Where you are. You can command a joint and read back what happened. Before anything runs without your hand on it, you need to know what this machine can do when it is wrong, and what the word “stop” actually buys you.
The reflex that does the wrong thing
Picture your first autonomous run. The policy is loaded, the arm is holding a block over the desk, and your hand is resting on Ctrl+C, because that is where a software person’s hand goes.
The arm starts driving toward somewhere it should not go. You hit Ctrl+C.
Here is what that does. LeRobot catches the interrupt, shuts down cleanly, and a clean shutdown disables torque, because the configuration says to. A servo with torque disabled produces no holding force at all. So the arm does not freeze in place. It goes slack, folds under its own weight, and drops the block, onto whatever is underneath - which in most home setups is a keyboard.
The reflex was not wrong about wanting to stop. It was wrong about what stopping does.
There is a second-order version of this that is worse, and it applies to lerobot-record rather than to a rollout. Its shutdown path finalises the dataset before it disconnects the robot, and finalising can mean encoding video. So Ctrl+C during a recording session does not drop the arm immediately: the arm keeps holding whatever pose it was in, for as long as the encode takes, and then goes limp at a moment you are no longer watching for. Assume the drop is coming and that you do not control when.
The idea in one paragraph
On this arm you never command force. You send angles, and the servo applies whatever torque it takes, which is the position-control contract from Module 0 arriving on your desk. The only force budget you have is a handful of caps written into registers. LeRobot sets three of them on connect and all three apply to the gripper alone, because the gripper is the motor that burns out. The one cap that would protect every other joint, and you, and the desk, ships switched off. So safety here is not about guarding against a crushing injury; a machine this size cannot deliver one. It is about your eyes, your desk, the arm’s own gearboxes, and understanding that you have a stop button and no hold button.
Everything in this lesson about safe practice is the course’s own material. LeRobot’s documentation has no safety section at all, and the hardware repository carries no safety notes beyond a warning about supply voltage. That is not a criticism; it is a gap, and you should know which parts of this you are getting from a manufacturer and which parts you are getting from us.
What this arm can actually hurt
Start with the honest physics. The hardware repository quotes 16.5 kg·cm of stall torque, measured at 6 V, for the 7.4 V-rated motors, and 30 kg·cm for the 12 V variant. Read the “at 6 V” carefully: it is a measurement at a supply voltage, not at the motor’s name, so the figure at whatever your supply actually delivers is somewhere else. Call it 15 to 20 kg·cm, which is roughly 1.5 to 2.0 newton-metres. Divide by the distance from the lifting joint to the gripper and you get the force available at the business end:
About the weight of a full mug of coffee, and that is an upper bound that ignores the arm’s own weight, which eats into the same budget. The quarter of a metre is an order-of-magnitude stand-in rather than a checked specification, so put a tape measure on your own arm before you quote any of this back.
Ranked by how likely each is to actually happen to you:
| What is at risk | How bad | Why |
|---|---|---|
| The arm itself | Very likely | Stripped horns, cracked printed parts, and a burnt-out gripper servo. This is where nearly all the damage lands. |
| The desk | Likely, and expensive | A swinging arm sweeping a mug of water onto an unenclosed control board. The single most probable costly outcome. |
| Your eyes | Unlikely, but serious | A joint can snap through its range quickly, and a held object can be flung. This is the one real injury risk. |
| You, otherwise | Minor | It can pinch and bruise. Under 1 kgf at the gripper will not break anything. It is not an industrial arm and does not need a light curtain. |
The caps that ship set
Wider than the screen; scroll it sideways.
Three limits are written to your motors every time you connect, and all three apply only to motor 6.
| Register | Value | Meaning |
|---|---|---|
Max_Torque_Limit | 500 of 1000 | the gripper may use half of its available torque |
Protection_Current | 250 | half of maximum current |
Overload_Torque | 25 | back down to a quarter when overloaded |
The cap that ships off
Every other joint has no comparable protection, and neither do you. There is one setting that fixes most of it, and its default is None:
--robot.max_relative_target=5This clamps how far any joint may be commanded to move in a single control step. It takes either one number for all motors or a dictionary of per-motor limits, and setting it to null removes it again.
Stop is not hold
Wider than the screen; scroll it sideways.
There is no e-stop on this arm. Nothing in the bill of materials is a big red button, and there is no interlock, no collision detection and no force sensing. Your e-stop is the barrel jack on the follower’s power supply, so keep it loose and within reach of your free hand before every autonomous run.
And then remember what pulling it does.
That single fact reorganises the whole practice:
- Park low. An arm stopped near the table falls a few centimetres. An arm stopped fully extended above the desk falls the whole way.
- Keep a hand ready. Not on the arm, near it. If you cut power while it is holding something over anything you care about, your hand is the only thing that will catch it.
- First rollout: short and clamped. A duration measured in seconds, the motion clamp set, and nothing in the swept volume.
Wider than the screen; scroll it sideways.
Heat is the slow failure
Module 0 established that holding a pose is the expensive case: a stalled motor converts everything it draws into heat because it is doing no mechanical work. On a bench that means a long teleoperation session, where the follower spends most of its time holding the arm up against gravity, warms the motors steadily even though nothing dramatic is happening.
The motors will tell you. Present_Temperature is readable at register 63, and Max_Temperature_Limit at register 13 is the threshold the motor itself will act on. Polling temperature during a session is a five-line script, and it converts an invisible failure mode into a graph.
Without hardware
MuJoCo has the model’s version of the register cap: forcerange on an actuator, and
ctrlrange on what you may command.
- Instead of the registers, clamp
forcerangein the task scene and re-run a grasp. Clamp it far enough and the grasp slips instead of holding. - Measure this: the force at which your grasp starts slipping and the force at which the object visibly deforms. Simulation hands you both numbers directly; on hardware neither is available without a scale and a ruined object.
- What you lose: the consequences. Nothing here can crush a finger, cook a servo or drop an arm when the power goes. This is the one place the simulation path is strictly better and also the one place that makes it a poor rehearsal, because the reflexes this lesson is trying to install are installed by fear.
Check yourself
1. Your arm is holding a block, extended over your keyboard, and it starts to misbehave. You hit Ctrl+C. What happens, and what should you have done differently?
LeRobot disconnects cleanly, and a clean disconnect disables torque. With torque off the servos have no holding force, so the arm collapses under gravity and drops the block on the keyboard. What you should have done differently happened earlier: park the arm low, clear the desk under the swept volume, keep the run short, and have a hand ready to support the forearm rather than only a finger on Ctrl+C.
2. Which torque limits does LeRobot set for you, and what does the pattern tell you?
Three, all on the gripper: a torque limit at half of maximum, a protection current at half of maximum, and an overload torque of a quarter. The pattern says the gripper is the motor that dies. It closes hard against rigid objects, stalls while holding, and cooks its windings. Every other joint has no equivalent protection, which is why the motion clamp matters for the rest of the arm.
3. max_relative_target defaults to None. Describe the failure that default allows, and where the fix belongs.
With no clamp, a single wrong action is executed at full speed: a policy that emits nonsense on an unfamiliar camera frame commands a full-range jump, and the arm gets there before you can react. The clamp turns that into a slow move you can interrupt. It belongs in the hardware layer, outside the policy, for the same reason a rate limiter belongs at the API boundary rather than inside the client asking for the work.
4. Why is a cheap 6-servo arm not a serious injury risk to a person, and what is the exception?
Because the numbers are small. The repository’s 16.5 kg·cm, and the 15 to 20 kg·cm band the sources between them support, over a reach of roughly a quarter of a metre is under one kilogram-force at the gripper, so the worst ordinary outcome is a pinch or a bruise. The exception is your eyes: a joint can move through its range quickly and a gripped object can be flung, and no amount of low torque helps there. Safety glasses on for autonomous runs.
5. A teleoperation session runs for an hour and the shoulder motor is uncomfortably hot, though the arm barely moved. Explain, and say what you would monitor.
Holding a pose is a stall: real torque, zero speed, so no mechanical work leaves the motor and the electrical power all becomes heat in the windings. An arm held up against gravity is at full duty cycle while appearing idle. Poll Present_Temperature at register 63 during the session and plot it, and give the arm a resting pose that is mechanically supported, or power it down, during breaks.
6. Which claims in this lesson would you personally verify before trusting them, and how?
The stall torque, because the sources disagree and the one published figure was taken at a voltage nobody runs; measure it with a kitchen scale on your own arm. A sensible value for max_relative_target, because nobody has tuned it on hardware - the units are read off the source and are solid, the number 5 is a guess. And the drop behaviour on power loss, because it is derived from a configuration default plus physics rather than from a manufacturer’s statement; test it deliberately, low down and over something soft.
Do this
About an hour. Two of these produce numbers that belong in your notes.
1. Do the drop test on purpose. Park the arm low over a folded towel, holding nothing, with the desk clear. Run any script that connects, then press Ctrl+C and watch. Repeat with the power plug instead of Ctrl+C. Write down what your arm actually does: how far it sags, whether it drops or settles, which joints give first. That behaviour is now something you know rather than something you were told.
2. Measure your own arm’s force. Put a kitchen scale on the desk under the gripper, with the arm positioned just above it and the elbow roughly horizontal. Command the lifting joint a few degrees past contact, hold for no more than three seconds, then return. Read the peak.
Convert: force in newtons is grams divided by 1000, times 9.81. Torque is that force times the horizontal distance from the joint axis to the contact point. Compare with the 1.6 N·m the repository’s 16.5 kg·cm implies, remembering that its figure was taken at 6 V.
Rules for this one: glasses on, fingers clear, three seconds maximum, never with the gripper motor, and stop immediately if any LED starts blinking. A blinking LED means you found the overload limit, which is useful information but not somewhere to linger.
3. Feel the clamp. Run the previous lesson’s script with a deliberately large step, twice:
python code/first_motion.py --port /dev/ttyACM0 --id kp_follower \
--joint shoulder_pan --delta 40
python code/first_motion.py --port /dev/ttyACM0 --id kp_follower \
--joint shoulder_pan --delta 40 --max-relative-target 5Watch both. The difference between them is the difference between a policy mistake you can interrupt and one you cannot. Note what value feels right on your hardware, since the number in this lesson is a starting guess.
4. Watch it warm up. Hold a demanding pose, arm out horizontally, and log temperature for ten minutes:
python code/torque_watch.py --port /dev/ttyACM0 --id kp_follower \
--seconds 600 --out warmup.csv
python code/torque_watch.py --plot warmup.csvWhich motor climbs fastest, how far does it get, and does it level off? That plateau, if you find one, is your safe continuous-duty envelope.
5. Write the card. Six lines on an index card, taped where you can see it from the keyboard: desk clear, plug loose and in reach, glasses on, clamp set, duration short, arm parked low. You will run this checklist a hundred times over the next few weeks, and the version on the card is the one you will actually follow.
What you can now do
You can say what your arm can and cannot damage, and back the claim with a number you measured rather than one you read. You can name the three caps LeRobot sets for you and the one it leaves off, set the motion clamp before an autonomous run, and explain why the limiter belongs outside the policy. And you can plan a stop properly, knowing that on this machine cutting power is a command to fall.