# 安全设计

> 本页由仓库源文件生成。请不要直接编辑本页；修改下方 source 文件后运行 `vp run docs:generate`。

> 中文支持说明：本页是中文站点镜像，保留论文标题、证据状态和来源字段的原始表述，避免未经核实的翻译改变证据边界。

> 来源: `system/safety-design.md`

## Safety Design

Status: `needs confirmation`

## Core Principle

No single EEG classification event should directly trigger robot motion. Robot execution requires target selection, confirmation, and robot-side safety checks.

Safety gates are emitted as `Safety Gate Result` records in `system/runtime-interfaces.md` and routed through `system/state-machine.md`.

## Safety Controls

| Risk | Control | Verification |
| --- | --- | --- |
| wrong visual candidate | confidence threshold, candidate freeze, user confirmation | Exp1 error analysis |
| SSVEP false selection | consecutive-window rule, second confirmation | Exp1 false selection rate |
| MI false activation | no-control state and priority-limited command set | Exp2 false activation rate |
| target loss | TargetLost state and re-scan | Exp3 target lost rate |
| unsafe robot motion | workspace boundary, speed/force limits, collision checking | robot dry-run and Exp3 logs |
| user wants abort | MI or external emergency stop | unsafe command blocked count |

## Freeze Requirement

All safety thresholds must be recorded in `experiments/templates/threshold-freeze-record.md` before evidence-producing sessions. Post-hoc threshold changes are exploratory only.