Safety: the rating, the badge and the Benchmarking Engine
Every robot, component or software product a builder lists on the matchmaker can carry a rating from the Dunster Physical AI Benchmarking Engine, the math behind the free Physical AI Safety Rating at dunster.ai/safety. The engine asks 36 questions in 8 parts, each citing a clause of the Dunster Physical AI Safety Principles, and returns a score out of 1,000, a risk tier from A to D and the score by part. The questions, their weights and the tier thresholds live inside the engine and apply to every builder the same way, Dunster included; the matchmaker never recomputes a score.
A rating is indicative only. It is not a certification, an insurance quote or an offer of cover.
How a rating gets onto a profile
- In the dashboard, a builder opens a product and clicks Rate with the Benchmarking Engine (while the link-up with the engine is being switched on, the product page links to the engine instead). The portal passes the product's name, robot class and autonomy level along so the engine can fill them in.
- The builder answers the 36 questions on the engine, for the product as it ships today.
- The engine sends the result back to the matchmaker itself, signed: score, tier, score by part and the engine's reference. Nothing to copy. The rating appears on the product as self-assessed. While the return channel is being switched on, Dunster attaches the result from the engine's records instead; the builder still copies nothing.
- The builder attaches evidence for the answers that matter for the robot class: a risk assessment, a test report, a guardrail record (the format in Annex B of the Principles), a video of the stop test.
- Dunster opens every item and, when it supports the answers, upgrades the badge to assessed, evidence-backed. If something is missing, Dunster asks.
Three states a product can be in
| Label | What it means | How it is shown |
|---|---|---|
| Not yet assessed by the Dunster Physical AI Benchmarking Engine | No rating has landed on this product. Publishing is still allowed. | Plain label |
| Self-assessed | The engine delivered a rating for this product. | Badge with score, tier and score by part |
| Assessed, evidence-backed | Dunster checked the evidence behind the answers. | Exclusive badge; listed first in shortlists and the builder index |
The badge is the only ordering on the platform and it is never for sale. A builder can hide the badge from the public profile at any time; the rating stays on record for three years. Rating data is not shared with insurers in this release.
What the engine looks at
The 36 questions sit in eight parts:
- Governance and conformance
- People and robot as a team
- Command, stop and emergencies
- Operating envelope and autonomy
- Physical contact limits
- Objects and surroundings
- Hardware, software and security
- Lifecycle and evidence
Twenty-nine of the questions climb a four-step evidence ladder: not in place; partly in place; in place and documented; verified by test or outside review. A safeguard verified by test or outside review counts for more than one that is only documented, which is where the evidence a builder attaches here earns its keep.
Risk tiers
| Tier | Name |
|---|---|
| A | Preferred |
| B | Standard |
| C | Conditional |
| D | Refer |
The engine sets the tier. The points that separate the tiers, and what each tier asks of a deployment, are part of the method Dunster keeps inside the engine and are not published; the matchmaker shows the tier as the engine names it and adds no reading of its own.
Robot classes and autonomy levels
The Safety Principles (Article 3.3) describe three robot classes by how close people are: separated (guarding keeps people out), shared (people within reach, no contact as part of the task) and contact (touching people is part of the task). Each use case says which class its site needs, and each product and capability card says which class it is built for.
Autonomy (Article 3.4) runs from A0, manual, where a person controls every motion, through A1 assisted and A2 attended, with an operator in the room, to A3 unattended inside a set envelope. A4, site-wide autonomy, is not permitted in this version of the Principles. A hazard-work robot driven from a safe room is A0 in a separated setting; a pharmacy robot beside technicians starts at A2 in a shared setting.
What end users get from it
A shortlist that puts checked products first, a tier they can read in a second, the score by part that shows where the evidence is thin, and a shared vocabulary with the builder about what the pilot has to prove. The badge does not replace a site risk assessment; it tells you who has done their homework.