Argument: A1.2.2.3.3.4.4.3.2.1.2 - The architecture and algorithms have been designed such that the hazard is mitigated

Argument A1.2.2.3.3.4.4.3.2.1.2 The architecture and algorithms have been designed such that the hazard is mitigated

Parent nodes:

Supports Claim: C1.2.2.3.3.4.4.3.2.1 The system is adequate to prevent collision

Child nodes:

Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.2 Runtime Monitors and a WDT are implemented
Has support Argument: A1.2.2.3.3.4.4.3.2.1.2.1 The (Complex) Collision Sensor is diverse from that of the image classification (sub-symbolic AI) and is verifiable
Has evidence Evidence: E1.2.2.3.3.4.4.3.2.1.1.6.1.2 SIF Functional and Non Functional Description

The (Complex) Collision Sensor and Image Classifier individually indicate to the 1oo2 voting that there is an obstacle in the robot's path. However the safety claim is placed on the (Complex) Collision Sensor system. They both make clear, unambiguous indications of the presence of an obstacle to the 1oo2 voting. The Image Classifier acts as an unclaimed support. The (Complex) Collision Sensor system is designed using traditional hardware and software techniques.

The flow chart describes the operation of this SIF.

Runtime monitors and a WDT have been used to ensure that the robot operates within its prescribed operating envelope and does not deadlock or freeze without entering the default safe state for the SIF.