1. Vendor and Product Reality
Epiroc AB is a Swedish multinational and a major global supplier of underground and surface mining equipment, competing with firms such as Sandvik and Caterpillar. Through its acquisition of Mobilaris MCE, Epiroc brought an established mining-IT product line in-house, whose Mobilaris Mining Intelligence (MMI) and Mobilaris Onboard suites are, per publicly reported deployments, used across underground and surface mining operations. The comparison here treats Mobilaris at the architecture level from publicly reported information and does not depend on any single site, contract, or deployment figure.
The platform consolidates network-derived underground positioning, vehicle telematics, production reporting, and traffic-management views into a single operational picture. On top of this real-time picture, Epiroc markets automation and connectivity under its 6th Sense umbrella, including autonomous and remote loader operation (Scooptram Automation), autonomous drilling offerings across its rig lines, and remote-operations centers for underground and surface fleets. Customers increasingly run mixed fleets where Epiroc autonomous loaders share ramps and intersections with human-operated trucks, and where blast-clearance, ventilation, and refuge-chamber states are computed centrally and pushed to equipment.
Operationally, the architecture is command-flow oriented: the central Mobilaris layer computes a route, a clearance, or a production directive; the equipment executes; telemetry returns; reports aggregate. Authority for an actuation lives implicitly in the role of the operator or the dispatch user, and exceptions surface as alerts rather than as architecturally-defined refusals. This is consistent with the rest of the mining-IT industry, but it is precisely the layer at which regulators (MSHA, the Australian WHS regime, the EU Machinery Regulation, ISO 17757) are tightening expectations around demonstrable harm-minimization and audit-grade post-actuation verification.
2. The Architectural Gap
Command-flow mining-IT architectures, as a category, resolve actuation as issue-and-execute: when the coordination layer issues a tram command, a drill commitment, or a haul-cycle continuation, the equipment executes it, and refusal is delivered by equipment interlocks and emergency-stop logic rather than by a first-class governed decision over credentialed observations. This is not a criticism of Mobilaris specifically; it is the shape of the mining-IT industry, and Epiroc coordinates that flow as well as anyone. The architectural property the provisional adds is a graduated-actuation mode selector fed by a composite admissibility evaluator, so that a proposed actuation resolves not into a permit-or-deny outcome but into one of a plurality of governance-defined modes (for example disabled, advisory, consultative, partial, constrained, stage-gated, deferred, or full), with the selected mode continuously mapped to the admissibility determination.
Three architectural differences follow from placing governance at the actuation layer. First, harm-minimization in safety-critical maneuvers (tramming past a refuge bay during shift change, descending a ramp with degraded brake telemetry) becomes a structural property of the commitment, evaluated by a harm-minimization deviation mechanism that can select a path minimizing composite projected harm when no available path avoids all harm, rather than resting solely on interlock libraries written per equipment platform. Second, reversibility is evaluated explicitly: a commitment to begin a long-hole drill cycle and a commitment to begin a blast-clearance ventilation purge carry radically different reversal costs, and a reversibility-aware commitment-point evaluator classifies each and modulates admissibility thresholds and mode selection accordingly. Third, post-actuation verification is closed structurally: rather than treating returning telemetry as a report, the governed layer emits a verification observation that re-enters the admissibility chain, so downstream commitments admit or refuse on the verified state rather than the commanded state.
The distinction is architectural, not a question of adding sensors, dispatch UI, or machine learning to a coordination layer. It is the presence or absence of a governed-actuation layer between intent and effector. That layer is what the provisional discloses.
3. What the Governed-Actuation Primitive Provides
The governed actuation primitive specifies that every proposed actuation in a conforming system passes through a graduated-actuation mode selector, with the selected mode produced by a composite admissibility evaluation rather than a binary permit-or-suppress gate. The admissibility evaluation itself yields more than a binary outcome: it produces an admit, gate, defer, solicit, reject, or escalate disposition over authority-credentialed observations, freshness, and policy, and a solicit disposition can emit a governed discovery query for additional observations to resolve uncertainty. The mode set the selector draws from is governance-policy-defined per actuator class and includes at minimum disabled, simulated, advisory, consultative, shadowed, partial, constrained, stage-gated, deferred, full, and emergency-accelerated modes. It is technology-neutral: a tramming path, a blast-clearance directive, a refuge-chamber lockdown, and a ventilation reconfiguration are all expressed in the same architectural shape, even though the implementing actuators differ.
Each commitment carries an explicit harm-minimization evaluation parameterized by the credentialed configuration of the operating context. For a Scooptram tramming past a refuge bay, the configuration includes the credentialed presence list, the credentialed brake-system class, and the credentialed ventilation state; the actuation mode is selected to minimize the worst-case harm under that configuration rather than the expected-case throughput. For a long-hole drill rig, the configuration includes credentialed blast-pattern, credentialed personnel-clearance, and credentialed ground-control state. The harm-minimization evaluation is structurally distinct from the throughput evaluation, and both contribute to mode selection.
Reversibility is evaluated as a first-class property of the commitment. Commitments with low reversal cost (a tram-stop request, a drill-pause request) are admissible under weaker credentialing; commitments with high reversal cost (a blast initiation, a stope-fill commitment) require stronger credentialed observation and stricter mode selection. The reversibility evaluator is itself a credentialed component, and its output enters lineage.
Post-actuation verification is structurally required: every commitment produces a verification observation that re-enters the chain at the observation layer, allowing downstream commitments to admit or refuse based on the verified state rather than the commanded state. This recursive closure is what distinguishes governed actuation from a flowchart of dispatch operations and what makes the substrate auditable end-to-end against MSHA, EU Machinery Regulation, and ISO 17757 expectations.
4. Composition Pathway
A governed-actuation substrate integrates beneath Mobilaris and 6th Sense without replacing either. The Mobilaris dispatch and operational-picture layer continues to compute routes, production directives, and clearance states; what changes is that each computed directive is expressed as a proposed actuation to the governed-actuation layer rather than as a direct command to the equipment. The substrate then resolves the proposed actuation into a graduated mode and emits the corresponding actuator command.
Authority credentialing maps cleanly to existing mining roles: shift bosses, blast supervisors, ventilation officers, and remote-operations operators each carry credential classes whose authority scope is published in the operation's governance configuration. Credentialed observations from underground positioning, gas monitoring, ground-control monitoring, and equipment health flow into the admissibility evaluator. Lineage records every actuation evaluation, mode selection, preemption event, commitment-point determination, harm-minimization selection, and verification outcome, accumulating in one store that internal incident review and inspections can read from directly.
For the OEM autonomy products (Scooptram, Pit Viper, Boomer), integration is at the commitment-issuance boundary: the autonomous controller proposes a commitment, the substrate evaluates and selects the mode, the controller executes the resolved mode, and the verification observation closes the loop. Existing interlock libraries continue to operate as a final safety net, but the architectural locus of harm-minimization moves into the substrate, where it can be reasoned about, audited, and certified once rather than re-litigated per equipment platform.
5. Embodiment Breadth
The disclosed approach is not tied to mining or to any single actuator. The provisional enumerates the governed actuator execution primitive over actuators of any type, including brake-by-wire, steer-by-wire, throttle-by-wire, gate, barrier, valve, pump, manipulator-arm, hydraulic, and pneumatic actuators; propulsion, electrical, optical, acoustic, thermal, chemical, medical, agricultural, and transit actuators; and any equivalent effector producing a physical effect on execution. A skilled implementer building on a mining stack would place the governed-actuation layer at the commitment-issuance boundary: the coordination or autonomy controller proposes an actuation (an actuator, a command, and parameters), the composite admissibility evaluator jointly weighs credentialed observations, a dispositional field, forecasting observations, and a capability envelope, the graduated-actuation mode selector maps the admissibility disposition to a mode, an actuator driver executes at that mode, and a post-actuation verification mechanism compares observed effects against expected effects.
Variations disclosed include distributed, centralized, and hybrid topologies; per-actuator confidence-threshold modulation; emergency preemption bounded by a per-authority preemption budget and expiration; mode de-escalation of an in-progress actuation upon newly consumed observations; reversibility classes spanning wholly reversible, partially reversible, irreversible, and time-bounded-reversible actuations; and graceful degradation that reduces autonomy toward less-autonomous modes rather than forcing a binary stop. The same primitive composes across a mixed fleet, a remote-operations center, and a regional coordination tier without changing shape, which is what makes it a substrate rather than a per-platform feature.
6. Commercial and Market Context
The following is external market framing, not part of the filed disclosure. As a business matter, a governed-actuation substrate can sit beneath a coordination product such as Mobilaris and 6th Sense without replacing either: the coordination layer keeps computing routes, production directives, and clearance states, and each directive is expressed as a proposed actuation to the governed layer. Positioned this way, the differentiation is architectural rather than equipment-based, which is relevant in a market where Epiroc competes with Sandvik and Caterpillar on autonomy as much as on hardware.
The plausible customer value is a single architectural locus for safety-case demonstration that survives equipment turnover, and audit-grade lineage that regulators, internal incident review, and insurers can read from one store. Whether that lineage reduces insurance premiums, satisfies a specific MSHA, EU Machinery Regulation, or ISO 17757 requirement, or supports a particular certification is an operator-specific and regulator-specific question outside the scope of the filing and is not asserted here as a guarantee. The durable point is architectural: demonstrable, post-verified, reversibility-aware actuation is difficult to retrofit into a command-flow stack, and easier to provide when it is a governed layer from the start.
7. Disclosure Scope
The technical subject matter described here as belonging to the invention, the composite admissibility evaluator and its admit, gate, defer, solicit, reject, and escalate dispositions, the graduated-actuation mode selector and its enumerated modes, the harm-minimization deviation mechanism, the reversibility-aware commitment-point evaluator, the emergency-preemption mechanism bounded by preemption budget and expiration, the post-actuation verification mechanism, and lineage-recorded actuation provenance, is disclosed in U.S. Provisional Application No. 64/049,409. That application is the sole source of the invention claims stated above.
All references to Epiroc, Mobilaris Mining Intelligence, Mobilaris Onboard, 6th Sense, Scooptram, Pit Viper, Boomer, and to other named vendors, products, mines, standards, and regulators are external context describing the market the disclosed approach is positioned within. Those references are provided to situate the architecture and are not part of the filed disclosure, are not claims of or by the filing, and are not assertions of any deficiency in the named products. Product names belong to their respective owners. Named products are described at the architecture level from publicly reported information; where a specific capability, deployment, certification, or regulatory status could not be stated precisely, the description is generalized rather than asserted.
