Fail-Safe State

The fail-safe state must be achieved passively without relying on the active execution of complex software or continuous power. It leverages stored potential energy (e.g., springs) or intrinsic physical forces (e.g., gravity, friction).

• Spring-Applied Brakes: Brakes that engage automatically when hydraulic or electric power is cut.
• De-energized Locking: Mechanisms that lock a joint or gimbal when the motor torque falls below a threshold.
• Aerodynamic Drag: A fixed-wing drone entering a stable, descending spiral without thrust.

The transition to a fail-safe state must be provably deterministic. The system must not rely on probabilistic machine learning models to decide how to fail. The logic is typically hard-coded in a watchdog timer or a hardware interrupt service routine.

• Finite State Machine: The failure handler is a simple, auditable FSM, not a neural network.
• Bypass Logic: The safety controller physically bypasses the main autonomy stack to actuate the safe stop.
• Example: A robot arm immediately cuts motor torque and engages joint brakes upon a heartbeat signal loss, ignoring all other sensor inputs.

The primary objective is to dissipate or contain hazardous energy forms—kinetic, potential, electrical, thermal, or chemical—to a level below the harm threshold.

• Kinetic Energy: Braking to a full stop or reducing speed to a non-injurious crawl.
• Potential Energy: Lowering a suspended load to the ground or locking a robotic arm in a low-energy posture.
• Electrical Energy: Activating a crowbar circuit to safely discharge high-voltage capacitors.
• Thermal/Chemical: Shutting off fuel valves and venting pressure in a controlled manner.

A fail-safe state must be triggered autonomously when the heartbeat signal between the agent and the orchestrator is lost. The agent cannot wait indefinitely for a command that will never arrive.

• Timeout Threshold: A configurable duration (e.g., 500ms) after which a comms loss is declared.
• Last Known Command: The agent either completes its last atomic command and stops, or immediately halts, depending on the risk profile.
• Return-to-Base Logic: A secondary, low-bandwidth radio may trigger a slow, safe return to a predefined docking station if the primary link fails.

The system must guarantee a safe state even during a catastrophic power loss. This requires energy storage (supercapacitors or batteries) dedicated solely to the safety function.

• Hold-Up Capacitors: Provide enough energy to power the braking circuit and flash a warning beacon for several seconds after main power is cut.
• Non-Volatile Memory: The system's last known safe state and diagnostic snapshot are written to NVM during the power-down sequence.
• Example: A mobile robot with a 0% main battery still has enough reserve power to engage its electromechanical parking brake and prevent rolling on an incline.

The fail-safe state is often synonymous with achieving a Minimal Risk Condition (MRC) as defined in safety standards like ISO 21448 (SOTIF). The MRC is the specific, pre-defined safe posture for a given operational context.

• Highway MRC: A vehicle comes to a controlled stop in the safest available location, activating hazard lights.
• Warehouse MRC: An AMU (Autonomous Mobile Unit) stops immediately, lowers its forks, and enters a safe torque-off state.
• Airborne MRC: A drone executes a controlled descent and landing at its current GPS coordinates, broadcasting a distress signal.

The specific, stable safe state to which an agent must default upon failure. This is the target outcome of a fail-safe state mechanism. Examples include a robot coming to a complete stop in a designated safe zone, a drone executing a controlled landing, or a vehicle pulling onto the shoulder. The MRC is defined during the system's safety analysis and is the ultimate guarantee against uncontrolled hazards.

A hardware or software timer that triggers a fail-safe state transition if not periodically reset by the main control program. It prevents the system from hanging indefinitely due to a software crash or infinite loop. If the heartbeat signal from the control loop stops, the watchdog expires and forces an immediate, pre-programmed safe action, such as cutting motor power or engaging brakes.

A real-time safety mechanism that continuously monitors an autonomous system's actions and intervenes to prevent violations of predefined safety invariants. RTA acts as a formal safety envelope, switching the system to a fail-safe state if an action is about to breach a boundary. It is an unbypassable, independent monitor that does not rely on the primary autonomy stack functioning correctly.

A physical or digital emergency mechanism that immediately cuts all power to actuators or terminates all active processes. Unlike a graceful fail-safe state, a kill switch provides an instantaneous, non-recoverable halt. It is the ultimate manual override for a malfunctioning agent, often implemented as a physical E-Stop button on the agent or a software command in the operator workstation.

A periodic signal sent from an agent to the central orchestrator to confirm it is still operational and connected. The absence of a heartbeat triggers a loss-of-comms safety protocol, forcing the agent into its fail-safe state. This is a critical component of fleet health monitoring, ensuring that communication loss is treated as a failure condition requiring immediate safety intervention.

Structured processes for managing agent failures, task errors, and other operational exceptions. These frameworks define the escalation path from a detected anomaly to a fail-safe state. They categorize failures by severity and type, triggering appropriate responses such as:

• Retry with backoff
• Degrade to a reduced capability mode
• Escalate to a human operator
• Halt to a minimal risk condition