Skip to content
Software Architecture Guide

Safety Tactic

Explanation

Section titled “Explanation”

A safety tactic is a design technique that keeps a system in control of recognized or accepted dangers, called hazards. The arc42 Quality Model tags these approaches with #safe.

The tagged approaches include:

  • N-Version Redundancy and Voting
  • Timeout
  • Watchdog Supervision
  • Fail-Safe Defaults
  • Dead Man’s Switch
  • Safety Interlocks

They span detection, containment and redundancy.

Safety interlocks. An interlock is a barrier-style tactic. It puts an explicit gate in front of a hazardous operation. The gate checks preconditions before the operation may run. Its defining property is that it falls back to a safe state when it cannot allow the operation. Variants include the two-person rule and permit-to-work.

Fail-safe defaults. Interlocks and fail-safe defaults complement each other. An interlock checks preconditions before an operation. A fail-safe default decides where the system goes when something goes wrong.

Watchdog supervision. A watchdog is a detection tactic. An independent monitor finds hung components and bounds recovery time. The monitor must run in a separate failure domain from the component it supervises.

Watchdog supervision overlaps with availability tactics such as heartbeat and restart. See Availability Tactic and Heartbeat. The reasoning is that an undetected hang is worse than a restart.

Example

Section titled “Example”

A packaging machine has a press that could injure an operator. An interlock checks that the guard is closed before the press may move. If the check cannot be confirmed, the press stays off. A watchdog on a separate controller watches the main control program. If that program hangs, the watchdog notices and triggers a restart.

Trade-offs

Section titled “Trade-offs”

A watchdog with too short a heartbeat interval causes false-positive restarts. This means the system restarts although nothing is wrong. The interval needs careful tuning.

A watchdog must run in a separate failure domain. That requires extra, independent infrastructure.

An interlock gates a hazardous operation and defaults to a safe state; a watchdog detects hangs.

Diagram source 
flowchart TD
  A[Request hazardous operation] --> B{Interlock: preconditions met?}
  B -- yes --> C[Run operation]
  B -- no or unknown --> D[Safe state]
  C --> E[Watchdog monitors component]
  E -- hang detected --> F[Restart]

Checks

Section titled “Checks”
  • Each hazardous operation is guarded by an explicit interlock that checks preconditions and defaults to a safe state.
  • The document states which safe state the system enters when something goes wrong (fail-safe default).
  • Each watchdog monitor runs in a separate failure domain from the component it supervises.
  • Heartbeat intervals for watchdogs are chosen to avoid false-positive restarts.
Section titled “Related”

Sources

Section titled “Sources”