# Safety Design

> Generated from repository source files. Do not edit this page directly; edit the source file listed below and rerun `vp run docs:generate`.

> Source: `system/safety-design.md`

## Safety Design

Status: `needs confirmation`

## Core Principle

No single EEG classification event should directly trigger robot motion. Robot execution requires target selection, confirmation, and robot-side safety checks.

Safety gates are emitted as `Safety Gate Result` records in `system/runtime-interfaces.md` and routed through `system/state-machine.md`.

## Safety Controls

| Risk | Control | Verification |
| --- | --- | --- |
| wrong visual candidate | confidence threshold, candidate freeze, user confirmation | Exp1 error analysis |
| SSVEP false selection | consecutive-window rule, second confirmation | Exp1 false selection rate |
| MI false activation | no-control state and priority-limited command set | Exp2 false activation rate |
| target loss | TargetLost state and re-scan | Exp3 target lost rate |
| unsafe robot motion | workspace boundary, speed/force limits, collision checking | robot dry-run and Exp3 logs |
| user wants abort | MI or external emergency stop | unsafe command blocked count |

## Freeze Requirement

All safety thresholds must be recorded in `experiments/templates/threshold-freeze-record.md` before evidence-producing sessions. Post-hoc threshold changes are exploratory only.