Supervisory Intervention

14 Supervisory Intervention

Lecture slides for this chapter

Purpose

Physical AI stack focus for this chapter.

Why can handing a moving robot to a human operator cause the collision the handover was meant to prevent?

Most deployed robots keep a person in reserve for the situations their learned policies cannot handle, and that reserve is usually treated as the final safeguard. A person, however, needs a large fraction of a second to respond even while watching closely and several seconds after only monitoring. A machine moving at walking pace covers meters in that time, so a request for help can consume the very clearance the help was meant to protect. Taking over also creates hazards of its own. Two controllers that each believe they hold a joint can command it at once, a controller that believes the other still holds it can leave it unattended, and an abrupt switch between their commands jolts the drivetrain and the load it carries. A takeover that grants unchecked control lets a startled or lagging operator drive the machine into a rack. A log that does not mark who commanded each instant can neither settle what caused an incident nor keep the machine’s own near-failures out of the demonstrations it later learns from. Authority can change hands within a single control cycle, but the momentum already delivered across the causal boundary cannot be recalled, so a takeover must be engineered as a control action with its own deadline, its own limits, and its own record.

Learning Objectives

• Specify operator permissions through capability matrices that bind each authenticated role’s operations to physical channels, preemption tiers, and clearance-derived deadlines
• Select a state-dependent local fallback that remains physically feasible while human intervention is pending
• Calculate the latest fallback time and takeover speed ceilings from human reaction latency and remaining physical stopping clearance
• Evaluate the inherited chunk lease and the chosen manual lease against their modes’ stopping reserves and available fallback mechanisms
• Design authority handshakes that keep one owner on each actuator output and size fixed-endpoint \(\Glyph{C}^2\) command blends within each channel’s rate limit
• Diagnose mode confusion in split-channel handovers and specify the per-channel annunciation that keeps an operator’s model of ownership current
• Evaluate whether an authority record provides the cryptographic and kinematic evidence needed to reconstruct post-incident fault causality

Explore the concepts in this chapter

The volume’s concept map, opened on this chapter. Select a concept to read how it connects to ideas in other chapters. Open the full map ↗

14.1 Shared Authority

When a pallet blocks an aisle and the warehouse mobile manipulator requests a remote assistant to take over, the transfer introduces a delay that no test on the chassis can bound, because it belongs to a person. Part III left the running machine with a stopping budget whose every term belongs to the hardware, each with a declared bound and a loaded test that could refute it, even where the test has not yet run, as for the dispatch-to-admission interval \(\DispatchAdmissionInterval\) that The board-link budget and the dispatch-to-admission interval allocated but did not measure. Part IV begins where a person enters that loop.

Supervisory intervention transfers the right to propose actions from an autonomous policy to a human operator, and eventually returns that authority to the machine. Nearly every embodied machine learning system operating in the physical world relies on this exchange. Remote teleoperation assistants clear blocked aisles and resolve scenes that warehouse robots and autonomous vehicles cannot interpret on their own. Safety drivers and teach-pendant operators step in whenever an operational policy drifts outside its design envelope, and their corrections protect the hardware and supply demonstration data for later retraining. Engineering block diagrams often reduce this supervision to a single switch or an external arrow pointing into the plant. In the physical world, however, kinetic energy does not pause while a multiplexer toggles inputs. Authority transfer is a control maneuver with its own deadlines, and it must be executed in coordination with the slowest and least predictable element in the loop, the human operator.

How often that exchange happens on a mature fleet is a matter of public record in one jurisdiction. California requires every company testing autonomous vehicles on its public roads to file annual reports of autonomous miles and of the disengagements, transfers of control to a person, that occurred during them (California Department of Motor Vehicles 2026). Figure 1 plots the filings of one long-running fleet, Waymo’s.

Figure 1: A decade of reported takeovers: Waymo’s annual filings to the California DMV. (a) Autonomous miles driven on public roads under the safety-driver testing permit and the driverless testing permit. (b) Miles per reported disengagement under each permit, on a logarithmic axis. Each company defines which disengagements are reportable, and the regulator notes that the reports are not designed for comparison across companies; commercial deployment miles are excluded. Early years are transcribed from the filed PDFs. Data from California Department of Motor Vehicles (2026).

California Department of Motor Vehicles. 2026. Autonomous Vehicle Disengagement Reports.

Over the decade the safety-driver rate rose from about 1,200 to about 19,200 miles per disengagement, yet the fleet still reported 174 takeovers in its latest year, and the series is far from monotone. Between 2020 and 2021 the rate fell 3.8× while the miles driven grew 3.7×. Driverless testing reports one disengagement every 71,800 miles, 54 in its latest year. Two consequences follow for the machine. Human authority is not a phase a capable system grows out of; even the most experienced fleet exercises it every year, so the transfer mechanism is a permanent part of the design. The reported rate also depends on where the fleet drove and on what its operator chose to count, which is why an intervention count tells a reviewer how often the exchange happened but not, by itself, how well either party performed it.

↪ The two permit series as two stages of permission to operate, and how a machine leaves one stage for the next, are developed in Permission in Stages.

The central engineering problem of supervisory intervention is how authority can change hands on a moving machine without exhausting stopping clearance, letting two controllers drive the same actuator at once, or losing track of who commanded each instant. The fourth law, permission must be earned (principle 4), frames the answer, and here Part IV applies it for the first time to a person. Like an autonomous policy, a human operator receives control authority only while valid evidence supports that grant, and loses it the moment that evidence lapses. Until the platform’s permission path checks it, every command from an operator is an untrusted request that cannot cross the causal boundary. A safe transfer must therefore bind each authenticated role to explicit actuator channels and timing bounds, commit ownership atomically on a control tick, blend reference changes within drivetrain rate limits, and log who held authority at every cycle for incident review and policy retraining.

For the warehouse mobile manipulator, this timing constraint is direct and unforgiving. When the blocked aisle prompts the machine to request a remote assistant, at its chosen 1.3 m/s aisle speed a 4.5 s pause before braking, the design out-of-loop takeover time that section 14.2.2 derives from driver take-over studies, carries the machine 5.8 m, more than five times its 1.10 m rack-end clear distance. An operator’s intervention request reaches a chassis that is already in motion under an admitted command; human intent cannot erase physical momentum or make an actuator respond in zero time. The permission path resolves this transition in two stages. The arbiter that selects among the fallback ladder’s rungs also decides, for each channel, which source holds the right to propose: the learned policy, the operator, or, once that authority lapses, a fallback rung. The enforcer then admits or rejects each setpoint from the selected source against physical envelope invariants. Both stages run deterministically on a dedicated safety microcontroller (MCU). Source selection precedes the enforcer’s check, and rung selection follows it whenever the check fails, so human intervention adds a new input to the arbiter, a person, rather than a new component. Throughout this process, the plant must keep enough clearance to bring itself to a safe halt. Switching setpoints in a single step demands a sudden torque jump that strains motor drives, gearboxes, and payload stability. Delaying the transfer, in turn, uses up the remaining stopping margin even when both the learned policy and the human supervisor produce sensible trajectories on their own.

↪ Whether a human role that needs this much time can count as a safety measure at all, and who is blamed when it cannot, is developed in Oversight a Person Can Perform.

Parasuraman, Raja, and Dietrich H. Manzey. 2010. “Complacency and Bias in Human Use of Automation: An Attentional Integration.” Human Factors 52 (3): 381–410. https://doi.org/10.1177/0018720810376055.

¹ Situation Awareness Levels: Endsley (1995) set out situation awareness as three levels: perceiving the elements of a scene, comprehending what they mean together, and projecting their state forward. The levels fail separately. A remote assistant can see the pallet without projecting that the base will not stop short of it, which is why a console that reports where the operator is looking cannot shorten the response budget (section 14.6).

Endsley, Mica R. 1995. “Toward a Theory of Situation Awareness in Dynamic Systems.” Human Factors 37 (1): 32–64. https://doi.org/10.1518/001872095779049543.

Endsley, Mica R., and Esin O. Kiris. 1995. “The Out-of-the-Loop Performance Problem and Level of Control in Automation.” Human Factors 37 (2): 381–94. https://doi.org/10.1518/001872095779064555.

Because momentum and kinetic energy sit on the physical side of the causal boundary, the machine keeps moving under the last admitted setpoint while the remote operator pieces together what is happening in the aisle. That mental reconstruction is slow. It is the paradox Lisanne Bainbridge called the ironies of automation (Bainbridge 1983): engineers automate routine work to remove human error, yet leave human operators to handle the hardest, unmodeled edge cases that the automation cannot solve, where plant dynamics are abnormal and time is shortest. An operator who only monitors a screen also loses both manual feel and a current mental model of how the plant is moving. When an unexpected hazard forces a sudden takeover, that operator must act under tight time pressure with little context. Human vigilance fades quickly when watching for rare faults, and automation complacency makes the problem worse whenever secondary tasks compete for the supervisor’s attention (Parasuraman and Manzey 2010). Decades of human factors research confirm that passive monitoring erodes situation awareness¹ and adds long decision delays when automation fails without warning (Endsley and Kiris 1995). The machine must therefore protect its own collision-free stopping envelope throughout the takeover window. Faster networks can trim milliseconds from packet transport, but they cannot shorten the time a person needs to see a hazard, decide what to do, and move a hand control.

↩︎ The causal boundary, across which admitted motion cannot be recalled, is established in Defining the Causal Boundary.

Cutting power to a moving base lets it coast, whereas cutting power to a loaded manipulator arm without a holding brake drops the payload. Each stage of an intervention therefore needs a fallback matched to the machine’s current state: a moving base may need controlled regenerative braking followed by a mechanical brake once stopped, while an arm carrying a tote needs an active, gravity-compensated position hold. Each response depends on the specific sensors and power rails qualified to carry it out. Because local damping, torque inhibition, and full power isolation produce different physical trajectories, the system cannot treat them as interchangeable steps on a generic escalation ladder; a protective input must invoke the validated fallback built for the plant’s current motion state.

↩︎ The fallback ladder, from which the arbiter selects a state-matched protective response on every tick, is established in The Fallback Ladder.

Autonomous and manual proposal rights operate under separate, explicit leases. The learned policy proposes trajectories under the action-chunk lease established in Chunk Lease Sizing from the Stopping Budget, while a teleoperation session receives a distinct, clearance-budgeted manual lease. Rejecting an invalid replacement command from an operator does not invalidate an active, previously admitted setpoint whose evidence, state bounds, and lease duration remain healthy. If either controller exhausts its lease duration or violates its underlying safety premises, the permission path immediately triggers the appropriate local fallback.

The permission path prevents split-brain command contention by pairing an upstream source arbiter with exclusive actuator-output ownership. In the 1 kHz control architecture analyzed here, the right to propose on a set of channels is a single object, the proposal token, and the arbiter grants it to one source at a time. An authority commit revokes the learned policy’s proposal token and latches its last approved setpoint; the admission enforcer remains the sole, non-bypassable writer to the physical actuators before, during, and after the transition. Standard bus protocols such as Controller Area Network (CAN) arbitration serialize message frames from multiple transmitters, but bus-level arbitration does not establish control-layer authority. If two nodes broadcast conflicting yet syntactically valid frames to the same motor drive, the actuator chatters between setpoints and loses stability. Gating the output path in firmware and selecting a single source per tick prevents that contention. Across continuous state spaces, the enforcer executes a bumpless transfer, a command handoff without reference step discontinuities (section 14.4), interpolating between validated endpoints while enforcing command-rate limits and honoring measured plant limits.

Intervention events also directly shape the machine learning lifecycle. If a flight recorder or logging pipeline captures a rescued episode without marking the exact handover instant, imitation algorithms treat the near-failure states that triggered the rescue as if they were intentional expert demonstrations. As Intervention and Recovery Data establishes, the states visited by the learner right before a takeover supply training data for recovery policies, but autonomous commands from a failing interval require review rather than automatic admission as expert targets. Downstream learning algorithms, from Dataset Aggregation (DAgger) (Ross et al. 2011) to modern human-gated policy correction methods (section 14.8.3), depend on knowing which controller held authority over each logged timestep. To resolve this attribution, the architecture keeps an authority record (the twelfth record in the platform’s record chain, specified in section 14.8), which retains the captured evidence preceding and following the takeover, with explicit gaps and timing bounds. Its per-tick entries timestamp every transition against the safety microcontroller’s monotonic clock. An authority commit ends policy ownership, ensuring that autonomous exploration, the enforcer’s transition blend, and verified human recovery remain distinct, auditable intervals.

Every shared-authority design begins by defining which named intervention may act upon which physical channel and establishing the maximum latency the machine can tolerate while awaiting human action. The protocol handshakes, setpoint blending algorithms, and authority records that follow all rest upon this initial grant of authority.

14.2 Human Authority, Reaction Time, and Clearance

An assistant guiding the arm can move the chassis if its credential also permits base-drive commands. A command admitted under that permission performs mechanical work on the plant before software can revoke it. Authority must therefore identify the physical channels a person may affect, rather than grant unrestricted access through a generic operator role.

The remote assistant who clears a blocked aisle and the coworker who takes an item from the gripper act on the same machine, and neither should hold the other’s authority. Each grant therefore names an operation together with its timing budget, physical degrees of freedom, and preemption rule. The permission path keeps these grants in an explicit capability matrix, a permissions table mapping individual operations (such as an emergency power cutoff, a velocity trim adjustment, a trajectory path veto, or manual drive of the base and arm) to authenticated roles. The design reflects classic taxonomies of human supervisory control² (Sheridan 1992) and multi-level automation (Parasuraman et al. 2000). Each entry in this matrix defines the exact actuator channels the operation governs, the preemption tier it carries over the learned policy, and the maximum propagation latency permitted from physical input to actuator response.

² Supervisory Control Levels: Sheridan and Verplank (1978) formulated a ten-level taxonomy of supervisory control, running from a human who performs the whole task without computer assistance to a computer that decides and acts while ignoring the human.

Sheridan, Thomas B., and William L. Verplank. 1978. Human and Computer Control of Undersea Teleoperators. Technical Report N00014-77-C-0256. Man-Machine Systems Laboratory, Massachusetts Institute of Technology.

Sheridan, Thomas B. 2021. “Human Supervisory Control of Automation.” In Handbook of Human Factors and Ergonomics, 5th ed., edited by Gavriel Salvendy and Waldemar Karwowski. Wiley. https://doi.org/10.1002/9781119636113.ch28.

Sheridan also describes the supervisor’s work as five steps in sequence: plan the task off-line, teach the plan to the computer, monitor the automatic action, intervene when it fails or the goal changes, and learn from the episode (Sheridan 2021). Intervening in flight and learning from the episode require finer granularity than a single autonomy level assigned to the whole task. The mobile manipulator needs an authority assignment per channel and per instant: during a takeover, the arm can sit near the manual end of the scale while the base still runs at the automatic end, and the enforcer holds the final admission gate on every channel throughout because it checks the operator’s commands just as it checks the policy’s. Levels that differ across channels are what a supervisor can lose track of, the mode confusion of section 14.6, so a channel left out of a transfer keeps its autonomous owner only while the console announces that it does, and otherwise holds. Each entry in the capability matrix therefore names the exact operation and channel it governs.

Naming the operations separates intervention from safety enforcement, two mechanisms that system architectures routinely conflate. Enforcement withholds permission from a candidate action proposed by a learned model, modifying, clamping, or projecting the setpoint while leaving the machine under autonomous control. Intervention transfers authority away from the model to an external entity, terminating autonomous operation and giving the supervisor the right to propose, while every command still passes the permission path. An enforcement filter sits in the fast inner control loop (1 kHz / \(\le\) 1 ms) to prevent the policy from demanding an over-current maneuver or violating a barrier certificate (Ames et al. 2019) during nominal tracking. An intervention mechanism strips the policy of its proposal token when an operational boundary is breached or an operator demands control. A system equipped with enforcement but lacking intervention cannot be redirected when human intent changes or external conditions fall outside the policy design envelope, leading to conservative deadlock when barrier constraints collapse the feasible control set. Conversely, a system equipped with intervention but lacking enforcement permits a lagging operator to drive the plant into structural failure during nominal manual operation. Table 1 sets the two mechanisms side by side, from trigger and authority holder to typical failure.

Ames, Aaron D., Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. 2019. “Control Barrier Functions: Theory and Applications.” 2019 18th European Control Conference (ECC), 3420–31. https://doi.org/10.23919/ECC.2019.8796030.

↩︎ The actuator current and thermal limits an enforcement filter must respect are established in The Five Physical Budgets.

Table 1: Architectural boundaries of safety enforcement and supervisory intervention: Enforcement operates in-loop as an active constraint on proposed actions; intervention transitions authority between discrete proposers.

Dimension	Enforcement filter	Intervention state machine
Primary trigger	Invariant boundary approach (\(\BarrierFunctionRate + \LinearBarrierDecayRate \BarrierFunction < 0\)) or torque limit	Human takeover assertion, monotonic lease timeout, or operational design domain (ODD) exit
Authority holder	Autonomous policy retains proposal rights; enforcer modifies setpoints	Authority transferred to external entity or fallback controller
Execution loop	Fast inner control loop (1 kHz / \(\le\) 1 ms)	Same permission tick; protocol exchange spans multiple ticks
Safety lease role	Enforces continuous barrier satisfaction on admitted commands	Lease expiry invokes the state-dependent validated fallback
Typical failure mode	Feasible set collapse; conservative deadlock or oscillation	Opposing commands cancel, mode confusion, or late human reaction

Definition 14.1: Supervisory intervention

Supervisory intervention is the transfer of the right to propose commands on named actuator channels between a learned policy and an authenticated person, committed on a control tick and bounded by a lease, while every command continues to pass the same permission check.

1. Significance: The transfer is a delay on a moving machine, so it is priced in the stopping budget \(\StoppingDistance \le \ClearDistance\) rather than in the user interface, and the waiting before braking, not the braking itself, decides whether the machine stops in time.
2. Distinction: Enforcement changes a proposal and leaves the proposer in place; intervention changes the proposer and leaves the check in place. A machine needs both, because neither can do the other’s job.
3. Common pitfall: A frequent misconception is that a takeover hands the operator the actuators. The operator gains only the right to propose, and the machine still needs a local stop that does not wait for the operator to act.

14.2.1 Capability matrices and the intervention-enforcement split

On the warehouse mobile manipulator, a coworker taking a mug from the gripper at the packing station would be at risk if their station credential also allowed them to command the arm’s joints or drive the base. The capability matrix prevents that cross-channel hazard by letting the remote assistant redirect motion while denying any motion authority to the coworker accepting an item.

In that matrix, the remote assistant who supervises the mobile manipulator may hold a signed trajectory veto capability for the base’s planner channel: role remote_assistant, operation veto_path, channel planner_proposal, preemption tier above the learned planner but below the local enforcer, authenticated session and nonce, and a clearance-derived acknowledgment deadline. The enforcer responds to a valid veto with a checked local hold or stop. The same session carries a second entry, manual_drive, on the base-velocity and arm-joint channels, which becomes active only through a handover that commits within the clearance-derived deadline, and lapses with the manual lease of section 14.3. Every command it carries still passes the permission check. A wheel drive-torque packet from that credential is denied, because neither entry grants the base’s wheel drive-torque channel.

The coworker at the packing station holds a different entry, accept_item, which lets the coworker take from the gripper the mug the arm picked from the takeaway conveyor. That entry grants no motion authority. The item-handover channel of the enforcement record caps the arm’s approach to the coworker’s hand at 0.10 m/s, and no capability lifts that cap. The handover is a collaborative application in the sense of ISO 10218-2:2025 (International Organization for Standardization 2025b), and the body model of the hand that bounds it, with the contact force that model predicts, is set out once in Intentional contact and in-contact energy barriers. ISO 10218-2 leaves out the hazards of mounting the arm on a mobile platform, which ANSI/A3 R15.08-2 addresses for the running machine (Association for Advancing Automation 2023).

International Organization for Standardization. 2025b. ISO 10218-2:2025: Robotics, Safety Requirements, Part 2: Industrial Robot Applications and Robot Cells. International Organization for Standardization.

Association for Advancing Automation. 2023. ANSI/A3 R15.08-2-2023: Industrial Mobile Robots, Safety Requirements, Part 2: Requirements for IMR System(s) and IMR Application(s). Association for Advancing Automation.

The ceiling behind that cap comes from the contact-force model (equation 12.13). For a free hand, which recoils, the selected 50 N criterion admits up to 0.24 m/s, and the cap sits under that ceiling. A hand clamped against a rack upright or the arm itself cannot recoil, and the same criterion then admits only 0.053 m/s, below the cap. The cap therefore holds only if the handover geometry excludes clamping, a premise the release case must evidence. The ceiling is conditional on these inputs and does not by itself establish a pressure or injury limit for a particular contact geometry; the site’s risk assessment qualifies the effective mass, the force criterion, and the contact geometry before the cap is qualified.

↪ The release criterion that holds the handover’s contact force under its assessed limit is developed in Physical Criteria for Release.

Each capability entry binds actor, operation, channel, deadline, authentication, preemption tier, and fallback; a valid signature alone grants no motion authority. Physical clearance sets the tolerable deadline; the operator’s response time determines whether a human can meet it.

14.2.2 Human reaction time and travel before braking

The remote assistant must notice the blocked aisle, decide how to recover, move the controls, and deliver a checked request. Summed in sequence, the total supervisory takeover latency \(\SupervisoryTakeoverLatency\) is: \[\SupervisoryTakeoverLatency = \OperatorSensoryTime + \OperatorCognitiveTime + \OperatorMotorTime + \ConsoleCommunicationTime \tag{1}\] The first three terms belong to the person and depend on engagement and expectation; the last belongs to the console and the link. Human response times are distributions with long right tails, so a stopping budget needs a value that nearly every request meets, not the typical one. The calculation below compares a continuously engaged operator with an out-of-loop assistant. Its communication term includes transport and the protocol exchange, so that exchange must not be charged again.

Waiting consumes distance before the selected stop begins. The finished stopping budget from Sizing the composite stopping budget supplies the machine delay, resident stop, and fixed allowances. Adding the human waiting interval exposes whether remote rescue can fit at the current speed; it does not authorize waiting when the local stop is already required.

The budgets that follow are illustrative design comparisons, not measured takeover performance. Each of them must also pay for the dispatch-to-admission interval \(\DispatchAdmissionInterval\), which The board-link budget and the dispatch-to-admission interval allocated but has not yet measured. A takeover does not remove that interval. The policy must still infer on the frame that shows the blocked aisle before it can request help, and its request, like any proposal, reaches the arbiter only through the safety microcontroller, so the base keeps rolling through \(\DispatchAdmissionInterval\) before the human response even begins. This chapter calls a budget without the interval the partial budget and a budget with it the complete budget. The stops and overruns below use the complete budget. The speed ceilings and deadlines give the partial value first and then the charged one, because the gap between the two is itself a design lesson.

The stopping budget of The warehouse mobile manipulator's stopping budget shows what equation 1 costs on the mobile manipulator. At the 1.3 m/s aisle speed it leaves 131.0 mm of the 1.10 m rack-end clear distance before dispatch-to-admission travel, and 48.7 mm once the 82.3 mm of travel during \(\DispatchAdmissionInterval\) is charged. A takeover delay adds to the machine’s own pre-brake delay \(\PrebrakeDelay\), and every millisecond of it becomes travel at the aisle speed:

1. Mode 1: Continuous in-loop teleoperation: An attending operator with hands on the controls of a synchronized leader arm or a real-time console, responding to the stimulus the task has led them to expect, makes a simple reaction. The Model Human Processor³ (Card et al. 1983) prices that reaction as one perceptual, one cognitive, and one motor cycle (Jastrzembski and Charness 2007). At the slow end of each cycle’s range, \(\OperatorSensoryTime =\) 200 ms, \(\OperatorCognitiveTime =\) 170 ms, and \(\OperatorMotorTime =\) 100 ms. The console adds \(\ConsoleCommunicationTime =\) 135 ms: the scene reaches the operator after a video glass-to-glass latency⁴ of 104 ms, measured for a wired teleoperation link (Schimpe et al. 2022), and the request returns through a 31 ms protocol exchange, the four-phase handshake that section 14.3.3 builds and budgets phase by phase. By equation 1, \(\TakeoverResponseTime =\) 605 ms. The machine travels 786.5 mm during that delay, several times the spare margin. Solving the complete budget for speed, with \(\TakeoverResponseTime\) and \(\DispatchAdmissionInterval\) added to \(\PrebrakeDelay\), bounds the machine to 0.797 m/s. The value holds only for the expected stimulus. A driver who is waiting for a brake signal needs up to 0.75 s to detect it and reach the pedal, and a surprise raises that to about 1.5 s (Green 2000). Section 14.2.3 prices those cases.
2. Mode 2: Passive out-of-the-loop supervisory takeover: An assistant who monitors the telemetry of several machines passively does not make a simple reaction, and its stages cannot be priced separately. Driver take-over studies measure the whole interval, from the take-over request to the first control input. Across 520 experimental conditions in 129 studies, the mean take-over time averaged 2.72 s, and the distribution of those condition means is skewed to the right (Zhang et al. 2019). For this illustrative comparison, the selected design value is the 90th percentile of the condition means, 4.33 s, computed from the study’s published data. With the same 135 ms console term, the takeover delay is \(\DisengagedTakeoverResponseTime =\) 4.5 s, during which the machine covers 5.80 m, more than five times the clear distance, before any brake command. The same solution bounds the machine to 0.189 m/s.

³ Model Human Processor: Card et al. (1983) modeled a person responding to a stimulus as three processors in series, perceptual, cognitive, and motor, and gave each cycle time a typical value and a range rather than a single number. The range is the design input. A budget built on the typical cycles admits a speed that a slower but still normal operator overruns, so this chapter’s design row takes the slow end of every range.

Card, Stuart K., Thomas P. Moran, and Allen Newell. 1983. The Psychology of Human-Computer Interaction. Lawrence Erlbaum Associates.

⁴ Glass-to-Glass Latency: The interval from light entering the remote camera’s lens to the matching image leaving the operator’s display, covering exposure, encoding, transport, decoding, and display refresh. It is the only video delay the operator experiences, and every stage of that path contributes to it, so a value measured on a wired link does not carry over to a warehouse wireless link. The site must measure its own link before the value enters the takeover budget.

In Mode 2 at the aisle speed, the machine would reach a static obstacle at the rack end at full speed, because contact occurs before braking ever begins. Stronger braking can raise a finite stopping-speed ceiling, but cannot recover distance already spent waiting. As braking distance tends toward zero, reaction travel still sets a limiting ceiling. A percentile of condition means also understates the tail an individual operator can produce, because each condition’s own spread grows with its mean; the site must measure its operators, console, and task load before any of these values admits a speed. Road regulation sizes the same interval generously for a vehicle that can keep driving while it waits. For an unanswered transition demand in the cited 2021 version of UN Regulation No. 157, an automated lane-keeping system begins its minimum risk manoeuvre no earlier than 10 s after it issues the demand (United Nations Economic Commission for Europe 2021), 2.2× the design takeover here. Severe system or vehicle failures permit an immediate minimum risk manoeuvre, and an obstacle can require an emergency response during the transition phase. The vehicle can afford that wait because it stays in its lane under automated control throughout. At the aisle speed the same wait would carry the mobile manipulator 13 m, so the machine cannot borrow the road’s interval, only its structure of a demand, a bounded wait, and an automatic fallback. Section 14.2.4 turns the two design values into the speeds at which the machine may request each kind of takeover.

Drawn to scale, the Mode 1 budget shows where the clearance goes (figure 2). The 48.7 mm spare of the complete budget corresponds to 37.5 ms at the 1.3 m/s aisle speed, so the machine has spent it long before the 104 ms video stage ends and before the operator has perceived anything. The perceptual, cognitive, and motor cycles and the handshake that follow are all travel the budget cannot absorb, 786.5 mm in total.

Figure 2: Where an in-loop takeover spends its time: The 605 ms in-loop takeover drawn to scale from the request, stage by stage: video transport to the console, the operator’s perceptual, cognitive, and motor cycles at the slow end of the Model Human Processor, and the four-phase handshake through commit notification. Local commit starts the enforcer-owned blend before notification; the full exchange remains the conservative waiting allocation. The distance row converts the same axis into travel at the 1.3 m/s aisle speed; the bracket at its left marks the 48.7 mm spare of the complete budget, which the machine exhausts within the video stage.

Napkin Math 14.1: The takeover tax

Problem: At the 1.3 m/s aisle speed, does the finished stopping budget still fit the rack-end clear distance once an in-loop or an out-of-loop takeover delay is inserted before braking, and by how much does each overrun it?

Variables:

• \(\SpeedAtDetection =\) 1.3 m/s (Chosen) and \(\ClearDistance =\) 1.10 m (Illustrative).
• \(\PrebrakeDelay =\) 133.6 ms, the machine’s own pre-brake delay (Derived; The warehouse mobile manipulator's stopping budget), which excludes the dispatch-to-admission interval, and \(\DispatchAdmissionInterval =\) 63.3 ms, the allocation of The board-link budget and the dispatch-to-admission interval (Illustrative), which a takeover still spends before braking.
• \(\ResidentStopDistance(\SpeedAtDetection) = \SpeedAtDetection^2/(2\CredibleBrakingDeceleration) + \SpeedAtDetection\,\CredibleBrakingDeceleration/(2\JerkLimit)\), the jerk-limited resident stop of equation 11.17, with \(\CredibleBrakingDeceleration =\) 2 m/s² (Illustrative) and \(\JerkLimit =\) 7.11 m/s³ (Derived).
• \(\FixedClearanceAllowance = \LocalizationBound + \ProtectiveClearanceMargin + \TrackingErrorBound =\) 190 mm (Illustrative and Chosen).
• \(\TakeoverResponseTime =\) 605 ms in-loop and \(\DisengagedTakeoverResponseTime =\) 4.5 s out-of-loop (Derived, from the measured human and transport terms of Modes 1 and 2 plus the chosen handshake).

Math: Every term is in millimeters. The machine alone, charged with the dispatch-to-admission travel, leaves a 48.7 mm spare:

\[d_{\text{stop},0} = v\,\tau_{\text{delay}} + v\,\DispatchAdmissionInterval + d_{\text{suffix}}(v) + \delta = 173.68 + 82.30 + 605.31 + 190 = 1051.30\text{ mm}\]

Each takeover adds \(\SpeedAtDetection\,\SupervisoryTakeoverLatency\) before the same stop:

\[d_{\text{stop},1} = v\,\tau_{\text{delay}} + v\,\DispatchAdmissionInterval + v\,T_{\Sigma,1} + d_{\text{suffix}}(v) + \delta = 173.68 + 82.30 + 786.5 + 605.31 + 190 = 1837.80\text{ mm}\]

\[d_{\text{stop},2} = v\,\tau_{\text{delay}} + v\,\DispatchAdmissionInterval + v\,T_{\Sigma,2} + d_{\text{suffix}}(v) + \delta = 173.68 + 82.30 + 5804.5 + 605.31 + 190 = 6855.80\text{ mm}\]

Result: The in-loop takeover overruns the clear distance by 737.8 mm and the out-of-loop takeover by 5.76 m; the second stop is 3.7× the first.

Systems insight: The waiting term, not the braking term, decides the verdict. The in-loop takeover alone covers 16.1× the spare, so no stronger brake can make \(\StoppingDistance \le \ClearDistance\) hold at this speed; only a lower \(\SpeedAtDetection\) or a stop before the request can. The delay, braking, and allowance terms follow the stopping-distance model of Kinematic Stopping Envelopes and Information Age Lag.

14.2.3 Takeover speed ceilings from available clearance

Because no braking force can recover distance spent waiting, the machine must bound its operating speed before an intervention is ever requested. One inequality sets both bounds that this section and the next derive. If the machine continues at speed \(\SpeedAtDetection\) for a waiting duration \(\ExternalWait\) while awaiting the operator’s response, the finished stopping budget of Sizing the composite stopping budget gains one term, the travel during that wait. The pre-brake delay \(\PrebrakeDelay\), the jerk-limited resident stop \(\ResidentStopDistance(\SpeedAtDetection)\) (equation 11.17), and the fixed allowances keep the meanings defined there, and the sum must still not exceed \(\ClearDistance\) measured at the same reference event: \[\StoppingDistance(\ExternalWait) = \SpeedAtDetection(\ExternalWait + \PrebrakeDelay) + \ResidentStopDistance(\SpeedAtDetection) + \LocalizationBound + \ProtectiveClearanceMargin + \TrackingErrorBound \le \ClearDistance. \tag{2}\] Setting \(\ExternalWait = \SupervisoryTakeoverLatency\) and solving for speed gives the takeover speed ceiling of this section. Fixing the speed and solving for \(\ExternalWait\) gives the latest fallback deadline of section 14.2.4.

The three stops of notebook 14.1 differ only in how long the machine coasts before an identical jerk-limited resident stop begins (figure 3). Every trace ends with the same braking curve, so the whole difference between stopping 48.7 mm short of the clear distance and stopping at 6.86 m is coasting.

Figure 3: Two takeovers against one clear distance: Clearance consumed at the 1.3 m/s aisle speed, starting from the fixed allowances. Each trace coasts through its delay, including the dispatch-to-admission interval, and then follows the same jerk-limited resident stop. The machine alone stops 48.7 mm short of the 1.10 m clear distance. A 605 ms in-loop takeover inserted before braking carries the stop to 1.84 m, and a 4.5 s out-of-loop takeover carries it to 6.86 m. The waiting, not the braking, spends the clearance.

Table 2 prices each sourced response time. Every row adds the 135 ms console term to the human response, adds the total to \(\PrebrakeDelay\), and solves the finished stopping budget for the largest speed at which the machine still stops inside the rack-end clear distance. Before charging the missing admission delay, the ceiling falls from 1.01 m/s for an attending operator who meets the expected stimulus at the nominal pace to 0.12 m/s for the slowest percentile of takeover conditions. No row fits at the 1.3 m/s aisle speed. Two facts dominate the table. Expectation matters more than the console, because moving from an expected to a surprising stimulus costs more speed than the whole console term does. The tail matters more than the average, because a speed chosen for the mean take-over time is overrun by every condition slower than the mean.

A ceiling above the resident stop’s transition speed \(\CredibleBrakingDeceleration^2/\JerkLimit\) is the positive root derived for the machine’s own stop in equation 12.2, where the half jerk ramp acts as an added delay before full braking (the rigid-stop form is equation 2.3). A takeover adds one more such interval, so setting \(\ExternalWait = \SupervisoryTakeoverLatency\) in equation 2 folds the human delay into the same root: \[\SpeedBound(\SupervisoryTakeoverLatency) = \CredibleBrakingDeceleration\left[\sqrt{\FullSpeedTravelTime^2 + \frac{2\,(\ClearDistance-\FixedClearanceAllowance)}{\CredibleBrakingDeceleration}} - \FullSpeedTravelTime\right],\qquad \FullSpeedTravelTime = \PrebrakeDelay + \SupervisoryTakeoverLatency + \frac{\CredibleBrakingDeceleration}{2\JerkLimit}. \tag{3}\] The term \(\FullSpeedTravelTime\) collects every interval during which the machine still moves at \(\SpeedAtDetection\): its own delay, the human’s, and the half jerk ramp before full braking. Below \(\CredibleBrakingDeceleration^2/\JerkLimit\) the stop never reaches full deceleration and the cubic branch of equation 11.17 applies instead, which is why the table’s slower rows come from the solver rather than from this root.

Napkin Math 14.2: The speed a human buys

Problem: What is the highest speed at which the mobile manipulator may request an in-loop takeover from an attending operator, and does any brake, however strong, admit the aisle speed?

Variables:

• \(\CredibleBrakingDeceleration =\) 2 m/s² (Illustrative) and \(\JerkLimit =\) 7.11 m/s³ (Derived).
• \(\PrebrakeDelay =\) 0.1336 s (Derived) and \(\TakeoverResponseTime =\) 0.605 s (Derived, from the measured human and transport terms of Mode 1 plus the chosen handshake).
• \(\ClearDistance - \FixedClearanceAllowance =\) 0.91 m (Illustrative, less the fixed allowances).

Math: \(\FullSpeedTravelTime =\) 0.1336 \(+\) 0.605 \(+\) 2 \(/ (2 \times\) 7.11\() =\) 0.1336 \(+\) 0.605 \(+\) 0.1406 \(=\) 0.8792 s. Then \(\FullSpeedTravelTime^2 + 2 \times\) 0.91 \(/\) 2 \(=\) 1.6830 s², whose square root is 1.2973 s, so by equation 3 \(\SpeedBound =\) 2 \(\times\) (1.2973 \(-\) 0.8792). The root lies above \(\CredibleBrakingDeceleration^2/\JerkLimit =\) 0.562 m/s, so the quadratic branch was the right one. If both the deceleration and jerk bounds are removed so that the resident stopping distance tends to zero, the limiting ceiling is \((\ClearDistance - \FixedClearanceAllowance)/(\PrebrakeDelay + \SupervisoryTakeoverLatency)\).

Result: \(\SpeedBound =\) 0.836 m/s, the design in-loop row of table 2; instantaneous braking would raise it only to 1.23 m/s.

Systems insight: Even a perfect brake leaves the ceiling below the 1.3 m/s aisle speed, because the travel during \(\PrebrakeDelay + \SupervisoryTakeoverLatency\) alone exceeds the clear distance at that speed. The waiting term of \(\StoppingDistance \le \ClearDistance\) sets the request speed, so faster brakes cannot buy back a slow human; adding the 63.3 ms admission allocation to \(\FullSpeedTravelTime\) lowers the root to 0.797 m/s.

Table 2: Takeover speed ceiling against the sourced human response: The first two rows are Model Human Processor simple reactions, one perceptual, cognitive, and motor cycle at nominal and slow-bound cycle times (Jastrzembski and Charness 2007). The next three are driver perception-brake times for an expected, an unexpected, and a surprise signal (Green 2000). The last four are percentiles of the mean take-over time across 520 experimental conditions, computed from the published data of Zhang et al. (2019); they describe conditions, not individual operators, whose tail is longer. Each total adds the console term (video glass-to-glass latency (Schimpe et al. 2022) plus the four-phase exchange) and excludes the dispatch-to-admission interval, so every ceiling is optimistic; charging that allocation lowers the design in-loop ceiling to 0.797 m/s. Bold rows are the design values.

Jastrzembski, Tiffany S., and Neil Charness. 2007. “The Model Human Processor and the Older Adult: Parameter Estimation and Validation Within a Mobile Phone Task.” Journal of Experimental Psychology: Applied 13 (4): 224–48. https://doi.org/10.1037/1076-898X.13.4.224.

Green, Marc. 2000. “‘How Long Does It Take to Stop?’ Methodological Analysis of Driver Perception-Brake Times.” Transportation Human Factors 2 (3): 195–216. https://doi.org/10.1207/STHF0203_1.

Zhang, Bo, Joost de Winter, Silvia Varotto, Riender Happee, and Marieke Martens. 2019. “Determinants of Take-over Time from Automated Driving: A Meta-Analysis of 129 Studies.” Transportation Research Part F: Traffic Psychology and Behaviour 64: 285–307. https://doi.org/10.1016/j.trf.2019.04.020.

Schimpe, Andreas, Johannes Feiler, Simon Hoffmann, Domagoj Majstorovic, and Frank Diermeyer. 2022. “Open Source Software for Teleoperated Driving.” International Conference on Connected Vehicle and Expo (ICCVE), 1–6. https://doi.org/10.1109/ICCVE52871.2022.9742859.

Operator state and response	Human response	With console term	Added travel at aisle speed	Speed ceiling
In-loop, expected stimulus, nominal pace	240 ms	375 ms	0.49 m	1.01 m/s
In-loop, expected stimulus, slow bound (design)	470 ms	605 ms	0.79 m	0.84 m/s
Expected brake signal	750 ms	885 ms	1.15 m	0.68 m/s
Unexpected but common signal	1,250 ms	1,385 ms	1.80 m	0.51 m/s
Surprise event	1,500 ms	1,635 ms	2.13 m	0.45 m/s
Out-of-loop takeover, median condition	2,370 ms	2,505 ms	3.26 m	0.32 m/s
Out-of-loop takeover, average condition	2,720 ms	2,855 ms	3.71 m	0.29 m/s
Out-of-loop takeover, 90th percentile (design)	4,330 ms	4,465 ms	5.80 m	0.19 m/s
Out-of-loop takeover, 99th percentile	7,000 ms	7,135 ms	9.28 m	0.12 m/s

The table also locates the other interfaces a site might offer. Continuous velocity guidance or supervisory waypoint dispatch places the operator somewhere between an expected-stimulus reaction and an out-of-loop takeover, and only a measured response distribution for that interface, console, and task says where. A hardwired protective input removes the console term but not the human response, so its operator still needs the local stop to hold the machine safe while that response runs.

14.2.4 Clearance-derived fallback deadlines

If a machine reaches the edge of its operating domain at speed and requests a takeover, an operator who is distracted, asleep, or incapacitated will fail to complete the handshake before the machine runs out of clearance. An autonomous policy’s handover request can therefore never wait indefinitely, nor can its timeout be a fixed software constant: a single fixed window that is safe at a crawl will overrun the clearance at transport speed (section 14.9 prices such a window at both speeds). Safe timeouts must instead be derived at runtime from the machine’s current speed, line-of-sight clearance, and braking deceleration.

The deadline is the second reading of the stopping inequality. The speed ceiling fixed the wait and solved for speed; the deadline fixes the current speed and solves for the wait. Setting equality in equation 2 (\(\StoppingDistance(\ExternalWait) = \ClearDistance\)) and solving for the maximum permissible waiting time yields the latest fallback deadline \(\FallbackDeadline\): \[\FallbackDeadline = \frac{\ClearDistance-\LocalizationBound-\ProtectiveClearanceMargin-\TrackingErrorBound-\ResidentStopDistance(\SpeedAtDetection)}{\SpeedAtDetection}-\PrebrakeDelay,\qquad \HandoverTimeout=\max\!\left(0,\min(\HandoverTimeoutCeiling,\FallbackDeadline)\right). \tag{4}\] For a live check, the safety microcontroller dispatches fallback no later than the last permission tick before the resulting deadline. A nonpositive \(\FallbackDeadline\) calls for immediate fallback and may mean stopping is already infeasible. The configured protocol ceiling cannot extend that physical deadline or the expiry of active permission.

Napkin Math 14.3: The waiting allowance

Problem: How long may the mobile manipulator wait after a handover request before it must dispatch its own stop, at the 1.3 m/s aisle speed and at the 0.75 m/s slow-down, and does the 605 ms in-loop takeover fit either allowance?

Variables:

• \(\ClearDistance - \FixedClearanceAllowance =\) 0.91 m (Illustrative) and \(\PrebrakeDelay =\) 0.1336 s (Derived).
• \(\ResidentStopDistance(\SpeedAtDetection) = \SpeedAtDetection^2/(2\CredibleBrakingDeceleration) + \SpeedAtDetection\,\CredibleBrakingDeceleration/(2\JerkLimit)\) (Derived; equation 11.17): 0.6053 m at 1.3 m/s and 0.2461 m at 0.75 m/s.
• \(\TakeoverResponseTime =\) 605 ms (Derived, measured human and transport terms plus the chosen handshake) and \(\DispatchAdmissionInterval =\) 63.3 ms (Illustrative; the unmeasured allocation of The board-link budget and the dispatch-to-admission interval).

Math: By equation 4, \(\FallbackDeadline =\) (0.91 \(-\) 0.6053)/1.3 \(-\) 0.1336 \(=\) 0.1008 s at the aisle speed, and (0.91 \(-\) 0.2461)/0.75 \(-\) 0.1336 \(=\) 0.7516 s at the slow-down. Reserving the takeover leaves 751.6 ms \(-\) 605 ms \(=\) 146.6 ms, and charging \(\DispatchAdmissionInterval\) leaves 83.3 ms.

Result: At the aisle speed the takeover overruns a 100.8 ms allowance; at the slow-down it fits with 83.3 ms to spare on the complete budget.

Systems insight: Slowing from 1.3 to 0.75 m/s multiplies the waiting allowance 7.5×, because both the stop term and the travel per millisecond of \(\StoppingDistance \le \ClearDistance\) shrink with speed. The deadline is a function of the current state, so no single configured timeout can be correct at both speeds.

At the aisle speed, the 100.8 ms of notebook 14.3, or 131.0 mm of travel, is the unallocated timing allowance of the stopping subtotal in Sizing the composite stopping budget, and it is a partial-budget value. Charging the 63.3 ms dispatch-to-admission allocation of The board-link budget and the dispatch-to-admission interval completes the budget. At speed \(\SpeedAtDetection\) the charge costs \(\SpeedAtDetection\DispatchAdmissionInterval\) of travel, so at the aisle speed only 37.5 ms of waiting survives it. Wherever the rest of the chapter reports a waiting allowance, it gives the partial value and then the charged one, and the charged value is the one a design must meet. Rounded down to whole permission ticks, the partial aisle-speed allowance of 100.8 ms becomes 100 ms, which illustrates tick rounding rather than an absolute fallback time. The 500 ms configured ceiling is only an outer protocol limit, because the clearance deadline binds first.

Both readings of the stopping inequality also need a clock origin, and the chapter uses the two that table 3 sets side by side. The design budget behind every displayed number counts from the observation’s capture. A live check on the safety microcontroller counts from now.

Table 3: Two clock origins for one stopping inequality: Either column is correct on its own. Mixing a cell from one column with a cell from the other charges elapsed travel twice or not at all.

	Design budget (capture origin)	Live check (now origin)
Where it is used	Every number this chapter displays	The safety microcontroller, at each permission tick of a pending request
Clear distance	\(\ClearDistance\) measured at the observation’s capture event	The current tick’s remaining clearance, already reduced for the motion since capture
Delay before braking	\(\PrebrakeDelay + \DispatchAdmissionInterval\), from capture to the onset of the physical response	Only the delay still ahead: dispatch to response onset plus any unpaid processing, never a fresh full lease
Meaning of the wait	\(\ExternalWait\) is additional delay inserted into that budget, with any overlap with its processing, lease, or transport intervals removed	The time left before the last permission tick at which a stop still fits

The two ways to mix them fail in opposite directions. A live check that takes the current clearance, which already reflects the travel since capture, and then also subtracts the capture-origin delay pays for the elapsed part of that delay twice and dispatches its fallback early, which costs availability. The reverse mix, the capture-time clearance with a delay counted only from now, never pays for the travel since capture and dispatches its fallback late, which costs clearance.

The 31 ms protocol exchange fits the aisle-speed allowance on both budgets. The sourced 605 ms in-loop response does not. It exceeds the aisle-speed allowance several times over, so an in-loop request needs a slower machine, and the human response time, not the machine, sets how much slower. Assuming a faster human gives the wrong answer. A slow-down to 1.2 m/s would suit an operator who responds in a small fraction of a second; there the budget leaves 184.1 ms, and the sourced response overruns it by 420.9 ms. Such a design passes every check that uses an optimistic human and fails the first operator who needs the time the literature measures.

The handshake fits the aisle-speed allowance; the whole takeover needs the slow-down.

The design slows to 0.75 m/s before requesting an in-loop takeover. That speed comes from solving the budget with both the sourced response and \(\DispatchAdmissionInterval\) added to \(\PrebrakeDelay\), which gives a complete-budget ceiling of 0.797 m/s, rounded down to the next 0.05 m/s step. At that speed the capture-origin budget leaves 563.7 mm, or 751.6 ms of additional delay. Reserving the response leaves 146.6 ms, and charging \(\DispatchAdmissionInterval\) still leaves 83.3 ms. That is a conservative design allocation, not a claim that every request at that speed receives the same live timeout, and it holds only while the operator meets the expected stimulus. An unexpected hazard moves the operator to the slower rows of table 2, whose ceilings the slow-down exceeds.

Solving with both intervals matters. The partial-budget ceiling, with the response alone added, is 0.84 m/s, and a designer who stopped there might choose 0.8 m/s, which sits under it. At that speed the response leaves 58.3 ms, less than the 63.3 ms allocation, so once the omitted interval is charged the slow-down misses its deadline by 5.0 ms. A budget that leaves out one interval of a few tens of milliseconds admits a speed that the complete budget rejects.

The out-of-loop takeover forces a larger change. Its 4.5 s design response caps the request speed at 0.19 m/s, so the crawl before an out-of-loop request is 0.15 m/s, where the budget leaves 5.79 s and the design response leaves 1.32 s of it unspent. The crawl survives the \(\DispatchAdmissionInterval\) charge, which lowers its ceiling only to 0.189 m/s. It still fails the 99th-percentile condition, whose 7.1 s response admits only 0.12 m/s, and an individual operator’s tail is longer than any condition mean. A crawl slow enough for every operator is no longer motion worth keeping. The robust design therefore stops the machine automatically before handing over. The local stop runs first, and the out-of-loop takeover begins from standstill, where waiting costs time but no clearance. Both moving candidates still require qualified admission delay, current clearance, and a feasible stopping continuation. The hidden pallet leaves no room for an anticipatory slow-down at all, so the machine answers it with its own local stop and requests the takeover from standstill. A planned slow-down or crawl can prepare an anticipated request; neither permits waiting at aisle speed for a newly discovered obstacle.

Every one of these designs rests on two properties the chapter has so far assumed. Authority, once granted, must not outlive a proposer that falls silent, and it must move between proposers on a single tick without two of them ever commanding the same channel. Section 14.3 builds both.

Checkpoint 14.1: Takeover budgets and speed ceilings

A takeover is a delay inserted before braking, so every question about it is a question about the stopping budget.

• Waiting vs. braking: Can you explain, from the limiting case of equation 3, why no brake however strong admits an in-loop takeover at the aisle speed?
• Ceiling estimate: An operator who waits for an expected brake signal responds in 750 ms, plus the 135 ms console term. Using the givens of notebook 14.2, can you estimate the speed at which that operator may be asked to take over, and check it against table 2?
• Clock origins: Can you explain why a live check that measures clearance from now must not also charge the delay measured from capture?

14.3 Authority Transitions

When a remote assistant takes manual control of the arm after the mobile base has slowed or stopped for a blocked aisle, authority must move between proposers on a single permission tick without two of them ever commanding the same channel, and it must not outlive a proposer that falls silent. The transfer names each actuator channel and assigns it to a single owner; linear blending of two competing proposers is no substitute for choosing who is in charge. The local enforcer remains the sole writer to the physical actuator bus, generating a checked transition profile only after an ownership change has committed on a control tick boundary.

Discrete handover is not the only way to share control. Shared autonomy systems keep both proposers active and blend their actions continuously. In standard policy-blending methods, the robot infers the operator’s intended goal and arbitrates between automated assistance and manual control; user studies show that this arbitration works only while the robot predicts the human’s goal with high confidence (Dragan and Srinivasa 2013). That confidence breaks down when there is more than one path around an obstacle. When an operator steers left around a pallet while the autonomous policy steers right, a convex combination of two sensible commands produces a third trajectory that hits the obstacle. In those cases, a qualified arbiter must select or construct one admissible proposal; the permission path here selects a single source deterministically at each tick. Continuous blending works well when the task has a single clear goal and every intermediate blend is admissible, as when an operator makes fine adjustments to an end-effector pose. Even in purely manual operation, the safety enforcer acts as an invariant filter rather than a proposer, projecting every human command onto the admissible control set regardless of who holds the channel. Before ownership can move between sources, however, each source’s hold on a channel must be bounded in time so that a proposer that falls silent loses authority instead of leaving its last command in force.

Dragan, Anca D., and Siddhartha S. Srinivasa. 2013. “A Policy-Blending Formalism for Shared Control.” The International Journal of Robotics Research 32 (7): 790–805. https://doi.org/10.1177/0278364913490324.

↩︎ The minimal-intervention principle, which keeps an admissible proposal and applies the smallest feasible correction otherwise, is established in The Minimal Intervention Principle and Optimization Filters.

14.3.1 Execution leases and three-position enabling hardware

A stalled policy and a disconnected teleoperator leave the same immediate problem, because in both cases the moving machine still holds a previously admitted command. An inference stall, lost wireless link, or incapacitated operator must not leave that command active indefinitely. Expiring the proposer’s authority must also select a local response that brakes the machine or holds the load.

The permission path bounds autonomous chunks and manual sessions with execution leases, enforced on the safety microcontroller’s clock. The autonomous lease is the running 60 ms chunk lease. The manual lease is a separate value, chosen in section 14.3.4 and checked against the remaining clearance in section 14.4.6. An authenticated renewal must also carry valid state and evidence, because a heartbeat alone cannot refresh old observations. A wireless console that carries these renewals is a cableless control system in the sense of IEC 62745, which specifies the functions and interfaces of radio and infrared links between operator control stations, including portable ones, and a machine’s control system (International Electrotechnical Commission 2017). Formally, let \(\LeaseRefreshInstant\) denote the local hardware timestamp of the most recent renewal accepted after authentication, freshness, state, and evidence validation. At physical time \(\TimeInstant\), the lease-age condition is: \[\TimeInstant - \LeaseRefreshInstant < \ChunkLease \ \text{(autonomous)}, \qquad \TimeInstant - \LeaseRefreshInstant < \ManualLease \ \text{(manual)}. \tag{5}\] The clock advances toward expiry even when packets stop arriving. At expiry, the microcontroller revokes the affected proposal rights and selects the validated response from the current physical state. Authority can return only through the declared recovery and fresh-admission procedure; packet resumption alone cannot restore it.

International Electrotechnical Commission. 2017. IEC 62745:2017: Safety of Machinery, Requirements for Cableless Control Systems of Machinery. International Electrotechnical Commission.

⁵ Manual Reduced Speed: ISO 10218-1:2025 limits the tool speed of an industrial robot in manual reduced-speed mode to \(250\text{ mm/s}\) (International Organization for Standardization 2025a), the mode in which the pendant of figure 4 couples motion to a three-position grip. Releasing or over-squeezing the grip only requests a stop from the safety circuit, and the performance level that circuit must reach, graded from PL a to PL e, is set by the machine’s risk assessment under ISO 13849-1 (International Organization for Standardization 2023). The grip therefore bounds how fast the machine may be moving when a startled operator lets go, not which stop follows.

International Organization for Standardization. 2025a. ISO 10218-1:2025: Robotics, Safety Requirements, Part 1: Industrial Robots. International Organization for Standardization.

International Organization for Standardization. 2023. ISO 13849-1:2023: Safety of Machinery, Safety-Related Parts of Control Systems, Part 1: General Principles for Design. International Organization for Standardization.

Electromechanical enabling devices provide an additional physical condition for manual motion, one that holds even when every network packet is valid. The industrial teach pendant in figure 4 is the familiar carrier: a technician standing beside a robot uses it to jog the arm by hand, with a display, a jogging joystick, and a latched emergency-stop button on its face and an enabling grip on its rear handle. On the running machine, an enabling device belongs to a person beside the machine, such as the maintenance technician who jogs one arm joint from a pendant. The remote assistant’s console need not carry such a grip, because authenticated heartbeats maintain the manual lease, with presence assessed by the console’s chosen checks, which do not establish cognitive engagement (section 14.3.4). A site may add an enabling grip to the console as a second condition. The grip that matters is a three-position one.⁵ A startled or distressed operator may release a grip or squeeze it harder, and a two-position device that enables whenever pressed does not detect the latter response. By contrast, a three-position grip enables motion only in its intermediate position (Position 2). Releasing it (Position 1) or squeezing beyond the center detent (Position 3) withdraws the enabling signal; the configured safety circuit determines the resulting stop. These dual-channel contacts request the stop selected by the machine’s safety circuit, independently of the Linux application processor and its scheduler. Where that response includes Safe Torque Off (STO, IEC 61800-5-2), STO disables torque generation; the configured braking or holding mechanism must still establish the required plant response. The enabling circuit must also prevent a return through Position 2 after an over-squeeze from automatically restoring motion.

The pendant’s red mushroom button is a different device with different semantics. Under ISO 13850, the emergency stop is a complementary protective measure, not a substitute for safeguarding or for the stop the risk assessment selects. It takes priority over every other function in every operating mode, it latches until an operator deliberately resets it at the device, and that reset must not restart the machine (International Organization for Standardization 2015). Which physical response the stop invokes is a stop-category choice that Stop functions and physical response maps to its evidence. The latch and the reset rule matter for supervisory control because they make a human stop sticky in exactly the way a network command is not. A remote packet can request a stop and a lease can lapse into one, but only the local reset of a latched device, followed by the fresh admission this chapter requires, returns the machine to motion.

International Organization for Standardization. 2015. ISO 13850:2015: Safety of Machinery, Emergency Stop Function, Principles for Design. International Organization for Standardization.

Figure 4: Industrial teach pendant with three-position enabling grip: Front view of an ABB teach pendant showing the touch display, manual jogging joystick, emergency-stop mushroom button, and industrial fieldbus cable. The three-position enabling grip described in the text sits on the rear handle, out of view. (Credit: Auledas, Wikimedia Commons, CC BY-SA 4.0.)

Even while an operator holds an active lease and maintains Position 2 on the deadman grip, the deterministic enforcer evaluates human setpoints against the same barrier certificates, current limits, and kinematic envelopes applied to the learned neural policy. If an operator panics and commands a high-speed steering angle that would induce dynamic chassis rollover, or requests a joint torque that would shear harmonic drive gear teeth, the enforcer clamps or rejects the command. A human command therefore remains a proposal, and the third law, proposal is not permission (principle 3), binds human supervisors and neural models alike. Intervention transfers the right to propose away from the learned policy, while the right to admit stays with the permission path. With every owner’s authority bounded by a lease, what remains to design is how the right to propose changes hands, at which control tick it commits, and what the machine does when a network handover stalls.

14.3.2 Authority states and single-writer actuator ownership

If the autonomous policy and the remote console both write to a motor drive while a handover is in flight, the drive receives alternating setpoints on consecutive ticks. To prevent two sources from commanding an actuator at once, the arbiter resolves authority over each channel at every discrete time tick \(\TimeInstant\) to a single, mutually exclusive state: \[\ChannelAuthorityState_t \in \{\text{Autonomous}, \text{Handover-Pending}, \text{Blend}, \text{Human-Manual}, \text{Fallback}, \text{Protective}\}.\] These states separate proposer identity from actuator access. Each carries a short code name, used in the per-tick record and in figure 5, and each names who holds the proposal token on the channel:

• Autonomous (AUTO): The learned model holds the proposal token and proposes setpoints, while the local enforcer verifies barrier certificates (\(\BarrierFunction(\MechanicalPlantState) \ge 0\)) on every control cycle before dispatching commands.
• Handover-Pending (PEND): A takeover handshake is negotiating across the network; the policy keeps the token and continues proposing commands under a strict clearance-derived countdown timer \(\HandoverTimeout\). Active lease and evidence expiry run concurrently with that timer, so the arbiter dispatches fallback at the earliest of the protocol, lease, evidence, and clearance deadlines.
• Blend (BLEND, enforcer-owned bridge): No proposer holds the token. The enforcer assumes exclusive bus ownership, driving a smooth, \(\Glyph{C}^2\)-continuous quintic interpolation between the latched autonomous setpoint and the validated human target setpoint.
• Human-Manual (MAN): The authenticated teleoperator holds the proposal token, streaming commands that pass through enforcer barrier checks under an active manual lease (\(\ManualLease\)).
• Fallback (FALLBACK): Entered when an active lease expires, communication drops, or no admissible continuation remains. No proposer holds the token; the arbiter selects the validated HOLD or STOP rung for the measured state without waiting for remote commands. An ordinary least-change correction, by contrast, is enforcement within the current state and leaves the token with the current proposer.
• Protective (PROTECTIVE): Entered directly from an independent hardwired protective input or a critical silicon fault. No proposer holds the token. The safety circuit selects the validated protective stop; Safe Torque Off (STO) disables torque generation, and any required load-holding mechanism must be qualified for the current state and surviving resources.

At no point do two software masters write to an actuator simultaneously. Even during the Blend state, the enforcer alone owns the actuator channel, executing a precomputed profile between the latched references and validating dynamic constraints against the current state on each tick. Each edge in table 4 therefore names its guard and deadline, its single actuator owner, and the fallback taken when the guard fails or an active lease lapses.

Table 4: Authority state machine transition matrix: Each row names the single actuator owner and the state-dependent fallback. The example uses a 1 ms permission tick. The BLEND state interpolates only latched, checked endpoints, under enforcer ownership.

From → to	Guard and deadline	Actuator owner / command	Failure response
Autonomous → Handover-Pending	Policy requests supervision; deadline computed from clearance	Enforcer admits policy proposals while feasible	Validated fallback if deadline reached
Autonomous or Handover-Pending → Blend	Authenticated operator ACK, fresh state, feasible target and stopping reserve; commit on a control tick	At commit, revoke the policy’s proposal token, latch last approved command and checked manual target; enforcer alone writes actuator	Deny invalid target; retain valid active mode or fall back
Blend → Human-Manual	Profile completes and manual lease remains valid	Enforcer admits live human proposals within physical limits	Validated fallback on lease or enabling-device loss
Handover-Pending, Blend, or Human-Manual → Fallback	Timeout, stale lease, or invalid state	The permission path executes the validated HOLD or STOP rung and records it	Re-arm only after validated recovery procedure
Any state → Protective	Independent protective input or qualified critical fault	Safety circuit/controller selects plant-specific protective stop	Validated brake or hold, not torque removal alone

14.3.3 The four-phase takeover handshake

If a single network packet could switch a channel directly from Autonomous to Human-Manual, a delayed request could hand the actuators to an operator whose view of the aisle is already stale. With the same single packet, a dropped reply could leave the operator and the machine disagreeing on who is driving. Moving a channel between states instead takes a deterministic four-phase takeover protocol (Request \(\to\) Acknowledge \(\to\) Commit \(\to\) Confirm) run by the safety microcontroller. This four-stage exchange separates the local hardware commit from the physical blend and from the final release of manual proposal rights, checks cryptographic freshness so replayed frames cannot trigger a switch, and changes ownership on a single tick boundary:

1. Notice (Request phase): Either the human supervisor notices policy drift and requests an override (for example, by pressing an enabling button or moving a joystick past its calibrated deadband), or the autonomous policy hits an epistemic uncertainty spike and requests teleoperation assistance. Upon receipt, the arbiter initializes the clearance-derived countdown timer \(\HandoverTimeout = \max(0, \min(\HandoverTimeoutCeiling, \FallbackDeadline))\) of equation 4.
2. Declutch (Acknowledge phase): The enforcer validates target prerequisites across the system. It verifies that sensor telemetry is fresh, network links are live, and the current plant state \(\MechanicalPlantState(\TimeInstant)\) retains sufficient stopping reserve to brake safely if the transfer aborts. It then captures a synchronous state snapshot before preparing to revoke the autonomous policy’s proposal authority.
3. Transition (Commit phase): At the next synchronous control tick boundary, the enforcer executes the state transition. It revokes the policy’s proposal token on the committed channels, latches the last approved policy setpoint alongside the checked manual target setpoint, and assigns sole write authority to the enforcer in the Blend state. The enforcer drives the \(\Glyph{C}^2\)-continuous transition profile, continuously checking that the trajectory remains feasible under measured plant dynamics.
4. Notification (Confirm phase): The permission path broadcasts confirmation of the committed owner and the active Blend state to the operator console. A dropped confirmation packet alarms the operator interface, but does not undo or stall the local commit on the robot. After the physical profile completes under valid state, sufficient stopping reserve, and an active manual lease, the arbiter separately grants the proposal token on the committed channels to the operator and transitions to Human-Manual. This release timing is dictated by physical profile completion rather than the network notification round trip.

Each phase in table 5 carries a strictly budgeted bound, an explicit guard and owner, and deterministic failure handling. The transaction rejects spoofed override attempts and applies the failure response assigned to its current phase. Lost confirmation does not reverse a committed transfer; lease expiry or a failed physical guard invokes the validated state-dependent fallback.

Table 5: Four-phase takeover timing: The phase budgets sum to 31 ms. This sum budgets the exchange through commit notification, not physical blending or release of manual proposal rights. The blend begins at commit and may continue after notification.

Phase / takeover stage	Budgeted bound	Guard and owner	Failure handling
1. Request (Notice)	10 ms	Authenticated role, checked nonce, and fresh clock-converted timestamp; no owner change	Reject invalid packet; keep current qualified mode
2. Acknowledge (Declutch)	5 ms	Check state, manual target, and full stop reserve; isolate write path	Reject request; invoke fallback if current mode cannot continue
3. Commit (Transition)	1 ms tick	Revoke the policy’s proposal token, latch both checked endpoints, assign enforcer sole actuator write path	No partial commit within the requested channel mask; fallback on failed guard
4. Confirm (notification)	15 ms	Announce committed BLEND; later announce MAN after profile and lease check	Lost notice alarms operator but does not undo commit

14.3.4 Arbiter execution and manual-lease heartbeats

Once a channel reaches \(\text{Human-Manual}\), a dropped wireless link or a distracted assistant who leaves the console would let the last manual command keep running unless the machine checks that the operator is still present. The safety microcontroller bounds that risk with a hardware-timed manual lease. Depending on the console, presence detection may use a capacitive grip sensor, eye tracking, or continuous joystick deflection past a deadband, chosen for their sensor coverage and false-drop rates. Manual authority is sustained exclusively through authenticated keep-alive heartbeats streamed from the operator console to the safety microcontroller. The manual lease \(\ManualLease\) of section 14.3.1 is the longest silence the microcontroller tolerates between them. Two bounds set its length. From below, the lease must outlast the heartbeat period plus the link’s jitter and at least one lost packet, or ordinary wireless loss would drop a healthy operator into fallback. That floor is why the heartbeats must run at a rate several times the lease’s inverse. From above, the lease replaces the chunk lease inside \(\PrebrakeDelay\) while the operator holds MAN, so the travel it adds over the chunk lease, \(\SpeedAtDetection(\ManualLease - \ChunkLease)\), must fit the clearance left after the takeover. The reference implementation chooses 100 ms. Section 14.4.6 checks that value against the upper bound at the in-loop request speed, and only the site’s measured heartbeat loss can show that it clears the lower one.

Each heartbeat packet carries a strictly increasing 64-bit sequence counter \(\HeartbeatSequenceCounter\), a monotonic hardware timestamp \(\HeartbeatTimestamp_k\), an authenticated operator credential, and a keyed message authentication code (AES-128 CMAC, evaluated in section 14.5). In the age calculation below, \(\HeartbeatTimestamp_k\) represents the sender’s timestamp translated into the local clock domain. The receiver tracks the bounded clock-synchronization uncertainty interval and computes freshness relative to the oldest plausible timestamp; an unqualified clock mapping cannot safely establish packet freshness. The nominal local-clock age is: \[\HeartbeatAge = \HeartbeatReceiptTime - \HeartbeatTimestamp_k.\] These fields combine communication checks used in black-channel safety architectures (International Electrotechnical Commission 2021) with cryptographic security over an untrusted wireless link. The sequence counter detects transmission loss and replay attacks. The timestamp and bounded lease act as a communication watchdog against excessive latency. The cryptographic tag authenticates the claimed credential. The safety communication checks and the security mechanism require separate qualification.

International Electrotechnical Commission. 2021. IEC 61784-3:2021: Industrial Communication Networks, Profiles, Part 3: Functional Safety Fieldbuses, General Rules and Profile Definitions. International Electrotechnical Commission.

↩︎ The proposal header that applies the same black-channel safeguards to every learned proposal is established in Supervisory timers and proposal wire contracts.

A heartbeat packet may renew authority only while its conservative age falls within the configured freshness window. The active manual lease expires deterministically on the local hardware clock at its committed deadline; stale or out-of-order network traffic cannot extend that horizon. Similarly, an autonomous action chunk expires strictly according to its admitted local deadline. A packet that fails cryptographic verification is immediately discarded. It cannot renew the lease, but it does not revoke currently valid authority either; the existing timer runs down on its own. Upon lease expiration, the microcontroller automatically revokes the operator’s proposal token, drops into Fallback, and executes a pre-validated holding or stopping trajectory. Once a lease lapses, the state machine prohibits any immediate return to \(\text{Autonomous}\) or \(\text{Human-Manual}\). The robot must satisfy strict recovery conditions: it must come to a complete mechanical standstill, resolve and acknowledge the relevant faults without erasing their evidence, and undergo an authenticated four-phase re-admission handshake initiated from rest.

When multiple control sources propose concurrent commands, the permission path resolves candidate selection through a fixed priority hierarchy evaluated deterministically every 1 ms control cycle below the proposal boundary. This mechanism adopts the layered priority structure of subsumption architectures (Brooks 1986), but applies it strictly to input source selection rather than behavioral synthesis. The independent enforcer then admits, modifies, or rejects the winning candidate to ensure compliance with configured physical limits. In the \(\text{Human-Manual}\) state with a valid lease, the human proposal takes precedence over learned model proposals, while remaining bounded by barrier certificates and actuator limits. In \(\text{Autonomous}\), the learned policy generates candidate actions for safety screening. Because fixed-state arbitration requires bounded work per tick (\(\mathcal{O}(1)\) computational complexity), it eliminates runtime negotiation or dynamic bargaining between software proposers.

↩︎ The proposal boundary, above which a learned component may only propose and below which the permission path alone admits commands, is established in The Machine in Five Levels.

Two properties of the protocol show only when the states and handshake are drawn together (figure 5). Every active state has an edge to Fallback, so no failure of the network or the operator can leave a channel without a defined owner, and the only edge out of Fallback is a reset from standstill. The hardwired Protective input sits outside the protocol entirely and preempts every state.

Figure 5: Authority states and their guards: Each box is one value of the per-channel authority state, with its code name above its plain name. A handover runs from request through acknowledgment to a commit on a control tick; from then on the enforcer owns the blend between latched endpoints, and manual proposals begin only when the profile completes with a live manual lease. Timeout, lease lapse, or an invalid state leads to the validated fallback, whose only exit is a reset from rest with a fresh re-admission. The hardwired protective input preempts every state.

Here the state machine decouples physical bus ownership from protocol progress. An acknowledgment prepares the transition. The local hardware commit (REVOKE_PROPOSAL_TOKEN()) strips the autonomous policy of its proposal token on the committed channels and grants the enforcer sole ownership of the blend. The enforcer admits live manual proposals only after the interpolation profile completes under an active manual lease. An unconfirmed transition therefore leaves only the console uncertain, as the Confirm phase states. A delayed handover request or a dropped heartbeat, in contrast, runs down its local timer and invokes the validated fallback without waiting for network consensus.

Assigning a single writer resolves authority unambiguously at each control tick, but an instantaneous switch can still produce hazardous dynamic transients. If the autonomous policy’s last admitted joint torque diverges significantly from the operator’s initial target, directly swapping setpoints across a single tick boundary requests an unachievable step change in torque, risking mechanical shock or actuator saturation. The enforcer avoids this discontinuity by using the latched boundary conditions to generate a dynamically feasible interpolation profile that preserves stopping margins throughout the transition.

Checkpoint 14.2: Authority transitions and timeout bounds

Before moving from who owns each channel to how its command changes value, verify your understanding of leases, transition state machines, and timeout dynamics:

• State-dependent fallback: Can you explain why the moving base and the loaded arm need different validated responses when a lease lapses, and why Safe Torque Off alone provides neither?
• Finite-state transition semantics: Can you trace the deterministic progression among the Autonomous, Handover-Pending, Blend, Human-Manual, and Fallback states, and name the guard and the single actuator owner on each edge?
• Timeout bound: At the aisle speed the configured protocol ceiling is 500 ms and the clearance-derived deadline after charging the dispatch-to-admission allocation is 37.5 ms. Can you state which one sets \(\HandoverTimeout\), by how many milliseconds it is the tighter, and how many whole 1 ms permission ticks the arbiter may wait before it dispatches fallback?
• Asymmetric preemption hierarchy: Can you explain why the qualified local protection path must meet its measured deadline, while restoring autonomous authority requires a fresh admission handshake?
• Fallback on a lapsed handover: Can you explain why a lapsed or unacknowledged handover goes to the validated stop rung rather than back to the degraded policy that requested it?

If any transition paths permit unhandled timeouts or undefined intermediate states, the authority protocol is vulnerable to mode confusion and runaway actuation. Review this section before proceeding to smooth command blending.

14.4 Transfer Without Discontinuity

At commit time \(\TimeInstant_0\), the enforcer latches the last admitted policy command \(\ControlCommand_0\) and a checked human target \(\ControlCommand_1\). Switching them in one permission tick may exceed the channel’s allowed command rate. In classical process control, bumpless transfer between manual and automatic modes is achieved by making the inactive controller track the active one’s output, so its internal state, including its integrator, already agrees at the switch (Åström and Hägglund 2006). Section 14.4.3 applies that tracking to the console-side controller that turns operator input into a command. Here bumpless transfer also names a second mechanism layered on top, which spreads the remaining command change across a finite window while matching the required endpoint derivatives. The quintic seam bridges of Quintic splines and C^2 boundary matching provide the construction; takeover adds a new admission decision because waiting for the operator has already consumed some clearance.

14.4.1 Command steps and mechanical drivetrain shock

A step change in torque or acceleration excites torsional resonances and snaps gearboxes across their backlash, while a slower blend lowers the command rate at the cost of stopping reserve. Because the \(\PowerRailInductance\,d\ConductorCurrent/d\TimeInstant\) coupling to the DC supply also turns a current step into a voltage sag on the shared rail, the command transition must satisfy the drive’s rate limits while leaving enough clearance for fallback. A smooth profile therefore needs both a rate bound and a check against the remaining physical envelope.

↩︎ The \(\PowerRailInductance\,d\ConductorCurrent/d\TimeInstant\) coupling through which a current step sags the shared DC bus is established in Power distribution impedance, transient droop, and brownout resets.

Definition 14.2: C² bumpless authority transfer ramp

\(\Glyph{C}^2\) bumpless authority transfer ramp is the enforcer-owned command profile between two checked, latched references \(\ControlCommand_0\) and \(\ControlCommand_1\). It is parameterized by a monotonic weighting function \(\BumplessTransferBlend(\TimeInstant) \in [0,1]\) with vanishing first and second boundary derivatives (\(\BumplessTransferBlendRate = \BumplessTransferBlendAcceleration = 0\)) over a finite blending window \(\BlendingTransitionWindow\). The profile keeps that command and its first two derivatives continuous across the fixed-endpoint handoff. When the command is acceleration, its first derivative is commanded jerk; when it is torque, the first derivative is torque rate.

1. Significance: A setpoint step has an unbounded ideal derivative. A \(\Glyph{C}^2\) command profile removes that discontinuity; measured actuator tracking and plant limits still decide physical feasibility.
2. Distinction: Unlike a linear interpolation ramp whose derivative jumps at both endpoints, a \(\Glyph{C}^2\) quintic spline enforces vanishing first and second derivatives (\(\BumplessTransferBlendRate = \BumplessTransferBlendAcceleration = 0\)) at entry and exit, making the interpolated command and its first two derivatives continuous for stationary endpoint derivatives. The physical meaning of those derivatives depends on the command channel.
3. Common pitfall: Choosing a window shorter than the rate limit allows for a fixed acceleration-command change (the bound equation 7 derives below) breaches the stated command-jerk limit even though the profile is smooth. Resonance, slip, and stopping distance require plant tests.

14.4.2 Sizing the blend window and the stopping-distance cost

Smoothing an acceleration command from cruising speed to emergency braking delays the onset of maximum deceleration, so bumpless transfer consumes clearance. It trades stopping reserve for lower mechanical stress, and sizing the blend window means balancing the actuator’s jerk limit against the clearance that remains.

The enforcer blends with the quintic smoothstep. For normalized progress \(\BumplessTransferProgress = (\TimeInstant - \BumplessTransferStartInstant) / \BlendingTransitionWindow \in [0, 1]\), the polynomial weighting function is: \[\BumplessTransferBlend(\BumplessTransferProgress) = 10\BumplessTransferProgress^3 - 15\BumplessTransferProgress^4 + 6\BumplessTransferProgress^5. \tag{6}\] The polynomial in equation 6 is the fixed-endpoint result derived in Smooth Trajectories and Bumpless Transfer. Its derivative \(\BumplessTransferBlendSlope(\BumplessTransferProgress) = 30\BumplessTransferProgress^2(1-\BumplessTransferProgress)^2\) peaks at \(\BumplessTransferProgress = 1/2\) with value \(30/16 = 1.875\), so the profile’s peak slope is \(1.875/\BlendingTransitionWindow\) and an acceleration change must satisfy: \[\BlendingTransitionWindow \ge \frac{1.875 \lVert \FiniteChange \ControlCommand \rVert}{\JerkLimit}. \tag{7}\]

For a torque command, replace the acceleration difference and jerk ceiling with the torque difference and torque-rate ceiling. The illustrative 15 N·m joint-torque change under a 750 N·m/s ceiling therefore requires 37.5 ms, rounded up to 38 ms on the permission clock. These bounds assume stationary endpoint derivatives; a transfer from a moving ramp must match its boundary state explicitly.⁶

⁶ Nonzero Boundary Derivatives: The \(1.875/\BlendingTransitionWindow\) peak derivative factor assumes stationary endpoint derivatives. A general quintic can match the command value, first derivative, and second derivative at both endpoints, including nonzero values (Quintic splines and C^2 boundary matching). Its interior rate extrema must then be checked; the fixed-endpoint smoothstep factor does not automatically apply.

Increasing \(\BlendingTransitionWindow\) reduces the profile’s peak commanded jerk, but delays the full human target and can lengthen the stopping trajectory. Consider the remote assistant’s takeover of the mobile manipulator’s base, committed while the machine cruises at the \(\SpeedAtDetection =\) 0.75 m/s it slowed to before requesting it (section 14.2.4). Suppose the assistant commands a stop at the scenario’s braking deceleration, a fixed step of \(\lvert \FiniteChange \BaseAccelerationCommand \rvert =\) 2 m/s² from the latched cruise command. The enforcer holds the blend to \(\JerkLimit =\) 7.11 m/s³, the jerk bound of the resident jerk-limited stop. That bound is a stipulated property of the loaded base, not of its speed, so the blend window does not depend on the speed at which the takeover commits. Measured load response still requires qualification. The smoothstep bound then sets a minimum blending window of 527.34 ms, longer than the 281.25 ms the resident stop spends ramping its deceleration at the same jerk bound, because the smoothstep reaches its peak slope only at mid-window. The smoothstep weight averages one half over the window, so the base would leave the blend at 0.22 m/s after traveling 316.1 mm. Integrating the smoothstep weight a first time subtracts one half of \(\lvert \FiniteChange \BaseAccelerationCommand \rvert\,\BlendingTransitionWindow\) from the entry speed \(\SpeedAtDetection\), whereas integrating that speed profile across the window subtracts only one seventh of \(\lvert \FiniteChange \BaseAccelerationCommand \rvert\,\BlendingTransitionWindow^2\) from the unbraked travel \(\SpeedAtDetection\,\BlendingTransitionWindow\) because most of the deceleration occurs in the second half of the ramp. Braking from there at the full target would take another 12.4 mm, for 328.4 mm to zero speed in this partial model. It holds full deceleration until rest, then switches acceleration to zero instantaneously. The value is therefore a lower-bound comparison for the ramp followed by ideal braking, not a complete smooth stopping trajectory. A feasible terminal transition needs its own distance and boundary-state check.

An instantaneous step takeover would stop in 140.6 mm, so even this partial ramp-and-brake model adds 187.8 mm of travel. The partial model is also 82.4 mm longer than the 246.1 mm resident stop from the same speed. For the one-dimensional model starting at zero acceleration and ending at rest with zero acceleration, the resident profile is a minimum-distance stop under the stated deceleration and jerk bounds (The C^2 stopping suffix and jerk-limited braking), so a different complete transition into braking must be checked against that baseline. The partial comparison above lacks the required terminal transition and is not itself a competing complete profile. For a braking command the resident stop is already the bumpless transfer. The base’s blend window therefore governs base command changes that do not stop the machine, such as the first manual command after an automatic stop, where the blend starts from rest and the enforcer still checks the resident stop from every blended state. An idealized step stop is mathematically shorter. Executing an unblended emergency stop, however, risks wheel lockup, dynamic rollover, or load shedding (such as throwing a loaded tote off the manipulator rack), which can increase the actual physical stopping distance beyond the ideal theoretical rigid-body stop. Command smoothing limits the requested rate; physical stability and sufficient clearance still require qualification. The enforcer admits each blended tick only while the resident stop from the resulting state still fits. Where no blend fits, the base receives the resident stop itself, the suffix the fallback ladder’s stop rung executes. Bypassing the blend window by applying the acceleration step within a single 1 ms permission tick would instead request a command jerk of about 2,000 m/s³ over that tick. The idealized step is only a comparison baseline.

Under the stated stopping model, the blend adds travel beyond the resident stop.

14.4.3 Initial condition matching and integrator pre-biasing

Command blending removes the chosen output discontinuity, but it cannot remove one that a controller upstream of the blend produces. On the remote assistant’s side that controller is the console-side tracking loop, the software that turns joystick deflection, or a measured guiding force (the force-guided input that section 14.4.4 describes next), into a velocity target for the channel. While the policy still owns the channel, that loop runs against a plant it does not drive, and its integrator accumulates the difference between its target and a motion that never follows. At commit it would emit that accumulated correction as a jump in the manual target, a step the blend window was never sized to absorb. Initial condition matching pre-biases that loop against the measured state before commit, so its internal controller state matches the output required at transfer rather than releasing accumulated error. It does not force the deliberate human target to equal the last policy command. The enforcer latches both endpoints, sizes the blend for their actual difference, and checks the resulting command and stopping reserve throughout transfer.⁷

⁷ Mid-Blend Re-Intervention Abort: If an operator commands a secondary protective stop while a bumpless transfer blend is actively underway (\(0 < \BumplessTransferProgress < 1\)), the enforcer does not wait for \(\BlendingTransitionWindow\) to complete. It uses the measured plant position, velocity, and acceleration, together with the active command and their uncertainty, to select a qualified state-matched fallback. A new polynomial seeded only from the intermediate command does not establish that the physical plant can execute it.

To verify a transfer, record the command profile, motor current, encoder motion, and chassis inertial response on a shared timebase with bounded alignment error. In the ideal model, a step command has an infinite derivative at the switch, which excites high jerk, unmodeled compliance, and drivetrain ringing in physical hardware. A fixed-endpoint quintic polynomial removes the command discontinuity by zeroing the boundary derivatives, so its command rate stays bounded across the whole window \(\BlendingTransitionWindow\) instead of concentrating in one impulse (figure 6). The measured plant response, not the command profile, establishes whether the handover met its physical limits.

Figure 6: Step vs. quintic command transfer: A step and fixed-endpoint quintic blend are compared. The solid line is the command. The step’s ideal derivative is a red impulse, the quintic’s bounded derivative is dashed slate, and the gray ringing is schematic. The profile bounds the commanded rate for the assumed endpoints.

The two panels distinguish the command’s mathematical continuity from the plant’s measured response. Removing the step bounds the requested rate under the stated endpoint assumptions; it does not establish that the drive tracks the command or that the load remains stable. Those measurements decide whether the selected blend window is acceptable.

The enforcer’s 1 kHz loop gathers the four-phase handshake, integrator pre-biasing, and the \(\Glyph{C}^2\) quintic blend into one protocol on the safety microcontroller. Each tick it samples plant state, stopping reserve, protective inputs, and the active execution lease. It commits an ownership change only on the qualified commit tick that follows a verified acknowledgment, blends only between latched endpoints and checks every blended candidate before dispatch, and falls back on a lapsed lease or a failed clearance check.

↪ Protocol: The enforcer’s cadence, memory and write invariants, and per-state execution steps are given in Authority-transfer protocol.

14.4.4 Mapping operator input to arm motion

Once the operator holds the arm channel, commanding a rigid position target into a bin wall or rack upright builds contact force until the enforcer trips, whereas guiding the arm through measured contact force lets the wrist comply. Position streaming supplies kinematic targets directly; force guiding uses measured contact force to generate a motion target through an admittance controller⁸ (Hogan 1985). Either mapping remains subject to the arm’s qualified limits. The choice also changes the logged learning target, so the record must retain whether a sample is a requested pose, a force measurement, or an admitted command.

⁸ Admittance and Impedance Control: Hogan (1985) framed interaction control as programming the relation between force and motion at the contact. An impedance controller answers imposed motion with a commanded force; an admittance controller is its dual, turning a measured force into commanded motion, which suits stiff, highly geared arms whose position loops are accurate but which cannot render force directly. On such an arm a force-guided target is still a motion command, so it passes the same enforcer checks as a streamed pose.

Hogan, Neville. 1985. “Impedance Control: An Approach to Manipulation: Part i–Theory, Part II–Implementation, Part III–Applications.” Journal of Dynamic Systems, Measurement, and Control 107 (1): 1–24.

14.4.5 Bilateral teleoperation and haptic feedback passivity

A force-reflecting console adds an actuated device at the operator’s hands. Delayed feedback⁹ can destabilize that coupled loop even when authority ownership is correct (Anderson and Spong 1989). Such a console therefore needs a separate interaction-energy argument, including its port conventions, controller sampling, delay and loss assumptions, and actuator saturation. The energy-storage condition and wave-variable construction are developed in Passivity and Energy-Bounded Interaction; they do not replace the clearance or force limits. The basic warehouse takeover does not require bilateral force reflection. If a site adds it, pre-biasing and ramping the console’s force output must prevent a command step at the operator’s hand within its own measured limits, because the arm’s accepted blend duration does not automatically qualify the console. Whichever input mapping and console a site chooses, the session that carries them must still fit the clearance left after the operator’s response.

⁹ Delayed Teleoperation: Ferrell (1965) found that operators working through a transmission delay fall back on a move-and-wait strategy, so task time grows with the delay. Force reflection through the same delay proved unstable until Anderson and Spong (1989) used scattering theory to make the communication channel passive, a construction that Niemeyer and Slotine (1991) recast as wave variables. For a force-reflecting console the delay budget is therefore a stability term as well as a latency term.

Ferrell, William R. 1965. “Remote Manipulation with Transmission Delay.” IEEE Transactions on Human Factors in Electronics HFE-6 (1): 24–32. https://doi.org/10.1109/THFE.1965.6591253.

Anderson, Robert J., and Mark W. Spong. 1989. “Bilateral Control of Teleoperators with Time Delay.” IEEE Transactions on Automatic Control 34 (5): 494–501. https://doi.org/10.1109/9.24201.

Niemeyer, Günter, and Jean-Jacques E. Slotine. 1991. “Stable Adaptive Teleoperation.” IEEE Journal of Oceanic Engineering 16 (1): 152–62. https://doi.org/10.1109/48.64895.

14.4.6 Admitting the remote-assistant session

Every interval priced so far in this chapter now draws from the same finite stopping reserve when a remote session begins. Admitting the remote assistant requires bounding four timing parameters against the machine’s limits: the operator reaction budget (the takeover latency \(\SupervisoryTakeoverLatency\) of equation 1 for the takeover mode in use), the handshake protocol latency \(\HandshakeProtocolLatency\), the manual lease \(\ManualLease\), and the minimum blending window \(\BlendingTransitionWindow\). Table 6 states them for the machine’s two command channels, the base and the arm, which one remote-assistant session commands together.

↪ How many machines one remote assistant can serve before requests wait minutes for a person is developed in One person, many machines.

Table 6: Blending windows on the mobile manipulator: One remote-assistant session commands both channels, and each window is rounded up to whole 1 ms permission ticks. The rate ceiling \(\CommandRateCeiling\) bounds the derivative of each command. The base window is the same at every speed, because the jerk bound belongs to the loaded base. At the in-loop request speed a braking blend does not fit the clearance that remains, so the base receives the resident stop and its window applies only to non-braking changes. Every lease and pending deadline must fit the state-dependent stopping reserve.

Machine channel	Command change and chosen rate ceiling	Smoothstep window \(\BlendingTransitionWindow\ge1.875\lvert\FiniteChange \ChannelCommand\rvert/\CommandRateCeiling\), whole ticks	Human / protocol time	Fallback contract
Base acceleration command	Zero to 2 m/s²; \(\CommandRateCeiling=\) 7.11 m/s³, the resident stop’s jerk bound	528 ms	605 ms / 31 ms	100 ms manual lease; 500 ms pending ceiling shortened by clearance
Arm joint torque command	15 N·m; torque rate \(\CommandRateCeiling=\) 750 N·m/s	38 ms	605 ms / 31 ms	The same manual lease; its loss invokes the arm’s validated stop

Consider an illustrative remote-assistant in-loop takeover, requested after the mobile manipulator has slowed to 0.75 m/s with the assistant’s manual_drive entry. The four parameters take the values already derived. The reaction budget \(\SupervisoryTakeoverLatency\) is the 605 ms in-loop takeover of section 14.2.2, which already includes transport and the 31 ms four-phase exchange of table 5, so the handshake is part of \(\SupervisoryTakeoverLatency\), not an addition to it. The manual lease, the longest silence tolerated from the assistant before the permission path falls back, is 100 ms, and table 6 gives the blending window for each channel.

An in-loop session at 0.75 m/s closes its complete budget by only a few centimeters, and only because the base takes its resident stop rather than a braking blend. A session that begins at the 0.15 m/s crawl or from standstill has far more room, so those are the configurations worth qualifying. Table 7 charges the in-loop session’s intervals one at a time against the clearance the finished budget leaves at that speed.

Table 7: Clearance budget for an in-loop remote-assistant session: Each row charges one interval at the 0.75 m/s request speed, in the capture-origin design budget, and the last column carries what remains. The first four rows close the complete budget by a few centimeters; the blend row would overrun it. These are screening values for an allocated, unmeasured \(\DispatchAdmissionInterval\), not a qualified admission result.

Interval charged at the in-loop request speed	Travel	Clearance left
None (the finished budget’s spare)		563.7 mm
In-loop takeover \(\SupervisoryTakeoverLatency\), handshake included	453.8 mm	110.0 mm
Dispatch-to-admission allocation \(\DispatchAdmissionInterval\)	47.5 mm	62.5 mm
Manual lease in place of the chunk lease in \(\PrebrakeDelay\)	30 mm	32.5 mm
Base braking blend (reserve it would use)	up to 157.0 mm	Does not fit; the base takes its resident stop

Three rows of the table decide that verdict. The remainder after the takeover, the 146.6 ms by which the takeover beats \(\FallbackDeadline\) (section 14.2.4), bounds the transfer itself. Any further delay before a stop could begin while authority is changing hands must fit inside it, and the enforcer checks the resident stop against it at every tick of the transfer. The lease row exists because, once the assistant holds MAN, the manual lease replaces the 60 ms chunk lease inside \(\PrebrakeDelay\), so its extra length becomes travel. The row is the upper bound on the lease set out in section 14.3.4, and the chosen value passes it. The blend row fails. Blending the step to braking from 0.75 m/s grows the travel plus the resident stop from the blended state by up to 157.0 mm, well past the remainder, so in this session the base receives the resident stop and only the arm blends. This conservative per-tick check charges a fresh resident stop starting from zero deceleration at each blended speed rather than the partial model’s 82.4 mm constant-deceleration tail, because any fallback triggered during the blend begins from the standard resident profile. The slow-down was derived with \(\DispatchAdmissionInterval\) charged, so the complete budget closes, but by centimeters, another reason the base should complete its stop before accepting continued manual motion.

At the crawl, after a 4.5 s out-of-loop takeover, 198.4 mm remains before the same charges, and the base’s stop from the crawl is its resident stop, with no braking blend to reserve. The admission allocation and the lease extension cost travel in proportion to speed, so at the crawl they take only a small part of that remainder. Once the assistant holds MAN, the live check of table 3 uses the current remaining clearance, the measured speed, and only the unelapsed portions of those intervals; commit does not restore the distance spent waiting or blending. These figures screen the candidates. Qualification must still check the rounded executable profile and the state-matched fallback, including delay travel, over the full transition, against a measured \(\DispatchAdmissionInterval\).

Every command in that session, whether a streamed pose, a force-guided target, or a heartbeat that renews the manual lease, must also come from the authenticated operator that the manual_drive entry names. A budget that closes by a few centimeters leaves no room for a forged or replayed packet, which makes identity and packet admission the next constraint.

14.5 Authenticating an Intervention

On a shared wireless link, a legitimate veto_path intervention packet and an unauthorized drive-torque packet can arrive within the very same control cycle. The permission architecture must prevent an adversary or malformed network frame from seizing kinetic authority, yet it must never obstruct an authorized operator from arresting the machine before a collision. Systems engineers reconcile the two demands by classifying intervention operations according to the mechanical work they produce. Stopping the machine by removing power or engaging a mechanical holding brake is not symmetrical with injecting active motion commands, so the two actions take different verification paths. A protective stop brings the machine to a controlled halt along a braking or holding rung of the fallback ladder rather than abruptly cutting actuator torque. Commanding base velocities, wheel torques, or joint trajectories, by contrast, injects fresh mechanical energy into the plant: a forged or corrupted trajectory command can drive a moving mass into an obstacle, whereas an authenticated out-of-band protective input only requests a plant-specific minimum-risk stop.

Authentication adds delay to the remote intervention path, so it is priced against the same deadline as every other latency source, the latest fallback deadline \(\FallbackDeadline\) of equation 4. At the warehouse aisle velocity of 1.3 m/s, the partial spare permits at most 100.8 ms of added delay before charging the admission latency \(\DispatchAdmissionInterval\), which drops to 37.5 ms once the placement allocation is charged. Transferring published Cortex-M4 cycle counts to the reference microcontroller clock gives an illustrative estimate of 1.8 ms for one Ed25519 signature verification¹⁰ (Owens et al. 2024), which translates into 2.34 mm of physical travel and leaves 128.7 mm of spare displacement margin. The same cycle-count and clock-rate estimate for an AES-128 CMAC over one command frame is 5.0 μs (Dworkin 2005; Schwabe and Stoffelen 2017). Per packet, both estimates fit within the deadline; loaded measurements on the target must qualify them. The design problem is therefore not choosing an algorithm but meeting five requirements on the admission path that carries the packets:

¹⁰ Ed25519: The Edwards-curve signature scheme of Bernstein et al. (2012) provides rapid verification alongside compact 32-byte public keys and 64-byte signatures. Constant-time implementations eliminate secret-dependent branches and memory lookups to protect against side-channel timing attacks. While that defense primarily shields the signing teleoperation console, the receiving safety microcontroller only verifies incoming frames. Well-formed invalid signatures can still require the expensive verification path, even when malformed inputs admit early rejection. The verifier’s processing load therefore depends on admitted traffic and its verification paths, the vulnerability that the verifier-flooding analysis of section 14.9 prices.

Bernstein, Daniel J., Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. 2012. “High-Speed High-Security Signatures.” Journal of Cryptographic Engineering 2 (2): 77–89. https://doi.org/10.1007/s13389-012-0027-1.

Owens, Daniel, Rabih El Khatib, Mojtaba Bisheh-Niasar, Reza Azarderakhsh, and Mehran Mozaffari Kermani. 2024. “Efficient and Side-Channel Resistant Ed25519 on ARM Cortex-M4.” IEEE Transactions on Circuits and Systems I: Regular Papers 71 (6): 2674–86. https://doi.org/10.1109/TCSI.2024.3384414.

Dworkin, Morris J. 2005. Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication. NIST Special Publication 800-38B. National Institute of Standards; Technology. https://doi.org/10.6028/NIST.SP.800-38B.

Schwabe, Peter, and Ko Stoffelen. 2017. “All the AES You Need on Cortex-M3 and M4.” Selected Areas in Cryptography (SAC 2016), Lecture notes in computer science, vol. 10532: 180–94. https://doi.org/10.1007/978-3-319-69453-5_10.

1. Protective stops never wait for verification. The local hardware fallback timer and independently wired emergency inputs act unconditionally, regardless of whether cryptographic routines have completed or stalled. If a verification routine overruns its deadline, the permission subsystem marks remote assistance as unavailable and cedes control to the autonomous protection layer; it never postpones an emergency deceleration. As analyzed in the verifier-flooding pitfall of section 14.9, what causes a cryptographic verifier to miss real-time deadlines is rarely the algorithmic cost of an individual packet, but rather the ingress volume of hostile or unvetted network traffic saturating the execution queue.
2. Takeover requests must be attributable to an individual. Because a symmetric Message Authentication Code (MAC) relies on a shared key known to both endpoints, a valid tag proves frame integrity but cannot prove which endpoint originated the transmission. An asymmetric digital signature, however, cryptographically binds the takeover request to the teleoperator’s private key, supporting attribution when credential enrollment, key custody, and compromise evidence also identify the operator. The architecture therefore mandates an asymmetric digital signature on the session-initiating manual_drive request, while subsequent streaming commands and periodic heartbeats rely on the lower-overhead symmetric MAC.
3. Freshness represents a spatial displacement budget, not merely a clock tolerance. In embodied systems, packet latency translates directly into unmodeled vehicle travel. A replayed or delayed motion packet arriving at the boundary of a 100 ms freshness acceptance window commands an action based on an obsolete vehicle pose. Over that interval the mobile base travels 130 mm, consuming nearly the entire safety margin and leaving only 1.0 mm of the 131.0 mm partial spare. Once the admission latency \(\DispatchAdmissionInterval\) is factored in, such a replay completely overruns the available spare, so the allowable freshness window must shrink below 37.5 ms. The receiver drops counters no newer than the last authenticated, accepted counter before spending processor cycles on cryptography. It advances that stored counter only after authentication and freshness checks pass, so an unauthenticated high counter cannot invalidate later legitimate traffic. Furthermore, if heartbeat packets cease for longer than the lease duration \(\ManualLease\), the controller immediately revokes manual authority and engages the certified local fallback ladder.
4. Malformed traffic never alters control authority. Any packet with a corrupted checksum, an out-of-order sequence counter, or an invalid authentication tag is immediately rejected and recorded according to Rule A4 of section 14.8. A corrupted packet neither modifies existing actuator channel assignments nor triggers a spurious emergency stop. Rejecting an isolated invalid packet preserves still-valid authority; interference or dropouts that prevent timely renewal still expire the lease and invoke the qualified fallback.
5. Every actuator-write path must be accounted for. All side channels capable of driving physical hardware, including diagnostic ports, hardware bootloaders, debug interfaces, and direct fieldbus wiring, must be gated by the hardware permission authority or guarded by dedicated interlocks. The intervention threat model explicitly accounts for unauthorized remote packets injected across wireless links, replay attacks traversing internal communication buses, and rogue commands originating from a compromised high-level application processor. Physical tampering, by contrast, enters the safety assurance case only when explicitly mandated by the operational threat model.

These authentication and transport latencies directly impact policy learning and sim-to-real transfer. An embodied simulator that provides instantaneous human takeover underprices the danger of visiting marginal states. If an autonomous policy learns that intervention occurs instantaneously, it will tolerate trajectories that are physically unrecoverable once realistic communication, cryptographic verification, and actuator fallback latencies are introduced. Training and hardware-in-the-loop evaluation pipelines must therefore inject these bounded authentication, transport, and mechanical reaction delays.

Verifying an incoming packet authenticates its credential; the capability manifest separately determines its privileges. Cryptographic validity alone cannot guarantee dynamic stability during control transfer. When authority shifts while the chassis carries linear momentum and the manipulator actuators exert active joint torques, the permission path must commit one selected source per channel and announce that ownership to the operator. Local mutual exclusion and human mode awareness are separate requirements; a valid packet establishes neither by itself.

14.6 Authority Handover Failure Modes

When the warehouse mobile manipulator’s perception policy meets an unmodeled specular reflection from wet shrink-wrap on a pallet, depth artifacts drop its confidence and the runtime asks a remote assistant to reposition the gripper. If the console grants manual joystick authority over the arm without locking the base channel or announcing that the base is still moving, an assistant focused on aligning the fingers assumes the chassis is stationary. Meanwhile the autonomous navigation thread keeps driving the wheels into a rack upright. Every individual hardware and software component in that handover operates within its specification. The collision comes from mode confusion, the failure class that Sarter and Woods identified in automated aircraft cockpits (Sarter and Woods 1995). Every operating mode added to a control loop multiplies the state a human supervisor must track. When an interface changes modes without unambiguous telemetry of which agent holds each channel, operators take actions that are right for their assumed mode and hazardous in the actual one (Sarter and Woods 1995). In embodied physical systems, the most dangerous form of this failure is authority ambiguity: a state in which the autonomous runtime assumes the human has taken over a physical degree of freedom, while the human assumes the automated controller still guides it.

Definition 14.3: Mode confusion

Mode confusion is a mismatch between the operational state a human supervisor believes an automated system occupies and its actual execution mode, leading the supervisor to take actions that would be correct for the presumed state but are hazardous in the real one.

1. Significance: When control channels transfer authority independently, an operator’s mental model of one channel can easily go stale while their attention is consumed by another. For example, an operator dedicates the 605 ms in-loop response window entirely to an arm alignment, under the false belief that the base is parked. The base, running under the autonomous policy at 1.3 m/s aisle speed, then travels 786.5 mm, which is 16.1× the 48.7 mm margin the complete budget leaves for \(\StoppingDistance \le \ClearDistance\).
2. Distinction: Conflicting command streams between concurrent software modules represent an arbitration fault, which single-owner bus gating resolves by construction. Mode confusion, by contrast, resides within the supervisor’s mental model of the machine. Resolving it requires committed channel masks and explicit per-channel status annunciation at the console, because deterministic ownership on the CAN bus or Ethernet backplane cannot correct a human’s false assumptions.
3. Common pitfall: Telemetry confirming that an operator’s gaze is directed at a primary task monitor does not guarantee the absence of mode confusion. Tracking an operator’s visual focus onto an end-effector camera stream reveals nothing about whether that operator realizes the autonomous navigation stack still holds kinetic authority over the drive chassis.

On a machine with several axes, control authority splits naturally across distinct groups of joints, such as the mobile base’s planar velocity (\(\BaseLongitudinalVelocity, \BaseLateralVelocity, \BaseHeadingRate\)) and the manipulator arm’s joint positions. In the wet-shrink-wrap collision, those channels transferred independently. Telemetry logs reveal the fault as disjointed control flags toggling asynchronously across execution threads. At the human-machine interface, however, the split state stays invisible until physical clearance is exhausted, because neither the policy nor the human receives an immediate, unambiguous indicator of the other’s partial withdrawal.

To prevent this desynchronization, handover protocols must enforce explicit, per-channel bitmasks across every phase of negotiation. Every Request, Acknowledge, and Commit message must declare the exact subset of degrees of freedom being transferred. The formal transition state machine of section 14.3 moves proposal tokens exclusively for those designated channels, and the subsequent Confirm phase explicitly annunciates active ownership on each channel back to the operator console. A channel left out of the bitmask may keep its autonomous owner, so the base can keep navigating while the operator takes the arm. This holds only while the console annunciates that the base is still moving under the policy and the operator’s acknowledgment covered that state. Without that annunciation, the commit places the untransferred channel in a certified holding state, such as an active brake hold, rather than letting autonomous execution continue silently. The wet-shrink-wrap collision above is the second rule’s case, an untransferred base left running without annunciation.

Explicit channel ownership protocols solve arbitration on the digital bus, but they cannot restore the situational awareness of an out-of-loop human. For this reason, the in-loop and out-of-loop takeovers of section 14.2.2 must be treated as distinct operational states with different timing budgets, the 605 ms and 4.5 s that set different request speeds. While gaze tracking can verify where an operator directs their eyes, it cannot verify cognitive comprehension or justify truncating the required takeover latency budget. Local stopping envelopes must remain continuously armed and active, even when the console reports an attentive supervisor. Two field incidents show what happens when either half of this two-layer protection is missing.

In the Tempe, Arizona collision, the National Transportation Safety Board (NTSB) determined that the safety driver was visually distracted by a personal smartphone, identifying operator complacency and inadequate monitoring policies as primary contributing factors (National Transportation Safety Board 2019). The vehicle architecture had disabled automatic emergency braking during testing and relied entirely on the human supervisor to perceive hazards and intervene. In the San Francisco Cruise incident, an autonomous vehicle executed an emergency stop after striking a pedestrian who had been thrown into its path by an adjacent human-driven car. The onboard planner, however, subsequently initiated an automated pull-over maneuver, dragging the pedestrian beneath the chassis (Quinn Emanuel Urquhart and Sullivan, LLP 2024). The Tempe disaster demonstrates why an operator-monitoring contract must always be backed by an autonomous, local stopping envelope capable of bringing the machine to a halt within the remaining sensor clearance, regardless of operator attentiveness. The Cruise incident demonstrates that unexpected physical contact, tactile sensor anomalies, or sudden external force spikes must immediately lock out all motion authority into a verified physical inspection hold, rather than allowing automated post-collision clearing routines to execute.

National Transportation Safety Board. 2019. Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, Arizona, March 18, 2018. HAR-19/03. National Transportation Safety Board.

Quinn Emanuel Urquhart and Sullivan, LLP. 2024. Report to the Boards of Directors of Cruise LLC, GM Cruise Holdings LLC, and General Motors Holdings LLC Regarding the October 2, 2023 Accident in San Francisco. Quinn Emanuel Urquhart; Sullivan, LLP.

↩︎ The Tempe timeline, including the action suppression that withheld emergency braking, is established in When the Responsibilities Fail Together.

A human operator’s manual command can oppose an active safety barrier without creating a multi-writer conflict on the actuator bus. When an operator commands a manipulator toward a prohibited obstacle, the downstream safety enforcer either projects the trajectory onto the safe half-space or rejects the command entirely, dispatching only the admitted control action to the motor drives. However, the supervisory console must make this active constraint immediately visible to the human. If the interface conceals why the robot has stopped responding, the operator will instinctively command higher control effort or larger joystick displacements, leading to severe command saturation and instability once the constraint clears. Furthermore, when the console incorporates bilateral teleoperation or force-feedback interfaces, system stability depends directly on the passivity-based energy bounds established in section 14.4.5; ownership tokens alone cannot prevent feedback oscillations across a physical-virtual coupled loop.

Authority ambiguity also corrupts downstream imitation learning. If the record cannot say who held each channel, interventions are mislabeled as autonomous behavior or the reverse, and a behavioral-cloning policy learns to reproduce the very errors that triggered the takeover. A low offline validation loss cannot catch this, because it only shows that the policy memorized the wrong labels. Causal intervention masking, developed in section 14.8.3, depends on ownership bits that the authority record stamps at commit time.

War Story 14.1: Ground-contact interlocks on flight 2904

Context: On Lufthansa Flight 2904 at Warsaw, the flight crew executed an approach based on outdated wind reports, encountering an unreported tailwind that caused the aircraft to touch down at high speed far down a waterlogged runway. Upon touchdown, the crew immediately commanded maximum manual braking and deployed thrust reversers, but the aircraft’s automated flight-control logic refused to grant deceleration authority (Main Commission Aircraft Accident Investigation Warsaw and German Federal Bureau of Aircraft Accident Investigation 1994).

Mechanism: Crosswinds and runway hydroplaning delayed the left gear compression: the right main gear made contact 9 s before the left. The aircraft’s deceleration interlocks were rigid. Ground spoiler deployment required weight-on-wheels shock-strut compression on both main gears or wheel spin-up above 72 knots. Thrust reversers required weight compression on both main struts. Mechanical wheel braking was locked out until the main wheels achieved synchronized spin-up. Because hydroplaning prevented wheel spin-up and an asymmetric roll angle kept the left strut uncompressed, the control logic determined the aircraft was still airborne. Consequently, the flight computer locked out spoilers and reversers for 9 s and inhibited wheel brakes for even longer.

Impact: Wheel braking was inhibited until 13 s after initial touchdown. With braking authority locked out across the primary deceleration zone, the aircraft could not dissipate its kinetic energy along the remaining wet runway. It overran the runway threshold at 72 knots, struck an airport embankment, and caught fire, resulting in two fatalities and total hull loss.

Response: Official accident investigators cited the ground-contact interlock logic as a critical contributing cause alongside crew decision-making and delayed meteorological updates. The crew could not override the spoiler and reverser lockouts. The report identifies those design constraints alongside crew actions and incomplete landing-distance guidance; it does not establish that a manual override alone would have prevented the overrun.

Systems lesson: Embodied robots share this exact failure topology whenever automated sensor preconditions, such as docking latch checks, wheel-slip traction observers, or ground-contact switches, gate emergency braking or reverse-torque commands issued by human supervisors. Unmodeled wheel slippage or uneven terrain can violate a sensor predicate precisely when deceleration is urgently required. Any control architecture that gates physical actuation behind automated preconditions must satisfy three rules. First, it must immediately annunciate unsatisfied interlocks across the operator console. Second, it must explicitly identify the unfulfilled sensor predicate. Third, it must provide a deterministic fallback mode for sensor disagreement. Rather than bypassing safety interlocks blindly, the supervisory architecture must define a certified fallback deceleration path that executes based on conservative, physically verifiable stops.

Main Commission Aircraft Accident Investigation Warsaw and German Federal Bureau of Aircraft Accident Investigation. 1994. Report on the Accident to Airbus A320-211 Aircraft in Warsaw on 14 September 1993. Polish Ministry of Transport; Maritime Economy / BFU.

The formal authority arbiter detailed in section 14.3 exists to prevent these failures. Safe embodied control architectures cannot rely on implicit authority handoffs, assumed human vigilance, or ad hoc torque summing on the actuator bus. Evaluating post-incident behavior requires a tamper-evident, channel-by-channel telemetry record captured at every control cycle, with explicit gaps and bounded event timing. The surviving record can help distinguish a safety boundary breach, an invalid token exchange, and electrical noise on a safety bus only to the extent that its independent measurements, capture coverage, and timing bounds separate those events. Its storage path must therefore survive unexpected power interruptions, kernel panics, and real-time scheduling stalls.

14.7 Trustworthy Operational Logs

Consider a robotic arm striking a warehouse racking upright during a supervisory takeover. If the operational log contains an unrecorded gap, investigators cannot determine whether the policy proposed the damaging trajectory, the enforcer admitted it, or the operator received authority too late to intervene. Rigorous incident reconstruction requires two foundational properties: declared loss handling and an operational record engineered to survive physical failure.

A trustworthy record must capture state on both sides of the causal boundary, paired with independent plant observations.¹¹ Motor phase currents, optical encoder positions, and wrist force-torque measurements provide physical observations distinct from software setpoints, subject to their calibration, bandwidth, and uncertainty bounds. Dispatched commands alone cannot prove delivered actuator torque or establish mechanical collision causality.

¹¹ Event Data Recorder Baseline: A passenger-vehicle event data recorder captures 5 s of pre-crash data at 2 Hz (phasing in from September 2028 to 20 s at 10 Hz), which even under the modernized rule yields only one sample per 100 ms across 100 permission ticks (National Highway Traffic Safety Administration 2024). Similarly, the data storage system mandated for automated lane-keeping systems under UN Regulation No. 157 logs system activations, overrides, and transition demands to establish driver attribution, but its timestamps require accuracy only within 1 s, or 1,000 permission ticks (United Nations Economic Commission for Europe 2021). Because neither regulatory standard provides the time resolution needed to order an intervention against physical contact within a single control cycle, the autonomous machine must maintain its own deterministic, per-tick operational record.

National Highway Traffic Safety Administration. 2024. Event Data Recorders: Final Rule (49 CFR Part 563). 89 FR 102810. U.S. Department of Transportation.

United Nations Economic Commission for Europe. 2021. UN Regulation No. 157: Uniform Provisions Concerning the Approval of Vehicles with Regard to Automated Lane Keeping Systems. E/ECE/TRANS/505/Rev.3/Add.156. United Nations Economic Commission for Europe.

↩︎ A record of what was proposed, evaluated, dispatched, and measured is the third demand on the permission path established in Where Safety, Security, and Accountability Meet.

At every cycle, the 1 kHz deterministic control loop records a structured authority and action tuple under declared loss handling. The minimal evidence tuple takes the form: \[\langle \MicrocontrollerClockTime, \RecordedAuthorityState, \MechanicalPlantState, \NominalControlCommand, \CertifiedControlAction, \JointTorque, \text{ID}_{\text{operator}}, \RemainingExecutionLease\rangle\] This tuple records both sides of the proposal-permission boundary. Its command fields are the action taps of The four-stream action tap tuple taken at intervention time: \(\NominalControlCommand\) is the requested or mapped command (\(\RequestedActionTap\) or \(\MappedCommandTap\), whichever the source emits), \(\CertifiedControlAction\) is the enforced command \(\EnforcedCommandTap\), and the measured response \(\MeasuredResponseTap\) lives in \(\MechanicalPlantState\). The fields are:

• \(\MicrocontrollerClockTime\) is the monotonic event timestamp recorded in nanoseconds by the safety microcontroller hardware clock, mapped to other subsystem clocks through a qualified clock-conversion method with an explicit error bound. Expressing values in nanosecond units does not imply nanosecond-level inter-device synchronization accuracy.
• \(\RecordedAuthorityState\) records the active discrete authority state (AUTO, PEND, BLEND, MAN, FALLBACK, or PROTECTIVE).
• \(\MechanicalPlantState\) captures the instantaneous measured plant state, including joint angles, velocities, motor phase currents, and IMU linear accelerations.
• \(\NominalControlCommand\) is the proposed plant control setpoint requested by the cognitive policy or human operator console.
• \(\CertifiedControlAction\) is the control command admitted by the enforcer, including a feasible CBF-filtered proposal or the selected qualified fallback. Associated event metadata must distinguish admission, modification, and rejection; Closed-form quadratic programming and torque projection specifies the projection path.
• \(\JointTorque\) is the actuator torque command dispatched across the real-time fieldbus to the motor inverters. It is still a command; delivered motor torque can be estimated from the measured phase currents in \(\MechanicalPlantState\) using a qualified motor model and explicit uncertainty bounds.
• \(\text{ID}_{\text{operator}}\) identifies the authenticated cryptographic entity holding active proposal rights.
• \(\RemainingExecutionLease\) records the remaining time on the active execution lease (\(\ChunkLease\) or \(\ManualLease\), minus the elapsed duration \(\MicrocontrollerClockTime - \LeaseRefreshInstant\)).

Omitting any of these fields breaks post-incident reconstruction. Without the proposal \(\NominalControlCommand\), a dispatched torque \(\JointTorque\) cannot show whether the policy or operator asked for an erratic action. Without the enforcer output \(\CertifiedControlAction\), the log cannot show whether the safety barrier modified that request. Without \(\RemainingExecutionLease\), it cannot show whether authority had already lapsed into a fallback mode when the command was evaluated. Chained with cryptographic integrity proofs and clock-synchronization metadata, these tuples form the per-tick half of the authority record that section 14.8 specifies.

Three architectural requirements ensure that logged tuples serve as reliable forensic evidence. First, timestamps must date physical events rather than software handling. A software interrupt handler that samples the clock only after being scheduled records its own execution delay rather than the event time. Under variable scheduling jitter and interrupt latency, this delay can easily invert the apparent chronological order of an intervention command and a mechanical contact. Protective inputs and fieldbus ingress packets must therefore be timestamped directly at the hardware boundary through timer edge capture and network controller hardware counters. When clock-conversion error, sensor exposure windows, and sampling intervals overlap between two events, the log must explicitly record their relative order as indistinguishable rather than asserting an unverified sequence.

Second, the storage pipeline must be strictly tiered by guarantee level. Minimal evidence tuples stream to a bounded ring buffer in non-volatile memory on the safety microcontroller. The serialized tuple size multiplied by the control tick rate sets a continuous write bandwidth that hardware qualification tests must prove the device sustains under all operating regimes, with buffer overflows explicitly flagged rather than silently dropped. High-bandwidth perception streams, including camera frames, point clouds, and policy internal activations, flow to a best-effort buffer on the primary host. This high-volume traffic is never permitted to contend for the safety microcontroller’s memory or bus bandwidth.

↩︎ The multi-camera ingestion rate that this best-effort buffer must absorb is established in Ingestion rate and the preservation requirement.

Third, loss must be declared explicitly. When buffer exhaustion or bus stalls occur, the logger must record a missing entry or overwritten frame as a declared gap in the evidence, never as an implied safe pass. A declared gap alerts both post-incident auditors and downstream training pipelines that the trajectory continuity was broken, whereas a silent drop makes two separated ticks appear contiguous in time.

Upon receiving an intervention trigger, such as an operator takeover command, an emergency stop assertion, or an enforcer barrier violation, the logger freezes a configured pre-trigger window (\(\PreTriggerWindowDuration =\) 5 s) and transitions to recording a dedicated post-trigger segment. The pre-trigger duration matches the 4.5 s design out-of-loop takeover latency characterized in section 14.2.2, rounded up to whole seconds. This window preserves the design takeover interval, but policy divergence may begin before the operator notices it, so its duration alone does not establish that the complete causal chain remains in the log. Operational sites that measure longer takeover tails must lengthen \(\PreTriggerWindowDuration\) accordingly. Overwritten frames or dropped samples within this interval remain declared gaps in the evidence. Intervention and Recovery Data uses this same window as its lookback horizon, searching it for the divergence point \(\DivergenceInstant\) and detailing why learner-visited states during drift are essential for offline policy training. The authority record provides the cryptographic ownership stamps that allow the training pipeline to distinguish unprivileged policy proposals from enforcer interventions and operator overrides.

Finally, the operational record must reveal any subsequent tampering or truncation. Each entry carries a keyed cryptographic link over its predecessor,¹² while periodic authenticated anchors are written to replay-protected storage located outside the logger’s primary write path. Rewritable non-volatile storage with authenticated writes satisfies this requirement, avoiding the need for dedicated write-once media. Under this design, investigators can determine exactly which log prefix each anchor authenticates, verify that cryptographic keys and anchors remained in trusted custody, and flag any unanchored tail or missing block as a declared gap. Hardware-level tamper resistance and loss declaration protect record integrity and expose missing evidence; they do not establish that a sensor reading is accurate. To serve post-incident reconstruction and downstream policy training, however, these raw evidence streams must be bound into a formal, machine-checkable artifact: the authority record.

¹² Linked Hash Chains: Haber and Stornetta (1991) proposed linking each timestamp to the cryptographic hash of its predecessor, ensuring that no historical record can be backdated or inserted without invalidating every subsequent link. The authority record inherits both this tamper-evident property and its limit, since an adversary possessing the signing keys and complete control over the storage device can recompute the entire chain. To protect against retroactive tampering, commitment anchors must be mirrored to an independent, replay-protected storage domain outside the logger’s mutable write path.

Haber, Stuart, and W. Scott Stornetta. 1991. “How to Time-Stamp a Digital Document.” Journal of Cryptology 3 (2): 99–111. https://doi.org/10.1007/BF00196791.

14.8 The Authority Record

When an incident investigator asks, weeks after an abrupt blocked-aisle takeover, which entity drove the mobile base as it neared the rack end, the machine’s recorded telemetry provides evidence bounded by its capture coverage, clock alignment, independent plant measurements, and trusted custody. The authority record bridges real-time supervisory arbitration with downstream verification and release claims. To establish this audit trail, the authority record consumes two upstream contracts. From the enforcement record of The Enforcement Record, it ingests the rungs of the fallback ladder so that every logged fallback explicitly identifies the rung executed by the permission path. From the placement record of The Placement Record, it incorporates the permission path’s declared timing bounds and bus arbitration settings, which every operator command also crosses, together with the placement record’s loaded-test field, which stays empty until verification fills it. The record shows who held each channel at each tick; it does not show who decided the speed, the staffing, or the operating domain that put the machine there.

↪ The record of who decided that the machine could be in that situation at all, with a named owner for each decision, is developed in The Approval Record.

To these upstream contracts, the authority record adds two deliverables of its own. The static authority manifest translates the capability matrix of section 14.2 into a machine-checkable contract. It binds every actuator channel to its authorized actors, operational preconditions, preemption tiers, and transition deadlines, and the safety microcontroller verifies and seals this manifest before the actuator drivers energize. Complementing the manifest, the record’s per-tick log forms an independent stream that records, for every control cycle, which entity held kinetic authority alongside the commands proposed, admitted, and dispatched, paired with independently measured physical response. In this stream, a missing cycle registers as an explicit communication or capture gap rather than an implied pass. The static manifest establishes the legal rules of interaction, while the per-tick log supports checking recorded runtime adherence under the capture, synchronization, custody, and declared-gap assumptions of section 14.7.

14.8.1 The static authority manifest and capability binding

If an operator’s permissions or a channel’s rate limits can be edited in software while the machine runs, a post-incident log cannot prove which rules the arbiter was supposed to enforce at the moment of a takeover. The static authority manifest fixes those rules before the actuators energize: loading and cryptographically sealing the manifest during system initialization binds every subsequent event to the permissions and physical limits in force at boot. It specifies every permitted interaction as a verifiable contract between the physical platform and potential command sources. Each entry delineates a distinct physical authority domain using a hardware actuator mask, an authorized entity class (such as a local physical operator, a remote teleoperation console, an autonomous trajectory policy, or an emergency stop loop), and an integer preemption tier. Before any command vector enters the actuation pipeline, the permission path verifies the sender’s cryptographic role credentials against this manifest. Over the network, an operator’s command arrives as an OPERATOR payload under the same proposal header, carrying the operator’s role, the requested channel mask, the command vector, a monotonically increasing nonce, and a keyed authentication tag.

In addition to credential validation, each manifest entry enforces four operational invariants on its assigned channel:

1. Single-writer mutual exclusion: Hardware access controls guarantee that exactly one entity writes to an actuator channel at any given instant.
2. Execution lease duration (\(\ManualLease\)): For human operators, the lease defines the maximum tolerable silence before the enforcer revokes authority and triggers a state-dependent fallback.
3. Command rate ceiling (\(\CommandRateCeiling\)): A hardware slew limit caps how rapidly a requested command vector may change between successive cycles, preventing abrupt step inputs.
4. Bumpless blending duration (\(\BlendingTransitionWindow\)): A transition window enforces a \(\Glyph{C}^2\) continuous authority transfer ramp that preserves the kinodynamic feasibility bounds established in Kinodynamic Feasibility, requiring a qualified executable profile and a feasible state-matched fallback at every transition state if communication severs. The fallback depends on surviving sensing, controller, and energy premises; duration and continuity alone do not establish it.

14.8.2 Per-tick evidence tuples and the fault injection suite

A general telemetry tuple that records only a single machine-wide mode cannot show which channels were mid-blend, which fallback rung fired, or why a higher-tier source preempted a lower one. Every entry in the authority record’s per-tick log therefore expands the evidence tuple of section 14.7 with further fields. A field names the specific actuator channels governed by the arbitration decision. Another gives the ladder rung of any active FALLBACK. Others give the root cause of any preemption and the instantaneous blend factor \(\BumplessTransferBlend(\TimeInstant)\) of the enforcer-managed profile. The last is a cryptographic hash link to the preceding log block, authenticated through the platform’s protected anchoring scheme. The versioned static manifest supplies the decoding context, specifying physical units, field serialization order, clock synchronization mappings with their associated error bounds, credential validation rules, and hardware access control masks.

↪ Byte layout: The operator payload’s and the authority record’s fields, types, and offsets are given in Authority record and operator payload.

Verification draws its test inputs from the static manifest and its evidence from the event schema. The manifest’s authority_claims field hands Forward physical analysis and common-cause modes four authority rules by identifier, each of which becomes a hardware-in-the-loop fault case on the machine:

• A1. Exactly one qualified enforcer output path writes each actuator channel. Source arbitration and hardware access controls prevent a second sender from bypassing that path while the policy and remote assistant both propose commands; successful bus arbitration alone does not satisfy this claim.
• A2. No lower-tier source bypasses an active higher-tier source or the independent permission check. An autonomous policy proposal during MAN is ignored, and an assistant command that opposes the enforcer’s admitted barrier limit is clamped or rejected.
• A3. An unacknowledged handover or stalled manual lease decays authority by \(\HandoverTimeout\) of section 14.2.4, initiating controlled fallback by the earlier of the configured lease ceiling and the clearance-derived deadline of equation 4. This clearance deadline has a partial-budget upper bound of 751.6 ms at the 0.75 m/s slow-down before an in-loop takeover, and 100.8 ms for a handover requested by the policy at the 1.3 m/s aisle speed. Both values represent additional-delay allocations in the capture-origin budget. The runtime deadline evaluates the actual event history and future delay budgets without double-charging for elapsed capture-to-admission transit.
• A4. The enforcer rejects replayed veto_path, manual_drive, or accept_item packets, and packets with invalid authentication tags or expired sequence counters, without modifying still-valid channel authority. It logs each rejection in the evidence tuple while allowing the active lease to age normally.

These authority rules turn the event log into a checkable contract. The same synchronized hardware timestamps also mark which controller generated each segment of an intervention trajectory, and that separation must exist before any segment can serve as a training target for imitation learning.

14.8.3 Causal masking and recovery eligibility

If a training pipeline feeds an entire rescued episode into behavioral cloning without filtering, the policy learns to imitate the autonomous drift that caused the near-miss, the enforcer’s synthetic blend spline, and the operator’s initial startled oscillations. The curation rules of Intervention and Recovery Data prevent that contamination by deciding which logged samples may train a policy: drift commands are quarantined, drift states are relabeled only by an automated expert, and only stabilized, reviewed recovery is admitted. Each rule keys on a timestamp that the authority record supplies, so a logging system that records intervention episodes for downstream policy retraining must preserve controller ownership, target meaning, and declared sample eligibility. This chapter’s conservative direct-imitation policy applies causal intervention masking to that record. Its optimization objective over recorded trajectories is formulated as: \[\MaskedImitationLoss(\ModelParameters) = \mathbb{E}_{(\MechanicalPlantState, \ImitationTargetCommand, \CausalInterventionMask) \sim \MaskedImitationDataset} \left[ \sum_{k=0}^{\BehaviorCloningHorizon} \CausalInterventionMask(\ControlSampleIndex) \cdot \ell\left(\Policy(\MechanicalPlantState_k), \ImitationTargetCommand(\ControlSampleIndex)\right) \right] \tag{8}\] where \(\ell(\Policy(\MechanicalPlantState_k), \ImitationTargetCommand(\ControlSampleIndex))\) denotes the policy prediction loss (such as mean squared error across action chunks or score-matching denoising loss for diffusion policies), \(\CausalInterventionMask(\ControlSampleIndex) \in \{0, 1\}\) is a binary causal mask, and \(\ImitationTargetCommand(\ControlSampleIndex)\) is the supervised training target. Each sample’s mask and target are evaluated at that sample’s logged hardware timestamp. The target carries its own symbol because it is not the admitted command \(\CertifiedControlAction\) of the evidence tuple; in each interval it is chosen from the logged fields, or supplied by an expert, as the interval list below states. Constructing the training dataset \(\MaskedImitationDataset\) requires selective transformation rather than wholesale ingestion of raw telemetry. While every logged state preserves its chronological position in the trajectory, its supervision target \(\ImitationTargetCommand(\TimeInstant)\) and mask \(\CausalInterventionMask(\TimeInstant)\) depend on the physical regime of the recording interval. As a result, the command dispatched to the hardware is not necessarily the training target. Deterministic authority transitions stamped by the safety microcontroller establish controller ownership. Empirical stabilization criteria, task validity checks, and the availability of expert labels, in turn, determine which samples receive \(\CausalInterventionMask(\TimeInstant) = 1\).

One intervention, four intervals; only validated, stabilized recovery trains directly as a human demonstration.

A supervisory intervention does not occur as a single monolithic demonstration. Instead, it spans four distinct physical intervals along the execution timeline:

1. Compounding policy drift (\(\DivergenceInstant \le \TimeInstant < \CommitmentInstant\)): The autonomous policy \(\Policy\) drifts away from the expert state distribution, accumulating compounding errors while the human supervisor perceives the anomaly, orients, and decides to intervene (the pre-commit latency modeled in equation 1).
   • Masking policy: The autonomous proposals \(\NominalControlCommand(\TimeInstant)\) executed during this drift are quarantined from training targets. Without an external expert label, the system sets \(\CausalInterventionMask(\TimeInstant) = 0\).
   • Relabeling: The learner-visited states \(\MechanicalPlantState(\TimeInstant)\) remain in the log for the corrective aggregation of Intervention and Recovery Data, whose relabeling rule accepts only an automated expert’s labels. A drift state therefore enters training with \(\CausalInterventionMask(\TimeInstant) = 1\) and target \(\ImitationTargetCommand(\TimeInstant) = \pi^*(\MechanicalPlantState_t)\) only when such an expert, for example an omniscient trajectory planner with privileged simulation state, supplies the correction.
2. Atomic handover and enforcer blend (\(\CommitmentInstant \le \TimeInstant < \CommitmentInstant + \BlendingTransitionWindow\)): The safety microcontroller latches the channel endpoints and computes a \(\Glyph{C}^2\) continuous smoothstep trajectory between controllers.
   • Masking policy: The system sets \(\CausalInterventionMask(\TimeInstant) = 0\) unconditionally. Dispatched setpoints \(\ControlCommand(\TimeInstant)\) during this window are synthetic interpolation splines generated by the enforcer’s deterministic quintic polynomial profile. Because they reflect neither learned neural policy intent nor human cognitive demonstration, training on this interval would condition the network to emit open-loop kinematic ramps detached from environmental feedback.
3. Operator re-orientation and hunting (\(\CommitmentInstant + \BlendingTransitionWindow \le \TimeInstant < \OperatorStabilizationInstant\)): Upon receiving the active manual lease (\(\ManualLease\)), the operator experiences neuromuscular latency, visual parallax, and control re-orientation, producing high-jerk, oscillatory corrections while regaining situational awareness.
   • Masking policy: The system enforces \(\CausalInterventionMask(\TimeInstant) = 0\). Bainbridge documented this control hunting directly. An operator whose active manual skill has lapsed during passive monitoring makes abrupt step corrections, oscillating around the setpoint before settling into smooth tracking (Bainbridge 1983). Control stabilization often takes significantly longer than the physical handover itself. In driving simulator studies, operators resuming control from automated systems required approximately 35–40 s before their lateral steering stabilized (Merat et al. 2014), at least 7× the length of the machine’s 5 s pre-trigger window. Consequently, post-trigger masking cannot rely on a fixed time constant; logging systems must evaluate empirical stabilization criteria. Discarding these initial frames prevents hesitation and oscillatory hunting from corrupting the imitation buffer. This exclusion involves an engineering trade-off, because interval 3 also contains the operator’s initial corrective inputs, which certain human-gated methods retain (table 8). The enforcer marks the stabilization boundary \(\OperatorStabilizationInstant\) only after tracking error and command slew have remained within calibrated limits for a declared dwell interval. Later violations mask the affected samples again. The limits are: \[\lVert \TakeoverTrackingError(\TimeInstant) \rVert \le \StabilizationErrorThreshold \quad \text{and} \quad \lVert \HumanCommandRate(\TimeInstant) \rVert \le \StabilizationSlewCeiling.\] Here, \(\TakeoverTrackingError(\TimeInstant)\) is the difference between the admitted manual setpoint and the measured plant response, \(\HumanCommandRate(\TimeInstant)\) is the time derivative of the operator’s command, and the parameter \(\StabilizationSlewCeiling\) denotes a channel-specific slew ceiling, representing an acceleration derivative (jerk) only when the underlying command vector represents acceleration. Both thresholds must hold continuously across the dwell window before the logger lifts the mask.
4. Stabilized expert recovery (\(\TimeInstant \ge \OperatorStabilizationInstant\)): The operator executes coherent, task-directed recovery maneuvers once measured control metrics stabilize. Smooth motion alone does not validate a recovery; the episode must also satisfy formal task-completion criteria before its samples qualify as expert targets.
   • Masking policy: The system sets \(\CausalInterventionMask(\TimeInstant) = 1\) with imitation target \(\ImitationTargetCommand(\TimeInstant) = \HumanControlCommand(\TimeInstant)\) exclusively for stabilized segments that pass task-validity review. All other telemetry frames remain masked from direct imitation, so this interval is the only post-takeover segment the curation rules admit as expert recovery data.

Merat, Natasha, A. Hamish Jamson, Frank C. H. Lai, Michael Daly, and Oliver M. J. Carsten. 2014. “Transition to Manual: Driver Behaviour When Resuming Control from a Highly Automated Vehicle.” Transportation Research Part F: Traffic Psychology and Behaviour 27: 274–82. https://doi.org/10.1016/j.trf.2014.09.005.

Feeding unsegmented telemetry directly into behavioral cloning or diffusion policies injects synthetic enforcer ramps and operator control transients into the training distribution. The causal mask \(\CausalInterventionMask(\TimeInstant)\) and target vector \(\ImitationTargetCommand(\TimeInstant)\) use the commit and state timestamps recorded by the safety microcontroller to enforce controller ownership boundaries, bounded by hardware clock synchronization and sampling limits.

The binary causal mask represents the most conservative member of a broader algorithmic spectrum. Contemporary human-in-the-loop learning methods treat interventions in fundamentally different ways: as direct state labels, as importance weights over surrounding trajectories, or as negative reinforcement signals indicating policy failure. Table 8 maps five representative paradigms onto these four operational intervals. For instance, Human-Gated DAgger (HG-DAgger) grants the human supervisor full authority upon takeover and aggregates only the human’s executed commands, leaving interval 1 unmasked but unlabeled (Kelly et al. 2019). Sirius generalizes \(\CausalInterventionMask(\TimeInstant)\) by assigning categorical importance weights across sample classes; it assigns zero weight to a fixed pre-intervention window while upweighting human recovery trajectories (Liu et al. 2023). Specifically, Sirius sizes its pre-intervention window to 15 robot actions (approximately 2 s), derived from observed human reaction times. While Sirius fixes this window a priori, the authority record timestamps the commit and supports reconstruction of the drift interval once \(\DivergenceInstant\) is identified from the retained evidence, a duration that the out-of-loop takeover budget of section 14.2.2 shows can be 2.2× longer. Meanwhile, Reinforcement Learning from Intervention Feedback (RLIF) eliminates the assumption of human optimality altogether, treating the intervention event as a negative reward penalty within an off-policy reinforcement learning framework (Luo et al. 2024). Similarly, Human-in-the-Loop Sample-Efficient Robot Learning (HIL-SERL) incorporates human interventions as targeted correction buffers for real-world reinforcement learning (Luo et al. 2025). Finally, RECAP, which trains the \(\pi^{*}_{0.6}\) vision-language-action model, blends autonomous rollouts, teleoperated interventions, and demonstrations using advantage conditioning, explicitly labeling human takeover corrections as positive-advantage actions (Physical Intelligence et al. 2025).

Table 8: Human-in-the-loop learning methods as of 2026, placed on the four intervals: Every method needs the ownership boundary the authority record holds; they differ in what the intervention becomes and in which intervals they train on. None trains on the enforcer’s blend as a demonstration. Entries summarize each method’s published design (Kelly et al. 2019; Liu et al. 2023; Luo et al. 2024, 2025; Physical Intelligence et al. 2025); a later edition should refresh the list.

Physical Intelligence, Ali Amin, Raichelle Aniceto, Ashwin Balakrishna, Kevin Black, Ken Conley, Grace Connors, et al. 2025. “\(\pi^{*}_{0.6}\): A VLA That Learns from Experience.” arXiv Preprint arXiv:2511.14759.

Method (year)	What the intervention becomes	Interval 1 (policy drift)	Interval 3 (re-orientation)	Needs from the authority record
Causal mask (this chapter)	Boundary between owners	Excluded unless an automated expert labels it	Excluded until measured stabilization	Commit, blend end, stabilization times
HG-DAgger (2019)	Label: human commands while in control	Not labeled	Kept with the human’s commands	Owner per sample
Sirius (2023)	Weight per sample class	Fixed pre-intervention window, weight zero	Kept, upweighted	Commit time; window measured to it
RLIF (2024)	Reward: the takeover itself is a penalty	Kept; the takeover penalizes it	Human samples added to the data	Commit time as the reward event
HIL-SERL (2025)	Correction data for a reinforcement learner	Kept as the learner’s own experience	Kept as correction data	Owner per sample
RECAP, \(\pi^{*}_{0.6}\) (2025)	Correction marked as a positive-advantage action	Kept; a value function scores it	Kept, marked positive	Owner per sample; episode outcome

Individual learning algorithms change, but every one of them must answer the same three systems questions: who held write authority over each sample, whether the takeover serves as a supervised label, an importance weight, or a reward penalty, and which physical intervals enter the training set. Downstream training pipelines cannot recover those ownership boundaries from trajectory kinematics alone. Recording the commit, blend-end, and stabilization timestamps on the safety microcontroller’s clock grounds dataset curation and fleet-level intervention rates directly in hardware measurements.

When an engineering team assembles the safety case for release (Matching the argument to the machine), the authority record also supplies the primary evidence that runtime handovers obey rules A1 through A4 (claim C6 in Claim-argument-evidence review for the warehouse mobile manipulator). That release dossier pairs the static authority manifest with the loaded stopping and blending measurements from section 14.4 and hardware-in-the-loop traces that verify an unbroken audit chain. Because a handover that looks clean on the communication bus can still slip a wheel on a wet floor or jolt a loaded tote rack, the dossier always checks bus timestamps against independent plant sensors. It treats measured preemption times as empirical percentiles rather than analytical worst-case bounds.

↩︎ The distinction between an empirical latency percentile and a response-time bound is established in Real-Time Command Transport and Bus Determinism.

Checkpoint 14.3: Authority evidence and causal masks

The authority record is useful twice, once to an investigator and once to a learner, and both uses depend on the same ownership timestamps.

• Evidence tuple: Can you name the incident question that becomes unanswerable when the log drops \(\NominalControlCommand\), when it drops \(\CertifiedControlAction\), and when it drops \(\RemainingExecutionLease\)?
• Interval masks: For one takeover, can you assign \(\CausalInterventionMask(\TimeInstant)\) and \(\ImitationTargetCommand(\TimeInstant)\) to each of the four intervals and name the logged event that bounds each?
• Sample count estimate: An out-of-loop takeover commits 4.5 s after the divergence, and the arm then blends for 38 ms. At the 1 ms permission tick, can you estimate how many logged ticks fall in intervals 1 and 2, and how many of them may train an imitation policy when no automated expert is available?
• Fixed windows: Can you explain what a fixed 2 s pre-intervention window misclassifies for a takeover that took the design out-of-loop time?

14.9 Fallacies and Pitfalls

Flipping a bit in an authority register does not complete a safe supervisory handover. A real-time physical AI system must preserve its dynamic stopping margin and protective enforcement functions throughout every stage of transfer. Furthermore, downstream imitation learning pipelines cannot treat intervention logs as unblemished expert recoveries without explicit causal filtering. When systems fail in deployment, the breakdown almost always traces back to one of four subtle architectural traps.

One 500 ms window overruns at aisle speed and idles at a crawl.

Pitfall: Treating human takeover timeout as a static time delay rather than a dynamic spatial stopping budget.

Consider a mobile manipulator that initiates a takeover request at its operational 1.3 m/s aisle speed under a statically configured 500 ms acknowledgment window. If the controller waits out that full window before commanding brakes, the vehicle covers 0.65 m of unbraked travel. When combined with the jerk-limited resident stop profile and actuator execution overheads, the total stopping distance ends 0.52 m beyond the 1.10 m rack-end clearance, causing a physical collision. Conversely, at an out-of-loop crawl speed of 0.15 m/s, that same window consumes negligible distance, leaving 5.8 s of margin before fallback braking must begin. The wait costs travel in proportion to speed, and the stop that follows grows with its square, so a timeout that leaves ample response time at a crawl overruns the clear distance at aisle speed. Real-time supervisory handovers cannot treat human response intervals as fixed wall-clock durations. The permissible wait time must be computed dynamically from instantaneous velocity, remaining obstacle clearance, and validated brake deceleration envelopes. Autonomous fallback must begin the moment the remaining clearance matches the required stopping profile.

A supervisory timeout is not a static timer; it is a dynamically bounded spatial margin that must fit the instantaneous stopping budget.

Architect’s countermeasure: On every control cycle, evaluate the instantaneous obstacle clearance against a complete stopping budget composed solely of future sensing delays, brake actuation lag, and jerk-limited deceleration. Dynamically recompute a candidate absolute deadline, anchored to a consistent time origin, from equation 4, which gives the longest wait whose delay travel and stop suffix still fit inside the remaining clearance. If a newly calculated deadline is earlier than the currently active deadline, tighten the expiration threshold immediately; never extend or restart an active countdown based on optimistic recalculations. Account for sensor pipeline latency consistently, and do not subtract historical capture-to-enforcement delay from clearance measurements that have already physically reflected that travel. If supervisory acknowledgment does not arrive before the deadline expires, immediately trigger the validated autonomous fallback brake sequence.

Fallacy: Human manual takeover should bypass automated safety barriers and grant unconstrained, open-ended actuator authority.

When a remote operator takes manual control of a mobile manipulator to steer it around an unexpected obstacle, the chosen steering commands might vector the chassis directly toward a warehouse rack upright. Granting manual control alters only the origin of proposed motion setpoints; it cannot alter chassis momentum, tire-floor friction coefficients, or environmental obstacle boundaries. The low-level safety enforcer must therefore evaluate human manual proposals against the formal admissible motion set on every cycle. If the operator commands a trajectory that risks collision or dynamic instability, the enforcer projects the command onto the nearest safe, kinodynamically feasible trajectory. If no safe trajectory exists within the admissible envelope, the enforcer rejects the proposal entirely and triggers an immediate autonomous fallback. Manual intervention grants the operator authority to guide high-level intent, but mechanical stresses, obstacle clearance, and brake margins remain hard physical constraints enforced at the joint actuator boundary.

Furthermore, manual intervention must operate under strictly bounded, perishable leases rather than open-ended authority grants. Transient wireless packet loss or operator distraction can easily leave stale velocity vectors active in flight. To prevent uncommanded runaway motion, every intervention session requires a cryptographically renewed manual lease calibrated to the active operational mode’s stopping reserve. In this warehouse aisle scenario, the system enforces a 100 ms manual lease. If periodic, authenticated heartbeat renewals fail to arrive before the lease expires, the safety microcontroller immediately revokes proposal authority and executes an autonomous fallback stop independently of host software or operator intervention.

Manual intervention transfers the authority to propose setpoints, but never the authority to bypass physical barrier certificates or operate on stale communication.

Architect’s countermeasure: Channel all teleoperation and manual override inputs through the enforcer’s control barrier certificates and kinodynamic clamping filters. When an operator command exceeds dynamic rollover thresholds, threatens structural shear limits, or breaches clearance buffers, the enforcer automatically clamps the actuation setpoint to the boundary of the safe set or initiates an emergency stop. Subordinate all manual authority to a hardware-timed watchdog lease sized to the active mode’s stopping reserve, guaranteeing that lease expiration automatically executes a deterministic brake or hold sequence without software intervention.

Pitfall: Relying on cryptographic authentication without rate limiting the traffic that reaches the verifier.

Cryptographic authentication guarantees message authenticity and integrity, but it introduces an asymmetric computation cost that an adversary or a misbehaving transceiver can exploit to starve real-time processing. Suppose an admission controller validates incoming signed remote takeover requests (section 14.5) using an embedded microcontroller that requires 1.8 ms to verify each Ed25519 digital signature. Malformed inputs may be rejected cheaply, but well-formed invalid signatures can still reach the expensive verification path. The following queue model charges every such request the stated verification time.

If a malfunctioning or compromised device on the network link floods the interface with bogus signed manual_drive packets, as few as 55 forged requests queued ahead of a critical veto_path message from a remote supervisor will delay its verification to 100.80 ms. At aisle speed, this delay exceeds the fallback deadline \(\FallbackDeadline\) of 100.78 ms. When charging the allocated downstream admission delay \(\DispatchAdmissionInterval\), the usable admission margin shrinks to 37.5 ms, meaning just 20 forged packets suffice to cause a deadline violation. Sustaining this denial-of-service attack requires an injection rate of only 546 packets per second, a trivial load for even a low-bandwidth industrial wireless channel.

Substituting symmetric MACs shifts the computational bottleneck to the network transceiver without eliminating the underlying vulnerability. Validating a MAC requires far fewer cycles, so roughly 20,306 forged frames within the same window are needed to induce a miss, yet the queue remains susceptible to line-rate saturating traffic. The robot’s independently wired protective stops and hardware lease timers must never share queues with network ingress. Those local safety channels must remain fully operational even when the cryptographic verifier is saturated. To protect real-time responsiveness, the ingestion pipeline must deploy hardware mailbox filters and per-source rate limiters ahead of the verification queue, and safety qualification tests must evaluate worst-case intervention latency under full adversarial packet inundation.

Cryptographic authentication protects command integrity but introduces an asymmetric availability risk, because an admission verifier spends finite compute cycles rejecting forged traffic before it can service critical safety messages.

Architect’s countermeasure: Deploy hardware mailbox filtering and per-source token-bucket rate limiters¹³ on the fieldbus interface ahead of the software verification queue. In addition, route emergency protective stops and fail-safe interlocks through dedicated, hardwired electrical circuits that bypass digital networking and cryptographic parsing entirely.

¹³ Token Bucket: A limiter holds up to \(\TokenBucketDepth\) tokens, refills at rate \(\TokenBucketRefillRate\), and admits a packet only by spending a token, so a source may burst \(\TokenBucketDepth\) packets but never sustain more than \(\TokenBucketRefillRate\). Placed before the verifier, it bounds the forged signatures that can arrive within \(\FallbackDeadline\) at \(\TokenBucketDepth + \TokenBucketRefillRate\,\FallbackDeadline\). For the single-source queue modeled here, keeping that bound below the 55 forgeries that push a genuine veto past its deadline, or 20 once \(\DispatchAdmissionInterval\) is charged, sizes \(\TokenBucketDepth\) and \(\TokenBucketRefillRate\) from the stopping budget rather than from link capacity. A deployed ingress must also bound aggregate traffic across sources, include already queued work and legitimate traffic, and prevent forged source identifiers from bypassing those limits.

Fallacy: Training directly on raw human intervention logs captures expert demonstrations.

Training on raw intervention logs commits the learner-action contamination of Intervention and Recovery Data. The raw telemetry of a rescued episode is not a continuous expert demonstration. It stitches the policy’s diverging trajectory to the operator’s reaction latency, the corrective jerks as the operator regains situational awareness, and the overshoots before stabilization, and a policy cloned from it reproduces the oscillations that made the takeover necessary.

The methods in table 8 require attribution of who generated each state-action pair and a declared interpretation of the sample as a target, a weight, or a reward. Neither a coarse session-level takeover timestamp nor an active manual authority bit guarantees that recorded telemetry is fit for policy training. This chapter’s conservative direct-imitation policy segments intervention trajectories into distinct causal regimes and masks transitional dynamics; the alternative objectives in table 8 retain some early corrections.

Unsegmented intervention telemetry records human cognitive lag and abrupt corrective overshoots; naively cloning these trajectories trains policies to reproduce the instability that triggered the takeover.

Architect’s countermeasure: For this chapter’s conservative direct-imitation corpus, apply causal intervention masking (equation 8), taking the interval boundaries from the commit, blend-end, and stabilization timestamps on the safety microcontroller’s monotonic hardware clock. Only Interval 4, validated post-stabilization guidance, trains as a human demonstration (\(\CausalInterventionMask(\TimeInstant)=1\)); Interval 1 drift states train only under an automated expert’s labels, and everything else stays in the record for forensics.

14.10 Summary

Supervisory intervention transfers the right to propose, never the right to admit. A capability matrix grants each authenticated role named operations on named actuator channels, each with a preemption tier and a clearance-derived deadline, while the enforcer checks every command from every source against the same physical envelope. Enforcement changes a proposal and leaves the proposer in place; intervention changes the proposer and leaves the check in place, and the machine needs both.

A takeover is a delay inserted before braking on a moving machine, so it is priced in the stopping budget rather than in the user interface. At the 1.3 m/s aisle speed the subtotal before dispatch-to-admission travel leaves 131.0 mm, a waiting window of 100.8 ms, and only 37.5 ms once the 63.3 ms dispatch-to-admission allocation of The board-link budget and the dispatch-to-admission interval is charged. Sourced human responses of 605 ms in the loop and 4.5 s out of it cap the request speed at 0.797 m/s and 0.189 m/s once it is charged. No brake, however strong, admits the aisle speed, because the waiting term rather than the braking term spends the clearance. The design therefore slows to 0.75 m/s before an anticipated in-loop request, crawls at 0.15 m/s or stops first before an out-of-loop one, and answers a newly discovered hazard with its own local stop. None of these speeds qualifies until loaded measurements confirm the allocation and the braking premises.

Authority is bounded and moved by mechanisms that never wait on the network. Execution leases on the safety microcontroller’s clock, the autonomous chunk lease and the 100 ms manual lease, revoke a silent proposer and select the fallback that matches the machine’s state. A four-phase handshake commits ownership on one control tick for an explicit channel mask, the enforcer remains the only writer to the actuators, and every timer that expires leads to a defined state. Authentication keeps forged commands out of admission, but only a rate limiter ahead of the verifier keeps forged traffic from delaying a genuine veto, and hardwired protective inputs bypass both.

Changing the proposer does not change the physics of the command. A fixed-endpoint \(\Glyph{C}^2\) smoothstep bounds the command rate between latched endpoints, but it spends clearance. The base window is 528 ms at every speed because the jerk bound belongs to the loaded base, and at the 0.75 m/s request speed no braking blend fits the clearance that remains. Within the stated one-dimensional stopping model and boundary conditions, no smoothed braking under the same bounds beats the resident profile, so the base receives the resident stop while the arm blends over 38 ms.

The authority record turns every handover into evidence. It binds the sealed static manifest to per-tick evidence tuples that record who held each channel and what was proposed, admitted, and dispatched alongside independent measurements of the response, chains them against tampering, and declares every gap. It draws its fallback rungs from the enforcement record and its declared timing bounds from the placement record, whose loaded measurements are still to come. The same ownership timestamps serve two readers. An investigator can reconstruct an incident from them, provided independent current, encoder, and contact measurements confirm what the commands did, and a learner can apply this chapter’s conservative four-interval direct-imitation mask, under which only validated, stabilized human recovery supplies post-takeover demonstration targets. Other learning objectives use the same provenance with different eligibility rules (table 8). Table 9 summarizes the governing quantitative relations for supervisory intervention, detailing the specific operational or physical quantity bounded by each equation.

Table 9: Key equations of supervisory intervention: Each equation fixes one quantity a takeover design must declare. The kinematic relations assume the jerk-limited resident stop and a constant speed while the machine waits; the ceiling’s closed form holds only above \(\CredibleBrakingDeceleration^2/\JerkLimit\). The delays inside them must be measured on the site’s operators, console, and link.

Equation	What it bounds or decides	Derived in
\(\SupervisoryTakeoverLatency = \OperatorSensoryTime + \OperatorCognitiveTime + \OperatorMotorTime + \ConsoleCommunicationTime\)	The takeover delay a person and a console add before any command changes	equation 1
\(\SpeedAtDetection(\ExternalWait + \PrebrakeDelay) + \ResidentStopDistance(\SpeedAtDetection) + \FixedClearanceAllowance \le \ClearDistance\)	Whether the machine can still stop after waiting \(\ExternalWait\) at speed \(\SpeedAtDetection\)	equation 2
\(\FallbackDeadline = (\ClearDistance - \FixedClearanceAllowance - \ResidentStopDistance(\SpeedAtDetection))/\SpeedAtDetection - \PrebrakeDelay\)	The latest fallback dispatch after a handover request; a fixed timeout is clipped to it	equation 4
\(\SpeedBound = \CredibleBrakingDeceleration\bigl[\sqrt{\FullSpeedTravelTime^2 + 2(\ClearDistance-\FixedClearanceAllowance)/\CredibleBrakingDeceleration} - \FullSpeedTravelTime\bigr]\)	The highest speed at which a takeover with delay \(\SupervisoryTakeoverLatency\) may be requested	equation 3
\(\TimeInstant - \LeaseRefreshInstant < \ChunkLease\) or \(\ManualLease\)	Whether a proposer still holds authority; expiry invokes the validated local response	equation 5
\(\BumplessTransferBlend(\BumplessTransferProgress) = 10\BumplessTransferProgress^3 - 15\BumplessTransferProgress^4 + 6\BumplessTransferProgress^5\) with \(\BlendingTransitionWindow \ge 1.875\,\lVert \FiniteChange \ControlCommand \rVert/\JerkLimit\)	The minimum window within the fixed-endpoint quintic family under the stated rate ceiling	equation 6 and equation 7
\(\LossFunction = \mathbb{E}\bigl[\sum_k \CausalInterventionMask(\ControlSampleIndex)\,\ell(\Policy(\MechanicalPlantState_k), \ImitationTargetCommand(\ControlSampleIndex))\bigr]\)	Which logged samples train the next policy, and with which target	equation 8

Key Takeaways: Supervisory intervention and authority bounds

• State-dependent fallback and monotonic leases: Bind each proposer to an explicit, mode-specific lease and stopping reserve. Lease expiry invokes the validated local fallback response appropriate for the current physical state, along with the sensing, drive energy, braking, and holding premises required to execute it safely. For manual teleoperation, the reference design chooses a 100 ms lease, bounded from below by heartbeat loss and jitter and from above by the clearance its extra travel over the chunk lease consumes after the takeover.
• Clearance governs waiting: A takeover delay is travel before braking, so its allowance comes from the stopping budget, not from a configured timer. The subtotal before dispatch-to-admission travel allows 100.8 ms of waiting at the aisle speed, 37.5 ms once the 63.3 ms admission allocation is charged, and 751.6 ms at the 0.75 m/s slow-down, which still leaves 83.3 ms after an in-loop takeover and the charge. Price human responses at design percentiles, not averages. On the complete budget, the 605 ms in-loop design response caps the request speed at 0.797 m/s and the 4.5 s out-of-loop response caps it at 0.189 m/s. Dispatch the fallback at the earliest of the protocol, lease, evidence, and clearance deadlines, and stop before handing an unexpected hazard to an out-of-loop operator.
• Single-writer actuator ownership: Explicit source arbitration and exclusive enforcer command ownership eliminate conflicting actuator writes; low-level bus arbitration alone cannot establish safety authority. Every request, commit, and confirmation message must explicitly declare its channel mask. A partial transfer, such as reassigning arm control while the base keeps navigating autonomously, is admissible only while the console annunciates the untransferred channel’s owner; otherwise that channel holds. A four-phase protocol (Request, Acknowledge, Commit, Confirm) transitions authority deterministically. The commit transition revokes the autonomous policy token on the designated channels and latches its last admitted command. No proposer holds the proposal token during BLEND, while the enforcer owns the command; the arbiter grants the token to the operator only after the profile completes, and the enforcer then checks human proposals against the same physical envelopes as the policy’s.
• Smooth command blending and haptic passivity: A fixed-endpoint \(\Glyph{C}^2\) acceleration profile bounds peak jerk during authority transitions, and its additional stopping displacement must be reserved in the braking envelope. If the system incorporates bilateral force reflection, the console feedback loop requires its own passivity and stability argument evaluated under realistic network latency, packet loss, and actuator dynamics.
• Independent stopping paths: Dedicated, hardwired protective circuits execute risk-assessed mechanical and electrical stops independent of software. Network-delivered commands undergo cryptographic admission checks: corrupted or unauthenticated packets are dropped at ingress, whereas a failure to refresh a valid lease triggers an autonomous local fallback.
• Causal data attribution: Training on intervention logs requires preserving controller provenance and declaring target and eligibility rules. This chapter’s conservative direct-imitation mask \(\CausalInterventionMask(\TimeInstant)\) (equation 8) preserves learner-visited drift states for failure analysis and automated relabeling, zeros out synthetic enforcer blending splines (\(\BlendingTransitionWindow\)) and initial operator hunting, and admits only validated, stabilized human recovery as post-takeover demonstration targets. Other objectives may retain or weight early corrections differently (table 8).
• Authority as auditable evidence: The authority record logs per-tick evidence tuples \(\langle \MicrocontrollerClockTime, \RecordedAuthorityState, \MechanicalPlantState, \NominalControlCommand, \CertifiedControlAction, \JointTorque, \text{ID}_{\text{operator}}, \RemainingExecutionLease\rangle\) into tamper-evident cryptographic hash chains, treating a missing entry as an explicit fault rather than an implied pass. The manifest’s four authority rules serve as primary test targets for verification fault injection; their passing logs, anchored by the authority record, are the evidence the release argument needs before it may admit remote takeover.

A person’s authority over an embodied physical AI system is granted on verifiable evidence and expires when that evidence lapses, as the fourth law, permission must be earned (principle 4), requires of every privilege the machine honors. Fresh credentials, checked plant state, a feasible target and fallback reserve, and a successfully committed handshake support the grant of authority; the manual lease bounds how long the grant remains valid while its physical premises continue to hold. When operator inputs cease renewing the lease, authority immediately lapses to a verified local fallback governed by the hardware permission path. Preemption tiers do not persist across a lease expiration: a remote assistant who previously commanded the mobile base retains no residual authority once the lease expires. Re-establishing control under any proposer requires satisfying the reset conditions of the authority state machine and presenting fresh, validated credentials.

14.11 Historical Perspective and Further Reading

Supervisory control emerged as an engineering discipline when teleoperated systems outgrew direct manual control. In deep-sea exploration and hazardous environment manipulation, transmission latency and high operator workloads made continuous teleoperation fragile. Sheridan and Verplank (1978) formalized the division of labor between human operators and machine intelligence, grading autonomy into explicit levels that range from complete manual execution to autonomous computer execution that ignores human input. Sheridan (1992) consolidated these insights into a unified systems theory of human supervisory control, modeling how human operators alternate between planning, programming, monitoring, intervening, and learning from automated subroutines. Expanding on this taxonomy, Parasuraman et al. (2000) decoupled automation across four functional dimensions: sensory information acquisition, information analysis, decision selection, and action execution, assigning distinct operational levels to each stage. Meanwhile, industrial process automation approached supervisory handovers from a control-theoretic perspective. Switching a closed-loop plant between manual operation and automatic tracking without inducing mechanical shock or actuator saturation requires the idle controller to track the active plant state continuously. This bumpless transfer technique, detailed as standard practice by Åström and Hägglund (2006), provides the classical foundation that this chapter’s enforcer generalizes: smoothly blending between verified endpoint states while strictly respecting physical actuator limits.

Åström, Karl Johan, and Tore Hägglund. 2006. Advanced PID Control. ISA-The Instrumentation, Systems,; Automation Society.

Brooks, Rodney. 1986. “A Robust Layered Control System for a Mobile Robot.” IEEE Journal on Robotics and Automation 2 (1): 14–23.

Human factors engineering revealed why relying on a passive human operator as an emergency fallback is fundamentally flawed. In a landmark critique, Bainbridge (1983) articulated the central irony of automation: automating routine operations leaves the human supervisor responsible solely for rare, anomalous edge cases, precisely when sustained inactivity has degraded both situational awareness and manual control proficiency. Sarter and Woods (1995) examined cockpit automation to trace the root causes of mode confusion, demonstrating how silent automation state changes lead pilots to issue inputs that are entirely correct for their assumed operational mode but hazardous for the aircraft’s actual mode. Endsley (1995) formalized the cognitive basis of operator intervention, decomposing situation awareness into three hierarchical tiers: perceiving sensory cues, comprehending the operational state, and projecting system trajectories into the near future. Physical latency imposes strict mathematical limits on these interactions. Ferrell (1965) demonstrated that when loop delays exceed a fraction of a second, human operators inevitably degrade into a disjointed “move-and-wait” strategy to avoid destabilizing the physical plant. In bilateral teleoperation with force reflection, delayed feedback injects non-physical energy into the loop and can destabilize it. Anderson and Spong (1989) addressed this instability through a passive communication-channel construction within a specified bilateral control architecture. Closed-loop stability also depends on the channel terminations and the coupled controllers and plant. Niemeyer and Slotine (1991) reformulated the communication-channel passivity condition using wave variables. Variable delay, packet loss, sampling, and saturation require the additional analysis identified in Passivity and Energy-Bounded Interaction. At the architectural level, arbitrating between competing subsystem commands using rigid priorities directly descends from the layered suppression and inhibition mechanisms pioneered by Brooks (1986) in the subsumption architecture.

Machine learning turned supervisory intervention into a source of training data. Ross et al. (2011) proved that naive behavioral cloning fails under distributional drift because the autonomous policy inevitably encounters states absent from the expert demonstrations; robust training requires querying the expert along the learner’s own induced state distribution via the DAgger algorithm. To reduce human fatigue, Kelly et al. (2019) introduced Human-Gated DAgger, delegating continuous control to the autonomous policy and recording demonstrations only when the human supervisor actively intervenes. Modern embodied systems generalize these intervention boundaries into core training signals. Sirius (Liu et al. 2023) uses intervention transitions as prioritized sample weights in offline policy optimization. Luo et al. (2024) converts supervisory takeovers into reinforcement learning reward penalties. Luo et al. (2025) uses intervention corrections to drive real-world robotic reinforcement learning safely on physical hardware. Every data-driven approach relies on unambiguous execution provenance: the system must record exactly which agent (human supervisor, machine policy, or safety enforcer) held authority over every actuator command. Tamper-evident logging draws on a deep cryptographic lineage, from the cryptographically linked timestamps of Haber and Stornetta (1991) to the hierarchical authentication structures of Merkle (1988). This chapter integrates these disparate systems threads into a single runtime abstraction: a per-tick authority record that aligns the handover sequence with the physical stopping budget and retains ownership boundaries for downstream policy learning. The arbiter and enforcer establish exclusive channel ownership; per-channel announcements support mode awareness, and the record supports evaluating both under its timing and capture assumptions.

Kelly, Michael, Chelsea Sidrane, Katherine Driggs-Campbell, and Mykel J. Kochenderfer. 2019. “HG-DAgger: Interactive Imitation Learning with Human Experts.” IEEE International Conference on Robotics and Automation (ICRA), 8077–83. https://doi.org/10.1109/ICRA.2019.8793698.

Liu, Huihan, Soroush Nasiriany, Lance Zhang, Zhiyao Bao, and Yuke Zhu. 2023. “Robot Learning on the Job: Human-in-the-Loop Autonomy and Learning During Deployment.” Robotics: Science and Systems (RSS). https://doi.org/10.15607/RSS.2023.XIX.005.

Luo, Jianlan, Perry Dong, Yuexiang Zhai, Yi Ma, and Sergey Levine. 2024. “RLIF: Interactive Imitation Learning as Reinforcement Learning.” International Conference on Learning Representations (ICLR).

Luo, Jianlan, Charles Xu, Jeffrey Wu, and Sergey Levine. 2025. “Precise and Dexterous Robotic Manipulation via Human-in-the-Loop Reinforcement Learning.” Science Robotics 10 (105): eads5033. https://doi.org/10.1126/scirobotics.ads5033.

Merkle, Ralph C. 1988. “A Digital Signature Based on a Conventional Encryption Function.” Advances in Cryptology — CRYPTO ’87, Lecture notes in computer science, vol. 293: 369–78. https://doi.org/10.1007/3-540-48184-2_32.

Six works trace this lineage from the ironies of automation to learning from interventions:

• Bainbridge (1983) articulates why automating routine operations deprives human operators of the running mental model and manual dexterity required to handle anomalous edge cases, establishing the engineering motivation for executing a safe dynamic stop before requesting intervention.
• Sheridan (1992) provides the definitive monograph uniting supervisory control, teleoperation architectures, and the dynamics of delayed human-in-the-loop systems.
• Sarter and Woods (1995) identifies the cognitive mechanics of mode awareness breakdowns in complex cockpits, illustrating the failure modes that per-channel masks and state announcements mitigate in section 14.6.
• Parasuraman et al. (2000) establishes the multi-dimensional taxonomy of automation across acquisition, analysis, decision, and action, providing the conceptual architecture behind channel-by-channel capability matrices.
• Anderson and Spong (1989) develops a passive communication-channel construction for delayed bilateral teleoperation, forming the analytical basis for section 14.4.5. Its closed-loop stability argument depends on the specified channel terminations and control architecture.
• Ross et al. (2011) introduces the DAgger algorithm and demonstrates that imitation learners must be trained against corrections collected on their own visited state distributions, explaining why the authority record must capture policy drift intervals and takeover boundaries.

Bainbridge, Lisanne. 1983. “Ironies of Automation.” Automatica 19 (6): 775–79. https://doi.org/10.1016/0005-1098(83)90046-8.

Sheridan, Thomas B. 1992. Telerobotics, Automation, and Human Supervisory Control. MIT Press.

Sarter, Nadine B., and David D. Woods. 1995. “How in the World Did We Ever Get into That Mode? Mode Error and Awareness in Supervisory Control.” Human Factors 37 (1): 5–19. https://doi.org/10.1518/001872095779049516.

Parasuraman, Raja, Thomas B. Sheridan, and Christopher D. Wickens. 2000. “A Model for Types and Levels of Human Interaction with Automation.” IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans 30 (3): 286–97. https://doi.org/10.1109/3468.844354.

Ross, Stéphane, Geoffrey Gordon, and J. Andrew Bagnell. 2011. “A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning.” Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (AISTATS) 15: 627–35.

What’s Next: From authority revocation to verification

Operational logs alone cannot establish that the arbiter enforces its rules under adverse conditions. Weeks of clean handovers in the authority record rarely contain a duplicate writer, a replayed packet, or a dropped heartbeat, and a record cannot testify about a fault that never occurred. The same gap runs through every record this book has developed, because the chunk lease, the permission path, and the held-up permission rail all describe protective responses that normal operation never exercises. Adversarial Verification creates those faults on purpose. It pairs four physical faults injected as the loaded base approaches the rack end, beginning with a stalled proposer, with the four authority rules A1 through A4 that this chapter’s manifest hands over. It scores each trial against an oracle fixed before the test, measured by instruments the fault cannot reach rather than by the arbiter’s own account of what it did.