The batch is small. The stakes aren't.

I have stood at the end of a brand-new line at six in the morning with the first serial part in my hands – no baseline, no capability study, no history. A drawing, a gauge and a decision. Small-batch production concentrates the mind that way. So the news that solid-state batteries for Xpeng's IRON humanoid robot have entered small-batch production reads differently to me: the demo era is over, and the quality era is starting with a toolkit built for a world that no longer exists.

Meanwhile, in the volume world, GM is recalling more than 67,000 EVs over potential brake failure. Painful, survivable, an accounting event. That is what an escape looks like when you ship at scale. A humanoid robot has no such cushion. Neither does the person working beside one.

The statistics assume volume

Almost everything the quality profession reaches for assumes a stream. Cpk wants twenty-five subgroups minimum, ideally a hundred-plus consecutive parts, before the number means anything at all. PPAP's run-at-rate exists precisely to prove the machine holds capability at contracted volume. A line producing a few hundred units a year, in batches of a few dozen, hits its first anniversary long before it hits statistical significance.

Sampling collapses for the same reason. ANSI/ASQ Z1.4 works because there is a stream to sample from; a batch of forty batteries has no stream. This is not a defect in the tools. The tools were honest about their assumptions, and the assumptions no longer apply.

At the plant where I built a QA/QC department from zero for more than 900 people, we had volume, and even then the first months were all verification and no statistics. You inspect everything, serial by serial, until the data earns you the right to sample. A humanoid line will live in that mode permanently. That is not failed quality; it is a different quality.

Sampling is a bet that the parts you didn't check resemble the parts you did. Beside a human worker, that bet has a different name.

Aerospace solved this decades ago

Aviation has built low volumes of safety-critical machines for seventy years, and the discipline is sitting there waiting to be borrowed. Under AS9100/EN 9100 you do not lean on capability indices; you verify. First-article inspection to AS9102 applies to every batch and every engineering change, and traceability runs serialized from raw-material heat lot to shipping serial – nonconformances through a material review board, quarantine that actually quarantines, escape prevention audited as its own discipline, configuration management so you know exactly which configuration walked out the door. Automotive optimises cost per part. Aerospace optimises knowledge per part. A humanoid is a low-volume, safety-critical product that walks.

Yes, it costs. Traceability is real money per unit: serialized records, retained samples, inspectors who are paid to slow things down. I spent two decades across automotive and aerospace plants watching that cost squeezed out – correctly, for automotive economics. The economics change when the failure mode changes. A recall is an accounting event; a 60 kg machine collapsing beside a line worker is a stop-work, an HSE investigation and, soon enough, a regulator in the lobby. No jurisdiction has a lemon law for humanoids yet, and nobody should want to be the reason one gets written.

Building that greenfield department taught me what day one requires: inspectors trained before launch, a containment process standing before the first defect exists, escalation paths agreed before the first customer complains. Skip those and you pay for years. We cut defect costs by 70% at that plant, and the foundation was poured in the first ninety days.

The failure modes no PFMEA has met yet

Here the borrowed playbook runs out. PFMEA ranks known failure modes on occurrence, severity and detection, and it is only as good as the list. Autonomous machines add emergent failure modes – behaviours that arise from components which individually pass every test.

I build and deploy multi-agent AI systems; my orchestration platform runs 63+ models in parallel with consensus synthesis. The failures that cost me sleep were never component failures. They were models agreeing, confidently and simultaneously, on the same wrong answer. Consensus drifting together. An orchestration layer timing out in a combination no single integration had ever shown. No checklist predicted those. We found them by running adversarial scenarios – hunting the abnormal instead of auditing the normal.

Translate that to a humanoid on a factory floor. The perception stack misreads a pallet overhang as floor and passes validation. The planner passes validation. The combination is a machine stepping into a person. That is not a row in a PFMEA; that is a safety case – the same class of problem as SOTIF in automotive functional safety, a system performing exactly as designed to the wrong outcome. The battery now entering small-batch production is the other half of the argument: solid-state chemistry improves the thermal profile, but a damaged cell on fast charge beside human traffic is a barrier-analysis problem, not a warranty provision.

The category will not be owned by whoever demos best. It will be owned by whoever ships a robot a customer will let walk the floor uncaged, and that decision is made by the quality system, not the keynote. I have built a day-one system from zero; I know what it costs in inspectors, records and nerve. It is still the cheapest line on the programme. The batch is small. The discipline cannot afford to be.