Inztinct is the architecture inside every robot we build. Intelligence plans the task. Inztinct decides what the robot is allowed to do about it, and how that improves over time.
Cannot be talked into anything.
Knows a covered table from an open one.
Gets better. Never gets looser.
Design intent. Every ZIV module and the Mining Drone are designed around all three layers. Measured results will be published as they exist.
Intelligence proposes. Sense narrows it to what the place allows. Core makes the final check against fixed limits it measures with its own sensors. Learn sits to the side and improves the upper layers through signed releases.
Releases go to Intelligence and Sense only. A failed gate stops the release. Core has no update path from Learn.
Core also reads its own sensors directly, so a spoofed camera feed cannot blind it. Design intent. Not measured data.
| Core | Sense | Learn | |
|---|---|---|---|
| Job | Hard limits and the last-resort stop | Understand the surroundings and lower limits to match | Improve Sense and the planner across the fleet |
| When it acts | Every control cycle, hard real-time. Stop latency to be measured and published | Fast loop, target 10 to 50 ms | Offline, between releases. Never on a running robot |
| Can it loosen a limit? | No. The limits are fixed | No. It only tightens | No. It cannot touch Core, and releases are checked for loosening in hazard scenes |
| Network | None in the safety path | Not needed at run time | Optional. Raw data can stay on site |
| How it changes | Never over the air. Physical key, offline | Signed releases made by Learn | It is the release process |
| Built from | Safety microcontroller, then FPGA, then a chip | Models on edge compute. Jetson-class today | Federated and offline training with a test gate |
| What we will publish | Measured stop latency. Core refusing malicious commands | Near-misses prevented against nuisance stops | Fleet improvement with zero safety-suite regressions |
| Status | Stage 0 on a safety microcontroller | Concept. Simulator tests first | Planned, after Sense |
The base carries Core. Each module brings its own profile for Core and its own context for Sense. Learn improves the whole family. The Mining Drone uses the same three layers.
| Robot | Core never lets it | Sense notices | Learn improves |
|---|---|---|---|
| ZIV-H Humanoid | Exceed arm force and speed caps, or enter no-contact zones | A person reaching in, a hand-over, a crowded lobby | Hand-over timing and when to give way |
| ZIV-L Logistics | Brake too late for its payload, or leave protected aisles | Ramps, doorways, wet floor, a person stepping out | Route choice and fewer needless stops |
| ZIV-I Inspection | Tilt the mast past the stability cap, or enter restricted equipment zones | Gaps, covers and clearances around equipment | Which readings need a second look |
| ZIV-C Cleaning | Run brushes when lifted or in contact | Floor type, wet patches, people nearby | Coverage paths and quiet hours |
| ZIV-S Security | Make contact. It escalates to a person | Normal against unusual movement on a site | Site patterns, with a person making the call |
| Mining Drone | Leave the geofence or fly into a blast zone. It returns to dock on low battery or lost link | Wind, dust and terrain that call for a tighter margin | Flight margins across sites, offline |
Design intent for each robot. Limits shown are the kinds of limits a profile holds, not final numbers.
Researchers have jailbroken LLM-controlled robots into unsafe actions. A limit that lives in the same software as the AI can be attacked the same way. Sources
Lobbies, wards, aisles and plant rooms are not fenced. The robot has to understand where it is, not only avoid what it sees.
The EU Machinery Regulation (2023/1230) applies from 20 January 2027 and asks for machinery that resists attempts to corrupt its safety functions. Check what applies to your product. This is a summary, not legal advice.
We are looking for design partners with robots that work near people.