> This page is for version 1.4.0 (Latest) (default).
> For other versions, use one of these documentation indexes:
> - 1.4.0 (Latest) (default): https://docs.nvidia.com/halos/outside-in-safety/1.4.0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/halos/outside-in-safety/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/halos/outside-in-safety/_mcp/server.

# Glossary

> Terms, component names and abbreviations used in the Halos Outside-In Safety documentation.

**`/run/nvpsf`**

The directory that holds the sockets every Safety Core link uses: `nvpssd` (client registration and
reports), `nvpssd_to_psd` (SEI daemon to NvPSD Gateway) and `nvpsd_gateway` (NvPSD Gateway to the
SDMs and `fsicom-agent`). Mode 1777. When a Safety Core process on the host connects to processes
in the container, the host directory is bind-mounted into the container.

**ATL**

Automated Trailer Loading. The reference application that controls a forklift's safety function
during trailer loading. Its decision maker is `atl_sdm`.

**BEV**

Bird's-eye view. In a 3D deployment, VSS calibrates several cameras into one BEV group and reports
events under the group's name instead of a camera's. See **Sensor group**.

**Cause**

A one-byte value (`EventCause`, 0–18) carried by every Safety Core event, saying why it was sent,
for example `4` for a lost camera stream or `15` for a lost Safety AI Monitor. Logs print it as a
number. See [Causes and records](/halos/outside-in-safety/reference/causes-and-records).

**CCPLEX**

CPU Complex. The main CPU subsystem on NVIDIA Tegra SoCs, where the Safety Core user-space
processes run.

**Command receiver**

The endpoint that receives the SDM's 64-byte UDP command packets and acknowledges them. In a real
deployment this is the PLC; the reference receivers are `atl_sdm_cmd_receiver`,
`proximity_sdm_cmd_receiver` and `atl_proximity_sdm_cmd_receiver`. It also sends the safe-release
request.

**DecisionRequest**

The message the SEI daemon sends towards the SDMs. It carries up to 8 events, the SEI mode
(`NORMAL`, `DEGRADED` or `ERROR`) and a request id. A periodic `PSS_STATUS_NOOP` request carries the
presence report even when no events flow.

**DecisionRequest envelope**

The header the NvPSD Gateway puts in front of each `DecisionRequest` it sends to an SDM: the magic
`DRPG`, a version, the gateway's epoch for that SDM, and a per-SDM transmit sequence number. The
SDM checks the sequence and latches on a gap.

**DecisionResponse**

The message the NvPSD Gateway returns to the SEI daemon to acknowledge a `DecisionRequest`.

**Deployment mode**

The `deploymentMode` key in `nvpss.conf`: `2D` (each camera reports its own events) or `3D` (events
arrive under a BEV group). It decides which identity files the MDX client and the SDMs use. See
[Sensor files](/halos/outside-in-safety/reference/sensor-files).

**DVM**

Data Validation Monitor. The part of PCM that checks the `mdx-frames` data: that each frame comes
from a known camera, is fresh, and carries valid decision data for the configured SDMs, and that
each camera keeps its frame rate. In LEARN mode it records the baseline, `pcm_baseline.cfg`, that
it checks against in ACTIVE mode. See
[Perception Container Monitor (PCM)](/halos/outside-in-safety/integration/components/perception-monitor).

**Event fusion**

The SEI daemon's correlation of detections of the same object from several cameras into one event,
by time, position and attributes. Enabled with `enableFusion = true`; always off in 3D.

**Fault-safe lockout latch**

The SDM's safe-state latch. When any latch cause becomes active, the SDM commands the safe state
and keeps commanding it. Clearing the cause does not release the latch; only a validated
safe-release request from the command receiver does, and it is denied while any cause is active.
Also called the safe-state latch.

**FSI**

Functional Safety Island. A hardware-isolated processor on NVIDIA IGX Thor that can run the SDM.

**fsicom-agent**

The CCPLEX process that connects an SDM running on the FSI to the NvPSD Gateway, and relays the FSI
SDM's commands to the command receiver over UDP. Shipped in the `psf-tegra-fsi` package.

**FusedSafetyEvent**

An event as the SEI daemon delivers it to the SDMs, with a status: `FUSED`, `PASSTHROUGH`, `STALE`
or `UNKNOWN`. SDMs drop `STALE` events.

**HBPG, HBPC**

The NvPSD Gateway's heartbeat to an SDM (`HBPG`) and the SDM's reply (`HBPC`).

**HIL**

Hardware-in-the-Loop. A testing method that runs perception and the Safety Core on the target
hardware while NVIDIA Isaac Sim supplies the sensor input from a separate host.

**HOISA**

The NVIDIA Halos Outside-In Safety Blueprint, abbreviated. The blueprint extends robot perception
beyond on-board sensors by using external infrastructure cameras and AI agents to control robot
behaviour. Formerly PSF (Proactive Safety Framework).

**L4T**

Linux for Tegra. NVIDIA's Linux distribution for Tegra-based platforms such as IGX Thor.

**mdx_client**

The MDX client. It consumes the VSS Kafka topics `mdx-events` and `mdx-frames`, turns matching
messages into events using the event mapping, and reports them to the SEI daemon. The launchers run
one, as instance 1. See [Event Mapping Configuration](/halos/outside-in-safety/reference/event-mapping-configuration).

**MDX**

Metropolis Data eXchange. The Kafka topic family (`mdx-events`, `mdx-frames`) on which VSS publishes
perception output.

**NGC**

NVIDIA GPU Cloud. The registry from which the Safety Core Debian packages and container image are
downloaded.

**NVDEC**

NVIDIA Video Decoder. The hardware decoder SAIM uses to decode camera streams.

**nv_perception_monitor**

The Perception Container Monitor (PCM) binary.

**nvFsiCom**

The platform daemon that owns FSI communication. It is not part of the Safety Core, but
`fsicom-agent` cannot work without it.

**NvPSD Gateway**

The component between the SEI daemon and the SDMs; its binary is `nvpsd_gateway`. It takes each
`DecisionRequest` from the SEI daemon, sends every registered SDM the events it subscribed to
inside a sequenced envelope, supervises each SDM with heartbeats, and turns faults on its link to
the SEI daemon into `SW_FAIL` events for every SDM. It accepts up to 10 SDMs, all on the local
socket `/run/nvpsf/nvpsd_gateway`.

**nvpss_daemon**

The SEI daemon. It reads `nvpss.conf`. See [SEI Configuration](/halos/outside-in-safety/reference/sei-configuration).

**PCM**

Perception Container Monitor. It checks the perception containers through the Docker Engine and
the `mdx-frames` data through its DVM, and reports `AI_PIPELINE_VALID` or `AI_PIPELINE_INVALID` for
the whole perception pipeline. A setup problem turns a check off and is never reported as
`AI_PIPELINE_INVALID`. Every SDM latches on `AI_PIPELINE_INVALID`. Its binary is
`nv_perception_monitor`. See
[Perception Container Monitor (PCM)](/halos/outside-in-safety/integration/components/perception-monitor).

**Peer check**

Every Safety Core socket accepts a connection only if the peer's primary group id equals its own,
and the SDMs, `fsicom-agent` and the NvPSD Gateway also check the server they connect to. A process
with a different primary group is refused. Every Safety Core process must therefore run with one
primary group. See [Shared process group](/halos/outside-in-safety/integration#shared-process-group).

**pipelineId**

The number, 1 to 8, that identifies a camera or a BEV group on every event. `pipelineId` 0 is
reserved for events that name no sensor.

**PLC**

Programmable Logic Controller. The external controller that receives the SDM's commands and acts on
the machine. SDM log messages use "PLC" for the command receiver.

**Presence report**

The cause-16 status request the SEI daemon sends every `status_noop_interval_ms`, listing which
safety sources (SAIM, PCM, MDX client instances) are present and which are expected. An SDM raises a
lost-source cause when a source it knows of is missing from it.

**PSB, PSD, PSF, PSS, PSU**

Former names of SBB, the SDM, the blueprint, SEI and SUI. They survive in binary, package, path and
log-record names, for example `nvpss_daemon`, `nvpsd_gateway`, `psf-desktop`, `/opt/nvidia/psf`,
`/var/log/psf` and `PSS_TO_PSD_DELIVERY_FAILURE`.

**psf-desktop, psf-tegra, psf-tegra-fsi**

The Debian packages: x86-64 binaries (`psf-desktop`), aarch64 binaries (`psf-tegra`), and the FSI
firmware with `fsicom-agent` (`psf-tegra-fsi`). Matching `-dev` packages carry headers.

**PSSCom**

An NVIDIA communication library for packet streaming between source and sink endpoints within the
Safety Core.

**PVA**

Programmable Vision Accelerator. SAIM's frame analysis runs on it on aarch64; on x86-64 SAIM uses
the GPU.

**REGR**

The registration message an SDM (or `fsicom-agent`) sends the NvPSD Gateway, listing the event types
it wants. It is re-sent every 30 s. The gateway accepts at most 4 per connection in 10 s by default.

**Required source**

A safety source that `nvpss.conf` declares the deployment must run: SAIM
(`required_safety_monitor`), PCM (`required_perception_monitor`) and MDX client instances
(`required_mdx_instances`). A required source that never registers is reported lost, and every SDM
latches.

**Reviewed sensor set**

The sensors listed in `sensor_pipelines_config.conf`. A CCPLEX SDM raises its
all-safety-relevant-sensors-failed latch when every sensor in the set has failed. In 3D the set is
the BEV group. See [Sensor files](/halos/outside-in-safety/reference/sensor-files#sensor_pipelines_config).

**RGNK**

The NvPSD Gateway's reply to a refused `REGR`, with a reason: `malformed`, `no_valid_event_types`,
`table_full` or `rate_limited`.

**ROI**

Region of interest. A zone in the camera view used to detect objects entering, leaving or being
inside it.

**SAIM**

Safety AI Monitor. It decodes each camera stream, compares it against a learned baseline, and
reports `SENSOR_VALID` or `SENSOR_INVALID` for each camera. Its binary is `safety_monitor`.

**Safe release**

The command receiver's `CMD_SAFE_RELEASE_REQUEST` (`0x08`). The SDM answers with
`CMD_SAFE_RELEASE_ACK` (`0x09`) and leaves the safe state, or with `CMD_SAFE_RELEASE_DENIED`
(`0x0A`) while a latch cause is still active.

**safety_monitor**

The SAIM binary. Runs in `LEARN` mode to capture per-camera baselines and in `ACTIVE` mode to issue
verdicts.

**Safety Core**

The Safety Core stack: the SEI daemon, the NvPSD Gateway, the SDMs, the MDX client, SAIM, PCM and
SBB.

**SafetyEvent**

The event a client reports to the SEI daemon: type, cause, timestamp, confidence, `pipelineId`,
sensor name and object data.

**SBB**

Safety Black Box. The audit-logging library through which the SEI daemon, the NvPSD Gateway and the
MDX client write their records to syslog. Formerly PSB.

**SDM**

Safety Decision Maker. It turns events into commands for the machine and owns the safe-state latch.
The reference SDMs are `atl_sdm`, `proximity_sdm` and `atl_proximity_sdm` on the CCPLEX, and an ATL
and a Proximity SDM on the FSI. Formerly PSD.

**SEI**

Safety Event Integrator. It receives events and trust reports, checks them against the sensor
configuration, fuses them, tracks which safety sources are present, and sends `DecisionRequest`
messages to the NvPSD Gateway. Its daemon is `nvpss_daemon`, configured by `nvpss.conf`. Formerly
PSS.

**SEI mode**

The state the SEI daemon reports on every `DecisionRequest`: `NORMAL`, `DEGRADED` or `ERROR`. The
NvPSD Gateway turns `ERROR` into a `SW_FAIL` for every SDM.

**Sensor group**

In 3D, the BEV group: one `pipelineId` and name standing for several cameras, defined in the file
named by `sensorGroupConfig`. The SEI daemon derives its trust from its member cameras. See
[Sensor files](/halos/outside-in-safety/reference/sensor-files#sensor-group-file).

**SIL**

Software-in-the-Loop. A testing method that runs the full stack against virtual sensor input from
NVIDIA Isaac Sim.

**SIPP**

Sensor Input Processing Pipeline. The AI perception that processes camera streams to detect
safety-relevant events.

**SRR**

The short name of the Regression Testing Reporter, which scores a closed-loop run against NVIDIA
Isaac Sim ground truth. It is kept from the tool's original name, Scenario Recorder + Reporter.

**SUI**

Safety User Interface. Formerly PSU.

**SW_FAIL**

Software failure: an event saying the safety path itself has a fault. It always carries a cause,
and every `SW_FAIL` latches every SDM that receives it.

**Tripwire**

A virtual line in the camera view that produces a directional crossing event when an object
crosses it.

**VSS**

NVIDIA Metropolis Blueprint for video search and summarization. Its Warehouse Operations blueprint
provides the reference perception.

**VST**

Video Storage Toolkit. The VSS component that ingests and re-streams camera feeds. SAIM reads its
RTSP streams, and the reference command receivers can relay command packets to it for on-screen
display.