Glossary

This page is for version 1.4.0 (Latest) (default). For other versions, use one of these documentation indexes: - 1.4.0 (Latest) (default): https://docs.nvidia.com/halos/outside-in-safety/1.4.0/llms.txt

/run/nvpsf

The directory that holds the sockets every Safety Core link uses: nvpssd (client registration and reports), nvpssd_to_psd (SEI daemon to NvPSD Gateway) and nvpsd_gateway (NvPSD Gateway to the SDMs and fsicom-agent). Mode 1777. When a Safety Core process on the host connects to processes in the container, the host directory is bind-mounted into the container.

ATL

Automated Trailer Loading. The reference application that controls a forklift’s safety function during trailer loading. Its decision maker is atl_sdm.

BEV

Bird’s-eye view. In a 3D deployment, VSS calibrates several cameras into one BEV group and reports events under the group’s name instead of a camera’s. See Sensor group.

Cause

A one-byte value (EventCause, 0–18) carried by every Safety Core event, saying why it was sent, for example 4 for a lost camera stream or 15 for a lost Safety AI Monitor. Logs print it as a number. See Causes and records.

CCPLEX

CPU Complex. The main CPU subsystem on NVIDIA Tegra SoCs, where the Safety Core user-space processes run.

Command receiver

The endpoint that receives the SDM’s 64-byte UDP command packets and acknowledges them. In a real deployment this is the PLC; the reference receivers are atl_sdm_cmd_receiver, proximity_sdm_cmd_receiver and atl_proximity_sdm_cmd_receiver. It also sends the safe-release request.

DecisionRequest

The message the SEI daemon sends towards the SDMs. It carries up to 8 events, the SEI mode (NORMAL, DEGRADED or ERROR) and a request id. A periodic PSS_STATUS_NOOP request carries the presence report even when no events flow.

DecisionRequest envelope

The header the NvPSD Gateway puts in front of each DecisionRequest it sends to an SDM: the magic DRPG, a version, the gateway’s epoch for that SDM, and a per-SDM transmit sequence number. The SDM checks the sequence and latches on a gap.

DecisionResponse

The message the NvPSD Gateway returns to the SEI daemon to acknowledge a DecisionRequest.

Deployment mode

The deploymentMode key in nvpss.conf: 2D (each camera reports its own events) or 3D (events arrive under a BEV group). It decides which identity files the MDX client and the SDMs use. See Sensor files.

DVM

Data Validation Monitor. The part of PCM that checks the mdx-frames data: that each frame comes from a known camera, is fresh, and carries valid decision data for the configured SDMs, and that each camera keeps its frame rate. In LEARN mode it records the baseline, pcm_baseline.cfg, that it checks against in ACTIVE mode. See Perception Container Monitor (PCM).

Event fusion

The SEI daemon’s correlation of detections of the same object from several cameras into one event, by time, position and attributes. Enabled with enableFusion = true; always off in 3D.

Fault-safe lockout latch

The SDM’s safe-state latch. When any latch cause becomes active, the SDM commands the safe state and keeps commanding it. Clearing the cause does not release the latch; only a validated safe-release request from the command receiver does, and it is denied while any cause is active. Also called the safe-state latch.

FSI

Functional Safety Island. A hardware-isolated processor on NVIDIA IGX Thor that can run the SDM.

fsicom-agent

The CCPLEX process that connects an SDM running on the FSI to the NvPSD Gateway, and relays the FSI SDM’s commands to the command receiver over UDP. Shipped in the psf-tegra-fsi package.

FusedSafetyEvent

An event as the SEI daemon delivers it to the SDMs, with a status: FUSED, PASSTHROUGH, STALE or UNKNOWN. SDMs drop STALE events.

HBPG, HBPC

The NvPSD Gateway’s heartbeat to an SDM (HBPG) and the SDM’s reply (HBPC).

HIL

Hardware-in-the-Loop. A testing method that runs perception and the Safety Core on the target hardware while NVIDIA Isaac Sim supplies the sensor input from a separate host.

HOISA

The NVIDIA Halos Outside-In Safety Blueprint, abbreviated. The blueprint extends robot perception beyond on-board sensors by using external infrastructure cameras and AI agents to control robot behaviour. Formerly PSF (Proactive Safety Framework).

L4T

Linux for Tegra. NVIDIA’s Linux distribution for Tegra-based platforms such as IGX Thor.

mdx_client

The MDX client. It consumes the VSS Kafka topics mdx-events and mdx-frames, turns matching messages into events using the event mapping, and reports them to the SEI daemon. The launchers run one, as instance 1. See Event Mapping Configuration.

MDX

Metropolis Data eXchange. The Kafka topic family (mdx-events, mdx-frames) on which VSS publishes perception output.

NGC

NVIDIA GPU Cloud. The registry from which the Safety Core Debian packages and container image are downloaded.

NVDEC

NVIDIA Video Decoder. The hardware decoder SAIM uses to decode camera streams.

nv_perception_monitor

The Perception Container Monitor (PCM) binary.

nvFsiCom

The platform daemon that owns FSI communication. It is not part of the Safety Core, but fsicom-agent cannot work without it.

NvPSD Gateway

The component between the SEI daemon and the SDMs; its binary is nvpsd_gateway. It takes each DecisionRequest from the SEI daemon, sends every registered SDM the events it subscribed to inside a sequenced envelope, supervises each SDM with heartbeats, and turns faults on its link to the SEI daemon into SW_FAIL events for every SDM. It accepts up to 10 SDMs, all on the local socket /run/nvpsf/nvpsd_gateway.

nvpss_daemon

The SEI daemon. It reads nvpss.conf. See SEI Configuration.

PCM

Perception Container Monitor. It checks the perception containers through the Docker Engine and the mdx-frames data through its DVM, and reports AI_PIPELINE_VALID or AI_PIPELINE_INVALID for the whole perception pipeline. A setup problem turns a check off and is never reported as AI_PIPELINE_INVALID. Every SDM latches on AI_PIPELINE_INVALID. Its binary is nv_perception_monitor. See Perception Container Monitor (PCM).

Peer check

Every Safety Core socket accepts a connection only if the peer’s primary group id equals its own, and the SDMs, fsicom-agent and the NvPSD Gateway also check the server they connect to. A process with a different primary group is refused. Every Safety Core process must therefore run with one primary group. See Shared process group.

pipelineId

The number, 1 to 8, that identifies a camera or a BEV group on every event. pipelineId 0 is reserved for events that name no sensor.

PLC

Programmable Logic Controller. The external controller that receives the SDM’s commands and acts on the machine. SDM log messages use “PLC” for the command receiver.

Presence report

The cause-16 status request the SEI daemon sends every status_noop_interval_ms, listing which safety sources (SAIM, PCM, MDX client instances) are present and which are expected. An SDM raises a lost-source cause when a source it knows of is missing from it.

PSB, PSD, PSF, PSS, PSU

Former names of SBB, the SDM, the blueprint, SEI and SUI. They survive in binary, package, path and log-record names, for example nvpss_daemon, nvpsd_gateway, psf-desktop, /opt/nvidia/psf, /var/log/psf and PSS_TO_PSD_DELIVERY_FAILURE.

psf-desktop, psf-tegra, psf-tegra-fsi

The Debian packages: x86-64 binaries (psf-desktop), aarch64 binaries (psf-tegra), and the FSI firmware with fsicom-agent (psf-tegra-fsi). Matching -dev packages carry headers.

PSSCom

An NVIDIA communication library for packet streaming between source and sink endpoints within the Safety Core.

PVA

Programmable Vision Accelerator. SAIM’s frame analysis runs on it on aarch64; on x86-64 SAIM uses the GPU.

REGR

The registration message an SDM (or fsicom-agent) sends the NvPSD Gateway, listing the event types it wants. It is re-sent every 30 s. The gateway accepts at most 4 per connection in 10 s by default.

Required source

A safety source that nvpss.conf declares the deployment must run: SAIM (required_safety_monitor), PCM (required_perception_monitor) and MDX client instances (required_mdx_instances). A required source that never registers is reported lost, and every SDM latches.

Reviewed sensor set

The sensors listed in sensor_pipelines_config.conf. A CCPLEX SDM raises its all-safety-relevant-sensors-failed latch when every sensor in the set has failed. In 3D the set is the BEV group. See Sensor files.

RGNK

The NvPSD Gateway’s reply to a refused REGR, with a reason: malformed, no_valid_event_types, table_full or rate_limited.

ROI

Region of interest. A zone in the camera view used to detect objects entering, leaving or being inside it.

SAIM

Safety AI Monitor. It decodes each camera stream, compares it against a learned baseline, and reports SENSOR_VALID or SENSOR_INVALID for each camera. Its binary is safety_monitor.

Safe release

The command receiver’s CMD_SAFE_RELEASE_REQUEST (0x08). The SDM answers with CMD_SAFE_RELEASE_ACK (0x09) and leaves the safe state, or with CMD_SAFE_RELEASE_DENIED (0x0A) while a latch cause is still active.

safety_monitor

The SAIM binary. Runs in LEARN mode to capture per-camera baselines and in ACTIVE mode to issue verdicts.

Safety Core

The Safety Core stack: the SEI daemon, the NvPSD Gateway, the SDMs, the MDX client, SAIM, PCM and SBB.

SafetyEvent

The event a client reports to the SEI daemon: type, cause, timestamp, confidence, pipelineId, sensor name and object data.

SBB

Safety Black Box. The audit-logging library through which the SEI daemon, the NvPSD Gateway and the MDX client write their records to syslog. Formerly PSB.

SDM

Safety Decision Maker. It turns events into commands for the machine and owns the safe-state latch. The reference SDMs are atl_sdm, proximity_sdm and atl_proximity_sdm on the CCPLEX, and an ATL and a Proximity SDM on the FSI. Formerly PSD.

SEI

Safety Event Integrator. It receives events and trust reports, checks them against the sensor configuration, fuses them, tracks which safety sources are present, and sends DecisionRequest messages to the NvPSD Gateway. Its daemon is nvpss_daemon, configured by nvpss.conf. Formerly PSS.

SEI mode

The state the SEI daemon reports on every DecisionRequest: NORMAL, DEGRADED or ERROR. The NvPSD Gateway turns ERROR into a SW_FAIL for every SDM.

Sensor group

In 3D, the BEV group: one pipelineId and name standing for several cameras, defined in the file named by sensorGroupConfig. The SEI daemon derives its trust from its member cameras. See Sensor files.

SIL

Software-in-the-Loop. A testing method that runs the full stack against virtual sensor input from NVIDIA Isaac Sim.

SIPP

Sensor Input Processing Pipeline. The AI perception that processes camera streams to detect safety-relevant events.

SRR

The short name of the Regression Testing Reporter, which scores a closed-loop run against NVIDIA Isaac Sim ground truth. It is kept from the tool’s original name, Scenario Recorder + Reporter.

SUI

Safety User Interface. Formerly PSU.

SW_FAIL

Software failure: an event saying the safety path itself has a fault. It always carries a cause, and every SW_FAIL latches every SDM that receives it.

Tripwire

A virtual line in the camera view that produces a directional crossing event when an object crosses it.

VSS

NVIDIA Metropolis Blueprint for video search and summarization. Its Warehouse Operations blueprint provides the reference perception.

VST

Video Storage Toolkit. The VSS component that ingests and re-streams camera feeds. SAIM reads its RTSP streams, and the reference command receivers can relay command packets to it for on-screen display.