Safety & Degraded Modes¶
Current working version
This page is the current working version of the safety documentation. It is clearly not the final version yet: the project is still under development, and safety analysis and implementation will continue to evolve as the robot is built and tested.
Safety is the most important part of this project. However, I am currently the only person working on it, and the robot itself is still being developed. A robot that does not exist cannot be tested or made safer. For that reason, development is continuing in parallel with the safety work. The goal is to keep safety visible and to implement the necessary protections progressively, before any real-world operation.
The table below records the current documented and implemented failure responses. It is an engineering snapshot, not a claim that all safety issues have been solved. Missing, uncertain, or not-yet-implemented behavior must be resolved before the robot is considered ready for operation.
Current FMEA¶
Every row in this table is directly sourced from documented, implemented behavior.
| Failure | Detected by | Delay | Reaction | Visible effect | Recovery |
|---|---|---|---|---|---|
| Controller link lost while the robot is walking or running | Pi (source staleness) | 500 ms | Auto-decelerate to STANDING |
Robot stops itself | Automatic once the link returns |
| Controller link lost in any state | Pi (source staleness) | 10 s | Auto-transition to SITTING; latch control mode to plain RC |
Robot sits; background behaviors are disabled | Link return does not clear the latch; explicit source action is required |
| Tilt exits the safety zone | Pico tilt monitor | Immediate | Cut motor power | Motors stop immediately | The subsequent FALLING protection remains available |
| Tilt out of range | Pico tilt monitor | ~5 s sustained | Auto-transition to FALLING; legs fold; optional alert sound |
Robot lowers itself defensively | Automatic once tilt is back in range, then SITTING |
| Pi to XIAO (head) link lost | XIAO watchdog | 200 ms | Failsafe: servo torque cut and vibrator off | Head goes limp | Automatic on the next valid command |
| Emergency stop from any source | Arbiter (OR across sources) | Immediate | Robot returns to SAFE |
Motors are de-powered | Clears instantly when no source signals that it is active |
| Pack voltage low (9.6 V) | Nano Every (INA226) | On threshold crossing | Clean shutdown sequence: notify, halt, then cutoff | Robot sits, then powers off | Manual: recharge and power cycle |
| Cell undervoltage (2.8 V) | BMS hardware | Threshold-based | Hard circuit cutoff | Total power loss | Manual: recharge |
| Overcurrent (60 A) or short circuit | BMS hardware | 1 s for overcurrent; 300 µs for short circuit | Hard circuit cutoff | Total power loss | Manual: recharge |
| Servo overload, overvoltage, or overheat | Servo firmware | 2 s for overload; immediate for voltage and temperature | Torque cut on that servo | Affected joint goes limp | Auto-rearm on a new setpoint or after returning to a safe range |