Safety Interlocks for Vision-Guided Robots

2026-08-05 · 6 MIN · FILED BY OPR-01

Here is the sentence we put on the first slide of every robotics kickoff: the model is never in the safety loop. Not "rarely," not "only with high confidence." Never. Perception models are probabilistic instruments — magnificent ones — and safety functions must be deterministic. The entire architecture follows from refusing to blur that line.

Two channels, one rule

Every vision-guided cell we ship has two strictly separated channels:

• The performance channel — where the model lives. It finds the part, plans the grasp, classifies the defect, adapts speed to the work. It is allowed to be wrong, because being wrong here costs yield, not fingers.
• The safety channel — safety-rated laser scanners, light curtains, torque limits, an E-stop circuit, and a certified safety PLC. It is dumb, redundant, and certified. It does not consume model output. It can only be made more restrictive by software, never less.

The model may request motion; the safety PLC decides whether motion is permitted. The wiring diagram enforces the org chart: silicon proposes, relay disposes.

Watchdogs for a probabilistic sensor

Inside the performance channel, we still treat the model like an instrument that can drift out of calibration mid-shift:

heartbeat:    perception must publish at ≥ rated Hz
              miss 3 ticks → controlled stop (not E-stop)
confidence:   rolling p10 below floor → slow mode + operator call
sanity:       detections outside geometric envelope → discard frame
staleness:    frame age > 80 ms → discard, never act on old world
drift:        daily golden-set replay; recall drop > 1% → hold deploys

The controlled-stop distinction matters. An E-stop is a safety event with paperwork and a restart procedure; a controlled stop is the cell politely pausing. Reserving the first for the safety channel keeps both meaningful.

Interlocks are written before the demo

The demo pressure on robotics projects is real: everyone wants to see the arm move on day two. We schedule it the other way — the first sprint delivers the safety case: hazard analysis, channel separation, watchdog spec, and the golden-set eval. The arm moves in sprint two. Teams that demo first bolt safety on later, and bolted-on safety has seams.

What the client actually buys

A vision system with 99.2% recall is a good instrument. A vision system with 99.2% recall, a deterministic safety envelope, a drift alarm, and a paper trail is a production asset — one the plant manager can defend to their insurer, their union, and their own conscience. That last part is the deliverable. The model is just the fast part.

← ALL FIELD NOTES