• 

  Architecture

• 

  Lifecycle

• 

  Summary

MotionFence — Safety-Gated Physical AI

Nemotron proposes. MotionFence decides. No valid ticket, no actuation.

---

Inspiration

What happens when an AI agent makes the right decision—but the physical world doesn't cooperate?

Imagine an AI detecting a leaking industrial valve and recommending an emergency isolation action.

The recommendation appears reasonable. The operational manual supports it. The model reports high confidence.

But what if a technician enters the hazardous area after authorization? What if the manual is outdated or applies to different equipment? What if the actuator receives the command but the valve never moves?

In a chatbot, an incorrect answer may be inconvenient. In a physical control system, an incorrect action can have serious consequences.

As AI advances toward robotics, industrial automation, and autonomous physical operations, we believe two distinctions are essential:

An AI-generated action is not an authorization.

An executed command is not a verified outcome.

We built MotionFence to explore how a probabilistic AI model can contribute useful reasoning without obtaining unrestricted authority over physical operations.

MotionFence introduces a deterministic safety-authorization boundary between AI-generated proposals and simulated industrial execution.

The model can reason, interpret evidence, and recommend an action. It cannot directly authorize or execute that action.

What it does

MotionFence is an open-source, evidence-gated safety runtime for Physical AI.

It combines NVIDIA Nemotron, operational knowledge retrieval, deterministic policy enforcement, cryptographic authorization, execution-time state revalidation, simulated industrial equipment, and post-action verification.

The core workflow is:

Observe → Retrieve → Ground → Propose → Evaluate → Authorize → Revalidate → Execute → Verify → Record

Every consequential action passes through explicit safety checks before the simulated hardware can execute it.

1. AI reasoning without unrestricted authority

NVIDIA Nemotron analyzes supplied intent, simulated plant observations, and relevant evidence to generate structured physical-action proposals.

MotionFence then validates the proposed action, target, evidence references, and operating conditions.

Nemotron cannot mint authorization tickets, directly command actuators, or override deterministic safety policy.

2. Cryptographically enforced authorization

When the deterministic PolicyEngine permits an action, the SafetyEnclave issues an HMAC-SHA256 signed authorization ticket.

Tickets are bound to the authorized action and safety-relevant execution context, including the recorded plant state.

The hardware boundary validates the ticket, checks its eligibility, and enforces single-use behavior.

A denied action must not receive an authorization ticket. Contradictory records indicating issuance after denial are classified as safety errors rather than successful denials.

3. Execution-time state revalidation

Authorization can become stale between the initial decision and physical execution.

MotionFence implements a time-of-check/time-of-use (TOCTOU) defense.

Immediately before simulated actuation, the runtime revalidates the state-bound authorization against the current modeled environment.

If conditions have changed incompatibly with the authorization, the action is blocked.

4. Post-action verification and fault handling

A successful command dispatch does not establish that the physical objective was achieved.

MotionFence checks the resulting simulated world state against action-specific postconditions.

For example, closing a valve requires evidence that the intended valve is CLOSED, cooling remains active, and applicable leak-related conditions are satisfied.

If an injected mechanical fault prevents the intended transition, MotionFence records the verification failure and initiates its modeled containment and recovery workflow.

Importantly, a recorded recovery attempt or CLOSED final valve position does not automatically establish verified recovery.

Where independent final verification evidence is missing, MotionFence reports UNVERIFIED.

5. Interactive decision and digital-twin console

MotionFence includes an interactive React-based console with two synchronized views:

• Decision and evidence rail: Shows observations, AI proposals, safety policy, authorization tickets, state revalidation, execution results, and verification outcomes.
• 3D industrial digital twin: Uses Three.js and WebGL to visualize recorded valve positions, pumps, actuator behavior, hazard-zone conditions, and simulated physical-state changes.

The visualization is driven by execution evidence rather than scenario labels or predetermined success animations.

The interface distinguishes a valve that has moved from an outcome that has been verified.

A One-Click Demo Director guides judges through the major scenarios, while the Decision Replay Console allows detailed inspection of individual stages.

How we built it

NVIDIA Nemotron + Nebius Token Factory

We integrated the NVIDIA open model:

nvidia/nemotron-3-super-120b-a12b

Inference runs through Nebius Token Factory using its OpenAI-compatible API:

https://api.tokenfactory.nebius.com/v1/

Nemotron performs two primary reasoning tasks:

Physical-action proposal generation: It converts operational intent and supplied environmental observations into structured candidate actions, including target, rationale, confidence, and supporting evidence identifiers.

Operational knowledge interpretation: It assists in extracting candidate constraints from engineering documentation, including prohibitions, requirements, preconditions, and postconditions.

We used structured prompt engineering, low-temperature inference, constrained action types, bounded output tokens, evidence-reference validation, and deterministic post-processing.

We did not fine-tune the model.

The provider has no access to actuator execution credentials or ticket-signing secrets.

Measured live Nebius validation:

Metric	Recorded result
Real Nemotron inference requests	10
Prompt tokens	6,057
Completion tokens	3,597
Total tokens	9,654
Average response latency	~1.86 seconds

Our live validation also exercised safe action proposals, hazard-zone denial, malformed-output handling, state-drift protection, environmental-context proposals, and simulated provider failures.

Why Nebius mattered: Token Factory allowed us to integrate a large NVIDIA reasoning model without provisioning GPU instances, managing model weights, or operating our own inference-serving infrastructure.

We used Nebius Token Factory for managed inference. The public web application is hosted separately on Render; we did not deploy the application onto Nebius GPU Compute or Serverless Endpoints.

---

How We Used Tavily — Evidence-Grounded Physical AI

Tavily is a functional operational-knowledge integration, not merely a search feature or a sponsor badge.

Physical AI systems frequently depend on equipment manuals, operating procedures, maintenance instructions, safety standards, and external technical references.

But retrieving a convincing-looking document does not establish that its instructions are applicable, current, or safe.

A retrieved rule might refer to another equipment model. A community discussion might omit a critical condition. A copied manual might preserve outdated instructions. A language model might accidentally reverse a prohibition or invent a numerical threshold.

We integrated the Tavily Search API to retrieve external operational knowledge and built a deterministic evidence-admissibility pipeline around it.

Tavily's role in MotionFence

Our knowledge-processing workflow is:

Tavily Search → Knowledge Retrieval → Source Trust Assessment → Claim Grounding → Constraint Admissibility → Deterministic Policy Evaluation

Step 1 — Retrieve operational evidence

Tavily searches for relevant engineering documentation, equipment manuals, procedures, and safety-related operational information.

Results are normalized into structured evidence records containing source URLs, document content, retrieval metadata, and provenance.

Step 2 — Assess source trust

MotionFence distinguishes among source types, including manufacturer documentation, standards-related material, third-party references, and community-generated content.

A search result's ranking or relevance score does not automatically make it authoritative.

Step 3 — Ground extracted claims

Nemotron-assisted extraction can identify candidate operational rules from retrieved documents.

MotionFence checks whether those claims are actually supported by the source text.

The grounding layer evaluates issues such as:

• Unsupported or fabricated evidence references.
• Negation and modal changes that could reverse a safety instruction.
• Missing preconditions or operating constraints.
• Invented numerical thresholds.
• Equipment or operational-scope mismatches.
• Duplicate, stale, contradictory, or insufficiently supported references.

Step 4 — Issue evidence-support records

Supported claims are associated with structured grounding evidence, source identifiers, and admissibility results.

Unsupported claims do not become trusted policy merely because an AI model generated them.

Step 5 — Apply deterministic policy

Retrieved information and candidate constraints must pass the appropriate validation and admissibility requirements before affecting safety-policy evaluation.

Neither Tavily nor Nemotron can independently authorize physical execution.

Real Tavily API validation

We exercised the actual Tavily Search API during controlled live validation.

Metric	Recorded result
Live Tavily search requests	10
Average retrieval latency	~2.96 seconds
Evidence-quality categories exercised	8

The evidence-quality matrix covered authoritative documents, regulatory references, community content, conflicting sources, mirrored duplicates, stale documents, ambiguous claims, and equipment-scope mismatches.

The public demonstration also supports deterministic offline evidence fixtures, keeping the judging experience reproducible without requiring judges to provide API credentials.

Why Tavily is essential: It helps MotionFence connect external operational knowledge to safety reasoning while preserving a strict boundary between retrieved information and executable authority.

Tavily supplies evidence. Nemotron proposes. MotionFence authorizes.

This integration is also our contribution to the hackathon's Best Use of Tavily bonus category.

---

Real-world environmental telemetry — USGS

We integrated the USGS Water Data API to bring authentic external environmental observations into the reasoning workflow.

The integration retrieves streamflow and gage-height observations from monitoring station USGS-01646500 on the Potomac River.

Observations are processed with timestamps, source identifiers, freshness checks, and SHA-256 provenance information.

The external measurements are used as contextual information for the model and safety workflow.

They are not presented as direct industrial-plant sensor readings or as authority to actuate machinery.

Physical simulation and hardware boundary

MotionFence includes a software-simulated industrial environment with:

• Isolation valves and piping.
• Pumps and cooling-system state.
• Modeled leaks and flow conditions.
• Human safety-zone occupancy.
• Actuator faults and simulated limit-switch readbacks.
• Controlled failures and post-action verification.

A mock hardware endpoint enforces authorization-ticket checks before simulated state changes.

We also implemented an NVIDIA Isaac Sim adapter contract and OpenUSD industrial-cell scene definitions.

Native NVIDIA Isaac Sim execution was not demonstrated in the deployed environment. The public 3D interface is a browser-based WebGL representation, not a native Isaac Sim physics runtime.

Bounded formal assurance

We integrated the Z3 SMT solver to check safety properties over bounded symbolic models of the runtime.

The source registry contains 60 registered safety property IDs. The assurance execution also reports two additional temporal-sequence findings, producing 62 satisfied findings in the recorded run.

These checks examine modeled authorization, execution, environmental conditions, and safety transitions.

They do not constitute real-world industrial safety certification.

Public deployment

MotionFence runs publicly on an existing Render Free web service in Singapore.

The backend uses Python, while the frontend is built with React, TypeScript, and Three.js.

The public demonstration intentionally uses deterministic offline replay to protect external provider credits and deliver reproducible evaluation.

Live Nemotron and Tavily API integrations were validated separately.

The public REPLAY session must not be confused with fresh paid model inference.

MotionFence Safety Lab — Quantitative Evidence

Beyond the main demonstration, we built an interactive adversarial testing environment that exercises the actual deterministic safety runtime under defined simulated conditions.

The expanded Safety Lab contains 20 cases covering nominal execution, unsafe proposals, environmental violations, stale authorization, contradictory evidence, invalid tickets, and simulated actuator faults.

Recorded benchmark results

Metric	Result
Safety Lab scenarios passed	20/20
Unsafe simulated actuations	0/12
False postcondition verifications	0/2
False denials of eligible actions	0/4
Fail-closed gate cases	7/7
Post-action verification coverage	7/7
Bounded assurance findings satisfied	62/62
Backend automated tests	655 passed
Frontend automated tests	154 passed

The benchmark results are reproducible within the implemented software simulation and bounded test cases.

They are not measurements of real industrial hardware reliability or a claim of IEC 61508/ISO 13849 certification.

The Safety Lab exposes scenario details, expected outcomes, assertions, and versioned evidence exports for independent inspection.

Demonstration Scenarios

Our final 2-minute-50-second YouTube video uses footage captured from the deployed MotionFence application.

1. Safe valve isolation

Nemotron's recorded proposal leads to deterministic authorization. A signed ticket permits simulated execution. The valve reaches the recorded CLOSED position, but the outcome becomes VERIFIED only after the post-action evidence is evaluated.

2. Human hazard-zone denial

A simulated technician occupies the exclusion zone. The deterministic policy returns DENY. No valid authorization ticket is issued, and the valve remains OPEN.

3. TOCTOU state drift

An action is initially authorized, but the recorded world state changes before execution. The execution-time revalidation barrier rejects the stale authorization and prevents simulated actuation.

4. Mechanical failure and recovery assessment

An injected actuator fault prevents the intended valve transition. MotionFence detects the failed postcondition and records containment and a SUSPECT component status.

The historical record also contains a later CLOSED valve state, but lacks sufficient correlated independent final verification. MotionFence therefore reports UNVERIFIED, rather than inventing verified recovery.

5. USGS telemetry

Real historical environmental observations are presented with provenance and source labels, without being confused with the simulated plant's measurements.

6. Tavily operational knowledge grounding

Retrieved technical knowledge is evaluated for source trust, claim support, applicability, and constraint admissibility.

The demo additionally presents the Safety Lab, bounded formal-assurance findings, and an interactive architecture explanation.

Challenges we ran into

Preventing AI proposals from becoming execution authority

A capable model can generate plausible actions, but plausible actions are not necessarily safe.

We separated Nemotron's reasoning from deterministic authorization and hardware-ticket enforcement.

Defending against stale authorization

Physical conditions can change after approval.

We implemented state-bound tickets and execution-time revalidation so stale permissions cannot silently authorize a later operation.

Distinguishing execution from verified outcomes

A command being accepted by an actuator does not prove that the intended movement occurred.

We implemented simulated fault injection, action-specific postconditions, discrepancy detection, and explicit unverified states.

Preventing untrusted knowledge from becoming policy

External search results may be outdated, contradictory, incomplete, or inappropriate for the equipment.

Tavily retrieval is therefore followed by source assessment, claim grounding, and deterministic admissibility checks.

Making the demonstration itself trustworthy

An attractive 3D animation can create a misleading impression of success.

We refined the presentation contract so decision outcomes and the rendered plant are driven by recorded evidence.

Missing verification cannot be reconstructed from scenario names or final valve positions.

Maintaining reproducibility without uncontrolled cloud costs

Live model inference and external search calls consume credits and introduce variability.

We separated controlled live-provider validation from the public deterministic replay experience and added bounded request budgets.

Accomplishments that we're proud of

We delivered a working, publicly accessible software prototype that demonstrates the separation between AI reasoning, safety authorization, simulated physical execution, and outcome verification.

Our principal accomplishments include:

• Real NVIDIA Nemotron inference through Nebius Token Factory.
• Real Tavily operational-knowledge search and evidence-grounding integration.
• Real USGS environmental telemetry ingestion.
• Deterministic safety-policy evaluation and signed, single-use authorization tickets.
• Execution-time state-drift protection.
• Simulated actuator-failure detection and evidence-aware recovery assessment.
• A synchronized 3D digital twin and decision console.
• An interactive 20-scenario adversarial Safety Lab.
• Z3-based bounded formal assurance.
• An MIT-licensed public repository with reproducible setup and test instructions.
• A deployed, no-login demonstration requiring no API keys from judges.

The final release was tested with 655 passing backend tests, 154 passing frontend tests, and browser-based checks of the public WebGL application.

Most importantly, MotionFence does not require every scenario to end in success.

A denied action, blocked authorization, mechanical failure, or unverified recovery is a meaningful result when supported by the actual evidence.

What we learned

1. AI intelligence and physical authority should be separate.

A model can contribute valuable reasoning without possessing the credentials to execute consequential actions.

2. Retrieved knowledge is evidence, not permission.

Tavily can discover relevant operational information, but source support and applicability must be checked before candidate rules influence physical decisions.

3. Authorization is time-dependent.

An action that was safe when approved may no longer be safe when executed.

4. Execution success is not outcome verification.

The system must check what happened after a command, not merely whether the command was dispatched.

5. The interface must be subject to the same evidence discipline as the runtime.

Visual success should never be stronger than the underlying verification record.

Our central principle is:

AI reasoning is probabilistic. Safety authorization is deterministic. Physical outcomes must be verified.

What's next for MotionFence

Our next development priorities are:

1. Native NVIDIA Isaac Sim validation: Execute the existing integration contract against a compatible NVIDIA GPU environment and real physics simulation.
2. Hardware-in-the-loop testing: Integrate controlled laboratory equipment, independent sensor readings, and hardware safety interlocks.
3. Expanded adversarial evaluation: Test larger scenario corpora, sensor contradictions, provider failures, and cross-system races.
4. Stronger evidence provenance: Improve source-to-decision traceability across multi-step agent workflows.
5. Reusable integration interfaces: Explore a vendor-neutral safety-authorization boundary for robotics and industrial automation developers.

The longer-term goal is to make safety authorization, time-of-use revalidation, and evidence-backed outcome verification reusable components for AI-assisted physical operations.

Current limitations

MotionFence is an experimental Physical AI safety prototype, not a certified industrial safety controller.

Physical actuation, simulated sensors, limit-switch readbacks, and final-state verification currently operate in software simulation.

No industrial PLC, GPIO actuator, or physical test bench is connected. Native NVIDIA Isaac Sim runtime execution has not been demonstrated.

The formal-assurance findings apply to bounded symbolic models, and the benchmark metrics apply to defined synthetic scenarios.

Public replay reproduces recorded execution evidence; it is not fresh live inference.

These boundaries are intentional and disclosed so the results can be evaluated accurately.

---

Technical Release Evidence:
https://github.com/subodhkant7/motionfence/blob/main/docs/phase_2z_release.md

Note: The live application runs on a Render Free service and may have a cold start after inactivity. Judges do not need an account or API credentials to use the public demonstration.

MotionFence exists because Physical AI needs more than intelligence. It needs independently enforced permission to act—and evidence that the intended outcome occurred.

Nemotron proposes. MotionFence decides. No valid ticket, no actuation.

Built With

• docker
• google-cloud-run
• hmac-sha256
• nebius-token-factory
• nvidia-isaac-sim-adapter
• nvidia-nemotron
• openusd
• pydantic
• python
• react
• sha-256
• tavily-search-api
• typescript
• usgs-water-data-api
• vite
• vitest
• z3-smt-solver