Dead man's switch

A foot pedal acting as a dead man's switch in a bucket lift truck

A dead man's switch (for other names, see alternative names) is a switch that is automatically operated if the human operator becomes incapacitated, such as through death, loss of consciousness, or being bodily removed from control. Originally applied to switches on a vehicle or machine, it has since come to be used to describe other intangible uses like in computer software.

These switches are usually used as a form of fail-safe where they stop a machine with no operator from potentially dangerous action or incapacitate a device as a result of accident, malfunction, or misuse. They are common in such applications in locomotives, aircraft refuelling, freight elevators, lawn mowers, tractors, personal watercraft, outboard motors, chainsaws, snowblowers, tread machines, snowmobiles, amusement rides, and many medical imaging devices. On some machines, these switches merely bring the machines back to a safe state, such as reducing the throttle to idle or applying brakes while leaving the machines still running and ready to resume normal operation once control is reestablished.

Dead man's switches are not always used to stop machines and prevent harm. These switches can also be used as a fail-deadly. A spring-operated switch can also be used to complete a circuit when it is no longer held down. This means that a dead man's switch may be used to activate a harmful device, such as a bomb or IED. The user holds down a switch of some sort in their hand which arms the device. The device will activate when the switch is released, so that if the user is knocked out or killed while holding the switch, the bomb will detonate. The Special Weapons Emergency Separation System is an application of this concept in the field of nuclear weapons. A more extreme version is Russia's Dead Hand program, which allows for automatic launch of nuclear missiles should a number of conditions be met, even if all Russian leadership were to be killed. A similar concept has been employed with computer data, where sensitive information has been previously encrypted and released to the public, and the "switch" is the release of the decryption key, as with WikiLeaks' "insurance files".

Background

Interest in dead-man's controls increased with the introduction of electric streetcars and especially electrified rapid transit trains, though dead-man equipment was quite rare on US streetcars until the successful PCC streetcar, which had a left-foot operated dead-man's pedal in conjunction with the right-foot operated brake and power pedals. This layout has continued to be used on some modern trams around the world. In conventional steam railroad trains, there was always a second person with the engineer, the fireman, who could almost always bring the train to a stop if necessary. For many decades this practice continued on electric and diesel locomotives, even though a single person could theoretically operate them.

With modern urban and suburban railway systems, the driver is typically alone in an enclosed cab. Automatic devices were already beginning to be deployed on newer installations of the New York City Subway system in the early 20th century. The Malbone Street Wreck on the Brooklyn Rapid Transit system in 1918, though not caused by driver incapacitation, did spur the need for universal deployment of such devices to halt trains in the event of the operator's disability. According to a Manhattan borough historian, there have been at least three instances where the dead-man's switch was used successfully – in 1927, 1940, and 2010.[1]

The status and operation of both vigilance and dead-man's switch may be recorded on the train's event recorder (commonly known as a black box).

Types

Handle

Most dead man's switches are mounted in the control handle of a vehicle or machine and engage if the operator ever loses their grip.

Vehicles

Handle switches are still used on modern trams and trains. Pneumatically or electrically linked dead-man's controls involve relatively simple modifications of the controller handle, the device that regulates traction power. If pressure is not maintained on the controller, the train's emergency brakes are applied. Typically, the controller handle is a horizontal bar, rotated to apply the required power for the train. Attached to the bottom of the handle is a rod that when pushed down contacts a solenoid or switch inside the control housing. The handle springs up if pressure is removed, releasing the rod's contact with the internal switch, instantly cutting power and applying the brakes.

Though there are ways that this type of dead-man's control could conceivably fail, they have proven highly reliable. On some earlier equipment, pressure was not maintained on the entire controller, but on a large button protruding from the controller handle. This button also had to be pressed continuously, typically with the palm of the hand so that the button was flush with the top of the handle. Another method used, particularly with some lever-type controllers, which are rotated rather than pushed or pulled, requires that the handle on the lever be turned through 90 degrees and held in that position while the train is in operation. Some dead-man's controls require the motorman to hold it in the mid-position rather than apply full pressure (see pilot valve).

In modern New York City Subway trains, for example, the dead man's switch is incorporated into the train's speed control. On the R142A car, the train operator must continually hold the lever in place in order for the train to move.

It is also common for many motorboats, particularly ribs with outboard motors, to have a killcord. This is a dead man's switch in the form of a wire attached to the boat and the helm(generally their wrist). If the helmsmen falls out of their seat the cord will be pulled cutting the engine.

Machinery

Handle-mounted dead man's switches are also used on many hand-held tools and lawn equipment, typically those that rotate or have blades such as saws, drills and lawn mowers. On saws for example, they incorporate a squeeze throttle trigger into the handle. If the user loses grip of the saw, the springs in the throttle trigger will push it back out to the off or idle setting, stopping the blade from spinning. Some tools go further and have a trigger guard built into the handle, similar to firearm safeties. Only when the user presses in the trigger guard first will it then release its lock on the trigger and allow the trigger to be pressed in. Typically, trigger guards can only be pressed in while the user has a firm grip of the handle.

Every walk-behind mower sold in the US since 1982 has a dead man's switch called an "operator-presence control", which by law must stop the blades within 3 seconds after the user lets go of the controls.[2] Attached across their handle is a mechanical lever connected by a flexible cable to the kill switch on the engine. While mowing, the operator must always squeeze the lever against the handle. If the operator ever loses grip of the handle the engine will die, stopping the blades from spinning and if equipped, any drive wheels from turning. This switch configuration also acts as the main kill switch for the engine. When the operator wants to stop the engine, they intentionally release the dead man's switch.

Touch sensor

On some vehicles, including the diesel-electric railway locomotives in Canada, and on Nottingham Express Transit vehicles, the tram's speed controller is fitted with a capacitive touch sensor to detect the driver’s hand. If the hand is removed for more than a short period of time, the track brakes are activated. Gloves, if worn, have to be finger-less for the touch sensor to operate. A back up dead-man's switch button is provided on the side of the controller for use in the case of a failed touch sensor or if it is too cold to remove gloves.

Pedal

A pedal can be used instead of a handle. While some pedal switches must simply be held down in order for the machine to function (this system is often found on amusement rides, where the operator is likely to remain in a standing position for a lengthy period of time while the ride is in motion), this method has some shortcomings. In the Waterfall train disaster, south of Sydney, Australia, in 2003, it appeared that the driver slumped on his seat, keeping the pedal depressed when he died suddenly of a heart attack. This also happened to a Canadian National Railway Railliner passenger train in the 1970s, but the problem was noticed by other crew members and the train safely halted.

There are some solutions to this issue that are now used in modern pedal systems. The pedal can have a vigilance function built in, where drivers must release and re-press the pedal in response to an audible signal. This prevents it from being defeated by the above circumstances and is a standard feature on most British DSD systems.[3]

Some types of locomotive are fitted with a three-position pedal, which must normally be kept in the mid-position. This also lessens the likelihood of accidentally defeating it, although it may still be possible to deliberately do so. Adding a vigilance function to this type of pedal results in a very safe system. However, isolation devices are still provided in case of equipment failure, so a deliberate override is still possible. These isolation devices usually have tamper-evident seals fitted for that reason.

Seat switches

The dead man's switch can also be located beneath the seat of a vehicle or machine and engages if the operator is not in the seat holding the switch down. On modern tractors, the switch will cut the engine while the transmission is engaged or the power take-off is spinning. On riding lawn mowers, the switch is often more extreme where the switch will cut the engine even if the mower is parked and the blades aren't spinning. Seat switches can also be used to keep small children from even starting the vehicle since they wouldn't weigh enough to completely hold down a switch adjusted to an adolescent's or adult's weight.

Key switches

On recreational vehicles such as boats, personal water craft and snowmobiles, and on the control panel of many amusement rides, the user or operator has a cord or lanyard attached to their wrist or life jacket that is in turn attached to a key mounted on the dead man's switch. Should the rider fall off the vehicle or the operator at least move away from the controls, the cord will be pulled out of the dead man's switch, turning off the engine or setting the throttle position to "idle". On powered boats in particular this cord often called a "kill cord" (use around the wrist is not recommended).[4] If the helmsman goes overboard or is forced away from the controls, the engine cuts out. This prevents the boat from continuing under power but out of control, risking injury to anyone in or out of the water including passengers who may have fallen out or may still be in the boat, and collision damage to any property in the path of this out of control boat. It is a common and dangerous practice to defeat the kill cord by fixing it to part of the boat instead of the operator; for convenience. This has been the cause of accidents, some of which were fatal, and/or that have caused limb loss.[5]

Some luggage carts at airports and exercise treadmills have this feature. In the case of treadmills, the dead man's switch usually consists of an external magnet attached to a cord that clips to the user. If the user falls or walks away without turning off the treadmill, the switch cuts power to the treadmill belt.

Altimeter switches

Strategic Air Command developed a dead man's switch for its nuclear bombers, known as Special Weapons Emergency Separation System (SWESS), that ensured the nuclear payload detonated in the event of the crew becoming incapacitated through enemy action. The purpose of this device, unlike other examples mentioned above, was fail-deadly rather than fail-safe. Once armed, the system would detonate the onboard nuclear weapons if the aircraft dropped below a predetermined level,[6] typically due to being shot down.

Vigilance control

The main safety failing with the basic dead man’s system is the possibility of the operating device being held permanently in position, either deliberately or accidentally. Vigilance control was developed to detect this condition by requiring that the dead man’s device be released momentarily and re-applied at timed intervals. There has also been a proposal to introduce a similar system to automotive cruise controls. A hybrid between a dead man's switch and a vigilance control device is a dead-man's vigilance device.

Software

Software versions of dead man's switches are generally only used by people with technical expertise, and can serve several purposes; such as sending a notification to friends or deleting and encrypting data. The "non-event" triggering these can be almost anything, such as failing to log in for 7 consecutive days, not responding to an automated e-mail, ping, a GPS-enabled telephone not moving for a period of time, or merely failing to type a code within a few minutes of a computer's boot. An example of a software based dead man's switch is a Dead Man's Switch which starts when the computer boots up and can encrypt or delete user specified data if an unauthorised user should ever gain access to the protected computer. Google's Inactive Account Manager allows the account holder to nominate someone else to access their services if not used for an extended period (the default is three months).

Spacecraft

Many spacecraft use a form of dead man's switch to guard against command system failures. A timer is established that is normally reset by the receipt of any valid command (including one whose sole function is to reset the timer.) If the timer expires, the spacecraft enters a "command loss" algorithm that cycles through a predefined sequence of hardware and/or software modes (such as the selection of a backup command receiver) until a valid command is received. The spacecraft may also enter a safe mode to protect itself while waiting for further commands.

While having some similarities to a dead man's switch, this type of device (a command loss timer) is not actually a dead man's switch, because it aims to recover from a hardware failure rather than the absence of human operators. It is generally called a watchdog timer, and is also used extensively in nuclear power control systems. System components on a spacecraft that put it into a safe mode or cause it to execute default behaviors when no command is received within a predefined time window can be considered a dead man's switch, but hardware or software that attempts to receive a command from human operators through an alternate channel is an auto-recovering or adaptive communications system, not a dead man's switch. Voyager 2 recovered from a command receiver failure with a command loss timer.[7]

Locomotive

In most modern locomotives, an "alerter" is used. This system, based on vigilance control works by alerting the motorman or engineer with a buzz or bell every few minutes or so. If they do not push a button on the driver's console, the "alerter" system will automatically put the train into a full emergency brake application. To acknowledge the alert and thus prevent penalty brake application, the engineer or motorman reaches down to press the button and reset the system. Most major railroads in the United States and abroad use this system both in their freight and passenger operations. It is also used on the R143 and other New York City Subway cars while under CBTC operation. In the USA, older locomotives produced before 1995 do not carry this feature, but given the modular nature of the system it is not uncommon to find them retrofitted.

Aircraft

Some airplanes use vigilance control to minimize hypoxia; descending to lower altitude if the pilot is unresponsive.[8]

Alternative names

See also

References

  1. ↑ Newman, Andy (May 7, 2010). "Not the First Time the 'Dead-Man' Switch Did Its Job". The New York Times. Retrieved May 7, 2010.
  2. ↑ "Code of Federal Regulations, Title 16, Part 1205 - Safety Standard for Walk-Behind Power Lawn Mowers".
  3. ↑ "Locomotive Repair Books, Record Cards, Manuals and Driver's Handbooks". Locodocs.co.uk. Retrieved 2013-11-15.
  4. ↑ Royal Yachting Association: Use your kill cord, 30 April 2013
  5. ↑ Steven Morris (6 May 2013). "newspaper: article on fatal speedboat accident in which an out-of-control boat severely injured people who had fallen out of it, with two fatalities, 6 May 2013". London: Guardian. Retrieved 2013-11-15.
  6. ↑ Sagan, Scott Douglas (1995). The Limits of Safety. Princeton University Press. pp. 187–188. ISBN 0-691-02101-5. Retrieved 2008-11-16.
  7. ↑ Voyager Support, DSN Progress Report 42-49, Jet Propulsion Laboratory, November-December 1978. Retrieved 4 March 2009.
  8. ↑ Bertorelli, Paul (13 April 2015). "Piper Bets Big On Envelope Protection". avweb.com. Aviation Publishing Group. Retrieved 15 April 2015.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.