Redundant Safety Channel vs Single-Channel Robot Control (2D)

Safety Architecture

Main Controller

Commanded angle: nominal cycle

Independent Safety Monitor

Watching actual position & velocity, independent of the main controller

Fault Injection

Injecting a fault simulates the main controller freezing or computing a runaway command — its commanded angle ramps upward without limit, exactly as if a software bug had locked the control loop onto a bad value.

Live Readout

Status

NOMINAL

Commanded angle

–

Actual angle

–

Angular velocity

–

Distance to human

–

Time since fault

–

Time-to-stop / time-to-collision

–

Trial Tally

Single — Safe0

Single — Collision0

Redundant — Safe0

Redundant — Collision0

How it works

A single-channel robot has one computer: the main controller decides the motion and is the only thing that could notice it going wrong. If that controller's software hangs or computes a bad command, nothing independent is watching — the arm just keeps executing whatever the faulty channel last told it, all the way to a collision.

A safety-rated design adds a second, independent channel: simpler, more rigorously verified hardware/software that never trusts the main controller's own account of what it's doing. Instead it reads the arm's actual measured position and velocity directly from sensors, every cycle, and compares them to a hard-coded safe envelope. The two channels don't need to agree on why the arm is moving — the monitor only cares whether the physical motion itself has left the safe zone. The instant it has, the monitor asserts a hardware-level stop (e.g. cutting motor torque) regardless of what the main controller is still commanding.

Single-channel — commanded angle races toward the human with no check; the arm follows it until physical collision.
Redundant channel — the same fault is injected into the same main controller, but the independent monitor trips the instant actual motion crosses the safety-zone boundary, well before the arm reaches the human.
Run 5 Trials — repeats fault injection with randomized ramp rate and injection point under the current mode, tallying safe stops against collisions.

This is a 2D top-down port of the 3D version: the same servo dynamics, fault model and independent-monitor logic, redrawn as a bird's-eye view of the arm sweeping over the floor zones.

Safe zone Approach zone Protective-stop boundary Independent monitor