Argument A1.2.2.3.3.4.4.3.2.1.2.2 Runtime Monitors and a WDT are implemented

• Supports Argument: A1.2.2.3.3.4.4.3.2.1.2 The architecture and algorithms have been designed such that the hazard is mitigated

Child nodes:

• Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.2.4 Environmental monitor Diverse and independent monitors have been designed to use data from the input domain (sensors) to constrain the robot's capabilities to that of the defined environmental operational envelope by applying identified fail safe states.
• Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.2.2 Operational Monitor Diverse and independent monitors have been designed to use data from the input (sensors) and output (actuators) domain to constrain the robot's capabilities to that of the defined operational envelope by applying identified fail safe states.
• Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.2.3 Health Monitor Diverse and independent monitors have been designed to identify excursions from the robot system's 'normal' internal operating health envelope to constrain the robot's capabilities to that of the defined operational envelope by applying identified fail safe states.
• Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.2.1 Watch Dog Timers (WDT) have been employed to place the the robot in a safe state if the processing freezes

The Runtime Monitors are implemented using conventional software techniques and verified accordingly.

The Runtime Monitors are implemented on separate and diverse hardware from that of the symbolic AI, (Intelligent) Collision Sensor, Image Classifier, Conventional Control Algorithms.

The WDT is hardware based and is patted from the 'main' polling loop forming the scheduler.

A claim is made here for both.

Possible approaches include:

1. The COTS software is constrained by a wrapper. The wrapper has been developed according to recognised good practice (RGP) which is commensurate with the classification of this SSC (Production Excellence (PE)). A third party has examined the process and its products to confirm that they are commensurate with the classification of this SSC (Independent Confidence Building Measures (ICBM)).

2. Independent and diverse software methods, tools, hardware, staff etc. have been used to verify the output of the SSC which is commensurate with the classification of this SIF(PE). A third party has examined the process and its products to confirm that they are commensurate with the classification of this SSC (Independent Confidence Building Measures (ICBM)).

3. Independent and diverse (and possibly less complex) hardware/software (sensors, decision making etc.) have been used to provide a preventative/mitigative SSC which is commensurate with the classification of this SIF (PE). A third party has examined the process and its products to confirm that they are commensurate with the classification of this SSC (Independent Confidence Building Measures (ICBM)). This could be implemented as an input to a voting system or as outer limits which place the system in to a safe state (failsafe).

4. Independent and diverse software methods, tools, hardware, staff etc. have been used to verify in RT the output of the SSC which is commensurate with the classification of this SIF (PE).