Fleet safety — why 1 robot is not 1,000 robots

The mental model most people have for robot safety looks like this: a sensor fails, the safety function activates, the robot stops. It's a single-robot model. Predictable. Testable. Certifiable under IEC 61508 or ISO 13849.

The problem is that nobody deploys single robots. Amazon crossed one million warehouse robots in mid-2025 and built DeepFleet — a generative AI foundation model — specifically to coordinate fleet movement at scale. Locus Robotics has passed one billion picks. Geek+ operates fleets of thousands. The scale is here.

And at fleet scale, failure modes emerge that don't exist at the individual level.

The most dangerous is the shared-update failure. When 1,000 robots run the same software and receive the same update, a single bug affects every robot simultaneously. This is not a cascade — where one robot's failure triggers the next. It's a correlated failure: every robot makes the same wrong decision at the same time because they all received the same flawed instruction. The blast radius of a bad update is the entire fleet.

Amazon's own DeepFleet research paper, published on arXiv in August 2025, documents the coordination challenge in detail. DeepFleet is a suite of four foundation model architectures — trained on approximately 5 million robot-hours of fleet movement data — designed specifically to solve multi-agent coordination at warehouse scale. The paper describes a critical "safety-and-correctness bridge": when a model predicts a robot's next action, the system checks whether the required physical vertices are reserved. If they're already claimed by another robot, the action is overridden with a wait command. This vertex reservation mechanism is what prevents collisions at the fleet level — and it operates outside the AI model's decision loop. Without it, fleet coordination is inherently unsafe.

Amazon's Blue Jay robot, introduced in October 2025, was cancelled by February 2026 — the fastest-developed and fastest-discontinued warehouse robot in Amazon's history. The cancellation underscored the gap between AI's rapid progress in software and its slower translation into reliable physical operation at fleet scale.

What fleet safety must add beyond single-robot safety: population-level monitoring that tracks whether the fleet's aggregate behavior matches expectations, not just whether each individual robot is operating within parameters. Blast-radius limits that prevent a single update from affecting more than a defined percentage of the fleet simultaneously. Canary deployments that test changes on 5% of robots before fleet-wide rollout. And rollback capability that can revert cohorts of robots to a known-safe state without human intervention.

IEC 61508 was designed for single safety-related systems. ISO 13849 covers individual machines. No existing standard addresses fleet-level coordinated failure modes. The industry underinvestment here is obvious. The answers aren't.