Argument A1.2.2.3.3.4.4.3.2.1.2.2.2 Operational Monitor Diverse and independent monitors have been designed to use data from the input (sensors) and output (actuators) domain to constrain the robot's capabilities to that of the defined operational envelope by applying identified fail safe states.

• Supports Argument: A1.2.2.3.3.4.4.3.2.1.2.2 Runtime Monitors and a WDT are implemented

Child nodes:

• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.1.1.2.4.1 Design Justification Report (DJR)
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.6.1.2 SIF Functional and Non Functional Description
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.5.2 Non functional test reports
• Has support Other: O1.2.2.3.3.4.4.3.2.1.2.2.2.1 The 'fail safe state' includes recovery functions

Example:

Moves too fast considering proximity to obstacles

Acceleration too high considering proximity to obstacles