What should a broken traffic light show? Not green

transcript

The controller crashes. What do the lamps show? Whatever they showed last? A stuck green. That's dangerous, and nobody notices.

A fault goes straight to flash mode. Every approach flashes red. An all-way stop. Drivers know what it means. Nothing is green. Real conflict monitors do the same.

A dark junction is invisible. Nobody knows to stop. Flashing red tells everyone to stop and look.

Pending walk requests are cleared. Any emergency target is dropped. Only an explicit recover leaves flash. It goes through two seconds of all red. Never straight to green.

Failure is not rare. A watchdog trips. A sensor lies. So the failure mode is a state in the design. Chosen in advance, not left to chance.

The monitor can also trigger a fault. If the controller asks for two greens, the monitor refuses. The controller then goes to flashing red.

Fail to a state you chose.

Full breakdown in the lecture.