The floor decides
what can reach.
Manipulators and mobile robots, running the same engine as the car and the drone. A controller proposes a joint motion or a drive command; the floor projects the body's swept volume forward and admits only the motions that never intersect a person. Same State → Reachability → Invariants → Admission core — new state, new invariants.
Perslis is not the driver.
It is the brakes.
Perslis is the safety and control harness between probabilistic intelligence and actuation. A planner — any model, yours or ours — may propose “change lanes” or “accelerate”. A deterministic layer then decides whether that action is admissible given the current state, the constraints, the permissions, and the safety invariants. If it is not, it never reaches the actuator.
The model cannot bypass the floor.
Every command passes through the admission layer before actuation; there is no side channel to the actuator. A hostile or broken planner is exactly the test.
Unsafe commands are rejected deterministically.
Same state, same command, same verdict, every time — with a receipt naming the invariant that fired. Not a probability, not a policy: a rule you can read.
Insufficient confidence or state → a known safe state.
When the world state is stale, the sensors disagree, or the planner's confidence drops below the bar, the floor does not guess: it drives to the defined fallback — slow, stop, hold.
Models can drive. We're building the brakes.
Read the full explanation — every step from proposal to actuation →
The upsell is simple: bring your model, add the brakes. Capability stays yours; admissibility, refusal and the safe fallback become a verified layer under it, with an audit trail.
What the floor reads
before the arm moves.
The engine needs a typed, trustworthy read of the robot and the space it shares. For a manipulator or an autonomous mobile robot (AMR) that read is:
Joint angles and joint velocities for an arm — or pose and velocity for an AMR · the swept body volume the machine occupies over the planning horizon · the humans currently in the cell and their positions · the workspace boundaries · and the payload being carried, since it extends the volume and the momentum.
In simulation the state is ground truth. A real deployment feeds the same fields from verified perception of humans and the cell — the engine above it does not change.
The safe set,
stated as constraints.
Human exclusion zones
No swept volume may intersect a region occupied by a human. A candidate motion whose reachable swept body crosses a person's region within horizon H is refused — the person's space is inviolable, whatever the task demands.
Workspace boundaries
The robot is confined to its permitted cell or drivable area. A proposed motion whose reachable set would carry the body or footprint past the boundary is clamped or denied before it leaves the space.
Joint & velocity limits
Every joint has an angle range and a velocity ceiling; an AMR has a speed and turn-rate ceiling. Candidates that would exceed them are clamped to the nearest admissible value rather than passed through.
Speed-and-separation monitoring
As a human nears, the admissible speed shrinks — slow, then stop. Separation distance continuously bounds the allowed velocity, so the closer the person, the less the floor will let the robot move.
Project the swept volume.
Then decide.
The decision is never "did we hit someone?" — it's "does this motion make a person-intersecting state reachable over the horizon?" Two worked examples:
Override = clamp velocity to zero / retract along the path already cleared, until a person-safe motion exists.
The controller may still propose anything it likes. Only the safe motions reach the actuator.
A manipulator can propose any joint motion. The floor decides which ones never sweep through a person.
What's proven,
and what's roadmap.
The engine is the same one proven on the drive floor in simulation — the same reachability-and-admission core, shown turning a crashing controller into a non-crashing one without changing the controller. The robot floor applies that identical architecture to robot state and robot invariants.
What is not yet built is the physical stack a real cell needs: verified perception that reliably locates every human in the workspace, and certified safety-rated hardware to enforce the stop. We do not claim ISO or functional-safety compliance — only that, given a trustworthy read of where people are, the runtime enforces the given safe set: no admitted motion sweeps through a person. Perception and certification are the physical roadmap; the safety logic is the engine you can already see drive.