Graceful Degradation

When the system can't do what it's supposed to, it steps down to a planned fallback and says plainly what still works.

Royal Majesty cruise ship Draft

June 10, 1995 · Nantucket, Massachusetts

About an hour after the cruise ship left Bermuda for Boston, the cable to its GPS antenna came loose. The GPS quietly switched to dead reckoning, estimating position without accounting for wind or current, and the autopilot, which wasn't designed to notice the change, kept steering by it. The only signals were a brief alarm and a small "DR" on the GPS unit, away from where the officers stood watch. For about 34 hours the bridge believed the ship was on course while it drifted steadily west. The Royal Majesty ran aground on Rose and Crown Shoal, about 10 miles east of Nantucket, with roughly 1,500 people aboard.4

Anti-pattern: Silent Step-Down Draft

The GPS stepped down exactly as designed when it lost its signal, but nothing downstream noticed. The autopilot kept treating estimates as fixes, and the officers kept trusting a position that had stopped being measured a day and a half earlier.

Graceful Degradation

Therefore: When a system loses capability, it steps down to a fallback designed in advance, and tells the operator plainly what still works and what doesn't.

Without

Drone status

Mode
AUTO
Faults
0
Can fly home
—

DELIVERY DRONE 04 · EN ROUTE

Inject the three faults and watch the mode label. Simplified illustration.

With the pattern

Drone status

  1. FULL — now
  2. REDUCED
  3. LAND IN PLACE
  4. STOP

DELIVERY DRONE 04 · EN ROUTE

The ladder is on screen before anything fails. Simplified illustration.

The system names its new state and limits, so the operator adjusts instead of panicking.

The mechanism

full capability → restore

  1. 01Full capabilityAll systems nominal
  2. 02Fault detectedSensor, link or model loss
  3. 03 · Key momentStep downTo the next defined fallback
  4. 04Signal limitsWhat still works, what doesn't
  5. 05RestoreOr escalate via a Handoff

At 03: Fallbacks are designed in advance as a ladder: full, then reduced, then minimal-safe, then stop.

At 05: Restore capability when it comes back, and hand control to the human when it doesn't.

On this page

Design considerations

  • Design the ladder before the fault. A system that improvises its way down can't tell the operator what it can still be trusted with, which is the thing they most need to know.1
  • Make every rung specific. Each fallback state names which tasks are still available and which are gone.
  • Say what still works, not just what failed. A list of losses leaves the operator to work out the rest.
  • Make each step down one event, not fifty. A step down produces alerts by design; group them so the operator sees one change of state. Alert Triage is how that grouping is done.
  • Define the floor. When every fallback is used up and nobody responds, the system gets itself to a safe state on its own: what the standards call a minimal risk condition or minimum risk maneuver.23

In the field Draft

Observed · Aviation. Air France 447: the flight controls stepped down to a mode without stall protection, and the crew never established what the new mode could still be trusted with.5

Observed · Automotive. UN R157 requires an automated lane keeping system to perform a minimum risk manoeuvre when the driver does not resume control after a transition demand — the floor of the ladder, written into a regulation.3

Sources

  1. The “Problem” of Automation: Inappropriate Feedback and Interaction, Not “Over-Automation”Donald A. Norman · 1990Paper
  2. SAE J3016 — Taxonomy and Definitions for Terms Related to Driving Automation Systems2021Standard
  3. UN Regulation No. 157 — Automated Lane Keeping Systems (ALKS)Standard
  4. Grounding of the Panamanian Passenger Ship Royal Majesty on Rose and Crown Shoal near Nantucket, Massachusetts, June 10, 1995National Transportation Safety Board · 1997Incident
  5. BEA Final Report — Air France Flight AF447, Rio de Janeiro to Paris2012Incident