Dead man's switch
 | This article needs additional citations for verification. (August 2011) |
A dead man's switch (for other names, see alternative names) is a switch that is automatically operated in case the human operator becomes incapacitated, such as through death or loss of consciousness.
The switch, a form of fail-safe, is usually wired so that it stops a machine by breaking a series circuit, although a spring-operated "dead man's switch" can be used to activate a system by completing a circuit when it is no longer held down (as in some explosive vests detonated by suicide bombers). Switches of the former type are commonly used in locomotives, aircraft refuelling, freight elevators, lawn mowers, tractors, personal watercraft, outboard motors, chainsaws, snowblowers, tread machines, snowmobiles, and many medical imaging devices.
A dead man's switch may also be used to activate a harmful device, such as a bomb or IED. The user holds down a switch of some sort in their hand which arms the device. When the switch is released, the device will activate, so that if the user is killed while holding the switch, the switch will be released and the bomb will detonate (i.e. fail-deadly). The Special Weapons Emergency Separation System is an application of this concept in the field of nuclear weapons (see Dead Hand (nuclear war)).
A similar concept has been employed with computer data, where the "switch" is a decryption key that can release sensitive information, as with the WikiLeaks "Insurance File".
Background
Interest in dead-man's controls increased with the introduction of electric streetcars and especially electrified rapid transit trains, though dead-man equipment was quite rare on US streetcars until comparatively recently. In conventional steam railroad trains, there was always a second person with the engineer, the fireman, who could almost always bring the train to a stop if necessary. For many decades this practice continued on electric and diesel locomotives, even though a single person could theoretically operate them.
With modern urban and suburban railway systems, the driver is typically alone in an enclosed cab. Automatic devices were already beginning to be deployed on newer installations of the New York City Subway system in the early 20th century. The Malbone Street Wreck on the Brooklyn Rapid Transit system in 1918, though not caused by driver incapacitation, did spur the need for universal deployment of such devices to halt trains in the event of the operator's disability. According to Manhattan borough historian Michael Miscione, there have been at least three instances where the dead-man's switch was used successfully – in 1927, 1940, and 2010.[1]
Types
Handle
Pneumatically or electrically linked dead-man's controls, still used today, involve relatively simple modifications of the controller handle, the device that regulates traction power. The main requirement is that the train's emergency brakes are applied if pressure is not maintained on the controller.
Typically, the controller handle is a horizontal bar, rotated to apply the required power for the train. Attached to the bottom of the handle is a rod which, when pushed down, contacts a solenoid or switch inside the control housing. The handle springs up if pressure is removed, releasing the rod's contact with the internal switch, instantly cutting power and applying the brakes.
Though there are ways that this type of dead-man's control could conceivably fail, they have proven highly reliable.
On some earlier equipment, pressure was not maintained on the entire controller, but on a large button protruding from the controller handle. This button also had to be pressed continuously, typically with the palm of the hand so that the button was flush with the top of the handle. Another method used, particularly with some lever-type controllers, which are pushed or pulled rather than rotated, requires that the handle on the lever be turned through 90 degrees and held in that position while the train is in operation.
Some dead-man's controls require the motorman to hold it in the mid-position rather than apply full pressure (see pilot valve).
In modern New York City Subway trains, for example, the dead man's switch is incorporated into the train's speed control. On the R142A car, the train operator must continually hold the lever in place.
Every lawn mower sold in the US since 1982 has an "operator-presence" device, which by law must stop the blades within 3 seconds after the user lets go of the controls.[2]
Touch sensor
On the diesel-electric railway locomotives in Canada, and on Nottingham Express Transit vehicles, the tram's speed controller is fitted with a capacitive touch sensor to detect the driver’s hand. If the hand is removed for more than a short period of time, the track brakes are activated. Gloves, if worn, have to be finger-less for the touch sensor to operate. A back up dead-man's switch button is provided on the side of the controller for use in the case of a failed touch sensor or if it is too cold to remove gloves.
Pedal
A pedal can be used instead of a handle. In the Waterfall train disaster, South of Sydney, Australia in 2003, it appeared that the driver slumped on his seat, keeping the pedal depressed when he died suddenly of a heart attack. This also happened to a Canadian National Railway Railliner passenger train in the 1970s, but the problem was noticed by other crew members and the train safely halted. In the movie Silver Streak, a man hijacks the train and keeps it running by placing a heavy toolbox on the pedal.
The pedal can also have a vigilance function built in, where drivers must release and re-press the pedal in response to an audible signal. This prevents it from being defeated by the above circumstances, and is a standard feature on British DSD systems.[3]
Some types of locomotive are fitted with a three-position pedal, which must normally be kept in the mid-position. This also lessens the likelihood of accidentally defeating it, although it may still be possible to deliberately do so. Adding a vigilance function to this type of pedal results in a very safe system. However, isolation devices are still provided in case of equipment failure, so a deliberate override is still possible. These isolation devices usually have tamper-evident seals fitted for that reason.
Seat switches
On modern tractors, the switch is beneath the seat, and will cut the engine if the operator gets off the tractor while the transmission is engaged or the power take-off is spinning.
Key switches
On recreational vehicles, such as boats with outboard motors, snowmobiles, jet skis and waverunners, the user has the ignition key attached to his wrist or waist by a leash. The key will be removed from the ignition switch if the rider falls off the vehicle, thus turning off the engine or setting the throttle position to "idle". Some luggage carts at airports and exercise treadmills have this feature. In the case of treadmills, they are designed to stop the treadmill if the user falls. The dead man switch on a treadmill usually consists of an external magnet controlling the circuitry that provides power to the treadmill belt.
Altimeter switches
Strategic Air Command developed a dead man's switch for its nuclear bombers, known as Special Weapons Emergency Separation System (SWESS), that ensured the nuclear payload detonated in the event of the crew becoming incapacitated through enemy action. The purpose of this device, unlike other examples mentioned above, was to fail-deadly rather than fail-safe. Once armed, the system would detonate the onboard nuclear weapons if the aircraft's altitude dropped below a predetermined level.[4]
Vigilance control
The main safety failing with the basic dead man’s system is the possibility of the operating device being held permanently in position, either deliberately or accidentally. Vigilance control was developed to detect this condition by requiring that the dead man’s device be released momentarily and re-applied at timed intervals.
There has also been a proposal to introduce a similar system to automotive cruise controls[citation needed].
A hybrid between a dead man's switch and a vigilance control device is a dead-man's vigilance device.
Software uses
Software versions of dead man's switches are generally only used by people with technical expertise, and can serve several purposes; such as sending a notification to friends or deleting and encrypting data. The "non-event" triggering these can be almost anything, such as failing to log in for 7 consecutive days, not responding to an automated e-mail, ping, a GPS-enabled telephone not moving for a period of time, or merely failing to type a code within a few minutes of a computer's boot. An example of a software based dead man's switch is Dead Man's Switch which starts when the computer boots up and can encrypt or delete user specified data if an unauthorised user should ever gain access to the protected computer.[5]
Spacecraft uses
Many spacecraft use a form of dead man's switch to guard against command system failures. A timer is established that is normally reset by the receipt of any valid command (including one whose sole function is to reset the timer.) If the timer expires, the spacecraft enters a "command loss" algorithm that cycles through a predefined sequence of hardware and/or software modes (such as the selection of a backup command receiver) until a valid command is received. The spacecraft may also enter a safe mode to protect itself while waiting for further commands.
While having some similarities to a dead man's switch, this type of device (a command loss timer) is not actually a dead man's switch, because it aims to recover from a hardware failure rather than the absence of human operators. It is generally called a watchdog timer, and is also used extensively in nuclear power control systems. System components on a spacecraft that put it into a safe mode or cause it to execute default behaviors when no command is received within a predefined time window can be considered a dead man's switch, but hardware or software that attempts to receive a command from human operators through an alternate channel is an auto-recovering or adaptive communications system, not a dead man's switch.
Voyager 2 recovered from a command receiver failure with a command loss timer.[6]
Alternative names
- Replacement of "switch" with "control" or name denoting a specific type of switch, e.g., "button"/"trigger"/"pedal"/"handle"/"brake"
- Replacement of "dead man's" or "dead-man" with "live-man" (commonly used in the robotics industry)
- "Driver's Safety Device" ("DSD") (the official term in the UK for switches of this type as used on railway trains)
- "Operator Presence Control" ("OPC")
- "Vigilance control"
- "Alerter system" (in higher-order systems in which the switch activates to sound an alarm rather than deactivates to disable the higher-order system)
Event recording
The status and operation of both the vigilance and dead-man's may be recorded on the train's event recorder (commonly known as a black box).
See also
References
- ^ Newman, Andy (May 7, 2010). "Not the First Time the 'Dead-Man' Switch Did Its Job". The New York Times. Retrieved May 7, 2010.
{{cite news}}: Cite has empty unknown parameter:|coauthors=(help) - ^ http://www.uaex.edu/Other_Areas/publications/HTML/FSA-1005.asp
- ^ http://locodocs.co.uk/brmanuals/DSD-33056-4-Issue1.htm
- ^ Sagan, Scott Douglas (1995). The Limits of Safety. Princeton University Press. pp. 187–188. ISBN 0-691-02101-5. Retrieved 2008-11-16.
- ^ http://www.smartstarttools.com/software.htm
- ^ Voyager Support, DSN Progress Report 42-49, Jet Propulsion Laboratory, November-December 1978. Retrieved 4 March 2009.