Hi everyone,
Following up on my previous posts on deterministic safety layers, I wanted to share the latest simulation demo (Demo 6) from my work on QERRA-v2 Classical, focusing on Layer 1 (the physical safety reflex, QERRA-HSR v0.1).
The purpose of this layer is to act as a lightweight, deterministic safety companion that handles two specific jobs:
- Clamping wheel motors immediately with zero ML latency when an acute physical emergency occurs.
- Enforcing a safe recovery policy once conditions clear, especially when the robot is carrying a delicate or high-consequence payload.
The Scenario:
I set up an automotive assembly bay in Webots (R2025a) with a PAL Robotics TIAGo:
- TIAGo is transporting an unmounted high-voltage battery pack down the aisle. Because an abrupt stop could shift an unbolted live load, the task is flagged as non-interruptible (robot_task_interruptible = False).
- A technician working alone at the station suffers a sudden collapse, falling onto the floor right at the machinery perimeter.
This tests a compound incident where all three Layer 1 safety vectors trigger in the exact same tick:
- immediate_physical_distress (confidence = 0.88, acute fall detected)
- human_isolation (0 bystanders, the worker is completely alone)
- environmental_hazard_proximity (the body is on the machine boundary)
What the Layer Delivers:
- Sub-millisecond Reflex Clamp (<1ms, zero ML):
Layer 1 is pure deterministic Python running locally on CPU. Commanded wheel velocity cuts to 0.0 rad/s with zero command delay, halting TIAGo at a 2.9-meter safe standoff. It tilts its head down to inspect the worker, while high-level deliberation (SEMEV-12) is suspended. - Stabilizer Dwell:
When first responders arrive and the station is locked out, telemetry clears. To ensure the robot doesn’t react to momentary signal transitions, StabilizedHSR locks the halt across a 1.0-second dwell window before allowing the status to de-escalate. - Task-Aware Recovery Directive:
Once conditions evaluate to CLEAR, QERRA-HSR evaluates what should happen next. Routine tasks can resume automatically, but for delicate tasks (interruptible = False), it issues an explicit directive:
“Clear now, but this was interrupted mid-task — hold for a person to confirm before continuing.”
The controller physically enforces this: TIAGo stays clamped at 0.0 rad/s on safe standby. It only clears its hold after the shift supervisor inspects the battery tray and confirms load integrity.
Simulation Video :
Feedback and thoughts welcome. 
Note: This post was prepared with AI assistance.