Abstract

This disclosure describes how control of a governed robot passes safely between its own autonomy, a remote operator, a person on site and another robot. Control is held by exactly one controller at a time, represented by a signed control token issued by the robot's independent safety plane. A handover may be requested by the current controller, by the receiver or by the safety plane. Before control passes, the receiver is checked: a person must hold a current credential for this class of robot and this place, and a robot must pass a Know-Your-Robot check and hold a proving stage that covers the task. During the transfer, the stricter of the two controllers' limits applies. Each kind of handover declares a minimum notice, and if the receiver does not accept within the notice, the robot does not carry on as before but brings itself to a safe stop chosen from its safe-state map. A remote operator's control is bounded by the measured quality of the link: as delay or loss grows, permitted speed and force fall, and beyond a declared bound the robot holds or stops on its own. A remote operator can never drive the robot beyond its own certified limits, which remain enforced on the robot. The number of robots a single operator may control or supervise at once is capped by the safety profile. When control passes, the party who answers for the robot is updated at once in its live status, so that anyone checking the robot sees who is in control now. Every request, check, acceptance, refusal, transfer and timeout is a signed record.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Share

COinS