Our approach to ensuring safe human-robot collaboration in shared workspaces.
Safety is not a feature. It is the substrate on which every other feature rests. A humanoid that can lift a car is a humanoid that can hurt you. The question is not whether the platform can do harm - of course it can - the question is whether it will do harm when it should not.
Three Layers, Not One
Our safety architecture is built in three independent layers, each capable of bringing the platform to a controlled stop on its own.
Layer 1: Mechanical Limits
- Strain-limiting tendon routing - the cables physically cannot transmit more than rated torque
- Series-elastic joints with a fail-safe spring back to a safe pose on power loss
- Hard mechanical end-stops on every axis, tested to 5x rated load
Layer 2: Real-Time Control
The control stack runs a collaborative-operation monitor at 1kHz. It maintains a dynamic model of every human in the workspace - derived from a 240Hz multi-spectral sensor array - and constrains the platform's motion to remain within ISO/TS 15066 power and force limits at all times.
Layer 3: Supervisory System
A separate safety PLC, electrically isolated from the primary compute, watches for any deviation from the expected state. It can cut actuator power in under 4 ms, with no software in the loop.
Safety is not a checklist. It is a habit, and it is the first thing we test every morning.
What We Will Not Do
We will not ship a humanoid that uses a software kill switch as its primary safety mechanism. Software has bugs. Steel does not negotiate.
We will not market a humanoid as safe on the basis of a single certification cycle. Safety is a continuing commitment, measured in millions of hours, and it is something we earn every shift.