ROS 2 Lyrical Luth · Lesson 79 of 86

Safety systems

Watchdogs, emergency stop, safe velocities and failing safe.

Estimated time · 60–90 min

Learning goals

What you will understand

Explain safety systems in your own words
Use it in a small robotics example
Verify the result instead of assuming it worked

Understand the idea first

The mental model

A safe robot fails into a safe state: if a command, sensor or heartbeat goes missing, it stops. A watchdog checks that fresh commands keep arriving (for example every 100 ms) and outputs zero velocity when they do not. An emergency stop should act through hardware that does not depend on ROS software.

Software layers add protection: velocity and acceleration limits, a collision monitor that slows or stops near obstacles, geofences and speed zones. This course teaches simulation-first practice; a real robot needs a risk assessment, certified safety hardware (safety lidars, e-stops) and compliance with standards such as ISO 13849 and ISO 3691-4. Software checks alone are never a safety function.

Guided lesson

Work through these steps

1.
Source the ROS 2 Lyrical environment in a fresh terminal.
2.
Read the safety systems example and identify what each line does.
3.
Build only the affected package, source the workspace overlay, and run the example.
4.
Inspect the result from a second terminal with the ros2 CLI or RViz2 and compare it with the expected result.

Worked example

Read it before you run it

auto age = now() - last_cmd_time_;
// How long since the last command arrived.
if (age > rclcpp::Duration::from_seconds(0.5)) {
// Older than half a second means the source is lost.
  geometry_msgs::msg::Twist stop;
// A zero-velocity command.
  cmd_pub_->publish(stop);
// Stop the robot.
  RCLCPP_WARN_THROTTLE(get_logger(), *get_clock(), 1000, "command timeout: stopping");
// Tell the operator, once per second.
}
// End of the timeout branch.

What the example is doing

1.The ros2 commands query the running graph; they do not prove that a node's internal behavior is correct.
2.Build from the workspace root, then source install/setup.bash so the shell can discover the new package.
3.Use a second sourced terminal to inspect nodes and interfaces while the example runs.

Watch it run · The robot's computer

See what this code does

The terminal types this lesson's practice solution and runs it. The scene shows the kind of robot behaviour that code drives. It plays by itself and loops.

Practice code

Now type it yourself

Copy the starter into practice.cpp and replace every TODO with your own code. Build and run it: g++ -std=c++17 -Wall -Wextra -Wpedantic practice.cpp -o practice -pthread && ./practice

#include <iostream>

int main() {
  const double last_command_age_s = 0.8;
  const double timeout_s = 0.5;
  // TODO: print "STOP" when the last command is older than the timeout, otherwise "RUN"
  return 0;
}

Expected output

STOP

Stuck? Show the full solution (try it yourself first)

#include <iostream>

int main() {
  const double last_command_age_s = 0.8;
  const double timeout_s = 0.5;
  if (last_command_age_s > timeout_s) std::cout << "STOP\n";
  else std::cout << "RUN\n";
  return 0;
}

Expected result

How you know it worked

ROS_DISTRO is lyrical in every terminal used for the exercise.
The complete package from the exercise builds and the expected graph entity appears in a second terminal.

Practical exercise

Apply the lesson

Add a 0.5 s command watchdog and a velocity limiter to a simulated robot, kill the teleop node while driving, and confirm the robot stops. Write a short list of hazards that software cannot cover.

Before you continue

ROS_DISTRO reports lyrical in every terminal you used
The example builds and runs without errors
You checked the result with a ros2 command, RViz2 or a test, not just by reading the code

If something goes wrong

ros2 cannot find a package or executable.

Source /opt/ros/lyrical/setup.bash, build from the workspace root, then source install/setup.bash in that terminal.

Nodes run but cannot discover each other.

Confirm both terminals use Lyrical, the same ROS_DOMAIN_ID, and compatible network/discovery settings.