Robot Component Provenance: Subsystem Documentation Guide

Not every component in a robot system requires the same level of provenance documentation. The components that most frequently feature in security reviews and procurement restriction analysis are: the central processing unit or system-on-chip that handles the main compute functions; any embedded controllers for actuators or sensors that run their own firmware; the wireless communication module if the robot uses wireless connectivity; the cellular or satellite modem if the robot uses mobile data connectivity; the camera sensors if the robot uses visual perception; and the lidar or depth sensor if the robot uses structured light or time-of-flight ranging.

These components are targeted because they represent the highest security sensitivity - they process the most data, they have the most connectivity potential, and they are the most likely to have active update or telemetry channels. Secondary components such as power management integrated circuits, indicator LEDs, and passive mechanical hardware are less frequently scrutinized but may need documentation if the applicable restrictions are broad in scope.

The deployment team should define the component documentation scope based on the specific restrictions or security requirements applicable to the deployment, rather than attempting to document every individual part.

The first source to consult for component provenance is the robot manufacturer's technical documentation. Many manufacturers publish integration guides, hardware reference manuals, or spare parts catalogs that identify major subsystem vendors and part numbers. Where this information is available, it should be captured in the provenance record with a reference to the specific document and version from which it was obtained.

Manufacturer technical certifications for radio-frequency devices, such as FCC filings in the United States, also identify the manufacturers of communication components and can be searched in public regulatory databases. For components not identified in published documentation, the deployment team can request a bill of materials or component disclosure from the manufacturer. Manufacturers vary in their willingness and ability to provide this information; the deployment record should note whether a disclosure request was made and what response was received.

Physical inspection of accessible hardware is a supplementary source that can identify component manufacturers from physical labels, markings, or printed circuit board silkscreen text, though it does not establish country of manufacture without additional research.

Physical inspection can yield useful component identification information where manufacturer documentation is incomplete or unavailable, but the quality of information obtained from inspection depends on the accessibility of the hardware and the identifiability of the components. External-facing components with visible labels or markings are the most accessible. Internal components may be visible during maintenance but require hardware disassembly that may void warranty or modify the system configuration in ways that trigger acceptance retesting requirements.

Where physical inspection is performed, the record should document what was inspected, what markings or identifiers were found, what conclusions were drawn from those identifiers, and what hardware state the system was in during the inspection - whether it was in its standard operational state or temporarily modified for inspection access. Photographic documentation of visible component markings is the most reliable record of physical inspection findings.

The limitations of inspection-based evidence should be acknowledged in the record: a component marking identifies the manufacturer but may not establish the country of manufacture, and a component that is not accessible for inspection generates a documented gap rather than a verified field.

Field replacements and component substitutions change the component provenance of a deployed robot in ways that must be reflected in the provenance record. When a failed component is replaced with a part from the original manufacturer using the original part number, the provenance of that subsystem is unchanged and only the replacement event needs to be noted. When a component is replaced with a part from a different manufacturer or with a different part number than the original, the provenance record must be updated to reflect the new component's origin and identity.

This situation arises when the original component is discontinued, when a substitute part is used to reduce lead time, or when a component is upgraded to a newer model during a maintenance window. Each substitution event should be recorded with the date, the reason for substitution, the identity of the replaced component, and the identity and origin of the replacement component. The substitution record should also note whether the change was reviewed for compliance with applicable procurement restrictions before being executed, not as a compliance certification but as documentation that the step was considered.

Component provenance is not only relevant at procurement time. Post-acceptance security reviews, regulatory inspections, and warranty investigations may all require access to component provenance information years after the original deployment. A provenance record that was built at commissioning and maintained through every subsequent change event provides this information without reconstruction.

A provenance record that was not maintained will require the deployment team to reconstruct component identities from maintenance records, purchase orders, and service reports, which is time-consuming and may yield incomplete or uncertain results. For long-running deployments that span multiple maintenance cycles and potentially multiple changes in applicable procurement restrictions, the ongoing value of a well-maintained component provenance record grows with the age and complexity of the deployment.

Building the provenance record as a living document from the start of commissioning, rather than as a one-time capture at acceptance, is the practice that makes it most useful when it is eventually needed.

• Define the component documentation scope based on applicable procurement restrictions or security requirements
• Record the manufacturer, model or part number, and country of origin for each in-scope component
• Consult manufacturer technical documentation before physical inspection as the primary source
• Capture FCC or equivalent regulatory filings to identify communication hardware manufacturers
• Document physical inspection findings with photographs and explicit notes about what was and was not identifiable
• Record manufacturer disclosure requests and responses where direct inquiry was made
• Update the component provenance record for every field replacement or substitution event