Ready to run. Guard every move.

Every startup and reset loads the known robot, tool and camera model. Review your protocol and run it directly; deterministic geometry guards and visual checks supervise execution.

Before running a protocol

1. Choose a deck layout, describe the experiment and review the generated transfers and visual checklists.
2. Approve the validated protocol. The required initial VLM hazard review must pass before movement.
3. The wrist camera localizes all three stations from three tags each. Missing or inconsistent tags stop execution.
4. Every new tip and transfer uses fresh stereo alignment. Read the feedback bounds and occluded-insertion policy.

Robot joints, tool dimensions and camera projection geometry come directly from the simulation model. No calibration workflow, fitted offsets, expiry timer or hidden calibration run is used. This is simulated geometry, not physical measurement.

Hard table boundary and collision protection

The rigid deck is 1.20 × 0.86 m. With a 20 mm inset, every arm mesh bounding box, tool envelope and joint centre must remain inside x = −0.30…0.86 m, y = −0.41…0.41 m in the robot-base frame. These limits cannot be disabled in the UI.

Well entry additionally requires the intended well, 2–4 mm insertion, ≥0.35 mm wall clearance and ≥3 mm bottom clearance. Solid-contact penetration above 0.05 mm is rejected. These are numerical simulation guards, not a claim of zero physical contact or certified continuous-time collision avoidance.

Two independent visual checks

Operation review: the planning LLM supplies an operation-specific checklist. The VLM reviews actual camera images after each critical action. Exact volume comes from the liquid ledger and actuation feedback, never an image-only estimate.

Continuous hazard review: a separate fixed safety prompt checks overview and overhead frames for gross collapse, detached tools, tipped stations, interpenetration and equipment outside the table. The experiment LLM cannot weaken this prompt. New reviews begin 5 seconds after the previous response during activity, or 30 seconds while idle; model latency is additional. Fresh frames are captured at least every 3 seconds when the worker is available. Evidence older than 45 seconds cannot authorize continued motion.

FAILED, UNCERTAIN, missing service or stale approval → latched stop. The experiment dashboard shows actual VLM output and recent history. The JSON report includes reviews; safety.jsonl and timestamped images preserve evidence. Successful idle snapshots retain the latest 60 review pairs; active-run and incident images are kept. In-memory history is capped at 2,000 reviews and safety logs rotate at 5 MB with five archives. A latched stop preserves the triggering review until reset. Offline mode explicitly reports continuous VLM unavailable.

A sampled VLM can miss a hazard and cannot react at servo speed. Immediate deterministic guards run independently. Physical safeguarding must use local controller functions, measured stopping distances, an emergency stop and appropriate enclosure/interlocks; cloud/VLM availability is never the protective circuit.

After a stop

1. Inspect the reported cause, camera views and liquid ledger. There is no automatic retract or ambiguous transfer retry.
2. For a safety incident, select “I inspected the incident · allow reset”. This records acknowledgement and leaves the stop latched.
3. Correct the cause and reset the workcell. Reset creates a new simulated inventory; it does not reverse a real liquid transfer.
4. Review a fresh protocol before starting. Do not reuse partially executed physical transfers without reconciliation.

The current application controls simulation only. See the concise parts and setup guide for physical integration requirements and the manufacturer’s system safety responsibilities.