An action-chain model for the design of hazard-control systems for robots