During the attack: who reaches the safe state?

The attack has started. The AI now takes orders from someone else. The robot is still moving. What brings it to rest?

Safety engineering has a name for the goal: the safe state. A robot at rest, actuators de-energised, hazard controlled. The question is who gets it there.

EU machinery law is clear about what the stop must do. Annex III 1.2.4.1:

The machinery or related product's stop control shall have priority over the start controls.

Annex III 1.2.4.3, on the emergency stop:

The emergency stop function shall be available and operational at all times, regardless of the operating mode.

The same section adds that emergency stop devices "shall be a backup to other safeguarding measures and not a substitute for them". So the e-stop is the last line, not the plan.

Now add the attacker. Annex III 1.2.1(a) asks control systems to withstand "reasonably foreseeable malicious attempts from third parties leading to a hazardous situation". IEC TS 63074 names the same fear. It covers threats that can lead to "the loss of the ability to maintain safe operation of a machine".

From January, put those lines side by side. The stop must win over every start. The emergency stop must work at all times. The control system must withstand a foreseeable attacker, where appropriate to the risks. (The annex exempts a few machines from fitting an e-stop, hand-held ones among them.)

Here's what none of those lines says. Where does the stop run?

That matters because of one engineering fact. A check that runs on a computer depends on that computer. I called this fate-sharing in P2. A random fault might hit the AI and spare the check. An attacker who holds the computer can choose not to spare it.

So "available at all times" becomes a hard question. Available to whom, if someone else holds the machine that decides?

Here's the honest limit. The annex text I quote says what the stop must do. It doesn't name an architecture. The Regulation leaves that choice to the maker and the assessor. I'm asking the question here, not answering it.

Bottom line: from January, the law demands a stop that wins and a control system that withstands attackers. It never says how the two meet. That gap lands in 85 days.

Safety engineers: on your robot, does the stop share a computer with the AI?

Part 7 of 12 · When the AI drives the motor: Physical AI cybersecurity as a safety problem.