Preconditions

• Robot turned ON, all Preflight done, and MOT-4 (Roll around) has passed.
• Clear physical space around the robot; nobody within its reach envelope.
• Rolling velocity set to the minimum usable value (0.25 m/s) — the robot is

stopped deliberately, so it is stopped slowly.

• The number and location of every emergency-stop button on this unit is known

before starting (MCT-1 releases "all the emergency stop(s)" — enumerate them).

• Camera ready: each stop is recorded as evidence.

Steps

1. Note which e-stop button is under test (start with button 1).
2. Command the robot to roll forward at 0.25 m/s (MOT-4 procedure).
3. While the robot is moving, press the e-stop under test.
4. Observe and record: does motion stop, how far does it travel after the press,

and does the robot hold its posture or collapse.

1. Release the e-stop. Do not send any new command.
2. Observe: the robot must remain stopped — it must not resume the previous motion.
3. Re-arm the robot per MCT-1 and confirm it can roll again.
4. Repeat steps 1–7 for every remaining e-stop button on the unit.

Expected

• Motion ceases when the e-stop is pressed, with no continued travel beyond the

coast recorded in step 4.

• The robot does not collapse or drop under its own weight when stopped.
• Releasing the e-stop does not resume motion — restarting requires an

explicit new command (no automatic restart).

• The robot returns to a commandable state after re-arming.
• Every e-stop button on the unit behaves identically — none is a special case.

Notes

• Irreducibly manual: the verdict needs a physical press and a human watching.

Not an automation candidate, unlike most of this domain.

• The pass threshold is not yet a number. "Stops immediately" is not testable,

so step 4 records the observed stopping distance and time as evidence. Once a safety requirement fixes a limit, this test gets that limit and the recorded runs become the baseline it is judged against.

• First candidate for the safety.* frontmatter block (§4.2). Left unset until P5

defines requirement IDs — an empty sil_claim would be noise, not traceability.

• The e-stop appears in MCT-1/2/3/4 today, but only as a precondition or as a way

to power the robot off. This is the first test of it as a safety function.