Designing Graceful Degradation for System Failure

In this lesson, you will learn how to structure your software architecture to shed non-critical features during a failure, ensuring your system maintains its core safety functions.

The Philosophy of "Fail-Safe" States

When an embedded system encounters a fault—such as a sensor failure or a memory corruption—it cannot always perform a full system reset. In safety-critical applications, a full reset might take too long to reach a stable state, leaving the system vulnerable. Graceful degradation requires us to define a hierarchy of system capabilities. When a component fails, the system transitions to a restricted mode that strips away "feature-rich" functionality while locking the system into its most essential safety-critical operation.

Implementing Mode-Based Logic

We implement this by segmenting our system into functional "modes." The main control loop checks the health of various subsystems (using your previous knowledge of FMEA and Watchdog Timers) and forces the state machine into a degraded mode if an error is detected.

Consider a motor controller for a vehicle:

typedef enum {
    MODE_NORMAL,      // All features (Adaptive Cruise, GPS, etc.)
    MODE_DEGRADED,    // Essential control only (Basic steering/braking)
    MODE_SAFE_STATE   // Emergency stop
} SystemMode;

void update_system(void) {
    if (is_sensor_faulty()) {
        current_mode = MODE_DEGRADED;
    }

    switch (current_mode) {
        case MODE_NORMAL:
            run_navigation();
            run_motor_control();
            break;
        case MODE_DEGRADED:
            // Disable non-essential navigation
            run_motor_control(); // Maintain critical safety function
            break;
        case MODE_SAFE_STATE:
            engage_brakes();
            break;
    }
}

Prioritizing Functionality

The design challenge lies in identifying exactly which components are "essential." You must use your Fault Tree Analysis results to categorize functions. Any module that is not strictly required to keep the system in a stable, predictable state should be eligible for disablement. By shedding the non-essential modules, you reduce the workload on the CPU and memory, effectively increasing the reliability of the core control loop despite the hardware fault.

Key Takeaway: Graceful degradation protects system integrity by architecting a prioritized fallback hierarchy that automatically abandons non-critical features to preserve essential safety operations when a fault is detected.