The safety question humanoids still have to answer

Last week NVIDIA announced Halos for Robotics, which it describes as the industry’s first full-stack safety system for physical AI. The system brings the company’s autonomous vehicle safety work into the world of robots, spanning computers, sensors, software and a new inspection lab to help partners prepare for third-party certification. Agility Robotics is the first to build NVIDIA Halos for Robotics into its humanoid robot, Digit.

This is good news, and I want to say so plainly. Safety has long been the least glamorous corner of robotics. It appeals to engineers and standards committees, not to the people who make the videos of robots dancing and running half marathons. So, when one of the most influential companies in computing puts its weight behind robot safety, and when a leading humanoid maker submits its system for independent scrutiny, the whole field benefits.

Investment in safety is investment in trust, and consumer confidence is critical if businesses are to continue to benefit from automation. It’s worth looking closely at what this wave of work addresses, and at what it does not.

A perception problem, well funded

Most of the safety effort around humanoids, including much of the new tooling, concentrates on perception. The hard questions are framed as “can the robot detect a person, predict where they are going, and avoid a collision?” NVIDIA’s approach includes an ‘outside-in’ method that uses external cameras and AI agents to watch the workspace and adjust how the robot behaves. That is difficult but crucial engineering.

However, perception-based collision avoidance rests on an assumption that the robot remains in control of itself. The discipline of functional safety is built on the opposite instinct. A risk assessment spends less time on how a machine behaves when everything works, and more on how it behaves when something breaks. The central question is what the robot does the moment a part fails – in the case of humanoids the answer is uncomfortable.

What happens when a part fails

A legged humanoid is dynamically stable. It stays upright only by continuously sensing its own balance and correcting, many times a second. Take that control away and it falls rather than pausing in place.

Picture a humanoid mid-stride when an actuator in one leg fails. The machine is already committed to a step it can no longer complete, and it topples, potentially onto whoever is nearby. Given the mass of these robots and their high center of gravity, the potential consequences are serious. A flawless perception system is no help here – the robot might know where people are but will be unable to avoid them. By the time the fault occurs, the robot has lost the very control that perception was meant to inform.

My colleague and leading robotics safety expert, Roberta Nelson Shea, makes a related point about power: a battery fault can disable every actuator and sensor at once, and a humanoid needs a reserve of power simply to lower itself to a stable position. Stability depends on nothing going wrong which makes fault tolerance the deeper safety challenge for human-shaped robots.  

Where this meets the rule book

Industrial robots are typically designed to be single-fault tolerant to meet the relevant safety standards. In plain terms, no single component failure should be able to create a dangerous situation. ISO 10218-1, the standard for industrial robot arms, is built on that principle.

Apply the same requirement to a heavy, dynamically stable machine and you are left with two options. The first is to engineer actuators, sensors and battery management that are either fully redundant or so reliable they almost never fail – how to do that at an acceptable cost currently eludes me.

The second option is to accept that working alongside a humanoid carries more risk than working alongside a conventional industrial robot, because a single failure can lead to a hazard.

ISO 10218-1 does not address the risks created by a humanoid’s own mobility. The first standard written specifically for dynamically stable mobile robots, ISO/CD 25785-1, is still at committee-draft stage, working through its first round of comments. As a first attempt at hard new ground, it has a long way to mature.

None of this means humanoids are impossible. It simply means the safety case for them is unfinished, and the honest version of that case is more demanding than the current conversation suggests.

The advantage of being purpose-built

A mobile collaborative robot, a robotic arm mounted on a wheeled autonomous base, does not face these problems because it is statically stable – a heavy base, a low center of gravity, and no need to balance. When something goes wrong, the safe response is simple, and crucially it is simple to make redundant. Cut the power and apply the brakes. A machine standing still is rarely a danger to anyone.

That difference is the result of choosing a form factor for the task rather than for its resemblance to us. Autonomous mobile robots, collaborative arms, and the standards-driven safety functions behind them were designed so that the failure modes are predictable and the safe states are easy to reach. The robot’s safety does not hinge on a perception system continuing to work. It is built into the architecture before any software runs.

There is another reason that purpose-built automation will keep winning on the factory floor. The complexity that makes a humanoid captivating in a demonstration is the same complexity that multiplies its failure modes. In manufacturing, reliability is non-negotiable, and falling short means downtime, rework and risk.  

Humanoids are not the only way to harness the incredible potential of physical AI on the factory floor. A rapidly growing number of AI enabled applications are running on collaborative industrial robots and autonomous mobile robots handling machine tending, palletising, inspection, and material movement with the safety and reliability the factory floor demands.

The question to ask first

I welcome NVIDIA’s move, and I hope it marks the start of a more serious, better-resourced era for robot safety. The more rigor the industry brings, the better for every company building machines that share space with people, mine included.

But anyone evaluating a humanoid for real work should start with the important unglamorous question. Before asking whether the robot can recognise a worker, ask what it does when an actuator, a sensor or a battery fails mid-task. Ask for the stability and reliability data. Ask which standards the system is certified against, and which parts of its operation those standards actually cover.

We had this debate, rightly, about self-driving cars, an open and public discussion about how much risk is acceptable and who decides. Humanoids deserve the same scrutiny. Until the field can answer the failure question as confidently as it answers the perception question, the proven path remains the one the industry has been building for years: robots whose shape, and whose safety, are designed for the job.

David Brandt is VP of R&D and CTO at Teradyne Robotics 

www.teradyne.com/robotics/