Argument A1.2.2.3.3.4.4.3.2.1.2.2.4 Environmental monitor Diverse and independent monitors have been designed to use data from the input domain (sensors) to constrain the robot's capabilities to that of the defined environmental operational envelope by applying identified fail safe states.

• Supports Argument: A1.2.2.3.3.4.4.3.2.1.2.2 Runtime Monitors and a WDT are implemented

Child nodes:

• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.1.1.2.4.1 Design Justification Report (DJR)
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.6.1.2 SIF Functional and Non Functional Description
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.5.2 Non functional test reports
• Has support Other: O1.2.2.3.3.4.4.3.2.1.2.2.2.1 The 'fail safe state' includes recovery functions

Example:

Significant excursions (directly measurable):

Is the environment too hot/cold to operate in?

Is there too much EM noise?

Do the obstacles that the robot is likely to come across absorb radar/sonar and therefore difficult to detect?

Are the obstacles that the robot is likely to come across likely to be too small to detect? 

Minor excursions  (data fusion from two or more sources required to detect):

Distance data determined by sonar and 3D images. The sonar data could be dependent on concentrations of materials dissolved in the water at different depths and also the temperature of the water at different depths.

- The decision making algorithm could help by providing a level of confidence. but this is difficult.