Core is the fixed layer between the AI and the actuators. It has its own sensing, a fixed set of measurable limits and a fail-safe ladder. It does not run a language model, take commands from the cloud or accept over-the-air updates.
The edge AI planner. Language and vision models, task planning. It is flexible and the largest attack surface.
Learned awareness of the surroundings. It can override the planner and can only tighten limits.
Fixed rules, independent sensing, watchdogs and safe torque off. It can override everything above it.
Motors, brakes and steering. Drive power is only available while Core allows it.
Researchers have jailbroken LLM-controlled robots into unsafe actions, and a safety layer that lives in the same software as the AI can be attacked the same way. We keep the last line of defence outside the AI stack.
RoboPAIR showed jailbreak attacks on LLM-controlled robots, including self-driving and wheeled platforms.
The Simplex pattern keeps a verified controller that can take over from an unverified one. We apply it to physical AI.
Platforms such as NVIDIA Halos describe isolated safety functions and certified processes for robots. Core is designed to sit beneath that kind of platform as an AI-independent fallback.
Illustrative simulation of the architecture. Not measured data. Limits shown are example values.
A Core fault does not mean a power cut. The robot steps down through four stages and ends in a basic, near-zero state that keeps it safe and visible.
Limit speed, force or torque to the safe envelope. The robot keeps working inside it.
Decelerate smoothly to zero and hold position with brakes.
Remove drive power to the motors by a path that does not depend on the main controller.
Isolate the AI stack, log the event and wait for a supervised reset by a person.
| Module | Basic-level state (design intent) |
|---|---|
| ZIV-H Humanoid | Base stopped and braked, arms held in a compliant safe pose, face display and voice announce safe mode. |
| ZIV-L Logistics | Stopped and braked, shelves locked, beacon on, payload stays put. |
| ZIV-I Inspection | Stopped and braked, sensors keep recording locally, alert sent through the safety channel. |
| ZIV-C Cleaning | Brushes off, stopped and braked, status light on. |
| ZIV-S Security | Stopped and braked, cameras keep recording locally, human contact alerted. |
Human instinct has a hard-wired core and a learned layer on top. Inztinct follows the same shape. Core holds the commandments. Sense is the learned part: it can choose among allowed actions and tighten limits, and it can never grant a permission the commandments forbid.
A hospital corridor or a crowd can lower limits. Nothing can raise them.
A lost link, a hijacked server or a bad update cannot change what Core does.
Every commandment is a measurable limit that can be tested, logged and audited.
Core reads its own sensors, so a spoofed camera feed cannot blind it.
Sense models and profiles change only through signed releases that a person approved.
What can be updated remotely can be attacked remotely.
The core stays the same. A signed, write-protected profile sets the limits for the job, and loading one needs a physical key. Values below are the kinds of limits a profile holds, not final numbers.
| Profile | Where it runs | Example limits |
|---|---|---|
| Logistics | Warehouses, hospitals, factories | Speed by distance to people, payload-aware braking, protected aisle zones |
| Inspection | Plants, telecom, data centres | Mast tilt and stability caps, restricted equipment zones |
| Service | Reception, care, retail | Arm force and speed caps, no-contact zones, handover rules |
| Cleaning | Commercial floors, public spaces | Low speed in shared space, brush stop on lift or contact |
| Security | Sites and perimeters | Strictest speed limits, no contact behaviours, escalate to a person |
| Aerial survey | Open-pit mines | Fixed geofence, blast-zone no-fly, return to dock on low battery or lost link |
| Mine vehicles Research | Open-pit haul roads | Proximity alerts first. Any intervention only through an interlock the vehicle maker has approved |
| Custom | Partner payloads | Written and reviewed with the partner before first power-up |
We are looking for design partners with robots that work near people.