Mechanism
The harm-minimization deviation mechanism is invoked when a governed unit confronts a physical configuration in which no available actuation path avoids harm and the unit must still act. A candidate-path generator produces a plurality of candidate actuation paths available to the governed unit given its current kinematic state, its capability envelope, and its observed environment. A harm projector projects the composite expected harm across entities over each candidate path. The projection consumes entity-class harm coefficients per a governance-policy-defined entity-class harm ordering and consumes an empathy-weighting output of the integrity engine. A composite-admissibility evaluator combines the per-path projected harm with per-path composite-admissibility determinations into a composite harm-admissibility score per path. A path selector selects the candidate path whose composite harm-admissibility score is the most favorable. A deviation-lineage recorder records the candidate-path set, the harm projections per path, the governance-policy-defined parameters applied, the selected path, and the actuation execution.
Because the harm ordering and the composite-admissibility evaluation supply the comparator, no separate manufacturer-specified fallback is required to choose between paths that all cause some harm. The harm ordering supplies the entity-class weighting, the capability envelope supplies the constraint surface, and the composite harm-admissibility score supplies the comparator. The mechanism does not invent a new ethical calculus; it consumes an existing governance-policy-defined artifact, the entity-class harm ordering, and evaluates it through the composite-admissibility evaluator. The harm-minimization deviation mechanism explicitly contemplates self-damaging actuation paths as admissible candidates rather than categorically excluding them: a path that minimizes composite projected harm across entities can be selected even when it damages the governed unit itself.
The selection is lineage-recorded so that each deviation decision is reconstructible. Downstream review consumes the deviation-lineage record under the same governance chain that signed the governance-policy parameters. The mechanism is specified at the level of the candidate-path generator, harm projector, composite-admissibility evaluator, path selector, and deviation-lineage recorder, without depending on a particular candidate-generation algorithm.
Operating Parameters
The entity-class harm coefficient employed by the harm projector is a governance-policy-defined parameter that ranks harm to entity classes in a governance-policy-configurable ordering. A non-limiting exemplary ordering assigns the highest harm coefficient to human life and bodily integrity, a lower coefficient to animal life, a lower coefficient to physical property, a yet lower coefficient to the governed unit itself, and the lowest coefficient to designated replaceable environmental fixtures including guardrails, shoulder berms, crumple zones, and emergency barriers. The ordering is configurable by the deploying authority per jurisdictional regulatory framework, per deployment-domain ethical framework, per organizational policy, and per operational context. The specific ordering is immaterial to the primitive; the primitive is the composite harm-admissibility evaluation across a governance-policy-defined entity-class harm ordering combined with the composite-admissibility evaluator.
The ordering adapts to the deployment domain. In a non-military consumer-roadway deployment, the example ordering applies. In a military defense deployment, the ordering additionally differentiates combatant from non-combatant in accordance with applicable laws of armed conflict. In an industrial deployment, the ordering additionally differentiates authorized personnel from unauthorized entrants. The harm projection also consumes an empathy-weighting output of the integrity engine.
The harm-minimization deviation mechanism integrates with the graduated-actuation mode selector. A high-confidence harm-minimization deviation proceeds in full mode. A lower-confidence harm-minimization deviation proceeds in constrained mode. An uncertain harm-minimization scenario proceeds in consultative mode when a human operator or higher-authority agent is reachable within the decision horizon. A harm-minimization path exceeding per-path governance-policy-defined risk thresholds proceeds in disabled mode, with the disabled decision lineage-recorded and the agent's cognitive state transitioned to a confidence-degraded operating mode.
Each deviation decision is lineage-recorded. The deviation-lineage recorder records the candidate-path set, the harm projections per path, the governance-policy-defined parameters applied, the selected path, and the actuation execution, so a downstream consumer of lineage can reconstruct the deviation decision under the same governance chain that signed the governance-policy parameters.
Alternative Embodiments
The disclosed harm-minimization deviations span domains without limitation. A ground vehicle intentionally steers into a guardrail, a shoulder berm, a vacant area, or a designated crumple zone to avoid contact with a pedestrian, cyclist, or occupant of another vehicle. An autonomous aircraft executes a controlled off-airport descent into unpopulated terrain to avoid overflight of a populated area during an in-flight emergency. An autonomous underwater vehicle intentionally grounds in a non-navigable zone or executes controlled disabling to avoid collision with a submerged cable, a pipeline, a coral reef, or a protected habitat. An industrial robot executes a controlled self-disabling arm retraction, arm collapse, or emergency-stop sequence to avoid contact with a human operator entering the work envelope.
Further disclosed embodiments include a medical infusion device aborting or reducing a dose upon projection that the administered interaction harm exceeds the non-administration harm; a weapon-system terminal actuator redirecting a munition into a less-harmful terminal location upon identification of non-combatants in the originally-targeted area or upon re-identification of the target as non-hostile; an autonomous delivery robot executing a controlled stop into a non-traversable zone rather than continuing onto an occupied pedestrian path; a building ventilation actuator accepting reduced ventilation in unoccupied zones to extend survivable-atmosphere duration in occupied zones during fire emergencies; and a grid-protection actuator executing controlled load-shed in a non-critical region to preserve supply to a critical-infrastructure region.
The mechanism applies across automotive, aerial, subsurface, industrial, medical, building, energy, and defense domains through the same architectural chain. The candidate-generation algorithm, vehicle dynamics model, sensing modality, and signing infrastructure are not fixed by the primitive; the primitive is specified at the level of the candidate-path generator, harm projector, composite-admissibility evaluator, path selector, and deviation-lineage recorder.
Worked Example: Roadway Avoidance
Consider an autonomous road vehicle on an urban segment governed under a consumer-roadway harm ordering. A pedestrian steps into the travel lane and no available actuation path avoids harm. The candidate-path generator produces a plurality of candidate paths available given the vehicle's current kinematic state, its capability envelope, and its observed environment: steering into a guardrail or shoulder berm to avoid contact with the pedestrian, a braking path, and continuing on path. The harm projector projects the composite expected harm across entities over each candidate, consuming entity-class harm coefficients per the governance-policy-defined ordering and the empathy-weighting output of the integrity engine.
Under the exemplary ordering, human life and bodily integrity carry the highest harm coefficient while designated replaceable environmental fixtures such as guardrails and shoulder berms carry the lowest. The composite-admissibility evaluator combines the per-path projected harm with per-path composite-admissibility determinations into a composite harm-admissibility score per path, and the path selector selects the path whose score is most favorable, here the path that steers into the guardrail and accepts self-damage to avoid contact with the pedestrian. The mechanism explicitly contemplates such self-damaging paths as admissible candidates rather than excluding them. The deviation-lineage recorder records the candidate-path set, the harm projections per path, the governance-policy parameters applied, the selected path, and the actuation execution, so a subsequent review reconstructs the deviation decision under the same governance chain.
Composition with the Governed-Actuation Stack
Harm-minimization deviation is one primitive among the governed-actuation primitives disclosed in Provisional 64/049,409. It composes with the capability envelope, with the composite-admissibility evaluator, with the graduated-actuation mode selector, with cross-authority recognition, and with lineage recording. The composition is intentional: each primitive is bounded so that the others can reason about its inputs and outputs without depending on its internal mechanism. A jurisdiction that revises its entity-class harm ordering changes the governance-policy parameters the harm projector consumes without changing the mechanism itself.
The deviation mechanism addresses the trolley-problem class of scenarios. The other primitives establish that the unit operates under governance authority; this mechanism establishes that even when no available actuation path avoids harm, the deviation is a lineage-recorded, reconstructible, and reviewable decision. Downstream regulatory review consumes the deviation-lineage record under the same governance chain that signed the governance-policy parameters.
Prior-Art Distinction
The harm-minimization deviation mechanism is structurally distinguished from prior collision-avoidance systems, prior pre-collision braking systems, prior emergency-steering systems, and prior academic discussions of trolley-problem ethics by the simultaneous presence of several features.
It uses a governance-policy-defined entity-class harm ordering rather than implicit per-system heuristics. It performs composite admissibility evaluation across cognitive primitives, including the integrity engine's empathy weighting. It explicitly contemplates self-damaging actuation paths as admissible candidates rather than categorically excluding them. It couples to the graduated-actuation mode selector, so the deviation proceeds in full, constrained, consultative, or disabled mode according to confidence. And each deviation decision is lineage-recorded and reconstructible.
The mechanism applies through the same governance chain across automotive, aerial, subsurface, industrial, medical, building, energy, and defense domains. It treats the no-good-options scenario with the same governed pattern as any other actuation: a candidate-path set, a composite harm-admissibility evaluation, a lineage-recorded selection, and an actuation.
Disclosure Scope
This article describes subject matter disclosed in U.S. Provisional Application No. 64/049,409. The disclosure covers the harm-minimization deviation mechanism across automotive, aerial, subsurface, industrial, medical, building, energy, and defense domains, where a governed unit confronts a configuration in which no available actuation path avoids harm and the harm ordering is governance-policy-defined rather than a per-system heuristic.
The disclosure includes the candidate-path generator, the harm projector consuming entity-class harm coefficients and the integrity engine's empathy weighting, the composite-admissibility evaluator, the path selector, and the deviation-lineage recorder, together with the governance-policy-configurable entity-class harm ordering and the integration with the graduated-actuation mode selector. The disclosure does not depend on a particular vehicle dynamics model, a particular sensing modality, a particular candidate-generation algorithm, or a particular signing infrastructure; the mechanism is specified at a level of abstraction that admits substitution along each of those axes provided the governance-policy-defined inputs and the lineage-recorded outputs are preserved.
