Fail-safes

A fail-safe is behavior designed so that when something goes wrong, the system ends up in a safe state rather than a dangerous one. A drone that loses its radio link might hover and then return home; a train that loses brake pressure stops instead of rolling on. A classic mechanism is the watchdog timer: a hardware countdown that the software must keep resetting, and if the code freezes and stops checking in, the watchdog reboots the system or triggers the safe action. The key design question is always “what does safe mean here?”, because sometimes stopping is safe and sometimes, like for a plane mid-flight, it isn’t.