Every physical technology that scaled did so by making its failures legible. The flight data recorder turned aviation crashes from mysteries into engineering problems. The automobile's event data recorder did the same for the crash you can't see coming. In both cases, the instrument came first, and the safety and the insurability followed.
Robots are arriving faster than the framework that should insure them. Roughly eighteen thousand humanoids shipped last year; by 2050 there may be more than a billion sharing our factories, warehouses, and homes. When one of them loses balance near a worker, or bumps a stamping machine, or hands off from autonomy to a remote operator at exactly the wrong moment, someone has to be able to say what happened. Today, mostly, no one can.
The incident window, not the movie
The instinct is to record everything. It's the wrong instinct. Continuous fleet surveillance is a liability, a privacy problem, and a data-storage bill that grows with every robot you deploy. It also isn't what an insurer actually needs.
The Robot Data Recorder (RDR) captures the incident window, a bounded buffer around a covered event, and nothing else. RDR is software only — a signed, read-only container that runs on compute the robot already carries, not a hardware dongle or onboard appliance. When a fault or near-miss trips the recorder, it persists the seconds on either side of the event: robot position and task state, a sensor snapshot, command and operator history, human and machine proximity, fault codes, and a relevant video or lidar frame. Then it signs that window locally and forwards only that.
The recorder keeps the window around the event, not the movie of the whole shift.
What it explicitly does not collect is just as important: no continuous video monitoring, no OEM model weights, no proprietary robot intelligence, no customer trade secrets, no unrelated robot behavior. The narrower the capture, the easier it is to trust, and the easier it is to say yes to.
Out of the loop, by construction
A recorder that can influence the robot is a recorder no safety engineer will approve. So the RDR is a passive subscriber: it reads the telemetry your robots already publish and has no publisher on any command, actuation, or safety topic. There is no code path from the recorder to the robot. It cannot instruct, override, or delay anything.
It ships as a signed, read-only container and runs on compute the robot already carries:
docker run -d --read-only --cpus 0.5 --memory 384m nvcr.io/boop/rdr
Distributed and attested through NVIDIA's container catalog, it draws under 3.6% of CPU off the control cores, about 0.3% of memory, and 0% of the GPU or AI engine. Integration is a standard ROS 2 pattern mapped to your existing topics, a half-day session, not a project. And it ships with an audit package: a signed read-only policy, resource caps, and an attested build your own safety team can verify.
One integration for autonomy and teleop
Deployments are rarely purely autonomous. Robots hand off to remote operators, and the handoff itself is where risk concentrates. The RDR is deployment-mode-agnostic by design: control mode is just one more field on every record, and autonomy-to-teleop transitions are captured like any other event. It records the network latency profile, the supervision ratio, the operator certification tier, and session duration, with operator identity pseudonymized at the source. Latency variance, not raw latency, turns out to be the single most safety-relevant metric.
Why the insurer wants it
Reconstructible incidents change the economics of coverage. Claims settle on evidence instead of argument. Pricing sharpens as real-world fault data accumulates. And the same signed windows, shared through the Physical AI Incident Data Standard (PAIDS), feed back into the world models behind every robot. Coverage funds the data; the data sharpens the coverage. Every incident makes the next robot a little safer, and the next deployment a little easier to insure.
The black box didn't make planes crash less by watching pilots. It made flying safer by making failure understandable. That's the bet here, pointed at the next physical technology to enter the household.
Deploying robots and want the RDR in your fleet? We'll walk your safety team through the audit package.
Talk to us