Why we limit force in the joint
A short argument for treating safety as a property of the hardware, not a mode you trust software to maintain.
Most robots are safe as long as the software is perfect. We don't think that's good enough for a machine meant to share a room with people. Software will have bugs; a safe robot should stay safe anyway.
So we limit force where it physically originates — in the joint. Compliant, back-drivable actuators and redundant torque sensing mean Juno yields on unexpected contact as a matter of physics, not policy. Safety isn't a mode you switch on; it's the way the hardware is built.
This constrains our engineering, and we like that. It forces us to earn capability within a safety envelope, instead of bolting safety on afterward and hoping it holds.