The floor decides
what can fly.
Nothing new in the architecture — it's the same State → Reachability → Invariants → Admission engine that runs under the drive floor. What changes is the state we read and the invariants we enforce. A quadcopter proposes velocities; the floor projects each one forward and admits only the ones that keep it inside the fence, above reserve, and clear of other aircraft.
Perslis is not the driver.
It is the brakes.
Perslis is the safety and control harness between probabilistic intelligence and actuation. A planner — any model, yours or ours — may propose “change lanes” or “accelerate”. A deterministic layer then decides whether that action is admissible given the current state, the constraints, the permissions, and the safety invariants. If it is not, it never reaches the actuator.
The model cannot bypass the floor.
Every command passes through the admission layer before actuation; there is no side channel to the actuator. A hostile or broken planner is exactly the test.
Unsafe commands are rejected deterministically.
Same state, same command, same verdict, every time — with a receipt naming the invariant that fired. Not a probability, not a policy: a rule you can read.
Insufficient confidence or state → a known safe state.
When the world state is stale, the sensors disagree, or the planner's confidence drops below the bar, the floor does not guess: it drives to the defined fallback — slow, stop, hold.
Models can drive. We're building the brakes.
Read the full explanation — every step from proposal to actuation →
The upsell is simple: bring your model, add the brakes. Capability stays yours; admissibility, refusal and the safe fallback become a verified layer under it, with an audit trail.
What the floor reads
before a rotor turns.
The engine needs a typed, trustworthy read of the aircraft and its world. For a UAV that read is:
Position and velocity vector · altitude above ground and above take-off · attitude (roll, pitch, yaw) · battery state of charge · command-and-control link status · nearby aircraft and their tracks · and the geofence boundaries that define where flight is permitted at all.
In simulation the state is ground truth. A real deployment feeds the same fields from verified GNSS, IMU, and traffic-awareness sensing — the engine above it does not change.
The safe set,
stated as constraints.
Altitude ceiling & floor
Flight is confined to a permitted altitude band. A candidate climb whose reachable set crosses the ceiling — or a descent that would cross the floor — is clamped to the band's edge, never executed past it.
Geofence boundary
A no-fly boundary in the horizontal plane. If a proposed velocity's projected trajectory would carry the aircraft across the fence within horizon H, the action is refused before it can leave the permitted volume.
Minimum separation
A protected envelope around every other tracked aircraft. Any candidate motion whose reachable set intersects another aircraft's envelope is denied — the floor holds separation rather than reacting after it's lost.
Battery & link failsafe
Below reserve state-of-charge, or on command-link loss, the admissible action set collapses: the only actions the floor will pass are a forced hover or return-to-home. Discretion is removed exactly when the world is degrading.
Project the action.
Then decide.
The decision is never "are we outside the fence now?" — by then it's too late. It's "does this proposed action make a forbidden state reachable within the horizon?" Two worked examples:
Override = clamp the velocity toward the fence-parallel component, or hold position, until a fence-safe action exists.
The controller may still propose anything it likes. Only the safe actions reach the actuator.
A drone can propose any velocity. The floor decides which ones keep it inside the fence, above reserve, and clear of others.
What's proven,
and what's roadmap.
The engine itself is proven on the drive floor in simulation — the same reachability-and-admission core, shown turning a crashing controller into a non-crashing one without changing the controller. The flight floor is that identical architecture applied to UAV state and UAV invariants.
What is not yet built is the physical stack a real aircraft needs: verified perception of position, altitude, and nearby traffic; bounded control latency inside the horizon; and the certification path for flight-critical software. Those are the physical roadmap — not the safety logic, which is the engine you can already see drive. We do not claim a flying demonstrator.