Imagining the worst is part of all good Risk Assessments.
But you don't just tick the box and say, "catastrophic", you are legally obliged to do something
Regulation 19 of PUWER 1998, insists you must be able to "isolate your equipment from all it's sources of energy".
Obama the pony is very clearly the source of energy.
IPRS isolates Obama from his Obamobile 3.
The IPRS can operate four different ways to release the pony.
The vehicle only remains attached is a small electric current is flowing through the IPRS circuit. If anything breaks the circuit, the pony is released. This is called fail safe. If anything fails, (flat battery, loose connection, broken wire) the system reverts to a safe mode, in this case with the pony isolated from the vehicle.
There are four ways of deliberately breaking that circuit:
Manually with a rip cord,
Manually with a red "Panic Button",
Remote elctronic release button, (NOT Fail Safe)
Automatic, if the operator is more than 10 metres from the vehicle..
Rip Cord.
For years this was the only system. I invented it in 2005 for the Saddlechariot after an excessivley unfunny and painful accident. Initially the rip cord operated a manual release, but this is vulnerable as the pressure on the release point from a bolting pony increases the friction on the mechanical release, risking failure of the rip cord parts. It never did, but I definitely felt it was a major vulnerability.
The ripcord now pulls three jackplugs out of their sockets. I use three jackplugs because the jackplugs that work best, don't provide a 100% connection. Using three gives a better resistance to the pull, and ensures a 100% electrical connection until pulled.
The Panic Button
This tends to be on and off unpredictably. Because I work with Neurodivergent children and adults, I don't want a big, tempting red button saying "push me". Equally if it isn't clear and obvious to everyone, it is unlikely to work. Therefore I have a button I can attach if needed. With three other systems I frequently run without it. But for the South Downs Way trip, it will be there.
The wireless Remote system gives the pony operator a hand held push button to allow instant pony release. The downs side is that this particular system is sending an occasional "release me" signal, while the Automatic release is sending a "stay attached" signal every second. If the Automatic dongle fails, the pony is released, but if the wireless remote fails, that doesn't happen. BUT
The Automatic Pony Release does what it says on the box. If the vehicle is more than 10 metres from the operator, the pony is released automatically. Therefore if the Wirelss Remote fails as mentioned above, and the pony bolts, when the vehicle has gone 10 metres away from the operator, it is released.
Tilt sensors.
These are of limited use as the vehicle is incredibly stable, but if the environment needs it they can be added very simply. If the vehicle is tilted more than x degrees sideways or y degrees fore and aft, it will disconnect.
Bumper sensors.
These are useful in a school setting but a nuisance cross country. Where the surface is not tussocky grass, brambles or scrub the bumpers are springloaded and if the force is above 20 Newtons, the pony is released. These are obviously variable for height, and sensitivity. If you are in a crowded school playground they are necessary.
Location sensors.
It is possible to geofence the vehicle if you have people who want to drive solo, and you can map out an area where they can drive, and if they deviate, the pony is released.