Physical Intelligence OS

GROVIM — The Security Layer for AI and Systems.

AI can act. GROVIM decides when it must stop.

Open simulator Request access
38 Subsystems
272 Modules

Every physical command passes through one gateway. There is no second path.

6,515 Tests passing
0 Known open issues

01The system

An authorisation kernel for machines that move.

Between a probabilistic AI planner and a physical actuator there must be something deterministic. GROVIM is that layer: it takes a proposed action, proves it safe against mathematical bounds, checks who is allowed to command it, and only then lets it reach hardware. Every physical command passes through one gateway. There is no second path.

38
Subsystems
8
Operational domains
17
Safety modules
23
API operations

THE STACK

07COGNITIVE

LLM reasoning, natural-language intent, task decomposition into concrete action proposals.

src/cognitive · src/agents
06WORLD MODEL

Frame observation, state building, change detection — what the machine believes is true right now.

src/world_model
05SIMULATION

Hypothesis generation and trajectory prediction. Unsafe paths are discarded before anything moves.

src/simulation · src/simulator
04SAFETY ENFORCEMENT

Control barrier functions, deny-by-default gateway, AST-level proof that no component can bypass it.

17 modules · 9,249 lines
03PERMISSION & AUTHORITY

Five-tier RBAC, operation classifier, ten-state authority machine, cryptographic command tokens.

src/core · src/api
02HARDWARE ABSTRACTION

One adapter protocol for every platform. Unit conversion, coordinate frames, time sync, fault injection.

23 modules · 8,542 lines
01EVIDENCE CHAIN

Hash-chained record of every command, response and safety decision. Externally auditable.

HMAC-SHA256
Deny by default, everywhere. Any path that cannot produce a real measurement raises an error rather than returning a plausible value. A sensor that quietly reports “all clear” when it is broken is more dangerous than one that reports a fault — an operator reads silence as a clear sky.

02The decision path

Detect. Corroborate. Refuse, if it must.

Five phases from sensor return to authorised effect: DETECT → CLASSIFY → DECIDE → INTERCEPT → ASSESS. Below is a live trace of four real engagements — including one where GROVIM declines. Clearing the release gate is not the same as permission to fire.

GROVIM · Kill chain traceRunning
DJI MAVICTRACK 1041
RADAREO/IRSDRACOUSTIC
DETECTCLASSIFYDECIDEINTERCEPTASSESS
CONFIDENCE
CORROBORATION
TRACK AGE
Initialising sensor bus…

FOUR ENGAGEMENTS — TRACE SUMMARY

TrackConfidenceSensorsMethodCommittedVerdict
DJI Mavic0.8094Cyber$100Authorised
FPV racing0.7913Cyber$100Authorised
Military UAV0.7754—$0ROE denied
Fibre-optic0.8222Kinetic$3,000Authorised

RELEASE CRITERIA — ALL THREE MUST HOLD

≥ 0.70
Classification confidence
How strongly the sensors present agree on what the object is.
≥ 2
Corroborating sensors
How many independent sources confirm it. One compromised sensor cannot authorise alone.
< 30s
Track age
A stale classification is not a current picture, and cannot authorise effect.

Confidence and authority are deliberately separate questions. A single sensor matching its reference perfectly reports confidence 1.00 while remaining one unverified source — so the corroboration count is enforced independently of the confidence value.

ScenarioConfidenceResult
One sensor, perfect match1.00Denied — single source
Radar + RF, agreeing1.00Authorised
Radar + RF, contradicting0.56Denied — below threshold
Military UAV at ALERT posture0.775Denied — ROE, no spend

RULES OF ENGAGEMENT — POSTURE GATES METHOD

PEACE
Detection and tracking only. No effector may be committed.
ALERT
Non-kinetic methods on qualifying targets. Cyber permitted; EW is not.
ENGAGED
Full cascade available, subject to the release criteria above.
CEASE FIRE
All effect halted. Tracking continues; nothing is dispatched.

03Four ways to see

One object. Four independent truths.

No single modality is sufficient. Radar gives range and cross-section but cannot see an airframe. Optics measure shape but need range to mean anything. RF is blind to anything that does not transmit. Acoustics hear a fibre-optic drone that emits nothing at all. Every figure below is measured against a known ground truth.

ARGUS-RDR
Radar
ASTERIX CAT-048 over UDP or file replay. The only modality that yields range and radar cross-section — and RCS is what separates nine of ten airframes that are ambiguous on speed alone.
  • Slant range at 10 NM — 0.000 m error
  • Azimuth at 90° — 0.000° error
  • Ground speed at 200 kt — 0.025 m/s (LSB floor)
  • Verified against hand-computed EUROCONTROL messages
SIREN
Acoustic
Shaft-harmonic extraction with multiple-correction and sub-bin refinement. The only sensor that detects a fibre-optic drone, which has no RF link to find.
  • Shaft frequency, six airframes — 0.000 % error
  • TDOA bearing — 1.71° against 2.44° quantisation
  • Pure noise — rejected across all seeds
  • Blade-pass tone correctly resolved to shaft rate
HARP-RX
Software-Defined Radio
I/Q fingerprinting: carrier offset, burst cadence, occupied bandwidth. The detection threshold is derived from noise statistics, not set as a constant.
  • Carrier frequency — 0.0 Hz error across five offsets
  • Burst interval 2–20 ms — 0.00 % error
  • False positives on white noise — 0 of 12
  • Threshold tracks record length as ln(N)
ARGUS-EO
Electro-Optical / Infrared
Pinhole projection converting pixels to centimetres. Range is a required input — the driver raises rather than assume it.
  • Ground sample distance at 300 m — 1.638 cm
  • Both orientations tested per candidate
  • Resolvability computed before a verdict is offered
  • Missing range — raises, never guesses
Why range is mandatory. A forty-pixel blob is a 28 cm quadcopter at 200 m or a 3.5 m Shahed at 2.5 km. An assumed range produces a precise, confident, wrong answer — and a wrong answer that clears the release gate is far worse than an honest error.

THREAT CATALOGUE — TEN AIRFRAMES, FOUR SIGNATURE SETS

ClassRFAcousticDefeat path
DJI Mavic / Mini / Phantomyes120 / 133 / 108 HzCyber takeover — commercial protocol
Autel Evo · Skydio X2yescataloguedCyber or jamming
FPV racingyes200 HzCyber — open analogue link
Custom DIYyescataloguedJamming, then kinetic
Military UAVencrypted66 HzJamming — cyber ineffective
Shahed-136none50 HzRadar + optics + acoustics → kinetic
Fibre-opticnonecataloguedAcoustics → kinetic only

04The hard case

A target that emits nothing at all.

“RF detection has limited effectiveness against baseline Shahed-136 variants in terminal phase because GPS/INS guidance is passive from the defender's perspective.”

— DRONE-WARFARE.COM · COUNTERING THE SHAHED-136

RADAR

60.0 m/s against 21.0 m/s for a quadcopter. Speed alone separates it decisively.

ELECTRO-OPTICAL

246 × 355 cm measured against a catalogued 250 × 350. Body longer than wingspan — the only such airframe.

ACOUSTIC

50.0 Hz shaft fundamental. Two-blade pusher propeller, unmistakable.

Identified at 0.791 confidence from three corroborating sensors — with zero RF emission. This is precisely why four modalities exist rather than one.

05Cascade engagement

Cheapest method that actually works.

GROVIM does not pick one weapon. It walks a cascade in cost order and stops at the first method the target is actually vulnerable to. A commercial quadcopter falls to a $100 cyber takeover. A fibre-optic drone has no RF link to attack at all, so the cascade runs to kinetic. Fifty percent from one method is not an outcome — if a method fails, the next is tried.

GROVIM · Cascade selectionLive
Stage 1 — Cyber
$100
Protocol takeover on commercial and FPV airframes. No effect on encrypted military links or fibre-optic control.
Stage 2 — Electronic warfare
$500
Jamming and GNSS spoofing. Effective against frequency-hopping military links at reduced probability; useless against fibre.
Stage 3 — Kinetic
$3,000
Four $750 interceptor drones. The path for anything with no radio link to attack — fibre-optic and hardened airframes.

MEASURED VULNERABILITY BY TARGET CLASS

Target classJamCyberEvidence
FPV0.310.60Verified — Ukraine combat data
DJI / commercial0.500.40Estimate
Shahed-1360.650.30Low end of claimed range
Military UAV0.300.05Estimate — encrypted
Fibre-optic0.000.00Physics — no RF link

06Safety architecture

Seventeen modules whose job is to say no.

The safety plane is the largest single subsystem after the domains themselves: 9,249 lines across 17 modules, exercised by 103 test files. It is deterministic and independent of any language model — the AI proposes, and this layer decides whether the physical world is allowed to receive it.

Safety gateway
One choke point
Every physical command passes through a single gateway. An AST-level audit proves no component can construct a path around it — the guarantee is structural, not a convention.
Control barrier functions
Forward invariance
A quadratic program constrains commanded action inside a proven safe set. If the solver returns infeasible, raises, or exceeds its budget, a watchdog forces an explicit safe state.
Five-stage sensor validation
Anti-spoofing pipeline
Integrity, consistency, plausibility, freshness and noise-pattern checks run before a reading is trusted enough to inform a decision.
Dual physical watchdog
Hardware and software tiers
Independent watchdogs cut actuator power on loss of heartbeat. Survives process crash — a hung supervisor cannot leave a machine energised.
Authority state machine
Ten deterministic states
UNINITIALIZED → INITIALIZING → AUTONOMOUS, SUPERVISED, DEGRADED, FALLBACK, RECOVERY, MAINTENANCE, EMERGENCY, SHUTDOWN. Transitions are explicit and logged.
GNSS spoofing protection
Inertial fallback
Dead-reckoning from IMU when satellite navigation disagrees with inertial truth. A spoofed position does not silently become the accepted one.
Counter-counter-UAS
Protecting our own fleet
Frequency hopping and autonomous fallback for when the adversary jams or spoofs GROVIM's own drones. Defence is symmetric.
C2 link-loss safe state
Token heartbeat with TTL
Kinetic authority expires unless actively renewed. Losing the command link revokes permission rather than freezing the last order.
Cross-domain arbitration
Conflicting demands
When multiple domains contend for the same physical resource, arbitration resolves priority under safety constraints rather than first-come order.
Red team automation
Adversarial by default
Automated attacks against our own defences: spoofed tracks, forged commands, GNSS manipulation, replayed evidence. Findings are recorded, not discarded.
Cryptographic authorisation. Fleet-level operations require a signed safety token. Without it the system fails closed — an unsigned command is rejected by mathematics rather than by a boolean flag someone can flip.

07Fleet & swarm

One operator. A thousand aircraft.

Fleet management coordinates up to a thousand drones through the same safety gateway as a single unit. Fleet-level barrier functions handle pairwise collision avoidance; arbitration resolves two drones assigned the same target; a fleet E-stop cascades to every airframe at once.

GROVIM · Fleet coordination & swarm classificationSimulating
Fleet idle.

SWARM CLASSIFICATION

SINGLE
One airframe acting alone. Standard release criteria apply.
GROUP
Several loosely correlated tracks. Treated individually with shared context.
SWARM
Spatially and temporally clustered formation. Saturation logic engages.
UNKNOWN
Insufficient structure to classify. Never upgraded by assumption.

COMMAND & CONTROL

Common Operating Picture
Unified tactical map — every track, sensor and effector on one surface, with track correlation across sources.
Kill Chain Analytics
Per-phase timing across DETECT, CLASSIFY, DECIDE, INTERCEPT and ASSESS. Bottlenecks are measured, not guessed.
After Action Review
Three-dimensional reconstruction and full timeline of every engagement, replayable from the evidence chain.

08Eight domains

Same kernel. Any machine.

The core intelligence never changes — only the adapter. Each domain brings its own entities, simulator and safety bounds while sharing one gateway, one permission model and one evidence chain. 11,456 lines across 26 modules.

SC-1 · CRITICAL
Counter-UAS
Detection, classification, release criteria and cascade engagement against unmanned aircraft.
cuas · barriers
SC-1 · CRITICAL
Interceptor
Pursuit geometry, intercept-point solution, kill probability and per-engagement cost accounting.
2,024 lines
SC-1 · CRITICAL
Drone Guard
Persistent border and perimeter watch with segment assignment, charging rotation and handover.
2,332 lines
SC-1 · CRITICAL
Naval Drone
Surface and sub-surface craft: mine detection and marking, hydrodynamic model, INS drift under GNSS denial.
1,799 lines
SC-1 · CRITICAL
Drone / UAV
Flight envelope, waypoint navigation, geofence bounds, battery reserve and emergency landing.
843 lines
SC-2 · HIGH
Vehicle
Lane keeping, adaptive cruise, autonomous emergency braking, obstacle and traffic-light handling.
1,649 lines
SC-2 · HIGH
Industrial
Robot arm envelope, conveyor control, valve and pressure limits, physical E-stop integration.
1,053 lines
SC-3 · MODERATE
Smart Home
Locks with fail-safe unlock, HVAC bounds, CO monitoring and evacuation control.
1,039 lines
One adapter protocol. Abstract commands translate to ROS, CAN, MQTT or a custom transport at the boundary. Unit systems, coordinate frames and time synchronisation are handled explicitly — a metres-versus-centimetres mismatch is a class of bug this layer exists to eliminate.

08bCyber & AI oversight

The same rules, for digital threats.

GROVIM's kernel — one gateway, one permission model, one evidence chain — does not stop at physical actuators. Two modules extend it into the customer's cyber and AI-agent estate.

CYBER · MONITORING
Cyber Dome
Watches customer infrastructure and its AI agents. Sentinels post signed, replay-protected event envelopes; eleven deterministic detection rules (brute force, credential compromise, web scanning, rogue processes, file-integrity drift, AI prompt injection, AI tool-call exfiltration and more) turn raw events into incidents mapped to MITRE ATT&CK. Humans decide the response; GROVIM proves what happened.
11 detection rules
AI · GOVERNANCE
AI Guard
A permit-and-approval layer that sits in front of any AI agent's actions. Every proposed action is checked against its permit, classified by risk, and either executed, queued for human approval, or blocked. Any action that bypasses this check entirely is treated as compromise — not a mistake — and triggers an immediate kill-and-latch. Every decision lands in the same tamper-evident evidence chain as the physical side, so one auditor tool covers drones and software agents alike.
shared evidence chain
One kernel, two worlds. A physical intercept and an AI agent's blocked action are logged, reviewed and proven the same way — because underneath, they are the same decision: is this action inside the permission this system was given, and can we show our work afterward.

09Cost per kill

Unit price is not the real number.

Cost per kill is unit cost divided by probability of kill. A method that works half the time costs twice its sticker price per result. Every engagement is recorded in a ledger with per-field evidence grading, so the arithmetic can be audited rather than believed.

SystemUnitPkPer killEvidence
Patriot PAC-3 MSE$3,729,7690.90$4,144,188Verified
Iron Dome (Tamir)$40,0000.90$44,444Verified
Stinger MANPADS$40,0000.55$72,727Verified
GROVIM kinetic$3,0000.90$3,333Design target
GROVIM electronic warfare$5000.31$1,613Pk verified
GROVIM cyber$1000.50$200Estimate
222×
Cheaper than Iron Dome
cyber, per kill
27.6×
Cheaper than Iron Dome
EW, per kill
20,721×
Cheaper than Patriot
cyber, per kill
Iron Dome is priced at the low end of its verified range — $40,000 against a published $40,000–$100,000 — so any advantage shown here is a floor rather than a best case. GROVIM's own success rates are design targets and estimates; the electronic-warfare figure is the one probability in this table drawn from combat data.

DECISION LATENCY — 200 ITERATIONS PER AIRFRAME

ASTERIX decode
0.016 ms
Fusion ingest
0.033 ms
Classification
0.041 ms
Gate · ROE · planning
0.080 ms
TOTAL
0.178 ms

Worst p95 across airframes: 0.62 ms. Sensor signal processing is excluded — in deployment that runs on the sensor's own hardware.

10Evidence chain

Every decision, reconstructable.

Each command sent, device response and safety verdict becomes a block containing a SHA-256 digest of its fields and the hash of the block before it. Altering one entry invalidates every subsequent link. Engagements can be replayed years later, and a review can establish exactly what the system knew at the moment it decided.

100%
Decisions logged
SHA-256
Hash chain
HMAC
Bundle signature
21
Evidence test files
Device binding
Evidence produced by one device cannot be replayed against another. Cross-device rejection is enforced, not assumed.
Fleet-level audit
The single-unit trail extends to fleet events — E-stops, arbitration outcomes and authority transitions across every airframe.
Structured safety log
Machine-readable, tamper-evident records of every gateway verdict, ready for external audit rather than internal reading.

11Engineering scale

Built to be checked.

A test-to-source ratio of 0.85 across 360 test files. Safety-relevant behaviour carries the heaviest coverage: 103 test files touch the safety plane alone.

6,515
Tests passing
0
Known open issues
132,082
Lines in src
112,530
Lines of tests
AreaTest filesWhat is covered
Safety plane103Gateway, CBF, watchdog, validation, authority states
Domains50Entity models, simulators, per-domain bounds
Hardware abstraction32Adapters, conformance, units, frames, fault injection
Evidence chain21Hash chaining, signatures, replay rejection
Kill chain19End-to-end path, release criteria, ROE, economics
Counter-UAS15Classification, fusion, cascade, counter-counter-UAS
Sensor drivers9ASTERIX decode, DSP, optics, I/Q processing

12Deployment status

Where the system stands today.

A capability claim is only useful alongside its stage of maturity. This is the current position, stated plainly.

OPERATIONAL

Decision & safety layer

Kill chain, release criteria, rules of engagement, cascade selection, cost ledger, fleet coordination, evidence chain. Complete in software and demonstrable end to end.

IN PROGRESS

Hardware integration

All four sensor drivers are implemented and verified against synthesised signals with exact known ground truth. Live radar, SDR, long-focus optics and microphone array are the next milestone, together with RCS calibration against a reference target.

PLANNED

Certification & trials

Hardware safety certification, external evidence signing, independent third-party review, and range trial. Alignment targets include ISO 13849 PL e, IEC 61508 SIL 3 and ISO 26262 ASIL D.

PLANNED

GPS-denied navigation (SLAM)

Today's platform navigates by GPS with an inertial fallback for brief signal loss — sufficient for open terrain, not for sustained autonomy inside tunnels, buildings or other GPS-denied structures. A full SLAM stack (LiDAR or depth-camera based mapping and localisation, obstacle-aware path planning) is architected and scoped: an obstacle-avoiding path planner is already validated in the software simulator, and the full hardware-backed capability is estimated at 7-11 months once sensor hardware is sourced.

Classification today is heuristic. Recognition matches measured signatures against a catalogue of ten airframes across four modalities. It is deterministic and inspectable — every verdict can be traced to the measurement that produced it. Trained models on field-collected signatures follow hardware integration.

The AI proposes. GROVIM disposes.

A deterministic authorisation kernel for autonomous physical systems — eight domains, four modalities, seventeen safety modules, and a cost model that changes the arithmetic of defence.

Request access

13Interactive simulation

Don't read about it. Watch it run.

The GROVIM simulator is a live digital twin of the full counter-UAS engagement pipeline. Threats appear on an ASTERIX-fed radar display. GROVIM classifies each one, walks the cascade from cyber to electronic warfare to kinetic, selects the cheapest method that works, and shows you the cost difference against Iron Dome and Patriot — in real time, with live running totals. Adjust the threat mix. Watch the budget. See what gets denied and why.

Radar
Live detection
ELM-2084 search radar with ASTERIX CAT-048 tracks. Threats enter from the edges; GROVIM sees them the moment they cross the detection ring.
Cascade
Method selection
Cyber → electronic warfare → kinetic. The simulator picks the cheapest method each target is vulnerable to and shows the reject path when a method fails.
Cost
Live ledger
Running total of GROVIM spend versus what Iron Dome would have spent, per engagement. The ratio is the point of the system.
Open simulator

Opens in a new page · no login required · runs in the browser