Industrial operations have a property the other domains this company builds for do not: the output moves. A plan that assigns two robots to the same lift, schedules a cell that is down for maintenance, or sends a fleet to charge in the same fifteen minutes does not produce an error message. It produces a robot waiting in an aisle, a line starved of parts, or a demand peak on next month’s bill. The software is therefore written to refuse a plan at planning time, while there is still a person able to change it.
The robots themselves are already well served. Every serious manufacturer ships a controller, a safety system and usually a fleet manager, and those are validated for the job of moving a machine safely. What a plant with three vendors does not have is anything above them: one view of the whole fleet, one allocator that can hand work across vendor boundaries, and one schedule that knows about robots, people, material and power at the same time. That gap is where this line sits, and it deliberately sits nowhere else.
So the architecture draws one hard line and builds everything around it. Below the line are motion, interlocks, emergency stops and safety-rated monitoring — owned by validated control systems, never commanded from here. Above it are tasks, zones, schedules, orders, maintenance and energy — planned here, released by a named person, and dispatched through each vendor’s own interface, which remains free to refuse. A refusal is a fact the planner records and works around, never an obstacle it retries past.
Swarm coordination is where that discipline matters most. Distributed allocation, shared-resource scheduling and replanning when a robot drops out are genuinely hard problems, and the tempting failure is a clever algorithm nobody can audit. Here allocation is deterministic for the same state, every assignment carries the reason it was made, and every new behaviour is simulated against your own layout before it reaches the floor.
None of that makes a plant run itself. It makes the plan reviewable and the floor predictable, which is the property software can actually give an operation this physical. The safety case stays with the systems — and the people — who are qualified to own it.