6.10.4 Fail safe measures

What this heading covers

The safe state has to be defined for the product and its context. It might be a stop, a hold, a fallback to manual control or a restricted mode. The measure is whether the product reached it, how long it took, and whether it stayed there. A product that fails safe but cannot be restarted has a different quality result from one that recovers. The evidence is an injected failure or an observed one, not a design description.

Record position: family 38 of 40 in clause 6, under 6.10 Safety, which carries 5 families. It is one of the 40 families a programme has to map its measures to, and its elements are listed below. The heading is 6.10.4 in the public contents; the text behind it is not public.

How a measure for this family is built

Count the failure scenarios in which the product reached the defined safe state within the stated time as the numerator over the scenarios tested. Report the time to the safe state and the behaviour after it. Include a failure during the transition, because that is where safe states often break.

What to put in place before publication

1. Define the safe state for each failure mode before testing.
2. Test a failure that occurs during the transition to the safe state.

Evidence to keep

Two questions to ask

• What is the defined safe state for each failure mode?
• How long did the transition take, and what happened to a failure during it?

Where teams usually fall short

• A design note that says the system fails safe, with no failure exercised.

What the number cannot tell you

It cannot tell you whether the safe state is genuinely safe. That is a judgement about the state, made before the measure.

What happens next

Hazard warning is the family that depends on the user noticing and acting.