Robotics
Agility and FORT Add an Offboard Safety Layer to Digit 5
The companies are expanding a component relationship into a three-part safety architecture for Agility's next humanoid robot. The design reflects a shift from keeping robots safe internally to connecting them with facility-wide protection systems.
By Michael G ·
Agility Robotics and FORT Robotics are expanding their work on Digit 5 into a three-part safety architecture that links controls on the humanoid robot with equipment elsewhere in a facility. The partnership includes an emergency pendant, onboard communications and a new offboard safety bridge.
The offboard interface is intended to let external safety systems communicate with Digit, extending protection beyond the robot's own sensors and motion controls. That matters as humanoids move through warehouses and factories where doors, conveyors, vehicles and workers create hazards no single machine can observe completely.
Digit 5 is Agility's next generation of the bipedal robot and the company's first version designed around what it calls cooperatively safe work. The architecture is expected to combine human detection, visible safety cues, safe motion control and independent manual override.
FORT has supplied technology for earlier Digit versions and recently developed a pendant sled that combines a tablet holder with emergency-stop and enabling-device functions. The new memorandum turns that component relationship into joint engineering, compliance and deployment support.
What Changed
The distinction between onboard and offboard control is central. An onboard system can react quickly using local sensors, while an external layer can use facility information the robot does not possess. A warehouse controller may know that a gate opened or another machine entered a shared zone.
That division also creates new failure modes. A safety bridge depends on communication, configuration and agreement about which system has authority. Engineers need defined behavior for lost connectivity, stale state and conflicting stop or resume commands.
Agility says previous Digit generations have accumulated more than 65,000 operating hours and have been deployed with customers including GXO, Schaeffler and Toyota Motor Manufacturing Canada. Those hours provide useful field evidence, though Digit 5 introduces a new safety design that must be evaluated on its own.
The manual pendant remains important even as autonomous operation improves. Setup, maintenance and unexpected conditions require a person to place the robot into a known state, and the stop path should not depend on the same autonomy software that may have created the problem.
Cooperative safety is more demanding than collision avoidance. A useful humanoid has to share space without stopping so frequently that the workflow collapses. The design must balance conservative motion with predictable productivity under real traffic.
Standards and certification will shape deployment. Industrial robot guidance historically assumed fixed arms, guarded cells or mobile platforms with narrower behavior. Humanoids combine mobility and manipulation in ways that challenge simple categories.
Physical systems turn software uncertainty into motion, force and proximity. Safety therefore depends on layered controls that remain effective when perception, planning or connectivity behaves unexpectedly.
A robot's environment is part of the system. Floors, fixtures, workers, lighting, network coverage and emergency procedures can determine whether a laboratory result survives in a warehouse or spacecraft.
Redundancy is useful only when failures are sufficiently independent. Two controls that depend on the same sensor, network or software assumption may fail together despite appearing to offer separate protection.
OSHA's robotics safety guidance places responsibility on hazard assessment, safeguarding and worker training, not merely on whether the robot completed a certification test before installation.
NIST robotics research focuses on measurement, interoperability and performance in real environments, all of which become important when a machine leaves a controlled demonstration and enters shared work.
Engineering claims become meaningful when they survive representative workloads. Reliability, throughput, calibration, recovery and performance outside a prepared demonstration matter more than a single favorable benchmark.
The Evidence To Watch
FORT's role may also include cybersecurity because an offboard safety interface becomes a network boundary. Authentication, update integrity and segmentation are necessary when a message can change the movement state of a physical machine.
Customers will need commissioning procedures that prove each layer works independently and together. A check performed when the robot arrives is insufficient if floor layouts, firmware and connected equipment change over time.
The companies say the expanded relationship will support more complex deployments. Complexity should be measured explicitly through traffic, task variation, human proximity and the number of external systems affecting the robot.
A layered safety design must define which layer wins during disagreement. A facility controller may issue a stop while the robot believes it needs to move to maintain balance, or a local sensor may detect a person after an external system has cleared the zone. Those cases require deterministic priorities tested on the actual machine rather than resolved only in documentation.
Recovery is as important as stopping. Once a protective action occurs, workers need to understand what caused it, whether the hazard remains and who may authorize motion again. An automatic restart can surprise people near the machine, while a process that always requires a specialist can make the robot impractical for ordinary shifts.
Maintenance introduces a different operating mode with different assumptions. Guards may be open, tools may be attached and technicians may intentionally command unusual motion. Safety systems should identify that mode explicitly, limit speed and authority, and preserve a record that distinguishes maintenance activity from autonomous production work.
Fleet management can create correlated risk. A software update, incorrect map or central scheduler may affect many robots at once, turning a local fault into a site-wide event. Operators need staged updates, mixed-version testing and the ability to isolate one machine without losing control of the rest of the fleet.
Near-miss reporting provides evidence before an injury or equipment loss occurs. Unexpected stops, awkward human evasions and repeated manual interventions should be reviewed as operational signals even when the robot technically remained within its limits. A low incident count is reassuring only if the reporting system captures uncomfortable events consistently.
Training should include contractors, visitors and temporary staff who may share space with the system without operating it. They need simple instructions about cues, exclusion zones and emergency action. A robot that is safe only around a small group of experts is not ready for the changing population of a commercial workplace or orbital facility.
The business case should include the cost of safe integration. Floor modifications, communication infrastructure, risk assessments, training and maintenance can exceed the price of the robot itself. Transparent deployment costs help customers compare automation with process redesign rather than evaluating a machine price against the full cost of human work.
Long-duration operation should be evaluated separately from short functional tests. Heat, battery behavior, component wear and repeated recovery can change how a robot moves after hours of work. Operators need maintenance thresholds tied to measured condition, along with a conservative response when a sensor or actuator begins drifting before it reaches an obvious failure.
Workers also need a consistent language of cues. Lights, posture and motion should communicate whether Digit has detected a person, yielded, paused or requires help without asking employees to consult a screen.
The commercial benefit of a shared safety architecture is that customers can integrate several robots into existing facility procedures. The risk is that a vendor-specific bridge becomes another proprietary layer that is difficult to audit or use with mixed fleets.
Digit 5 will be judged by whether the layers make deployment safer without making normal work brittle. The partnership is strongest when it treats safety as an operating system for the site, not a compliance accessory attached after the robot is built.
Agility and FORT Add an Offboard Safety Layer to Digit 5 also changes the practical sequence of decisions. Organizations need to establish what is known, what came from the reporting source and what remains a provider or official claim before they turn the development into procurement, policy or operational guidance.
The immediate test for Digit 5 safety is not whether the idea sounds plausible. It is whether another team can reproduce the result or verify the reported conduct using preserved records, defined conditions and a comparison with the process that existed before the change.
Agility Robotics introduces dependencies that are easy to miss during a launch cycle. Identity, data access, model versions, infrastructure capacity and human approval can each determine the outcome even when the visible product appears to be one integrated service.
A useful evaluation should include failed attempts and interventions. If specialists repeatedly correct the system, rebuild context or reverse actions, the apparent speed of FORT Robotics may reflect work moved to a less visible part of the organization rather than work eliminated.
The commercial and institutional incentives point in different directions. Providers benefit from rapid adoption and broad claims, while customers and regulators need stable definitions, comparable evidence and enough time to examine conduct outside the conditions selected for a demonstration.
That tension does not require stopping useful experimentation. It argues for bounded trials in which authority is narrow, logs remain available and the organization has already decided which result would justify expansion, revision or suspension.
The human role should be specified rather than described as oversight in the abstract. Reviewers need time, relevant evidence and authority to reject the recommendation. A person who sees only the final output cannot reliably detect an upstream data or permission failure.
Costs should be counted at the completed-task level. Inference, retries, connected tools, specialist review, security controls and incident recovery all contribute to the price of a dependable outcome, even when the headline model or software rate appears low.
The record also needs to survive a vendor update. Teams should retain the model and policy version, evaluation set, accepted exceptions and the reason a deployment was approved so that later performance can be compared with the system decision-makers actually examined.
Commercial adoption will depend on serviceability as much as dexterity. Customers need predictable maintenance, spare parts, diagnostics and a clear process for returning a machine to safe operation.
Human factors deserve the same attention as autonomy. Workers must understand a robot's cues, know when it has yielded and be able to stop it without interpreting an opaque internal state.
The best evidence will come from hours of ordinary work, including interruptions and recovery, rather than a short sequence selected for a launch video.
The Association for Advancing Automation's robot safety standards explain how risk assessment and protective measures fit together across industrial deployments, including systems that combine mobility and manipulation.
ISO robotics standards help customers distinguish machine capability from the documented safety processes required to integrate that capability into a shared workplace.
The first implementation discipline is a clear baseline. Teams should record how the work is performed today, how long it takes, which errors occur and which outcomes matter before introducing a new system.
Evaluation should include incomplete instructions, unusual inputs and changing conditions. Prepared demonstrations remove precisely the ambiguity that production systems are expected to handle.
Human review has to be designed around limited attention. Asking a person to approve a constant stream of routine outputs produces click-through behavior rather than meaningful oversight.
Data lineage deserves equal scrutiny. A polished result can be assembled from stale, incomplete or incorrectly joined records, so important claims need traceable sources and update times.
Procurement should cover retention, subcontractors, model changes, export rights and incident notice. Those terms determine whether a pilot can become governed infrastructure.
Metrics should include abandoned tasks, manual takeovers, permission denials and corrected outputs. Those events show where uncertainty enters the workflow even when no public incident occurs.
Competition can improve price and quality, but it can also make restraint look like weakness. Release processes need room to narrow or delay a feature when the evidence does not support wider use.
Workforce effects should be measured across the process. Automation can remove one repetitive step while creating review, exception handling and customer communication somewhere else.
Organizations should preserve an exit path. Model portability, documented workflows and exportable records reduce the risk that an experimental decision becomes an irreversible dependency.
The near-term evidence will come from customer deployments, independent testing and the handling of failures. Those signals reveal strategy more clearly than a launch-stage claim.
A useful deployment plan separates technical success from organizational readiness. The system may perform a task in testing while the institution still lacks an owner, an incident process or authority to suspend it. Launch approval should require both forms of evidence because a reliable component can still produce harm inside an unmanaged workflow.
Independent review is strongest when evaluators can reproduce the relevant conditions. Aggregate scores and selected examples are not enough for high-consequence claims. Reviewers need model or hardware versions, tool settings, input classes, intervention rules and the definition of success, along with enough failed cases to understand where the boundary lies.
Communication after failure deserves advance design. Customers, workers and regulators need different information at different speeds, but all of them benefit from a consistent factual record. Teams should decide who confirms an event, who can speak publicly and how corrections will be issued before commercial pressure makes those choices harder.
The final decision should remain reversible. Organizations can limit scope, keep a manual path and set a date for reassessment rather than treating adoption as a permanent endorsement. Reversibility turns uncertainty into a managed condition and gives leaders room to respond when new evidence changes the balance of benefit and risk.
The significance of Digit 5 safety will be settled after the announcement cycle. The durable measure is whether the evidence improves, the controls survive pressure and the organizations involved remain willing to explain decisions when performance and responsibility pull in different directions.
Topics: Digit 5 safety, Agility Robotics, FORT Robotics, humanoid robots, industrial safety