## 4 Methodology
### Prompting on Different Safety Levels  
In our safety-related decision making method, we consider as \"safe states\" the normal operation behavior of the system, and as safe \"control actions\" (CAs) the nominal actions under which the system operates without provoking any hazards. Moreover, we consider as \"unsafe states\" the hazardous situations of the system, which occur under the execution of an \"unsafe control action\" (UCA). During the STPA analysis, the unsafe states of the system along with the UCA of the studied controllers are extracted during the definition of the circumstances under which a loss scenario will occur. We employ the UCA and hazardous states and the normal operation states with their respective nominal CAs to determine the complete state space that define a collaborative workflow along their respective observations. These parameters can express an optimal policy \(\pi\), through a POMDP model, which can be utilized as a safety prompting model to continuously monitor the ongoing task. We interpret the collaborative tasks as a POMDP problem, the objective of which is to decide on each state the optimal action, in order to resolve the defined task with safety. We select to read the state and action space based-on the safety levels as dictated in the STPA analysis. This will provide our safety monitoring system with the equivalent loss scenarios. Since the state space is partially observable, it is conceptually grouped by defining blocks of states that correspond to discrete safety levels \(\overline{S}=\{S_{U},S_{R},S_{S}\}\). Herein, the state space is partitioned in three safety levels, namely _Unsafe_, _Recover_ and _Safe_. The states that belong to the \(S_{U}\) safety level group correspond to instances of the collaborative workflow that the system is completely unsafe and may lead to hazard situations. The \(S_{R}\) safety levels define the group of states within the collaborative task in which the robot/operator have already engaged in recover/corrective action and the level of hazard has been allayed. The states that may belong to the \(S_{S}\) safety level group dictate the instances in the collaborative workflow that the system is completely safe and the task propagates normally. The design principle behind the proposed POMDP formulation mechanism is schematically exhibited in Figure 2.  
The main advantage of the state space partitioning is that it indirectly defines groups of system actions, either performed by the robot or the operator, the context of which is related to the type of the intervention required for the completion of the collaborative task, given the current system safety level. Following the same strategy, the action space is partitioned as \(\overline{A}=\{A_{UCA},A_{RCA},A_{SCA}\}\). The \(A_{UCA}\) set corresponds to completely unsafe control actions, as defined from the STPA, that may lead the system to a hazardous situation; the \(A_{RCA}\) set reflects the set of recovery control actions applied from the robot or the operator in order to bring the system to a safer state or to avert an unsafe control action. The \(A_{SCA}\) set involves the safe control actions performed by the system to complete the collaborative task. In more detail, the \(A_{UCA}\) set involves all the faulty, erroneous and unsafe control actions identified during the STPA analysis and classified as potential fact for the violation of the system level constraints over the identified control loops in the collaborative workflow, such as inaccurate reporting of collision space, failure of the proximity mechanism, insufficient grasping, failure of human-machine interaction interfaces, malfunction of the task planner, communication drop in augmented reality engine, collapse of hardware sensors, etc. The selection and execution of such actions can lead to hazardous situations and eventually can provoke losses.