Supervisory Control

The operator does not engage in continuous manual control. Instead, they issue high-level goals or setpoint adjustments and then disengage to monitor outcomes. This contrasts with direct teleoperation, where every motor command originates from the human. The autonomous system executes the plan until it encounters an edge case, reaches a goal state, or detects a deviation requiring human judgment. This intermittent loop reduces cognitive load and allows a single operator to supervise multiple agents simultaneously.

Effective supervisory control relies on a continuous feedback loop:

• Perception: The system presents a synthesized view of the environment via a digital twin interface or dashboard.
• Comparison: The operator compares the system's actual state against the intended goal.
• Correction: If a deviation is detected, the operator issues a corrective command or a takeover request is triggered. This loop ensures the human remains the ultimate authority while the machine handles execution.

A core design challenge is preventing alert fatigue while ensuring critical signals are not missed. Supervisory interfaces employ notification throttling to suppress, group, or delay non-critical alerts. When a system encounters an edge case outside its Operational Design Domain (ODD), it escalates via a defined escalation policy. The interface visually prioritizes anomalies using confidence score displays, allowing the operator to quickly triage which agents need immediate attention.

Supervisory control is not a binary state. The sliding autonomy model allows the level of machine independence to shift dynamically along a spectrum:

• Full Manual: Direct teleoperation via joystick or keyboard.
• Shared Autonomy: The human provides intent (e.g., a goal point) while the machine handles low-level navigation and collision avoidance.
• Full Autonomy: The system operates independently within its ODD, only alerting the human for exceptions. This flexibility allows the system to adapt to task complexity and operator trust levels.

A safety-critical characteristic where a separate, formally verified monitor continuously checks the autonomous system's actions against a set of safety invariants. If the system is about to violate a boundary—such as exceeding a speed limit or crossing a geofence—the run-time assurance layer intervenes independently of the main autonomy stack. This creates a deterministic safety net that does not rely on the operator's reaction time, transitioning the agent to a minimal risk condition (e.g., a controlled stop) if necessary.

Every supervisory action must be recorded for post-incident analysis and regulatory compliance. The system maintains an immutable audit trail that chronologically logs:

• All operator commands and manual overrides.
• The system's internal state and confidence scores at the time of each decision.
• The context and reason for every intervention logging event. This dataset is critical for improving the autonomy stack's edge-case handling and for legal liability attribution.

The operator's mental model of the fleet's current state, encompassing perception of agent positions, comprehension of task progress, and projection of near-future states. Endsley's three-level model is the foundational framework. Loss of situation awareness is the primary cause of operator error in supervisory control.

• Level 1: Perception of elements (agent locations, battery levels)
• Level 2: Comprehension of meaning (recognizing a traffic bottleneck forming)
• Level 3: Projection of future status (predicting a collision in 30 seconds)

A dynamic control architecture where the level of autonomy shifts along a continuous spectrum based on task complexity, operator trust, or environmental conditions. Unlike binary handoffs, sliding autonomy allows the system to gracefully degrade or escalate authority. For example, an AMR navigating an open aisle operates at full autonomy, but as it approaches a congested intersection, control slides toward shared autonomy, blending human guidance with machine precision.

A structured signal from an autonomous agent to the human operator requesting immediate intervention. Triggered by edge cases, uncertainty thresholds, or ODD violations. Effective takeover requests must include:

• Reason code: Why the agent is handing off (e.g., sensor occlusion)
• Urgency level: Time-to-collision or deadline buffer
• Suggested action: The agent's recommended course, if any
• Context snapshot: Relevant sensor data at the moment of handoff

The desensitization of a human operator caused by exposure to a high volume of frequent notifications, leading to missed critical warnings. In fleet supervision, alert fatigue is a systemic safety risk. Mitigation strategies include notification throttling, severity-based filtering, and predictive alert aggregation that groups related low-priority events into a single digest rather than triggering individual pings for each agent.

A real-time safety mechanism that acts as an unbypassable formal safety envelope around the autonomous system. Unlike advisory systems, RTA continuously monitors planned actions against predefined safety invariants and intervenes autonomously to prevent violations. If an operator's manual override command would breach a safety invariant, the RTA rejects it. This creates a dual-control architecture where human authority is bounded by machine-enforced safety constraints.

A synchronized 3D virtual representation of the physical fleet environment serving as the primary supervisory control surface. Operators interact with the digital twin rather than raw video feeds, enabling:

• Spatial querying: Click any agent for telemetry
• Command preview: Simulate a reroute before committing
• Time-shifted replay: Scrub backward to analyze an incident
• What-if simulation: Test interventions in a sandboxed copy of the live state