Next. The 2028 wedge.
Cutting power is not safety here. Bounded behaviour is.
Traditional machinery safety often relies on stopping, de-energisation, or safe torque removal as risk-reduction measures. Dynamically balanced machines complicate that assumption: for a legged robot or a humanoid, uncontrolled loss of power can itself create the hazard. Cut power to a walking machine and it falls, onto whatever and whoever is beside it. The safest behaviour is bounded behaviour: keep operating, inside hard limits, all the way to a controlled stop.
Bounded behaviour cannot be a promise made by the same software stack that is being bounded. It has to survive a software fault, a compromised model, and a planner that has misjudged the room. PEC-1 holds proximity, force, speed, and zone policy at the drivetrain, below the autonomy stack. PEC-1 keeps protected command authority inside the defined envelope, which is the safety outcome required even when simply removing power is not itself safe.
What PEC-1 enforces here
Proximity and force limits. Enforced in hardware through every interaction near people, unaffected by model state.
Task envelopes. Geofence and behaviour policy held at the actuators, with permits and isolation states gated for work on live plant.
Coexistence evidence. A tamper-evident audit record of every enforcement verdict, building the case that lets robots work beside people rather than behind fences.
As humanoids move from pilots toward procurement, the certification question arrives with them. The wedge is already visible: the fail-passive assumption is broken, and hardware-enforced bounded behaviour offers a path to demonstrating safe behaviour when simply removing power is not safe.
