechanism capable of causing large unintended accelerations (NASA Engineering and Safety Center 2011), the dispute highlights an essential real-time principle: watchdog refresh points must be coupled to the completion of safety-critical algorithmic cycles rather than independent periodic interrupts.

Barr, Michael. 2013. Bookout v. Toyota Motor Corp.: 2005 Camry L4 Software Analysis.

NASA Engineering and Safety Center. 2011. Technical Support to the NHTSA on the Reported Toyota Motor Corporation (TMC) Unintended Acceleration Investigation. National Aeronautics; Space Administration.

Real-time safety requires wrapping the proposer’s payload in a transport and authority envelope. The system enforces chunk leases through the proposal header, a structured wire contract that enables the permission path to validate candidate trajectories without placing trust in host application software. The header encapsulates a monotonically increasing sequence number, the evidence timestamp of the source sensory frame (including clock conversion error bounds), the host dispatch timestamp, the requested lease duration (which the permission path caps at the lease it derives, so a proposer can ask for less authority but never more), a cryptographic parent-record digest for provenance tracking, the coordinate frame identifier, the payload type enum, and a 32-bit cyclic redundancy check (CRC-32). For the default payload type the payload consists of \(\ActionChunkHorizon\) kinematic waypoints specifying joint coordinates and velocities; the payload-type field is where other command forms announce themselves, so an impedance target (section 4.6.1) carries its stiffness and damping gains beside its equilibrium waypoints. In this layered architecture, the learned policy expresses kinematic intent, the permission enforcer converts admitted waypoints into position setpoints, and the drives regulate joint velocity and motor current. The payload deliberately omits raw torque commands; while direct-torque policies require alternate wire representations and specialized admission checks, their outputs remain untrusted proposals. In all cases, an admitted proposal retains execution authority only until the earlier of its lease expiration and its evidence freshness deadline, regardless of whether cancellation packets arrive across the network.

↩︎ The proposal payload, the candidate motion and the evidence times it carries, is established in Information the proposer must supply.

EtherCAT Technology Group. 2019. Safety over EtherCAT (FSoE): Introduction and Overview. EtherCAT Technology Group seminar slides.

Industrial safety networking adopted the same transport safeguards decades before the advent of learned robotic proposers. Functional-safety fieldbus standards such as IEC 61784-3 establish the black-channel principle: transmission media, network controllers, and intermediate switches are treated as untrusted, fallible channels, requiring safety-critical packets to encapsulate self-contained integrity and timing protections verified exclusively at communication endpoints (International Electrotechnical Commission 2021). Fieldbus profiles like PROFIsafe and Safety over EtherCAT (FSoE) exemplify this architecture. FSoE protects frames against corruption using CRCs, against repetition and packet loss using sequence counters, against misrouting using unique connection identifiers, and against transit delay using watchdog timers; missing or delayed frames force the receiver into a deterministic safe state (EtherCAT Technology Group 2019). The proposal header mirrors this design field for field: checksums guard integrity, sequence numbers detect drops, payload identifiers ensure proper dispatch, and the chunk lease replaces the watchdog timer. The physical link between host application processor and safety microcontroller operates as an untrusted black channel; end-to-end header checks allow the permission path to enforce its declared physical admission contract without trusting host operating system integrity. Classical real-time theory provides the complementary semantic foundation. Kopetz defines a computing system’s internal representation of a dynamic physical entity as a real-time image, which remains temporally accurate only during a bounded physical duration following the initial observation (Kopetz 2011). The proposal’s evidence deadline represents this temporal accuracy window applied to sensory inputs, while the chunk lease bounds the duration of derived actuation. This architecture adds one thing to these precedents, the grounding of temporal validity. Whereas industrial fieldbuses configure watchdog timeouts empirically and real-time images reflect passive plant dynamics, the chunk lease is derived analytically from the physical stopping budget above and the proposer’s renewal floor below (equation 2, notebook 4.1).

↪ Byte layout: The proposal header’s and chunk payload’s fields, types, and offsets are given in Proposal header and chunk payload.

Every record crossing the proposal boundary expresses temporal quantities referenced to the safety microcontroller’s monotonic clock. Upstream producers operating on independent oscillator domains map timestamps using a versioned affine transformation and transmit explicit synchronization error bounds, which the safety consumer adds to all age evaluations. Wall-clock calendar time is restricted to diagnostic logging and software release expiration; it never enters real-time safety gating.

Individual boundary records guard against three orthogonal failure modes through three distinct mechanisms, only two of them cryptographic. A checksum across the header and payload, a CRC rather than a cryptographic function, detects transmission bit flips and memory corruption during transit, leaving origin authentication unaddressed. Similarly, a cryptographic digest of the parent record establishes computational lineage without authenticating the sender. Cryptographic message authentication codes (MACs) appear exclusively where sender identity conveys explicit operational authority: network teleoperation commands, immutable authority audit logs, and release artifacts verified during deployment. Learned model proposals omit cryptographic signatures entirely, because the permission enforcer validates candidates based on physical admissibility and temporal freshness rather than origin. A cryptographic key stored inside an untrusted host environment provides no assurance of kinematic safety.

↪ How a teleoperation command’s authentication tag is verified and priced against the fallback deadline is developed in Authenticating an Intervention.

The reader’s possible failures fall into four classes (table 2), and none of them lets a failed producer make the permission path wait. The classes keep the exchange from blocking; they do not by themselves contain the plant, because the fallback each one selects still needs bounded timing and a validated stop, and even a valid admitted chunk still has to be stepped from the proposer’s coarse waypoint spacing down to the permission tick’s rate.

Table 2: Boundary contract failure classes and deterministic fallback matrix: Exchange faults across the proposal boundary by class, with the fallback each selects. Fallback paths are selected without waiting on host recovery.

Failure Class	Reader Detection Condition	Physical Systems Fallback Action	Bounded Response
Torn / In-Flight	Odd \(\ReadStartSequenceCount\) or changed \(\ReadEndSequenceCount\)	Reject current snapshot; use admissible prior chunk or fallback	One bounded attempt; measure duration
Malformed	Checksum or configured command bound fails	Reject candidate; retain admissible active chunk or use fallback	Measure check and response
Stale	Past proposal expiry or evidence deadline (local clock)	Reject stale candidate; end active authority if its own deadline passed	Deadline from plant budget
Missing	Sequence gap	Record audit gap; evaluate current record on its own merits	One tick for flag

4.4.2 Rate interpolation and boundary fallback execution

Holding each admitted waypoint constant for its full 25 ms spacing until the next waypoint arrives injects staircase position steps into the drives rather than a smooth trajectory, delaying reference tracking by half the step spacing on average and exciting high-frequency structural resonances. Bridging the learned policy’s renewal rate (20 Hz) and the real-time permission tick (1 ms) without those disturbances requires guarding against three sampled-data failure modes: reference lag, spectral aliasing, and buffer starvation. Because the zero-order hold’s latency sits entirely on the feedforward reference path outside the feedback loop, it appears as tracking error rather than eroding feedback phase margins (section 4.3.1), and confusing reference lag with closed-loop phase lag often leads engineers to misdiagnose tracking errors as plant instability. To eliminate discrete steps across chunk boundaries, the permission enforcer constructs a quintic Hermite spline bridge matching boundary position, velocity, and acceleration. These six boundary constraints guarantee \(\DifferentiabilityClass^2\) continuity across chunk transitions, meaning position, velocity, and acceleration all stay continuous. Evaluating this admitted spline at 1 kHz yields continuous position references, smooth velocity feeds, and feedforward acceleration profiles for the underlying joint controllers.

↩︎ Action chunking, which produces the trajectory segments this interpolator densifies, is established in Action chunking.

⁸ Filter Group Delay: Digital smoothing filters commonly applied in machine learning pipelines introduce significant phase lag when placed inside feedback control loops. An \(\FilterTapCount\)-tap moving-average finite impulse response (FIR) filter imposes an average group delay of \((\FilterTapCount-1)/2\) sample intervals. Consequently, a 9-tap moving average operating at the 1 ms permission tick delays feedback signals by 4 ms. At the illustrative 20 Hz crossover frequency from section 4.3.1, this delay burns 28.8\(^\circ\) of phase, 5.8× the design allowance. In real-time control paths, decimation and filter topologies must be selected for minimal phase lag rather than cosmetic smoothing.

Spectral aliasing occurs when unmodeled high-frequency mechanical vibration or sensor noise, sampled too slowly, reappears as a false low-frequency signal in the slower streams that estimators and the tick consume. The architecture mitigates aliasing through front-end analog filtering followed by multi-rate digital decimation,⁸ low-pass filtering a fast sample stream before keeping only one sample in several, within the high-rate microcontroller domain. Classical sampled-data control models assume constant, deterministic sampling periods. Temporal jitter, a sampling interval that varies from cycle to cycle, degrades phase margin more severely than a constant delay of equivalent mean duration (Cervin et al. 2003). Discrete trajectory execution also assumes setpoints replenish continuously before downstream buffers drain. The permission path enforces these invariants via cycle-deterministic hardware timer interrupts and real-time buffer-depth accounting. If the upstream planner stalls and the trajectory buffer reaches its terminal waypoint, the enforcer rejects stale extrapolation and commands a validated local stopping profile.

An overrun costs something different at each of the four tiers:

• Current loop (20 kHz): Its jitter allowance is below \(10\,\MicroUnitPrefix\text{s}\) (table 3). A timing overrun, gate-drive desynchronization, or current spike trips a hardware fault line that disables the inverter’s PWM stages.
• Permission tick (1 kHz): A deadline overrun by the enforcer software sends the machine to the local deceleration stop.
• Chunk policy (20 Hz): Inference latency is stochastic (40 ms at p99), so some chunks arrive late. A late chunk costs nothing until the active chunk’s lease or evidence deadline runs out, and the enforcer never waits on the proposer’s optimistic estimate of when it will finish. When either deadline passes, the enforcer commands the state-matched fallback.
• Intent planner (2 Hz): Its goals expire under a separate intent lease, a longer grant of authority over the goal itself rather than over any motion (developed in The Intent Lease Specification and Contract). When it lapses, the system holds station instead of chasing a stale goal.

The lease notebook charged the tick and the bus cycle as fixed terms, 1 ms and 1 ms, as though each were certain to finish on time. That premise is the next thing to establish. It requires a worst-case response bound for every stage between the mailbox and the drives, and no benchmark or faster processor substitutes for one.

4.5 Real-Time Command Transport and Bus Determinism

A profiling campaign can run the permission tick for days without a missed deadline and still not establish the tick’s worst case. An empirical percentile says how often sampled executions stayed under a threshold; it says nothing about executions that meet a combination of competing tasks, memory contention, or peripheral delay the campaign never produced. The lease budget needs the other kind of number: a response-time bound that accounts for every unit of permitted computation and queuing delay along the critical path under defined operating conditions. In an embodied system, timing determinism protects both stability and safety, because delayed feedback erodes the controller’s phase margin and delayed actuation consumes stopping clearance before the chassis can decelerate. Bounding the tick on the microcontroller comes first; bounding the drive network that carries its admitted setpoints to the motors follows the same logic (Kopetz 2011).

4.5.1 Response time analysis and execution variance

A permission tick whose own instructions finish in 250 μs can still miss its 400 μs deadline if a lower-priority link driver masks interrupts while re-arming a DMA descriptor or a burst of higher-priority timer interrupts preempts the tick mid-cycle. Response Time Analysis (RTA) bounds a task’s total response time by summing the three constituents introduced in section 4.2: execution time, blocking delay, and preemption interference (Joseph and Pandya 1986; Audsley et al. 1993). To guarantee schedulability, each term requires an analytical upper bound under specified operating conditions: \[\WorstCaseResponseTime_i = \WorstCaseExecutionTime_i + \TaskBlockingTime_i + \TaskInterferenceTime_i \le \TaskRelativeDeadline_i \tag{3}\] where \(\WorstCaseExecutionTime_i\) is the worst-case execution time (WCET) of task \(\RealTimeTaskIndex\), \(\TaskBlockingTime_i\) is the maximum blocking time spent waiting for lower-priority tasks to vacate shared critical sections, \(\TaskInterferenceTime_i\) is the maximum interference from preempting higher-priority tasks, timer interrupts, and DMA transfers, and \(\TaskRelativeDeadline_i\) is the relative deadline.

Each term demands distinct evidentiary backing. Formal static timing analysis against an accurate cycle-level processor model can establish a bound on the WCET \(\WorstCaseExecutionTime_i\). High-watermark profiling under stress-bench conditions instead characterizes observed execution times; it can refute a declared WCET but cannot establish one. The blocking term \(\TaskBlockingTime_i\) represents the longest critical section of any lower-priority task that can lock a shared resource required by task \(\RealTimeTaskIndex\). The priority ceiling protocol establishes a provable bound on \(\TaskBlockingTime_i\). In this protocol, each synchronization lock carries a priority ceiling equal to the highest priority of any task that may acquire it. A task may acquire a lock only if its priority strictly exceeds the priority ceilings of all locks currently held by other tasks. Furthermore, any lock holder that blocks a higher-priority task temporarily inherits that task’s elevated priority. Under these constraints, a task is blocked by at most a single lower-priority critical section across its entire execution (Sha et al. 1990). An immediate priority ceiling protocol (IPCP), which instantly elevates a lock holder to the resource ceiling upon acquisition, guarantees the same blocking bound with lower runtime overhead. Finally, the interference term \(\TaskInterferenceTime_i\) aggregates the execution time of all higher-priority tasks and interrupt service routines released during the response window. Because a longer response time provides a wider window for higher-priority tasks to re-trigger, calculating \(\TaskInterferenceTime_i\) requires solving a fixed-point recurrence relation; Real-Time Timers, Watchdogs, and Schedulability details this formulation, and equation 3 defines the overarching budget that the recurrence resolves, which notebook 4.2 evaluates for the permission tick.

Napkin Math 4.2: The response-time margin

Problem: The permission tick must finish within its deadline after every release. With its declared WCET and illustrative bounds on blocking and interference, does it meet the deadline, and what happens to the margin when one term loses its bound?

Variables:

• Declared WCET \(\WorstCaseExecutionTime_i =\) 250 μs and deadline \(\TaskRelativeDeadline_i =\) 400 μs (both chosen).
• Blocking \(\TaskBlockingTime_i =\) 50 μs, the longest section in which lower-priority code masks the tick, such as the link driver re-arming its DMA descriptor (illustrative). The mailbox adds nothing to \(\TaskBlockingTime_i\), because the seqlock never makes the tick wait for the receive interrupt.
• Interference \(\TaskInterferenceTime_i =\) 40 μs, the timer and bus interrupts that can preempt the tick within one response window (illustrative).

Math: \[R_i = C_i + B_i + I_i = 250 + 50 + 40 = 340\ \mu\text{s} \le D_i = 400\ \mu\text{s}, \quad D_i - R_i = 60\ \mu\text{s}\]

Systems insight: The margin is only as dependable as its weakest constituent bound. For instance, moving the mailbox copy into a low-priority task guarded by a standard mutex without priority inheritance or priority ceilings leaves \(\TaskBlockingTime_i\) completely unbounded, because medium-priority work can preempt the lock holder indefinitely, which is the Mars Pathfinder pathology of war story 4.1. Similarly, permitting unscheduled DMA traffic on the tick’s memory path destroys the upper bound on \(\TaskInterferenceTime_i\). If even a single term loses its bound, the tick lacks a defensible worst-case response time, leaving the stopping budget’s \(\PermissionLoopPeriod\) parameter with no engineering foundation.

↪ How host memory traffic would inflate the permission tick’s interference if both paths shared one die is developed in Contention for Shared Resources.

⁹ Rate-Monotonic Scheduling: Liu and Layland (1973) established that static-priority rate-monotonic scheduling guarantees periodic task schedulability when total processor utilization satisfies \(\TaskSetUtilization \le \PeriodicTaskCount(2^{1/\PeriodicTaskCount} - 1)\), converging to \(\ln(2) \approx 0.693\) for large \(\PeriodicTaskCount\). The utilization bound is sufficient, not necessary, so a task set that exceeds it may still meet every deadline; with shared-resource blocking and deadlines shorter than periods, only the exact response-time test of Real-Time Timers, Watchdogs, and Schedulability decides.

Liu, C. L., and James W. Layland. 1973. “Scheduling Algorithms for Multiprogramming in a Hard-Real-Time Environment.” Journal of the ACM 20 (1): 46–61.

Cervin, Anton, Dan Henriksson, Bo Lincoln, Johan Eker, and Karl-Erik Årzén. 2003. “How Does Control Timing Affect Performance? Analysis and Simulation of Timing Using Jitterbug and TrueTime.” IEEE Control Systems Magazine 23 (3): 16–30. https://doi.org/10.1109/MCS.2003.1200240.

Neither a low average latency nor a modest processor utilization can substitute for that analytical bound,⁹ because a single missed deadline degrades the machine across multiple architectural layers. When a deadline slips, distributed motor drives must hold their previous position setpoint for an entire additional bus cycle. Consequently, the actuator setpoint lags by a full period (1 ms) rather than the conventional half-period delay associated with a zero-order hold. Repeated deadline misses manifest as timing jitter, which Cervin et al. (2003) analyze as a direct erosion of phase margin in digital feedback loops closed through the tick. Within the safety subsystem, a delayed tick evaluates an expired lease or safety violation late; at the drive velocity limit, each 1 ms delay incurs an irreversible loss of 1.5 mm in physical stopping clearance.

Bounding these response terms requires categorizing every potential source of timing variability according to whether an analytical bound exists:

1. Bounded Sources: Hardware mechanisms that admit analytical upper bounds from vendor architectural specifications. Examples include deterministic instruction pipelines, round-robin interconnect arbitration, zero-wait-state tightly coupled memory (TCM/SRAM), and deterministic vectored interrupt controllers on real-time microcontrollers.
2. Experimentally Characterized Sources: Microarchitectural behaviors that cannot be proved strictly from first principles but can be enveloped empirically under frozen hardware configurations. Examples include bounded cache-line misses under hardware cache partitioning, write-buffer draining latencies, periodic DRAM auto-refresh pauses, and thermal throttling profiles stabilized by closed-loop active cooling.
3. Unbounded Sources: Software and hardware mechanisms that have no finite mathematical worst-case bound and must be purged from the real-time critical path. Examples include operating-system page faults under demand paging, preemptive thread synchronization lacking priority inheritance, dynamic heap allocation over fragmented memory pools, and unscheduled peripheral bus contention.

A credible timing guarantee must therefore explicitly enumerate all permissible operations along the execution path. While the hardware partitioning and core isolation strategies from section 4.2 eliminate broad classes of timing interference, and a zero-allocation static architecture pre-allocates all buffers and queues at boot time to eliminate memory-management overhead, these strategies cannot eliminate contention for shared memory buses. Response-time analysis must account for every remaining shared-resource transaction, because a high task priority alone never guarantees real-time execution, as the Mars Pathfinder resets showed.

War Story 4.1: The Mars Pathfinder priority inversion (1997)

Context: In July 1997, shortly after landing on Mars, the Mars Pathfinder spacecraft’s avionics computer ran the VxWorks real-time operating system with preemptive priority-based scheduling across mission tasks (Reeves 1997).

Mechanism: A high-priority thread (bc_dist) distributed critical spacecraft bus telemetry, while a low-priority thread (ASI/MET) published meteorological sensor observations through a shared pipe. The mutex serializing access to this pipe was not explicitly declared in mission application code; rather, it was embedded deep within the operating system’s select() implementation to protect internal file-descriptor queues (Reeves 1997). When ASI/MET acquired this internal mutex, long-running medium-priority communications tasks preempted it. Because these medium-priority tasks outranked the meteorological thread, they starved it of CPU cycles, preventing it from releasing the mutex while bc_dist remained blocked, an unbounded priority inversion.

Impact: The blocked bc_dist thread missed its execution deadline. When the supervisory bc_sched watchdog initiated the subsequent bus cycle and detected that bc_dist had not completed, it flagged a critical timing fault and commanded a total system reset. Although telemetry collected prior to the reset survived in non-volatile storage, the resets recurred repeatedly during operational surface maneuvers.

Response: NASA engineers diagnosed the pathology on an identical ground testbed using VxWorks execution tracing, subsequently uploading an inflight software patch that enabled priority inheritance (Sha et al. 1990) on the underlying mutex semaphore.

Systems lesson: Preempting a low-priority lock holder with medium-priority work blocks high-priority consumers indefinitely. Priority inheritance resolves this vulnerability by temporarily elevating the lock holder’s priority to match that of the blocked high-priority task, allowing it to complete its critical section promptly. In robotic actuator and motor-control paths, engineers must either rigorously bound blocking duration (\(\TaskBlockingTime_i\)) using priority inheritance protocols or eliminate shared locks altogether through lock-free communication structures.

4.5.2 Event-triggered and time-triggered bus architectures

Once the permission tick finishes its check on the microcontroller, the admitted setpoint still has to cross a shared physical wire to reach the motor drives, where the same blocking and interference questions reappear. If a high-priority servo command arrives at a shared bus just after a lower-priority diagnostic frame has started transmitting, the command cannot preempt the bits already on the wire and must wait for the frame to finish. Physical buses handle shared medium access in one of two ways: on an event-triggered bus, nodes transmit whenever new data is ready and resolve collisions through dynamic bus arbitration, whereas on a time-triggered bus, a fixed global schedule assigns dedicated transmission windows to each node in advance. Neither design guarantees bounded delivery by its name alone; establishing a worst-case bound requires pricing payload sizes, competing traffic, error-recovery overhead, and device controller delays.

The Controller Area Network (CAN) and its CAN FD variant resolve message collisions via bitwise priority arbitration. While a high-priority frame preempts lower-priority traffic competing for an idle bus, it must wait for any frame already in transmission to finish. Switching to CAN FD accelerates payload serialization by elevating the data-phase bitrate, yet it retains the rule that an in-progress frame cannot be preempted. The blocking duration depends on the longest eligible frame at its nominal and data-phase rates. A valid worst-case response budget must therefore combine both the frame’s own transmission time and the maximum duration of a lower-priority transmission already in progress.

EtherCAT adopts an on-the-fly time-triggered model: an Ethernet coordinator issues a single master frame that traverses all connected motor drives in a physical ring. Dedicated hardware controllers in each drive read incoming setpoints and write sensor feedback directly into designated bit offsets as the Ethernet frame streams through the physical layer. This architecture eliminates arbitration contention across the motor drives, while distributed clock synchronization synchronizes local PWM switching cycles. Time-Sensitive Networking (TSN) achieves comparable determinism over switched Ethernet through IEEE 802.1Qbv time-aware traffic shapers. A TSN delivery guarantee relies on synchronized network gates, bounded clock skew, and strict admission controls that gate best-effort traffic.

↪ The protocol engines and analytical response-time models of concrete fieldbus deployments are developed in Real-Time Fieldbuses and Lock-Free Synchronization.

CAN FD arbitrates a separate frame per message; EtherCAT carries every drive in one frame.

For an integrated mobile manipulator, the core architectural question is whether cyclic actuator commands and feedback fit within the allocated bus period while preserving sufficient margin for MCU control loop execution and motor drive processing. High-bandwidth perception streams (such as camera and LiDAR data) and asynchronous supervisory middleware require separate networks or prioritized channels to prevent unmodeled queuing delays from invading the motor command path. Industrial controllers build that separation into the hardware (figure 5), with ports that serve only the deterministic drive network and local I/O attached through terminals on the controller itself rather than through host software. The running machine does not use this controller; the photograph shows the pattern its own permission path follows.

Figure 5: Real-time distributed controller with modular I/O: Dedicated embedded real-time controller and adjacent hardware I/O modules. The unit acts as a deterministic bus coordinator, synchronizing distributed sensor acquisition and motor drive terminals via hardware-scheduled Ethernet telegrams. (Photo: Oleg Yunakov, Wikimedia Commons, CC BY-SA 4.0).

Clock synchronization aligns the sampling and actuation instants across distributed drives;¹⁰ however, phase alignment reveals nothing about the transport latency required for a newly computed setpoint to traverse the physical bus. Even if every drive clock fires simultaneously, the actuators will merely execute stale commands if transit delays stall delivery. A sound design therefore requires independent bounds for both command transport latency and multi-axis synchronization jitter, starting with whether the serialized frames fit inside the cycle at all.

¹⁰ Distributed Clock: EtherCAT Distributed Clocks (DC) synchronize distributed drive nodes to a reference clock by measuring propagation delays around the ring. Receive-time latches at each node let the coordinator discipline every node’s timer, so the hardware SYNC0 events that start the drives’ update cycles occur in close alignment. Clock alignment alone does not bound the complete control cycle, which must also account for controller response time and PWM gate update latency.

4.5.3 Comparing bus occupancy on CAN FD and EtherCAT

Wiring all nine servo axes of the mobile manipulator onto a single shared CAN FD bus without pricing arbitration headers and worst-case bit stuffing pushes the command and feedback frames alone past the 1 ms bus cycle before any controller delay or bus contention is counted. To keep each link within its cycle budget, communication links on the mobile manipulator separate into three tiers by rate and scope:

1. Board-Level Peripheral Interconnects (SPI, Memory-Mapped I/O): Synchronous SPI links and memory-mapped register transfers link local microcontrollers directly to joint position encoders, current-shunt analog-to-digital converters (ADCs), and inverter gate drivers with sub-microsecond latency (\(< 1\,\MicroUnitPrefix\text{s}\)) along rigid, hardware-timed schedules.
2. Deterministic Drive Command Buses (EtherCAT, TSN Ethernet): Deterministic industrial networks transport cyclic joint position setpoints and motor feedback across all distributed drive inverters within an allocated 1 ms bus cycle (\(\CommandTransportTime\)), maintaining sub-microsecond synchronization jitter (\(\TimingJitter < 100\text{ ns}\)).
3. Chassis and Auxiliary Diagnostic Buses (CAN FD): Priority-arbitrated buses service lower-rate peripherals, such as battery management systems (BMS), thermal monitors, and chassis diagnostics, where arbitration delays remain acceptable under verified worst-case utilization bounds.

None of these bounds belongs to a protocol acronym alone. Each guarantee depends on the physical network topology, transceiver hardware, payload geometries, and cyclic schedules. The first check is whether every servo axis can exchange its command and feedback payloads within the permission path’s allocated bus cycle budget.

Napkin Math 4.3: Fieldbus serialization before schedulability

Problem: The mobile manipulator’s permission path exchanges position setpoints and feedback with its servo axes once per bus cycle. How much of that cycle do CAN FD frames, or one EtherCAT frame, occupy before controller and device delays are counted, and which buses pass this necessary check?

Variables:

• 9 servo axes, 7 arm joints and 2 drive wheels (datasheet), exchanged every 1 ms bus cycle (illustrative).
• An 8-byte record per axis in each direction, a 32-bit position and two 16-bit words (chosen).
• CAN FD at \(1\text{ Mbps}\) nominal and \(5\text{ Mbps}\) in the data phase (chosen). A CAN frame carries one message, so each axis needs a command frame and a feedback frame. The arbitration field and the trailer run at the nominal rate, 34 bits; the data-length code, payload, stuff count, and 17-bit CRC run at the data rate, 113 bits (International Organization for Standardization 2015; Robert Bosch GmbH 2012). Both counts include the worst-case 21 dynamic stuff bits, because a bound must assume the bit pattern that lengthens the frame most.
• EtherCAT at \(100\text{ Mbps}\) (datasheet), one frame carrying every axis’s command and feedback with a 64-byte header, and a forwarding delay of 0.6 μs per node, the shift-register pass-through of a slave controller that never buffers the frame (both illustrative).

Math: One CAN FD frame, then all frames on one bus and on an arm bus: \[t_{\text{frame}} = \frac{34\ \text{bits}}{1\ \text{Mbps}} + \frac{113\ \text{bits}}{5\ \text{Mbps}} = 34 + 22.6 = 56.6\ \mu\text{s}\] \[18 \times 56.6 = 1018.8\ \mu\text{s} > 1000\ \mu\text{s}, \qquad 14 \times 56.6 = 792.4\ \mu\text{s}\] The base’s 4 frames take 226.4 μs. For EtherCAT, serialization plus forwarding: \[\frac{(64 + 9 \times 16)\ \text{B} \times 8}{100\ \text{Mbps}} + 9 \times 0.6\ \mu\text{s} = 16.64 + 5.4 = 22.04\ \mu\text{s}\]

Result: One CAN FD bus fills 101.9 percent of the cycle on serialization alone. A bus per limb passes, the arm bus at 79.2 percent with 207.6 μs left for blocking, competing frames, and retransmissions. EtherCAT occupies 2.2 percent and leaves 978.0 μs unallocated by this calculation.

Systems insight: CAN FD’s accelerated data phase cannot salvage a single shared bus topology. Every transmitted frame still incurs arbitration and trailer bit times at the lower nominal rate, and CAN requires distinct command and feedback frames for each joint axis. EtherCAT, in contrast, aggregates all axes into a single circulating telegram processed on the fly. Neither occupancy figure represents an end-to-end response bound: a rigorous CAN FD analysis must incorporate message arbitration, non-preemptive blocking, and retransmissions, whereas an EtherCAT budget must include coordinator cycle jitter, slave hardware propagation, and drive firmware latencies. Any unmodeled delay that creeps into the physical command path consumes stopping clearance at a rate of \(\SpeedAtDetection\,\UnmodeledCommandPathDelay\).

Robert Bosch GmbH. 2012. CAN with Flexible Data-Rate: Specification Version 1.0. Robert Bosch GmbH.

4.5.4 Bandwidth, response time, and multi-axis synchronization jitter

A network link with plenty of raw bandwidth can still deliver a joint setpoint late if frames queue behind camera traffic, and a bus that delivers setpoints quickly on average can still twist a coordinated multi-joint motion if the drives apply their updates at slightly different instants. Analyzing serialization occupancy separates three metrics that industrial datasheets often conflate: raw bandwidth, command response time, and multi-axis synchronization jitter. Bandwidth governs the total payload volume the link can carry per unit time; command response time measures the complete latency, including queueing, arbitration, transmission, and drive input decoding, before an actuator applies a setpoint; and synchronization jitter bounds the time spread across multi-axis updates. A network design can improve any one of these metrics while leaving the others unconstrained.

Set against the cycle, the notebook’s occupancies separate into one failure and three passes (figure 6). Only the single shared CAN FD bus fails, needing 1018.8 μs before any contention or retransmission is counted; the per-limb buses (792.4 μs for the arm) and EtherCAT (22.0 μs) leave room for controller execution and clock synchronization. Staying within the cycle budget provides neither a synchronization-jitter bound nor a complete response bound. A defensible CAN FD analysis requires upper bounds on asynchronous message interference and non-preemptive blocking; an EtherCAT path demands explicit master cycle jitter, slave hardware propagation, and drive firmware latencies; a TSN schedule requires reserved transmission windows and bounded clock-synchronization errors.¹¹ These factors represent essential inputs to the response-time equation, not inherent guarantees achieved simply by selecting a protocol standard.

¹¹ Time-Sensitive Networking: IEEE 802.1Qbv Time-Sensitive Networking provides bounded Ethernet delivery by configuring time-aware traffic shapers across network switches. High-priority control frames travel inside dedicated, pre-scheduled transmission windows, while asynchronous high-bandwidth traffic (such as uncompressed camera streams) is held back at the switch gates. This scheduled time-division multiplexing lets camera streams and microsecond servo commands share a physical link without packet collisions or switch-queue buildup.

Actuator commands also demand strict temporal freshness. Even when delivered comfortably within a deterministic transport window, a setpoint computed from stale perception is functionally hazardous. The evidence timestamp and lease expiry embedded in the command proposal remain vital safeguards even over nanosecond-synchronized fieldbuses. The transport budget must reserve adequate headroom for physical actuation to execute, and the real-time permission path must reject any setpoint whose authoritative validity window has expired.

Figure 6: Scenario bus occupancy before response qualification: Modeled serialization and forwarding terms for the configured servo-axis example, command and feedback included, compared with the allocated bus cycle. One CAN FD bus for all axes exceeds the allocation before other delays are counted. A CAN FD bus per limb and EtherCAT leave unallocated time, but controller response, competing traffic, device delays, and fault allowances still need qualification. These calculated values are not measured end-to-end response or synchronization bounds.

Checkpoint 4.1: Response bounds and command transport

The lease budget counts the permission tick and the bus cycle as bounded terms. These items test whether you can supply the bounds it assumes.

• Percentile vs. bound: Can you explain why a measured \(\text{p99}\) response time, however long the test that produced it, may enter the handoff record only as a measured distribution and never as a proven bound?
• Response-time estimate: If the longest tick-masking section in the link driver grew from 50 μs to 120 μs, with the tick’s WCET and interference unchanged, would the tick still meet its 400 μs deadline, and by how much would it pass or miss?
• Bus occupancy estimate: With one command frame and one feedback frame per axis at 56.6 μs each, how many axes can one CAN FD bus serve within a 1 ms cycle before any blocking is counted?
• Synchronization vs. latency: Can you explain why tightly synchronized drive clocks do not bound how long a newly issued command takes to reach the drives?

A fieldbus path qualified under declared traffic and fault conditions bounds command delivery within its allocated cycle, but on-time delivery says nothing about whether the command should have been sent. That depends on which node may issue setpoints at all, and on whether each setpoint is checked against the machine’s physical limits before it leaves.

4.6 Actuation Authority

A shared mailbox cannot protect a mobile manipulator if the host processor retains a diagnostic route, an auxiliary bus master, or a JTAG debug port that writes directly to a drive. The silicon partition established in section 4.2 therefore requires exclusive physical control over every electrical path capable of energizing the motor windings. Actuation authority is this exclusive physical ability to modify drive states, encompassing PWM configuration registers, current references, gate-driver outputs, and bridge-enable lines. Under this architecture, the host publishes candidate proposals \(\CandidateProposal_t\) and the safety microcontroller’s permission path alone turns them into admitted commands \(\AdmittedCommand_t\). The difference between holding that authority and merely appearing to is a question of wiring (figure 7). When the permission path is the sole writer of the drive registers and can trip a drive inhibit, every motion passes its checks; when the host can also write those registers, one unchecked write reaches the motors and proposer and drives share a single failure domain.

Figure 7: Hardware proposal boundary: (a) The application processor proposes across a black-channel board link into the safety microcontroller’s own double buffer; the permission path on that microcontroller is the sole writer of the drive registers and can trip a drive inhibit. (b) When the application processor can write the drive registers directly, an unchecked write reaches the motors, and proposer and drives share a single failure domain.

↪ How exclusive authority over each actuator channel passes between the learned policy, an operator, and the fallback is developed in Authority states and single-writer actuator ownership.

¹² Hardware Trip Zone: Microcontroller hardware trip zones couple analog overcurrent and overvoltage comparators directly to timer output logic. Upon fault detection, configured trip logic may force gate signals high-impedance or activate a validated braking mode. These have different mechanical consequences: torque removal can leave the plant coasting, while dynamic braking requires a rated energy path.

The microcontroller continuously evaluates physical safety invariants: verifying that commanded joint positions lie within certified reach envelopes, that joint velocities stay within qualified limits, and that projected decelerations remain safely within dynamic stopping clearance (\(\StoppingDistance \le \ClearDistance\)). When a proposal satisfies all invariants, the microcontroller admits the command and interpolates waypoints into cyclic position setpoints for each bus cycle, which the drives track through their internal velocity and current loops. When a candidate proposal violates an invariant or expires, the enforcer refuses it (\(\bot\)). A refusal does not automatically revoke a previously admitted, actively executing trajectory chunk. Instead, the active chunk continues running as long as its state, sensor evidence, and chunk lease remain valid. When those conditions lapse or fail, the enforcer terminates execution authority and transitions the system into a controlled deceleration or hold. In parallel, a separate hardware trip zone stands ready to cut motor drive torque upon catastrophic electrical faults, though simply de-energizing an inverter does not by itself brake moving mass.¹²

↪ The refusal authority and the state invariants it checks are developed in Refusing Proposals and Enforcing State Invariants.

At the causal boundary the root cause of an aberrant proposal does not matter. A remote memory exploit in a host operating system daemon, an adversarial optical perturbation that induces a vision model hallucination, and an arithmetic overflow in an acceleration tensor engine can all produce invalid proposals for the same boundary filter to reject. A proposal that passes the physical checks may still pursue the wrong task, so admission does not establish semantic correctness. Because the enforcer evaluates physical invariant bounds against direct sensor feedback from optical encoders and current shunts rather than inspecting internal neural network weights, it requires no internal model of why the proposer failed. Because the host lacks bus-master privileges to actuator registers, a compromised host has no bypass around this check. Complete protection against a rogue host nonetheless requires four physical foundations: independent sensing, an accurate kinematic and dynamic limit model, sufficient actuator capability, and a physically feasible fallback trajectory.

↩︎ The causal boundary, where a command becomes current in a winding and mass begins to move, is established in From a proposed action to motion.

Controlled stopping and torque removal impose fundamentally different engineering obligations. Powered braking actively uses the drive inverters to decelerate the plant to zero velocity before disabling torque. Immediate torque removal, by contrast, de-energizes the motor windings instantly, which can leave a wheeled base coasting uncontrollably or allow a vertically loaded manipulator arm to collapse under gravity. Maintaining a held position requires either continuous motor torque or a certified mechanical restraint. At the actuation authority interface, the systems designer must explicitly designate the physical fallback response and reserve both the execution time and thermal energy budget that it demands.

A refusal that leaves no admissible active continuation carries an unavoidable physical cost. When the enforcer rejects an invalid proposal and commands dynamic braking on a fast-moving joint, the physical braking path must supply sufficient torque, clearance, and thermal dissipation capacity to arrest the moving mass. Over an arrest interval spanning several hundred milliseconds, the motor winding resistance, dynamic brake chopper resistor, or friction brake lining must absorb the joint’s accumulated kinetic energy within the thermal limits detailed in Thermal Duty Cycles. This dissipation must occur without degrading winding insulation or permitting the manipulator to breach its physical clearance boundary.

↪ The stopping-distance model this braking path must satisfy is developed in Kinematic Stopping Envelopes and Information Age Lag.

¹³ Safe Torque Off (STO): An STO implementation removes torque-producing drive signals through a hardware interlock. An IEC 61800-5-2 integrity rating depends on the actual devices, diagnostic coverage, wiring, and validation, not on the circuit pattern alone (International Electrotechnical Commission 2016).

International Electrotechnical Commission. 2016. IEC 61800-5-2:2016: Adjustable Speed Electrical Power Drive Systems, Part 5-2: Safety Requirements, Functional. International Electrotechnical Commission.

If the safety microcontroller itself hangs or suffers a clock failure, it cannot execute a software-directed stop. A hardwired, out-of-band interlock must therefore supervise the system and enforce a qualified fallback state. Safe Torque Off (STO) accomplishes this by disabling gate-driver optocouplers or charge pumps through hardware logic, preventing the inverter from generating rotating magnetic fields.¹³ STO does not isolate the high-voltage DC bus from the mains, nor does it guarantee that momentum will dissipate within the stopping clearance allocated for powered deceleration. Complete electrical isolation requires an upstream safety contactor, and containing gravitational drop or mechanical drift requires a certified electromechanical brake. A dual-channel interlock circuit, the relay network figure 8 diagrams, decouples torque inhibition entirely from the host software stack; safety qualification must still verify that the system remains resilient against common-cause failures in power rails, clock crystals, and harness wiring.

Figure 8: Illustrative out-of-band interlock and STO path: Each emergency-stop contact holds its own force-guided relay, and each relay’s enable contact holds one of the drive’s two STO inputs, so a single welded contact or shorted wire leaves the other channel able to remove torque. The EDM contacts report a relay that failed to release before restart. Removing torque leaves the motor free to coast; the spring-applied brake is a separate circuit that clamps when its supply is removed. The diagram shows a hardware response path, not a certified integrity level or a stopping distance (synthesized from ISO 13849-1 and IEC 61800-5-2).

In figure 8, dual positive-break E-stop contacts (\(\EmergencyStopContact_1\), \(\EmergencyStopContact_2\)) drive independent force-guided relays (\(\ForceGuidedRelay_1\), \(\ForceGuidedRelay_2\)), routing dual STO enable signals into the motor drive while series-wired normally closed external device monitoring (EDM) contacts prevent system restart if either relay fails to open. At the bottom, a dedicated brake supply drops a spring-applied mechanical brake directly onto the motor shaft upon power loss, enforcing torque removal (\(\MotorTorque = 0\)) and holding restraint without software or processor intervention. However, engineers must not confuse a static holding brake with a dynamic stopping brake. Under normal operational sequences, the drive decelerates the motor to zero velocity electrically before engaging the spring brake to hold position. Dropping a holding brake onto a spinning shaft during a high-speed emergency stop subjects the brake pads and hub to severe friction heating and mechanical shock, requiring independent thermal rating and stopping-distance validation. The stop-category selections and timing sequences depend directly on these electromechanical limits.

Systems Perspective 4.1: Hardware authority invariant

If an unverified learned policy has direct memory-mapped write access to actuator gate-driver registers, the machine has no mediated proposal path, and its next out-of-distribution input reaches the motors unchecked.

Write privilege is a physical reality dictated by memory mapping, bus arbitration, and physical trace layout, never a configurable software flag. The host processor holds no write privilege to drive registers. While hardware partitioning determines which processor may issue physical commands to an actuator, the engineer must still decide what physical quantity those admitted commands specify, because each choice leaves a different set of failure modes for the permission path to catch.

4.6.1 What a proposal may command

A digital motor drive accepts setpoints across a nested cascade of control loops: position, velocity, and winding current, with current running innermost at the highest bandwidth. Sending raw current targets directly to the drive bypasses its position and velocity loops and leaves the permission path to predict how gravity, inertia, and external contact will move the joint, whereas sending pure position targets lets the drive bound its own speed and current at the cost of ramping winding current against an unmodeled obstacle until the inverter saturates or the mechanism breaks. The level at which a proposal enters this cascade therefore decides which physical states the drive hardware regulates on its own and which quantities the permission path must verify before admitting the command. Four command interfaces dominate physical AI systems, each placing a different prediction and checking burden on the enforcer.

A position target \(\JointPositionTarget\) delegates the entire trajectory tracking problem to the drive’s internal cascaded loops. Because the drive firmware enforces its own configured speed and current limits, the enforcer’s verification burden remains relatively compact: it validates that the target lies within the geometric reach envelope, bounds the discrete step between consecutive targets (which position gains convert directly into velocity and torque demands), and ensures adequate dynamic stopping clearance. However, a pure position target cannot modulate interaction force. When encountering an unmodeled rigid obstacle, a stiff proportional-integral position loop interprets physical contact as a tracking error to be eliminated, ramping winding current until the inverter saturates or the mechanical structure breaks; the impedance-control analysis in Transmission compliance, contact impedance, and tooth fracture quantified this exact failure mode on a cage-door latch.

A velocity target \(\JointVelocityTarget\) shifts kinematic integration to the host proposer, bypassing the drive’s position loop. Because the proposal omits an explicit geometric endpoint, the enforcer cannot simply validate a target coordinate against static workspace limits. Instead, the enforcer forward-integrates the commanded velocity over the duration of the active chunk lease to predict the joint’s worst-case state at lease expiration. It then checks both the reach envelope and the dynamic stopping distance against this forward projection. As with pure position control, contact force remains unregulated, and unmodeled collisions will produce maximum drive torque.

A torque target \(\JointTorqueTarget\), delivered as a direct current reference, bypasses both outer loops. The drive regulates only electromagnetic winding current. Consequently, all kinematic state evolution, including velocity, position, and braking distance, becomes an emergent consequence of plant dynamics, gravity, and external contact forces rather than an enforced setpoint. The enforcer must bound the resulting state evolution and preserve a feasible fallback, using a plant model or effort-space constraints, while constraining torque slew rates and tracking the cumulative mechanical energy injected into the system. Torque control offers maximum responsiveness for dynamic locomotion and manipulation, but it imposes the heaviest computational burden on the permission path while providing the least explicit intent.

An impedance target specifies a virtual equilibrium pose alongside stiffness gains \(\PidProportionalGain\) and damping gains \(\PidDerivativeGain\), so the actuator behaves as a virtual spring-damper (Hogan 1985), the same model introduced in Transmission compliance, contact impedance, and tooth fracture: \[\ImpedanceRestoringForce = \PidProportionalGain (\ImpedanceEquilibriumPosition - \ImpedanceControlledPosition) + \PidDerivativeGain (\ImpedanceEquilibriumVelocity - \ImpedanceControlledVelocity)\] Its dynamic dual, an admittance target, measures external contact force via load cells and commands motion in response. Both formulations explicitly regulate the dynamic relationship between motion and force, a coupling that position, velocity, and torque interfaces leave unconstrained. This capability makes impedance and admittance formulations standard in contact-rich manipulation tasks. The enforcer’s verification role expands accordingly: it must evaluate both the equilibrium setpoint and the commanded stiffness gains. Under quasi-static contact, the maximum contact force is bounded by the product of the commanded stiffness and the largest displacement the environment can impose. Consequently, a stiffness parameter that exceeds the structural limits of the workpiece or fixture is just as inadmissible as a trajectory crossing a workspace wall. However, steady-state gains do not govern transient impact forces, which depend heavily on approach velocity, rotor inertia, structural compliance, and control-loop latency. Intentional contact and in-contact energy barriers establishes the energy and contact-force barriers needed to bound these transient impact phases.

Hogan, Neville. 1985. “Impedance Control: An Approach to Manipulation: Part i–Theory, Part II–Implementation, Part III–Applications.” Journal of Dynamic Systems, Measurement, and Control 107 (1): 1–24.

On the reference mobile manipulator, the enforcer admits position waypoints, interpolating them into fine setpoints for each bus cycle while the motor drives close their own internal velocity and current loops. When the manipulator engages the sprung latch of an equipment cage door, the host switches to an impedance command, introducing stiffness and damping parameters that the real-time tick must validate before transmission. No command interface eliminates the verification burden of the permission path: shifting the command interface inward, from position setpoints toward raw current references, strips away explicit geometric intent and forces the safety layer to predict complex electrodynamic behavior. Write privilege and command filtering protect the physical plant only if the enforcer also maintains physical independence from the host whose proposals it evaluates, because if the safety microcontroller and the host application processor share a power rail, a common system clock, or a unified memory bus, a failure in the host can brown out the microcontroller, corrupt its timing, or deadlock the bus, silencing the safety layer without issuing a single illegal drive command.

4.7 Hardware Isolation and Fault Containment

A large current transient during a neural accelerator burst can pull down a shared power rail and brown out or reset the permission processor without warning, while memory bus contention on a shared interconnect can delay safety checks past the hard real-time execution tick. Even when safety enforcement executes on a dedicated processor, physical coupling to the proposal engine can silently undermine software isolation. Containing faults across the two paths therefore requires isolating or bounding shared physical resources across four domains: execution hardware, reference oscillators, power distribution rails, and memory hierarchies.¹⁴ Where any of those resources remain shared, the architecture must demonstrate that cross-domain interference and declared common-cause faults cannot prevent the permission path from meeting its execution deadline or initiating its qualified fallback.

¹⁴ Freedom from Interference (FFI): ISO 26262 defines FFI in its vocabulary, Part 1, as the absence of cascading failures between two or more elements that could lead to the violation of a safety requirement (International Organization for Standardization 2018). Part 6 lists the software interference it covers (timing and execution, memory, and exchange of information), whereas shared power, clocks, and heat are common-cause and cascading faults that Part 9 treats in its dependent-failure analysis and that IEC 61508 addresses as independence between elements (International Electrotechnical Commission 2010b). A neural policy sharing silicon with the permission path therefore needs both arguments, FFI for its software and a dependent-failure analysis for the resources underneath.

International Organization for Standardization. 2018. ISO 26262:2018: Road Vehicles, Functional Safety. International Organization for Standardization.

International Electrotechnical Commission. 2010b. IEC 61508-2:2010: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems, Part 2: Requirements for Electrical/Electronic/Programmable Electronic Safety-Related Systems. International Electrotechnical Commission.

The running machine’s two-processor architecture addresses each of these four fault paths with an explicit hardware design choice. The permission path executes from private memory over a dedicated board-level link, clocks from an independent oscillator, and draws power from the isolated rail specified in Cross-budget coupling and permission rail isolation rather than from the primary 47.7 V drive bus feeding the application processor. Diode-isolated storage capacitors hold up this safety rail for 2 s. If a transient load fault pulls the drive bus down to the host converter’s undervoltage lockout threshold at 33 V, the safety microcontroller stays powered long enough to capture the undervoltage interrupt, log the event, and command a graceful fallback while the primary host resets, provided that the required detector, actuator power, and braking path survive the fault.

Keeping the logic powered does not guarantee motor torque or braking capability. Bringing a moving machine to a controlled stop requires sufficient DC bus energy, healthy inverter stages, and adequate obstacle clearance. If electrical drive power collapses entirely, the system must execute a qualified unpowered fallback whose mechanical brake engagement delay and subsequent stopping motion fit within the pre-allocated physical envelope. These isolation guarantees are design assertions that must be empirically verified on physical hardware. Every shared dependency must be carried forward into the formal verification handoff record.

↪ The four substrate couplings that board layout must sever, and the fault-injection experiments that test their isolation, are developed in Two Paths and the Resources They Share.

A sag on the shared bus reaches every load; the permission rail rides through on its own.

Substrate isolation ensures that the permission path stays alive when the host crashes, but the enforcer’s downstream action depends entirely on how the proposer failed: through unresponsiveness or through corruption. Unresponsiveness occurs when an inference pipeline deadlocks, thread scheduling misses a deadline, or kernel memory fragmentation stalls process execution, yielding no new trajectory packets. A complete host crash trips the hardware heartbeat timer. Conversely, the host operating system might remain healthy while the user-space neural policy pipeline hangs; in that scenario, the proposer simply stops emitting admissible action chunks, allowing the active chunk’s lease or evidence deadline to lapse. These complementary deadlines form the supervisory timing hierarchy established in section 4.4.1.

Corruption occurs when the proposer continues running and satisfies its heartbeat deadline, but outputs invalid or hazardous setpoints. Examples include kinematically unreachable joint configurations, step discontinuities in velocity requests, or floating-point NaNs and infinities caused by out-of-distribution visual tokens or matrix overflow. The enforcer handles these two failure profiles through orthogonal mechanisms: unresponsiveness triggers trajectory revocation as soon as the chunk lease or the heartbeat timer expires, whereas corruption prompts an immediate invariant rejection at the boundary filter upon the arrival of the malformed packet. A live heartbeat therefore never extends motion authority; only an admitted chunk renews it, and authority ends when the chunk lease runs out. Whether the chunk policy can renew quickly enough to keep the machine moving, and why the slower intent model supplies goals rather than holding chunk leases itself, is the coupled budget of section 4.9.1.

When active motion authority lapses without an admissible continuation, the permission path must execute an explicit degradation strategy rather than cutting motor bus power unconditionally. As detailed in Unpowered states and unmanaged fallback dynamics, de-energizing an inverter drops the actuators into uncontrolled freewheeling or dynamic short-circuit braking, neither of which produces an orderly, predictable stop. Instead, the safety path evaluates the plant’s instantaneous kinematic state and selects the safest feasible deceleration profile. An optional brief continuation along the last validated trajectory is permissible only while its state estimates, sensor evidence validity, chunk lease window, and obstacle clearance margins all remain valid.

Once that lease expires, any separately authorized fallback delay \(\FallbackHold\) is absorbed into the total reaction latency \(\PrebrakeDelay\) and must fit, together with the evidence age, within the 176.3 ms left under the pre-brake ceiling once the lease path and brake onset are charged at the drive limit (notebook 4.1). If measured latency bounds exceed this headroom, the enforcer must initiate deceleration sooner. Controlled braking uses the available actuator torque characterized in Actuator Transmission Limits to arrest motion within the remaining clearance. On gravity-loaded manipulators, motion arrest must be backed by engaging rated mechanical holding brakes once the joints reach standstill, preventing gravitational backdriving when drive power is subsequently removed.

After the physical plant comes to a complete halt, the architecture executes a recovery handshake before restoring autonomous proposal authority. The safety microcontroller asserts a persistent FAULT_HELD latch in its exported status register and publishes the plant’s confirmed physical rest pose \((\RestConfiguration, \GeneralizedVelocities = \ZeroVector)\). In turn, the application processor must discard all pending action chunks, invalidate internal state tied to the interrupted motion, capture fresh sensor observations tagged with synchronized hardware timestamps, and formulate a newly aligned trajectory proposal.

This recovery sequence must also purge any proposal-side state that assumes the robot executed its planned trajectory to completion. For autoregressive policies and VLA models, this requires flushing token buffers and the key-value (KV) attention cache; retaining pre-fault keys and values would bias future action generation toward a physical trajectory that was interrupted. However, clearing software caches does not by itself establish physical continuity. Before deasserting the FAULT_HELD latch and restoring proposal authority, the safety microcontroller inspects the opening waypoint \(\ProposalFirstWaypoint\) of the incoming proposal, verifying that it aligns with the robot’s measured physical rest pose within a strict spatial bound (\(||\ProposalFirstWaypoint - \RestConfiguration|| \le \RecoveryPoseTolerance\)).

Architectural independence cannot simply be read off a schematic or block diagram; it must be empirically validated against identified common-cause faults on the physical board. Similarly, the chunk lease that constrains a malfunctioning proposer derives directly from physical dynamics, sized from the stopping margin that remains after detection delays and actuator responses. Together, these defenses bound a proposer that crashes, stalls, or publishes corrupted actions. The separation leaves one question open, whether a neural policy engineered to execute deterministically at the enforcer’s own update rate still requires an external runtime monitor.

↪ The fault injection that tests this independence on the physical board is developed in Fault Injection on Hardware.

4.8 Invariant Checking

A proposer fast enough to keep pace with the permission tick invites a shortcut. Learned locomotion controllers already emit joint targets within an order of magnitude of a millisecond, and a designer may be tempted to let such a policy write the motor registers directly. Rate does not confer authority. A fast network emitting joint targets or torques carries the same statistical uncertainty as a large model generating waypoints a few times a second, and even when policy and enforcer share one period, the network’s output remains a proposal that must pass the proposal boundary before it changes current in a winding. What the permission path can still guarantee when a learned policy commands at control rate, and what it gives up, is examined in Where the thesis bends.

The interface must reject an inadmissible candidate without waiting for the producer, and recheck the active command against current physical state. Position and velocity limits (\(\GeneralizedCoordinates \in [\JointPositionLowerLimit, \JointPositionUpperLimit]\) and \(|\GeneralizedVelocities| \le \JointVelocityLimit\)) are necessary but do not by themselves establish a feasible stop. A torque-slew constraint, \(|\JointTorqueSlew| = |(\JointTorque_k - \JointTorque_{k-1})/\FiniteChange \TimeInstant| \le \JointTorqueSlewLimit\), can limit command changes, but a command that meets the slew limit must still satisfy the other physical limits. Contact may additionally require accounting for exchanged energy, \(\int \JointTorque^\top \GeneralizedVelocities\,d\TimeInstant\).

↪ The passivity framework that accounts for energy exchanged in contact is developed in Passivity and Energy-Bounded Interaction.

Choosing and composing those filters is the work of Safety Enforcement, which constructs the admissibility calculation and selects a feasible continuation, hold, or stop. What the Nervous System fixes is the execution contract those filters must run under, whatever they compute. On the running machine the contract has numbers. The recheck of the active command must finish inside the tick’s 400 μs deadline under the response bound of equation 3, it must read measured wheel and joint encoder state rather than commanded setpoints (the fallacy of section 4.10 shows what the commanded setpoints miss), and it must leave the safety microcontroller the only writer of the drive registers. Neither fast inference nor a fast rejection routine establishes that contract on its own.

The same reasoning covers the one proposer that is not learned. A remote operator is a third proposer. Its commands pass the same permission path, and network delay spends the same pre-brake budget. Neither speed nor a human origin gives a proposal authority; only passing the permission path’s checks does, and each check spends part of a budget that the next section lays out handoff by handoff.

↪ How an operator’s reaction and link delays are charged against the stopping budget is developed in Human reaction time and travel before braking.

Checkpoint 4.2: Hardware isolation and invariant checking

Before turning to the handoffs between proposer and actuator, verify your understanding of the exchange, hardware isolation, and pre-actuation invariant defenses:

• Nonblocking exchange: Can you explain how the seqlock reader detects a torn read in one bounded attempt, and why a writer stopped mid-write cannot extend the active spline’s state, evidence, or lease validity?
• Independence as a hypothesis: Can you state the independence requirement the permission path must meet, and explain why the two-processor split satisfies it only once loaded tests on the machine’s silicon support the claim?
• Chunk lease cost: Can you explain why the chunk lease must be sized from stopping distance and clearance rather than chosen as a software timeout, why a heartbeat never renews it, and how much clear distance lengthening it from 60 ms to 100 ms would spend at the 1.5 m/s drive limit?
• Command interface: Can you state what the permission path must check or predict for a position, a velocity, a torque, and an impedance target, and why a velocity target leaves it to predict motion over the whole lease?
• Rate matching and authority: Can you explain why a policy that runs at the plant’s own rate still produces only proposals, and what timing, state, and fallback obligations remain?

4.9 The Handoffs Matrix

When a mobile manipulator overruns a stop, the diagnosis begins by locating the fault at one of five canonical handoffs between the photons collected by its cameras and the current delivered to its drives. A cloud service governs its interfaces with statistical service-level objectives (SLOs), such as a \(\text{p99}\) request latency; when a tail event violates that target, the runtime absorbs the delay through retries, request rerouting, or graceful degradation. The five handoffs of an embodied machine define hard cyber-physical service-level objectives instead. Software cannot recall physical momentum or undo resistive heating in an actuator winding, so no retry mechanism can mask an unbudgeted interface violation.

Upstream, sensing hardware transfers raw transducer signals to perception pipelines. Perception yields intermediate geometric and semantic representations that fuse into an estimated world state. This state feeds the learned policy to produce an action plan, which in turn submits candidate trajectories to the safety enforcer. Finally, the approved command passes from the enforcer to the physical motor drives. Across each boundary, five interface limits govern feasibility: latency (\(\Latency\)), bandwidth (\(\Bandwidth\)), energy and heat (\(\HeatDissipationPower\)), determinism (\(\TimingJitter\)), and fault domain isolation (\(\FaultDomainIsolation\)). The five handoffs and five interface limits form a five-by-five matrix mapping every signal path to the physical budgets of the machine. These interface limits are distinct from the body’s five mechanical budgets, which enter the matrix primarily through its latency and energy columns. The contract that records these budgets, the handoff record defined below, joins the physical limit records of The six elements of a limit record to the proposer limits of the Brain, so latency, renewal rate, and evidence age are written in one schema.

↩︎ The body’s five mechanical budgets are established in The Five Physical Budgets.

The allocation in table 3 illustrates which limits are design-limiting at each handoff, using chosen design budgets rather than empirical measurements. The matrix gathers the physical budgets of the machine’s mechanical, cognitive, and sensory systems, together with the sensor capture that the five-level machine model places at the Boundary. In the Boundary row (\(\SignalHandoff_1\)), where the physical world becomes digital measurement, bandwidth and latency bind first: raw multi-camera pixel streams saturate the serializer-deserializer (SerDes) lanes, and the exposure window imposes a strict floor on image age before serialization even begins. The Brain rows (\(\SignalHandoff_2\), \(\SignalHandoff_3\)) bind first on energy and latency, reflecting the heavy inference costs of the learned proposers. The Body row (\(\SignalHandoff_5\)) binds first on determinism and heat, because the drives’ current loops must hold their timing jitter below \(10\,\MicroUnitPrefix\text{s}\), and every ampere delivered dissipates heat across the windings and power inverter stages.

The Nervous System row (\(\SignalHandoff_4\)) forms the architectural bridge coupling the Brain and the Body. The proposal boundary between the learned planner and the enforcer carries an action proposal (\(\CandidateProposal_t\)), typically structured as a compact spline parameterization or waypoint chunk. For the compact payload assumed in this grid, the required throughput is modest (\(\Bandwidth < 100\text{ kB/s}\)), so bandwidth does not bind; instead, latency, determinism (\(\TimingJitter\)), and fault domain isolation (\(\FaultDomainIsolation\)) govern the interface. The permission path isolates stochastic model proposals using nonblocking mailboxes and expiring leases. On the mobile manipulator, the latency limit is the chunk lease, which consumes 60 ms of the 258.3 ms pre-brake ceiling available at the drive limit (section 4.4), while the active command is rechecked within each 1 ms permission tick. Full trajectory admission has a separate computation and response budget and must complete before any candidate chunk activates; the tick interval does not imply that arbitrary occupancy queries or whole-trajectory collision checks fit within that brief slice. Fault isolation relies on a private peripheral bus, an independent oscillator, and the isolated, held-up power rail detailed in section 4.7.

From the causal boundary perspective, any interface failure localizes to the specific handoff and budget it violates. Semantic mistakes or flawed physical assumptions can still escape an otherwise timely interface; the matrix does not substitute for task-level evaluation or hazard analysis. When diagnosing an over-budget stop, trajectory overrun, or subsystem fault, engineers navigate table 3 through a three-step operational root-cause procedure:

1. Locate the boundary seam: Identify which physical handoff (\(\SignalHandoff_1\text{--}\SignalHandoff_5\)) recorded the initial timing excursion, sequence gap, torn payload, or thermal trip.
2. Check the binding dimension: Query the specific physical limit (\(\Latency, \Bandwidth, \HeatDissipationPower, \TimingJitter, \FaultDomainIsolation\)) designated as BINDING for that handoff cell, identifying the primary resource bottleneck governing the interface.
3. Evaluate like-for-like evidence: Compare runtime diagnostic traces directly against the recorded bound kind (requirement, proven bound, or measured distribution), verifying whether the failure stemmed from an unmodeled microarchitectural tail event or a direct physical budget violation.

A handoff diagnosis must strictly compare like evidence. For the \(\SignalHandoff_2\) state-estimation path, suppose engineers allocate a \(30.0\text{ ms}\) latency budget and measure \(\text{p99} = 24.5\text{ ms}\) during a baseline hardware-in-the-loop run, yielding a sampled margin of \(+5.5\text{ ms}\). Under thermal throttling, a subsequent run measuring \(\text{p99} = 85.0\text{ ms}\) reveals a \(-55.0\text{ ms}\) deficit against that design budget. The appropriate remedy is to reduce or reallocate computational workload while preserving independent safety enforcement during revalidation. A sampled \(\text{p99}\) latency diagnoses a performance regression; it does not constitute a worst-case timing proof.

Table 3: Handoffs-by-limits synthesis grid: A five-by-five matrix mapping five canonical signal handoffs (\(\SignalHandoff_1\text{--}\SignalHandoff_5\)) across the Boundary (The Machine in Five Levels), Brain (The Cognitive Brain), Body (The Physical Body), and Nervous System (section 4) against five physical limits (\(\Latency, \Bandwidth, \HeatDissipationPower, \TimingJitter, \FaultDomainIsolation\)). Cells marked BINDING are the budgets that drive selection; Non-binding means the scenario budget meets that dimension with margin. These illustrative allocations organize the timing and isolation evidence still required; a non-binding cell is not a qualification verdict.

Canonical Handoff Boundary	Latency Limit (\(\Latency\))	Bandwidth Limit (\(\Bandwidth\))	Energy & Heat Limit (\(\HeatDissipationPower\))	Determinism Limit (\(\TimingJitter\))	Fault Domain Isolation (\(\FaultDomainIsolation\))
\(\SignalHandoff_1\): Sensing \(\to\) Perception (Boundary)	BINDING \(\Latency \le 16.7\text{ ms}\), one frame period (sensor age dated at the frame’s middle row; the oldest row is older, The Observation Contract)	BINDING \(\Bandwidth \ge 1.2\text{ GB/s}\) (multi-camera 4K uncompressed streams)	Non-binding \(\HeatDissipationPower < 3\text{ W}\) (sensor head dissipation isolated)	BINDING \(\TimingJitter \le 1.0\text{ ms}\) (frame-sync triggers prevent skew)	Non-binding Defended by SerDes hardware & DMA ring buffers
\(\SignalHandoff_2\): Perception \(\to\) State (Brain)	BINDING \(\Latency \le 30.0\text{ ms}\) (camera and inertial motion estimate & feature window)	Non-binding \(\Bandwidth\approx 10\text{--}50\text{ MB/s}\) (compressed image features & 3D occupancy cells)	BINDING \(\HeatDissipationPower \approx 15\text{--}35\text{ W}\) (edge vision backbone accelerator envelope)	Non-binding Defended by sliding-window state estimator buffers	BINDING Spatial memory isolation: MPUs prevent memory corruption
\(\SignalHandoff_3\): State \(\to\) Plan (Brain)	BINDING chunk policy 40 ms p99 inside its 50 ms renewal period (Two proposers and the evidence horizon); autoregressive intent model 336 ms inside its 500 ms period (The Cost of a Fresh Evaluation)	Non-binding \(\Bandwidth < 5\text{ MB/s}\) (low-dimensional state & prompt embeddings)	BINDING \(\HeatDissipationPower \approx 30\text{--}75\text{ W}\) (transformer/diffusion matrix accelerators)	Non-binding Defended by receding-horizon chunking & spline buffers	BINDING Host faults must not halt the independent permission path
\(\SignalHandoff_4\): Plan \(\to\) Enforcer (Nervous System)	BINDING chunk lease 60 ms (candidate allocation; age at admission from table 1); active-command checks within each 1 ms tick; full admission budget recorded separately	Non-binding Defended by compact parameterized splines (\(\Bandwidth < 100\text{ kB/s}\))	Non-binding \(\HeatDissipationPower < 0.5\text{ W}\) (fixed-point constraint evaluation on MCU)	BINDING \(\TimingJitter \le 100\,\MicroUnitPrefix\text{s}\) (cycle-deterministic packet reception on MCU)	BINDING Hardware boundary: private bus, separate oscillator, isolated held-up rail
\(\SignalHandoff_5\): Enforcer \(\to\) Actuator (Body)	BINDING \(\Latency \le\) 1 ms (servo interval 1 ms; current loop 50 μs)	Non-binding \(\Bandwidth\approx 1\text{--}5\text{ Mbps}\) (cyclic packets over deterministic command bus)	BINDING \(\WindingCurrent^2 \ElectricalResistance\) copper winding dissipation, MOSFET switching losses	BINDING \(\TimingJitter < 10\,\MicroUnitPrefix\text{s}\) (hard real-time PWM phase alignment & FOC)	BINDING Galvanic isolation, out-of-band analog E-stops, STO circuits

Definition 4.3: Handoff record

Handoff record is the record that states one interface limit at one of the five handoffs between sensing and actuation: its value, the conditions under which it holds, its uncertainty and margin, the detector that catches an excursion, its provenance, and whether the value is a requirement, a proven bound, or a measured distribution.

1. Significance: It is the second record in the record chain, after the limit record of the Body, and the first that ties a timing claim to the interface where the time is spent. On the running machine its \(\SignalHandoff_4\) entry is the 60 ms chunk lease, recorded as a requirement whose margin depends on the intervals of table 1.
2. Distinction: Unlike a limit record, which describes a physical envelope of the plant such as credible deceleration, a handoff record describes an interface between two subsystems and names the clock on which its times are expressed. Unlike a latency in a profiling log, it states its bound kind, so a percentile cannot pass for a worst case.
3. Common pitfall: Recording a bench \(\text{p99}\) as a proven bound. The record then carries a number that the permission path trusts in conditions the bench never reached.

Every boundary condition in the grid is recorded this way, so the budgets survive changes of hardware, firmware, and model. Each entry carries the six elements of a limit record and adds the fields that locate the limit at a handoff and state what evidence supports it (table 4).

Table 4: Conceptual fields of the handoff record: The six limit-record elements of The six elements of a limit record, extended with the handoff, bound kind, and clock domain that locate a limit in the machine and state what evidence supports it.

Field Name	Physical SI Units	Structural Invariant & Description
signal_id	dimensionless	Unique alphanumeric identifier (for example, SIG_VIO_01, SIG_TRQ_AX1).
source_subsystem	dimensionless	Originating hardware or software module (Camera_SerDes, Planner_VLA).
destination_subsystem	dimensionless	Receiving hardware or software module (State_Estimator, Safety_MCU).
handoff	dimensionless	The handoff the signal crosses (\(\SignalHandoff_1\) to \(\SignalHandoff_5\)).
physical_dimension	dimensionless	Target limit category (\(\Latency\), \(\Bandwidth\), \(\HeatDissipationPower\), \(\TimingJitter\), \(\FaultDomainIsolation\)).
value	SI units (\(\text{ms}\), \(\text{MB/s}\), \(\text{W}\), \(\MicroUnitPrefix\text{s}\))	Allocated budget, or the measured distribution it is checked against; for \(\SignalHandoff_4\), the chunk lease derived from the stopping budget.
conditions	as recorded	Payload, temperature, supply voltage, firmware build, and concurrent workload under which the value holds; the value lapses when they change.
uncertainty	same as value	Error bound of the instrument or model that produced the value.
margin	same as value	Engineering margin between the operating target and the breakdown threshold.
detector	dimensionless	Runtime monitor that catches an excursion (for example, a lease timer, a rail-voltage monitor, or a phase-current sensor).
provenance	dimensionless	Source of the value, including its evidence category (measured, derived, datasheet, or illustrative).
bound_kind	dimensionless	requirement, proven bound, or measured distribution; only a proven bound may stand in for a worst case.
clock_domain	dimensionless	Clock on which every time-valued field is expressed; a handoff that feeds the permission path uses the safety microcontroller’s clock.
verification_timestamp	UTC timestamp	Date of bench falsification and sign-off; a log field, never an input to an age test.

The four timing events of table 1 sit on this grid’s handoffs, capture within \(\SignalHandoff_1\), dispatch at \(\SignalHandoff_2\), admission at \(\SignalHandoff_4\), and brake onset at \(\SignalHandoff_5\), so the grid’s latency column follows the same single execution path as the timing table, and every time in it is expressed on the safety microcontroller’s clock. Together, those rows show that the chunk lease at \(\SignalHandoff_4\) cannot be chosen in isolation from the stopping distance below it or the inference renewal rate above it.

4.9.1 Coupling the distance, lease, and supply budgets

Shortening the chunk lease to save stopping distance without checking how fast the proposer renews causes the lease to expire before the next chunk arrives so the robot stutters from stop to stop, whereas lengthening the lease to ride out slow renewals lets the robot overrun its rack-end clearance before braking begins. The machine’s physical, cognitive, and nervous subsystems therefore meet at a single shared budget, with the chunk lease at their point of convergence. In Kinetic Momentum, the loaded machine moving at its 1.5 m/s drive limit had to come to a complete stop within the 1.10 m clearance available at a rack end, and accounting for deceleration mechanics and fixed braking overheads left 258.3 ms for all computational and communication activities preceding brake onset. Section 4.4 then allocated a portion of this window: when a proposer stalls, it retains motion authority for one chunk lease before the emergency stop command reaches the motor drives one tick and one bus cycle later, bringing the running stopping budget to 835.5 mm.

Because the proposer needs enough time to renew that lease before it expires, The Cost of a Fresh Evaluation sets the lower bound from what each learned model can supply. The intent model’s INT4 weights require 24.5 ms just to stream across the memory bus, and a complete inference pass of compute-bound prefill followed by bandwidth-bound autoregressive decoding consumes 336 ms, which means that at 2 Hz the intent model cannot renew proposals on tens-of-milliseconds timescales. By contrast, the action chunking policy streams its parameters in 1.12 ms, and its target 20 Hz cadence supplies a fresh trajectory chunk every 50 ms. Its illustrative 40 ms \(\text{p99}\) inference latency makes this cadence a feasible nominal supply target rather than a guaranteed worst-case bound, so intercepting late, dropped, or corrupt renewals remains the responsibility of the independent permission path.

The lease must outlast renewal and expire well before the stopping budget runs out.

These constraints dictate the lease rule for the machine. For continuous, uninterrupted trajectory tracking, the lease duration must exceed the proposer’s renewal interval plus an allowance for tail jitter. Simultaneously, to guarantee physical safety, the lease must fit within the pre-brake ceiling of equation 2 once detection latency, bus transport, actuator brake onset, and sensor evidence age at admission are deducted: \[\ChunkRenewalPeriod + \RenewalJitterAllowance < \ChunkLease \le \frac{\ClearDistance - \LocalizationBound - \ProtectiveClearanceMargin - \SpeedAtDetection^2/2\CredibleBrakingDeceleration}{\SpeedAtDetection} - \PermissionLoopPeriod - \CommandTransportTime - \ActuatorResponseTime - \ObservationAge \tag{4}\] where \(\ChunkRenewalPeriod\) is the chunk policy’s nominal renewal period, \(\RenewalJitterAllowance\) is the margin allocated for interarrival timing variations, and \(\ObservationAge\) is charged as the evidence’s age at admission, rows 1 and 2 of table 1 together, not its age at dispatch alone. This inequality captures the coupled cyber-physical budget in a single mathematical relation. The left side reflects compute supply, bounded by the neural proposer. The first term on the right reflects physical mechanics, governed by vehicle speed, workspace clearance, and braking deceleration. The remaining subtractive terms account for detection and communication delays, actuator brake onset, and the observation age accumulated across the perception pipeline. A faster vehicle, a less aggressive brake, or a tighter workspace lowers the upper bound; a slower or more jitter-prone neural network raises the lower bound. If the two bounds cross, no lease can preserve both uninterrupted proposal tracking and the stopping guarantee at that velocity; the permission path must interrupt tracking before authority expires.

On the mobile manipulator, the lower bound evaluates to the 55 ms renewal floor derived in notebook 4.1. The upper bound provides 236.3 ms prior to deducting observation age; subtracting the 51.6 ms capture-to-dispatch age allocated in row 1 of table 1 leaves 184.7 ms. Because the observation must also traverse the dispatch-to-admission pipeline before execution, charging that interval’s budget from table 1 increases total evidence age at admission to 114.9 ms, leaving an effective upper limit of 121.4 ms. This is the same subtraction as the notebook’s, taken in a different order. The notebook charged the lease first and left 176.3 ms under the ceiling for evidence age and the stop profile; the lease rule charges the age first and leaves this limit for the lease. The selected 60 ms lease sits just above the lower renewal bound, reflecting the physical reality that every additional millisecond of lease duration consumes 1.5 mm of stopping clearance at maximum drive velocity. This value remains an unverified allocation until the physical vehicle demonstrates that all constituent intervals fit within budget under load. Artificially inflating the lease duration to mask software latency spikes merely consumes stopping clearance, trading mechanical safety margin for compute slack.

Because each chunk packages base velocities and arm joint targets together, the architecture enforces a single shared chunk lease across both subsystems. When that lease expires, each physical body must execute a kinematically feasible, state-matched fallback maneuver. The base’s 258.3 ms pre-brake ceiling governs this allocation; it does not imply that the arm possesses surplus margin. The arm analysis in The Planning Handoff and the Trajectory Record evaluates stopping distance and response travel against its own localized workspace clearances. Validating the shared lease requires verifying timing, evidence age, dynamic state, and fallback limits simultaneously across both base and manipulator. The goal the intent model supplies is governed by a different timer, the intent lease, which limits how long a high-level goal remains active before it must be renewed and is sized in its own chapter, not from this stopping budget.

↪ The intent lease and its contract are developed in The Intent Lease Specification and Contract.

Checkpoint 4.3: The handoffs matrix and physical budgets

Before testing the lease on a humanoid and reviewing the engineering fallacies, verify your understanding of system-wide interface contracts:

• Signal handoff classification: Can you identify the five canonical handoffs (\(\SignalHandoff_1\text{--}\SignalHandoff_5\)) bridging physical plant mechanics to high-level deliberative reasoning?
• Binding physical constraints: Can you explain why sensory handoffs bind first on bandwidth and exposure latency, whereas actuation handoffs bind first on determinism and heat?
• Handoff record provenance: Can you describe why every numerical limit in an autonomous system must record its evidence category, operating conditions, bound kind, and verification status?
• The lease rule: Can you state the two limits on the chunk lease, one set by successful-admission interarrival and one by the pre-brake ceiling, and explain why a p99 inference time alone proves neither?

Systems Perspective 4.2: A deadline set by a fall

Question: Does the split among proposer, lease, and permission path still hold when the deadline comes from a fall rather than a stop?

An upright biped diverges from balance on the characteristic timescale \(\BalanceDivergenceTime = \sqrt{\MassCenterHeight/\Gravity}\), where \(\MassCenterHeight\) is its center-of-mass height. Modeling the biped in the sagittal plane as an inverted pendulum of point mass \(\Mass\) pivoting above a contact point at height \(\MassCenterHeight\) (the linear inverted pendulum model that Kajita et al. (2001) introduced for walking-pattern generation), Newton’s second law for a small angular deflection \(\TiltAngle\) from vertical yields: \[\Mass \MassCenterHeight^2 \BipedTiltAcceleration = \Mass \Gravity \MassCenterHeight \sin\TiltAngle \implies \BipedTiltAcceleration \approx \frac{\Gravity}{\MassCenterHeight} \TiltAngle\] The characteristic equation \(\BipedTiltAcceleration - \PendulumNaturalFrequency^2 \TiltAngle = 0\) yields natural divergence modes \(e^{\pm \PendulumNaturalFrequency \TimeInstant}\) with natural frequency \(\PendulumNaturalFrequency = \sqrt{\Gravity/\MassCenterHeight}\). The growing exponential mode governs how quickly an unrecovered perturbation tilts out of control, with characteristic divergence timescale: \[\BalanceDivergenceTime = \frac{1}{\PendulumNaturalFrequency} = \sqrt{\frac{\MassCenterHeight}{\Gravity}}\] For an adult-scale humanoid with its center of mass near hip height (\(\MassCenterHeight =\) 0.9 m) and gravitational acceleration \(\Gravity = 9.81\,\text{m/s}^2\), this evaluates to \(\BalanceDivergenceTime = \sqrt{0.9 / 9.81} \approx 0.303\,\text{s} = 303\,\text{ms}\) (about 303 ms). This figure represents a characteristic divergence rate, not an absolute recovery deadline. The actual time available to recover depends on the biped’s initial angular deflection, its angular velocity, support polygon geometry, and available kinematic reach. Nonetheless, this timescale demonstrates why deliberative inference cannot be placed in the feedback loop governing local balance: an explicit, state-dependent recovery calculation must define the hard real-time deadline.

The architectural partition between proposer, lease, and permission path remains valid for bipeds, but the recovery deadline becomes dynamic and state-dependent. Rather than bringing drives to a standstill, balance recovery requires placing a foot at the dynamic capture point (Pratt et al. 2006), a process demanding both finite swing time and peak joint torque. The interface lease must accommodate these physical demands:

• The lease is sized from the dynamic capture-point deadline. On a wheeled base, an expired lease triggers mechanical braking to bring the vehicle to rest (\(\SpeedAtDetection \cdot \ChunkLease\)). On an underactuated biped, locking the joints mid-stride makes the fall worse, because engaging holding brakes while the center of mass moves forward causes the torso to pivot forward into an uncontrolled ground impact. Where reach, swing-time, torque, and energy limits permit recovery, the lease fallback action must therefore execute an emergency capture-point step. The chunk lease, permission tick, fieldbus transit, and observation age must all fit within the dynamic recovery budget while reserving sufficient time to swing and plant the foot. The characteristic fall timescale frames this constraint but cannot substitute for dynamic simulation.
• The proposer must meet the recovery budget. An inference renewal period that consumes a major fraction of the characteristic fall timescale cannot safely participate in posture stabilization. High-level intent models must remain decoupled from balance reflexes. Whether a mid-level chunk policy can safely control locomotion depends on whether its renewal interval and tail jitter leave adequate margin for fallback step execution.
• Actuator thermal limits and supply sag constrain the recovery step. Executing an emergency recovery step demands simultaneous peak torque across multiple leg joints. This surge draws massive transient current, inducing resistive heating in motor windings and risking DC bus voltage collapse (Power distribution impedance, transient droop, and brownout resets). Consequently, the permission path must evaluate candidate recovery trajectories against instantaneous thermal and electrical reserves before admission.

Pratt, Jerry, John Carff, Sergey Drakunov, and Ambarish Goswami. 2006. “Capture Point: A Step Toward Humanoid Push Recovery.” Proceedings of the 6th IEEE-RAS International Conference on Humanoid Robots (Humanoids), 200–207. https://doi.org/10.1109/ICHR.2006.321385.

Kajita, Shuuji, Fumio Kanehiro, Kenji Kaneko, Kazuhito Yokoi, and Hirohisa Hirukawa. 2001. “The 3D Linear Inverted Pendulum Mode: A Simple Modeling for a Biped Walking Pattern Generation.” Proceedings of the 2001 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) 1: 239–46. https://doi.org/10.1109/IROS.2001.973365.

Whether the deadline comes from a warehouse rack end or a biped’s fall, the handoff matrix and the lease rule only protect the machine if the hardware and firmware underneath them honor the boundaries the equations assume. In practice, subtle implementation shortcuts in watchdog servicing, calibration ports, state feedback, and middleware configurations routinely bypass those boundaries without triggering a compile or bench error.

4.10 Fallacies and Pitfalls

A block diagram draws a clean boundary between high-level deliberation and low-level real-time enforcement, but physical boards and firmware routinely couple the two through shared power rails, common clock domains, interrupt lines, or auxiliary diagnostic ports. When a planning subsystem crashes or misbehaves, those hidden couplings decide whether the safety enforcement loop actually survives.

Pitfall: Servicing a safety watchdog inside a high-priority timer interrupt rather than an application-verified safety loop.

The mobile manipulator relies on a hardware self-watchdog to trigger the Safe Torque Off path of section 4.6 if it receives no feed within 5 ms. Because an enforcer that stops executing can no longer command a coordinated stop, this immediate hardware cutoff is essential. A dangerous design mistake occurs when engineers service this watchdog from a high-priority hardware timer interrupt rather than directly from the safety loop. If the lower-priority enforcement task deadlocks on a mutex or crashes, the hardware timer interrupt continues firing every 1 ms tick. The watchdog remains fed while the enforcer has silently lost its ability to evaluate torque limits, kinematic clearances, and lease budgets.

In distributed systems engineering, this error is known as the confusion of liveness with correctness. A node responding to network ping heartbeats can be livelocked, thrashing on memory allocation, or deadlocked on an internal mutex. Servicing a watchdog must never signify mere scheduler activity. Instead, every refresh pulse must be conditioned on the successful, sequential retirement of all required verification stages, for example by requiring a monotonic task-completion token before a windowed hardware watchdog is serviced. An independent timer tick confirms only that interrupt dispatching still operates; it provides zero evidence that the controller has safely evaluated the machine’s physical state (section 4.4.1).

Architect’s countermeasure: Bind watchdog refresh pulses strictly to the verified completion of the safety loop’s invariant checks, deploying windowed hardware watchdogs that trip on both execution underruns and spurious early feeds.

Pitfall: Leaving auxiliary diagnostic or calibration interfaces unmediated in production operation.

Suppose the mobile manipulator validates base velocity proposals through its permission path, yet its drive-wheel motor drives retain an unmonitored serial calibration interface. If a diagnostic daemon writes a \(35.0\text{ A}\) test value directly into an inverter register through that port, the proposal mailbox continues reporting zero velocity. Checking the mailbox reveals nothing about the bypassed command, yet the drive wheels produce torque that no motion safety check ever evaluated or approved. Actuation authority is not defined by a logical software diagram; it encompasses every physical wire, bus transceiver, and digital interface capable of changing a power-stage register. Service interfaces must therefore incorporate operational interlocks or hardware jumpers that prevent calibration writes from bypassing the enforcer during production runs.

Architect’s countermeasure: Electrically isolate, physically jumper, or cryptographically interlock all auxiliary diagnostic and calibration ports during operational modes, routing all register writes exclusively through the real-time enforcer.

Fallacy: Evaluating safety barrier invariants on commanded trajectory setpoints is equivalent to evaluating physical plant state.

Suppose an arm controller evaluates safety using a control barrier function (Ames et al. 2019), a scalar function \(\BarrierFunction\) of the state space that remains positive within the safe set and is kept from going negative by filtering unacceptable control inputs. To conserve fieldbus bandwidth, an engineer might evaluate \(\BarrierFunction\) using commanded joint positions rather than load-side encoder feedback. If a transmission gear strips or a drive belt shears, the trajectory interpolator continues generating valid, smooth setpoints. The enforcer calculates that the system remains safely inside the barrier set (\(\BarrierFunction(\CommandedJointConfiguration) > 0\)), even while the decoupled arm collapses into an obstacle. Safety enforcement belongs at the causal boundary, which means it must ingest ground-truth physical state measurements through dependable sensory channels and account for sensor noise and latency. Auditing the command stream reveals what the planner intended, but only independent physical feedback captures where the machinery actually moves.

Ames, Aaron D., Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. 2019. “Control Barrier Functions: Theory and Applications.” 2019 18th European Control Conference (ECC), 3420–31. https://doi.org/10.23919/ECC.2019.8796030.

Architect’s countermeasure: Close safety barrier evaluations strictly around verified, independent sensor measurements (such as optical load encoders and current shunts) rather than planned trajectory setpoints.

↪ The control barrier function and the safety filter that keeps it nonnegative are developed in Safe Sets as Conditional Permission.

Fallacy: Nominal, fault-free operating logs are sufficient to prove physical architectural isolation.

Logging thousands of operating hours without a missed deadline demonstrates nominal stability, but clean telemetry cannot expose hidden cross-subsystem couplings that awaken only during failure modes. Subsystem isolation often breaks down under unmodeled physical interactions, such as supply-rail voltage sags when multiple inverters switch simultaneously, bus contention storms, or memory corruption spilling across addressing domains. Rigorous qualification requires deliberate fault injection: inducing power transients, flooding communication buses, corrupting policy memory, and mechanically locking motor shafts on a dynamometer. Each experiment must evaluate an explicit, quantitative response bound, such as locked-rotor detection clamping motor current within \(2.0\text{ ms}\), rather than treating the mere absence of an operating system crash as validation. Fault experiments support the isolation claim within their stated fault and load coverage when the system maintains invariant enforcement or reaches the specified fallback within the quantitative response bounds. They do not establish coverage of untested fault combinations.

Architect’s countermeasure: Validate fault-domain independence through active fault-injection regimes (power sags, clock glitches, bus flooding, and memory corruption) with quantitative pass-fail response bounds.

Pitfall: Assuming zero packet loss in robotics middleware equates to deterministic real-time delivery.

A publish-subscribe transport configured for reliable delivery attempts to recover lost packets, but successful recovery does not establish deterministic real-time delivery. After congestion or interference, a reliable transport delivers the burst of queued, obsolete setpoints that section 4.3.2 traced, each describing a robot state that no longer exists. While switching to a freshest-sample policy prevents queue backlogs, dropping stale frames does not inherently bound scheduling jitter, serialization delay, or driver execution latency. The cycle-critical actuation path requires two separate guarantees: an engineered worst-case delivery bound across the physical communication bus and an explicit freshness deadline enforced by the receiver before executing any torque command.

Architect’s countermeasure: Budget the complete transport response under declared traffic and fault conditions, enforce deadline-based freshness at the consumer, and isolate cycle-critical commands from supervisory middleware traffic regardless of the bus architecture.

4.11 Summary

The Physical Body derived the physical stopping budget for the loaded machine, and The Cognitive Brain established the operational cadences for proposal generation and evidence age. This chapter introduced the real-time permission path designed to enforce those constraints, establishing a two-processor architecture whose physical isolation still awaits evaluation under load. To guarantee deterministic safety, the permission path holds exclusive write access to the motor drive registers. It communicates with the unprivileged proposal engine through a lock-free mailbox that never stalls the high-frequency control tick, while communication and computation delays mandate closing joint-level feedback loops directly within the drives. By evaluating command interfaces, from joint positions to operational-space impedances, the permission path prices each check against available stopping clearance. Combining these constraints yields a bounded time window during which an action proposal is permitted to drive physical actuators. On the running machine, this analysis produces a chunk lease that exceeds the proposer’s renewal interval while fitting within the pre-brake delay budget. The resulting handoff record documents this lease alongside its validity conditions and evidence requirements. This lease and the mechanisms behind it remain claims until they are verified under worst-case compute jitter, bus contention, malformed proposals, sensor faults, and degraded braking. Table 5 summarizes the four governing relations that define the nervous system’s timing, lease duration, and response guarantees, along with the engineering decisions they resolve.

Table 5: Key equations of the nervous system: The four relations behind the chapter’s rate, lease, and response decisions, with the place each is derived. \(\PrebrakeDelayCeiling\) is the right side of the pre-brake ceiling.

Equation	What it bounds or decides	Derived
\(\DelayPhaseLag = \CrossoverFrequency\left(\dfrac{\SamplingPeriod}{2} + \EnforcerComputeTime + \CommandTransportTime\right)\)	The phase lost to sample-and-hold, computation, and transport delay at crossover, dictating whether a control loop can close across the network bus or must reside inside the drive	equation 1
\(\PrebrakeDelay \le \dfrac{\ClearDistance - \LocalizationBound - \ProtectiveClearanceMargin - \SpeedAtDetection^2/2\CredibleBrakingDeceleration}{\SpeedAtDetection}\)	The pre-brake ceiling: the maximum allowable delay before braking onset that still guarantees stopping within available clearance	equation 2
\(\ChunkRenewalPeriod + \RenewalJitterAllowance < \ChunkLease \le \PrebrakeDelayCeiling - \PermissionLoopPeriod - \CommandTransportTime - \ActuatorResponseTime - \ObservationAge\)	The lease rule, bounding chunk lease duration between the proposer’s renewal floor and the ceiling imposed by detection, transport, brake onset, and evidence age	equation 4
\(\WorstCaseResponseTime_i = \WorstCaseExecutionTime_i + \TaskBlockingTime_i + \TaskInterferenceTime_i \le \TaskRelativeDeadline_i\)	Worst-case response-time schedulability for hard real-time tasks, verifying that execution, blocking, and interference fit within the task deadline	equation 3

Key Takeaways: The permission path and determinism

• The permission path alone writes the drives: Learned models act only as unprivileged proposal engines (\(\CandidateProposal_t\)). Write access to the motor drive registers belongs to the deterministic real-time enforcer alone, hosted on silicon whose isolation from the proposer must be verified experimentally.
• Cadence is dictated by physics, not software: The four-tier concurrency hierarchy (20 kHz FOC current regulation, 1 kHz kinematic enforcer checks, 20 Hz action-chunk renewal, and 2 Hz multimodal deliberation on the running machine) is governed by physical time constants (\(\ElectricalTimeConstant = \PhaseInductance/\PhaseResistance\)), total loop delay (a phase lag \(\DelayPhaseLag = \CrossoverFrequency(\SamplingPeriod/2 + \EnforcerComputeTime + \CommandTransportTime)\), which keeps the joint loops in the drives), exposure horizons, and model execution budgets.
• The exchange never waits, and every proposal expires: The permission path reads the mailbox in a single bounded attempt per tick, retaining the currently active, independently admissible chunk if a write collision occurs. Every proposal carries an evidence timestamp and an explicit expiration horizon that terminates its authority even if an explicit cancellation never arrives.
• Stopping dynamics dimension the chunk lease: For the mobile manipulator operating at its drive limits, the pre-brake ceiling is 258.3 ms. Sizing the lease at 60 ms places it just above the proposer’s renewal floor. The interval from the final admitted chunk to brake onset takes 82 ms, and its lease path brings the stopping budget’s running total to 835.5 mm of the 1.10 m clear distance before evidence age and the remaining stop margins are charged (row 4 of The warehouse mobile manipulator's stopping budget).
• Worst-case bounds outrank empirical distributions: Tail-latency percentiles such as \(\text{p99}\) cannot establish real-time safety. Deterministic enforcement requires bounding worst-case computation, blocking, and interference (\(\WorstCaseResponseTime_i = \WorstCaseExecutionTime_i + \TaskBlockingTime_i + \TaskInterferenceTime_i \le \TaskRelativeDeadline_i\)) under rigorously qualified operating conditions.
• The permission path is only as independent as what it shares: If the permission path shares a clock source, power rail, memory bus, or silicon die with the proposal engine, faults in the proposer can compromise the enforcer. The two-processor split is an architectural hypothesis that requires empirical validation through stress testing and fault injection (Empirical Verification of Silicon Isolation), not an assumed property of separate software processes.
• The command interface sets what the permission path must check: Joint position targets express kinematic intent that the enforcer can verify geometrically, but they cannot bound contact forces. Velocity interfaces require a bounded motion projection, while torque interfaces require dynamic bounds and a feasible fallback. Impedance targets bound steady-state interaction forces, but only if the enforcer validates the stiffness and damping gains alongside the reference trajectory.
• Locate interface regressions at their handoff: The system handoff record maps every timing and clearance limit to one of five architectural boundaries, binding each to operational preconditions, evidence categories, and bound types. When performance regresses, engineers can isolate the offending subsystem against its allocated budget using like-for-like evidence.

Physical stopping limits, inference renewal rates, and the Nervous System’s response delays converge on one governing parameter, how long an admitted proposal may command the actuators. When a timing question arises on a new machine, the first diagnostic is to price that parameter, converting the lease path to distance at the operating speed and comparing it with what the stopping budget has left. A lease that cannot fit between the renewal floor and the pre-brake ceiling cannot sustain uninterrupted proposal tracking at that speed, and a faster processor helps only if it lets the renewal period, and with it the floor, shrink.

This chapter closes Part I, and with it the argument that the first law, irreversibility (principle 1), set in motion. The Body turned irreversibility into distances and limit records, the Brain into proposals that arrive late and expire, and the Nervous System into a rule of authority. Motion that cannot be undone may be granted only for as long as the stopping budget can still guarantee the stop. The chunk lease is that rule written as a number, and the handoff record is where the number is kept. Everything the machine later learns or is permitted to do inherits this bound, including the demonstrations it collects while the permission path is watching.

4.12 Historical Perspective and Further Reading

The phase-margin arguments that keep high-bandwidth joint feedback loops inside local motor drives predate digital computing. Nyquist (1932) established the foundational stability criterion that determines whether a closed-loop feedback amplifier will oscillate, and Bode (1945) formalized these dynamics into the gain and phase margins that control engineers budget today. When mechanical and analog controllers transitioned to software, sampled-data control theory formalized how digital sample-and-hold stages, discrete computation steps, and communication transport introduce pure time delays that consume this margin (Franklin et al. 1998). High-bandwidth feedback-loop placement in this chapter follows directly from this phase accounting: a control loop must close physically close to its sensors and actuators because any transport latency erodes phase margin that high-bandwidth physical dynamics cannot spare.

Joseph, Mathai, and Paritosh Pandya. 1986. “Finding Response Times in a Real-Time System.” The Computer Journal 29 (5): 390–95. https://doi.org/10.1093/comjnl/29.5.390.

Audsley, Neil, Alan Burns, Mike Richardson, Ken Tindell, and Andy J. Wellings. 1993. “Applying New Scheduling Theory to Static Priority Pre-Emptive Scheduling.” Software Engineering Journal 8 (5): 284–92. https://doi.org/10.1049/sej.1993.0034.

Reeves, Glenn E. 1997. What Really Happened on Mars? Electronic mail message, Jet Propulsion Laboratory.

Predictable execution and real-time scheduling supply the second pillar of this architecture. Liu and Layland (1973) proved that assigning static priorities monotonically by rate guarantees schedulability for periodic task sets up to a theoretical utilization bound. Subsequent response-time analysis transformed this sufficient condition into an exact test by summing worst-case execution time, resource blocking, and higher-priority task interference (Joseph and Pandya 1986; Audsley et al. 1993). When shared resources threatened these guarantees with priority inversion, Sha et al. (1990) bounded the duration of blocking through priority inheritance and the priority ceiling protocol. The Mars Pathfinder mission in 1997 demonstrated precisely what the absence of such bounds costs in production, when unmanaged priority inversions triggered repeated system resets on the Martian surface (Reeves 1997). Extending predictability to distributed embedded systems, Kopetz (2011) established the foundations of time-triggered design, arguing that safety-critical systems must remain statically analyzable prior to execution and introducing the concepts of state messages and temporal accuracy that govern the proposal headers in this chapter.

The lock-free coordination between the high-level policy proposer and the low-level safety permission path descends from foundational work on sharing state without waiting. Lamport (1977) demonstrated that a concurrent reader can detect an overlapping write using version sequence numbers alone. Simpson (1990) developed the asynchronous four-slot mechanism for flight-control avionics running on unrelated clocks, Herlihy (1991) formalized the theoretical hierarchy of wait-free synchronization, and Kopetz and Reisinger (1993) formulated the non-blocking write protocol specifically for real-time readers. Industrial networks confronted similar timing and isolation challenges on the wire: Controller Area Network (CAN) bus architectures resolved medium access through deterministic, bitwise priority arbitration (International Organization for Standardization 2015), while the functional-safety profiles of IEC 61784-3 established the black-channel principle, encapsulating integrity and freshness guarantees within the messages so that the transmission medium itself need not be trusted (International Electrotechnical Commission 2021). Finally, the concept of bounded temporal leases originated in distributed systems, where Gray and Cheriton (1989) restricted how long a client could rely on cached data so that an unresponsive client blocked the server for at most one lease period. Physical AI systems adapt this lease mechanism to an entirely different physical objective: rather than preserving distributed cache consistency, the lease is bounded by the kinetic stopping budget and renewal deadlines of the safety monitor.

Kopetz, Hermann, and Johannes Reisinger. 1993. “The Non-Blocking Write Protocol NBW: A Solution to a Real-Time Synchronization Problem.” Proceedings of the 1993 Real-Time Systems Symposium, 131–37. https://doi.org/10.1109/REAL.1993.393507.

International Organization for Standardization. 2015. ISO 11898-1:2015: Road Vehicles, Controller Area Network (CAN), Part 1: Data Link Layer and Physical Signalling. International Organization for Standardization.

International Electrotechnical Commission. 2021. IEC 61784-3:2021: Industrial Communication Networks, Profiles, Part 3: Functional Safety Fieldbuses, General Rules and Profile Definitions. International Electrotechnical Commission.

Gray, Cary G., and David R. Cheriton. 1989. “Leases: An Efficient Fault-Tolerant Mechanism for Distributed File Cache Consistency.” Proceedings of the Twelfth ACM Symposium on Operating Systems Principles (SOSP), 202–10. https://doi.org/10.1145/74850.74870.

For readers seeking deeper exploration, six works trace the lineage from classical feedback theory to modern real-time permission paths:

• Franklin et al. (1998) provides the definitive treatment of digital and sampled-data control, analyzing how zero-order hold circuits, computation time, and transport latencies introduce phase lag. This analysis forms the theoretical foundation for the multi-rate cadence decisions in section 4.3.
• Liu and Layland (1973) is a concise, classic paper that remains the clearest demonstration of how rate-monotonic priority assignment guarantees schedulability under worst-case task arrival patterns.
• Sha et al. (1990) formalizes the priority inheritance and priority ceiling protocols alongside their mathematical blocking bounds. This work explains both the recovery strategy deployed on Mars Pathfinder and the derivation of the blocking term \(\TaskBlockingTime_i\) in equation 3.
• Buttazzo (2011) offers an authoritative textbook treatment of hard real-time systems, fixed-priority and deadline-driven scheduling, and response-time analysis, complete with concrete task sets that readers can verify by hand.
• Kopetz (2011) develops real-time architectures from the time-triggered perspective. Its chapters on real-time entities, temporal accuracy, and communication clarify why our proposal mailbox exchanges idempotent state messages rather than transient event queues.
• Simpson (1990) presents the four-slot mechanism in its original flight-critical avionics context, demonstrating how four memory slots decouple an asynchronous reader and writer without locking, waiting, or sample loss.

Franklin, Gene F, J David Powell, and Michael L Workman. 1998. Digital Control of Dynamic Systems. 3rd ed. Addison-Wesley.

Sha, Lui, Ragunathan Rajkumar, and John P. Lehoczky. 1990. “Priority Inheritance Protocols: An Approach to Real-Time Synchronization.” IEEE Transactions on Computers 39 (9): 1175–85.

Buttazzo, Giorgio C. 2011. Hard Real-Time Computing Systems: Predictable Scheduling Algorithms and Applications. 3rd ed. Real-Time Systems Series. Springer. https://doi.org/10.1007/978-1-4614-0676-1.

Kopetz, Hermann. 2011. Real-Time Systems: Design Principles for Distributed Embedded Applications. 2nd ed. Real-Time Systems Series. Springer. https://doi.org/10.1007/978-1-4419-8237-7.

Simpson, H. R. 1990. “Four-Slot Fully Asynchronous Communication Mechanism.” IEE Proceedings E (Computers and Digital Techniques) 137 (1): 17–30. https://doi.org/10.1049/ip-e.1990.0002.

What’s Next: From anatomy to closed-loop learning

When an embodied machine modifies or rejects a human command before execution, the recorded demonstration no longer reflects unconstrained intent. The Body, the Brain, and the Nervous System establish physical limits, learned proposals, and a timed permission path. During data collection, such as teleoperated openings of the spring-latched cage door, that path may clamp, rate-limit, or refuse an operator’s request, while the body may deliver motion that differs from the admitted command. The limit and handoff records preserve the conditions behind those interventions. In Part II, Physical Data begins from the reality that a physical machine manufactures its own training data, so each executed action changes the observations that follow and each record carries what the operator requested, what the permission path admitted, and what the body delivered. It then establishes what a demonstration must retain so that a policy can learn the task without mistaking the collecting machine’s limitations for intended behavior.