Livgens

Every move rehearsed. Every real one asked.

Pilot brings Living Worlds Lab's intelligence to robots, machines and vehicles. Its policies are trained in School and tried in simulation first. Control is staged: shadow first, then under a policy a person signs, with a record of every command.

In development
01What it does
Simulate

The machine and its surroundings in a twin, run through what could happen.

next
Propose

The next action, with what the simulation says will follow.

next
Stage

A new policy runs in shadow beside the real controller, and is compared with it before it is given any say.

next
Act

Only under a signed policy and on a person's word, with what was asked and what the machine reports side by side.

next
Calibrate

What the machine then does is measured by its hardware nodes, and the twin is corrected against it.

next
Dotted paths run left to right and stop at a green vertical gate; one bold path waits at a green dot before it.
02How it decides
simulation first

Tried in a twin before it is tried for real.

Nothing reaches a motor that has not run in simulation first.

asks first

A person decides what is allowed.

The policy a machine runs under is set and signed by a person, and a command outside it is refused. When asked and observed disagree, Pilot says so and stops.

kept

Every command leaves a record.

What was sent, under which policy and what the machine reported back are kept in a record that cannot be quietly rewritten.

within the twin

Only inside what the twin has solved.

A plan is trusted only where the twin has been checked against measurements. Outside that range Pilot says it does not know.

status

Designed and staged, not switched on.

Sensing is built. Control of real machines is still being staged.

03What a machine is for

A system says what it is for before it is allowed to act.

Each system declares its purpose in one or more domains, the quantities it measures, the actions it can take, its safe operating limits and its twin. A check returns every issue it finds, each with a code: an unknown domain or quantity, an action with no limit, a limit in the wrong unit, an action outside its limit, or a request to act. Where the twin does not model a measured variable, the check says so, because that measurement then validates nothing.

Domains

Compute, processing, physics, motion, measurement, environment, energy, fluid and thermal, and structure.

built
Kinds of system

Articulated robot, mobile platform, process machine, pump and valve system, environmental monitor, structure under observation and compute fleet. Others are allowed.

built
Actions

Setpoint, trajectory, mode, model update and calibration update. Every action is declared with a safe limit in the unit of the quantity, and one without a limit is refused.

built
Quantities

The motion, orientation, field, pressure, temperature, humidity, air-quality, electrical, light, flow and sound quantities that Sense reads, with position, velocity, torque, force, energy and status code for machines, each tied to the twin variable it validates.

built
Integrations

A purpose may name the integrations that bring its measurements in: ROS 2, OPC UA, EtherCAT, MQTT, SocketCAN and Modbus, described on Sense. All six are observe only, so none carries a command. Measurements through them are soft at best, and the check says when a named integration does not serve the system, the purpose or a quantity.

built
Born into the world

A model is born into a robot, a machine, a piece of physical infrastructure or the world, and into other software, through this same interface. Its birth record is one of the four documents that cross it, with the batch, the command and the receipt.

built
04Staged, then asked
shadow first

Nothing is issued.

Every answer today is in shadow mode, and a request to act is refused. A real actuator needs an explicit grant signed by an operator at the site for that actuator and that quantity. With no policy the answer is deny.

within the twin

Never outside the solved band.

A command whose forecast is not validated, or falls outside the twin’s band, is not issued. A twin that is not calibrated issues shadow commands only.

bounded

Magnitude, rate, acceleration, duration.

The limits are enforced twice, by Living Worlds and by the site’s own tighter policy, and the stricter wins. Every command expires, and one that is out of order or late is rejected.

lowest level

A command is as strong as its weakest input.

Its basis names the twin, its calibration, the band check and the lowest attestation level of the measurements behind it. A derived result is never stronger than its inputs.

who approves

More authority, more people.

Shadow needs no approval. A low-risk, reversible setpoint inside its limits needs a standing policy. Moving a machine or a robot needs a person to approve each time. Anything privileged needs operator authority.

not a safety function

The machine’s own stop comes first.

A kill order at the site dominates and cancels queued commands, and an unreachable Living Worlds never blocks it. It is a supervisory stop above the machine’s own emergency stop and safe torque off, and does not replace them. A command the site cannot verify is denied and reported.

Request access.

Tell us what you want to run with Pilot. We answer every request ourselves.

Request access All applications and tools