Dead man's switch
A dead man's switch is a switch that is designed to be activated or deactivated if the human operator becomes incapacitated, such as through abandonment, drowsiness, loss of consciousness, death, or being bodily removed from control. Originally applied to switches on a vehicle or machine, it has since come to be used to describe other intangible uses, as in computer software.
These switches are usually used as a form of fail-safe where they stop a machine with no operator from a potentially dangerous action or incapacitate a device as a result of accident, malfunction, or misuse. They are common in such applications as locomotives, aircraft refuelling, freight elevators, lawn mowers, tractors, personal watercraft, outboard motors, chainsaws, snowblowers, treadmills, snowmobiles, amusement rides, and many medical imaging devices. On some machines, these switches merely bring the machines back to a safe or safer state, such as reducing the throttle to idle or applying brakes while leaving the machines still running and ready to resume normal operation once control is reestablished.
Dead man's switches are not always used to stop machines and prevent harm; such switches can also be used as a fail-deadly, since a spring-operated switch can be used to complete a circuit, not only to break it. This allows a dead man's switch to be used to activate a harmful device, such as a bomb. The switch that arms the device is only kept in its "off" position by continued pressure from the user's hand. The device will activate when the switch is released, so that if the user is knocked out or killed while holding the switch, the bomb will detonate. The Special Weapons Emergency Separation System is an application of this concept in the field of nuclear weapons. A more extreme version is Russia's Dead Hand program, which allows for either automatic or semiautomatic launch of nuclear missiles should a number of conditions be met, even if all Russian leadership were to be killed.
A similar concept is the handwritten letters of last resort from the prime minister of the United Kingdom to the commanding officers of the four British ballistic missile submarines. They contain orders on what action to take if the British government is destroyed in a nuclear attack. After a prime minister leaves office, the letters are destroyed unopened.
This concept has been employed with computer data, where sensitive information has been previously encrypted and released to the public, and the "switch" is the release of the decryption key, as with Vault 7.
A related device is a kill switch.
Background
Interest in dead man's controls increased with the introduction of electric trams and especially electrified rapid transit trains. The first widespread use came with the introduction of the mass-produced Birney One-Man Safety Car, though dead-man equipment was fairly rare on US streetcars until the successful PCC streetcar, which had a left-foot-operated dead man's pedal in conjunction with the right-foot-operated brake and power pedals. This layout has continued to be used on some modern trams around the world. In conventional steam railroad trains, there was always a second person with the engineer, the fireman, who could almost always bring the train to a stop if necessary. For many decades, two people were assigned to electric and diesel locomotives as well, even though a single person could theoretically operate them.With modern urban and suburban railway systems, the driver is typically alone in an enclosed cab. Automatic devices were already beginning to be deployed on newer installations of the New York City Subway system in the early 20th century. The Malbone Street Wreck on the Brooklyn Rapid Transit system in 1918, though not caused by driver incapacitation, did spur the need for universal deployment of such devices to halt trains in the event of the operator's disability. According to a Manhattan borough historian, there have been at least three instances where the dead man's switch was used successfully – in 1927, 1940, and 2010.
The status and operation of both vigilance and dead man's switch may be recorded on the train's event recorder. Modern locomotive practice is to incorporate the dead-man's and vigilance functions under the control of the alerter or the event recorder.
Types
Handle
Many dead man's switches are mounted in the control handle of a vehicle or machine and engage if the operator ever loses their grip.Vehicles
Handle switches are still used on modern trams and trains. Pneumatically or electrically linked dead man's controls involve relatively simple modifications of the controller handle, the device that regulates traction power. If pressure is not maintained on the controller, the train's emergency brakes are applied. Typically, the controller handle is a horizontal bar, rotated to apply the required power for the train. Attached to the bottom of the handle is a rod that when pushed down contacts a solenoid or switch inside the control housing. The handle springs up if pressure is removed, releasing the rod's contact with the internal switch, instantly cutting power and applying the brakes.Though there are ways that this type of dead man's control could conceivably fail, in practice they have proven highly reliable. On some earlier equipment, pressure was not maintained on the entire controller, but on a large button protruding from the controller handle. This button also had to be pressed continuously, typically with the palm of the hand so that the button was flush with the top of the handle. Another method used, particularly with some lever-type controllers, which are rotated rather than pushed or pulled, requires that the handle on the lever be turned through 90 degrees and held in that position while the train is in operation. Some dead man's controls only work in the mid position and not with full pressure.
In modern New York City Subway trains, for example, the dead man's switch is incorporated into the train's speed control. On the R142A car, the train operator must continually hold the lever in place in order for the train to move.
An example of a passenger vehicle using a dead man's switch is on Tesla electric vehicles. When the driver has engaged the semi-autonomous driving system "Autopilot", they must keep their hands on the steering wheel. If the driver takes their hands off the steering wheel for more than 30 seconds, a loud alarm will sound inside the car to wake sleeping drivers; if the driver leaves their hands off for more than a minute, then the car will engage its hazard warning lights and bring the car to a stop. This is done because the Autopilot system is not capable of full-self driving, and requires that the driver be able to take over operation of the vehicle without warning, should the car encounter a problem it does not know how to solve. This system uses a torque sensor on the steering wheel of the vehicle: when a driver is simply holding the wheel, they are still applying a small amount of torque to the wheel, confirming for the car that the driver is being attentive; if the driver turns the wheel with more force, all vehicle controls are handed back to the driver immediately.
Machinery
Handle-mounted dead man's switches are also used on many hand-held tools and lawn equipment, typically those that rotate or have blades such as saws, drills, snow blowers and lawn mowers. On saws for example, they incorporate a squeeze throttle trigger into the handle. If the user loses grip of the saw, the springs in the throttle trigger will push it back out to the off or idle setting, stopping the blade from spinning. Some tools go further and have a trigger guard built into the handle, similar to firearm safeties. Only when the user presses in the trigger guard first will it then release its lock on the trigger and allow the trigger to be pressed in. Typically, trigger guards can only be pressed in while the user has a firm grip of the handle.Every walk-behind mower sold in the US since 1982 has a dead man's switch called an "operator-presence control", which by law must stop the blades within three seconds after the user releases the controls. Attached across the handle is a mechanical lever connected by a flexible cable to the kill switch on the engine. While mowing, the operator must always squeeze the lever against the handle. If the operator ever loses grip of the handle, the blade will disengage or the engine will stop, stopping the blades from spinning and any drive wheels from turning. On mowers where the engine stops, this switch configuration also acts as the engine's main kill switch; when the operator wants to stop the engine, he can release the dead man's switch intentionally.
Touch sensor
On some vehicles, including the diesel-electric railway locomotives in Canada, and on Nottingham Express Transit vehicles, the tram's speed controller is fitted with a capacitive touch sensor to detect the driver's hand. If the hand is removed for more than a short period of time, the track brakes are activated. Gloves, if worn, have to be finger-less for the touch sensor to operate. A backup dead-man's switch button is provided on the side of the controller for use in the case of a failed touch sensor or if it is too cold to remove gloves.Pedal
A pedal can be used instead of a handle. While some pedal switches must simply be held down in order for the machine to function, this method has some shortcomings. In the Waterfall train disaster, south of Sydney, Australia, in 2003, the driver suddenly died of a heart attack, and his slumped body kept the pedal depressed.There are some solutions to this issue that are now used in modern pedal systems. The pedal can have a vigilance function built in, where drivers must release and re-press the pedal in response to an audible signal. This prevents it from being defeated by the above circumstances and is a standard feature on most British DSD systems. If the timer period is beginning to expire, a visual and audible warning is given. If the operator fails to acknowledge the warning, a penalty brake application results.
Some types of locomotive are fitted with a three-position pedal, which must normally be kept in the mid position. This lessens the likelihood of accidentally defeating it, although it may still be possible to deliberately do so. Adding a vigilance function to this type of pedal results in a very safe system. However, isolation devices are still provided in case of equipment failure, so a deliberate override is still possible. These isolation devices usually have tamper-evident seals fitted for that reason.