Safety

Fail-operational

ActivePublished: 24 October 2026Updated: 24 October 2026Published

Key innovation

Instead of shutting down into a safe state after a fault, the system keeps performing its function (at least in a degraded form), enabling autonomy without a human fallback.

How it works

The system duplicates or triplicates critical paths — power, compute, sensors, and steer-by-wire and brake-by-wire actuators. A fault detection and isolation module identifies the failed channel, and arbitration or majority voting (e.g. TMR) rejects erroneous outputs. After losing a channel the system enters a degraded mode, delivering the minimum required function (e.g. a safe stop manoeuvre) while retaining controllability. For redundancy to be effective the channels must be independent, which limits common-cause failures.

Problem solved

In autonomous systems that lack a human fallback (SAE L4/L5 vehicles, unmanned aircraft), an immediate shutdown after a fault is itself hazardous. Fail-operational ensures that a single fault does not strip the system of its ability to continue or end the mission in a controlled, safe manner.

Components

Redundant channelsProvide a backup path for the function after one element fails.

Duplication of critical components in a dual or triple modular redundancy (TMR) arrangement; with TMR all three subsystems must fail for the whole system to fail.

Fault detection and isolation (FDI)Detects the faulty channel and isolates it from the function.

Monitors channel behaviour and recognises errors (e.g. bad data value, missing message), enabling reconfiguration.

Arbitration / majority votingSelects the correct output among redundant channels.

In a TMR architecture a single component's error is out-voted by the other two (majority voting / voting logic).

Degraded-mode controllerMaintains a minimum safe function after loss of redundancy.

After a fault switches the system into a limited operating mode performing a safe manoeuvre (e.g. a controlled stop) instead of an abrupt shutdown.

Implementation

Implementation pitfalls

Common-cause failuresHigh

Redundancy fails when all channels share the same vulnerability (e.g. a lightning surge, a common power bus, an identical software bug).

Fix:Independent power buses, physical and electrical separation, and dissimilar redundancy (N-version programming).

Redundancy complexity reducing reliabilityMedium

Redundancy can yield less, not greater, reliability: it creates a more complex system, invites human neglect of duty, and may overstress the system through higher demands.

Fix:Limiting unnecessary complexity, rigorous validation of arbitration mechanisms, and clear ownership of maintenance.