A dead man’s switch keeps a hazardous operation or a risky change in force only while a responsible party keeps confirming it. Each confirmation arms a timer; on expiry the system stops or reverts to the last confirmed state. Silence, incapacity, a crashed client, and a lost connection all end safe.

It reverses the burden of proof of Watchdog Supervision: a watchdog continues until it detects a failure; a dead man’s switch stops unless someone vouches for continuation. The confirmer is the party accountable for the operation — driver, machine operator, engineer applying a remote change — not the component doing the work.

Timeline: each confirmation resets a timer. After the last confirmation the timer keeps rising, crosses a warning level, and on expiry the enforcer moves the system into the safe state or restores the last confirmed configuration.

How It Works

  • Define the fallback per operation: stop the motion, cut the drive, or restore the previous configuration.
  • Size the interval to how long the hazard may run unattended — seconds for machinery, minutes for a remote change.
  • Make each confirmation a deliberate act an absent person cannot produce: a pedal, a button, a confirm command.
  • Warn before expiry, so attentive operators confirm in time.
  • An independent enforcer executes the fallback locally — brake controller, safety relay, configuration daemon.
  • Remote changes apply provisionally with a scheduled rollback and commit only on explicit confirmation.

Failure Modes

  • Operators defeat the switch — a weight on the pedal, a confirming script — and the operation runs unattended.
  • Confirmation becomes a reflex, proving presence, not attention.
  • Intervals too short for the task cause nuisance stops, which invite bypasses.
  • Fallback and confirmation share one channel, so a lost link leaves an unconfirmed change in force.
  • The fallback is unsafe in context, e.g. a rollback reverting a security fix.
  • A startled operator clamps the control instead of releasing it.

Verification

  • Lapse test: withhold confirmation; the fallback completes within interval + warning + actuation tolerance (e.g. 30 s + 5 s + 1 s).
  • Channel-loss test: drop the confirmer’s session mid-change; the enforcer still reverts locally.
  • Revert fidelity: after expiry, the running configuration equals the last confirmed one.
  • Defeat check: zero sessions with machine-regular confirmation timing.
  • Nuisance-stop rate below an agreed threshold (e.g. < 1 per 100 operating hours).
  • Rail vigilance control: a missed acknowledgement triggers a warning, then the emergency brake.
  • Three-position enabling switches stop on release and on full squeeze, countering the panic grip.
  • Confirmed commit (RFC 6241) rolls back remote changes that cut off the operator.
  • Trial boot: new firmware confirms its own health, or the bootloader falls back to the previous image.
  • Leases apply the same expiry to machine authority (locks, leadership) — a distributed-coordination tactic.

References