Models can drive.
We're building the brakes.
Everyone is racing to train a smarter model to drive the car, fly the drone, move the robot. We did the opposite. Before intelligence is allowed to move a physical system, we define what movements are admissible — and enforce it in a runtime that sits under the model, not inside it. The controller can be weak, broken, even hostile. Safety does not degrade with it.
A software runtime-safety architecture, demonstrated in simulation. Not a control system for real vehicles — see scope below.
Perslis is not the driver.
It is the brakes.
Perslis is the safety and control harness between probabilistic intelligence and actuation. A planner — any model, yours or ours — may propose “change lanes” or “accelerate”. A deterministic layer then decides whether that action is admissible given the current state, the constraints, the permissions, and the safety invariants. If it is not, it never reaches the actuator.
The model cannot bypass the floor.
Every command passes through the admission layer before actuation; there is no side channel to the actuator. A hostile or broken planner is exactly the test.
Unsafe commands are rejected deterministically.
Same state, same command, same verdict, every time — with a receipt naming the invariant that fired. Not a probability, not a policy: a rule you can read.
Insufficient confidence or state → a known safe state.
When the world state is stale, the sensors disagree, or the planner's confidence drops below the bar, the floor does not guess: it drives to the defined fallback — slow, stop, hold.
Models can drive. We're building the brakes.
Read the full explanation — every step from proposal to actuation →
The upsell is simple: bring your model, add the brakes. Capability stays yours; admissibility, refusal and the safe fallback become a verified layer under it, with an audit trail.
You cannot train your way
to a safety guarantee.
Autonomy is being solved as a model problem: collect more miles, grow the network, hope the failure rate falls. But a learned policy can always propose a fatal action, and no amount of capability lets you prove it won't. "It's safe because the model is good" is unfalsifiable — which is exactly why certification, insurance, and regulators choke on it. Billions are being spent making the proposer smarter. None of it changes what the proposer is allowed to do.
Model capability is not a safety argument. Admissibility is.
Separate the proposer
from the admission layer.
The intelligence — whatever it is — only gets to propose a candidate action. Every candidate is verified against grounded safety invariants before it reaches the actuator. Admitted, clamped, denied, or overridden to a safe fallback. The safe set is defined by the runtime, not learned by the model.
The beautiful part: you can build almost all of this before choosing an AI model at all. Swap the proposer freely —
— and the floor is unchanged. The safety case never depends on which one is plugged in.
Feed it a hostile controller.
Watch the floor refuse.
The controller below is a tailgater: it floors the throttle straight at the car ahead — a deliberately terrible driver. Toggle the floor. With it off, the crash is exactly what the controller asks for. With it on, the shield projects the reachable state, sees the collision, and brakes — holding a safe gap the whole way. Same controller, unchanged. The floor just refuses to execute the unsafe action, and writes a receipt for every refusal.
A longitudinal model of the real drive-floor invariant (safe_gap = max(min_gap, speed·headway), reachability-aware brake). In our full MetaDrive run the same tailgater crashed with the floor off and drove the whole highway safely with it on — the floor turned a crashing controller safe without changing the controller.
One runtime under
every moving machine.
The heart isn't another giant rule engine. It's one question, asked continuously:
Can this proposed action drive the machine into a forbidden state within horizon H?
State
Position, velocity, orientation, trajectory, nearby objects, boundaries, actuator state — a typed reading of the world.
Reachability
Project the candidate action forward. Which states become reachable over the next short horizon?
Invariants
Speed and acceleration limits, collision envelopes, geofences, minimum separation, prohibited regions, actuator limits.
Admission
ALLOW · CLAMP · DENY · EMERGENCY. The candidate is executed, tightened, refused, or replaced by a safe override.
Fallback
If state goes unknown, contradictory, stale, or sensors drop, transition to a predefined safe behavior — never ask the model what to do.
Receipts
Record world state → requested action → violated invariant → admitted action → result. Every refusal is auditable.
Every action leaves a receipt.
Instead of "the safety system stopped the car," you get an auditable record — the same shape whether the proposer was a random planner or a frontier model:
requested_throttle = +0.31 · predicted_collision = TRUE
invariant = MIN_STOPPING_ENVELOPE · verdict = DENY · override = BRAKE · result = stopped
Autonomous actions become inspectable, testable, and insurable — because the safety argument lives in the runtime, not in a model's weights.
Same engine. Cars, drones,
robots, boats, bikes.
A vehicle, a quadcopter, a warehouse robot, a robotic arm — the abstraction doesn't change. Swap the state and the invariants; the reachability→admission core stays exactly the same.
Drive Floor
Vehicles, pedestrians, road and lane boundaries, speed and stopping envelopes.
Flight Floor
Drones: altitude, geofences, separation, battery and link failsafes.
Robot Floor
Mobile robots and manipulators: humans, workspace boundaries, swept-volume collision.
& anything that moves
Boats, rovers, e-bikes, AMRs — if it has actuators and a safe set, it has a floor.
Admission control for
model-mediated systems.
Perslis keeps building the same machine in different domains. It was never "symbolic AI." It's a runtime that decides what a model is allowed to make real.
Science
The bio floor rejects fabricated protein facts; only source-pinned claims are admitted.
Law
The legal floor rejects fabricated case law; a citation must resolve to a real record.
Motion
The drive floor rejects unsafe control; an action must pass the safety invariant.
A fabricated citation can never reach a verified state. An unsafe action can never reach the actuator. Same spine.
You don't win the model race.
You sit under it.
Model-agnostic by construction
Every AV, drone, and robotics company is spending to improve their proposer. The floor is the layer they all still need — the one that makes any proposer deployable. We are not a competitor to the autonomy stack; we are the runtime beneath it.
The moat is the runtime, not a model
Models commoditize. A verified admission runtime with an auditable receipt trail — the artifact insurers, certifiers, and regulators actually need — does not. The safety case is the product.
Provider- and hardware-agnostic
Random, rule-based, local, or frontier; car, drone, or arm. One abstraction, many floors — a horizontal safety runtime across everything autonomous that moves.
De-risked by design
We isolated the software-control question first and solved it in simulation. That's the honest, fundable path: prove the runtime, then layer the physical world onto a foundation that already holds.
Honest scope. What exists today is a software runtime-safety architecture, demonstrated in simulation (MetaDrive). It is not a certified solution for real vehicles. Physical systems add sensor uncertainty, control latency, actuator faults, timing guarantees, hardware redundancy, and certification — real work, deliberately downstream of the question we answered first: given a trustworthy read of the world, what motion is admissible, and can we enforce it independent of the model? That question, we solved.