Dead-Man Switch¶
Interface — instantiates Fail-Safe Default
A mechanism that requires a continuous human presence signal and enters a safe state when that signal disappears.
A Dead-Man Switch inverts the usual logic of a control: instead of acting when someone does something, it acts when someone stops. It demands a continuous positive signal of presence and control — a held lever, a periodically pressed pedal, a maintained grip — and treats the disappearance of that signal as evidence of lost control, tripping into the safe state on silence. Its defining idea is that absence is informative: an incapacitated, asleep, or absent operator produces exactly the same "no signal" as a healthy one who has walked away, and the mechanism is engineered so that either way the system must not be left running unsupervised. It is a detector that listens for a heartbeat and assumes the worst when the heartbeat stops. What it detects it hands off; it is not itself the actuator that shapes the stopped state.
Example¶
A freight locomotive is running a long night haul. Modern cabs carry a driver vigilance device: at pseudo-random intervals a light or tone prompts, and the driver must acknowledge by pressing a pedal or button within a few seconds. As long as those acknowledgments keep arriving, the device stays quiet and traction continues. On this run the driver suffers a silent medical event and slumps — no drama, no lever thrown, simply the acknowledgments stop. The vigilance device does not diagnose why the signal vanished; it only registers that the required confirmation is now absent, escalates through an audible alert, and — with no response — commands a penalty brake application that brings the train to a controlled stop before it can run away or overrun a signal at speed. The one thing that saved the situation was the absence of an input, read as loss of control rather than as normal quiet.
How it works¶
- Require a live confirmation. A held or periodically renewed signal is the price of continued operation; the default with no signal is "unsafe, stop."
- Prompt to distinguish inattention from incapacity. Random-interval challenges keep an operator from satisfying the check reflexively while zoned out.
- Timeout with escalation. A grace window, an attention-getting alert, then commitment to the safe state if the signal still does not return.
- Treat silence conservatively. Loss of the signal itself — a cut wire, a dead sensor — is read as loss of control, not as permission to continue.
Tuning parameters¶
- Challenge cadence — how often presence must be reasserted. Frequent checks catch incapacity sooner but fatigue and annoy, breeding defeat pressure.
- Grace window — how long silence is tolerated before commitment. Longer avoids nuisance trips from a momentary lapse; shorter shrinks the unsupervised interval.
- Confirmation modality — grip, pedal, or cognitive prompt. A held grip is simple but easily wedged; a randomized prompt resists gaming but demands attention.
- Escalation shape — straight to safe state, or alert-then-commit. Escalation rescues the merely distracted operator at the cost of a slower stop.
When it helps, and when it misleads¶
Its strength is covering the hazard no button can: the operator who can't act. Because it keys on absence, it protects against incapacitation, sleep, and abandonment — states in which an emergency stop would simply never be pressed. It also fails safe on its own wiring faults, since a broken signal path looks like silence.
Its failure mode is defeat: any control that must be continuously satisfied invites a workaround, and the folklore of dead-man controls is full of wedged pedals, taped-down grips, and weights on levers that convert the safeguard into decoration.[n1] The classic misuse is tuning the cadence so aggressively that operators disable it to get their job done — the safeguard's own nuisance becomes the reason it is bypassed. The guarding discipline is randomized, hard-to-spoof challenges plus tamper-evidence, so satisfying the check keeps requiring genuine presence rather than a rubber band.
How it implements the components¶
Dead-Man Switch fills the presence-detection slice of the archetype — the parts a continuous-confirmation control can own:
hazardous_failure_mode— it names one specific danger precisely: the system running on while the human meant to supervise it has lost the ability to act.failure_detector— the disappearance of the required continuous signal is the detection; silence, not an anomalous reading, is what it senses.manual_override— the held or renewed confirmation is a continuous human authorization to keep running, and deliberately releasing it is the operator's own path into the safe state.
It does NOT implement shutdown_or_isolation_rule as a deliberate human press, nor status_indicator — the pressed, latched, self-announcing control belongs to Emergency Stop; Dead-Man Switch fires instead on the absence of a signal via failure_detector, and delegates the actual stopping to a consumed actuator.
Related¶
- Instantiates: Fail-Safe Default — Dead-Man Switch supplies the presence-keyed detector that assumes lost control from silence.
- Consumes: Trip Switch or Circuit Trip — the vigilance device detects, then relies on a brake/traction cutoff to actually enter the safe state.
- Sibling mechanisms: Emergency Stop · Trip Switch or Circuit Trip · Automatic Shutdown · Fail-Closed or Fail-Open Design · Safe Mode · Watchdog Timer · Containment on Alarm
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Dead-Man Switch operates as a live operational control that automatically routes, enforces, adapts, or responds during execution because it a mechanism that requires a continuous human presence signal and enters a safe state when that signal disappears.
Independent corroboration: The frozen evidence defines Dead-Man Switch as 'A mechanism that requires a continuous human presence signal and enters a safe state when that signal disappears', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Safety engineering cohered presence controls that require a continuous operator signal and treat its disappearance as loss of control, triggering transfer toward a safe state.
Related originating lineages:
- Aviation & Aeronautics — Rail and transport vigilance systems institutionalized dead-man controls and later randomized challenges against circumvention.
Review resolution: Safety engineering established continuous-presence controls that fail safe on operator loss; transport vigilance systems are the direct formative lineage.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
Dead-Man Switch and Watchdog Timer are near cousins — both trip on a missing periodic signal — but the source differs: a dead-man switch listens for a human presence signal, a watchdog listens for a machine controller's heartbeat. That distinction decides which one you reach for: incapacitated operator versus hung processor.
[n1] The driver vigilance device (or "driver safety device") is the standard rail implementation of dead-man logic. Its long service history is also a catalogue of the mechanism's central weakness: crews have historically found ways to satisfy or defeat continuous-hold controls, which is why modern designs randomize the challenge rather than accept a single held input. ↩