Argument A1.2.2.3.3.4.4.3.2.1.2.2.3 Health Monitor Diverse and independent monitors have been designed to identify excursions from the robot system's 'normal' internal operating health envelope to constrain the robot's capabilities to that of the defined operational envelope by applying identified fail safe states.

• Supports Argument: A1.2.2.3.3.4.4.3.2.1.2.2 Runtime Monitors and a WDT are implemented

Child nodes:

• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.1.1.2.4.1 Design Justification Report (DJR)
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.6.1.2 SIF Functional and Non Functional Description
• Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.5.2 Non functional test reports
• Has support Other: O1.2.2.3.3.4.4.3.2.1.2.2.2.1 The 'fail safe state' includes recovery functions

 Example:

Does the environmental appear to change unfeasibly quickly?

Is a diverse/independent temperature sensor giving a different reading?

Is the temperature reading beyond that feasible for the location?