🤖 How Should Industrial Robots Behave During Authorization Revocation?

[Erkan Teskancan]

🤔 Physical AI and Critical Decisions​

What should a mobile robot do when its work order is suspended while it's closing an isolation valve on a leaking line? The work order was correctly issued, the movement is safe, the request is validated, and the robot is capable of doing the job. But now the authority behind the action has disappeared. The robot has three options: finish closing, stop in place, or reopen the valve. Each is a physical event with its own consequences. So, at what layer should the authority to decide the next step reside?

🛑 No Undo in the Physical World​

In the software world, when permissions are revoked, an "undo" command restores everything to its previous state. But physical actions are not atomic. A partially closed valve restricts flow, which most isolation valves are not designed for. Reopening it applies full pressure to the leak. Finishing the closure, however, might be the exact opposite of the new instruction if the control room has chosen to isolate a location closer to the leak and wants this line to remain in service. The same applies to a robot placing a heavy part, a partially completed dispensing cycle, or a partially laid weld.

Therefore, "stop" is not a single answer. The correct outcome depends on why the authority was withdrawn. A revised isolation plan, a suspended permit, or a change in operating mode might each require a different action.

✅ What Are the Existing Solutions?​

Most of these situations are actually familiar. PackML and ISA-88 define hold, stop, and abort states that operators or supervisory systems can command. This way, a running machine or batch phase already has defined outcomes. Actuated valves have designed fail positions. Stop categories in IEC 60204-1 distinguish between immediate power-off stops and controlled stops. Interlocks and operating permits, scanned in every controller cycle, can halt an ongoing action. Functional safety (IEC 61508, IEC 61511) should kick in if the partially completed state creates a hazard for which safety functions are designed.

When these mechanisms cover the case, the question is answered. It is important that this coverage is documented rather than assumed.

⚠️ Areas That Might Be Missing​

Safety functions and fail positions are designed for failures, hazards, and loss of power. Withdrawn authority is different. It is usually not a hazard: closing a valve despite a supervisor's new instruction might be perfectly safe but still wrong. A fail position is chosen once, at the design stage, for a single type of event. It cannot know why authority ended this time.

Physical AI adds two complexities. First, a robot operating a manual valve is outside the DCS and any PackML or ISA-88 state model, so it may not have a defined outcome other than its own safety posture. A human operator at the same point would receive a radio call and follow procedure; the question is whether the robot's dispatch path does the same. Second, an AI planner directed by enterprise systems is a new source of command. Its authority can be checked once, upstream, when the request arrives, and it can take time for a withdrawal to reach the actuator. Change management should capture this; it's worth checking if it asks what the outcome is and who approved it.

🔍 What Provides the Solution?​

This situation is testable. In representative deployments, there would be no obvious gap if the withdrawal of authority during action produced a predefined and approved outcome via control logic or procedure. The absence of actions completed after authority ended or left in an undefined state would also indicate this. Tests or incidents showing the opposite would point to a gap.

A simple pilot study can tell which is true: on a test rig or during commissioning, withdraw authorization at random points during actuation, record whether the effect stops, holds, reverses, or completes, and compare this to what should happen.

🎯 Four Questions to Ask About Your Systems​

• When authority is withdrawn, how long does it take to reach the actuator?
  
• For every ongoing action, is the outcome (completion, stop, hold, or reverse) defined and dependent on why the authority ended?
  
• Who approved this outcome and when?
  
• Can you later demonstrate what authority was present at every moment of the action?
  

If these answers are already available, physical AI has a solid foundation. If not, the outcome may need to be determined when an action is authorized, not improvised afterward. In either case, a machine that can do something, by that very fact, is not permitted to do so, and this applies as much to how it stops as to how it starts.