Lesson 4.2.4 — Safety and Recovery

Week 37

Prerequisite lessons: 4.2.1 (perception stack integration), 4.2.2 (policy layer), 4.2.3 (reasoning layer), 3.3.4 (safety and constraints on LLM outputs), 2.3.3 (contact-rich manipulation), 2.2.4 (offline-to-online fine-tuning), 4.1.3 (evaluation design and held-out test suites).

Prior results used in this lesson. From 4.2.2: the four authorities, the veto’s priority, and the attribution’s procedure, restated in §L.C.1. From 4.2.3: the abort conditions and the deferral’s record, restated in §L.C.2. From 3.3.4: the four-layer stack, the safe-action set, and the residual-risk register, restated in §L.B.2 and §L.E.3. From 2.3.3: the 20 N force limit, the momentum observer, and the release sequence’s safe state, restated in §L.A.2. From 2.2.4: the Q-shield and the trough criteria, restated in §L.B.1. From 4.1.3: the 400-episode suite and the replay, restated in §L.D.2. Each is restated at the point of use.

What this lesson hands forward. The hazard analysis, the invariant list, the monitor’s coverage argument, and the safety case’s structure. Module 4.3 uses the fault injection’s suite as its experiment template. Module 4.4 uses the safety case as the defense’s evidence.

The running case in one sentence. The running arm, gripper, eye-in-hand camera, table, cube, bin, divider, and three distractors are unchanged; this lesson asks what hazards the full-stack agent can create, what invariants exclude them, how the monitor detects a violation, and how the recovery restores the safe state.

§L.0 — Lesson map, objectives, and misconceptions

Observable outcomes. By the end of this lesson you can, without notes: (1) run a hazard analysis on the full-stack agent and rank the hazards by severity and probability; (2) write an invariant as a predicate over the perception’s and the policy layer’s state with its threshold and its detection’s time; (3) state the architecture’s five components and each one’s role; (4) compute the monitor’s cadence from the strictest invariant’s hazard’s time; (5) state the guard’s condition and distinguish the preemptive from the reactive’s guard; (6) compute the false alarm’s trade and set the threshold by the Neyman–Pearson criterion; (7) name the five recovery kinds and their selection’s rule; (8) run the escalation’s protocol and state its coverage’s condition; (9) compute the recovery’s composed success rate; (10) write the safety case’s structure and identify each argument’s residual.

Misconception inventory.

Everything is self-contained. Where a prerequisite lesson is used, the result is restated at the point of use.

§L.0.5 — Retrieval warm-up

Q1. In 4.2.2, the four authorities were task, motion, contact, and safe, and the safe authority’s trigger was the failure’s condition. What does the safe authority’s fallback’s script do, and what is its latency?

Answer. The fallback is the 3.3.4 §L.C.3’s release sequence — reduce the grip, lower to the table, open — and its latency to the first action is about 5 ms, while the full script’s duration is about 2 s. Used in §L.A.3 to place the safe authority in the architecture.

Q2. In 4.2.3, the deferral was the layer’s output after three re-queries’ failure, and its record’s fields were the instruction, the serialization, the strata, and the failure’s data. Who consumes the deferral’s record, and what is the consumer’s action?

Answer. The operator and the 3.3.4 §L.E.3’s register; the operator’s intervention is the escalation’s action, and the register’s entry is the residual-risk record. Used in §L.C.2 to define the escalation’s protocol.

Q3. In 3.3.4, the safe-action set was $\mathcal{A}_{safe}(s) = {a : \forall s' \in \mathrm{Succ}(s,a), s' \in \mathcal{S}_{safe}}$, and the Q-shield was its value-based approximation. What is the difference between the safe-action set and an invariant, and why does the difference matter?

Answer. The safe-action set is a set of actions whose successors are safe; an invariant is a predicate on the state. The invariant is the target, and the safe-action set is the mechanism; the invariant’s predicate is what the monitor checks, and the safe-action set is what the guard enforces. Used in §L.B.2 to distinguish the monitor from the guard.

Q4. In 2.3.3, the force budget’s worst case at the 0.3 friction was 2.31 N, and the standard grip was 5 N. What is the hazard’s time for the force’s violation, and how does it compare to the momentum observer’s 3 ms detection?

Answer. The controller’s bandwidth is about 100 rad/s, so the force’s rise from 5 N to 20 N takes about 50 ms; the observer’s 3 ms detection is an order of magnitude faster, and the monitor’s cadence’s bound is the force’s rise’s time, not the observer’s. Used in §L.B.1 to compute the monitor’s cadence.

Part A — Hazards, invariants, and the architecture

§L.A.1 — The hazard analysis

A hazard is a state or event that can cause harm: to the operator, to the equipment, or to the task. The hazard analysis is the systematic enumeration of the hazards the full-stack agent can create, and it is the safety case’s foundation.

The method is the System-Theoretic Process Analysis (STPA; Leveson 2011, tier A, S). Its structure is: the unsafe control actions — the commands that can lead to a hazard — and the causal scenarios — the conditions under which the unsafe action is issued. The method’s value is that it treats safety as a control problem rather than a component’s failure’s problem, which is the right frame for a full-stack agent whose components each work and whose composition can still fail.

The running case’s six hazards.

H1 — Uncontrolled force. The contact exceeds the 20 N limit, crushing the cube or injuring the operator’s hand. The severity is high; the probability is moderate on the contact-rich grasp and low elsewhere. The unsafe control actions: the impedance controller’s setpoint’s too deep, the residual’s clip’s too wide, the grasp’s force’s too high.

H2 — Workspace intrusion. The end-effector crosses the divider, the bin’s rim, or the table’s edge, damaging the cell. The severity is moderate; the probability is moderate in the clutter. The unsafe control actions: the plan’s clearance’s margin’s violated, the handoff’s switch’s discontinuity’s large, the perception’s pose’s stale.

H3 — Drop. The cube falls from the grasp, hitting the operator or the equipment. The severity is moderate; the probability is moderate at the rotated grasp. The unsafe control actions: the grip’s force’s below the friction’s requirement, the acceleration’s above the budget, the contact’s loss’s undetected.

H4 — Unintended motion. The arm moves to a pose the operator did not command. The severity is high; the probability is low. The unsafe control actions: the reasoning’s semantic error commands a wrong object, the VLA’s hallucination’s object, the injection’s program.

H5 — Stuck state. The arm holds an unsafe pose with a load — a 30 N grip, a position near the divider — after the shield fires. The severity is moderate; the probability is low. The unsafe control action: the fallback’s pose-hold rather than the release sequence.

H6 — Spurious goal. The reasoning layer’s semantic error commands a wrong object or a wrong bin, and the execution is silently wrong. The severity is moderate; the probability is moderate. The unsafe control action: the specification’s target’s wrong, the success predicate’s tolerance’s absent.

The hazards’ ranking, by severity’s times probability’s product.

The ranking’s role is the architecture’s allocation: the invariants’ strictness and the monitor’s cadence are set by the top-ranked hazards, and the low-ranked hazards’ coverage is the recovery’s and the escalation’s.

Self-explanation 1. Why does STPA treat safety as a control problem rather than a component-failure problem?

Answer. Because the full-stack agent’s hazards arise from the interaction of components that each work as specified — the VLA’s subgoal and the planner’s trajectory and the controller’s force are each correct, and their composition’s timing is the hazard’s source — and a component-failure analysis would not see the interaction.

§L.A.2 — The invariant’s form

An invariant is a predicate over the state that must hold at every moment, and its violation is the hazard’s signature.

The running case’s five invariants.

I1 — The force’s invariant. The peak contact force is at most 20 N at every contact, computed from the 2.3.3 momentum observer and the finger’s force’s reading. The threshold’s source is the 2.3.3 force budget’s worst case plus the 3.3.4 §L.C.3’s safe state’s margin; the detection’s time is 50 ms (the controller’s bandwidth’s rise from the standard 5 N to the limit).

I2 — The workspace’s invariant. The end-effector’s distance from the divider’s surface is at least 1 cm and from the bin’s rim is at least 1 cm, computed from the 4.2.1 pose’s contract and the 2.3.2 clearance’s check. The threshold’s source is the 2.3.2 clearance’s margin’s half; the detection’s time is 100 ms (the arm’s speed at 10 cm/s and the 1 cm margin).

I3 — The grasp’s invariant. The grasped mass times the acceleration’s magnitude is at most the grip’s force’s margin’s friction’s budget, computed from the 4.2.1 pose’s object’s identity and the 2.3.3 force’s reading. The threshold’s source is the 2.3.3 Eq. (B.5)‘s margin; the detection’s time is 100 ms (the slip’s onset’s rate).

I4 — The velocity’s invariant. The end-effector’s velocity in the contact authority is at most 10 cm/s, computed from the 1.1.3 joint’s velocities and the 1.1.1 Jacobian. The threshold’s source is the 2.3.3 contact’s stability’s budget; the detection’s time is 20 ms (the controller’s period’s 10 cycles).

I5 — The goal’s invariant. The goal’s target is within the 2.3.2 workspace’s reachable set and its success predicate is achievable, computed from the 4.2.3 specification’s target and the 2.3.2 feasibility’s check. The threshold’s source is the 2.3.2 workspace’s boundary; the detection’s time is the 4.2.3 monitor’s 2.05 s.

The five invariants’ three properties.

Computability. The predicate must be a function of the perception’s and the policy layer’s state, and the state’s estimate’s uncertainty must be part of the predicate. An invariant on the force’s exact value is not computable; an invariant on the force’s measured value plus its uncertainty’s bound is.

Threshold’s source. The threshold must be derived from the hazard’s severity, not chosen for convenience. The 20 N is the 2.3.3 budget’s, the 1 cm is the 2.3.2 clearance’s, and the 10 cm/s is the 2.3.3 contact’s stability’s.

Detection’s time. The detection’s time is the hazard’s time’s fraction. The force’s rise’s 50 ms is the H1’s time, and the monitor’s cadence’s 17 ms is the 50/3’s.

The invariants’ and hazards’ coverage’s mapping.

The mapping’s role is the coverage’s argument: each invariant’s residual is the hazard’s mode that the invariant does not cover, and the residuals are the safety case’s gaps.

§L.A.3 — The architecture’s five components

The safety architecture has five components, and each is a mechanism with a role.

The invariants’ list. The five predicates of §L.A.2 with their thresholds and detection’s times. The list’s role is the target’s specification; the list is what the other four components are checked against.

The monitor. The component that evaluates the invariants at the cadence’s bound and reports the violation. The monitor’s mechanism is the 4.2.1 §L.B.3’s checks and the 4.2.2 §L.D.1’s attribution’s trace’s plus the invariant’s predicates’ evaluation. The monitor’s output is the violation’s report — the invariant’s ID, the state’s values, and the detection’s timestamp.

The guard. The component that acts on the monitor’s report — the 3.3.4 §L.C.1’s safe-action set’s enforcement and the 2.2.4 Q-shield. The guard’s two modes: the preemptive — the action’s rejection before the violation — and the reactive — the safe authority’s activation after the violation.

The recovery. The five kinds of §L.C.1, selected by the failure’s kind. The recovery’s role is the state’s restoration or the goal’s re-specification.

The escalation. The operator’s notification at the abort’s and the deferral’s trigger. The escalation’s role is the outside-the-loop’s intervention when the inside-the-loop’s mechanisms have exhausted.

The five components’ arrangement.

perception ─► policy ─► reasoning ─► actuators
     │           │           │            │
     ▼           ▼           ▼            ▼
 ┌──────────────────────────────────────────┐
 │  monitor (invariants' evaluation)         │
 │       │                                   │
 │       ├──► guard (preemptive / reactive)  │
 │       │                                   │
 │       ├──► recovery (retry/degrade/... )  │
 │       │                                   │
 │       └──► escalation (operator)          │
 └──────────────────────────────────────────┘

The architecture’s layering’s principle is the 3.3.4 §L.A.3’s defense in depth’s restatement at the system’s level: the five components’ catches are complementary, and the composition’s coverage is the components’ independent projections’ union.

Concept check. The monitor and the guard are both parts of the safety architecture. Why are they separate components rather than one?

Answer. Because the monitor’s role is the detection and the guard’s is the enforcement, and the two have different failures. A monitor with a correct detection and a guard with a slow enforcement is a hazard; a guard with a fast enforcement and a monitor with a missed detection is also a hazard. The separation is the components’ independent failure’s property, and the composition’s coverage requires the independence. [displaces M1]

Worked-example ladder.

WE-L.A.a (fully worked). The six hazards’ severity’s and probability’s products are $5 \times 3 = 15$ for H1, $3 \times 3 = 9$ for H2, $5 \times 1 = 5$ for H4, $3 \times 3 = 9$ for H3, $3 \times 3 = 9$ for H6, and $3 \times 1 = 3$ for H5. Compute the ranking and state the top two’s invariants’ strictness’s implication.

Solution. The products are H1:15, H2:9, H3:9, H6:9, H4:5, H5:3. The ranking is H1 first and the 9-triple tied. The top two’s invariants are I1 (H1) and I2 (H2, tied with H3 and H6). The strictness’s implication is that I1’s monitor’s cadence is the 17 ms and I2’s is the 33 ms, and the architecture’s cadence’s bound is the 17 ms.

WE-L.A.b (completion). The H6’s probability rises to 4 because the operator’s phrasings shift. Recompute the ranking and state whether I5’s monitor’s cadence changes.

Completion. The H6’s product is 12, and the ranking is H1:15, H6:12, H2:9, H3:9, H4:5, H5:3. The I5’s monitor’s cadence is the 2.05 s’s — it is unchanged by the probability’s rise — but the I5’s strictness’s requirement rises because the hazard’s rank rose. The completion shows the cadence’s bound is the hazard’s time’s, not the probability’s.

WE-L.A.c (faded). Write the invariant for the H6 hazard and state its residual.

Faded step. The I5 goal’s invariant: the target is reachable and the predicate is achievable; the residual is the semantic error below the tolerance.

Completion. The residual is the H6’s mode that the I5 does not cover — the semantic error that is within the tolerance but wrong — and the recovery’s replan and the escalation are the residuals’ mitigations.

WE-L.A.d (contrastive near-miss). A team’s architecture is the monitor and the guard only, without the recovery and the escalation. A force’s violation is detected and the guard’s Q-shield fires, and the arm holds the 30 N pose. Why it fails: the guard’s Q-shield’s rejection replaces the action, and the state is still unsafe — the 30 N force persists. The recovery’s release sequence and the escalation are the components that the state needs. The fix: the five components’ composition, per §L.A.3.

Comparative table: the five components.

Design principle P56.1. Safety is the invariants’ satisfaction, not the test’s pass rate; the five components’ independence is the coverage’s basis, and the components’ composition is the architecture.

Consolidation checkpoint 1

(a) Three capabilities. You can run the hazard analysis and rank the hazards. You can write an invariant with its threshold and detection’s time. You can name the five components and their outputs.

(b) Transfer probe. The H4’s severity rises to 5 and its probability to 2, so its product is 10. Does the ranking change, and does the monitor’s cadence change? Answer: the ranking’s H1 is still first at 15, and H4 is tied with H2 and H3 at 10. The monitor’s cadence is the I1’s 17 ms, unchanged; the I4 velocity’s monitor’s cadence is the 20 ms, and the H4’s rank’s rise makes the I4’s strictness’s requirement higher.

(c) Remediation rule. If you cannot state why the monitor and the guard are separate, re-read §L.A.3 before Part B.

Part B — The monitor, the guard, and the false alarm’s trade

§L.B.1 — The monitor’s cadence

The monitor’s cadence is the evaluation’s frequency, and its bound is the strictest invariant’s detection’s time.

The detection’s time is the time between the violation’s onset and the monitor’s report. For the invariant with the hazard’s time $T_{hazard}$, the detection’s time is $T_{hazard}/k$, where $k$ is the safety’s factor — typically 3 — and the monitor’s cadence is the reciprocal.

The running case’s invariants’ cadences.

I1 force. The hazard’s time is the 50 ms’s rise from 5 N to 20 N; the detection’s time is $50/3 = 17$ ms; the monitor’s cadence is 60 Hz.

I2 workspace. The hazard’s time is the 100 ms’s travel from 1 cm to the divider at 10 cm/s; the detection’s time is 33 ms; the cadence is 30 Hz.

I3 grasp. The hazard’s time is the 100 ms’s slip’s onset; the detection’s time is 33 ms; the cadence is 30 Hz.

I4 velocity. The hazard’s time is the 20 ms’s acceleration’s transient; the detection’s time is 7 ms; the cadence is 143 Hz.

I5 goal. The hazard’s time is the 2.05 s’s goal’s validity’s age; the detection’s time is 0.68 s; the cadence is 1.5 Hz.

The monitor’s cadence’s bound is the I4’s 143 Hz, which is above the control tier’s 1 kHz’s fraction and below the contact tier’s 1 kHz. The I4’s cadence is the strictest, and the monitor’s design is the per-invariant cadence: the I4’s at 143 Hz on the controller’s thread, the others at their cadences on the policy layer’s thread.

The single monitor at the strictest cadence is the conservative choice, and its cost is the compute. The per-invariant cadence is the efficient choice, and its cost is the design’s complexity. The running case’s design is the per-invariant cadence, with the I4 on the control tier’s thread and the others on the policy layer’s.

Self-explanation 1. Why is the detection’s time the hazard’s time divided by a factor rather than the hazard’s time itself?

Answer. Because the detection’s time is the budget between the violation’s onset and the monitor’s report, and the response’s time — the guard’s or the recovery’s — is the other part of the budget; the factor $k$ reserves the response’s time’s share, and the detection’s time is $T_{hazard}/k$.

§L.B.2 — The guard’s condition and the two modes

The guard’s condition is the predicate that, when true, causes the guard to act. The condition is not the invariant’s violation — that is the monitor’s report — but the pre-violation’s state, which the guard’s preemptive mode uses.

The guard’s two modes.

The preemptive guard. The guard evaluates the safe-action set $\mathcal{A}_{safe}(s)$ of 3.3.4 §L.C.1 and rejects any action outside it. The preemptive guard’s condition is the action’s membership’s test; the guard acts before the violation’s state is reached. The 2.2.4 Q-shield is the preemptive guard’s value-based approximation, and the 3.3.4 §L.B.2’s physical layer’s force limit is the preemptive guard’s exact form.

The reactive guard. The guard acts after the monitor’s report of a violation. The reactive guard’s action is the safe authority’s activation — the 4.2.2 §L.B.1’s safe authority’s fallback’s script — and the guard’s condition is the monitor’s report’s truth.

The two modes’ coverage. The preemptive guard catches the failures whose action’s consequence is the hazard; the reactive guard catches the failures whose state’s violation is the hazard. The two are complementary, and the 3.3.4 §L.C.1’s safe-action set’s guarantee is the worst-case’s successor’s, which is the preemptive mode’s strength and its conservatism’s cost.

The guard’s condition’s threshold is the design’s number. The preemptive guard’s threshold is the safe-action set’s boundary, and its calibration is the 3.3.4 §L.D.2’s physical layer’s. The reactive guard’s threshold is the monitor’s, and its calibration is §L.B.3’s.

§L.B.3 — The false alarm’s trade

The monitor’s threshold is a trade between the miss’s rate and the false alarm’s rate. The trade’s structure is the receiver operating characteristic (ROC), and the threshold’s choice is the Neyman–Pearson criterion: fix the miss’s rate at a level the hazard’s severity permits, and minimize the false alarm’s rate subject to that.

The trade’s two costs.

The miss’s cost. A miss is a hazard’s detection’s absence, and its cost is the hazard’s severity’s — the H1’s miss is the operator’s injury or the equipment’s damage.

The false alarm’s cost. A false alarm is a spurious activation of the recovery or the abort, and its cost is the availability’s — the episode’s failure’s and the operator’s trust’s. A monitor whose false alarm rate is high is disabled by the operator, which is the safety’s loss that the conservative’s design did not anticipate (Amodei et al. 2016, tier A, S).

The running case’s calibration.

The I1 force’s threshold. The monitor’s force’s estimate has a noise’s standard deviation of 0.5 N. The threshold is set at the 20 N’s limit minus 3 standard deviations, or 18.5 N, so the false alarm’s rate at the 20 N’s boundary is 0.1% and the miss’s rate at the 20 N’s limit is 0.1%. The margin’s 1.5 N is the noise’s compensation.

The I2 workspace’s threshold. The monitor’s distance’s estimate has a standard deviation of 2 mm. The threshold is 1 cm minus 3 standard deviations, or 4 mm, and the false alarm’s rate is 0.1%.

The I4 velocity’s threshold. The monitor’s velocity’s estimate has a standard deviation of 0.5 cm/s. The threshold is 10 cm/s minus 3 standard deviations, or 8.5 cm/s, and the false alarm’s rate is 0.1%.

The thresholds’ 3-sigma’s margin is the calibration’s discipline, and the false alarm’s rate’s target is 0.1% per invariant. The four invariants’ joint false alarm’s rate is about 0.4% per cycle, which at 60 Hz is 0.24 false alarms per second — a rate the operator would find disruptive. The mitigation is the hysteresis: the alarm requires three consecutive cycles’ violation, which reduces the false alarm’s rate to $0.001^3 = 10^{-9}$ per cycle at the cost of the detection’s latency’s three cycles.

The hysteresis’s trade is the detection’s latency’s multiplication by three. For the I1’s 17 ms’s detection’s time, the three cycles’ 51 ms is at the hazard’s 50 ms’s time, and the design’s safety factor’s 3 is consumed by the hysteresis. The resolution is the I1’s hysteresis’s two cycles rather than three, and the false alarm’s rate’s $10^{-6}$ is the acceptance’s.

§L.B.4 — The invariant’s coverage

The invariant’s coverage is the fraction of the hazard’s modes that the invariant excludes, and its complement is the residual risk.

The coverage’s argument’s structure.

The mode’s enumeration. Each hazard’s modes are the causal scenarios that lead to the hazard’s event. The H1’s modes are: the controller’s setpoint’s too deep, the residual’s clip’s too wide, the grasp’s force’s too high, and the contact’s stiffness’s mis-estimated.

The invariant’s check. Each mode’s signature is compared to the invariant’s predicate. The controller’s setpoint’s mode’s signature is the force’s rise; the residual’s clip’s mode’s signature is the total force’s sum; the grasp’s force’s mode’s signature is the grip’s force’s reading; the stiffness’s mode’s signature is the force’s penetration’s ratio.

The coverage’s fraction. The modes whose signature is within the invariant’s predicate’s scope are the covered; the modes outside are the residual.

The H1’s coverage. The controller’s setpoint’s, the residual’s clip’s, and the grasp’s force’s modes are covered by I1’s force’s predicate. The stiffness’s mode is partially covered — the force’s reading catches the mis-estimation’s consequence but not its cause — and the residual is the stiffness’s error’s within the force’s margin.

The coverage’s argument is the safety case’s central’s item, and its honesty is the residual’s registration. The 3.3.4 §L.E.3’s register’s entries are the residuals’ records, and the safety case’s argument is the register’s completeness’s argument.

Self-explanation 2. Why is the false alarm’s cost an availability’s rather than a safety’s?

Answer. Because the false alarm’s activation is safe — the recovery’s or the abort’s action is the safe one — and the cost is that the episode’s goal was not achieved; the safety’s loss is the operator’s trust’s erosion, which leads to the monitor’s disabling, and the disabling is the safety’s loss that the false alarm’s availability’s cost causes.

Concept check. The I1’s threshold is set at 18.5 N with a 3-sigma’s margin, and the operator’s review finds the false alarm’s rate is 2%. What is the diagnosis and the fix?

Answer. The monitor’s noise’s model is wrong — the actual noise’s standard deviation is larger than the 0.5 N’s — or the hysteresis is absent. The fix is the noise’s re-estimation and the hysteresis’s two cycles, and the false alarm’s rate’s re-measurement is the fix’s evidence. [displaces M4]

Worked-example ladder.

WE-L.B.a (fully worked). The I1’s force’s threshold is 18.5 N with a 0.5 N’s noise’s standard deviation. Compute the false alarm’s rate at the 20 N’s boundary and the miss’s rate at the 20 N’s limit.

Solution. The threshold’s 18.5 N is 3 standard deviations below the 20 N’s limit, so the false alarm’s rate — the probability that the noise pushes the estimate above the 18.5 N when the true force is 18.5 N — is the 0.00135’s tail. The miss’s rate — the probability that the noise pushes the estimate below the 18.5 N when the true force is 20 N — is the probability that the noise is below $-1.5$ N, which is the $z = -3$‘s tail, 0.00135. The two rates are equal because the threshold is the midpoint’s 18.5 N’s and the limit’s 20 N’s 3-sigma’s.

WE-L.B.b (completion). The threshold is moved to 19.5 N. Recompute the two rates.

Completion. The threshold’s 19.5 N is 1 standard deviation below the 20 N’s limit. The false alarm’s rate at the 19.5 N is the $z = +2$‘s tail’s 0.0228; the miss’s rate at the 20 N is the $z = -1$‘s tail’s 0.1587. The false alarm’s rate’s 2.3% is the availability’s cost, and the miss’s rate’s 15.9% is the safety’s cost. The completion shows the threshold’s trade: moving it up reduces the false alarm and increases the miss.

WE-L.B.c (faded). Compute the hysteresis’s two-cycles’ false alarm’s rate at the 2.3%‘s per-cycle.

Faded step. The two cycles’ false alarm’s rate is the per-cycle’s squared: $0.0228^2 = 0.00052$. The detection’s latency doubles to the 34 ms, which is within the 50 ms’s hazard’s time.

Completion. The two cycles’ 34 ms’s detection’s latency is within the I1’s 17 ms’s budget’s two cycles, and the false alarm’s rate’s 0.05% is the acceptance’s. The completion shows the hysteresis’s trade is the detection’s latency’s multiplication and the false alarm’s rate’s squaring.

WE-L.B.d (contrastive near-miss). A team sets the I1’s threshold at 15 N to “be safe”. The false alarm’s rate is 50% and the operator disables the monitor. Why it fails: the threshold’s 15 N is 10 standard deviations below the 20 N’s limit, so the nominal’s force’s 5 N is within the hysteresis’s band and the monitor fires on every grasp. The operator’s disabling is the safety’s loss. The fix: the Neyman–Pearson’s criterion, per §L.B.3.

Comparative table: the guard’s two modes.

Design principle P56.2. Set the monitor’s threshold by the Neyman–Pearson criterion and the hysteresis by the false alarm’s acceptance; the false alarm’s cost is the availability’s, and the monitor’s disabling is the safety’s loss.

Consolidation checkpoint 2

(a) Three capabilities. You can compute the monitor’s cadence from the hazard’s time. You can state the guard’s two modes and their conditions. You can compute the false alarm’s and miss’s rates and the hysteresis’s trade.

(b) Transfer probe. The I2’s distance’s estimate’s noise’s standard deviation is 5 mm. What is the threshold at a 3-sigma’s margin from the 1 cm’s limit? Answer: the threshold is $10 - 15 = -5$ mm, which is below zero — the noise’s 5 mm is too large for the 1 cm’s margin’s 3-sigma’s. The fix is the distance’s estimate’s noise’s reduction or the threshold’s margin’s lowering to 2 sigma’s, with the false alarm’s rate’s 2.3%.

(c) Remediation rule. If you cannot state why the hysteresis’s false alarm’s rate is the per-cycle’s squared, re-read WE-L.B.c before Part C.

Part C — The five recovery kinds and the escalation

§L.C.1 — The five kinds

The recovery is the component that restores the state or re-specifies the goal after a failure’s detection, and its five kinds are selected by the failure’s kind and the hazard’s severity.

Retry. The failure is transient — the perception’s one-frame’s occlusion, the contact’s momentary’s loss, the action’s one-cycle’s rejection — and the recovery’s action is the same goal after a state’s change. The state’s change is the retry’s precondition: a retry without the change is the same failure’s re-execution, and the 3.3.2 §L.C.2’s retry bound’s two is the loop’s guard. The retry’s cost is the state’s change’s latency, typically 10–50 ms.

Degrade. The failure is persistent and the goal’s accuracy is coarser but usable. The recovery’s action is the goal’s re-specification with a larger tolerance — the 4.2.3 §L.C.1’s tolerance’s inflation — and the consumer’s 3.3.3 affordance’s check’s re-evaluation. The degrade’s cost is the accuracy’s loss, and its acceptance is the affordance’s check’s pass at the coarser tolerance.

Replan. The goal is infeasible — the reasoning layer’s specification’s target is unreachable, the plan’s clearance’s violated — and the recovery’s action is the 4.2.3 §L.D.2’s re-query with the feasibility’s reason. The replan’s cost is the re-query’s latency — the LLM’s 200 ms’s plus the verifier’s 10 ms’s — and its acceptance is the re-query’s convergence.

Abort. The state is unsafe — the invariant’s violation, the 3.3.4 §L.B.2’s physical layer’s failure — and the recovery’s action is the 4.2.2 §L.B.1’s safe authority’s fallback’s script. The abort’s cost is the episode’s failure’s, and its acceptance is the safe state’s attainment. The abort is the only recovery that is unconditional — it does not depend on the failure’s kind, only on the invariant’s violation.

Escalate. The recovery’s inside-the-loop’s mechanisms have exhausted — the three re-queries’ failure, the abort’s repeated’s activation — and the recovery’s action is the operator’s notification with the 4.2.3 §L.D.3’s deferral’s record. The escalation’s cost is the operator’s response’s time, and its acceptance is the operator’s intervention’s within the risk’s window.

The five kinds’ selection’s rule.

The selection’s rule’s priority is the abort’s unconditional’s over the others. A failure that is both transient and unsafe is the abort’s, not the retry’s; the invariant’s violation’s detection dominates the failure’s kind’s classification.

§L.C.2 — The escalation’s protocol

The escalation is the operator’s notification, and its protocol has four steps.

Step 1: the notification. The 4.2.3 §L.D.3’s deferral’s record — the instruction, the serialization, the three re-queries’ strata, the failure’s data — is delivered to the operator’s console. The notification’s completeness is the record’s, and the record’s absence is the escalation’s failure’s mode.

Step 2: the state’s preservation. The arm holds the 3.3.4 §L.C.3’s safe state — the release sequence’s completion’s pose — and the policy layer’s safe authority’s activation is the state’s guarantee. The preservation’s duration is the operator’s response’s time.

Step 3: the operator’s intervention. The operator reviews the record, diagnoses the failure’s stratum, and either re-initializes the system with a corrected goal’s specification or issues a manual command. The intervention’s form is the operator’s, and the system’s role is the information’s delivery.

Step 4: the re-initialization. The operator’s re-initialization restores the task authority’s activation with the corrected goal, and the 4.2.2 §L.B.3’s handoff’s protocol is the re-initialization’s mechanism.

The escalation’s coverage’s condition is the operator’s presence and the record’s completeness. The operator’s absence — an unattended cell — is the escalation’s failure’s mode, and the risk’s assessment is the unattended’s window’s hazard’s.

The escalation’s latency is the operator’s response’s time, and the running case’s design is the 30 s’s for a present operator and the 5 min’s for a remote operator. The latency’s bound is the safe state’s duration’s — the arm holds the safe state for the operator’s response’s time — and the safe state’s stability’s is the 3.3.4 §L.C.3’s release’s completion’s.

§L.C.3 — The recovery’s composed success rate

The recovery’s composed success rate is the fraction of failures that the recovery’s five kinds restore, and its arithmetic is the selection’s accuracy times the kind’s success rate.

The composition’s formula.

where $p_k$ is the probability that the failure’s kind is $k$ and $s_k$ the recovery’s success rate for the kind.

The running case’s values.

Retry. $p_{retry} = 0.55$, $s_{retry} = 0.80$. The retry’s failures are the persistent’s failures that the state’s change did not resolve.

Degrade. $p_{degrade} = 0.15$, $s_{degrade} = 0.60$. The degrade’s failures are the consumer’s affordance’s check’s rejection at the coarser tolerance.

Replan. $p_{replan} = 0.20$, $s_{replan} = 0.90$. The replan’s failures are the re-query’s non-convergence.

Abort. $p_{abort} = 0.08$, $s_{abort} = 1.0$. The abort is unconditional and the safe state’s attainment is the 3.3.4 §L.C.3’s script’s guarantee.

Escalate. $p_{escalate} = 0.02$, $s_{escalate} = 0.95$. The escalation’s failures are the operator’s absence’s and the record’s incompleteness’s.

The composed’s rate.

The 0.809’s rate is the recovery’s coverage, and the complement’s 0.191 is the residual risk’s share that the architecture’s components do not restore. The complement’s mitigation is the escalation’s operator’s intervention’s outside-the-loop’s — the operator’s manual recovery — and the residual’s acceptance is the 3.3.4 §L.E.3’s register’s.

The composed’s rate’s sensitivity is the retry’s and the replan’s. The retry’s $p \cdot s$‘s 0.44 is the largest term, and the retry’s $s$‘s improvement from 0.80 to 0.90 raises the composed’s rate to 0.864. The replan’s $p \cdot s$‘s 0.18 is the second, and its $s$‘s improvement’s effect is proportional.

Self-explanation 3. Why is the abort’s $s_{abort}$ exactly 1.0 while the others are below 1.0?

Answer. Because the abort’s action is the safe authority’s script — the 3.3.4 §L.C.3’s release sequence — and the script’s attainment of the safe state is the script’s guarantee, not a probabilistic’s recovery; the script’s failure’s would be the actuator’s failure’s, which is the hardware’s, not the recovery’s.

Concept check. The escalation’s $p$ rises to 0.05 and its $s$ is 0.95. Recompute the composed’s rate with the other terms unchanged.

Answer. The escalation’s term is $0.05 \times 0.95 = 0.0475$, replacing the 0.019, and the other terms’ sum’s 0.44 + 0.09 + 0.18 + 0.08 = 0.79. The composed’s rate is 0.8375 — higher — because the escalation’s $s$ is higher than the retry’s. The mechanism is the selection’s accuracy’s: a failure moved from the retry to the escalation is a failure whose recovery’s kind is better matched. [displaces M3]

Worked-example ladder.

WE-L.C.a (fully worked). The five kinds’ $p$‘s and $s$‘s are the table’s. Compute the composed’s rate and the largest term’s contribution.

Solution. The terms are 0.44, 0.09, 0.18, 0.08, 0.019; the sum is 0.809. The largest term is the retry’s 0.44, which is 54% of the composed’s rate. The completion shows the retry’s dominance.

WE-L.C.b (completion). The retry’s $s$ falls to 0.70 because the state’s change’s latency rises. Recompute the composed’s rate and state the sensitivity.

Completion. The retry’s term is $0.55 \times 0.70 = 0.385$; the sum is 0.385 + 0.09 + 0.18 + 0.08 + 0.019 = 0.754. The composed’s rate falls by 0.055, and the sensitivity’s magnitude is the retry’s $p \times \Delta s = 0.55 \times 0.10 = 0.055$, which matches.

WE-L.C.c (faded). Derive the composed’s rate’s marginal sensitivity to each kind’s $s$, and state the priority’s ordering.

Faded step. The marginal is $p_k$; the priority is the retry’s 0.55, the replan’s 0.20, the degrade’s 0.15, the abort’s 0.08, the escalation’s 0.02.

Completion. The priority’s ordering is the $p$‘s, and the retry’s $p$‘s 0.55 is the largest; the retry’s $s$‘s improvement’s effect is 0.55 per unit, and the others’ are 0.20, 0.15, 0.08, and 0.02.

WE-L.C.d (contrastive near-miss). A team’s composed’s rate is 0.65 and the team adds a sixth kind — the “restart” — with $p = 0.05$ and $s = 0.40$. The composed’s rate falls to 0.62. Why it fails: the new kind’s $s$‘s 0.40 is below the existing kinds’ weighted average’s, and the selection’s accuracy’s shift moved failures from the retry to the restart without improving the recovery. The fix is the kind’s selection’s accuracy’s, not the kind’s number’s. The fix: the selection’s rule’s re-examination, per §L.C.1.

Comparative table: the five kinds.

Design principle P56.3. Select the recovery by the failure’s kind and the hazard’s severity; the abort is unconditional, and the composed’s rate’s sensitivity is the kind’s probability’s.

Consolidation checkpoint 3

(a) Three capabilities. You can name the five recovery kinds and their selection’s rule. You can run the escalation’s protocol’s four steps. You can compute the composed’s rate and its sensitivity.

(b) Transfer probe. The retry’s $p$ falls to 0.40 and the replan’s rises to 0.35 because the reasoning’s re-queries’ specificity improves. Recompute the composed’s rate with the $s$‘s unchanged. Answer: the retry’s term is $0.40 \times 0.80 = 0.32$; the replan’s is $0.35 \times 0.90 = 0.315$; the sum is 0.32 + 0.09 + 0.315 + 0.08 + 0.019 = 0.824. The composed’s rate rises because the replan’s $s$‘s 0.90 is above the retry’s 0.80.

(c) Remediation rule. If you cannot state why the abort’s $s$ is 1.0, re-read §L.C.3 before Part D.

Part D — The fault model, the injection’s suite, and the safety case

§L.D.1 — The fault model

The fault model is the set of faults the architecture is designed to detect and recover from, and its enumeration is the fault injection’s suite’s design’s basis.

The running case’s faults.

F1 — The perception’s pose’s error’s spike. The 4.2.1 estimator’s pose’s error exceeds its covariance’s claim by 3 sigma. The mode’s cause: the reflection, the occlusion, the training’s distribution’s gap. The detection: the 4.2.1 §L.B.3’s cross-modal’s check. The recovery: the retry’s re-observe.

F2 — The policy’s action’s out-of-distribution. The 4.2.2 task authority’s action’s Q-value falls below the 2.2.4 Q-shield’s threshold. The mode’s cause: the VLA’s hallucination, the subgoal’s unreachable. The detection: the Q-shield’s rejection. The recovery: the degrade or the replan.

F3 — The reasoning’s plan’s infeasibility. The 4.2.3 verifier’s feasibility’s check’s rejection. The mode’s cause: the divider’s move, the clearance’s violation. The detection: the verifier’s reason. The recovery: the replan.

F4 — The actuator’s saturation. The 2.3.3 force’s limit’s exceeded. The mode’s cause: the impedance’s setpoint’s too deep, the residual’s clip’s too wide. The detection: the force’s reading. The recovery: the abort’s release sequence.

F5 — The sensor’s dropout. The 4.2.1 provenance’s absence — a source’s missing’s entry. The mode’s cause: the camera’s frame’s loss, the depth’s freeze. The detection: the 4.2.1 §L.C.2’s completeness’s check. The recovery: the degrade’s coarser accuracy or the escalate.

The fault model’s completeness’s argument is the fault-to-hazard mapping: each fault’s consequence’s hazard is identified, and the fault’s detection’s mechanism is the invariant’s or the check’s. A fault whose consequence’s hazard is not identified is the fault model’s gap, and the gap’s resolution is the analysis’s iteration.

The running case’s mapping.

The mapping’s coverage’s argument: each fault’s hazard is the detection’s and the recovery’s, and the composition’s coverage’s fraction is the fault model’s completeness’s measure.

§L.D.2 — The fault injection’s suite

The fault injection’s suite is the set of tests that verify the architecture’s response to each fault, and it is the 4.1.3 suite’s replay’s complement at the safety’s level.

The suite’s design.

The injection’s point. The fault is injected at the component’s boundary — the perception’s pose’s entry, the policy’s action’s entry, the reasoning’s plan’s entry — so that the downstream architecture’s response is the test’s target.

The injection’s magnitude. The fault’s magnitude is the just-noticeable’s to the worst-case’s — the pose’s error’s 3 sigma to 10 sigma, the force’s 20 N to 40 N — so that the architecture’s response’s graded’s is measured.

The expected response. Each injection’s expected response is the 4.2.4 §L.C.1’s recovery’s kind, and the response’s match is the test’s pass’s condition.

The suite’s metrics.

The detection’s rate. The fraction of injections whose detection’s mechanism fires within the detection’s time. The target is 1.0 for the within-model’s faults and 0.8 for the outside-model’s faults.

The recovery’s success’s rate. The fraction of detected’s faults whose recovery’s kind restores the state. The target is the composed’s rate’s 0.81.

The false alarm’s rate. The fraction of nominal cycles whose monitor fires. The target is the 0.001 per invariant.

The recovery’s latency. The 95th percentile’s time from the detection to the restoration. The target is the recovery’s kind’s cost’s bound.

The suite’s evidence is the 4.1.3 §L.D.1’s split’s discipline’s — the injections are on the held-out suite’s episodes, not the training’s — and the replay is the 4.1.3 §L.C.2’s protocol’s.

§L.D.3 — The safety case’s structure

The safety case is the structured argument that the full-stack agent is acceptably safe, and its structure is the Goal Structuring Notation (GSN; Kelly & Weaver 2004, tier B, S).

The case’s structure.

The claim. The top-level claim is the agent’s acceptably safe’s, with the scope’s statement — the deployment’s distribution, the operator’s presence, the cell’s configuration.

The arguments. The claim is supported by five arguments, one per architecture’s component.

• The invariants’ argument: each hazard’s modes are covered by an invariant, per §L.B.4’s coverage’s fraction.
• The monitor’s argument: each invariant’s monitor’s detection’s time is within the hazard’s time’s fraction, per §L.B.1.
• The guard’s argument: the preemptive and reactive’s guard’s coverage of the modes, per §L.B.2.
• The recovery’s argument: the composed’s rate’s 0.81, per §L.C.3.
• The escalation’s argument: the operator’s presence’s and the record’s completeness’s, per §L.C.2.

The evidence. Each argument’s evidence is the 4.1.3 suite’s replay’s metrics and the 4.2.4 §L.D.2’s injection’s suite’s results.

The residuals. Each argument’s residual is the 3.3.4 §L.E.3’s register’s entry, and the case’s strength’s is the residuals’ acceptance’s by the operator.

The case’s gap’s identification’s procedure. For each argument, the residual’s enumeration is the argument’s weakness’s; the case’s review’s task is the residuals’ plausibility’s and the mitigations’ sufficiency’s. A residual that is not accepted is the case’s gap, and the gap’s resolution is either the argument’s strengthening’s — a new invariant, a faster monitor, a better recovery — or the residual’s acceptance’s with the documented’s rationale.

The case’s iteration’s discipline. The case is a living document, and each 4.3 lesson’s iteration updates the residuals. A case whose residuals are not updated is a case whose evidence is stale, and the stale’s evidence is the case’s invalidity’s source.

Self-explanation 1. Why is the safety case’s structure a tree of arguments rather than a list of tests?

Answer. Because the tests are the evidence, and the case’s claim is the argument’s conclusion; the tree’s structure makes each argument’s premises explicit and each residual’s location traceable. A list of tests has no structure, and a test’s failure’s implication’s for the claim is ambiguous.

Concept check. The recovery’s argument’s composed’s rate is 0.81 and the 4.1.3 suite’s replay’s recovery’s success is 0.72. Is the case’s argument’s evidence consistent?

Answer. No; the argument’s premise is the 0.81’s rate, and the evidence’s 0.72 is below it. The inconsistency is the argument’s residual’s re-examination’s — the kinds’ probabilities’ or the kinds’ success’s rates’ — and the resolution is either the argument’s adjustment’s or the evidence’s re-collection’s. [displaces M2]

Worked-example ladder.

WE-L.D.a (fully worked). The five arguments’ residuals are the pose’s spike’s 3 sigma’s undetected’s, the out-of-distribution’s 2%, the infeasibility’s 10%, the saturation’s 0.5%, and the dropout’s 5%. Compute the total’s residual’s probability and the case’s argument’s weakest’s.

Solution. The residuals are independent’s, so the total’s residual’s probability is the union’s, which is approximately the sum’s for small’s values: $0.0001 + 0.02 + 0.10 + 0.005 + 0.05 = 0.175$. The weakest’s argument is the infeasibility’s 10%, and its strengthening’s is the verifier’s reason’s specificity’s or the replan’s convergence’s.

WE-L.D.b (completion). The infeasibility’s residual falls to 2% because the verifier’s reason’s specificity improves. Recompute the total and state the new weakest’s.

Completion. The total is $0.0001 + 0.02 + 0.02 + 0.005 + 0.05 = 0.0951$; the weakest’s is the dropout’s 5%. The completion shows the residual’s reduction’s effect is the total’s union’s, and the weakest’s shifts to the next.

WE-L.D.c (faded). Write the escalation’s argument’s premises and its residual’s location.

Faded step. The premises: the operator’s presence’s within the 30 s’s, the record’s completeness’s, the safe state’s duration’s 2 s. The residual’s: the operator’s absence’s and the record’s missing’s field’s.

Completion. The residual’s location is the 3.3.4 §L.E.3’s register’s escalation’s entry, and the argument’s strength’s is the residual’s acceptance’s.

WE-L.D.d (contrastive near-miss). A team’s case has the evidence’s suite’s results but no residuals’ column, on the argument that the tests pass. The case is rejected. Why it fails: the tests’ pass is the evidence’s, and the case’s claim’s is the argument’s; the residuals’ absence makes the case’s strength’s undeterminable, and the claim’s scope’s is unbounded. The fix: the residuals’ column, per §L.D.3.

Comparative table: the safety case’s components.

Design principle P56.4. Build the safety case as a tree of arguments with residuals; the case’s strength is the residuals’ acceptance, and the case’s invalidity’s is the residuals’ staleness.

Consolidation checkpoint 4

(a) Three capabilities. You can name the five faults and their mapping’s to the hazards. You can design the fault injection’s suite’s four metrics. You can write the safety case’s five arguments and their residuals.

(b) Transfer probe. The F2’s out-of-distribution’s residual is 2% and the F3’s infeasibility’s is 10%. Which argument’s strengthening is the priority, and why? Answer: the F3’s, because its residual’s 10% is the larger and its strengthening’s — the verifier’s reason’s specificity’s — is the 4.2.3 §L.D.2’s prompt’s specificity’s, which is the cheaper’s.

(c) Remediation rule. If you cannot state why the case’s structure is a tree rather than a list, re-read §L.D.3 before Part E.

Part E — The running case

§L.E.1 — The architecture’s assembly

The running case’s safety architecture, assembled from the five components.

The invariants’ list. The five of §L.A.2 with their thresholds and detection’s times.

The monitor. The per-invariant cadences: the I1’s 60 Hz on the policy layer’s thread, the I2’s and I3’s 30 Hz, the I4’s 143 Hz on the control tier’s thread, the I5’s 1.5 Hz.

The guard. The preemptive’s Q-shield at the 2.2.4 §L.D.3’s 10th percentile plus the 3.3.4 §L.B.2’s physical layer’s force limit’s 20 N. The reactive’s safe authority’s activation with the 3.3.4 §L.C.3’s release sequence.

The recovery. The five kinds’ selection’s rule’s table of §L.C.1, with the composed’s rate’s 0.809.

The escalation. The operator’s console with the 4.2.3 §L.D.3’s deferral’s record’s delivery, the 30 s’s response’s window, and the safe state’s 2 s’s duration.

The architecture’s integration’s evidence is the 4.2.1 §L.E.2’s checks’ statistics, the 4.2.2 §L.E.2’s layer’s metrics, the 4.2.3 §L.E.2’s goal-level’s metrics, and the 4.2.4 §L.D.2’s injection’s suite’s results.

§L.E.2 — The recovery’s budget

The recovery’s time’s budget, from the hazard’s time to the recovery’s latency.

H1’s force. The hazard’s time is 50 ms; the monitor’s 17 ms’s detection plus the guard’s 5 ms’s activation plus the abort’s 5 ms’s first action is 27 ms, within the 50 ms’s.

H2’s workspace. The hazard’s time is 100 ms; the monitor’s 33 ms plus the guard’s 5 ms plus the abort’s 5 ms is 43 ms, within the 100 ms’s.

H3’s grasp. The hazard’s time is 100 ms; the monitor’s 33 ms plus the recovery’s degrade’s 50 ms plus the release’s 5 ms is 88 ms, within the 100 ms’s — a tight’s margin.

H4’s unintended. The hazard’s time is the 4.2.2 §L.A.2’s 200 ms’s; the monitor’s I5’s 0.68 s’s detection is above the 200 ms’s, and the hazard’s time’s budget’s is exceeded. The mitigation is the I5’s monitor’s cadence’s rise to the 4.2.2 §L.B.4’s trigger’s threshold’s — the 200 ms’s — which is the 4.3 lesson’s iteration’s item.

H5’s stuck. The hazard’s time is the safe state’s duration’s; the reactive guard’s 5 ms’s activation is well within.

H6’s spurious. The hazard’s time is the 4.2.3 §L.C.2’s 2.05 s’s; the I5’s monitor’s 0.68 s’s is within.

The budget’s failure’s is the H4’s, and the mitigation’s is the I5’s cadence’s rise. The register’s entry is the 4.3 lesson’s priority.

§L.E.3 — The register’s entries

The safety’s register’s six entries, one per hazard.

The register’s entries are the 3.3.4 §L.E.3’s five fields, and the residuals are the safety case’s gaps.

The H1’s residual’s the stiffness’s mis-estimation — the 2.3.3 identification’s interval’s coverage — and the 3.4.3 §L.E.2’s interval’s complement’s is the 3.4.4 §L.C.3’s monitor’s.

The H4’s residual’s the I5’s 0.68 s’s detection’s — the monitor’s cadence’s 1.5 Hz’s — and the 4.3 lesson’s iteration’s is the cadence’s rise’s.

The H6’s residual’s the semantic error’s within the tolerance’s — the tolerance’s 2.8 cm’s is the perception’s covariance’s, and the semantic’s error’s is below it — and the 4.2.3 §L.D.3’s escalation’s is the complement.

Self-explanation 2. Why is the H3’s 88 ms’s budget a tight’s margin rather than a comfortable one?

Answer. Because the hazard’s time’s 100 ms and the recovery’s 88 ms leave 12 ms, which is the monitor’s noise’s and the degrade’s latency’s variations’ joint’s; a 12% margin is the tail’s risk, and the register’s residual’s is the 12 ms’s excess’s.

Worked-example ladder.

WE-L.E.a (fully worked). The H3’s budget’s components are the monitor’s 33 ms, the degrade’s 50 ms, and the release’s 5 ms. Compute the total and the margin.

Solution. The total is $33 + 50 + 5 = 88$ ms; the margin is $100 - 88 = 12$ ms, or 12% of the hazard’s time. The margin’s tight’s, and the register’s entry’s residual’s is the 12 ms’s excess’s probability’s.

WE-L.E.b (completion). The degrade’s latency rises to 60 ms because the consumer’s affordance’s check is slower. Recompute the margin and state the acceptance.

Completion. The total is $33 + 60 + 5 = 98$ ms; the margin is 2 ms, or 2%. The acceptance’s marginal, and the fix is the degrade’s latency’s reduction’s — the affordance’s check’s parallelization’s — or the monitor’s cadence’s rise’s.

WE-L.E.c (faded). Write the register’s entry for the H4’s residual’s with the 4.3 lesson’s iteration’s item.

Faded step. The failure: the I5’s 0.68 s’s detection’s; the probability: moderate; the consequence: the unintended’s motion’s; the mitigation: the 4.2.3 monitor’s cadence’s; the residual: the semantic error’s within the tolerance’s.

Completion. The residual’s acceptance’s is the 4.3 lesson’s cadence’s rise’s, and the 3.1.3 §L.C.2’s paraphrase’s coverage’s is the semantic error’s reduction’s complement.

WE-L.E.d (contrastive near-miss). A team’s H4’s residual’s is accepted without the I5’s cadence’s rise, on the argument that the H4’s probability is low. The 4.3 lesson’s iteration’s prioritizes the H4’s, and the team’s acceptance’s is invalidated. Why it fails: the residual’s acceptance’s is the operator’s, and the operator’s acceptance’s requires the documented’s rationale’s and the residual’s magnitude’s; the H4’s severity’s is high, and the low’s probability’s does not compensate. The fix: the I5’s cadence’s rise, per §L.E.2.

Comparative table: the recovery’s budget.

Design principle P56.5. Budget the recovery’s time against the hazard’s time and register the negative margin’s item; the tight’s margin is the tail’s risk, and the negative’s is the architecture’s gap.

Consolidation checkpoint 5

(a) Three capabilities. You can state the five components’ assembly. You can compute the recovery’s budget per hazard. You can write the register’s six entries.

(b) Transfer probe. The H4’s hazard’s time is 200 ms and the I5’s detection is 0.68 s. What is the margin’s sign and the fix? Answer: the margin is negative, and the fix is the I5’s cadence’s rise to the 200 ms’s — the 5 Hz’s monitor — or the 4.2.3 §L.D.1’s monitor’s threshold’s tightening.

(c) Remediation rule. If you cannot state why the H3’s 12 ms’s margin is the tail’s risk, re-read §L.E.2 before the lab.

Failure taxonomy

The table covers the three lab corruptions plus three failures not exercised in the lab: the recovery’s loop, the escalation’s absence, and the monitor’s disabling.

The lab

Task. Implement the safety architecture’s five components — the invariants, the monitor, the guard, the recovery, and the escalation — for the running case’s full-stack agent, run the fault injection’s suite’s five faults with three magnitudes each, and compute the detection’s rate, the recovery’s success’s rate, the false alarm’s rate, and the safety case’s residuals.

Conditions. Python 3.10+, NumPy. The perception, the policy, and the reasoning are the prior labs’ stubs; the faults are injected at the components’ boundaries. The suite is the 4.1.3 400-episode’s synthetic’s replay. Seed all RNGs.

Controls. (i) The full architecture; (ii) the architecture without the recovery; (iii) the architecture without the guard’s reactive mode; (iv) the architecture with the monitor’s cadence’s halved.

Metrics.

Pre-registered hypotheses.

H1. The full architecture’s detection’s rate is at least 0.95, because the five faults’ mechanisms are the 4.2.1, 4.2.2, and 4.2.3’s checks.

H2. The architecture without the recovery’s detection’s rate is unchanged and its recovery’s success’s rate falls to 0.5, because the detection and the recovery are independent’s components.

H3. The architecture without the reactive guard’s recovery’s success’s rate falls on the F4’s saturation, because the preemptive’s Q-shield’s rejection’s alone does not restore the state.

H4. The halved’s monitor’s cadence’s detection’s rate falls on the F1’s pose’s spike, because the 8.5 ms’s cadence’s exceeds the 50 ms’s hazard’s time’s 3-sigma’s.

Break-it sequence.

1. Remove the recovery silently. The detection fires and the state persists. Silent: the detection’s log is normal.
2. Halve the monitor’s cadence silently. The F1’s spike is missed on the fast’s rise. Silent: the nominal’s cadence’s looks adequate.
3. Set the threshold at 15 N silently. The false alarm’s rate is 50% and the operator disables the monitor. Silent: the threshold’s number is conservative’s.

Acceptance criteria.

What good looks like. A good artefact has five properties. (1) The five components are separate functions with separate logs. (2) The invariants’ thresholds are derived from the hazards, not chosen. (3) The injection’s magnitudes are graded, not single-point. (4) The safety case’s residuals are a column, not an afterthought. (5) The break-it results are a table.

A runnable core of the monitor, the guard, and the recovery, seeded and annotated:

# lab_4_2_4.py — monitor, guard, recovery, safety case's residuals
import numpy as np
np.random.seed(0)

INVARIANTS = {
    "I1_force":  {"threshold": 18.5, "cadence_hz": 60, "hazard_s": 0.050},
    "I2_workspace": {"threshold": 0.004, "cadence_hz": 30, "hazard_s": 0.100},
    "I4_velocity": {"threshold": 0.085, "cadence_hz": 143, "hazard_s": 0.020},
}

def monitor(state, invariant, noise_sigma):
    """Return True if the invariant is violated (with the noise's margin)."""
    value = state[invariant["id"]]
    return value > invariant["threshold"]

def guard(violation, recovery_kind):
    """The guard's reactive mode plus the recovery's kind."""
    if not violation:
        return "none"
    return recovery_kind

def recovery(kind, state, retry_count):
    """The five kinds, with the retry's bound and the state's change."""
    if kind == "retry":
        if retry_count >= 2:
            return "degrade", state
        return "retry", state - 0.05          # state's change
    if kind == "degrade":
        return "degrade", state                # coarser accuracy
    if kind == "abort":
        return "abort", 0.0                    # safe state
    if kind == "replan":
        return "replan", state
    return "escalate", state

# The composed's rate (Eq. C.1)
kinds = [("retry", 0.55, 0.80), ("degrade", 0.15, 0.60),
         ("replan", 0.20, 0.90), ("abort", 0.08, 1.0),
         ("escalate", 0.02, 0.95)]
R = sum(p * s for _, p, s in kinds)
print(f"composed's rate = {R:.3f}")

# The Neyman-Pearson's threshold
def false_alarm_rate(limit, threshold, sigma):
    z = (threshold - limit) / sigma
    return 1 - 0.5 * (1 + np.math.erf(z / np.sqrt(2)))   # upper tail

for limit, thr, sig in [(20.0, 18.5, 0.5), (20.0, 19.5, 0.5)]:
    print(f"limit={limit} thr={thr} sigma={sig}  "
          f"FA={false_alarm_rate(limit, thr, sig):.4f}")

# The safety case's residuals
residuals = {
    "I1_force": 0.001,
    "I2_workspace": 0.02,
    "I3_grasp": 0.10,
    "I4_velocity": 0.005,
    "I5_goal": 0.05,
}
total = sum(residuals.values())
print(f"total residual's union = {total:.3f}")
print("weakest's =", max(residuals, key=residuals.get))

Line 4–8 define the three invariants’ thresholds, cadences, and hazard’s times. Lines 10–14 are the monitor’s evaluation; lines 16–28 the guard and the five recovery kinds with the retry’s bound and the state’s change. Lines 30–37 compute the composed’s rate of Eq. (C.1). Lines 39–46 compute the Neyman–Pearson’s false alarm’s rate. Lines 48–55 compute the safety case’s residuals’ union.

Cheat sheet

Exercises with solutions

E 4.2.4.1. State the five components and each one’s output.

S 4.2.4.1. Invariants (the target’s list), monitor (the violation’s report), guard (the preemptive or reactive’s action), recovery (the state’s restoration or the goal’s re-specification), escalation (the operator’s intervention). The lesson: the five components’ independence is the coverage’s basis, and the composition is the architecture.

E 4.2.4.2 (transfer). The I1’s hazard’s time is 50 ms and the safety’s factor is 3. Compute the monitor’s cadence.

S 4.2.4.2. The detection’s time is $50/3 = 17$ ms; the cadence is 60 Hz. The lesson: the cadence is the hazard’s time’s inverse with the safety’s factor.

E 4.2.4.3. Write the five invariants and their hazards’ coverage.

S 4.2.4.3. I1 force (H1, H5), I2 workspace (H2), I3 grasp (H3), I4 velocity (H1, H2), I5 goal (H4, H6). The lesson: one invariant can cover several hazards, and one hazard can need several invariants.

E 4.2.4.4 (diagnostic). The I1’s threshold is 15 N with a 0.5 N’s noise’s standard deviation and the false alarm’s rate is 50%. What is the diagnosis and the fix?

S 4.2.4.4. The threshold is 10 standard deviations below the 20 N’s limit, so the nominal’s 5 N is within the hysteresis’s band; the fix is the Neyman–Pearson’s threshold at the 18.5 N and the two-cycle’s hysteresis. The lesson: the threshold’s calibration is the false alarm’s trade’s, and a conservative’s threshold is the operator’s disabling’s source.

E 4.2.4.5. Compute the composed’s rate for the retry’s 0.55 and 0.80, the degrade’s 0.15 and 0.60, the replan’s 0.20 and 0.90, the abort’s 0.08 and 1.0, and the escalation’s 0.02 and 0.95.

S 4.2.4.5. The terms are 0.44, 0.09, 0.18, 0.08, and 0.019; the sum is 0.809. The lesson: the composed’s rate’s sensitivity is the $p$‘s, and the retry’s 0.55 dominates.

E 4.2.4.6 (transfer). The retry’s $s$ rises to 0.90 and the others are unchanged. Compute the composed’s rate.

S 4.2.4.6. The retry’s term is $0.55 \times 0.90 = 0.495$; the sum is $0.495 + 0.09 + 0.18 + 0.08 + 0.019 = 0.864$. The lesson: the retry’s $s$‘s improvement’s effect is the 0.055’s, which is the $p \times \Delta s$‘s.

E 4.2.4.7 (diagnostic). The H3’s budget’s recovery’s time is 88 ms and the hazard’s time is 100 ms. Is the margin comfortable, and what is the residual?

S 4.2.4.7. The margin’s 12 ms is 12% of the hazard’s time, and it is tight — the tail’s risk’s; the residual’s is the 12 ms’s exceedance’s probability’s, and the register’s entry’s is the 2.3.3 adaptive grip’s complement’s. The lesson: the tight’s margin is the tail’s risk, and the register’s residual’s is the exceedance’s.

E 4.2.4.8. Write the safety case’s five arguments’ residuals and state the case’s strength’s.

S 4.2.4.8. The invariants’ (the uncovered modes), the monitor’s (the detection’s misses), the guard’s (the conservatism), the recovery’s (the unrecovered’s 0.19), the escalation’s (the absence’s window). The case’s strength’s is the residuals’ acceptance’s. The lesson: the case’s strength’s is the residuals’, not the tests’ pass’s.

E 4.2.4.9 (transfer). The safety case’s recovery’s argument’s premise is 0.81 and the suite’s replay’s recovery’s success is 0.72. Is the case’s argument’s evidence consistent?

S 4.2.4.9. No; the evidence’s 0.72 is below the premise’s 0.81, and the argument’s residual’s re-examination’s is the resolution. The lesson: the case’s evidence’s inconsistency is the argument’s residual’s re-examination’s, not the claim’s acceptance’s.

Exit test

You are ready for Module 4.3 when you can, without notes:

1. Run a hazard analysis and rank the hazards by severity times probability.
2. Write an invariant with its threshold and detection’s time.
3. Name the five components and their outputs.
4. Compute the monitor’s cadence from the hazard’s time.
5. State the guard’s two modes and their conditions.
6. Set the monitor’s threshold by the Neyman–Pearson criterion and compute the false alarm’s rate.
7. Name the five recovery kinds and their selection’s rule.
8. Run the escalation’s protocol’s four steps.
9. Compute the composed’s recovery’s rate and its sensitivity.
10. Name the five faults and their hazard’s mapping.
11. Design the fault injection’s suite’s four metrics.
12. Write the safety case’s five arguments with their residuals.
13. Compute the recovery’s budget per hazard.
14. Write the register’s six entries with residuals.
15. State why the tight’s margin is the tail’s risk and the negative’s is the architecture’s gap.

Cross-references. 4.2.1 supplies the perception contract and the checks restated in §L.A.2 and §L.B.1. 4.2.2 supplies the four authorities, the arbitration, and the attribution restated in §L.A.3 and §L.C.1. 4.2.3 supplies the abort conditions, the deferral, and the monitor restated in §L.C.2 and §L.E.2. 3.3.4 supplies the four-layer stack, the safe-action set, and the register restated in §L.A.3 and §L.E.3. 2.3.3 supplies the force limits, the momentum observer, and the safe state restated in §L.A.2. 2.2.4 supplies the Q-shield restated in §L.B.2. 4.1.3 supplies the suite and the replay restated in §L.D.2. Module 4.3 uses the fault injection’s suite as its experiment template. Module 4.4 uses the safety case as the defense’s evidence.

Ready. The next lesson to write is 4.3.1 — Systematic Experimentation and Ablations. Say “next” to generate it. Module 4.3 is the curriculum’s final phase’s last module before the master’s defense, and its lessons are marked proposed in the index.