45.9 risk score after a 60 s shift
The model proposes.Detent decides.
A deterministic safety gate between any robot policy and its motors. Every command is checked before the drives move.
Time stopped on one decision
t = 1.18 s
Same policy. Same person. Two worlds.
Both runs start from one seed. On the left every proposal goes straight to the motors; on the right each one passes through the gate first.
One decision, ten checks, 1.5 µs.
ALLOW
no rule fired
Each control tick the gate runs the same ordered checks on the robot's state and the policy's proposal. The first check that fails decides the verdict, and the command that reaches the drives is the one it verified.
Gate latency measured on this machine.
- 01Robot stateMeasured state valid, fresh, inside limits, no contact
- 02Stop inputsEmergency and protective stop inputs
- 03People and perceptionSeparation to the nearest person, perception health
- 04AdviceEscalation from learned advisors
- 05Latched stopsA latched stop holds until someone resets it
- 06Missing proposalNo proposal arrived this cycle
- 07Proposal integrityFinite, in sequence, fresh, from an authorized model
- 08Speed capCartesian cap from mode, separation and advice
- 09ShapeJoint, speed and force limits, clamped or blocked
- 10Verify and brakeThe final command again: link geometry, braking distance
362,317unsafe commands released without the gate, 144 simulated episodes with perfect sensing
0with the gate, same episodes
156 simulated episodes.
11 ways a policy or its sensing fails.
With perfect sensing the gate released nothing unsafe and the person was never touched. With degraded sensing it can only act on the distance perception reports, so some separation violations still get through.
Every decision is signed. Change one bit and it shows.
Verifying 10,026 records
The recorder chains every record to the one before it and signs checkpoints. A replay of the recorded inputs reproduces each decision bit for bit.
The same decisions on every chip.
x86-64
0x0000000000000000this machine, just nowARM64
0x0000000000000000ARM64 Linux under QEMU, in CICortex-M4F
0x0000000000000000safety-controller image on an emulated STM32F405, in CIA fixed stream of 20,000 cycles runs through the gate and every decision goes into one digest. The digest matches on all three targets.
Later
The same record can price insurance.
Once real cells run the gate, the signed record is evidence an insurer can verify. We built the rating and claim engine to show how; no insurer is signed and every number below is a placeholder.
annual premium, quoted and bound
Placeholder binder, uncalibrated rating. No carrier stands behind it yet.
CLM
From simulation to a real cell.
Gate on a real arm
₹1.86 lakh
SO-101 arm pair, Jetson Orin Nano Super, two STM32 boards as the safety controller, safety relay and e-stop.
A pilot cell
₹19.3 lakh
A Fairino FR5 cobot, Jetson AGX Orin, a SICK safety scanner, a light curtain and a servo with certified STO.
The full lab
₹74.8 lakh
A UR5e to match the simulation, a second cobot, Jetson AGX Thor and guarding on two sides.
Estimates from Indian and public list prices read on 17 Oct 2026, with an assumed 28% import allowance and 10% contingency. The UR5e price is on request in India.
Built by Dovel Lab.
Raising
We are raising a pre‑seed to put the gate on real robots.
- The pilot cell. A cobot with certified stop hardware, a safety laser scanner and a light curtain, so the numbers on this page get measured on a real arm.
- The safety co-founder. Someone who signs the safety case.
- Three design partners. Robot makers and integrators putting learned policies on arms in 2027.
hello@dovellab.com