Engineering Physical AI

18 Engineering Physical AI

Purpose

Physical AI stack focus for this chapter.

Why does a better model not, by itself, make a better machine?

The learned model is the part of a physical machine that is easiest to improve and easiest to score, so it attracts most of the effort. Useful service depends on everything around it as well. The body must sustain the task across loads, surfaces, and hours of duty, the learned behavior must hold in the states its own actions create, each proposal must be admitted, corrected, or refused before the motion it asks for is already under way, and the evidence for all of it must match the conditions of operation and stay true as the machine and its site change. Each of these can be engineered well in isolation while the machine as a whole remains unjustified, because doubt accumulates across every premise a physical claim depends on, and a premise that no one names or owns is assumed silently. A team that cannot join these parts into one argument keeps improving the model while an unmeasured floor, an unqualified detector, or an unowned restriction decides what the machine actually does. The same joined argument also chooses what to build next, since the most valuable measurement, experience, or design change is the one that retires the weakest open premise. At the causal boundary, irreversibility makes that weakest premise, not the best prediction, the measure of what a machine may be trusted to do.

Learning Objectives

Explain why a better prediction can still produce a worse physical action, and synthesize the four laws into the design argument that answers it
Distinguish an unobserved premise from a monitored unknown, and explain why only a standing restriction can contain an unobserved premise
Apply the four laws to select and evaluate a candidate operating mode for an unfamiliar machine
Construct residual-claims entries with supported restrictions, accountable owners, and predeclared closure tests
Evaluate the throughput cost of an operating restriction against the cost of the closure campaign that would retire it
Select the next measurement, learning experiment, or design change needed to extend a machine’s capability

18.1 From a Better Prediction to Useful Service

The release review of Deployment Release ended with a verdict, and Responsible Physical AI named who answers for each decision behind it. On this book’s own records the warehouse mobile manipulator is refused, and even the stipulated evidence branch earns it only conditional service, held in place by premises that no sensor on the machine reports, such as the friction of the aisle floor. Improving its learned models alone would not change that verdict while the supporting physical and timing premises remain unqualified. The verdict is therefore the engineering form of the answer to the question The Causal Boundary opened with: why a better prediction can still produce a worse physical action, and what the rest of the machine must supply so that a model’s proposals become useful work within justified limits. The book’s parts join into that answer on the warehouse machine, and the same method then transfers to an unfamiliar machine, the packaging cell of section 18.2. The premises no sensor can check each need an owner, a restriction, and a closure test in a residual-claims register (section 18.3), and those open premises in turn select the next capability to build (section 18.4).

The question began with a contrast. Traditional machine learning evaluated advisory predictions against static datasets, and agentic machine learning could run iterative reasoning loops inside controlled digital sandboxes, behind glass, with elastic time, transactional rollback, and symbolic interfaces. Those privileges depended on the sandbox; external calls could already produce irreversible effects. Physical AI stepped through that glass into the continuous world, where computation commands actuators across the causal boundary. That step exposed computation to continuous time, in which delay becomes distance traveled, and to mechanical and thermodynamic irreversibility, which forbids undo. The illustrated feedback workload also required one action at a time under a real-time deadline, a batch size of one (\(\BatchSize=1\)); this scheduling constraint does not prohibit coordinated axes or batching elsewhere in the system. These constraints forced an architectural response, the separation of speculative proposals from deterministic permission, which is a design choice rather than a fact of physics.

One reference platform carried the argument: a warehouse mobile manipulator that picks an object from a moving conveyor, opens a spring-latched cage door, and carries the payload down an aisle shared with people. That mission exercised every capability the book develops (sizing the physical and computational dynamics, teaching learned policies, integrating a real-time runtime, evaluating closed-loop behavior, and maintaining the operating envelope as the machine and its site degrade), and each design choice constrained the next.

The question can now be answered precisely. Predictive accuracy alone does not establish the operating premises on which physical success depends. The distance a mobile base travels while a neural network runs its forward pass, the friction available at the tire-floor interface during hard braking, the states into which the robot’s own prior actions drive it, and the gaps between demonstration datasets and live site conditions all decide what an actuator command does once it crosses the causal boundary. Improving a model’s statistical accuracy can refine the proposed trajectory, and shortening inference can recover timing margin, but neither result by itself qualifies traction, closed-loop competence, or the complete stopping budget.

The second half of the question, what the surrounding machine must supply, resolves into the four-step argument of The Question This Book Answers, pairing one engineering discipline with each of the four laws. Under the first law (irreversibility), the body’s mechanical and thermal limits bound what any proposal may request. Part I translated payload capacity, surface traction, contact forces, motor heating, and energy reserves into strict operating budgets that govern proposal horizons, execution cadence, and deterministic fallback paths. Under the second law (endogenous data), policy competence holds only over the states induced by closed-loop interaction. Part II tied proposer evaluation directly to the states the physical machine actually visits, turning recovery failures into targeted data-collection runs rather than unhandled anomalies. Under the third law (proposal is not permission), execution authority resides in an independent permission path rather than the learned model. Part III joined observation freshness contracts, grounded geometric targets, timed trajectories, and real-time admission filters onto a compute layout built to meet hard deadlines under load. Under the fourth law (permission must be earned), deployment scope extends only as far as qualified system-wide evidence supports it. Part IV structured physical operation as a governed service contract that separates proposer autonomy, whole-system task success, and protective intervention. A least-change speed filter, for example, can preserve an in-flight delivery even when a raw proposal requires intervention, whereas an emergency stop protects physical hardware without fulfilling the promised service.

The release verdict is where the four laws meet. In the baseline audit of Adjudicating the Safety Case, the book’s illustrative records yield REFUSE, because tail risks and fault margins remain unverified. The stipulated branch of Worked restricted service with stipulated evidence shows which evidence would raise that verdict to conditional authorization (COND): under those stipulated performance and fault records, the machine may run inspected-route transport, guarded door approaches, and close-proximity handovers, provided that standing conditions on floor traction, pedestrian crossings, feeder alignment, and sensor calibration stay verified. Each condition traces back through the record chain to a measured limit, an evaluated behavior, or a timed check, which is what separates a result stated under premises from a deployment claim.

Assembled, these parts close one causal loop through the physical world (figure 1). The loop runs at rates four orders of magnitude apart: the Brain proposes at 2 Hz, the permission path on the discrete safety microcontroller admits, corrects, or refuses at 1 kHz, and the drives close their current loops at 20 kHz. The loop closes only through the World, and the World returns only what its sensors capture, with capture times, to the permission path and to the Brain. A state the sensors never carry, such as the friction under a clear film, is invisible to every level at once. Governance surrounds all five levels and changes on the timescale of releases, so it sets the budgets and standing conditions that the fast loop enforces without taking part in any single control cycle.

Figure 1: Closed causal loop: The Brain proposes across the proposal boundary, and the permission path in the Nervous System admits, modifies, or refuses each proposal before the Body acts. The Body’s current becomes force and motion at the Boundary, the World evolves, and the Boundary returns measurements with capture times to the permission path and the Brain. Not every state of the World reaches a sensor. The governance envelope surrounds all five levels and changes on the timescale of releases rather than control cycles. The labels are this machine’s values: the intent model proposes at 2 Hz, the chunk is renewed every 50 ms, the application processor sends a setpoint every 25 ms over a black-channel link to a discrete safety microcontroller unit (MCU) whose permission path ticks at 1 kHz, and the drives close their current loops at 20 kHz from a 47.7 V bus. Another machine sets its own rates.

The records summarized in table 1 bring the four laws into one engineering workflow. Rather than treating safety as an abstract property of a model, each part of the architecture leaves behind durable, auditable records that preserve the evidence and operating intent when tasks, payloads, or site conditions change.

Table 1: The four laws as engineering competence: Each part produces records that support the next design decision. The conditions and results belong to the particular machine and its evidence; they are not universal hardware requirements.

Law	Part	Records that carry it	Condition to maintain	Engineering result
Irreversibility	I (The Physical Body, The Cognitive Brain, The Nervous System)	Limit records; the proposer’s limits, which enter the handoff record	Each measured limit, such as floor friction, payload, brake onset, or observation age, still holds under present conditions	A feasible speed or force envelope, a timed proposal interface, and a reachable fallback
Endogenous data	II (Physical Data, Policy Training, Closed-Loop Evaluation)	Provenance record, policy manifest, evaluation record	The states the machine enters lie inside the target operational design domain (ODD, Choosing a tractable coverage table) that closed-loop evaluation represents	A learned behavior evaluated in its closed loop; new qualified experience can expand its supported task population
Proposal is not permission	III (Sensor Perception, Spatial Memory, Grounded Intent, Trajectory Planning, Safety Enforcement, Workload Placement)	Observation contract, belief record, intent lease, trajectory record, enforcement record, placement record	The permission path sees fresh, distinguishable state and meets its deadline under load	Useful motion admitted or minimally corrected within current limits; invalid active authority invokes a state-matched fallback
Permission must be earned	IV (Supervisory Intervention, Adversarial Verification, Deployment Release, Responsible Physical AI)	Authority record, fault record, release manifest, approval record, and the residual-claims register of this chapter	The premises of the release claim still hold after release	A named service authorized under standing conditions, with tested intervention and update procedures

The synthesis also completes the history traced in From Prediction to Action. Over eight decades, learning moved from the machine’s periphery toward its actuators. Deterministic mechanisms gave way to learned perception feeding analytical planners, then to end-to-end motor policies, and now to foundation models that propose action chunks across many robot bodies. At each step, a guarantee that physical separation or a watchful person once supplied had to move inside the machine.

The warehouse platform shows where that history now stands. Its split between an intent model proposing at 2 Hz and a chunk policy renewed every 50 ms mirrors current vision-language-action pipelines, and the guarantees those statistical models displaced survive in the deterministic architecture around them. The reflex halt beneath Shakey’s STRIPS planner and the lower layers of Brooks’s subsumption architecture, which kept running while higher layers were busy or wrong, have become the discrete permission path, enforcing signed kinematic and dynamic envelopes sized for this body. The remote operators who stayed close to the loop at the DARPA Robotics Challenge have become a formal intervention authority with timed handover budgets, and the environmental oversight a person once supplied has become explicit standing conditions of release.

The next phase, taken up in section 18.4.3, brings foundation models that control many bodies while learning continuously from fleet deployments. Cross-embodiment pretraining broadens what a model can propose, and it also carries the model further from the empirical distribution of any single site. Wider proposing latitude therefore makes the independent permission path more necessary, not less. It demands stronger checks at runtime and more defensible evidence at release, an architectural response to the safety-limit and conformity requirements of European machinery law (The standards map for the running machine).

The architecture is a method meant to carry across platforms. Its transferable core consists of the foundational questions, dynamic budgets, test protocols, and interface boundaries; the platform-specific elements are the calibrated numerical thresholds, kinematic envelopes, and actuator limits. The packaging cell of section 18.2 tests how that core adapts when mechanics, cycle rates, and operating environments change.

18.2 Generalizing to Unfamiliar Systems

An automated packaging cell that shuttles containers, seats closure tabs, and repeats high-rate cycles across a full shift can ram a closing gate, crush a carton wall, or bake its motor windings if its learned proposers outrun its physical limits. Building it requires the same pairing as the warehouse machine: a capable learned proposer with an execution pipeline whose runtime authority respects kinematic reach, contact force, and thermal buildup in the drive motors. The four bedrock laws trace one chain through such a machine, from the task’s irreversible consequences to measurable physical envelopes, through the closed-loop data that trains and validates its policies, to the real-time runtime that gates motor commands, and finally to the operating envelope certified for deployment. Auditing a machine the book has not yet studied tests whether that chain is a transferable method or only a description of one robot.

↩︎ The four bedrock laws, from irreversibility to permission must be earned, are established in The Four Bedrock Laws.

18.2.1 Auditing a new machine with the four laws

Auditing an unfamiliar machine out of order—evaluating a learned policy before the stopping budget fixes the speed ceiling, for example—wastes the evaluation on states the permission path will never admit. The audit therefore asks one question per law, in the order the laws constrain one another, and each answer leaves a record behind:

Irreversibility. What can the task do that no later command can undo, and what measured bound keeps it from happening? The answer names the collisions, plastic deformations, and thermal overloads of the task and sizes the envelope that excludes them, such as a speed ceiling from the stopping budget. It produces the machine’s limit records.
Endogenous data. Do the demonstrations and the closed-loop evaluation cover the states the machine will enter once that envelope is enforced? A limit added in step 1 changes the states the proposer sees, so the evaluation must be run inside the envelope, not before it. It produces the provenance record and the evaluation record.
Proposal is not permission. Which independent path admits, corrects, or refuses each proposal, on which sensors, within which timing budget, and with which fallback when permission lapses? It produces the enforcement record and the timing budget the permission path must meet.
Permission must be earned. Which operating claims does the assembled evidence support, under which standing conditions, who answers for each decision behind them, and which premises remain open? It produces the release manifest, the approval record, and the residual-claims register entries for every premise left open.

Because each step constrains the next, adjustments ripple back up the list: reducing the permitted transit speed to satisfy a stopping budget in step 1 alters the visual flow and dynamic states that step 2 must evaluate. Tracing those four steps on a high-rate packaging cell shows how a single limit in step 1 reshapes the data, runtime checks, and release claims that follow.

18.2.2 A packaging cell across the three machine classes

Consider a packaging cell in a logistics hub, laid out as in figure 2 (panel a). A carriage carrying one carton runs along a straight track, driven by a linear servo drive at the track’s near end. Partway along, an insertion head presses down on the carton’s flaps to seat its retention tabs. At the far end, a gate closes across the track whenever the next station cannot accept a carton, and a carriage still moving when the gate closes drives its carton into the gate and the frame. The cell is laid out tightly for cycle rate, so the carriage is only a few centimeters from its stop line when a closure can begin. This single cell couples all three machine classes within one enclosure: the carriage as moving mass, the insertion head as contact force, and the drive as thermal dissipation, because it cycles the carriage through rapid accelerations all shift.

↩︎ The three machine classes (mass-dominated mobility, contact-dominated manipulation, and energy- and thermal-dominated operation) are established in Three Machine Classes.

International Electrotechnical Commission. 2007. IEC 60085:2007: Electrical Insulation, Thermal Evaluation and Designation. International Electrotechnical Commission.

The first law asks what the machine cannot undo, so the audit begins by cataloging the cell’s irreversible state changes alongside the governing physical bounds. A loaded parcel container moving along a linear transfer rail carries momentum. When a carriage strikes an obstruction, kinetic energy dissipates through plastic deformation of the container and structural deflection of the frame, and commanding the drive motor in reverse cannot undo that damage. The insertion head introduces a second irreversible boundary: an actuator drives a tool head against package tabs to lock retaining clips. If the actuator pushes harder than the carton wall can support in compression, the container buckles and crushes its contents. The high-duty drive introduces a third irreversible boundary through Joule heating (\(\WindingLossPower = \TorqueProducingCurrent^2 \ElectricalResistance(\WindingTemperature)\)). Continuous high-acceleration cycles pump heat into sealed motor windings. Winding insulation does not need to melt to fail; elevated temperatures speed up chemical degradation over time, shortening insulation life rapidly (International Electrotechnical Commission 2007). Cooling the housing afterward cannot restore the dielectric strength already lost. Because insulation damage accumulates across duty cycles, an instantaneous temperature trip threshold alone cannot bound lifetime wear.

Because the carriage’s momentum is already committed, the permission path must act before the carriage consumes its clearance. The stop modeled next is the cell’s application-level path: a camera watches the gate, a learned model recognizes that a closure has begun, and the admitted stop command goes to the carriage brake. That path keeps normal operation clear of the gate, but it is not the cell’s certified protective function, which the third-law discussion below and Problem 1 take up. The constant-deceleration stopping relation of Kinematic stopping distance and pre-brake delay tests a candidate design for it, here on hypothetical scenario inputs rather than measurements from a commissioned cell.

Napkin Math 18.1: The delay wall

Problem: The loaded carriage travels at 1.50 m/s toward a gate whose fixed stop line is 60 mm away when the hazardous closure begins, maintaining constant speed until braking begins. Can it stop short of the line, and if not, what is the fastest speed whose stop fits once a 15 mm reserve is held back?

Variables:

Moving mass of carriage and loaded tray \(\Mass\) = 12 kg and nominal speed \(\SpeedAtDetection\) = 1.50 m/s (Illustrative)
Clearance 60 mm, less 15 mm reserved for uncertainty and residual clearance, leaves a stopping budget \(\StoppingDistanceBudget\) = 45 mm (Illustrative)
Braking lower bound \(\CredibleBrakingDeceleration\) = 15 m/s² after the delay, for whichever brake the stop command engages (Illustrative; a bound to qualify under load, pad wear, and rail conditions, not a motor’s peak rating)
Delay from closure to full braking \(\PrebrakeDelay\): 16 ms to a usable image, including frame phase and exposure, 36 ms for transfer, inference, scheduling, and admission, 2 ms for command delivery, and 10 ms for brake buildup, in all 64 ms (Illustrative upper bounds)

Math:

Nominal stop (equation 2.2, margins held in the reserve): \(\StoppingDistance = \SpeedAtDetection\PrebrakeDelay + \SpeedAtDetection^2/2\CredibleBrakingDeceleration\) = 1.50 m/s \(\times\) 64 ms \(+\) (1.50 m/s)\(^2/(2 \times\) 15 m/s²) = 96 mm \(+\) 75 mm = 171 mm, a deficit of 111 mm.
Speed ceiling (equation 2.3 with \(\StoppingDistanceBudget\) as the available distance): \(\CredibleBrakingDeceleration\PrebrakeDelay\) = 0.96 m/s and \(2\CredibleBrakingDeceleration{}\StoppingDistanceBudget\) = 1.35 m²/s², and the square root of (0.96 m/s)\(^2\) \(+\) 1.35 m²/s² is 1.51 m/s. The positive root is \(\SpeedBound\) = 1.51 m/s \(-\) 0.96 m/s = 0.55 m/s.
Candidate mode at 0.50 m/s, below the ceiling: 32 mm of delay travel \(+\) 8.3 mm of braking = 40.3 mm, leaving 19.7 mm before the stop line. Translational energy \(\KineticEnergy = \Mass \SpeedAtDetection^2/2\) falls from 13.5 J to 1.5 J, a reduction of 88.9 percent.

Result: At nominal speed the carriage reaches the gate before braking even begins. The budget admits at most 0.55 m/s, and the 0.50 m/s candidate keeps more than the allocated reserve.

Systems insight: At these speeds delay travel, not braking, exhausts the clearance. The 64 ms chain alone carries the nominal carriage 96 mm, farther than the stop line, so the condition \(\StoppingDistance \le \ClearDistance\) of principle 1 is met first by lowering speed or shortening the chain from closure to braking. The carriage’s speed limit belongs to that whole chain, not to its brake alone.

The slower mode is therefore worth qualifying. Cutting speed to a third shrinks the two terms of the stop unequally (figure 2). Delay travel is linear in speed and falls threefold, from 96 mm to 32 mm; braking distance is quadratic and falls ninefold, to 8.3 mm. At the restricted speed the delay chain, not the brake, therefore sets most of the stop, which is why the next question is which premise moves the ceiling most.

Three panels. Panel a is a side-view schematic of a linear track with a drive box at the left end, a carriage carrying a carton, an insertion head pressing down on the carton, and a gate with a red dashed stop line at the right; labels name the drive as thermal dissipation with insulation aging, the carriage as moving mass whose impact deforms carton and frame, and the insertion head as contact force that buckles the carton wall. Panel b is a horizontal delay bar of four segments, image 16 ms, transfer inference and admission 36 ms, bus 2 ms, and brake onset 10 ms, totaling 64 ms from closure. Panel c shows two stopping-distance bars on a millimeter axis from 0 to 180 with a red dashed stop line at 60 mm and a hatched reserve band just before it. At 1.5 m/s the bar has 96 mm of delay travel and 75 mm of braking, reaching 171 mm, with the part beyond the stop line shaded red. At 0.5 m/s the bar has 32 mm of delay travel and a short braking segment, stopping at 40.3 mm with 19.7 mm to spare. — Figure 2: **Three machine classes in one packaging cell**: (a) The carriage is the moving mass whose impact deforms carton and frame, the insertion head applies the contact force that can buckle a carton wall, and the drive dissipates heat that ages winding insulation. (b) The assumed delay chain from gate closure to full braking totals 64 ms. (c) At 1.50 m/s the carriage travels 96 mm before braking begins and stops after 171 mm, far beyond the 60 mm stop line; at the restricted 0.50 m/s it stops in 40.3 mm, clear of the 15 mm reserve. All inputs are hypothetical design allocations, not measurements.

The positive root also shows how the ceiling responds to each premise. Halving the processing allocation to 18 ms raises the ceiling to 0.66 m/s; because delay travel dominates this stop, reducing that allocation recovers substantial speed margin. Halving the qualified braking bound to 7.5 m/s² lowers the ceiling to 0.47 m/s, below the candidate 0.50 m/s mode, which then no longer fits. The two premises play different roles. Shorter latency is an opportunity for throughput, whereas a braking shortfall invalidates the mode outright, which is why the loaded deceleration must be qualified under worst-case conditions before the cell is commissioned. The stopping equation fixes the relationship; only measurements on the assembled cell can establish that the latency budget, the deceleration bound, and the reserve hold.

↩︎ This speed ceiling, the positive root of the stopping equation, is established for the mobile base in Dynamic velocity ceilings and clearance budgeting.

The second law evaluates the competence of the cell’s learned proposers in the closed loop. This packaging cell runs three distinct learned proposers: a vision model that infers container contents to propose carriage transit speeds (fragile or liquid contents tolerate gentler accelerations and stops than solid goods), a multimodal network that estimates cardboard thickness to propose insertion forces and dwell durations, and an electro-thermal estimator that proposes acceleration profiles to manage motor winding temperatures. Each proposer’s actions alter what it observes next. Throttling carriage speed changes camera frame timing and motion blur, extending tool dwell changes the material deformation that later thickness estimates read, and reshaping acceleration profiles changes the temperature trajectory the thermal estimator measures. Evidence of proposer competence therefore holds only for the state distribution sampled during closed-loop evaluation, and the question is whether that distribution matches the conditions admitted at runtime. A safety restriction imposed after training shifts that distribution. If closed-loop evaluation sampled only the nominal transit speed of 1.50 m/s, clamping speed to 0.50 m/s pushes the vision model into visual dynamics it never encountered during evaluation, so the restriction that secures the stopping distance also opens a regime without evidence. The engineering team must either evaluate the policy under derated conditions before release or record the unverified regime as an open premise in the release sign-off.

↩︎ A policy whose actions choose its next observations drives the endogenous covariate shift established in Mechanics of Endogenous Covariate Shift.

Closing this gap requires matching the data-collection and evaluation campaign to the restricted operating envelope. Expert demonstrations must span the admitted transport velocities, insertion forces, and thermal regimes, preserving complete site metadata in the provenance record. Once trained, the candidate proposer must undergo closed-loop trials on the physical cell to confirm that it completes the packaging task under those conditions, including during interventions by the permission path. If the cell cannot maintain acceptable task performance within its physical bounds, engineers must revise the task specification, the proposer architecture, or the mechanical plant before re-evaluating the modified system. Calculating a speed ceiling tests the transport stopping budget under its stated premises; qualifying those premises and demonstrating closed-loop task performance are both required for a viable packaging cell.

↩︎ Why proposer evidence must come from the closed loop the machine will actually run is established in Closed-Loop Dynamics.

The third law places these proposed actions beneath an architectural authority split that the proposers cannot bypass, delay, or corrupt. The permission path prevents unverified neural proposals from reaching physical actuators directly. In this packaging cell, an independent kinematic monitor runs at 1 kHz, reading the carriage’s optical encoders and a rangefinder aimed at the gate, and admits a carriage motion command only when the measured clearance supports the qualified stopping distance. This monitor is the admission stage of the camera path in notebook 18.1: the camera reports that a closure has begun, and the monitor admits the stop. Its work is therefore part of the 36 ms processing allocation, and a 1 kHz tick bounds only how long a command waits for the next check, not the transfer, inference, and scheduling that come before it.

While the software kinematic check confines normal operation to the derated velocity mode, it does not carry the cell’s formal protection claims. In an industrial deployment, harm-prevention claims rest on hardware-certified drive safety functions codified under IEC 61800-5-2 (International Electrotechnical Commission 2016) and mapped for warehouse automation in The permission path above its certified floor. The restricted transport mode maps to safely limited speed (SLS) on the carriage drive, an independent hardware function that continuously monitors motor velocity and triggers an emergency stop if the limit is exceeded. The emergency response executes as a ramp-monitored safe stop 1 (SS1) terminating in safe torque off (STO), with safe brake control (SBC) engaging mechanical holding brakes at rest. Each safety function requires a validated timing budget and an integrity metric. Under ISO 13849-1 (International Organization for Standardization 2023), safety functions are classified by performance level (PL), which bounds their average probability of dangerous failure per hour according to the cell’s risk assessment. The camera-triggered stop budgeted in notebook 18.1 is the application-level path announced before it, not a protective safety function. A safety-rated optical gate sensor feeding the drive’s SS1 input directly replaces the frame-exposure and neural-inference allocations with its certified hardware response time, while command delivery and brake onset still contribute to \(\PrebrakeDelay\) in the physical stopping model.

International Electrotechnical Commission. 2016. IEC 61800-5-2:2016: Adjustable Speed Electrical Power Drive Systems, Part 5-2: Safety Requirements, Functional. International Electrotechnical Commission.

International Organization for Standardization. 2023. ISO 13849-1:2023: Safety of Machinery, Safety-Related Parts of Control Systems, Part 1: General Principles for Design. International Organization for Standardization.

Physical safety limits must govern the insertion tool and actuator drives just as strictly as carriage motion. Setting a mechanical force limiter to 220 N is a nominal design choice rather than proof that every parcel resists crushing; physical tests must verify that peak transmitted forces, including dynamic overshoot during contact impact, stay below the yield strength of the weakest admitted carton and tab geometry. Similarly, setting a winding thermistor trip threshold at 105 °C and a stall detection timeout of 400 ms provides basic supervisory cutoffs rather than a certified thermal envelope. Safe continuous operation depends on drive current profiles, winding resistance, heat capacity, cooling airflow, and sensor thermal lag. Because internal winding temperatures can surge before external housing sensors register the heat, as modeled in Thermal capacity and insulation breakdown thresholds, engineers cannot validate a sustained duty cycle from trip thresholds alone without measuring the thermal response under load.

High-rate deceleration also transfers mechanical kinetic energy back into the electrical drive system. During regenerative braking, the decelerating motor returns power to the inverter DC bus; a dynamic brake chopper and power resistor must absorb this energy before bus voltage exceeds the inverter trip threshold of 60 V, following the bus energy balance in Regenerative overvoltage surges and dynamic brake choppers. The energy sink must handle repeated stops across a full shift rather than an isolated emergency event. Furthermore, regenerative braking requires an energized inverter stage throughout deceleration, whereas the carriage’s electromechanical track brake relies on its own spring-actuated mechanism. Logic power hold-up alone supplies neither regenerative braking torque nor friction-brake clamping force. A thermal fault or electrical shutdown that cuts drive power disables regenerative braking, leaving deceleration entirely to the mechanical brake. The notebook’s 15 m/s² bound therefore holds after a power cut only if the spring-applied track brake is itself qualified to it; otherwise the power-cut case has a lower deceleration, a longer stop, and a lower speed ceiling of its own. System designers must ensure that safety-directed power cuts preserve a qualified deceleration and holding response across the declared operating states and fault conditions.

The fourth law synthesizes these engineering decisions into a release argument. The cell’s release manifest must validate rangefinder coverage, gate clearance margins, braking deceleration, and sustained task throughput as one connected system. Equally important, the manifest explicitly records any claims that physical evidence cannot support. To check whether the tabs have latched, the engineering team evaluates a vision model that inspects surface reflections for container tab engagement. Under industrial overhead lighting, glare from tape and crinkled plastic packaging produces bright reflections that mimic latch defects while hiding genuine tab misalignments. Because the cell lacks an independent physical measurement, such as a tactile switch or a laser profile scanner, that separates engaged tabs from misaligned flaps under glare, the sign-off claim lacks a qualified detector. Recording this limitation as detectorless and unsupported in the residual-claims register (section 18.3.3) is not a documentation failure but an accurate statement of what the physical evidence justifies.

The stopping analysis therefore supports a candidate restricted mode for carriage transit at 0.50 m/s, provided that the 64 ms end-to-end latency, 15 m/s² braking deceleration, 60 mm physical clearance, and uncertainty reserve are validated together on the physical cell. Insertion forces and thermal duty cycles remain restricted until physical testing confirms material crush limits, sensor thermal lag, and independent fault paths. Autonomous package sign-off is refused because glare hides tab engagement from the vision system and the cell lacks an independent verification sensor. A qualified tactile or laser engagement sensor could support autonomous sign-off; mandatory downstream manual inspection instead supports a commercial deployment that makes no autonomous sign-off claim. An analytical throughput model cannot substitute for that physical evidence. Each law’s answer constrains the next. The stopping mechanics fix a transport envelope, the envelope fixes the regime that data collection and evaluation must cover, the runtime monitors enforce that envelope, and the release argument restricts the cell wherever a claim lacks support.

The same audit extends beyond the three machine classes of the packaging cell into fluid and chemical process systems, where the irreversible consequence may be reagent already delivered or heat already transferred rather than damage from a moving mass. Consider a learned proposer that sets the opening of a dosing valve feeding a reaction tank, with a high-level trip that commands the valve shut before the tank overfills. The first law asks what reagent has already been committed. If the shutoff command arrives after a delay \(\PrebrakeDelay\) at a volumetric flow rate \(\VolumetricFlowRate\), fluid continues to discharge, adding roughly \(\VolumetricFlowRate\PrebrakeDelay\) to the volume delivered before the valve even begins to move, the fluidic analog of the delay travel \(\SpeedAtDetection\PrebrakeDelay\) in the stopping distance. The valve’s closing stroke then adds the fluidic analog of braking distance, and both must fit within the headroom above the trip level, as the clearance did for the carriage. Stored thermodynamic and hydraulic energy also complicates the fallback. A pressurized accumulator, a cryogenic transfer line, or a heated pressure vessel retains stored energy after electronic control power is cut. As with a balancing biped, whose fall begins the moment its torque is removed, de-energizing the controller does not by itself produce a safe state, so the design must name a qualified physical sink, such as a spring-loaded pressure relief bypass, to dissipate that energy. The remaining laws apply in the same way. Policy evaluation must sample the throttled flow regimes that the safety limits enforce, the permission path must guarantee valve closure within the allowable volume tolerance, and sign-off must rest on measured valve slew rates and sensor response times. In every case the machine’s operating claims hold only as far as its physical evidence reaches, and a physical state that stays unobserved until the execution deadline marks where that evidence ends.

Checkpoint 18.1: Transferring the four-law audit

The packaging cell demonstrates how the four-law audit organizes system design for an entirely novel machine, anchoring every operational claim to physical bounds and empirical measurements.

Speed-ceiling estimate: Suppose physical load testing qualifies the carriage’s braking bound at only 12 m/s², assuming the same 64 ms total delay and 45 mm stopping budget. Estimate the updated velocity ceiling from the positive root of the stopping equation, and determine whether the candidate 0.50 m/s mode still fits within the updated stopping budget under the remaining assumed inputs.
Machine classes: For the carriage, the insertion head, and the linear drive motors, identify each component’s physical machine class, the irreversible physical state transition it can produce, and the governing physical boundary.
Derated evaluation: Explain why imposing a runtime velocity restriction after training induces an endogenous covariate shift for the vision proposer. What two engineering options can close this evaluation gap before operational sign-off?
Sign-off verdict: What specific physical sensing evidence would be required to transition autonomous package sign-off from refused to supported, and why does simply expanding the training dataset with more glare-corrupted images fail to resolve the underlying detector deficiency?

18.3 The Epistemic Frontier

A packaging cell’s camera can confirm an arm’s position and approve a transport motion without verifying that a hidden mechanical tab has engaged. Similarly, a warehouse robot’s lidar and cameras can clear a navigation path across an aisle without determining whether the concrete floor provides enough traction to brake. These gaps are epistemic limits: boundaries on what the available sensors and analytical arguments can justify. Additional training can improve a policy’s action proposals, but machine learning cannot manufacture an unmeasured physical state. Systems engineers must therefore determine whether justifying the next operating claim requires broader training experience or a physical measurement absent from the existing sensor suite.

Consider an aisle where a pallet jack with a leaking hydraulic line has just crossed, leaving a thin, clear film of fluid on polished concrete. The mobile manipulator’s stopping budget assumes the floor supplies enough surface friction for credible deceleration, which dry industrial concrete reliably does. Under an oil film, however, available traction collapses, yet neither standard navigation cameras nor time-of-flight lidars can tell the clear fluid apart from dry concrete. In this failure mode the safety architecture runs exactly as specified. The software permission path meets every deadline, chunk leases expire on schedule, and the drive controller applies braking torque right on time. Even so, the robot slides past its stop line and collides at the rack end. The failure comes not from software latency or actuator lag, but from an unmonitored premise—the local wheel-floor friction coefficient before braking—and the stopping budget prices that premise.

The claim adjudication in Matching the argument to the machine already encountered this premise: claim C3 (braking traction) was refused on this book’s own evidence and deferred to this chapter as an unresolved premise. The credible deceleration \(\CredibleBrakingDeceleration\) that The Physical Body credited to the brakes was always conditional on the floor. Made explicit, that condition says the deceleration a machine actually has available is the smaller of what its brakes can deliver and what tire-floor traction can transmit:¹ \[\AvailableDeceleration = \min(\CredibleBrakingDeceleration, \CoulombFrictionCoefficient \Gravity). \tag{1}\] The friction term is the traction ceiling of The Physical Body (figure and Electrical time constants, back-EMF, and current clamping), \(\CoulombFrictionCoefficient \DrivenWheelLoadFraction \Gravity\), taken with all of the weight on the driven wheels (\(\DrivenWheelLoadFraction = 1\)). That is the case that sets the friction floor, the same optimistic all-weight screen that claim C3 was adjudicated against; at the drive wheels’ rated load share the floor is higher, as that notebook computes, so every friction margin below is the optimistic one. On an oily surface, interface friction rather than motor torque becomes the binding constraint.

¹ Amontons-Coulomb Friction: The classical laws of sliding friction make the friction force proportional to the normal load and independent of the apparent contact area, which is what lets a single coefficient \(\CoulombFrictionCoefficient\) describe a contact. Bowden and Tabor (1950) traced the law to the small true area of contact, whose shear strength sets \(\CoulombFrictionCoefficient\), and showed that a lubricant film only molecules thick can lower it several-fold. The coefficient therefore belongs to the pair of surfaces and whatever lies between them, not to the floor alone, and the braking premise needs a measurement at the tire-floor interface that no camera viewing the floor supplies.

Bowden, Frank Philip, and David Tabor. 1950. The Friction and Lubrication of Solids. International Series of Monographs on Physics. Clarendon Press.

Napkin Math 18.2: The friction floor

Problem: A clear hydraulic film lies across the aisle. Does the known-component stop from the candidate 1.3 m/s aisle speed still fit the rack end’s 1.10 m clear distance?

Variables:

Credible deceleration \(\CredibleBrakingDeceleration\) = 2 m/s² (Illustrative, Kinetic Momentum) and \(\Gravity\) = 9.81 m/s² (Defined standard-gravity constant)
Floor friction \(\CoulombFrictionCoefficient\) = 0.60 on dry industrial concrete and 0.05 under the film (both Illustrative; see the Reader Guide)
Aisle speed \(\SpeedAtDetection\) = 1.3 m/s (Chosen) and clear distance \(\ClearDistance\) = 1.10 m (Illustrative)
Known-component budget, the seven rows of The warehouse mobile manipulator's stopping budget, which leave out the dispatch-to-admission interval \(\DispatchAdmissionInterval\) that is allocated but not yet measured: pre-brake delay \(\PrebrakeDelay\) = 133.6 ms, jerk bound \(\JerkLimit\) = 7.11 m/s³, and fixed overheads of 190 mm (all Derived)

Math:

Friction floor (equation 1): The brake binds only while \(\CoulombFrictionCoefficient \ge \CredibleBrakingDeceleration/\Gravity\) = 2 m/s² \(/\) 9.81 m/s² = 0.204. Dry concrete clears it; the film does not, so \(\AvailableDeceleration = \CoulombFrictionCoefficient \Gravity\) = 0.05 \(\times\) 9.81 m/s² = 0.49 m/s².
Dry-floor budget: Delay travel \(\SpeedAtDetection\PrebrakeDelay\) \(+\) braking \(\SpeedAtDetection^2/2\AvailableDeceleration\) \(+\) jerk-ramp travel \(\SpeedAtDetection \AvailableDeceleration/2\JerkLimit\) (the S-curve term of row 6, valid in the trapezoidal regime because \(\SpeedAtDetection > \AvailableDeceleration^2/\JerkLimit\)) \(+\) overheads = 173.7 mm \(+\) 422.5 mm \(+\) 182.8 mm \(+\) 190 mm = 969.0 mm.
Film budget: The same terms at \(\AvailableDeceleration\) = 0.49 m/s² give 173.7 mm \(+\) 1,723.3 mm \(+\) 44.8 mm \(+\) 190 mm = 2.13 m.

Result: On the film the stop grows from 969.0 mm to 2.13 m, far past the 1.10 m clear distance, before the dispatch-to-admission interval is even added.

Systems insight: Below \(\CoulombFrictionCoefficient\) = 0.204 the floor, not the brake or the timing, sets the deceleration, and the braking term grows as \(1/\CoulombFrictionCoefficient\). Faster admission can recover only the 173.7 mm of delay travel, so no improvement in the permission path restores the dry-floor mode on the film. Only a restriction or a measurement at the tire-floor interface can keep \(\StoppingDistance \le \ClearDistance\).

Below \(\CoulombFrictionCoefficient\) = 0.204, the floor, not the brake, sets the deceleration.

The calculation omits the dispatch-to-admission interval, which the discrete placement of The board-link budget and the dispatch-to-admission interval allocates but no loaded measurement yet confirms; that interval adds travel and reduces every derived speed ceiling, yet even the known-component budget already excludes the film. Moreover, the friction premise did not appear only when fluid leaked onto the concrete: the candidate normal operating mode of Sizing the composite stopping budget always assumed that unmeasured friction floor across every aisle, dry or wet. Software timing and physical traction are independent requirements, since bounding scheduling delays does not guarantee floor grip and confirming floor grip does not remove scheduling delays. On the oil film, the drive electronics continue to regulate motor current and commanded torque within milliseconds, yet that torque slows the base only through tire-floor contact, so neither a faster enforcer nor another layer of neural inference replaces the interface measurement or the speed restriction the notebook calls for.

↩︎ Current regulation within milliseconds through electrical time constants and current clamping is established in Electrical time constants, back-EMF, and current clamping.

The manipulator arm’s contact limit at the door latch has the same structure. Safety depends on a latch that holds under any force below the arm’s contact ceiling. Mechanical wear, material fatigue, or corrosion can silently lower the latch’s yield force below that ceiling, even while joint torque sensors report readings identical to those against a sound strike plate. A wrist force-torque sensor whose zero-point calibration has drifted creates the same hazard for every contact threshold that depends on its signal (section 18.3.4.2).

In each case, a machine can leave its safe operating envelope while internal telemetry stays completely nominal. Successful test runs under nominal conditions provide no safety guarantee once an underlying physical premise fails. A safety case must explicitly list each unobserved premise, restrict operating authority while that premise remains unverified, and state the physical evidence required to close it. For every open entry, systems discipline requires determining what the machine can physically measure, what actuator limits can still prevent, and which operating claims must remain refused.

18.3.1 What the release claim rests on

Extensive testing of one link in a safety case cannot compensate for an unmeasured premise in another: a thousand hours of fault-free perception trials will not stop a base whose tires lose traction on an oily floor.² A mobile manipulator’s release claim forms a chain of dependent arguments tied to its operating hazards and chosen mitigations. The complete safety case must establish the operational design domain, measured actuator performance, stopping bounds, component interface contracts, and independent permission filtering for learned proposals. Hazards managed by runtime detection require verified detector coverage and bounded monitoring latency, whereas hazards managed through passive compliance or operating restrictions require physical evidence that those safeguards hold across declared payloads, component wear, and site conditions.

² Popperian Falsification: The asymmetry holds for universal hypotheses (Popper 1959). No finite run of safe stops proves that every aisle floor supplies the friction floor, and one measured film below it refutes that premise. A rate claim, such as a hazard rate per hour, is neither refuted by one incident nor proved by many incident-free hours, so it is bounded statistically and revised as exposure accumulates. This chapter therefore holds deterministic premises in register entries and rate claims in confidence bounds.

Popper, Karl R. 1959. The Logic of Scientific Discovery. Hutchinson.

Each premise in a safety case carries one of five statuses: established by measurement or derivation, assumed, decided by accountable judgment, unsupported, or outside the threat model. (The Reader Guide lists the same five with examples; the audits of this chapter and its problems use these exact labels.) The envelope trichotomy (definition 16.3) classifies an actively monitored runtime condition as known-true, known-false, or unknown. That trichotomy presupposes a monitor. “Unknown” marks a monitored condition whose evidence has lapsed, and the permission path answers it at once with a validated stop or hold until fresh evidence returns. An unobserved premise has no runtime monitor whose report can trigger that transition; its missing evidence must instead be recorded in the release argument. Telemetry stays nominal while the premise fails, and holding the machine until a report arrives would hold it forever, because no report will come. Such premises require standing restrictions decided before operation; a fallback cannot be triggered by evidence the machine never receives. Release certification must therefore either validate and maintain these premises through external physical evidence or restrict operating authority accordingly. For the mobile base, stopping-distance guarantees rest on an assumed wheel-floor friction coefficient that cannot be observed before braking. For the manipulator arm, contact safety assumes a minimum yield strength for the door latch and the objects it handles, a threshold set by engineering judgment rather than real-time measurement. For the wrist sensor, force-limiting safety functions assume zero-point calibration stability, a condition internal telemetry cannot verify without an unloaded physical tare. Recording these premises explicitly does not weaken a release case; it marks the exact boundary where system guarantees hold and beyond which operating authority must be withdrawn.

Separating physical measurement from accountable judgment is essential to systems engineering. Testing and statistical analysis can estimate physical exposure, quantify sensor noise, and bound parameter uncertainty, but test data cannot choose an acceptable residual risk or decide which people in a facility must bear that risk. Those choices are accountable engineering decisions that must be recorded as explicit judgments rather than presented as empirical facts. Similarly, the verification campaign’s threat model bounds where the safety record holds. Field trials across normal fleet workflows and random component faults do not by themselves support claims about deliberate attacks outside the tested conditions. A test campaign showing that a vision pipeline tolerates lens flare, sensor noise, and partial occlusions provides no evidence that it resists adversarial optical projections, tampered policy weights, or deliberate denial-of-service flooding on the internal communication bus.

↩︎ The fault list that bounds what verification tests, including transduction-layer attacks on sensors and on the proposer, is established in Deriving the Fault List.

18.3.2 Conditional shield credit and common-cause bounds

Treating an independent permission path as a substitute for a missing floor-friction measurement asks the safety shield to stop a hazard it cannot sense, and even for hazards within its view, a shield reduces the failure rate only in proportion to its own tested coverage. Pricing what the permission path actually contributes to a hazard-rate claim separates the hazards a shield can attenuate from the register entries it can never close. The Minimal Intervention Principle and Optimization Filters established deterministic guarantees for each command a safety shield checks, but turning those per-command guarantees into a system-level hazard rate requires statistical accounting. Because a shield acts as a conditional filter, the resulting hazard rate depends on how often the policy proposes hazardous actions, how reliably the shield intercepts them in those exact states, and how often failures occur outside the shield’s sensing domain. Notebook 18.3 prices these terms in an illustrative deployment.

Consider an illustrative system target of 1 × 10⁻⁹ \(\text{h}^{-1}\). This number comes from civil aviation certification, where catastrophic failure conditions must be shown to be “extremely improbable,” on the order of \(10^{-9}\) per flight hour³ (Federal Aviation Administration 1988). While no industrial robotics standard requires this threshold, examining it shows the statistical burden a borrowed safety target imposes. As the exposure wall established, physical operating hours alone cannot certify failure rates of this scale.⁴ The practical engineering question is what safety margin a runtime shield genuinely contributes against that target, and what supporting evidence its own operation requires.

³ Extremely Improbable Band: The advisory circular offers its probability bands as aids to engineering judgment, expressed per flight hour of a mean-duration flight and applied to each failure condition separately, and it grounds such criteria in historical accident data (Federal Aviation Administration 1988). The \(10^{-9}\) figure is therefore one catastrophic condition’s share of a certified design’s risk, not a rate for a whole aircraft, let alone for another kind of machine. Applying it elsewhere without the allocation argument that set its share leaves the number without its basis.

Federal Aviation Administration. 1988. System Design and Analysis. AC 25.1309-1A. U.S. Department of Transportation, Federal Aviation Administration.

⁴ Pooling Evidence Across Updates: An updated model may alter the proposal distribution. Earlier data can be pooled only with a justified configuration-equivalence and exposure argument; an update does not automatically erase every observation. The exposure wall’s constant-rate model also requires a defensible treatment of shared fleet conditions and correlated faults.

↩︎ The exposure wall, the event-free operating hours needed to bound a rare hazard rate, is established in Verification Ceilings and the Exposure Wall.

A safety shield argument is inherently conditional. Observed incident rates across an operating fleet already include the protective interventions of runtime filters and human supervisors, so multiplying an observed incident rate by a shield’s interception factor double-counts that protection. For a defined hazard class \(\HazardClassIndex\), let \(\HazardousProposalRate\) denote the arrival rate of unshielded, hazardous action proposals emitted by the policy before the permission layer, and let \(\ShieldInterceptionCoverage = \Pr(\text{intercept} \mid \text{hazardous proposal}, \HazardClassIndex)\) denote the verified interception coverage for that hazard class. Including an independently bounded hardware fault and common-cause arrival rate \(\HardwareCommonCauseRate\), the conditional hazard rate obeys equation 2: \[\SystemHazardRate \le \HazardousProposalRate(1-\ShieldInterceptionCoverage)+\HardwareCommonCauseRate \tag{2}\] Here, \(\SystemHazardRate\), \(\HazardousProposalRate\), and \(\HardwareCommonCauseRate\) are rates per operating hour, while \(\ShieldInterceptionCoverage\) is a unitless conditional probability. The limiting cases make the shield’s role plain. With perfect detection and interception (\(\ShieldInterceptionCoverage = 1\)), the upper bound reduces to the hardware and common-cause term \(\HardwareCommonCauseRate\), a residual no coverage removes. Conversely, if the shield has zero coverage (\(\ShieldInterceptionCoverage = 0\)), the raw proposal hazard rate passes straight to the actuators. This relation turns the runtime assurance architecture, which pairs an unverified primary controller with a verified safety filter (Sha 2001; Hsu et al. 2024), into a checkable hazard-rate claim.

↩︎ The Simplex architecture, which pairs a capable unverified proposer with a verified protective controller, is established in The Per-Tick Gatekeeper.

Using equation 2 requires four premises. The first is a verified counterfactual oracle: an evaluation harness that determines whether an unshielded action proposal would have caused a safety violation. Without this oracle or another justified way to identify or conservatively bound hazardous proposals, the raw proposal error rate \(\HazardousProposalRate\) has no supporting evidence. The remaining requirements are timely hazard detection, adequate braking authority, and a careful accounting of correlated failures. Designers frequently overlook this final common-cause term. Release claim C5 required physical testing rather than a theoretical independence assumption because separate implementations of the same specification fail together far more often than statistical independence predicts (Contextual assumptions and the weakest link). The product \(\HazardousProposalRate(1-\ShieldInterceptionCoverage)\) uses interception coverage conditional on hazardous proposals; substituting coverage measured on unrelated states erases that conditioning. An occluded camera frame that causes the neural policy to propose a bad trajectory can corrupt the safety shield’s state estimator at the same moment. That shared failure does not merely add an independent background term to \(\HardwareCommonCauseRate\); it lowers \(\ShieldInterceptionCoverage\) in the very states where policy errors happen. Interception coverage \(\ShieldInterceptionCoverage\) must therefore be measured across the actual states where the policy fails rather than on an idealized set of synthetic test cases. The equation gives no credit for hazards the shield cannot sense, such as oil films or fatigue-weakened latches, and no credit for the shield at all until each of the four premises is supported; until then the release must restrict operation instead.

Bounding the system hazard rate requires bounding the raw proposal rate \(\HazardousProposalRate\) from an adjudicated execution log before crediting shield attenuation. Under a stationary Poisson arrival model with zero observed hazardous proposals, this upper bound follows the rule of three (Hanley and Lippman-Hand 1983) from equation 7.4, with proposal operating hours in place of discrete trials. For an adjudicated log spanning \(\Time\) operating hours at significance level \(\HypothesisTestSignificanceLevel\), the one-sided upper confidence bound is \(-\ln\HypothesisTestSignificanceLevel/\Time\), or roughly \(3/\Time\) at 95 percent confidence:

Hanley, James A., and Abby Lippman-Hand. 1983. “If Nothing Goes Wrong, Is Everything All Right? Interpreting Zero Numerators.” JAMA 249 (13): 1743–45.

Napkin Math 18.3: The coverage bill

Problem: In an illustrative scenario, a fleet keeps a fully adjudicated proposal log for one release cycle, judged by a validated counterfactual oracle, and the log records no hazardous proposal. If a named shield’s interception coverage for that hazard class were independently established, would the modeled residual of equation 2 meet the system target, and what evidence would it take to show that it does?

Variables:

System target \(\TargetHazardRate\) = 1 × 10⁻⁹ \(\text{h}^{-1}\) (Illustrative)
Proposal log \(\Time\) = 100 units \(\times\) 90 days \(\times\) 24 h = 2.16 × 10⁵ proposal-hours with zero hazardous proposals (Illustrative)
Class-specific coverage \(\ShieldInterceptionCoverage\) = 0.9999 and \(\HardwareCommonCauseRate\) = 0 (Illustrative; the hardware and common-cause term is set to zero for this calculation)
Confidence 95 percent, significance \(\HypothesisTestSignificanceLevel\) = 0.05 (Chosen)

Math:

Proposal bound (rule of three with hours in place of trials): \(-\ln\HypothesisTestSignificanceLevel / \Time\) = 2.996 \(/\) 2.16 × 10⁵ h = 1.387 × 10⁻⁵ \(\text{h}^{-1}\).
Residual: 1.387 × 10⁻⁵ \(\times\) 1 × 10⁻⁴ \(+\) 0 = 1.387 × 10⁻⁹ \(\text{h}^{-1}\), above the target. Meeting it at this bound needs \(\ShieldInterceptionCoverage \ge 1 -\) 1 × 10⁻⁹ \(/\) 1.387 × 10⁻⁵ = 0.9999279.
Proposal evidence at the assumed coverage: The bound must fall to 1 × 10⁻⁹ \(/\) 1 × 10⁻⁴ = 1 × 10⁻⁵ \(\text{h}^{-1}\), which takes 2.996 \(/\) 1 × 10⁻⁵ = 3.00 × 10⁵ proposal-hours, or 124.8 days for the fleet, 34.8 days beyond the cycle.
Coverage evidence: Bounding \(\ShieldInterceptionCoverage\) itself takes \(\ln\) 0.05 \(/ \ln\) 0.9999 = 29,956 seeded hazardous proposals of that class with no miss, drawn from the states in which the policy errs.
Joint confidence: The probability that at least one of two bounds fails is at most the sum of their failure probabilities, so a joint 95 percent statement needs each bound at 97.5 percent (the Bonferroni split). The proposal bound becomes 3.689 \(/\) 2.16 × 10⁵ h = 1.708 × 10⁻⁵ \(\text{h}^{-1}\), the coverage campaign 36,887 trials, and the residual 1.708 × 10⁻⁹ \(\text{h}^{-1}\).

Result: The modeled residual misses the target even with the common-cause term set to zero. Supporting the claim takes both a proposal log longer than the release cycle and tens of thousands of seeded interceptions, and the confidence of the combined claim must be budgeted across them.

Systems insight: A shield changes the system claim only for hazard classes it can detect and intercept in time. Proposal frequency, conditional interception coverage, hardware faults, and common-cause failures need separate evidence. Oil or material failure outside the shield’s sensing coverage stays in the residual-claims register.

The notebook prices what evidence the exposure model and the safety filter would need; it supplies none for either. Formal verification carries the same scoping requirement, since any mathematical proof applies only to the declared kinematic model, sensor observations, disturbance bounds, and timing guarantees. Whenever a physical premise lacks empirical proof, the release argument must substitute an operating restriction assigned to an accountable owner.

↩︎ The scoping limits of formal certificates to their declared plant, observations, and disturbances are established in Scope of a formal verification result.

18.3.3 A residual-claims register

Refusing claim C3 in the safety case did not remove the floor-friction premise behind it, and without a durable record tying that open premise to an operating restriction, a later model update could restore normal aisle speed while the floor remains unmeasured. The residual-claims register is the sixteenth and closing record in the systems record chain. Taking in the upstream release manifest and approval record, the register binds every unresolved physical premise directly to an operating restriction.

↪ The sixteen-record chain, which the residual-claims register closes, is developed in The record register.

Each register entry names four required elements: the missing physical observable, the active containment mechanism or operating restriction, the accountable owner, and a predeclared closure test. Together they give principle 4 direct operational force. Unlike a software defect log or issue tracker, the register is a machine-readable deployment record with a fixed schema. Its parameters set runtime enforcer bounds, and its standing conditions bind facility operations. Operating authority stays derated until test evidence passes the predeclared closure test; writing a warning note in documentation or deferring an open premise to a future release without lowering speed or narrowing the operational design domain provides zero physical protection.

↪ Byte layout: Wire formats, data fields, and structural invariants for register entries are documented in Residual-claims register.

Not every open premise is physical. Entries that the approval record of The Approval Record cannot close before release, such as a human role whose feasibility is still UNKNOWN, a decision waiting for an owner, or a group of people whose detection has not yet been measured, enter the register in the same form. Each carries the restriction that holds meanwhile, such as a lower speed wherever the unmeasured group works, an owner, and the test that would close it.

Engineers must state each missing observable in concrete physical quantities rather than modeling jargon. Calling a failure an “out-of-distribution latent state” does not say what physical sensor must measure it or when an enforcer must intervene. Naming an unmeasured friction coefficient or latch yield force, by contrast, makes the engineering choices concrete: the team can weigh adding a sensor, adding a passive mechanical limit, or narrowing the operational design domain, and everyone can see what test evidence is needed to retire the restriction.

The undetected oil film forms the first register entry for the mobile manipulator. Its premise is that every aisle floor supplies a friction coefficient of at least \(\CoulombFrictionCoefficient \ge\) 0.204, the floor needed for credible deceleration. The missing observable is the local friction coefficient under a clear fluid film, which neither onboard cameras nor lidars can tell apart from clean concrete. Because a stop sized for dry concrete overruns the available clearance on an oily floor, the normal speed limit is justified only on surfaces where friction is verified or actively controlled.

An open premise requires an immediate operational response. For warehouse aisles, release sign-off can authorize a derated speed of 1 m/s on designated routes maintained under a facility inspection procedure. In this restricted-service mode, scheduled floor scrubbing, spill isolation, and controlled access must maintain a friction coefficient of at least \(\CoulombFrictionCoefficient \ge\) 0.12. That friction level gives an available deceleration of 1.18 m/s² and a known-component speed ceiling of 1.23 m/s, the inspected-floor ceiling that the release envelope carries (Operating envelope of the warehouse mobile manipulator), drawn as the dashed envelope in the stopping distance analysis of Safety Enforcement (figure). The restricted mode sits below that ceiling rather than at it, because the ceiling, like the budget it comes from, still leaves out \(\DispatchAdmissionInterval\) and any reserve for it. This inspected level is an illustrative baseline chosen below dry concrete to tolerate light surface contamination; a production deployment must set this value from friction surveys across the designated routes and show how spill prevention or bounded cleanup maintains it between inspections. In the illustrative project records, restricted-mode operation remains provisional until the full timing budget, including dispatch-to-admission latency and the required reserves, is verified under load. Routes outside the facility inspection program are excluded from automated navigation.

Restricted operation requires an accountable owner who can keep the underlying physical premise true. Facility operations owns this entry through its maintenance and spill-response procedures along pallet-jack routes, setting inspection intervals and specifying the site conditions that pause automated traffic. While the signed speed ceiling in the onboard permission path enforces the motion limit, a software speed setting alone cannot keep the floor dry.

Every register entry must also state a closure test before data collection begins. To detect surface films online, the closure test must qualify an independent physical sensor, since standard visual cameras and lidars cannot resolve clear fluids on concrete. Alternatively, higher-traction floor coatings or physical barriers separating leaky equipment could support a revised claim through facility evidence. One candidate closure campaign evaluates an optical film detector, requiring a miss rate of at most 0.1 percent demonstrated across 2,995 zero-failure trials on seeded fluid films, the trial count required by the zero-failure sizing of Sample size requirements per empirical claim; until the sensor passes this test, the lower speed limit stays in force. Smaller test campaigns do not provide enough statistical confidence: zero misses across 1,000 independent trials bounds the miss probability only at 0.002991 at 95 percent confidence. In addition, the detector must see far enough ahead that sensing latency, permission processing, and braking finish before the wheels reach the fluid. Forward range, inference latency, false-alarm rate, and post-detection friction assumptions must all be declared in advance. Reactive wheel-slip reflexes can limit further acceleration once the wheels spin, but they cannot guarantee stopping distance before the tires hit the film.

While the target miss rate of 0.1 percent is chosen illustratively here, a production deployment must derive it from the site’s hazard budget. The detector works inside the conditional shield relation of equation 2, with fluid film encounters in place of hazardous action proposals. If films appear along transit routes at an arrival rate \(\FilmEncounterRate\) and facility engineering allocates a hazard budget \(\AllocatedHazardRate\) to this failure mode, the detector must satisfy \(\FilmEncounterRate\,\DetectorMissProbability \le \AllocatedHazardRate\). Choosing the risk allocation \(\AllocatedHazardRate\) is an accountable engineering judgment, whereas estimating the encounter rate \(\FilmEncounterRate\) comes from maintenance and spill logs.

Aisle navigation adds a second register entry: moving people at blind corners. Stopping-distance budgets are sized against stationary obstacles, so a person who keeps walking toward the mobile base during the stop consumes clearance distance that the budget never set aside. As shown in Sizing the composite stopping budget, accounting for a person walking toward the robot throughout the stop caps the permissible base speed at the rack corner far below normal transit speeds. The safety premise behind normal aisle speed assumes that no person walks out of the occluded cross aisle during an emergency stop, leaving a person’s presence in the hidden cross aisle as an unobserved state. Restricted service therefore requires physical barriers or access controls that block human cross-traffic during automated runs; painted floor lines do not satisfy this condition. Facility operations owns this restriction. A proposed blind-corner presence sensor cannot earn credit in the safety case until its field of view, latency, and miss rate pass qualification under the same zero-failure statistical standard applied to the film detector.

↩︎ Clearance eroded by a person approaching from an occluded cross aisle at walking speed is established in Forward State Propagation and Occlusion Decay.

The automated picking station adds a third entry, covering what the arm grasps. Its premise is that the object the gripper picks up, and then hands to a coworker through the accept_item interface, is the object the task names. As shown in Intent Grounding Failure Modes and Their Checks, semantic grounding can fail silently: when a thin-walled red glass jar sits alone where the red ceramic mug was expected, the grounding model mistakes the jar for the mug and still satisfies every geometric check in the planner and permission layers. The missing observables are object identity and crush strength, which neither wrist cameras nor visual foundation models can verify reliably before contact.

↩︎ The accept_item handover entry, which grants no motion authority and caps the arm’s approach to the coworker’s hand, is established in Capability matrices and the intervention-enforcement split.

Containing this hazard takes a two-part operating restriction. First, facility operations restricts conveyor loading to verified items from a declared stock-keeping unit (SKU) list that excludes fragile look-alikes. Second, the pick station admits a grasp only when optical singulation confirms a single object in the pick window; multiple objects abort the automated intent and route the tote to manual picking. Singulation removes geometric confusion among permitted items, but it does not measure what an object is made of; an off-list glass jar arriving alone is kept out only by upstream loading controls. Lowering the grip-force limit enough to protect fragile items would require measured crush limits for every item in inventory, which is itself an unverified physical assumption. Facility operations and the application engineering team co-own the item catalog and singulation rules. The closure test requires qualifying an automated check at the station, such as a radio-frequency identification (RFID) reader or a combined scale-and-barcode check, with a false-accept rate of at most 0.1 percent at 95 percent confidence across 2,995 failure-free trials with seeded look-alikes. Table 2 compares these three entries side by side, listing the four required components for each open premise.

Table 2: Residual-claims register for the aisle and the pick station: Proposed responses to three open premises behind the mobile manipulator’s aisle speed and its pick; operating credit requires the supporting evidence stipulated in the restricted-service branch. For each, the register names the missing physical observable, the hazard it permits, the operating restriction and its accountable owner, and the predeclared closure test that would retire the restriction.

Claim and missing state	Hazard mechanism	Active containment and owner	Predeclared closure test
Braking traction: every aisle floor supplies \(\CoulombFrictionCoefficient \ge\) 0.204; friction beneath a clear film is unobserved.	At \(\CoulombFrictionCoefficient\) = 0.05 the available deceleration falls to 0.49 m/s², and the known-component budget at 1.3 m/s already grows to 2.13 m against a 1.10 m clear distance.	Candidate in the actual records: 1 m/s on qualified, controlled floors (\(\CoulombFrictionCoefficient \ge\) 0.12); full timing and reserve must support it. Uncontrolled routes excluded. Owner: site operations, through the spill procedure for pallet-jack routes.	A floor-film detector with a miss rate of at most 0.1% at 95% confidence, from 2,995 failure-free seeded-film trials, plus timing and clearance tests; the restriction holds until it passes.
Walking person: no person approaches the rack end during a stop; presence in the hidden cross aisle is unobserved.	A person walking at 1.6 m/s through the whole stop would cap the base far below its aisle speed at the rack end (Sizing the composite stopping budget).	Controlled separation excluding continuing human approach during a stop; no credit for an unqualified presence sensor. Owner: site operations.	Qualify coverage, detection timing, and the complete response; 2,995 failure-free trials support a 0.1% miss bound at 95% confidence for the declared trial population.
Object identity: the object grasped is the object the task names; identity and fragility before contact are unobserved.	A confident grounding to a thin-walled glass jar in place of the absent mug passes every geometric check, and a grip the ceramic mug needs can crush the glass.	Feed control admits to the conveyor only items on the station’s declared list, none of them a fragile look-alike; singulation admits a grasp only with one object in the pick window. An off-list item arriving alone is contained only by the feed procedure. Owner: site operations, jointly with the task profile.	A qualified identity check at the station (tag read or scale-and-code) with a false-accept rate of at most 0.1% at 95% confidence, from 2,995 failure-free seeded look-alike trials; the restriction holds until it passes.

The register also holds a fourth entry, a timing premise, which the table leaves out because its hazard is the same overrun as the first row’s and only its missing evidence differs. Measured capture-to-dispatch latency excludes the downstream dispatch-to-admission interval. The placement allocation budgets that interval at 63.3 ms out of the 100.8 ms timing allowance at the aisle speed, leaving 37.5 ms of reserve. Stated in the register’s four elements, the missing observable is the loaded worst-case dispatch-to-admission interval, which steady-state inference benchmarks do not bound; because that interval remains unverified, the runtime systems team owns an active restriction that holds the aisle speed as an uncertified candidate rather than an authorized mode until a closure test—supported timing and response analysis under declared workload and resource bounds, challenged by loaded and adversarial measurements of both latency intervals—shows that the interval fits its allocation with positive reserve and meets the lease duration and renewal requirements of the execution contracts. The stipulated service branch assumes that timing evidence for its derated mode; in the baseline records the entry remains open.

Maintaining the restrictions

Writing an open assumption into a machine-readable register file does not turn it into a measured physical state: if the signed speed limits and site procedures are not wired into the release gate and daily floor work, the restriction exists only on paper. Operating restrictions in the register must therefore attach directly to the runtime enforcers and site workflows that govern daily operation. Cryptographically signed speed envelopes constrain the onboard permission path, while scheduled maintenance intervals bind facility operations. Release pipelines check that both controls are active in the authorized configuration, while runtime monitors enforce only the physical bounds that onboard sensors can read.

Model retraining or software updates must inherit every open restriction whose closure test has not yet passed. Release gates must check the signed operating limits and the status of their supporting evidence before authorizing a deployment. Dropping to a restricted mode requires its own validated safety case; an open register entry does not automatically clear a slower mode for service. At runtime, low-level controllers enforce speed ceilings and actuator limits, while facility crews maintain floor traction and conveyor loading rules at the scheduled intervals.

A restriction can also lapse in the middle of a motion, when a signed envelope expires, an inspection interval runs out while the base is in a route, or a deployment gate withdraws a mode. The lapse must hand over to the fallback ladder rather than to a generic stop. A trajectory chunk already executing inside the old restriction may finish only if its lease, state estimate, envelope, and supporting physical premises remain valid through completion. Withdrawing permission for new proposals can preserve an already admitted chunk under those conditions; loss of a premise that supports its execution cannot. Losing active permission altogether demands a physically feasible stop within the remaining budget, and the rung must match the state, because controlled deceleration, holding brakes at zero velocity, torque removal, and full power isolation produce very different transients. No register entry can replace those physical distinctions with a single emergency-stop primitive.

↩︎ The ladder of state-matched fallback responses, from minimal projection to complete torque removal, is established in The Fallback Ladder.

New sensors can justify wider operating envelopes only after they pass empirical qualification. Where real-time detection is impractical, the register must rely on a conservative action, passive containment, periodic proof testing, or a restricted operating domain—the responses to a hidden state that section 18.3.4.2 develops. Choosing among them requires knowing what hazard can unfold before the machine crosses its deadline, which is the subject of the next section.

18.3.4 Failures without detectors

An automated floor-film detector can retire the surface-friction restriction only if its coverage, false-alarm rate, and detection latency fit inside the route’s stopping budget rather than a standalone model benchmark. In the known-component budget, running at the candidate aisle speed leaves 131.0 mm of physical margin, which corresponds to an allowable delay of 100.8 ms. Setting aside 63.3 ms for dispatch-to-admission processing leaves 37.5 ms of timing reserve. That reserve is an upper bound on unallocated latency, not a certified budget for new perception pipelines, and it offers no protection against a pedestrian who keeps walking toward the robot during the stop.

A forward-looking fluid detector faces an even tighter spatial deadline. The required detection range, minus the distance the robot travels during sensor integration and neural inference, must cover the full dry-floor stopping distance before the tires reach the leading edge of the film: \[\RequiredDetectionRange \ge \SpeedAtDetection\,\DetectionInterval + \KnownComponentStopDistance(\SpeedAtDetection), \tag{3}\] where \(\KnownComponentStopDistance(\SpeedAtDetection)\) denotes the known-component dry-floor budget of notebook 18.2, the seven rows of The warehouse mobile manipulator's stopping budget. The detection interval \(\DetectionInterval\) covers only the film detector’s own work, from the moment the film enters its range to the moment it reports. That report is the observation that starts the pre-brake chain, so the observation age and admission already inside \(\KnownComponentStopDistance\) follow it rather than overlap it; where the two do overlap in a real pipeline, adding them is conservative. With a chosen sensing and inference latency of 100 ms at the 1.3 m/s aisle speed, the detector must see the film at least 1.10 m ahead. That range is almost exactly the 1.10 m clear distance, and not by coincidence: the dry budget and the spare together make up the clear distance, and the detector’s 100 ms of travel nearly equals the 100.8 ms that the spare buys. A detector that sees only as far as the clear distance therefore spends the whole timing allowance by itself, leaving nothing for the 63.3 ms dispatch-to-admission allocation; to fit beside that allocation, its latency must stay under the 37.5 ms reserve, or its range must grow. If classification occurs only after the drive wheels enter the fluid, the stopping distance expands to 2.13 m, far beyond the 1.10 m clear distance. A classification received after the wheels cross onto the film can serve incident analysis, but it arrives too late to avert the collision.

Observational indistinguishability and the action deadline

When an oil film and dry concrete produce identical camera and lidar readings until the robot is already inside its dry-floor stopping distance, no classifier running on those sensors can trigger a stop in time. That limit is observational indistinguishability. Consider two physical world states, \(\SafeWorldState\) and \(\HazardousWorldState\). In state \(\SafeWorldState\), a commanded actuator trajectory \(\ControlInput(\TimeInstant)\) runs safely. In state \(\HazardousWorldState\), that same command \(\ControlInput(\TimeInstant)\) causes structural damage or human injury, requiring the permission path to trigger an emergency stop. The constraint governing this stop is distance rather than elapsed time: because braking changes the robot’s speed along its path, the point of harm is a place in the room. Let \(\RemainingHarmDistance\) denote the remaining distance to that boundary when the distinguishing observation arrives. An emergency stop finishes short of the hazard only if: \[\RemainingHarmDistance \ge \SpeedAtDetection\,(\EnforcerComputeTime + \ActuatorResponseTime) + \BrakingDistance(\SpeedAtDetection), \tag{4}\] matching the physical stopping relation used throughout this book. The enforcer’s compute time and the actuator’s response time together act as the pre-brake delay \(\PrebrakeDelay\), counted from the arrival of the distinguishing observation rather than from a fixed capture event, and \(\BrakingDistance(\SpeedAtDetection)\) is the braking distance of the chosen stop. Dividing this distance constraint by the approach speed gives an equivalent observation deadline: \(\DeadlineInstant = \HarmInstant - \EnforcerComputeTime - \ActuatorResponseTime - \BrakingDistance(\SpeedAtDetection)/\SpeedAtDetection\), where \(\HarmInstant\) is the instant the unbraked trajectory would reach impact. A common mistake subtracts the full stopping duration \(\StoppingDuration\) instead of the speed-normalized distance \(\BrakingDistance/\SpeedAtDetection\), treating the robot as if it kept moving at full cruising speed until the instant it came to rest. For the jerk-limited profile from 1.3 m/s, braking lasts 931.2 ms but covers a distance equal to only 465.6 ms of constant-speed travel. Writing the deadline purely in time over-reserves 465.6 ms, or 605.3 mm of clearance, an error larger than the entire 131.0 mm spare. The time form errs on the safe side, but it refuses operating modes that the distance form rightly admits. Manipulator contact follows the same logic: once an end-effector touches a stiff surface, contact force rather than position sets the observation deadline (Intentional contact and in-contact energy barriers).

Charging the full stop time over-reserves several times the entire spare.

If the sensor stream \(\MeasurementVector(\TimeInstant)\) produced under state \(\SafeWorldState\) matches that under \(\HazardousWorldState\) up to \(\DeadlineInstant\) for every admissible control input, no algorithm acting on those measurements can tell the safe state apart from the hazardous state in time to prevent harm:

Definition 18.1: Observational indistinguishability

Observational indistinguishability is the condition in which two physical states that require different responses produce the same observation history, under every input the machine may admissibly apply, until the deadline by which a state-specific response must begin.

Significance: It turns an observation limit into a stopping-budget violation. The deadline is set by equation 4, so if the film and the dry floor look identical until the remaining distance falls below \(\SpeedAtDetection\,(\EnforcerComputeTime + \ActuatorResponseTime) + \BrakingDistance(\SpeedAtDetection)\), that evidence cannot justify continuing the dry-floor mode; the machine must instead use a response already qualified for both states or withhold that mode.
Distinction: Noise and weak detectors obscure information that more data or a better model can recover; indistinguishability means the information is absent from the channel. Unlike unobservability (definition 9.3), which asks whether a state can ever be reconstructed from the output history, it is tied to a deadline and to the inputs the machine may apply.
Common pitfall: A frequent misconception is that a more capable classifier on the same channel will eventually separate the states. Identical histories give every classifier identical inputs. A designed probe can separate states hidden under the current observation policy only when an admissible excitation reveals a difference before the deadline; if every admissible input leaves the histories identical, the response requires a new channel or an action valid in both states.

↩︎ The observation contract, which bounds the age and error of what a channel reports but cannot certify a state the channel never carries, is established in The Observation Contract.

⁵ Auxiliary Signal Design: The multimodel method computes a small test input that guarantees the normal model and each declared failure model produce different outputs within a fixed test horizon, despite bounded disturbances (Campbell and Nikoukhah 2004). A probe can therefore rule out only the failures someone wrote down as models, which is why the hidden premise must first be named in the register. The input bound and the horizon map onto this chapter’s budgets, since the probe must fit the force envelope and the separation must arrive before \(\DeadlineInstant\).

Campbell, Stephen L., and Ramine Nikoukhah. 2004. Auxiliary Signal Design for Failure Detection. Princeton University Press.

The qualification under every input the machine may admissibly apply matters because whether two states look different often depends on how the machine excites the plant, as shown in nonlinear observability theory (Hermann and Krener 1977). In some settings, an engineer can inject a small, safe control test input that makes the two states produce different sensor readings before the deadline. This technique is active probing: applying a bounded test excitation to expose hidden state differences in the sensor stream before the action deadline, the same excitation that Observability Ceilings and Estimation Limits uses to expose a drifting force-sensor bias. Active probing draws on auxiliary signal design⁵ from fault detection (Campbell and Nikoukhah 2004). For example, a controlled tug at a qualified proof load can check whether a door latch holds at that load before the arm commits to its full pull, though it does not measure the latch’s remaining yield margin. On the floor, a brief torque pulse at low speed, applied before the base enters a route, makes the wheels slip measurably on a film and not on dry concrete, turning the friction under the tires into telemetry. Such a slip check measures only the patch of floor the wheels already stand on; it cannot see a film ahead, which is why the forward detector above has its own range condition. Active probing costs time and disturbs the motion, and both costs must fit inside the safety budgets. Where no admissible probe can separate the states within the timing budget, the design must fall back on conservative actions or passive mechanical containment.

Responses when the state remains hidden

When physical states remain hidden under the current observation policy, software algorithms lack the evidence for state-specific branching logic. Five responses address that gap in different ways. When an admissible excitation can separate the states before the deadline, active probing supplies the missing observation online; if every admissible input leaves them indistinguishable, the remaining four responses must carry the claim without online separation. Proof testing measures the state from outside the runtime channel at scheduled intervals—such as an unloaded tare of a sensor or a load test of a latch—and covers the time between tests by argument, whereas a conservative action chooses a command safe in both candidate states, such as a speed low enough for the film. When control commands alone cannot bound the interaction, passive containment limits the physical consequence mechanically—such as a compliant element that caps contact force whatever the software believes—and a restricted operational domain withholds authority altogether from states that cannot be told apart, such as routes without a spill procedure. The register entries above already used the conservative action and the restricted domain, and active probing was shown at the latch and the floor; the wrist sensor and the latch below show proof testing and passive containment at work on the running machine.

Sensor drift is the slow form of the same barrier. The wrist strain gauge of Observability Ceilings and Estimation Limits, whose bias wanders as thermal cycles and mechanical stress relaxation alter its bridge resistance, reports only the sum of contact force and bias, so a drifting bias and a real change in force produce the same reading and a zero innovation. What this chapter adds is the choice of response. Every contact threshold that depends on that signal inherits the drift, and no response chosen at runtime can see it, so the response must be proof testing: an unloaded tare or a proof-test fixture at an interval short enough that the drift accumulated between tests stays inside the threshold’s margin.

↩︎ Mechanical degradation and thermal calibration drift as continuing obligations of a release verdict are established in Degradation, drift, and observation cadence.

⁶ Proof Test: Functional safety defines a proof test as a periodic test that reveals dangerous failures no online diagnostic can detect, so that the function can be restored to its as-new condition (International Electrotechnical Commission 2010). A hidden failure that arrives at a constant rate \(\ComponentFailureRate\) is present, on average over a test interval \(\Time\), for a fraction of about \(\ComponentFailureRate \Time/2\) of the time when \(\ComponentFailureRate \Time\) is small. The interval is therefore itself a safety parameter, because it bounds how long a weakened latch can go unseen.

International Electrotechnical Commission. 2010. IEC 61508:2010: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems. International Electrotechnical Commission.

A weakened door latch poses the same observability barrier on a millisecond timescale. Before the metal yields, joint torque sensors read the same reaction force against a fatigued latch as against a sound one, so the torque channel carries no information about how much yield margin remains. Because plastic yield is permanent, no software command sent after the latch bends can undo the damage, and running a faster classifier on joint torque signals adds zero protection. A credible safety strategy must bring in information from outside the runtime torque channel. Scheduled proof tests⁶ check that the latch survives a specified proof load at fixed intervals, without measuring its ultimate yield strength. Even so, proof testing holds only if maintenance records show that fatigue, wear, and corrosion cannot push the latch’s yield strength below the arm’s contact ceiling between tests.

Adding a passive compliant element to the structure can mechanically cap interaction forces across a qualified deflection stroke, the principle behind series elastic actuators (Pratt and Williamson 1995) and mechanical torque limiters. Two physical conditions govern compliant load paths, both set by the stroke the arm actively drives after contact detection rather than the total uncompressed spring length. When a contact tripwire \(\ContactTripwireForce\) triggers, the arm keeps moving during its controller response latency \(\ContactResponseLatency\) before decelerating at rate \(\ArmStoppingDeceleration\), driving the mechanism through a post-contact stroke of \(\PostContactDrivenStroke = \SpeedAtDetection\,\ContactResponseLatency + \SpeedAtDetection^2/(2\ArmStoppingDeceleration)\). To keep the contact force below the declared strength floor \(\LatchStrengthFloor\) (a lower bound on the latch’s strength, unrelated to the floor friction), the equivalent stiffness \(\EquivalentSeriesStiffness\) of the combined series load path (compliant element and strike plate) must satisfy equation 5: \[\ContactTripwireForce + \EquivalentSeriesStiffness\,\PostContactDrivenStroke \le \LatchStrengthFloor \quad\Longleftrightarrow\quad \EquivalentSeriesStiffness \le \frac{\LatchStrengthFloor-\ContactTripwireForce}{\SpeedAtDetection\,\ContactResponseLatency + \SpeedAtDetection^2/(2\ArmStoppingDeceleration)}. \tag{5}\] In addition, the compliant element’s allowable stroke must exceed its deflection under the peak allowable force, \((\LatchStrengthFloor-\CompliantElementPreload)/\CompliantElementStiffness\), so the spring never bottoms out against a hard stop. The threshold \(\LatchStrengthFloor\) is not the latch’s actual yield strength, which remains unobserved between proof tests; it is a chosen lower strength bound recorded as an assumption in the register until physical evidence supports it. Accountable judgment chooses the design bound; it cannot create material strength.

Pratt, Gill A., and Matthew M. Williamson. 1995. “Series Elastic Actuators.” Proceedings of the 1995 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) 1: 399–406. https://doi.org/10.1109/IROS.1995.525827.

The warehouse door latch shows what passive compliance buys. During a guarded approach at 0.03 m/s, meeting a stiff strike plate of stiffness 4.0 × 10⁵ N/m satisfies equation 5 with a required arm deceleration of 2.95 m/s², matching the guarded latch stop derived in Intentional contact and in-contact energy barriers. At a faster approach speed of 0.10 m/s, however, the same stiff contact would require an impossible arm deceleration of 400 m/s², forcing the permission path to refuse the trajectory. Holding arm deceleration to the guarded stopping bound instead drives the arm through 1.89 mm after it crosses the 15 N tripwire, capping the allowable series stiffness at 44.9 kN/m. Because series compliance combines inversely (\(1/\EquivalentSeriesStiffness = 1/\CompliantElementStiffness + 1/\LatchPlateStiffness\)), pairing the compliant element with the strike plate requires a spring stiffness of at most 50.5 kN/m and an available stroke of at least 2.0 mm to stay within the 100 N design force.

This quasi-static calculation assumes the actuator drive actively applies braking torque throughout the post-tripwire stroke. If the safety response instead cuts motor torque completely, the arm’s effective mass 12 kg coasts into the spring, and energy conservation sets the peak force. A spring compressed to force \(\SpringCompressionForce\) stores potential energy \(\SpringCompressionForce^2/(2\EquivalentSeriesStiffness)\); at the tripwire, the spring already holds \(\ContactTripwireForce^2/(2\EquivalentSeriesStiffness)\), and the coasting mass adds its kinetic energy \(\EffectiveImpactMass{}\SpeedAtDetection^2/2\). The resulting peak impact force is \(\sqrt{\ContactTripwireForce^2 + \EquivalentSeriesStiffness\,\EffectiveImpactMass\,\SpeedAtDetection^2}\), the dynamic impact regime that governs high-speed robot collisions (Haddadin et al. 2009). With the series spring installed, this coasting peak is 74.9 N, below the 100 N that the braked case reaches. That result is not a paradox. The stiffness bound was sized for a drive that holds the arm to the gentle 2.95 m/s² stop and so keeps pushing through the whole 1.89 mm stroke, bringing the force right to the floor. With torque removed, nothing pushes; the spring alone slows the 12 kg effective mass, harder than that commanded stop, and halts it in a shorter stroke at a lower force. Striking the stiff plate without compliance, by contrast, produces peak forces of 219.6 N at the faster approach speed and 67.4 N under the guarded approach. Within the qualified approach-speed and stroke envelope, the compliant element keeps both modeled responses at or below the latch’s declared design strength; driving beyond that stroke would bottom out the spring and break the bound. Even so, passive compliance does not verify latch strength: qualification must still test damping, material fatigue, and structural load paths rather than spring stiffness alone.

Haddadin, Sami, Alin Albu-Schäffer, and Gerd Hirzinger. 2009. “Requirements for Safe Robots: Measurements, Analysis and New Insights.” The International Journal of Robotics Research 28 (11–12): 1507–27. https://doi.org/10.1177/0278364909343970.

A series spring keeps the coasting peak under the declared 100 N floor.

The door latch, the oil film, and the packaging tab pose the same problem. When a safety premise cannot be evaluated before an execution deadline, the first question is whether an admissible probe can separate the states in time. If it can, active probing supplies the missing observation; otherwise proof testing, a conservative action, passive containment, or a restricted operational domain must support the claim. The choice among them depends on the claim each response can support and the evidence needed to maintain it, and every such mitigation must also state the evidence that would retire it.

Checkpoint 18.2: Premises no sensor reports

The warehouse machine’s hardest limits are premises its own telemetry cannot check, and each one needs an entry, a restriction, and a response chosen before the deadline.

Friction estimate: A friction survey measures an aisle at \(\CoulombFrictionCoefficient\) = 0.15. Given the 2 m/s² braking bound, compute the available deceleration from equation 1 and determine whether the brake or the floor binds.
Register entry: For the weakened door latch, state the four components of its register entry: the missing observable, the restriction, the owner, and the closure test.
Shield credit: Explain why equation 2 gives no credit against the oil film, and identify which term the film would enter.
Hidden-state responses: For a state hidden under the current observation policy, identify the five possible engineering responses, determine when active probing is available, and classify the series spring at the latch.

18.4 Choosing the Next Capability

Pouring engineering effort into a faster proposer when an unmeasured floor or an unseated tab actually limits the cell leaves the operating restriction in place. In a deployed packaging cell, restricted transit speeds and human-supervised sign-offs call for different investments: speeding up proposal generation improves throughput inside the current safety envelope, whereas qualifying a new contact or engagement sensor can retire the need for human sign-off altogether. Each advance requires two deliverables: a predeclared task metric and a physical test of the operating premise it changes. Tuning execution inside an existing envelope and gathering the evidence to widen that envelope are distinct engineering programs, and the register’s open entries decide which one the next capability needs.

18.4.1 Match the experiment to the missing evidence

Treating every open entry in the residual-claims register by training another neural detector fails whenever the missing evidence is a field evaluation, a mathematical bound, or a fallback that the body cannot execute. The open entries do not all call for the same kind of work; each falls into one of four gap classes, and the class, not the entry’s urgency, decides which experiment can close it:

Unmeasured observables require dedicated sensors that can tell the relevant physical states apart before the action deadline passes.
Evaluation deficits require randomized field trials or statistical estimators that represent the actual operating population while accounting for correlated samples and rare tail events.
Theoretical deficits require bounded analytical arguments whose physical premises can be proved mathematically or tested on the actual hardware plant.
Scope mismatches require changing the system architecture or narrowing the operational design domain.

Naming the exact gap class directs the next experiment to the evidence a register entry actually lacks, turning the open premises in the claims register into distinct work programs. Undetected floor films, hidden cross-aisle pedestrians, ambiguous object identities, and unseated packaging tabs are unmeasured observables; each calls for either a qualified sensor channel with a tested miss bound or an operating restriction that avoids the hazard, such as the downstream manual inspection that stands in for the tab sensor. Loaded dispatch-to-admission timing requires a supported timing bound under declared workload and resource limits, challenged by loaded and adversarial latency measurements. By contrast, the coverage factor \(\ShieldInterceptionCoverage\) for a safety shield requires statistical qualification on the declared population of hazardous proposals, whereas finite stress tests alone cannot establish a worst-case timing bound. Gaps between formal plant models and physical hardware are theoretical deficits, requiring robust control bounds. A scope mismatch differs from all three because no measurement, trial, or proof inside the current architecture can fix it. Claiming a de-energized safe stop for a balancing biped is the clearest example: cutting torque is itself the hazard, so the remedy is a different fallback architecture or a narrower claim, as section 18.4.3 discusses.

Statistical extreme value theory bounds rare tail exceedances only when its asymptotic and independence assumptions hold; fitting a parametric curve to test data cannot validate unmodeled contact physics or reveal unobserved floor friction. Similarly, Hamilton-Jacobi reachability analysis yields invariant sets only for an explicitly declared plant and disturbance bound. Moving an unverified friction assumption from field testing into a rigid-body simulator or an analytical proof leaves it just as unverified as before.

↪ Extreme value theory and its asymptotic and independence assumptions are developed in Extreme Value Theory and Tail Risk.

↪ Hamilton-Jacobi reachability and its declared disturbance model are developed in Hamilton-Jacobi reachability and worst-case differential games.

18.4.2 What a restriction costs

Knowing which experiment would close an entry does not say whether running it is worth the cost. An entry in the residual-claims register can buy protection at a throughput cost. On the warehouse machine, the oil-film restriction lowers cruising speed along the aisle from 1.3 m/s to 1 m/s, imposing a 23.1 percent speed penalty. At steady cruise, this derating stretches transit time across each 30 m aisle segment from 23.1 s to 30 s. That single constraint adds 30 percent more transit time per leg before accounting for acceleration profiles and docking maneuvers. Because transit time scales as \(1/\SpeedAtDetection\), the percentage increase in leg time exceeds the percentage cut in speed.

An operational restriction remains in force until its closure test passes. That test carries a tangible empirical cost: the 2,995 seeded-film physical trials specified in the register, for example. The separate claim about safety shield coverage requires 29,956 seeded hazardous proposals; that campaign does not close the film entry. The claims register therefore confronts systems engineers with an economic optimization problem alongside the technical one. On throughput savings alone, a formal closure campaign pays back when the cumulative value recovered exceeds the combined cost of the test campaign and the sensing instrument it qualifies. A full investment decision must also account for changes in exposure, maintenance, and the value of newly supported tasks. An operational restriction can remain the economical choice when its physical premise can be maintained reliably at low cost, such as through qualified cleaning and spill-control procedures along a few pallet-jack routes. Evaluating this trade-off requires site-specific parameters: the economic value of a completed task, the machine’s active duty hours on restricted routes, and the marginal expense of executing controlled test trials. In the absence of proprietary site economics, time provides the universal benchmark that transfers directly across facilities.

The same operational accounting governs fleet deployments. When commercial logistics facilities contract bipedal humanoids under robots-as-a-service agreements (GXO Logistics 2024), commercial performance is measured by volume moved, 100,000 totes at an initial customer facility by late 2025 (Agility Robotics 2025). In these operational environments, physical interventions, speed restrictions, and withheld autonomy modes can reduce completed-task throughput; their billing effect depends on the service contract. The gating criteria established during release validation translate directly into ongoing operating expenses.

GXO Logistics. 2024. GXO Signs Industry-First Multi-Year Agreement with Agility Robotics. Press release, 27 June 2024.

Agility Robotics. 2025. Digit Moves over 100,000 Totes in Commercial Deployment. Agility Robotics, 20 November 2025.

Bainbridge, Lisanne. 1983. “Ironies of Automation.” Automatica 19 (6): 775–79. https://doi.org/10.1016/0005-1098(83)90046-8.

Intervention rates incur a double cost. Frequent human takeovers consume costly labor hours and tether fleet operations to local technician availability. Conversely, rare interventions introduce the classic ironies of automation: an operator who seldom intervenes struggles to maintain the situational awareness and manual dexterity needed when an emergency takeover occurs (Bainbridge 1983). A defensible business case therefore reports proposer autonomy, whole-machine task success, and protective responses separately, as the first fallacy in section 18.5 insists, because each carries a different price.

↩︎ The labor a deployment moves onto technicians, sweep crews, and remote assistants, and the uses of their data it bars, are established in The Labor the Machine Moves.

18.4.3 Research that changes an engineering result

Transferring a generalist policy from a stationary dual-arm cobot to a wheeled mobile manipulator, or cutting motor power on a balancing biped in mid-stride, breaks the assumptions that certified the original machine. In physical AI, research warrants industry and academic investment when its resolution improves useful task performance within justified limits or supplies support for a broader operating claim. As of 2026, six central challenges define the frontier of embodied machine learning. Each stresses one of the four laws and falls into one gap class of section 18.4.1, and each has a stated form of evidence that would count as progress. Table 3 collects them with the current state of practice, and the discussion that follows states the systems principle beneath each.

Generalist and cross-embodiment policies stress the fourth law, permission must be earned, because evidence gathered on one body and one model version must now earn permission for another. A single pretrained vision-language-action (VLA) foundation model can now control diverse kinematics. For example, flow-matching architectures have been trained across single-arm, dual-arm, and mobile manipulation platforms from a unified model (Black et al. 2024), using heterogeneous embodiment datasets. Modern pipelines continuously fine-tune from production deployments via reinforcement learning with human interventions (Physical Intelligence et al. 2025) or remap learned trajectories across distinct kinematic morphologies (Gemini Robotics Team 2025).

↩︎ Why demonstrations logged on one embodiment carry its dynamics and do not transfer unchanged to another is established in Cross-Embodiment Transfer.

However, empirical safety evidence compiled on a dual-arm cobot cannot be assumed to hold when that same policy executes on a mobile manipulator. Furthermore, policies that continually adapt in production require reopening the release claims whose supporting evidence depends on the changed behavior (Maintaining Release Through Updates). The enduring challenge is establishing formal transfer guarantees across both physical embodiments and continuous model updates. Concrete progress requires rigorous transfer arguments with explicit kinematic and dynamic equivalence conditions, verifiable by predicting a new morphology’s closed-loop failure distributions before physical deployment. The cross-embodiment paradigm also reinforces the necessity of an independent permission pipeline: physical protection limits are calibrated to each specific mechanical chassis and remain invariant regardless of how frequently upstream generalist weights are updated.

Data scaling is the empirical frontier of the second law, endogenous data. Large-scale empirical studies encompassing more than 40,000 real-robot teleoperated demonstrations indicate that out-of-distribution generalization across novel environments and visual scenes follows an approximate power law governed by environmental diversity, whereas collecting redundant demonstrations within identical scenes shows sharp diminishing returns (Lin et al. 2025). In physical systems, structural diversity rather than raw sample count dictates data utility.

The open challenge is determining whether these empirical scaling laws generalize to contact-rich manipulation, long-horizon multi-step planning, and safety-critical edge states. In embodied settings, an agent’s closed-loop control actions actively determine its subsequent perceptual distributions, concentrating risk in rare, unmodeled corner cases. Meaningful progress requires publishing verified scaling curves that measure tail-risk closed-loop failure rates within declared operational design domains (ODDs), replacing benchmark evaluations that measure only average-case task completion rates.

↩︎ Why the diversity of pooled demonstrations, not their raw count, governs their value to a target task is established in Choosing pooled experience for the target task.

Generative world models also stress the fourth law, because they offer a way around the physical exposure wall only if their rollouts count as evidence. Latent dynamics formulations and high-fidelity video generation models increasingly act as general-purpose physics simulators (NVIDIA et al. 2025; Assran et al. 2025). Researchers have begun deploying these generative models directly as policy evaluators, demonstrating strong correlation with real-robot task execution on benchmark tasks (Jeon et al. 2026). Synthetic rollouts execute at massive parallel scale for a fraction of the cost of physical hardware hours.

Nevertheless, strict evidentiary limits constrain synthetic evaluation. A learned world model may estimate latent physical variables, but its training fit does not validate those estimates in unobserved regimes or justify extrapolating friction discontinuities or structural compliance omitted from its training distribution. The critical research question is establishing when synthetic evaluation in a learned world model constitutes valid evidentiary support for real-world release claims. Genuine progress requires formalizing proxy-transfer bounds (Simulation as a conditional proxy) validated against the empirical tail of real-world physical failures rather than aggregate nominal success, accompanied by end-to-end dataset and architecture provenance tracking.

↩︎ Provenance records for learned world models, binding architecture, checkpoint, and dataset lineage, are established in Learned world models as simulators.

⁷ Fail-Passive and Fail-Operational: Avionics separates a fail-passive function, whose failure causes no significant deviation of path or attitude and hands the task back to the crew, from a fail-operational one, which keeps performing through a failure. Removing torque from a wheeled base is fail-passive in this sense only after it reaches a qualified, mechanically restrained rest. A balancing biped in mid-stride has no such resting state, so its posture control must remain operational until the machine reaches a supported rest, and the certifiable reaction must be a controlled one.

Dynamically stable machines, such as bipedal humanoids and high-speed quadrupeds, are the most stringent test of the first law, irreversibility. As highlighted in Perspectives 4.2, 7.2, 13.1, and 16.1, the entire architectural chain of proposal, permission, and admission applies directly to balancing robots, with one catastrophic exception: fallback safe states. For the wheeled platform or stationary manipulator considered here, the fallback first reaches a qualified, mechanically restrained standstill before removing drive torque. On a balancing biped in mid-stride, cutting motor power induces an unrecoverable ballistic fall, transforming the safety mechanism into the primary hazard. Instead of bringing the system to an immediate stop, a balancing machine must execute dynamic recovery maneuvers: taking a stabilizing step, initiating a controlled crouch, or executing an active powered descent to a mechanically supported resting posture. Traditional functional safety standards, however, were built around fail-passive de-energization (the torque-removal rungs of the fallback ladder, which The four rungs of the fallback ladder treats as fail-safe only for a plant already at a mechanically restrained standstill), creating what safety researchers term the fail-passive gap⁷ (Ding et al. 2026). Bridging this divide requires certifying active closed-loop balance stabilization as a safety-rated critical function. Demonstrating meaningful progress requires designing certifiable dynamic reaction chains, analogous to automotive emergency braking profiles, that reliably steer the robot from each qualified gait phase under the declared fault conditions into a stable, supported configuration within bounded peak power and kinetic energy budgets. The most capable learned machines are thus the ones for which a safe stop is hardest to define.

Contact-rich, dexterous manipulation centers on physical AI’s canonical unobserved state: high-frequency contact interaction. Determining whether a snap-fit latch yields, a packaging tab seats, or a fragile container begins to crush cannot be reliably deduced from joint motor currents or external RGB-D cameras alone. High-resolution tactile sensing provides a direct channel for several of these contact dynamics; each claimed observation still needs qualification for its materials, geometry, and deadline. Modern vision-based elastomeric tactile sensors directly capture surface deformation fields, contact geometry, and distributed shear stresses at the end-effector (Yuan et al. 2017).

↩︎ Optical elastomer tactile sensing and its timing and calibration obligations are established in Tactile contact sensing.

Tedrake, Russ. 2023. Robotic Manipulation: Perception, Planning, and Control. Massachusetts Institute of Technology.

Closing the loop on contact, however, challenges the third law, proposal is not permission. Contact forces escalate within milliseconds of initial impact, far outstripping the round-trip latency of high-level neural planners and placing strict burdens on low-level passive or series elastic compliance (section 18.3.4.2). The open engineering challenge is integrating tactile feedback into the formal permission path. Concrete progress requires qualifying tactile perception channels with rigorous statistical miss rates for incipient slip and shear yield, coupled with low-latency impedance controllers whose force limits can be deterministically verified and bounded by safety hardware (Tedrake 2023).

Certifying learned models that directly implement safety functions is the central challenge of the fourth law. Although such components are assigned the notified-body route of The standards map for the running machine, the robotics industry lacks standardized methodologies to certify deep neural networks at automotive or industrial safety integrity levels (SIL) or PL, because current verification techniques face stark limitations. Exact satisfiability modulo theories (SMT)-based and mixed-integer linear programming verification tools can establish formal input-output properties over declared neural network weights (Katz et al. 2017), yet these proofs remain vulnerable to open-world modeling gaps outside the declared plant and observations. Purely statistical validation collides with the exposure wall, requiring billions of physical test cycles to establish low target failure probabilities. Runtime safety filters and shield wrappers transfer the verification burden onto the shield’s own coverage and latency envelope (Hsu et al. 2024). The unresolved systems challenge is constructing hybrid safety arguments: composing analytical proofs where deterministic physics models are tractable with statistical bounds where perceptual models operate, and allocating risk budgets across both tiers. Until such composite certification arguments mature, the architecture developed here keeps learned proposers outside the safety-critical permission path. Verifiable progress requires publishing complete, audited conformity dossiers for learned safety components alongside their formal assurance cases.

Table 3: A research agenda keyed to the four laws, as of 2026: Each row names an open problem, the law it stresses, the gap class of section 18.4.1 it belongs to, and the evidence that would count as progress. The last column dates the state of practice and should be refreshed in later editions; the durable content is in the first four columns.

Open problem	Law stressed	Gap class	Progress would be	State of practice, as of 2026
Generalist, cross-embodiment policies	Permission must be earned	Evaluation deficit	Evidence that transfers across bodies and updates under a stated equivalence condition	One policy across several robot types (Black et al. 2024); learning from deployment with corrections (Physical Intelligence et al. 2025); motion transfer between embodiments (Gemini Robotics Team 2025)
Data scaling	Endogenous data	Evaluation deficit	Scaling curves on closed-loop failure rates inside a declared ODD	Roughly power-law gains in environment and object diversity, saturating in demonstrations per environment (Lin et al. 2025)
World models as evaluators	Permission must be earned	Evaluation deficit	A proxy-transfer condition validated on the failure tail	General world foundation models (NVIDIA et al. 2025; Assran et al. 2025); a world model built for policy evaluation (Jeon et al. 2026)
Fall-safe dynamically stable machines	Irreversibility	Scope mismatch	A certified, actively controlled reaction chain to a supported rest state	The fail-passive gap located in a humanoid pick-and-place cell (Ding et al. 2026)
Contact-rich, dexterous manipulation	Proposal is not permission	Unmeasured observable	A qualified tactile channel and a checkable contact-force bound	High-resolution vision-based tactile sensing (Yuan et al. 2017)
Certifying learned safety functions	Permission must be earned	Theoretical deficit	A published conformity assessment of a learned safety component	Third-party assessment required in the EU from 20 January 2027 (European Parliament and Council of the European Union 2023); network verification of declared models (Katz et al. 2017)

Black, Kevin, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, et al. 2024. “\(\pi_0\): A Vision-Language-Action Flow Model for General Robot Control.” arXiv Preprint arXiv:2410.24164.

Physical Intelligence, Ali Amin, Raichelle Aniceto, Ashwin Balakrishna, Kevin Black, Ken Conley, Grace Connors, et al. 2025. “\(\pi^{*}_{0.6}\): A VLA That Learns from Experience.” arXiv Preprint arXiv:2511.14759.

Gemini Robotics Team. 2025. “Gemini Robotics 1.5: Pushing the Frontier of Generalist Robots with Advanced Embodied Reasoning, Thinking, and Motion Transfer.” arXiv Preprint arXiv:2510.03342.

Lin, Fanqi, Yingdong Hu, Pingyue Sheng, Chuan Wen, Jiacheng You, and Yang Gao. 2025. “Data Scaling Laws in Imitation Learning for Robotic Manipulation.” International Conference on Learning Representations (ICLR), 54877–910.

NVIDIA, Niket Agarwal, Arslan Ali, Maciej Bala, Yogesh Balaji, Erik Barker, Tiffany Cai, et al. 2025. “Cosmos World Foundation Model Platform for Physical AI.” arXiv Preprint arXiv:2501.03575.

Assran, Mido, Adrien Bardes, David Fan, Quentin Garrido, Russell Howes, Mojtaba Komeili, Matthew Muckley, et al. 2025. “V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction and Planning.” arXiv Preprint arXiv:2506.09985.

Jeon, Byeongguk, Seonghyeon Ye, JaeHyeok Doo, Sungdong Kim, Minjoon Seo, Hyungmok Son, and Kimin Lee. 2026. “RoboWorld: Fast and Reliable Neural Simulators for Generalist Robot Policy Evaluation.” arXiv Preprint arXiv:2607.01060.

Ding, Caiwu, Tao Cui, Lingyun Wang, and Chengtao Wen. 2026. “Toward Certified Functional Safety for Industrial Humanoid Robots: The Fail-Passive Gap and a Feasibility Study.” arXiv Preprint arXiv:2608.02809.

Yuan, Wenzhen, Siyuan Dong, and Edward H. Adelson. 2017. “GelSight: High-Resolution Robot Tactile Sensors for Estimating Geometry and Force.” Sensors 17 (12): 2762. https://doi.org/10.3390/s17122762.

Katz, Guy, Clark Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer. 2017. “Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks.” International Conference on Computer Aided Verification (CAV), 97–117. https://doi.org/10.1007/978-3-319-63387-9_5.

Two systems challenges cut across all six problems. The first is continual online adaptation, which turns the model into a moving target: whether a proposer retrains asynchronously on aggregated fleet telemetry or adapts its latent state online to accommodate component wear and shifting terrain (Kumar et al. 2021), background model updates must never starve the permission pipeline of compute or bus bandwidth. The second is multi-robot fleet coordination, which couples otherwise independent permission boundaries: transmitting shared task intents across lossy wireless links cannot substitute for the local, hard-real-time sensor streams required by an individual robot’s admission gate, while physically cooperative manipulation of a shared payload directly couples actuator contact dynamics across platforms. Across all of these problems, advancing physical AI does not require abandoning established systems rigor; it requires extending it. Unlocking the next capability begins by isolating a concrete physical task that the current system cannot safely execute, identifying the missing empirical premise or unmeasured observable, and engineering the precise evidential argument required to justify expanding the machine’s operational envelope.

Kumar, Ashish, Zipeng Fu, Deepak Pathak, and Jitendra Malik. 2021. “RMA: Rapid Motor Adaptation for Legged Robots.” Robotics: Science and Systems XVII. https://doi.org/10.15607/RSS.2021.XVII.011.

18.5 Fallacies and Pitfalls

When engineers move physical AI systems such as the warehouse mobile manipulator or the packaging cell from isolated benchmarks to production floors, the traps that remain are conceptual. Every local calculation can succeed numerically while the system-level reasoning fails, because the team has misread how physical dynamics, learned proposers, and runtime enforcement relate. The traps below recur on both machines.

Fallacy: A protective intervention means the whole machine failed its task.

When a runtime safety governor or control barrier filter modifies an actuator command, engineers often mistakenly log the episode as a system-level failure. In practice, a least-change speed correction or torque clamp often allows an autonomous mobile robot or packaging arm to complete its physical mission smoothly within safe boundaries. If the warehouse machine enters a route whose floor is inspected only to \(\CoulombFrictionCoefficient \ge\) 0.12 and the governor trims its speed from the 1.3 m/s aisle speed to the register’s 1 m/s restricted mode for that floor, the delivery still completes; the leg simply takes 30 percent longer.

Treating every safety intervention as a mission failure corrupts operational telemetry. Conflating proposer interventions with unrecoverable task aborts conceals where engineering effort should be directed. Development teams must track three metrics independently: raw proposer autonomy (the fraction of time the learned model operates without override), whole-machine task success (whether the physical objective was achieved within operational deadlines), and protective intervention frequency. Decoupling these signals reveals whether system bottlenecks stem from policy distribution shift, sensor latency in the perception pipeline, or overly conservative governor tuning.

↩︎ Proposer autonomy, task success, and protective intervention as separately recorded outcome channels are established in What a Physical Success Rate Measures.

Pitfall: Treating a restriction as evidence that its physical premise holds.

Deriving a tighter operational limit does not guarantee that the physical environment satisfies the assumptions behind that limit. The register’s restricted mode for the warehouse machine, 1 m/s instead of 1.3 m/s, provides a stopping margin only on floors that hold \(\CoulombFrictionCoefficient \ge\) 0.12. Under the clear film, where \(\CoulombFrictionCoefficient\) falls to 0.05 and the available deceleration to 0.49 m/s², the lower speed setpoint carries no stopping guarantee at all; the restriction rests on the same unmeasured premise as the mode it replaced.

Digital artifacts cannot substitute for physical friction. Neither a signed configuration parameter in software, nor a clear path reported by an RGB camera, proves that the ground provides adequate traction. Vision pipelines readily mistake transparent oil or thin ice for dry concrete. A restricted envelope therefore needs its own premise kept true, through the inspection and spill procedure the register assigns to facility operations or through a qualified forward film detector. Monitoring wheel slip and inertial deceleration can reveal after the fact that a premise failed, and should trigger the restriction for later motion, but it cannot rescue the stop already under way. A safety envelope is only as credible as the physical premise beneath it.

Fallacy: More model capacity or simulated exposure settles every residual claim.

Scaling up neural network parameter counts or running billions of simulated training steps improves policy interpolation across modeled conditions, but neither technique can overcome an unmodeled physical reality. A deep learning policy cannot infer an unobserved physical state, such as internal material stress, micro-slip at a fingertip, or variable ground compliance, if the sensor suite lacks the transducers to measure it. Similarly, physics simulators rely on simplified approximations of rigid-body contact, Coulomb friction, and non-deformable geometry. Generating massive synthetic datasets within a simulator that omits real contact mechanics merely produces policies optimized for fictitious physical dynamics.

When an embodied system displays persistent edge-case failures, the solution rarely lies in adding more transformer layers or randomizing synthetic textures. Engineers must diagnose the specific physical claim that lacks empirical grounding. Resolving the defect requires choosing the appropriate engineering intervention: integrating a dedicated physical sensor to observe the missing state, introducing passive mechanical compliance to absorb unmodeled impact energy, constraining the operational design domain, or calibrating friction models against instrumented hardware trials.

Pitfall: Charging the full stop time against an action deadline.

An engineer who sizes the latest useful observation by subtracting the whole braking duration treats the machine as if it held its speed until it stopped instantly. For the jerk-limited stop from the 1.3 m/s aisle speed, braking lasts 931.2 ms but covers only the distance of 465.6 ms of travel at constant speed. The time form therefore over-reserves 465.6 ms, or 605.3 mm, more than the entire 131.0 mm spare.

The error is safe in the narrow sense that it never admits an unsafe stop, which is why it survives review. Its cost appears elsewhere. A deadline computed this way refuses operating modes the distance form correctly admits, and it hides how much timing allowance a new detector or a slower admission stage can still spend. The deadline belongs to the remaining distance, equation 4, with the braking term divided by speed, never to the stop’s duration.

Fallacy: A safety shield makes the proposer’s error rate irrelevant.

A shield attenuates hazardous proposals; it does not erase them. In notebook 18.3, a full release cycle of adjudicated proposals with no hazardous event still bounds the proposal rate only at 1.387 × 10⁻⁵ \(\text{h}^{-1}\). A shield with interception coverage 0.9999 then leaves a modeled residual of 1.387 × 10⁻⁹ \(\text{h}^{-1}\), above the 1 × 10⁻⁹ \(\text{h}^{-1}\) target even with the common-cause term set to zero. Meeting the target at that proposal bound would need coverage of 0.9999279, and showing the assumed coverage alone takes 29,956 seeded hazardous proposals with no miss.

The residual of equation 2 is a product, so both factors need evidence, and a common-cause failure that blinds the shield in the same states where the proposer errs lowers coverage exactly where it matters. The shield is the reason the proposer need not be perfect, not a reason to stop measuring how often it errs.

Pitfall: Qualifying a forward detector by its miss rate alone.

A floor-film detector that passes 2,995 failure-free seeded trials has a miss bound of 0.1 percent, and a team may treat that result as closing the register entry. Detection that arrives too late is a miss in every sense that matters to the stop. At the 1.3 m/s aisle speed with a 100 ms sensing and inference latency, equation 3 requires the detector to see the film 1.10 m ahead, about the whole 1.10 m clear distance, and at that range the latency leaves nothing for the 63.3 ms dispatch-to-admission allocation; to fit beside it, the detector’s latency must stay under the 37.5 ms reserve.

A detector that reports only once the wheels are on the film faces a 2.13 m stop, turning a statistically accurate classification into an unrecoverable overrun. The closure test must therefore predeclare range, latency, false-alarm rate, and the friction assumed after detection, alongside the miss rate, and qualify them together on the routes the restriction covers.

18.6 Summary

The warehouse mobile manipulator now carries one connected design argument, and the packaging cell shows that the same argument transfers to a machine with different mechanics, rates, and hazards. The book opened by asking why a better prediction can still produce a worse physical action, and the chapter’s answer is concrete. A neural network optimizes expected statistical loss over its training distribution, but the physical plant operates under continuous Newtonian mechanics, electromagnetism, and thermodynamics. A better proposer cannot supply the friction premise that an unobserved oil film removes, because no input it receives measures the tire-ground contact interface. It cannot make a derated operating mode evaluated, because the operational restriction that shortens the stop also displaces the proposer into physical configurations its training and evaluation never sampled. It cannot close a detectorless claim such as the glare-hidden packaging tab, because the physical sensor required to resolve that state does not exist on the machine. Nor can a faster forward pass recover the stopping distance already consumed while the vehicle cruised under unguided momentum (\(\BlindTravelDistance = \SpeedAtDetection \PrebrakeDelay\)). In each case, the physical outcome is judged by dynamics, timing, and environmental evidence that the learned prediction does not contain.

The learned model must therefore be engineered as an unprivileged component of a machine, with the rest of the machine supplying what the model lacks, one law at a time. The first law, irreversibility, turns the body’s kinetic, actuator, and thermal limits into budgets that bound any proposal, and the friction floor showed that a single unmeasured term can void those budgets. The second law, endogenous data, confines competence to the states the closed loop actually visits, which is why the packaging cell’s restricted mode opened a regime its evaluation never sampled. The third law, proposal is not permission, places an independent permission path between proposal and actuator, and the shield-dilution bound showed that this path improves a hazard-rate claim only for the hazards it can detect and intercept in time. The fourth law, permission must be earned, grants the machine only what its evidence supports, and the residual-claims register gives each unobserved premise a restriction, an owner, and a predeclared closure test. Table 4 collects the relations the chapter applied to both machines, what each bounds or decides, and where the book derives it.

Table 4: Key equations of the chapter: Each equation the chapter applies to the warehouse machine or the packaging cell, what it bounds or decides, and where the book derives it. The first two and the zero-failure count are derived in earlier chapters and reused here; the others are stated in this chapter.

Equation	What it bounds or decides	Where derived
\(\StoppingDistance = \SpeedAtDetection\PrebrakeDelay + \SpeedAtDetection^2/2\CredibleBrakingDeceleration\)	Whether a mode’s stop fits its clearance, and whether delay or braking dominates	equation 2.2
\(\SpeedBound = -\CredibleBrakingDeceleration\PrebrakeDelay + \sqrt{(\CredibleBrakingDeceleration\PrebrakeDelay)^2 + 2\CredibleBrakingDeceleration{}\AvailableBrakingDistance}\)	The speed ceiling a stopping budget admits	equation 2.3; jerk ramps in equation 12.2
\(\AvailableDeceleration = \min(\CredibleBrakingDeceleration, \CoulombFrictionCoefficient \Gravity)\)	Whether the brake or the floor binds, and the friction floor \(\CredibleBrakingDeceleration/\Gravity\)	equation 1
\(\SystemHazardRate \le \HazardousProposalRate(1-\ShieldInterceptionCoverage) + \HardwareCommonCauseRate\)	What a shield adds to a hazard-rate claim, and the coverage the claim needs	equation 2
\(\ZeroFailureTrialCount = \lceil \ln\HypothesisTestSignificanceLevel / \ln(1-\TrialFailureProbability) \rceil\)	Failure-free trials that bound a miss or false-accept probability \(\TrialFailureProbability\)	equation 7.5
\(\RequiredDetectionRange \ge \SpeedAtDetection\,\DetectionInterval + \KnownComponentStopDistance(\SpeedAtDetection)\)	The range at which a detector must report a hazard ahead of the machine	equation 3
\(\RemainingHarmDistance \ge \SpeedAtDetection\,(\EnforcerComputeTime + \ActuatorResponseTime) + \BrakingDistance(\SpeedAtDetection)\)	The latest point at which a distinguishing observation can still help	equation 4
\(\ContactTripwireForce + \EquivalentSeriesStiffness\,\PostContactDrivenStroke \le \LatchStrengthFloor\)	The stiffness of a passive element that bounds contact force	equation 5

Key Takeaways: Engineering a machine that senses and acts

Useful service joins the four laws: Body limits, learned competence, independent permission, and maintained evidence must support the same task; a better prediction strengthens only one link of that argument.
Competence can grow: New qualified experience, retraining, and regression evaluation can extend what the next candidate can justify.
Admission can preserve success: A minimally corrected proposal can complete useful work; proposer autonomy, task success, and protection require separate measures.
Restrictions need evidence: A lower speed still needs traction, clearance, and a feasible response. A stipulated supported branch teaches the release decision without turning illustrative records into measurements.
Residual limits select the next experiment: Missing observations, evaluation support, proof premises, and task scope call for different engineering responses.

The chain from body limits to a release decision can be carried through for any machine, but the chapter’s last lesson lies where that chain runs out. The running machine’s hardest limits were not its slowest computation or its weakest model; they were premises no sensor reports, a floor’s friction and a latch’s strength. Engineering judgment at that edge means naming such a premise, restricting the machine until evidence arrives, and choosing the next measurement, learning experiment, architectural change, or narrower domain by which open premise it retires. The Causal Boundary promised the ability to design, teach, integrate, evaluate, and maintain such a machine within justified operating limits, and to name, when the evidence is incomplete, what would support the next capability. That ability to build, verify, and justify a machine that senses and acts is the enduring discipline this book develops.

18.7 Historical Perspective and Further Reading

The architectural boundaries developed throughout this chapter emerged historically from hard limits of evidence, verification, and observability. Physical systems must operate in unconstrained environments where empirical testing alone cannot provide safety guarantees. Popper established the epistemological foundation of this constraint by demonstrating that no finite sequence of observations can verify a universal hypothesis, whereas a single counterexample refutes it (Popper 1959). In safety-critical software engineering, Butler and Finelli formalized this evidentiary barrier as the exposure wall (Butler and Finelli 1993). They proved mathematically that certifying catastrophic failure rates on the order of \(10^{-9}\) failures per operational hour requires billions of operating hours without failure, a testing volume no embodied fleet can accumulate. Decades earlier, civil aviation confronted this statistical impasse by establishing argued safety cases rather than relying solely on raw empirical testing. FAA Advisory Circular AC 25.1309 required airframers to allocate safety targets across subsystems, defining catastrophic failures as “extremely improbable” events backed by qualitative failure modes analysis and quantitative reliability budgets (Federal Aviation Administration 1988). Modern autonomous vehicle and robotics standards build directly on this methodology: UL 4600 mandates explicit, structured safety cases connecting claims, arguments, and evidence (UL Standards & Engagement 2023), providing the disciplined engineering framework that Koopman formalizes to evaluate when an autonomous system is safe enough for public deployment (Koopman 2022).

UL Standards & Engagement. 2023. ANSI/UL 4600 Ed. 3-2023: Standard for Evaluation of Autonomous Products. UL Standards & Engagement.

Seto, Danbing, Bruce Krogh, Lui Sha, and Alongkrit Chutinan. 1998. “The Simplex Architecture for Safe Online Control System Upgrades.” Proceedings of the 1998 American Control Conference (ACC) 6: 3504–8. https://doi.org/10.1109/ACC.1998.703255.

Ames, Aaron D., Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. 2019. “Control Barrier Functions: Theory and Applications.” 2019 18th European Control Conference (ECC), 3420–31. https://doi.org/10.23919/ECC.2019.8796030.

Knight, John C., and Nancy G. Leveson. 1986. “An Experimental Evaluation of the Assumption of Independence in Multiversion Programming.” IEEE Transactions on Software Engineering SE-12 (1): 96–109. https://doi.org/10.1109/TSE.1986.6312924.

European Parliament and Council of the European Union. 2023. Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June 2023 on Machinery and Repealing Directive 2006/42/EC and Council Directive 73/361/EEC. Official Journal of the European Union, L 165, 29.6.2023, p. 1.

The architectural separation between an unverified, high-capacity proposer and a deterministic permission path predates modern machine learning. In real-time fault-tolerant control, the Simplex architecture introduced by Seto et al. (1998) paired an unverified high-performance controller with a formally verified baseline safety controller. Simplex monitored invariant state boundaries, preempting the primary controller and transferring actuation authority to the baseline fallback within a bounded response time before the system drifted beyond its recoverable set. Sha generalized this mechanism into a fundamental principle of runtime assurance: verifiable safety requires architectural simplicity, isolating complex optimization policies from the verifiable deterministic envelopes that enforce physical invariants (Sha 2001). Modern control theory evolved this discrete switching paradigm into continuous, minimally invasive interventions. Control barrier functions define forward-invariant safe sets, computing least-effort corrections via real-time quadratic programming to enforce state constraints while preserving policy performance (Ames et al. 2019). Hsu et al. (2024) synthesize switching, reachability, and barrier mechanisms into a unified theory of safety filters. However, systems engineers must not mistake software diversity for statistical independence. Knight and Leveson demonstrated experimentally that multi-version software channels, developed independently against identical specifications, frequently suffer correlated failures when exposed to unanticipated corner cases (Knight and Leveson 1986). The European Union’s 2023 Machinery Regulation regulates self-evolving machine-learning components that ensure safety functions and requires documented safety limits that learning must not modify in ways that create hazards (European Parliament and Council of the European Union 2023). The separation developed in this book is one architecture for carrying those obligations into operation.

The final intellectual lineage concerns the limits of passive observation. In nonlinear dynamical systems, state distinguishability depends on the observation model and the inputs the system may apply. Hermann and Krener formalized this input-dependent notion of observability (Hermann and Krener 1977). Campbell and Nikoukhah turned this mathematical insight into active auxiliary signal design, synthesizing targeted perturbation inputs that force distinct dynamical responses between nominal and degraded operational modes within a bounded time horizon (Campbell and Nikoukhah 2004). This chapter grounds each of these lineages directly in physical hardware execution. Abstract evidence limits become concrete risk registers backed by operational design domains and closure tests. Runtime permission logic is charged directly against physical actuation latencies, sensor staleness, and worst-case stopping distances. Finally, epistemic observation horizons translate into spatial deadlines, requiring an embodied agent to obtain discriminating evidence or choose an action valid in the unresolved states before physical momentum carries it past its point of safe recovery.

Hermann, Robert, and Arthur J. Krener. 1977. “Nonlinear Controllability and Observability.” IEEE Transactions on Automatic Control 22 (5): 728–40.

For further reading, six works trace the core concepts joined in this chapter:

Butler and Finelli (1993) demonstrates in a few concise pages why neither black-box testing nor software reliability growth models can validate ultra-high reliability, establishing the exposure wall that bounds every statistical safety claim in physical systems.
Leveson (2011) formulates system safety as a dynamic control problem governing the entire sociotechnical lifecycle, providing the theoretical basis for assigning accountable owners and verifiable operational restrictions to residual hazard claims.
Sha (2001) articulates the core runtime-assurance argument that separates high-performance proposal from deterministic permission, an architectural pattern that this book develops as the foundation of safe physical AI.
Hsu et al. (2024) surveys modern safety filter formulations across control barrier functions, Hamilton-Jacobi reachability, and Simplex-style switching, making explicit the coverage assumptions and model fidelity priced by the shield-dilution calculations in section 18.3.2.
Campbell and Nikoukhah (2004) establishes the methodology of active fault detection through designed test inputs, providing the mathematical machinery needed to probe latent environmental hypotheses before actuation deadlines expire.
Koopman (2022) presents a rigorous, practitioner-oriented framework for setting, arguing, and validating autonomous system safety goals, detailing how open risk registers and explicit safety cases replace ungrounded empirical mileage claims.

Butler, Ricky W., and George B. Finelli. 1993. “The Infeasibility of Quantifying the Reliability of Life-Critical Real-Time Software.” IEEE Transactions on Software Engineering 19 (1): 3–12. https://doi.org/10.1109/32.210303.

Leveson, Nancy. 2011. Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press.

Sha, Lui. 2001. “Using Simplicity to Control Complexity.” IEEE Software 18 (4): 20–28.

Hsu, Kai-Chieh, Haimin Hu, and Jaime F. Fisac. 2024. “The Safety Filter: A Unified View of Safety-Critical Control in Autonomous Systems.” Annual Review of Control, Robotics, and Autonomous Systems 7: 47–72. https://doi.org/10.1146/annurev-control-071723-102940.

Koopman, Philip. 2022. How Safe Is Safe Enough? Measuring and Predicting Autonomous Vehicle Safety. Independently published.

What’s Next: From physical AI to the systems discipline

The next unfamiliar machine will bring a different body, task, and environment. Its engineering begins by tracing how observations become proposals and how admitted commands become force, motion, and heat. The methods developed here provide a way to teach useful behavior, integrate it with timely physical control, and determine which operating claims the resulting evidence supports. This work is dedicated to the students, researchers, and systems engineers who take up the challenge of giving machines safe and capable hands in an open physical world.

Prof. Vijay Janapa Reddi, Harvard University