What physical AI must record

The gap

ISO 25785-1, still an unpublished committee draft, will say what a robot must do. UL 4600 says how to structure a safety case. Nothing says what the machine must record so that case can be built.

Retention is already an obligation. EU AI Act Art. 19 and Art. 26(6) put a six-month floor under it, and for the half of such a record that identifies a person, data-protection law can turn that floor into a ceiling. Operators are required to keep something and told nothing about what.

Robotics is not starting from zero here. Winfield and Jirotka made the case for an ethical black box in 2017 and gave it a draft data specification in 2022. What robotics has is a proposal. Automated driving has a mandate: UN R157 carries the DSSAD provisions, a required retained event recorder that stores discrete events rather than continuous state. A proposal is something to build on. A mandate is what makes someone build.

Why the record is now the hard part

Discrete manufacturing solved autonomy-in-a-box with the robot cell: a fixed arm, a fenced perimeter, an enumerable workspace, under ISO 10218. Mobile machines on a surveyed floor inherit the same trick under ISO 3691-4. The bound is real, but it sits in the cell, or in the building. A machine going where nobody surveyed first has to carry the bound, recomputing the envelope, the region its body sweeps within a horizon, as it moves.

The recording problem arrives with it. Full sensor logs from a humanoid run to on the order of a terabyte a day, assumed rather than measured. Sites are instrumented and cloud-connected, so the constraint is not that the data cannot leave the building; it is that an assessor certifying what happened cannot depend on the vendor's service still being up, or on the vendor at all. Whatever they read has to be small enough to retain, exportable as one file, and checkable with no network and no trusted third party. This is a specification problem, not a storage one.

What follows is measured on a fixed base, where the envelope is computable from proprioception alone: the tractable half, and the half the cell already exploited. It is also a prototype — a planar arm, no dynamics, scripted trajectories standing in for a learned policy, and entity positions taken from the simulator instead of a perceiver. The policy being a black box is the premise here, not something implemented. The boundary is marked below.

A log is a self-report

IEC 61508 grades a continuously operating system by probability of dangerous failure per hour, and a policy's safety claim has the same shape: evals, coverage, pass rates, all distributional.

Whether the record of that behaviour was altered afterwards is a claim of a different shape. A safety claim is an expectation over nature. An integrity claim is worst case over an adversary, and it does not weaken as the policy's uncertainty grows. Retaining a record does not make a policy safer. It moves the account of what the policy did onto a different footing from the behaviour itself.

It matters because an assessor arriving after an incident has two accounts and one party produced both: the operator's, and the machine's log. A log arrives on the authority of the system under investigation. A black box built as a passive recorder inherits that problem intact.

Declarations, not logs

The alternative is a declaration: an ex-ante commitment, signed before the action, that a party who does not trust the policy can adjudicate afterwards. Promise and verdict are separate records, computed and signed by different parties, so when they disagree the artifact says which one was wrong.

1. Before acting, the policy signs an intent covering the next half-second — I will do this, and keep my body inside this region — spanning twenty-five commanded actions.
2. An enforcement layer computes its own bound from the robot's kinematics and limits, and adjudicates every action against both that bound and the declared region.
3. It signs a verdict. Both records are hash-chained, after Schneier and Kelsey 1998 minus its forward security.
4. The chain answers, from the artifact alone: what was declared, what was refused, and when.

Two polygons are involved, pointing opposite ways. What the record stores is sampled and under-covers: the region the arm demonstrably swept. What enforcement adjudicates against over-covers: the region the body cannot leave inside the window, which is the direction a safety claim needs.

Each record is keyed and links to its predecessor, which is the difference from an unkeyed per-record checksum: delete a run of records from a checksummed log and every remaining checksum still verifies.

What ships is still bounded. Both keys live in one process, so the verifier is also a forger, and they are static for the run, so anyone holding the keyring can re-sign the whole history. Nor is a bare chain append-only: deleting the last records breaks no link, which is Ma and Tsudik's truncation attack. A second on-site party countersigns both chain heads at close, and the useful half of that check needs no key at all, because the heads recompute from the records the file holds. None of that is a third-party timestamp. RFC 3161 or a transparency log would be, and both need a network call at the moment the artifact closes, which is a dependency it is built not to have. This is the structure of non-repudiation, not non-repudiation.

The requirement on the policy is an interface

Nothing in that loop knows what emitted the action, which is the premise and not a shortcut. The emitter is interchangeable, and the requirement on it is an interface: emit an action, and emit a checkable claim about where the body will be while it runs.

Declaring is almost free for a behaviour tree of bounded primitives. A policy emitting action chunks has to calibrate a claim about its own near-future body region, which is an open problem in its own right and not a logging one. That problem is the real ask this project makes of a policy team.

Declarations are also worth only what their tightness is worth, and nothing here prices tightness. Declare the whole reachable set every half-second and you never lie, never overclaim, and are never refused. The check is radial: it catches a region that reaches further than the arm can get inside the window, not one that is merely useless. A specification mandating declarations would have to price that. This one does not.

Two layers, one mechanical rule

Naming an entity is what makes an edge Layer B. Separation distance qualifies. It reads as geometry, but it is only known if the person's position is known, and that came from a perceiver whose failure modes this prototype cannot characterize.

Certifiable here means those failure modes are characterizable from proprioception, not that anything has been certified. The binary is a simplification in both directions: an IEC 61496 scanner rated PLd is perception with characterized failure modes and still lands on the uncertifiable side, and the encoders on the other side would need dual-channel redundancy before they carried a safety claim at all.

One edge type can be Layer A, a configuration bound to its computed envelope, and even that is conditional. Under ISO/TS 15066 speed-and-separation monitoring, now in ISO 10218-2:2025, a velocity limit is a function of a measured separation. So limits carry a required provenance tag with no default, the envelope inherits its layer, and limits with no provenance make the artifact a could-not-evaluate. A taint arriving inside a value cannot be caught by inspecting field names, which is what the rest of the rule does.

The split buys a claim that survives the perception stack being wrong: if the perceiver misplaced the person, every Layer B claim is void and the configuration, the limits, the declared region and the refusing verdict are still true. That is a property of the schema, not a result — the entities here are simulator ground truth, so it has never met a perceiver that was wrong.

It is also where the whole approach stops. A moving base needs a frame, world-frame pose comes from localisation, and localisation is perception — so the evidence stops being cleanly certifiable at the moment the external bound disappears and the robot has to generate its own. Both arrive together, and nothing here closes them.

The fault the standard has no name for

IEC 61784-3 defines the black channel: a communication system containing elements with no evidence of design or validation. Rather than certify the transport, the safety function wraps the exchange in an integrity layer and detects the transport's failures itself, each detection ending in passivation — the safe state a system drops to when a check fails.

This project borrows that move. Before the black channel, safety-relevant traffic needed a certified network; IEC 61784-3 and its profiles — PROFIsafe is the one most people meet — moved the assurance into the endpoints and let the wire stay commodity Ethernet, uncertified and unmodified. The uncertifiable component was not fixed. It was surrounded.

For a learned policy that construction already exists, and this project does not claim it. It is the Simplex architecture, standardised for aircraft as ASTM F3269 and applied to a learned controller on a flying robot by SOTER in 2019, with a reachability-derived switching rule and a composition proof. SOTER decides. What is missing is the record: an artifact that lets someone who was not there check what was decided, months later, without trusting the party that decided it.

Most of the standard's enumerated communication errors transpose without trouble. Corruption and masquerade both become a record whose MAC does not verify, incorrect sequence becomes a replay, unacceptable delay an expired declaration, loss an expired watchdog.

What it has no name for is the case that matters here: a declaration correctly signed, in sequence, on time, from the right sender, and contradicted by the action that followed. A wire has no intent to contradict. Four of this prototype's nine faults exist only because the sender's intent is under test — overclaiming the envelope, acting outside the declared region, an action outside the vocabulary, a failed escalation. That is the black-channel pattern applied to semantics, and it is the part that is not borrowed.

What it costs, and the framing that was retired

Six months of the artifact is 264 GB per robot at this simulator's fifty actions a second, at occurrence resolution — measured, and re-measured on every CI run against every document that publishes it. The comparison it appears beside is not: an assumed 1 TB/day sensor log projects to 182.5 TB, putting the artifact roughly 691× below it. Cheap enough to keep is the only property the rest of the argument needs.

Two things bound what that number means. At the coarsest resolution the artifact is 98.5% attestation records, 3,120 declarations and verdicts against 42 occurrences, so it prices the retention of attestation, not of a DSSAD-equivalent event log. And a real manipulator runs at 1 kHz, where six months is 4.17 TB and the margin falls to about 44×, below two orders of magnitude. The 1 kHz rung also sits above the artifact's own time base, which addresses a hundred instants a second, so per-frame questions at 1 kHz fall outside its published tolerance.

The original framing was compression, and the answer is no. Against a gzipped copy of the raw state stream the artifact is about 40× larger. The two do not carry the same content: that baseline is 24 columns, 19 of them Layer B — the human's pose and every obstacle's — against an artifact carrying Layer A. Nor is a gzipped CSV what practitioners retain: the incumbent is a rosbag2/MCAP bag, which carries framing the CSV does not, and nobody here has measured the artifact against one. So 40× is the number to quote, and it is an upper bound on the gap against what a deployment actually keeps.

What transfers

Two of the mechanisms are not about robots.

The constraint loop runs one way. Enforcement returns a verdict to the record and nothing to the policy. A verdict reaching the policy is a signal the policy can be fit to, and the thing it would fit is the enforcer. Structurally absent is checkable in a way that merely unused is not.

Every claim carries the trust class it depends on. Tag each assertion with the inputs it inherits trust from, require the tag, and let an untagged assertion resolve to could-not-evaluate, never to pass. A check that can only say yes or stay silent is not a check. This applies to any system mixing validated and unvalidated sources, which is every system with a model in it.

What is open

Personal data

Position to a centimetre, contact and closest-approach occurrences with wall-clock times, and an operator and shift beside them; a shift resolves against any roster to a person. Minimisation is in the schema rather than in a policy, since no column names anybody, but under §87(1)(6) BetrVG this is still a device suitable for monitoring worker performance, subject to works-council co-determination before the robot runs. It is the one limitation bounding whether the artifact may be kept at all, not what it can answer.

Keys

Both in one process, static for the run.

Policy version

The chain binds the party that made each record, not the build of the policy under investigation; DSSAD's software-version element is unimplemented because nothing here has a policy version to bind. Operator and unit are recorded. Version and site are the joins still missing, and each is a namespace somebody has to own.

Passivation

Eight of the nine faults passivate, but the record reaches no table, no query and no fixture, and the builder refuses such a run outright instead of writing a chain link over the gap. So “was the passivation acknowledged, and by whom” cannot be asked.

Witness

The code refuses a witness holding a signing key. It cannot refuse one on the operator's payroll.

Tightness

Unpriced, as above.

The 50 Hz figures are re-measured on every CI run. The 1 kHz ladder is a manual measurement, and the sensor-log side of every ratio is a projection from a sourced assumption, never measured here. Builds are byte-reproducible from the same seed and the same declared run start.