High-Gain Degraded-Mode Trigger¶
Procedure — instantiates Opponent-Channel Regulation
Watches channel integrity and, the moment one side can no longer be trusted, drops the system into a low-gain conservative mode.
A High-Gain Degraded-Mode Trigger is the safety procedure that recognizes when an opposed pair can no longer be run at full strength and retreats to a conservative fallback. Its defining idea is that high gain is only safe while both channels are healthy and visible — the instant one side fails, saturates, lags, or goes dark, the calibrated opposition that made high gain precise becomes a runaway or a collapse waiting to happen. So the trigger continuously checks whether the pair is still trustworthy and, on failure of that check, deliberately reduces gain and switches to a simple, slow, safe behavior. It is a discrete switch into a fallback state, not a graded correction that keeps the system at full performance and not a running controller.
Example¶
An autonomous delivery vehicle governs its speed through an opposed pair: a throttle/acceleration channel that keeps it moving briskly and a braking/deceleration channel that keeps it safe, both tuned to a high gain that gives crisp, responsive motion in normal traffic. A High-Gain Degraded-Mode Trigger sits over the pair. It watches an integrity signal on each channel — brake actuator pressure, sensor confidence, the timing between commanded and actual deceleration. When a sensor's confidence drops below threshold on a foggy road, the trigger does not try to keep driving briskly with a compromised brake channel. It fires: the vehicle drops into a low-gain mode — a hard speed ceiling, wide following distances, gentle inputs only — and signals for takeover or a safe stop.
The point is that the system gives up performance to preserve safety the moment it can no longer trust the opposition. In full mode the brake and throttle shape a fast, precise response; in degraded mode neither channel is allowed to be strong, precisely because a strong channel opposed by an untrustworthy partner is the runaway the archetype most fears. The trigger's discipline is to make that transition automatic and early, before the compromised pair produces a bad output rather than after.
How it works¶
- Watch trust, not just output. Continuously read a per-channel integrity signal and an imbalance signal, so the trigger fires on loss of trustworthiness — a saturated brake, a dark sensor — not on an already-bad result.
- Cross a firm threshold. Define an explicit trip condition (integrity below X, or imbalance beyond Y) so the switch is unambiguous and does not dither at the boundary.
- Collapse the gain. On trip, reduce both channels to a low, safe gain and adopt a simple conservative behavior — the whole move is retreat to something dumb and survivable, not clever compensation.
- Latch and require deliberate recovery. Stay in degraded mode until the failed channel is confirmed healthy again, so the system does not flap in and out of safety on a marginal signal.
Tuning parameters¶
- Trip threshold — how degraded a channel must get before the trigger fires. A sensitive threshold retreats early and safely but sacrifices performance on false alarms; a coarse one preserves performance but risks tripping too late.
- Degraded-mode gain — how conservative the fallback is. A very low gain is maximally safe but nearly useless; a moderate one stays somewhat functional but carries more residual risk.
- Hysteresis — the gap between the trip-down and recover-up thresholds. Wide hysteresis prevents flapping but keeps the system degraded longer than strictly necessary; narrow hysteresis recovers fast but can oscillate.
- Recovery gate — what evidence is required to leave degraded mode. A strict gate (a full re-check) is safe but slow to restore performance; a lax gate restores fast but may re-enter a still-broken state.
When it helps, and when it misleads¶
Its strength is that it makes the archetype's "conservative fallback when either side becomes unavailable or untrusted" concrete and automatic. It converts a dangerous state — high gain over a compromised pair — into a safe one before harm occurs, and it does so by the honest route of giving up capability rather than pretending a broken pair can still be driven hard. This is the same logic as an automotive limp-home mode.[n1]
Its failure mode is that a fallback is only safe if the fallback itself is safe and the trip fires in time. A degraded mode that is still too aggressive, or a trigger tuned so conservatively it never fires — or so twitchy it flaps — defeats the purpose. The classic misuse is letting degraded mode become the de facto normal mode: the trigger fires so often that operators route around it or raise the threshold until it never protects anything. The guarding discipline is to treat frequent tripping as a signal to fix the underlying channel, not to desensitize the trigger, and to test the degraded behavior as carefully as the full one.
How it implements the components¶
degraded_mode_or_escape_path— the low-gain conservative fallback the system switches into on channel failure is exactly this component; providing it is the trigger's reason to exist.independent_channel_integrity_monitor— the trip decision reads a per-channel trust signal, checking each side's health separately rather than inferring it from net output.imbalance_observability_signal— it consumes a live imbalance reading to detect the dangerous state before it manifests as a bad output.
It reacts and retreats; it does not gently re-tune. The graded rebalancing_adjustment_rule that keeps the pair at full performance is the Push–Pull Controller Pair, and the anticipatory feedforward_brake_pathway that shapes a response at onset is the Feedforward Brake Circuit or Protocol.
Related¶
- Instantiates: Opponent-Channel Regulation — supplies the conservative fallback the pair falls back to when either channel can no longer be trusted.
- Consumes: Dual-Actuator Calibration Test defines the healthy bands whose violation the trigger watches for.
- Sibling mechanisms: Feedforward Brake Circuit or Protocol · Push–Pull Controller Pair · Excitation–Inhibition Ratio Dashboard · Dual-Actuator Calibration Test
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: High-Gain Degraded-Mode Trigger operates as a live operational control that automatically routes, enforces, adapts, or responds during execution because it watches channel integrity and, the moment one side can no longer be trusted, drops the system into a low-gain conservative mode
Independent corroboration: The frozen evidence defines High-Gain Degraded-Mode Trigger as 'Watches channel integrity and, the moment one side can no longer be trusted, drops the system into a low-gain conservative mode', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Convergent development
Present-day reach: Multi-domain
Rationale: Automatic retreat to conservative performance when a channel becomes untrustworthy is fail-safe and fault-tolerant engineering.
Related originating lineages:
- Aviation & Aeronautics — Degraded flight-control modes materially formalized capability reduction under sensor and actuator faults.
- Computer Science & Software Engineering — Graceful degradation and safe-mode operation independently developed in software and distributed services.
- Robotics & Automation — Automated control systems routinely implement gain reduction and safe fallback modes.
- Systems Thinking & Cybernetics — Opponent-channel integrity and gain regulation provide the broader control-theoretic framing.
Review resolution: Both reviewers independently assign engineering_design as the primary originating domain, so that shared primary is retained. Alternate domains are the union of reviewer-identified formative or independently originating lineages; later application settings alone are excluded. The record preserves independently developed forms rather than treating every alternate as mere application. It has established independent use across several domains, but that does not make it domain-free. The encyclopedia entry makes that composition explicit.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Limp-home mode is the automotive fail-safe in which an engine control unit, on detecting a sensor or actuator fault, restricts power and locks conservative settings so the car can still be driven slowly to safety. It trades performance for survivability the moment a subsystem can no longer be trusted — the same retreat this trigger performs on an opposed pair. ↩