17
DraftS05-CON-010v0.1Source imported
Section 84 of 102
83. Fail-Safe Behavior and Graceful Degradation
Stable section ID: S05-CON-010-SECTION-84 · 20 content blocks
System05 agents and connected systems shall fail toward a condition appropriate to the affected hazard.
Fail-safe behavior may include:
- Maintaining the last verified safe setting.
- Stopping motion.
- Removing non-essential energy.
- Preserving ventilation or freeze protection.
- Restricting access.
- Returning control to deterministic systems.
- Requesting human intervention.
- Entering local manual mode.
The correct fail-safe condition may differ by system. Loss of communication should not automatically close, open, energize, or de-energize every device without regard to physical consequence.
Graceful degradation shall preserve unaffected capabilities while restricting those that can no longer operate reliably.
A degraded state shall identify:
- The failed dependency.
- Affected capabilities.
- Remaining functionality.
- Current limitations.
- Required manual actions.
- Recovery conditions.
- Degradation shall not remain hidden behind apparently normal user interfaces.