Robotics Escalation to Blue Light: Four Stages to BOS

A security robot without a documented escalation chain is an expensive camera on wheels. Anyone who operates a KRITIS site, anyone running a 24/7 control room, anyone passing an audit knows this. The decisive point is not detection. The decisive point is what happens in the 240 seconds between sensor event and arrival of the patrol. This article describes the operational chain Quarero implements between QR-2, QR-3, control room, plant security and BOS (Behörden und Organisationen mit Sicherheitsaufgaben, the German emergency services). We name time windows, responsibilities, and the points where a human decides, not the machine.

Robotics Escalation to Blue Light: The Chain in Four Stages

The escalation chain is divided into four stages with defined time windows and responsible parties.

Stage 1 is the sensor event on the robot itself. A thermal hit, a LiDAR cluster or an audio anomaly is classified on-device. Latency: under 800 milliseconds from raw signal to classification. The robot does not decide on escalation, it only decides on pre-classification.

Stage 2 is verification in the 24/7 control room. The dispatcher receives a live feed from the QR-2 or QR-3 within 60 seconds, together with map position, sensor path and pre-classification. Each event creates an audit log entry with timestamp and dispatcher ID.

Stage 3 is operational escalation. The dispatcher sends a plant security patrol, directly dials 110 or 112, or closes the event as a false alarm. On a police call, GPS coordinates and a prepared situation report go to the responding station.

Stage 4 is the handover to the arriving police. Timestamps, sensor path, video fragments and a signed hash value of the chain of evidence are handed over on site. Each stage is subject to documentation requirements under BSI-KritisV and must be filed in an audit-proof manner internally.

Next step: understand the sensor logic of the first stage, QR-2 for 24/7 outdoor perimeter.

Sensor Logic: When the Robot Triggers an Alarm

Trigger logic separates by sensor type and platform. QR-2 triggers a thermal alarm as soon as a body signature at 36 °C or above is detected in a defined exclusion zone and the motion vector exceeds 0.5 m/s. This filters out stationary heat sources and animals below the threshold.

QR-3 with LiDAR and drone detection follows a separate path. Drones below 120 metres flight altitude are classified via acoustic signature and LiDAR profile. Escalation does not run through the normal perimeter logic but through a dedicated channel to the control room, because the response patterns (airspace violation, BOS jurisdiction, evidence preservation) are different.

The false alarm filter is the economically most important part. Without cross-validation, each single sensor produces double-digit false positive rates. The combination of thermal plus RGB plus audio reduces false positives to under 3 percent in our pilot installations [source to insert]. That is the threshold at which a control room does not drown in alarm load.

Geofencing separates permitted routes from exclusion zones. Delivery traffic to the loading dock, maintenance staff on defined paths, shift changes at fixed access points: these movements are authorised via whitelists per shift and do not trigger escalation. Exclusion zones are everything else.

All classifications are processed on-device. Raw video leaves the plant site only when the control room escalates. This is BDSG compliant and reduces the data leakage risk in the transport segment.

Next step: the control room decision in detail, Robotics-as-a-Service model.

Control Room: Human Decides, Machine Delivers Evidence

The control room is the point at which the machine hands over to the human. The dispatcher receives a pop-up with live stream, map position, sensor path and pre-classification from the robot. No automated full-text logic, no auto-escalation to the police. A human sees, a human decides.

The decision is made within 60 seconds in one of three directions: send a plant security patrol, dial 110 or 112, or close the event as a false alarm. False alarms are closed with justification and feed into the weekly sensor tuning.

QR-2 and QR-3 are equipped with loudspeakers and a voice link to the control room. The dispatcher can play a standard de-escalation announcement or speak live. Standard text: "You are on a monitored plant site. Leave the area via the nearest exit. Plant security and police have been notified." In around 70 percent of nighttime perimeter violations, that is enough. [source to insert]

Every escalation decision is stored as a signed audit entry. Retention: 30 days, BDSG compliant. Longer retention is only permitted in an ongoing investigation with a documented legal basis.

On a police call, the four-eyes principle applies. A second dispatcher countersigns the 110 call before the connection is made. This prevents fatigue-driven misdials and is a precondition for cooperation with the local BOS control rooms.

Next step: the handover protocol to the arriving patrol, continue to stage 4.

Handover to Police: The Operational Protocol

On the 110 call, a standardised message text runs: object, sector, number of persons, weapon indication, robot ID and GPS coordinates. The police control room receives in parallel a prepared link to the live feed, if the station is cleared for it. Without clearance, it remains a verbal situation report.

The robot guides the arriving patrol to the incident location via light signal and live audio. Light signal means: blue position light on the robot, not blue light in the StVO sense. The robot keeps visual contact with the subject but does not engage. No intervention, no detention, no pursuit beyond the plant site. That is legally not permitted and operationally not intended.

The handover dossier is ready as a PDF in under 5 minutes. Timestamps of each detection, sensor path per stage, three to five video fragments, GPS track of the subject on the site. The officer in charge receives the dossier by email or by USB handover on site, depending on the local arrangement.

The chain of evidence is secured via hash values. Each media file receives a SHA-256 hash at creation, which is signed at handover together with the file and transmitted to the station. Court admissibility depends on the local court (Amtsgericht), but the technical groundwork is done.

The core principle: the robot delivers evidence and situation reporting. The robot does not intervene. Anyone who blurs this in the escalation matrix risks liability questions under §34a GewO and the EU Machinery Regulation 2023/1230.

Next step: escalation for fire brigade and emergency medical services, separate path.

Fire Brigade and Emergency Medical Services: Separate Escalation Paths

Fire load detection runs via the thermal sensor system. A temperature rise above 80 °C in sectors without defined process heat triggers a separate escalation. [source / technical specification to insert] Sectors with process heat (dryers, ovens, cooling aggregates) are marked as heat zones in geofencing and are excluded from the fire load logic.

The direct 112 call contains sector designation, hazardous substances on site from the plant master data, and the optimal approach route. Master data comes from the internal safety data sheet register and is loaded once at commissioning, then updated quarterly. Without a current substance list, the message remains at the standard text.

The robot positions itself at the agreed fire brigade approach point and delivers a situation report before the first units arrive. Visual contact with the fire location, recording of smoke development, acoustic warning to persons in the sector. This measurably shortens the reconnaissance phase of the incident command.

For a medical emergency, the QR-2 person-down detection takes over. After 90 seconds of immobility of a person signature, the control room is informed. [source / internal validation study to insert] The dispatcher verifies via live feed and voice link, then the 112 call is placed with position and visible condition.

The handover to the emergency medical service includes an indicative vital signs estimate from the thermal signature. Core temperature indication, breathing rate from the chest profile. This is not diagnostic. It helps the incident command with resource selection, nothing more.

Next step: the legal framework for all of this, below.

Legal Framework: What the Escalation Must Carry

The KRITIS Umbrella Act (KRITIS-Dachgesetz) requires documented response chains with defined time windows for operators of critical infrastructure (draft Bundestag-Drucksache 20/9262). Anyone deploying a robotic escalation must demonstrate the chain in documented form, including responsibilities and trigger criteria.

The NIS-2 Directive requires incident reports to the competent authority within defined deadlines. For reportable sectors: initial report to the BSI within 24 hours, report within 72 hours, final report within one month (Art. 23 NIS-2 Directive, EUR-Lex). Robot logs are the primary source in this chain if the incident was detected at the perimeter.

The EU Machinery Regulation 2023/1230 governs autonomous systems and limits autonomous intervention without human oversight. This is the legal anchor for the principle "human decides, machine delivers evidence". A robot that independently detains or pursues would not be compliant.

EN ISO 13482 specifies safety requirements for personal care robots and encounter logic. The standard is not one-to-one transferable to security robots, but the encounter logic (distance, evasive behaviour, acoustic warning) is derived from it and applied to QR-2 and QR-3.

BDSG-compliant recording requires perimeter signage indicating video surveillance and robot presence as well as defined deletion periods per data category. If the control room is outsourced, a data processing agreement with Quarero is mandatory.

Next step: KRITIS-Dachgesetz checklist 2026.

Integration into Existing Plant Security Structures

Connection runs via open API to existing PSIM systems. Genetec, Milestone, Lenel, Bosch BVMS: Quarero supplies adapters and event schemas. No rip-and-replace, no swap of the existing video solution. The robot is integrated as an additional sensor node, its events appear in the familiar operator UI of the control room.

The shift handover briefing contains three robot-specific points: platform utilisation in the past shift, open alarms or maintenance cases, planned maintenance windows in the coming 24 hours. This integrates into the existing handover protocol and costs around 90 seconds of additional briefing time.

The plant security patrol retains authority over access control, personal checks and physical presence on site. The robot complements the patrol, it does not replace it. Anyone introducing a robot as a substitute for the patrol fails the audit and the shift operation. The arithmetic is in guard service cost comparison.

The escalation matrix is site-specific. It defines who calls when, from which escalation level a 110 call is justified, and which incident goes first to the internal on-call service. The matrix is worked out with the security manager and approved by the head of plant security. Without a signed matrix, the robot does not go into production.

Quarterly escalation drills with the local police are mandatory. Each drill is documented with a drill script, participant list and outcome report. This is the evidence the KRITIS auditor wants to see and the insurer requires for the premium reduction.

Next step: board liability in the NIS-2 context, NIS-2 board liability.

Pilot Setup: 48 Hours to the First Documented Escalation

Day 1 is the sensor walkthrough. Security manager, head of plant security and Quarero engineer walk the site. They define exclusion zones, whitelists and heat zones. In parallel, the escalation matrix is agreed: which triggers go to plant security, which to 110, which to 112. Time required: 6 to 8 hours.

Day 2 is commissioning. QR-2 or QR-3 is delivered, charged, connected to the control room. First test alarm with plant security participation. Plant security triggers a controlled perimeter violation. The chain is played through to stage 3 (without a real 110 call, with a simulated police connection).

Week 1 produces the first real escalations. False alarms are recorded, sensor thresholds fine-tuned, the false alarm review runs daily. Expectation: 5 to 15 escalations in the first week, of which 1 to 3 are real incidents. [source / pilot data to insert]

Week 2 is authority contact. The local police station is informed in writing about the robot presence, a meeting for mutual introduction is arranged. The fire brigade receives the plant master data and the sector map. Without this step, the first real deployment is delayed.

Month 3 is the first escalation drill with BOS. An agreed scenario, a controlled 110 call, a full handover on site. The outcome report goes into the KRITIS evidence file and to the insurer. From this point on, the escalation chain is documented and defensible.

Anyone who wants to implement the chain between sensor, control room and BOS now requests a pilot. Escalation matrix, commissioning and the first documented drill in the quarter are included in the pilot package. Pilot package details.