Argument A1.2.2.3.3.4.4.3.1.1.2 Design and implementation of the Collision Avoidance guard is adequate to prevent collision because...

• Is a subclaim of Claim: C1.2.2.3.3.4.4.3.1.1 The guard is adequate to prevent collision

Child nodes:

• Has subclaim Claim: C1.2.2.3.3.4.4.3.1.1.2.3 The level of independence and independent oversight has been determined and achieved
• Has subclaim Claim: C1.2.2.3.3.4.4.3.1.1.2.2 A suitable design and implementation lifecycle has been followed
• Has subclaim Claim: C1.2.2.3.3.4.4.3.1.1.2.4 Probabilistic analyses have show that the guard has a failure rate commensurate with the requirements
• Has subclaim Claim: C1.2.2.3.3.4.4.3.1.1.2.5 The guard is sufficiently diverse, independent and segregated from the (intelligent) control system
• Has subclaim Claim: C1.2.2.3.3.4.4.3.1.1.2.1 functional requirements

Requirements for the guard have been derived from the system functional and non-functional safety requirements and verified.

NB. The requirements should include the remediation action. i.e. how to recover from the safe state.

The design and implementation of the guard has followed a safety lifecycle model commensurate with IEC 61508. The guard has been designed and verified independently (explain what that independence is).

An analysis has shown that a combination of:

• the maximum speed that the robot is capable of moving (this may need to be governed unless it can be shown that it is impossible to exceed the speed),
• the mass of the robot
• the distance between detection and collision
• the maximum drift distance and deceleration once power is cut to the propellers

results in a maximum (worst case) impact energy plus a n% margin which is less than that which the hazard analysis shows to be unsafe.

Probabilistic analyses (Failure Modes and Effects Criticality Analysis (FMECA), SIL calc's and Safe Failure Fractions (SFF)) have been conducted for the guard and shown to have a failure rate commensurate with the requirements. This analysis has also shown that a burn in of n cycles is required prior to first use.

The guard is diverse, independent (except for its power supply) and segregated from the (intelligent) control system. The design and implementation does not contain any programmable elements and is based on the actuation of micro switches by 'whiskers' placed around the robot which in-turn actuate relays cutting power to the propellers (the safe state). The guard will enter its safe state if its power or that of the (intelligent) control system fails.

The guard has been functionally tested with 100% coverage.

The guard has been tested to confirm it meets its non-functional requirements, including:

• Performance test
• The guard has been shown to be EMC compliant (analysis and test).
• The guard has been shown to be resilient to the environment (analysis and test).