Robotics Safety
Safety for Embodied Robots
A body turns model error into physical consequence.
Three embodiment-conditioned safety families, one policy IR — identical verification semantics on every morphology.
Single- & Multi-Arm Industrial Manipulators · Collaborative Cobots
Long-horizon, contact-rich manipulation with pre-execution checking against force, velocity, reachability and workspace occupancy; power/force-limiting and protective stops on contact.
Humanoid Robots · Quadrupeds
Whole-body motion, balance and force bounded around people; safe-stop and kill-switches; envelopes that hold under sensor noise, occlusion and unexpected contact.
Autonomous Mobile Robots · Drones
Collision-free navigation in dynamic shared spaces; bounded speed and proximity; safe-stop and fallback on sensor loss.
One policy intermediate representation runs across all three families, so a constraint written for an arm and a constraint written for a mobile robot are verified by the same semantics rather than by three separate safety stacks. Checks are pre-execution: an action chunk is verified against the compiled envelope before it reaches an actuator.
Deployment architecture: robotics safety
Everything that decides whether an action may execute is on the robot. The hop to the cloud is asynchronous and one-way, and the cloud zone is marked off path: it never gates an actuator.
The robot emits actions at 30-120 Hz, and each one is checked before it reaches an actuator. Sensor data goes out with the action rather than the action alone, because the node evaluates the action against what the robot is currently sensing, not against the command in isolation. The client SDK is Python and C++ and is called from the control stack on the robot, so inference never leaves the machine.
The edge node runs on the device or on a cell controller beside it. It carries Kavach Robotics at 4B and 8B, with one endpoint per embodiment family — manipulation, full-body motion, navigation — the same three families described above, reached as three surfaces over one policy IR. The pre-execution check runs inside the control loop against force, velocity, reachability, workspace occupancy and geofence.
The cloud is for revalidation and the reinforcement loop, at 27B and 111B: policy is compiled once and pushed down, fleet-scale adjudication and offline re-certification run there, and near-misses mined from the audited trail come back as envelopes. That last part is the loop closing — without it the cloud would be an archive rather than something that improves the fleet.
Alongside it sit the auxiliary outputs: a signed audit per verdict, near-miss mining, and storage and retention.
Where robotics safety sits
Every other safety surface governs what a model says or shows. Industrial Safety watches a facility through cameras that observe but do not act. Robotics safety governs a machine that moves, so a verdict has to land before the actuator does rather than after the output is produced.