ARC — Autonomous Risk Classification

§0

Purpose and scope

Everyone deploying autonomous machines is currently describing them in private vocabulary. One operator's "supervised" is another's "autonomous"; one fleet counts a safety stop as an incident and another counts it as normal operation. The result is that safety cases cannot be compared, insurers cannot pool experience, and regulators are being asked to write rules about categories that have no agreed definition.

ARC defines five things and nothing more: how autonomous a machine is (§1), where it is permitted to operate (§2), what its safety telemetry means (§3), how badly an event turned out (§4), and how to count exposure (§5).

Scope note ARC is a classification and reporting vocabulary. It is not a safety standard, does not state what is safe, does not certify anyone, and does not specify engineering requirements. It gives the parties who do those things a shared way to describe what they are talking about.

The key words MUST, SHOULD, and MAY are used in their conventional specification sense.

§1

Autonomy tiers — RA-0 to RA-5

Automated driving has agreed levels; general robotics does not, and borrowing the driving levels does not work because they assume a vehicle, a road, and a driver's seat. ARC tiers are defined by who is responsible for the next action and who handles the situations the machine cannot.

RA-0

Teleoperated

A human issues every motion command in real time. The machine executes; it does not choose.

Operator liable
Continuous link

RA-1

Assisted

The machine executes short pre-defined sequences on command. A human initiates each one and watches it complete.

Operator liable
Line of sight

RA-2

Supervised autonomy

The machine plans and acts continuously. A human monitors in real time and is expected to intervene. Interventions are routine, not exceptional.

Shared
1:1 to 1:5 ratio

RA-3

Conditional autonomy

The machine operates unsupervised inside a declared ODD and requests human help when it reaches a boundary it cannot resolve. A human must be available to respond within a stated time.

Deployer liable
1:many, on call

RA-4

High autonomy

The machine handles ODD exits itself, including bringing itself to a safe state without human fallback. Humans are notified, not relied upon.

Deployer / maker
No fallback

RA-5

Unrestricted autonomy

No declared ODD limitation for the machine's class of task. Reserved; no system is known to meet this today and the tier exists so that claims to it are legible.

Maker liable
Reserved

Normative A machine's tier MUST be declared per task type, not per machine. The same humanoid may be RA-3 for shelf-to-tote transfer and RA-2 for human handover. Reporting a single tier for a mixed-task deployment MUST NOT claim conformance.

§2

Operating design domain

A tier is meaningless without the domain it applies to. An ARC-conformant ODD declaration MUST state a value or an explicit unrestricted for each of the six dimensions below.

Spatial

Permitted area, surface types, gradients, and vertical transitions such as stairs, kerbs, and lifts.

warehouse.zone_a; no_stairs

Human proximity

Who may be within the working envelope: nobody, trained staff only, or members of the public.

trained_only

Temporal

Permitted hours and shift patterns, including whether unattended overnight operation is allowed.

06:00–22:00; attended

Environmental

Illumination range, precipitation, temperature, and surface condition bounds.

indoor; >150lux; dry

Force & payload

Maximum payload mass, reach envelope, and the peak contact force the machine can apply.

≤22kg; ≤140N peak

Connectivity

Network dependency and the declared behaviour on link loss.

degraded_ok; safe_stop@30s

Normative Time spent operating outside any declared dimension MUST be reported as ODD exit (S5) and MUST NOT be excluded from exposure. Out-of-domain operation is a rating factor, not a coverage question — a machine that leaves its domain is still a machine that was working.

§3

Safety signals — S1 to S8

These are the events that ARC-conformant telemetry reports. Definitions are deliberately narrow so that counts are comparable between fleets and between manufacturers. Each signal has a defined unit and a required minimum payload.

Code	Signal	Definition	Unit
S1	Intervention	A human assumes control of a machine that was operating autonomously, whether requested by the machine or initiated by the human. Both directions are counted; the trigger is recorded.	count / robot-hour
S2	Protective stop	Motion halted by a safety function — emergency stop, light curtain, force limit, or watchdog. Excludes normal task completion and operator pause.	count / robot-hour
S3	Proximity event	A person detected inside the declared safety envelope while the machine was in motion, whether or not a stop followed.	count / robot-hour
S4	Force exceedance	Measured contact force or torque above the declared D5 limit, regardless of what was contacted.	count + peak N
S5	ODD exit	Operation outside any declared §2 dimension. Reports which dimension and for how long.	count + duration
S6	Degraded operation	Continued operation with a known sensor, actuator, or compute fault. Reports the faulted subsystem and elapsed time in degraded state.	duration
S7	Autonomous recovery	The machine returned itself to nominal operation from a fault or ODD exit without human action. The positive signal — recovery capability is a risk reducer.	count / attempts
S8	Change event	Deployment of firmware, control policy, or model weights to a unit. Reports scope, whether staged, and whether rollback is available.	count + fleet share

Normative S1 MUST distinguish machine-requested from human-initiated takeover. Conflating them is the most common way intervention data is made useless — a machine that asks for help is behaving correctly, and a human who grabs the controls unprompted is reporting something else entirely.

arc-event.json§3 minimum payload

{
  "arc_version": "0.1",
  "unit_id":     "nb-warehouse-0142",
  "task_tier":   "RA-3",          // §1, per task
  "signal":      "S1",
  "trigger":     "machine_requested", // or human_initiated
  "odd_state":   "in_domain",
  "t":            "2026-08-19T14:22:07Z",
  "robot_hours": 1841.5          // §5 cumulative
}

§4

Incident severity — IS-0 to IS-5

Severity is reported separately from signals because an event's cause and its outcome are different facts. A protective stop that prevented contact and one that followed contact are the same S2 and very different IS.

Code	Severity	Threshold
IS-0	Near-miss	No contact and no damage. A safety function operated as intended, or the situation resolved without one.
IS-1	Contact	Physical contact with a person or object with no injury and no damage requiring repair.
IS-2	Minor damage	Property damage repairable in place, or damage to the machine not requiring removal from service.
IS-3	Reportable	Injury requiring first aid, or damage requiring the machine or property to be taken out of service.
IS-4	Serious	Injury resulting in lost time or medical treatment beyond first aid, or damage above the deployer's declared materiality threshold.
IS-5	Severe	Life-threatening or life-altering injury, fatality, or damage with third-party consequence beyond the site.

Normative IS-0 near-misses SHOULD be reported at the same fidelity as higher severities. They are the only high-frequency safety data an early fleet produces, and a reporting culture that counts only injuries produces a dataset that cannot predict them. Any rating scheme built on ARC MUST NOT load premium on IS-0 frequency alone.

§5

Exposure units — the robot-hour

Every rate, every frequency, and every comparison has a denominator, and it is the least glamorous and most consequential definition in this document. If two fleets count robot-hours differently, none of their published safety numbers can be compared.

Definition One robot-hour is sixty minutes during which a unit is powered, in a task state, and capable of motion — whether or not it moved.

State	Counts?	Reason
Executing a task	Yes	Plainly exposed.
Idle, powered, awaiting a task	Yes	Capable of motion means capable of harm.
Charging, motion inhibited	No	Not capable of motion.
Protective stop, awaiting reset	No	Motion inhibited by a safety function.
Teleoperated (RA-0/RA-1)	Yes*	Counts, but reported separately — exposure exists, autonomy does not.
Powered down or in transport	No	Handled by transit cover, not operational exposure.

* Teleoperated hours MUST be reported as a separate accumulator. Mixing them into autonomous robot-hours understates intervention rates by exactly the amount that matters most.

§6

Conformance

There are three levels. Nobody audits them; they are self-declared, and the point is that a claim of conformance says something specific enough to be wrong.

ARC-D

Declaring. Publishes autonomy tiers per task (§1) and a complete ODD declaration (§2). No telemetry requirement. Achievable in an afternoon by any deployer.

ARC-R

Reporting. ARC-D, plus emits all eight safety signals (§3) with the minimum payload, and counts exposure per §5.

ARC-S

Severity-linked. ARC-R, plus every incident is classified per §4 and linked to the signals preceding it. This is the level at which fleet data becomes actuarially useful.

Citation format
ARC v0.1 §3 (Roboline, 2026). Available at roboline.com/standard/
Licence CC BY 4.0 — reuse, adapt, and build on this, including commercially, with attribution. Competing insurers are explicitly welcome to rate from it.