PRELIMINARY - SAFETY REQUIREMENTS CANDIDATE ONLY - NOT FUNCTIONALLY SAFETY VALIDATED - NOT APPROVED FOR CONNECTION, POWERED TESTING, MOTION, OR ENERGIZATION

Project Button · HR-30 whole-body P0.1

Define the safe state before applying power.

The existing stop hardware, no-motion firmware, restraint boundary and first-power ladder now have one traceable candidate SRS. Every achieved-performance and physical-result field is still open.

24

whole-robot hazards; none accepted

12

safety/control function records

8

stopping-time intervals to measure

0

achieved PL claims or executed validations

Architecture boundary

Hardwired HR-30 emergency-stop path separated from standard controller and AI request path

Candidate safety functions

IDFunctionCandidate PLrImplementationAchieved PL
SFR-01Emergency-stop demand removes actuator energydIMPLEMENTED AS UNVALIDATED TOPOLOGYNO
SFR-02Prevention of unexpected restartdIMPLEMENTED AS UNVALIDATED TOPOLOGYNO
SFR-03External-device monitoringdIMPLEMENTED AS UNVALIDATED TOPOLOGYNO
SFR-04Control-power loss enters safe statedPARTIAL - HARDWARE/HIL NOT EXECUTEDNO
SFR-05Actuator VDD backfeed preventiondDEFINED - UNBUILTNO
SFR-06Branch overcurrent interruptionN/ANOT IMPLEMENTEDNO
SFR-07Watchdog loss requests safe stopNOT ALLOCATEDDEFINED - NO SAFETY CREDITNO
SFR-08Torque-disable commandNOT ALLOCATEDCOMPILED - UNFLASHEDNO
SFR-09Charger interlockcFUTURE - OUT OF SCOPENO
SFR-10Fall restraint prevents head/floor contactN/ANOT SELECTED OR PROVEDNO
SFR-11Safety-related speed/travel limitingdNOT IMPLEMENTED - MOTION PROHIBITEDNO
SFR-12Power-loss collapse containmentdNOT IMPLEMENTED - MOTION PROHIBITEDNO

System stopping-time model

T_total = t_input + t_logic + t_output + t_contactor + t_bus + t_torque + t_mechanical

No numerical stopping limit or distance is released. Every interval, joint velocity, gravity/fall contribution and uncertainty must be measured before any motion stage.

TermIntervalAllocationResult
t_inputhazard/E-stop actuation to valid safety-input stateSELECTION REQUIREDNONE
t_logicsafety relay input recognition to output releaseSELECTION REQUIREDNONE
t_outputsafety output release to K1/K2 coil decaySELECTION REQUIREDNONE
t_contactorcoil decay to both main contacts confirmed openSELECTION REQUIREDNONE
t_busmain contact opening to actuator rail below selected safe-voltage thresholdSELECTION REQUIREDNONE
t_torquerail/torque-off demand to actuator current below selected residual-torque thresholdSELECTION REQUIREDNONE
t_mechanicaltorque removal to end of coast/overtravel/restraint motionSELECTION REQUIREDNONE
T_totalt_input + t_logic + t_output + t_contactor + t_bus + t_torque + t_mechanicalSELECTION REQUIREDNONE

Open safety holds

SRS-H01

qualified ISO 12100 risk assessment not accepted

OPEN

SRS-H02

candidate PLr allocations are project-owned and unapproved

OPEN

SRS-H03

achieved PL/PFHd not calculated

OPEN

SRS-H04

common-cause measures unverified

OPEN

SRS-H05

stopping-time intervals and total are unmeasured

OPEN

SRS-H06

joint and endpoint stopping distances are unallocated

OPEN

SRS-H07

PNOZ/contactors and DC opening duty are unvalidated as a system

OPEN

SRS-H08

whole-body fall restraint has no rated design or proof

OPEN

SRS-H09

safety-related speed/travel monitoring is absent

OPEN

SRS-H10

public and child interaction safety is outside P0.1

OPEN

SRS-H11

electrical protection and protective bonding remain open

OPEN

SRS-H12

no physical safety test or qualified validation has executed

OPEN

Controlled records

SRS · hazards · functions · PL inputs · CCF · zero-motion invariants · timing · 25 axes · validation · holds · sources

External standards are referenced by official publication pages and access date. Their copyrighted full text is not reproduced.