RRF / Physical assurance

Physical assurance

The model proposes; a bounded layer disposes.

Conformance is not certification. Compliance evidence is not regulatory sufficiency. What the registry holds is evidence a robot's owner chose to publish.

RCAN and this registry have one maintainer and no third-party verification. The registry does not test robots and does not review linked evidence.

The Bounded Embodiment test method was presented remotely in Session 1 (“Core Technologies for Embodied AI”) of the ITU Workshop on “Embodied AI for Multimedia Technologies”, Hangzhou, China, 16 October 2026, held with ITU-T FG-EAI. That was a presentation, not an endorsement by ITU or anyone else.

The idea

Any AI model may propose what a robot does next. A small, deterministic gate between the model and the motors decides what actually runs. The safety claim rests on the gate, which can be tested without the model's weights, rather than on the model, which cannot be tested exhaustively.

This is not new. It is the Simplex architecture (Sha, 2001) and the run-time assurance pattern standardised for aircraft in ASTM F3269. What is new is a vendor-neutral test method for machines driven by learned policies: five requirements, each with a pass/fail test a third party can run. That method, Bounded Embodiment, is independent of RCAN and of this registry and does not require either. RCAN Appendix C is one implementation that maps onto it. Comments on the method go to its issue tracker.

It complements, and replaces none of, ISO 10218:2025, ISO 13482, ISO/CD 25785-1, ISO 13849-1, IEC 61508, IEC 60204-1, ISO/IEC TR 5469, IEEE 7009 and ITU-T F.748.44. F.748.44 benchmarks the model; this tests the machine around it.

Five requirements

Declared envelope

The robot publishes its limits in a machine-readable file: where it may go, how fast, how hard it may push, and how quickly and how far it takes to stop.

Test: Measure the machine from outside. Nothing measured may exceed what was declared.

Enforcement below the model

A small gate between the AI model and the motors checks every command. The model cannot change the gate, the limits or the log.

Test: Replace the model with a program that sends random and extreme commands. The machine must never leave its envelope.

Stop always wins

Every authorised stop overrides everything else within a declared time. If power, communications or a heartbeat is lost, the machine goes to a safe state.

Test: At top speed, trigger each stop source and measure time and distance to standstill.

Accountable commands

Every command that moves the machine can be traced to the person or system that authorised it.

Test: Audit the log: no executed command without an authorising principal.

Tamper-evident evidence

Every gate decision (allow, clamp, reject, stop) is written to an append-only, hash-chained log.

Test: Verify the chain and replay each decision against the declared envelope.

The gate makes one of four decisions for every command: allow, clamp, reject or stop. If anything goes wrong inside the gate (an error, a timeout, stale sensor data, a command it cannot read) the answer is stop.

Assurance levels

BE-1

Declared (registry value A1)

Published envelope, gate in a separate process from the model, hash-chained log.

BE-2

Enforced (registry value A2)

BE-1 plus: gate on independent compute or firmware, a hardware stop path, heartbeat watchdogs, and passing the fault-injection tests.

BE-3

Assured (registry value A3)

BE-2 plus: gate and stop path meet a functional-safety integrity target (ISO 13849 PL or IEC 61508 SIL) with third-party testing.

Assurance levels BE-1 to BE-3 are a separate axis from RCAN's protocol conformance levels L1–L4. An L-level says how well a robot speaks the protocol; a BE-level says how well its motion is bounded. An RCAN L3 robot can be BE-1. The names BE-1 to BE-3 replaced A1–A3 on 8 October 2026. The registry API still stores and returns the values A1, A2 and A3, which mean BE-1, BE-2 and BE-3.

Two different stops

RCAN ESTOP message

Fast, authenticated, honoured from any principal, and logged. It depends on software being alive to receive it.

Hardwired power cut

A circuit that removes actuator power without going through the gate, the model or the runtime. It works when software is the failure.

Both are needed. They are not the same thing, and a robot with only one of them does not have the other.

What the registry shows

→ A robot record may carry assurance_level, envelope_hash and assurance_evidence_url, supplied by its owner.
→ BE-1 and BE-2 are always labelled self-declared.
→ BE-3 is shown only when a third-party evidence link is present. The registry links to that evidence; it does not review it.
→ A safety-benchmark submission may list which EV tests (EV-01 to EV-09) it covers. That list is shown as self-reported.
→ No registry endpoint accepts test results as verified.

Out of scope

Whether the declared limits are right for a task or a site; harm the machine can do while staying inside its limits; how well the machine senses people; general cybersecurity; and identity and delegation mechanics (the subject of ITU FG-TIDA).