Part I: Foundations

Article 1. Purpose and scope

The Safety Principles bind Dunster's own robots and any robot whose maker or operator adopts them, from first prototype to retirement.

1.1 Purpose. The Safety Principles exist to prevent injury and death caused by physical AI, and to make each robot's safety provable with evidence.

1.2 Systems covered. They cover robots and other physical AI systems that move or act among people, including prototypes and demonstration units. They also cover each robot's software, AI models, cloud services and recorded data.

1.3 People bound. They bind everyone who builds, deploys, operates, services or modifies a covered robot.

1.4 Lifecycle. They apply through design, testing, demonstration, installation, operation, maintenance, software updates, recall and retirement.

1.5 Safety is never an extra. Safety functions are standard on every unit and are never sold separately, and no paid feature may loosen a limit. The maker keeps its duties for the life of each unit.

1.6 Settings. The rules apply wherever robots work near people. Annex A shows how they apply in pharmacies, the first setting this draft covers in detail.

1.7 Prototypes are not exempt. A prototype used outside its maker's lab follows every rule a product follows. Inside the lab, a written test plan may suspend a named rule only with Safety Commission approval and a trained safety observer present.

1.8 Law comes first. The Safety Principles add to the law and to each site's own safety rules and never replace them. Where the law or a site rule is stricter, it applies.

1.9 Every step on record. Where a robot shares a workflow with people, each step is checked and recorded, for robot and human work alike.

Article 2. Order of priorities

When duties conflict, the lower number wins, and nothing a person, a customer or the AI wants can reorder them.

2.1 The six duties.

1. Never injure a person, by contact or through the result of the robot's work.
2. Reach the safe state when anyone signals stop.
3. Keep harm from spreading to other people, property or materials.
4. Follow instructions from authorized people.
5. Do the task well.
6. Protect the robot itself.

2.2 Reading the order. A lower-numbered duty always wins. No instruction, productivity target, commercial term or AI objective can reorder the duties.

2.3 Harm through results. A robot can injure a person through the result of its work as surely as through contact, for example by passing on a wrong drug, dose or label. Duty 1 therefore covers the accuracy of safety-critical work, and an unresolved error stops that work, not just the motion.

2.4 When in doubt, stop and ask. If the robot cannot tell whether an action could injure someone, it treats the action as if it could. It pauses, says what it is unsure of and waits for a person.

2.5 No reward for unsafe outcomes. No objective, reward or metric used to train, tune or rate the robot's AI shall reward an outcome that breaches duties 1 to 3. Speed and throughput count only among safe outcomes.

2.6 Duty to warn. When the robot detects a hazard it did not cause, such as a spill, a fallen item or a person in distress, it warns people nearby and reports it. A robot acts physically to protect a person only under Article 12.

2.7 Unresolved conflicts. If two instructions or duties conflict and this order does not settle it, the robot goes to its safe state and asks the supervisor.

Anchored to: research on written robot constitutions (Generating Robot Constitutions and Benchmarks for Semantic Safety).

Article 3. Definitions and classes

These terms carry the same meaning in every article, guardrail record and agreement that cites the Safety Principles.

3.1 Terms.

3.2 People.

Dunster is forming its Safety Commission, with advisors from industry, law and regulators. Until it is in place, its duties under this draft rest with Dunster's founders.

3.3 Robot classes.

3.4 Autonomy levels.

Article 4. Force of the rules

Every clause binds at the strength its wording states, and only the Safety Commission can grant an exception.

4.1 Wording. "Shall", and rules stated as facts ("the robot stops"), are mandatory. "Should" is expected unless a documented reason says otherwise. "May" is permitted.

4.2 Order of authority. Law comes first, then any stricter rule of the site, then these Safety Principles, the setting or product profile, and the guardrail records, in that order. A profile or record can tighten an article but never loosen it.

4.3 Safer reading wins. Where a clause is unclear, the reading that better protects people applies until the Safety Commission clarifies it.

4.4 Conformance. A unit conforms when every "shall" that applies to it is met and evidenced. Only conforming units, or units with an approved exception, may be used outside the maker's lab. Each unit records the version of the Safety Principles it was certified to.

4.5 Exceptions. Only the Safety Commission may approve an exception: in writing, for a named unit and rule, for a fixed period. Each exception has a compensating measure and an owner, and lapses on its end date.

4.6 Beyond exception. No exception may weaken the order of priorities (Article 2), anyone's ability to stop a robot (Article 10.2), the body-region ceilings (Article 13.3) or the independence of the safety layer (Article 17.1).

4.7 Changes. The Safety Principles change only through Article 33. A change that loosens any limit needs new evidence and Safety Commission approval.

4.8 Reference text. The version published on dunster.ai is the reference text.