---
title: "When the network drops, what should a robot do?"
url: "https://kyberbot.com/blog/when-the-network-drops"
description: "A machine that stops dead on every hiccup is useless; one that carries on unbounded is dangerous. Degraded autonomy is a design decision, not an error path."
---

# When the network drops, what should a robot do?

August 2, 2026·3 min read·Editorial team

A small wheeled robot from behind, its antenna folded down and a three-position mode switch set to the middle

Warehouse wifi drops. It drops behind metal racking, it drops when the aisle fills with pallets, it drops for four seconds during a roaming handover. A robot that stops dead every time is an expensive trolley; a robot that carries on with no boundary is a hazard nobody authorised. What happens in those four seconds is a design decision, and treating it as an error path is how it ends up undesigned.

## Three bad answers

**Stop on any loss.** Safe in the narrow sense and operationally useless. Enough spurious stops and someone will extend the timeout, then extend it again, and the timeout will end up long enough that it no longer means anything.

**Carry on regardless.** Common, rarely stated out loud. The machine keeps executing its plan because nothing told it not to. The problem is not the four seconds; it is that the same code path handles a four-hour outage identically.

**Buffer and replay.** Queue the commands, apply them when the link returns. This is catastrophic with physical actuators: the world moved while the queue sat there, and executing a stale plan is worse than executing nothing.

## The useful answer: the envelope is local

The insight that makes this tractable is that the _authority_ to act does not have to travel over the network in real time. Only the _decisions_ do.

The harness — the envelope, the limits, the escalation rules — is cached on the machine and evaluated on the machine. It was authored centrally, distributed with a version and an expiry, and it works whether or not the link is up. That is the same pattern as an offline-capable access token, applied to physical motion.

So losing the network does not remove the boundary. It removes the ability to _widen_ it, to receive new tasks, and to escalate to a human quickly. Each of those has a sensible response, and none of them is “keep going and hope”.

## Degradation as a ladder, not a switch

What we keep coming back to is a small number of named modes, each with an explicit envelope, and rules for moving between them.

**Connected.** Full envelope. New tasks accepted, escalation available in seconds.

**Degraded, briefly.** Seconds without a link. Finish the current motion, then hold. Do not start anything new. This covers the overwhelming majority of real outages, and handling it gracefully is what stops people from disabling the safety timeout.

**Degraded, extended.** Minutes. Complete the current task only if it can be finished safely in isolation, then move to a designated safe position and wait. No new work, reduced speed, narrowed zones.

**Isolated.** The envelope’s expiry approaches, or the machine cannot confirm its own localisation. Stop in place, signal locally, wait for a human. An expired policy is not a policy.

The ladder matters more than the specific thresholds, because it turns an implicit behaviour into something an operations team can read, argue about and set deliberately.

## What the machine must be able to do alone

Three capabilities have to be local or the ladder does not work.

**Evaluate the envelope.** No round trip to decide whether a motion is permitted.

**Know its own confidence.** Localisation quality, perception agreement, actuator health. A machine that cannot tell it is lost will happily execute a plan into a wall.

**Signal locally.** Lights, sound, a screen, the operator’s device — a robot waiting silently in an aisle is an obstacle, and being an unexplained obstacle is its own kind of hazard.

## The honest limit

None of this substitutes for certified safety hardware. An emergency stop must work with the network down, the compute frozen and the software in an unknown state; that is precisely why it is a separate, certified, hard-wired system.

What software can do is make the certified layer’s job rare. Every time the harness slows a machine because confidence dropped, that is an intervention the emergency stop did not have to make. Measuring that ratio — how often the soft layer catches something before the hard layer must — is one of the better ways to tell whether an autonomy stack is actually improving.

-   edge autonomy
-   degraded mode
-   reliability
-   networks

## Keep reading

-   [What it means for an assistant to know you best](https://kyberbot.com/blog/an-assistant-that-knows-you)
-   [How an assistant hands work to a swarm](https://kyberbot.com/blog/how-an-assistant-hands-work-to-a-swarm)