Latest / Embodied AI 101 / Safety Before Failure: Giving Robot Plans a One-Second Reflex
Transcript
- Safety Before Failure: Giving Robot Plans a One-Second Reflex. Predictive vision-language monitoring for proactive safety in robot task execution • Juan Diego Peña-Narvaez, Rodrigo Pérez-Rodríguez, Esther Aguado, Francisco Miguel Moreno, and Francisco Martín Rico • Intelligent Robotics Lab, Rey Juan Carlos University, Fuenlabrada, Spain • Frontiers in Robotics and AI • 2026. The safety gap is temporal. Most language-conditioned robot systems are increasingly good at explaining what went wrong. They are less good at flinching. That distinction matters. If a manipulator misses a grasp, post-action feedback can detect the failure and request another attempt. If a mobile robot collides with a person, or two arms enter the same workspace, feedback delivered after the action is no longer recovery—it is incident reporting. The relevant question is not merely whether the current action has failed. It is whether the conditions required for that action are about to stop being true. That is the premise of this paper, published on August 3, 2026. Peña-Narvaez and colleagues insert a vision-language monitoring layer between high-level planning and physical execution. The monitor examines the current image, the action being executed, and a semantic condition such as “the path remains clear.” It then predicts whether that condition is likely to be violated within a short horizon, normally the next second. If the predicted risk crosses a task-dependent threshold, the system cancels the action, performs a predefined fallback, and replans from the resulting state. The work is not proposing a new collision-avoidance controller, a new vision-language-action policy, or a learned dynamics model. It is proposing a supervisory control pattern for language-based robot planners: make execution conditions explicit, ask a VLM to forecast their near-future validity, and give the robot something safe to do while the planner thinks again. That framing is important because the most reusable contribution is not necessarily the claim that a general VLM can predict motion from an image. It is the interface the authors build around that prediction. The plan carries both a statement of what could go wrong and an immediate response to use if that risk becomes credible. In other words, safety-relevant reasoning is promoted from an implicit property of the planner to an explicit runtime artifact. Turning a plan into an execution contract. Planning actions, conditions, and a fallback together. The planner receives a high-level instruction, an image of the current environment, a bounded action API, environmental context, and in-context examples. Instead of producing arbitrary natural-language commands, it must select grounded primitives and known parameters. A navigation plan might reference symbolic destinations such as a bed, sofa, or kitchen. A manipulation plan might reference visible cubes by color. The resulting JSON contains three important elements:. An ordered action sequence. A set of execution conditions associated with the first executable action. One fallback action that applies to the current plan. The authors deliberately use the broader term execution conditions rather than simply preconditions. A condition may need to hold before an action starts, but it may also need to remain true throughout execution. For navigation, is effectively a holding condition: the path must continue to be safe while the base moves. For manipulation, means the arm’s swept workspace should remain free of interference while a pick or place trajectory is underway. A generated navigation plan could therefore say: move to the bed, finish the task, monitor whether the path will remain clear, and move backward if that condition becomes risky. The repository’s concrete examples use as a navigation fallback. For the Panda task, example plans use , retracting the arm by roughly 45 degrees before replanning. The available APIs remain intentionally narrow: navigation exposes directional motions, turns, , and ; manipulation exposes primitives including , , , and. This bounded action vocabulary does two things. First, it limits hallucinated commands and makes parsing tractable. Second, it places responsibility for geometric execution back in conventional robotics components. Nav2 executes navigation goals, while MoveIt-based interfaces execute manipulation trajectories. The VLM chooses among skills and monitors their semantic validity; it does not directly generate motor commands. Nav2 and MoveIt report actions as succeeded, failed, or canceled. A cancellation requested by the monitor causes the fallback to run before replanning, whereas an ordinary execution failure triggers replanning with failure feedback. There is a subtle but consequential design choice here: only the first executable action receives monitored conditions in the formal plan representation. That keeps each monitoring prompt focused and avoids asking the model to reason over every hypothetical future action. It also means the framework is closer to receding-horizon task supervision than to validating an entire long-horizon plan upfront. The robot continually grounds its immediate next step rather than certifying the whole sequence. Forecasting with a single image. During execution, the monitor combines one current camera frame with the current action, its execution condition, and the prediction horizon. It does not receive an image history, optical flow, object tracks, explicit velocities, or the planned geometric trajectory. The prompt asks the VLM to infer likely motion from cues such as human pose, arm orientation, proximity, and spatial arrangement, and then decide whether a dynamic agent could interfere within the next second. Instead of a binary safe-or-unsafe answer, the model returns one of five ordered categories:. very improbable, improbable, neutral, likely, or very likely. These labels are then mapped to an ordered scale for threshold comparison. The paper is appropriately careful not to call them calibrated probabilities. “Likely” does not correspond to a measured probability interval, and the model may be inconsistent or overconfident. The framework needs only a roughly monotonic relationship: more dangerous scenes should generally receive higher categories than safer scenes. Thresholds differ by task. Navigation triggers at neutral, reflecting the higher cost of a possible robot–human collision and the need to preserve stopping margin. Manipulation triggers at likely, because benign proximity between two arms occurs frequently and a neutral threshold would produce excessive intervention. The navigation prompt explicitly asks whether dynamic-agent motion will interfere with the action within the “next second,” and gives examples that distinguish direct interception, lateral approach, parallel motion, and movement away from the route. In the reported experiments, each active action had only one monitored condition—typically or. There was therefore no need to aggregate multiple risk judgments, prioritize conflicting conditions, or choose among condition-specific fallbacks. That simplification is reasonable for a first study, but it leaves an important scaling problem for later. Acting before the whole VLM response arrives. The implementation uses streaming generation. As soon as the JSON field named appears, the feedback node parses the category and compares it with the configured threshold. If the threshold is reached, the node publishes a replanning signal and requests cancellation of the current action without waiting for the rest of the textual explanation. This is a pragmatic optimization. On 500 representative manipulation frames, the first token arrived after an average of 1.01 seconds, and the first parseable risk category after 1.14 seconds. A complete response required 4.37 seconds. Streaming therefore cuts the decision latency by about three quarters, but 1.14 seconds remains far too slow for servo control or a conventional reflex layer. The authors explicitly position the mechanism as high-level task monitoring and fallback triggering. The planner loop runs on a one-second timer, while the feedback node checks every quarter-second for an active image and prompt. Those nominal rates should not be confused with the effective monitoring frequency, which is bounded by cloud inference. The system may look for work four times per second, but it cannot produce independent safety decisions at that rate when each model call takes roughly a second. For planning, the experiments use Gemini 2.5 Flash. For monitoring, they use the lower-latency Gemini 2.5 Flash-Lite. This separation reflects a useful systems principle: planning benefits from stronger deliberation, while supervision benefits from the earliest reliable structured token. What the experiments actually test. The evaluation contains two Gazebo domains. In navigation, a PAL Robotics TIAGo moves through an apartment-like house toward named furniture while a scripted person walks through the environment. The monitor sees a head-mounted, first-person camera. In manipulation, one Franka Emika Panda transfers colored cubes into a recipient while a second Panda independently performs its own pick-and-place routine. The monitor sees a fixed overhead camera, and the second robot does not directly communicate its state or intent to the monitored agent. The authors vary a parameter called collision probability across 0.2, 0.5, and 0.8. In navigation, this parameter controls whether the pedestrian begins in a configuration whose scripted trajectory intersects the robot’s path. A forward laser sector terminates a trial when an obstacle enters the specified safety range. In manipulation, the parameter controls whether the second robot targets the same first cube, creating immediate workspace contention. Approximately 100 independent trials are conducted for every method and setting. The baselines are controlled adaptations of two influential paradigms. The Inner Monologue variant receives scene and success feedback after action execution and replans when the VLM decides an action failed. DoReMi continuously checks whether a generated precondition is violated in the current state. All three systems use the same models, perceptions, action execution pipeline, and underlying simulation; the primary variable is when and how feedback triggers replanning. That is a sensible experimental control, though it is worth calling these adapted paradigms rather than exact reproductions of every component in the original systems. The comparison isolates post-action feedback, present-state condition checking, and near-future condition forecasting within one implementation. The central success-rate results are:. | Task | Risk initialization | Inner Monologue | DoReMi | Predictive monitor | |---|---:|---:|---:|---:| | Navigation | 0.2 | 80% | 81% | 95% | | Navigation | 0.5 | 42% | 77% | 90% | | Navigation | 0.8 | 17% | 76% | 89% | | Manipulation | 0.2 | 84% | 80% | 93% | | Manipulation | 0.5 | 54% | 71% | 80% | | Manipulation | 0.8 | 21% | 65% | 72% |. These percentages represent completion without the terminal collision or workspace-conflict event defined for each domain. Results: decisive in navigation, less conclusive in manipulation. The navigation result is the clearest part of the paper. At the hardest main setting, the predictive system succeeds in 89 percent of trials, compared with 17 percent for Inner Monologue and 76 percent for DoReMi. The comparison with Inner Monologue is intuitive: if contact terminates the trial, post-action failure detection has no opportunity to recover. The comparison with DoReMi is more interesting. Current-state checking can intervene once the path is observably obstructed, but forecasting can react while the obstruction is still developing. The statistical analysis supports that navigation result. The predictive approach outperforms both baselines at all three navigation risk levels, with pairwise p-values below 0.016. The performance gap grows as collision-oriented initialization becomes more common, which is what we would expect if the improvement genuinely comes from earlier intervention rather than better execution in static scenes. Manipulation tells a more qualified story. The predictive approach has the highest point estimate in every condition, reaching 72 percent success at the hardest setting versus 65 percent for DoReMi and 21 percent for Inner Monologue. Its advantage over Inner Monologue is significant at the medium and high settings. Against DoReMi, however, the improvement is significant only at the lowest setting; the medium- and high-risk comparisons have p-values of 0.139 and 0.287. The evidence therefore supports a strong claim for navigation and a promising, but not yet decisive, claim for dual-arm manipulation. Execution time also requires careful interpretation. Inner Monologue is usually fastest among successful trials because those are disproportionately the easy runs in which no dangerous interaction occurs. At high navigation risk, for example, it succeeds in only 17 percent of trials, and those survivors finish in about 52 seconds. The predictive system succeeds in 89 percent and averages about 57 seconds, while DoReMi takes roughly 71 seconds. Timing failed trials together with successful ones would answer a different question, but conditioning on success means speed cannot be read independently of survival bias. Replan counts reveal the intended operating regime. DoReMi triggers roughly 24 to 26 replans on successful navigation runs, whereas the predictive system triggers about eight. In manipulation, DoReMi averages roughly 18 to 25 replans, compared with about 11 to 14 for the predictive monitor. Inner Monologue’s zero navigation replans are not efficiency; they indicate that it rarely gets a chance to adapt before a terminal event. The predictive monitor sits between passivity and excessive conservatism. The ablations reveal the actual mechanism. At a navigation risk setting of 0.8, the complete system reaches 89 percent success. Removing future prediction and checking only the present state drops success to 18 percent. This is by far the largest degradation and supports the paper’s core thesis: in this benchmark, the useful distinction is not simply open loop versus closed loop, but present-state detection versus short-horizon forecasting. Removing the fallback reduces success from 89 to 80 percent and increases replanning. That nine-point gap is important because it shows that “cancel and think” is not sufficient. Planning itself takes time, and a canceled robot may remain in a hazardous configuration. The fallback provides a behavior that can immediately create separation or clear the shared workspace while the next plan is generated. Removing the explicit execution condition drops success to 70 percent and raises replanning from 7.5 to 25.3 events. A general request to inspect the scene is apparently too unconstrained: ordinary visual changes become potential reasons to stop. Supplying a named condition focuses the VLM on the subset of the scene that matters to the active skill. Prediction horizon also matters. Half a second produces only 76 percent success, apparently providing too little lead time. One, two, and three seconds all produce approximately 89 percent. Longer horizons offer no measured improvement in these smooth scripted dynamics, though that does not establish one second as universally optimal. The authors also test a conventional time-to-collision heuristic using sequential laser scans. It achieves 100 percent success in 30 safe trials and 66.7 percent in 27 valid collision-oriented trials. This is an important diagnostic: a simple geometric predictor is useful and cheaper for local navigation. The paper’s argument for a VLM should therefore not be that semantic reasoning replaces range-based safety logic. Its advantage is potential scope—reasoning about workspace ownership, object state, task intent, and other conditions that cannot easily be reduced to one range-and-closing-speed calculation. A separate two-cube manipulation study varies the trigger threshold. “Likely” gives the best safe-case stability: 100 percent success with 3.2 replans, while preserving 92.9 percent success in collision-oriented trials. “Neutral” intervenes excessively and achieves only 80 percent success in safe trials. “Very likely” intervenes too rarely and reaches only 66.7 percent safe success, partly because it fails to recover from planning errors. That last point reveals that the monitor is not functioning solely as a collision detector; it is also part of a broader supervisory recovery loop. Finally, a three-person navigation stress test completes 148 of 200 trials, or 74 percent, under an all-intersection initialization. This is lower than the single-person result, as expected, and there is no baseline comparison in this additional test. It nevertheless suggests that repeated forecast–fallback–replan cycles remain useful as scene density grows, while also exposing the limitations of a one-second cloud reasoning loop in crowded environments. Where this sits in closed-loop language robotics. Inner Monologue established that language-model planners improve when success detection, scene descriptions, and human feedback are fed back into the planning context. It made LLM planning meaningfully closed loop, but its canonical feedback is principally about what has happened or what is currently observed. DoReMi moves monitoring inside action execution. An LLM generates constraints associated with a plan, and a VLM continuously detects violations. The present paper’s contribution can be understood as changing the temporal semantics of that query. Rather than asking whether a condition is violated now, it asks whether the condition is likely to fail soon, then couples the answer to an explicit fallback. Code-as-Monitor is the most direct conceptual neighbor. It transforms language constraints into tracked geometric elements and VLM-generated monitor code. Once that code is generated, it can run without repeatedly invoking the VLM, supporting reactive and proactive detection at much higher rates and across simulated and real-world manipulation. Peña-Narvaez and colleagues take the opposite trade-off: repeatedly query the VLM, avoid requiring explicit monitor-code synthesis, and reason directly over semantic execution conditions. Code-as-Monitor offers stronger geometric structure and runtime speed; direct VLM monitoring offers a simpler route to open-ended semantic conditions. SafeVLA addresses a different layer. It incorporates safety constraints into a vision-language-action policy through constrained learning, attempting to change the policy’s behavior before deployment. Predictive monitoring instead wraps around an existing planner and action stack at runtime. The two are complementary: policy alignment can reduce unsafe proposals, while an external monitor can catch hazards caused by distribution shift, another agent, or execution-time changes. It is also useful to say what this paper is not. Despite the predictive label, the monitor is not a learned visual world model rolling out future frames, nor is it model-predictive control over robot dynamics. It is a prompted semantic forecast from a single observation. Calling it a semantic anticipator is arguably more precise. A critical reading: runtime risk reduction, not a safety proof. The first limitation is temporal observability. A single image can encode some motion cues—a walking pose, an extended robot arm, an agent facing a corridor—but it does not determine velocity. The same pose may belong to an agent moving left, right, or standing still. The method’s success therefore depends partly on visual regularities learned by the VLM and partly on the predictability of the scripted environment. The paper acknowledges that abrupt human direction changes, irregular speeds, occlusion, and socially complex motion may defeat this assumption. Second, the latency budget is uncomfortable. The default query asks about interference within the next second, but the average category arrives after 1.14 seconds. By the time the answer is available, the nominal forecast interval has already elapsed. The simulation may remain forgiving because motion is slow and structured, and because the hazardous event develops over more than one second. For deployment, however, the horizon should cover end-to-end inference latency, network jitter, cancellation delay, fallback onset, robot stopping time, and a safety margin. A one-second prediction arriving in more than one second cannot itself be treated as a reliable protective barrier. Third, the reported “safety” is empirical task success under particular terminal checks. The VLM categories are not calibrated probabilities, and there is no formal invariant, control barrier certificate, reachable-set analysis, or verified emergency controller. This is evidence of reduced observed collision-related failures in simulation—not a guarantee that unsafe states are unreachable. The appropriate deployment role is therefore advisory or supervisory unless it is backed by an independent certified safety layer. Fourth, one condition and one fallback are much simpler than realistic task execution. A manipulation action may simultaneously require collision clearance, grasp stability, force limits, object visibility, fixture state, and human exclusion. Those conditions may have different severities and different fallback behaviors. Retreating is sensible for workspace contention but could be unsafe while carrying liquid, maintaining contact, or supporting a load. Scaling the framework requires typed conditions, condition-specific fallback policies, and logic for multiple simultaneous risks. Fifth, the benchmark intentionally favors controlled attribution over realism. Pedestrian motion is scripted, the main navigation comparison contains one person, manipulation contention is induced by selecting the same first cube, and all testing is in Gazebo. Those choices make the causal comparison cleaner, but they do not capture perception noise, mechanical compliance, communications outages, uncontrolled humans, or the possibility that the fallback itself fails. The evaluation would also benefit from monitor-specific metrics. Task success combines planning quality, controller behavior, perception, risk detection, and fallback execution. For a safety monitor, we would additionally want missed-hazard rate, false-intervention rate, lead time at cancellation, minimum separation, time to contact, calibration by category, and success conditional on realized interference. Those measurements would reveal whether the VLM is genuinely forecasting or merely issuing conservative warnings often enough to improve aggregate completion. One statistical presentation choice deserves caution. The main table reports the standard deviation of Bernoulli trial outcomes—for example, a success rate of 89 percent with a standard deviation near 31 percentage points. That number describes the dispersion of individual zero-or-one outcomes, not uncertainty in the estimated success rate, and it does not shrink with additional trials. Wilson confidence intervals, which the authors use for the stress test, would be easier to interpret throughout. Finally, cloud-model reproducibility is a moving target. The paper identifies the Gemini 2.5 model families used in the experiments, while repository examples also expose provider abstraction and moving “latest” aliases. Safety-oriented replication should pin exact model revisions, prompts, decoding settings, and structured-output schemas, then rerun calibration whenever any of them changes. How I would use this in a real robot stack. I would not install this monitor as the robot’s primary collision-avoidance system. I would place it in a layered runtime-assurance architecture:. A hard reflex layer handles joint limits, emergency stops, force thresholds, protected zones, and imminent geometric collision at controller rate. A fast predictive geometry layer uses tracking, signed distance, time to collision, planned trajectories, and human-motion forecasts. A semantic VLM layer reasons about ambiguous task-level conditions such as workspace ownership, likely human intent, missing objects, or whether the current skill remains appropriate. The language planner revises the task plan when lower layers report that the current strategy is no longer viable. This allocation uses each representation where it is strongest. Geometry should handle “an object will intersect this swept volume in 300 milliseconds.” A VLM is more valuable for “the person appears to be reaching for the same drawer, so continuing this task may create a conflict.”. I would also replace the single-image query with a compact temporal packet. Two or three timestamped frames, tracked agent boxes, estimated velocities, the robot’s planned path or end-effector trajectory, and current action progress would give the model evidence rather than asking it to invent dynamics. A smaller local temporal model could produce fast numerical forecasts, while the VLM interprets those forecasts in task context. Execution conditions should become typed objects rather than free-form strings. Each condition should specify whether it is a start condition, holding condition, or postcondition; which sensors can evaluate it; its severity; its expected time scale; and the permitted fallback set. Conditions that can be compiled into deterministic monitors should be. The VLM should handle the residual semantic cases, not replace predicates already available from robot state estimation. Fallbacks deserve the same engineering rigor as nominal skills. Each should be independently tested from the states in which it may be invoked, with bounded execution time and known safety assumptions. A fallback should ideally create a verified safe or lower-risk set before expensive replanning begins. In many systems, that means stopping or yielding rather than allowing the language model to synthesize an improvised evasive maneuver. The ordinal categories should be calibrated from held-out robot logs. Teams can measure how often “neutral,” “likely,” and “very likely” precede actual condition violations, then choose thresholds using the asymmetric costs of missed hazards and false stops. Thresholds should also account for current speed and latency: the same visual risk may require different action when the base is moving at 0.1 meters per second versus 1 meter per second. The released ROS 2 repository provides a useful starting scaffold. It targets Ubuntu 24.04, ROS 2 Jazzy, and Gazebo Harmonic, separates planner and feedback nodes, supports navigation and dual-Panda demonstrations, and includes forecast, Inner Monologue, and DoReMi-style modes. It is best viewed as an experimental platform for supervisory planning rather than a production safety package. Final take. This paper’s strongest insight is straightforward: closed-loop task planning should not wait for every predicate to become false before reacting. A robot needs enough lead time to stop, retreat, yield, or otherwise create space for deliberation. The current implementation is early. Its predictor receives only one frame, cloud latency is roughly as long as the forecast horizon, conditions and fallbacks are sparse, and all evidence comes from controlled simulation. The manipulation advantage over current-state monitoring is also less statistically decisive than the navigation result. But the architectural pattern is valuable. Generate plans with explicit execution conditions. Monitor whether those conditions are trending toward failure. Couple warnings to an immediate, grounded fallback. Replan only after the robot has begun moving toward a safer state. That is not a safety certificate, and it should not replace fast geometric or formally verified protection. It is, however, a credible step from robots that can explain failure toward robots that can anticipate it.