Chapter 22 · Bring up real robot hardware through bounded, evidence-led gates
Today in the field story
One problem, then the next
The stop-function review places ordinary command cancellation, software timeout, watchdog, controlled stop, emergency stop, Safe Torque Off, electrical isolation, braking, and load holding in separate rows. You state initiator, energy effect, diagnostic, reset, evidence owner, and unresolved hazard for each. A software watchdog may help application recovery but is not automatically independent or safety-rated. No E-stop or STO is pressed or validated at Bench Zero; those tests require the exact platform, competent design, approved procedure, and qualified witnesses.
- Why now
Similar stop words conceal materially different physical functions and assurance levels.
- Ignore today
Do not design, wire, bypass, or validate a real protective function.
- Unlocks next
A safety-function responsibility matrix with no inflated software claims.
Understand
Build the physical picture first
Stopping is a layered risk-control problem: application commands, watchdogs, emergency functions, STO, brakes, isolation, stored energy, reset, and restart each make different promises.
Name the function before judging it. A normal stop ends the operating cycle in a controlled way. A ROS 2 cancellation, zero-velocity command, controller deactivation, browser stop, or standard network watchdog is ordinary application behavior unless the entire channel has been designed and validated to the required safety performance. A protective stop or other safety function belongs to a risk-derived safety-related control system. An emergency stop is a complementary protective measure for an emergency, designed to override normal operation and reduce risk; it is not the routine stop, a substitute for guarding, or proof that every hazard is controlled.
Safe Torque Off is a specific drive safety function that prevents torque-producing energy from being supplied to the motor when correctly integrated and validated. It does not necessarily remove mains or DC-bus voltage, actively brake a moving axis, monitor standstill, hold a vertical load, remove pneumatic or hydraulic energy, or make maintenance electrically safe. A motor can coast, and gravity or stored mechanical energy can still move a mechanism. The risk assessment may require a controlled safe stop, safety-related brake, mechanical support, energy isolation, or another function in addition to or instead of STO.
Watchdogs and shutdown sequences still matter when described honestly. A local command watchdog can detect an expired heartbeat and move ordinary application outputs to a defined state without waiting for the network. A normal shutdown can stop new work, request a controlled stop, verify measured standstill where applicable, deactivate controllers, preserve diagnostics, and follow approved power or energy procedures. Fault shutdown handles uncertain state and communication. None of these is automatically safety-rated; each has assumptions, failure modes, response time, and evidence that must be reviewed separately from the independent emergency path.
Reset and restart are distinct. Releasing or resetting an emergency actuator should remove the emergency condition only according to the engineered design; it must not itself create unexpected motion. Before restart, the responsible operator or system checks that the hazard is cleared, safeguards and command authority are restored, state and calibration are trustworthy, stored energy is controlled, and a new deliberate start is authorized. Learners may review diagrams and simulate state transitions, but must never design, wire, bypass, prove, or time a real E-stop or STO circuit without the qualified safety owner and exact manufacturer procedures.
Words you need
Name each idea precisely
- Emergency stop
A complementary protective function intended to avert or reduce an emergency hazard, with behavior derived from the machine risk assessment and applicable requirements.
Physical example:An accessible emergency actuator triggers the validated machine response and overrides ordinary production commands; releasing it does not command the robot to resume.
- Safe Torque Off (STO)
A safety-related drive function that prevents torque-producing energy from being supplied to the motor, without by itself guaranteeing electrical isolation, braking, standstill, or load holding.
Physical example:A drive enters STO while a horizontal axis coasts; a vertical gravity-loaded axis may require a separately engineered brake or support.
- Command watchdog
A monitor that detects missing or stale expected commands or heartbeats and invokes a declared local application response.
Physical example:A drive interface stops renewing its ordinary velocity request after 200 ms without a valid heartbeat and reports the timeout state.
- Energy isolation
A controlled method for separating and managing hazardous electrical, mechanical, pneumatic, hydraulic, gravitational, thermal, or other energy for the intended work.
Physical example:STO alone does not establish isolation for electrical maintenance because hazardous voltage may remain on the drive's supply or DC bus.
- Restart inhibit
A condition preventing automatic resumption of hazardous motion after a stop or fault until the designed reset and deliberate start requirements are satisfied.
Physical example:Resetting a simulated E-stop state changes
emergency_activetoreset_required; a separate authorized start is still needed after conditions are checked.
Math, one line at a time
Work through today’s relationship
Prerequisite rescue · optionalZero-power electricity bridge: voltage, current, resistance, and power
Before buying, wiring, or energizing hardware, use paper calculations and manufacturer documentation to detect impossible loads, overheated conductors, and incompatible supplies.
- V = IR
- voltage equals current multiplied by resistanceUnit: volts (V)
- P = VI
- electrical powerUnit: watts (W)
- I
- charge flow through one declared pathUnit: amperes (A)
On paper, a documented 12 Ω test load across 24 V would draw I = V/R = 24/12 = 2 A.
Its electrical power would be P = VI = 24×2 = 48 W, so an ordinary low-power resistor would be unsuitable even though the arithmetic is simple.
Stop at the calculation: do not assemble or energize the circuit. Verify ratings, protection, isolation, polarity, grounding, wiring, thermal limits, and a supervised low-voltage commissioning plan with qualified guidance.
Types and range checks catch bad values in software; electrical ratings are physical contracts whose violation can create heat, fire, shock, or loss of braking.
On paper, what current would an ideal 10 Ω load draw from 5 V?
I = V/R = 5/10 = 0.5 A; this calculation is not permission to build or energize a circuit.
Travel before watchdog detection is
Total stopping distance is plus measured actuation and braking travel.
Review a layered stop-state table without touching hardware
A simulated arm has ordinary pause, ROS cancellation, a 200 ms command watchdog, a modeled emergency input, a modeled STO state, a vertical axis, and a separate symbolic brake. The exercise tests semantics and evidence only.
List hazards and energy sources first: moving links, gravity-loaded axis, electrical supply and DC bus, stored mechanical energy, tool energy, remote commands, and unexpected restart. Assign qualified owners instead of designing circuits from the lesson.
Create rows for normal stop, cancellation, watchdog timeout, protective function, emergency stop, STO, controlled safe stop, brake or support, energy isolation, reset, and restart. For each, state initiator, path, expected output, what is monitored, remaining energy, and evidence required.
Inject a lost network heartbeat at simulated speed 0.6 m/s. At a 0.080 s detection time the pre-response travel is
0.6 × 0.080 = 0.048 m; label this 48 mm as detection travel only, not total stopping distance or a safety setting.Add modeled actuation delay and braking travel as separate unknown or measured fields. Do not choose a protected-zone distance from the exercise arithmetic, because payload, surface, drive state, mechanical response, sensing, tolerances, and applicable safety design remain outside it.
Trigger the symbolic STO state on the vertical-axis model and show both allowed outcomes: the motor cannot generate commanded torque, yet the load may coast or descend unless the separately modeled brake or support is effective.
Release the symbolic emergency input and require
reset_required, inspection of state and safeguards, resolved command authority, and a separate deliberate start. Reject any transition that automatically returns to motion.Run loss of browser, host process, standard controller, watchdog task, safety input, brake indication, and power restoration as separate fault cards; produce an awareness report listing which responses are application simulations and which require qualified real validation.
The state table distinguishes ordinary and safety-related functions, shows that 48 mm covers only heartbeat-detection travel, exposes STO's no-torque versus no-motion boundary, and blocks automatic restart.
A stop claim is meaningful only when the hazard, channel, remaining energy, monitored state, failure assumptions, reset, and qualified evidence are all named.
Physical examples
Where this appears in real life
Vertical axis after torque removal
A gravity-loaded lift loses torque-producing drive energy. The axis is not mechanically supported and the ordinary motor brake has not been established as a safety-related holding function.
No-torque is not the same as no-motion; gravity, brake design, stored energy, load support, isolation, and risk-derived safe state require separate qualified decisions.
UI stop versus independent emergency path
A browser stop sends a request through Wi-Fi, a host process, ROS 2, and a standard controller. A separate engineered emergency chain does not depend on that application path.
The UI stop is valuable for ordinary operation but shares software, network, and host failure modes; do not label it E-stop, STO, safety-rated, or proof of stopped physical energy.
Hands-on exercise
Make the idea observable
Use paper state cards, a lamp or simulator indicator, and no connected machine. Treat E-stop, STO, brake, and isolation as symbolic states rather than instructions for wiring or validation.
Draw separate ordinary-command, watchdog, modeled emergency, modeled STO, brake or support, energy-isolation, reset, and restart paths; mark shared dependencies and qualified owners.
Write the exact promise and non-promise for each path, including voltage remaining, torque generation, coast, gravity, standstill monitoring, communication dependence, and restart behavior.
Simulate normal stop, cancel, stale heartbeat, browser loss, host crash, emergency request, STO request, brake unavailable, power restoration, reset, and deliberate restart.
For one moving simulation, separate detection delay, actuation delay, and braking travel; record unknowns rather than turning the sum into a real machine parameter.
Challenge the table with a vertical load and stored energy, then add the required qualified review item when no symbolic function alone establishes the safe state.
Have another learner point to every use of
safe,emergency,STO, orisolatedand demand the owner, scope, evidence, and limitations; revise any overclaim.
The word stop hides very different paths and remaining energies; the most dangerous errors appear when zero command, no torque, zero speed, held load, and electrical isolation are treated as synonyms.
Every state has a bounded promise and explicit non-promises, automatic restart is impossible in the simulation, and the artifact contains no real wiring, bypass, energization, or safety-validation instruction.
Build today
Bring up a LeRobot-supported arm or mobile robot with calibration, limits, teleoperation, and emergency stop.
Evidence to save
DONE when a 60–120 second uncut “Emergency stop, STO awareness, watchdog, and safe shutdown” demo links to its command, logs or plots, result count, and honest failure note.
Common mistakes
Catch the wrong mental model
Labelling a UI button or ROS cancellation as an emergency stop because it usually halts the demo.
Call it an ordinary stop request and identify its shared failure paths; route emergency risk reduction through the independently engineered and validated machine function.
Assuming STO means the axis is stationary, held, and electrically safe to service.
STO prevents torque-producing motor energy but may allow coast or gravity motion and may leave hazardous voltage; braking, support, standstill, and isolation need their own design.
Allowing motion to resume when an emergency actuator is released or power returns.
Use restart inhibition and require the designed inspection, reset, restored safeguards and authority, trustworthy state, and a separate deliberate start command.
Job connection
How this becomes employable evidence
Map operator, ROS, drive, watchdog, safety controller, brake, isolation, reset, and restart responsibilities with qualified safety engineers; prevent HMI and software documentation from overstating ordinary stop behavior; and preserve separate evidence for each risk control.
Relevant target roles
- Robotics Deployment, Integration & Validation Engineer
- Robotics Application / ROS 2 Integration Engineer
- Robot HMI / Control & Monitoring Engineer
Chapter 22 interview drill
Interview questions: Emergency stop, STO awareness, watchdog, and safe shutdown
Practise a 60–90 second answer: define the idea, connect it to a physical robot, state assumptions, frames, and units when relevant, then finish with the failure signal or evidence you would inspect.
Primary interview scenario
Explain why a web stop, ROS cancellation, watchdog, E-stop, STO, brake, and lockout are different. Use a vertical axis and network failure to show remaining energy, response evidence, reset behavior, and where qualified functional-safety ownership begins.
Answer shape: clarify the situation → trace the physical and software path → test the most likely boundaries → name the evidence that would confirm the result.
Technical follow-up questions
Q1Why is a robot-side command watchdog still not automatically safety-rated?
Its sensing, logic, output, independence, diagnostic coverage, failure rate, response, integration, and validation may not meet the risk-derived safety performance even if ordinary tests pass.
Q2What does STO not necessarily provide?
Electrical isolation, active braking, monitored standstill, holding against gravity or external force, removal of other energy, or a complete machine safe state.
Q3What should releasing an emergency-stop actuator do?
It should only permit the engineered reset process; it must not itself restart hazardous motion, which requires conditions to be checked and a separate deliberate authorization.