Specification · section 7

Safety model

The safety model is the reason MHP exists as a separate protocol rather than a set of MCP tools. Every rule below is enforced in the server, on the device side of the network, so it holds even when the agent is wrong, compromised, or has lost context.

7.1 Gate order

On every settings/write and actions/invoke the server evaluates, in this order, and stops at the first failure:

  1. StateEStopActive if in estop, DeviceFault if in fault.
  2. ApprovalForbidden for forbid items; ApprovalRequired for confirm items sent without approved: true.
  3. InterlocksEach named signal is read live at that moment. Any falsy value: InterlockOpen.
  4. LimitsNumeric range or enum: LimitViolation, with the limits in data.
  5. LeaseAnother client holds an unexpired lease: NotLeased.
  6. BusyA non-concurrent job is running: DeviceBusy.

Only after all six pass does vendor code run. dryRun: true stops after the sixth gate and reports what would have happened.

idlebusyfaultestop

7.2 Approval levels and elicitation

confirm is the bridge between agent autonomy and human oversight. The intended flow: the agent invokes open_lid and receives ApprovalRequired. The host shows the human a confirmation using the action's own notes ("Lid may be hot; a human should be present."). The human confirms, and the host re-sends the call with approved: true.

A host MUST NOT set approved: true on the model's say-so alone. Servers that can reach a human directly, through a touchscreen on the instrument or a physical key switch, MAY instead implement elicitation/confirm as a server-initiated request and wait for the answer in-band.

Over MCP the reference bridge closes this loop itself: when the harness declared the elicitation capability, a confirm-gated call makes the bridge ask the harness to put the question to the human, with the action, its parameters and the descriptor's notes; only an explicit accept re-sends the call approved, and the answer is written to the run log. Jobs can also be paused and resumed, so a person can step in without an emergency stop.

7.3 Fail closed

Any exception inside vendor code during a job moves the device to fault. Both fault and estop block all writes and invokes until an explicit safety/reset. There is no automatic recovery: a human or the agent must decide the device is safe to resume.

7.4 Defence in depth

Descriptor limits protect setpoints. Action parameters (a PCR step at 200 °C inside an otherwise valid protocol) are the driver's responsibility. Drivers SHOULD validate parameters against the same physical limits and MAY publish them under actions[].limits. The reference thermocycler does both.

7.5 What MHP does not do

MHP is not a functional-safety system in the IEC 61508 sense. Hard-wired e-stops, light curtains and PLC safety logic remain the primary layer. MHP is the layer that keeps an agent from asking for something unsafe, and gives it a standard way to stop everything when it sees something wrong.