Why the device trusts no one

UPAN is built to be driven by words: from your phone, from a PC, or by an AI agent. That makes one question more important than any feature: what stops a wrong program from crashing the carriage into the end of the rail?

AI around the device, not inside it

The agent runs on your computer and talks to the device through upan-mcp. It writes a program: a fixed list of moves, waits and outputs. The device runs only programs like that. It does not interpret sentences and does not ask a server what to do.

The checks live where the steps are made

Travel, speed, acceleration, motor current and limit switches are checked by the motion MCU, the same chip that makes the steps. Not by the agent, not by the app, not by the network module, and not by us.

A program is checked twice:

• When it is loaded, the device checks its structure and every move against the current limits.
• When it is started, it checks everything again, because the limits might have changed in between.

A program that breaks a limit does not start. The answer names the instruction that broke it, so the agent can fix exactly that line.

You can try this on the home page: ask for 1500 mm on a 1200 mm axis and watch the device refuse before the first step.

Limits change only with a hand on the device

The working limits can be changed over the API. The machine limits, the ones that protect the mechanics, change only over USB while the presence button on the device is pressed. A remote agent cannot reach them.

Local first

The API runs on the device itself, in your network. Moving an axis needs no account, no internet and no server of ours. If Wi-Fi drops, a loaded program runs to its end, and jogging stops by itself after a short timeout.

And the stop input

The hardware stop input cuts the driver without asking the firmware. It is not a safety-rated emergency stop; that is a function of the whole machine, built with a safety relay and a contactor. We say so plainly in the documentation.