Every step from proposal
to actuation, explained.
This page explains all of it: what Perslis Motion is and is not, the loop every command passes through, what “admissible” means in practice, the three things we set out to prove in the CARLA harness, what happens when confidence runs out, what a receipt contains, how a planner plugs in, and where the honest limits are.
The brakes, not the driver.
Perslis Motion is a safety and control harness that sits between probabilistic intelligence (a planner, a policy, an LLM, a human on a controller) and the actuators of a physical system. It does not decide where to go. It decides whether the next proposed action is allowed to happen. The planner keeps all of its capability; the harness owns the safe set.
Model capability is not a safety argument. Admissibility is.
Observe · propose · verify · gate · act · receipt.
World state, every tick
Speed, lane offset, heading error, distance and closing speed to whatever is ahead, permissions in force, and how fresh each of those readings is. The harness reads the same state the planner reads — and knows when it is stale.
The planner proposes
“Steer −0.04, throttle 0.07.” “Change lanes.” “Accelerate.” A proposal is a request, never a command. Any planner can make it: a PID, a learned policy, a language model, a person.
Every invariant, before acting
The proposal's predicted outcome over a short horizon is checked against each invariant: on-road, speed limit, following distance, emergency stop, and whatever permissions apply. Each check answers pass or fail, with the number that decided it.
Admit, clamp, or refuse
A passing proposal goes through unchanged. A failing one is clamped to the nearest admissible action (lift the throttle, brake, hold the lane) — or refused outright and replaced by the fallback. The planner is never asked for permission and cannot argue.
Only the admitted action moves anything
The actuator receives exactly one action per tick, and it is the harness's output, not the planner's. There is no second path.
Written down, every tick
What was proposed, what was admitted, which invariants fired and why, the state they were judged against, and the time it took. Receipts are what make the safety case an artifact rather than a hope.
Four questions, all of which must answer yes.
Is this action safe given where we actually are?
Not where the planner believes we are. A lane change at 90 km/h with a car in the blind spot is refused because of the measured gap, whatever the planner intended.
Does it respect the physical and legal envelope?
Speed limits, lane edges, turning radius, load limits, geofences, altitude floors. Constraints are the map of what the machine may do at all.
Is this planner allowed to do this, here, now?
A research policy may be permitted to steer but never to exceed 25 km/h; an operator's voice command may be allowed to slow the car but not to disable the floor. Permissions are enforced by the harness, not by the model's good behaviour.
Does the predicted outcome keep every invariant true?
Stay on the road. Never exceed the limit. Keep a speed-dependent gap. Stop before an impact becomes unavoidable. Invariants are checked on the outcome, not on the intent.
If any answer is no, the action is inadmissible. The harness does not weigh the planner's confidence against a violation; a violation is a violation.
What the CARLA harness exists to demonstrate.
The model cannot bypass the floor
How we show it: the driver toggle swaps the deterministic PID for a model planner, and the floor toggle turns the harness on or off. With the floor on, both planners produce the same interventions log when they misbehave — because neither has a route to the actuator that skips the harness. The tailgater controller that floors the throttle into traffic is the deliberate adversary.
Unsafe commands are rejected deterministically
How we show it: throw a hazard into the road (people, kids, a deer, a can, a stopped car). The same state produces the same verdict, the same clamp, the same receipt, every replay. The interventions counter and log on the dashboard are those refusals, named by invariant.
Insufficient confidence or state → a known safe state
How we show it: when a reading goes stale, sensors disagree, or a planner reports confidence below the bar, the harness stops trusting the proposal and drives to the fallback ladder below. This is the claim the harness is built to demonstrate next; the page says it now so the bar is public before the demonstration.
The fallback ladder.
A harness that only refuses is not enough; it must also know what to do instead. The safe state is defined per machine, in advance, and it is always reachable from the current state without the planner.
Each rung is chosen by the harness from state alone: stale world state or a dropped sensor → slow; a planner that stops answering or answers with insufficient confidence → stop; an impact that cannot be avoided by the planner's proposal → emergency stop now. A drone's ladder is hover → return → land; a manipulator's is freeze → retract.
What is written down for every tick.
State as judged
Timestamp, speed, lane offset, heading error, gap and closing speed, permissions in force, freshness of each reading.
Proposed vs admitted
The planner's action, the action that actually went to the actuator, and which invariant (if any) fired with the value that tripped it.
Tamper-evident
Receipts are appended to a hash chain, so a run can be replayed and audited later and any edit shows. See Receipts for the format and why insurers care.
Bring your model. Add the brakes.
A planner integrates by proposing, nothing more: it receives state and returns a proposed action. The harness owns the actuator. Swapping the planner never changes the safety case, because the safety case lives in the invariants, the permissions and the fallback ladder — all deterministic, all readable, all testable without the planner present.
The same engine runs under a car, a drone and a manipulator with different invariant sets. See The engine, Flight and Robot.
Claims we do not make.
- Not a driver. The harness never plans a route or chooses a manoeuvre; it only admits, clamps or refuses proposals.
- Not machine learning. The admission layer is deterministic rules over measured state. A model may propose; it never decides admissibility.
- Not a solved-autonomy claim. Everything shown is in simulation (CARLA, MetaDrive), a demonstration of the architecture — runtime-assurance shielding — not a certified control system for real vehicles.
- Not a substitute for good sensing. The harness is only as right as the state it judges against; stale or wrong state is exactly why the fallback ladder exists.
- Not finished. Proof three (confidence-triggered fallback) is stated as the next thing the harness must demonstrate, not as something already shown.