The first deliverable is a protective stop
The consortium's opening piece of work is the assurance case for an open source safety stop, a device still being built, with its evidence written in public alongside it.
The consortium’s first deliverable is the safety case for a specific device, written while the device is still being built.
Protective Stop is an open source safety stop for robots and industrial machines, developed by founding member Polymath Robotics. A PoE- or USB-powered ESP32-S3 remote sends operator intent to the machine ten times a second over an encrypted tunnel. When those messages stop arriving, because the operator released the control, the link dropped, or the remote lost power, the machine brings itself to a controlled halt.
The distinction in the name matters. An emergency stop cuts power and leaves the machine wherever inertia puts it. A protective stop commands a controlled shutdown into a defined state. Both belong on a machine, and treating one as a substitute for the other is how people get hurt.
The project targets SIL 3 under IEC 61508 and Performance Level e under ISO 13849, the levels a builder needs when a failure can injure someone. It has not reached them yet. The firmware runs lockstep across both cores of the ESP32-S3, the protocol library is kept on a separate certification track, and a MISRA checker gates the C. The test suite includes a chaos proxy that deliberately mangles the network to see what the device does when the link misbehaves.
All of it is published. Apache-2.0 covers the software, CERN-OHL-P-2.0 the hardware, and CC-BY-4.0 the documentation, including design records, test reports and safety playbooks.
That is why the consortium started here. Most safety evidence for open source components gets produced privately, once per company, and is then never seen again. Here the argument, the tests and the failures are public from the beginning, so the consortium can work on the evidence itself instead of citing someone else’s summary of it.
The repository is candid about what does not work. WiFi transport currently sustains roughly a 98% soak reply rate, recorded as an open item rather than rounded up. The enclosure CAD and board schematics are marked work in progress. Commits landing this week add unit tests keyed to individually numbered requirements.
The device is unfinished and the evidence is incomplete. Both are visible anyway, which is the arrangement the consortium wants to make ordinary.