Safety Principles draft

Annex B: Example guardrail records

October 18, 2026 Draft for public comment, version 0.1

This annex shows how a robot working in a pharmacy turns the articles into motions and records. Each record shows its ID, article, situation, rule and response; limits, detection methods and test evidence are held by the maker.

A draft for public comment, not yet in force. Please read the status notice before relying on any part of it.

Motion catalog

The workflow steps are those of the step record in Annex A.

MotionWorkflow stepsMain hazardsSafe stateRecords
Travel between stationsAllStriking a person; tipping; spilling a loadSmooth stop, load held levelGR-PH-001, 002, 003, 005, 020
Reach into a shelf or bin1, 2A hand pinned against a shelf; items fallingStop, back off along the pathGR-PH-006, 007, 008, 009
Grasp a container1, 2, 3Crushing glass; the wrong itemHold at the lightest secure gripGR-PH-010, 011
Carry a container1 to 4Dropping glass or a hazardous drug; spillingSmooth stop, keep the gripGR-PH-004, 012, 013
Count and pack3Wrong count; pinched fingersStop, hold the trayGR-PH-012, 013, 015
Apply a label4The wrong patient's labelHold the package for the pharmacistGR-PH-016
Hand over to a person3 to 5Contact with the hand; a dropSoft grip, hold until takenGR-PH-002, 009, 014
Present for the final check5Release without sign-offHold until the pharmacist signsGR-PH-017
Dock and chargeNoneBattery heat or fireIsolate power, alertGR-PH-022
Every motionAllStops, restarts, incidents, power loss, software, remote commands, dataAs each record statesGR-PH-018, 019, 021, 023 to 026

Guardrail records

IDArt.SituationRuleResponse
GR-PH-0019.5Travelling with people in the roomKeep to each zone's speed limitsSlow down by zone
GR-PH-0029.6A person enters the reach zoneNo motion without an explicit yesPause, announce, wait
GR-PH-0039.2Reaching the boundary of the work areaNever enter the counter or customer areasProtective stop at the boundary
GR-PH-00415.2Carrying glass or a liquidKeep the load level and securedSmooth stop, keep the grip
GR-PH-00515.7A spill, cord or object in the pathNever drive over or through itStop, alert, reroute only if clear
GR-PH-0069.5Arm moving with a person in reachMove only after a yes, at the reach-zone speedProtective stop above the limit
GR-PH-00713.5A hand near a shelf or wallNever move toward a hand that could be pinnedHold position
GR-PH-00814.2Any contactReact on the first credible signalStop, yield, back off, keep the load
GR-PH-00913.3Contact with a handStay at or below half the Annex M valueDesign limit, never exceeded
GR-PH-01015.5Grasping glassGrip below breaking forceSoft setting; slip control
GR-PH-01115.1Before any graspCode, label and vision must agreeStop and ask
GR-PH-01215.3Hazardous drugsMove sealed containers only; never open, count or packRefuse; hand to a technician
GR-PH-01315.4Controlled substancesScan at every hand-off; never unattended outside storageStop; alert the pharmacist on any discrepancy
GR-PH-01413.1Handing an item to a personYes first; release only when takenHold until the person takes it
GR-PH-01515.8Counting a prescriptionA second technological check confirms the countHold the prescription
GR-PH-01615.8Applying a labelRead the label back against the prescription and patientHold for the pharmacist
GR-PH-017Annex AReleasing a prescriptionNever without pharmacist sign-offHold
GR-PH-01810.2Anyone wants to stop the robotEvery stop path always worksEmergency or protective stop
GR-PH-01910.6Restarting after a stopAuthorized person, checklist, clear areaStay stopped until met
GR-PH-0209.2No enrolled operator presentNever run unattendedFinish the safe step, then pause
GR-PH-02111.2An incidentLock the record; quarantine items handledAlert; hold prescriptions
GR-PH-02217.4Charging and batteryCharge only at the dockIsolate power, alert
GR-PH-02310.5Power or control lostStay safe without powerSafe state; manual release available
GR-PH-02417.6A software or model updateSigned and tested; never while movingRefuse the install; roll back on failure
GR-PH-0258.6A remote commandRemote may stop, never start motion in reachAccept stops; ignore starts
GR-PH-02617.8Camera images with patient dataEncrypt, log access, keep only what is neededAlert on unauthorized access

Comments

Comments are open for 60 days from publication. Comments posted here are public once Dunster Physical AI has reviewed them. Comments and emails are not treated as confidential, and Dunster may use them to improve the Safety Principles. Please don’t send patient information or anyone’s confidential material. To raise a safety or security concern privately, email info@dunster.ai.