Two greens at once: the rule that's checked twice
transcript
North and south green. East and west green too. The one thing a signal must never do.
First line: the plan. A phase is a set of approaches. Put north and east in one phase? It refuses to exist. A bad plan is rejected before any lamp is touched.
Second line: the lamps. Every change goes through a monitor. It checks the whole picture, not just the change. Two conflicting directions live? It refuses.
The monitor doesn't trust the controller. And the controller doesn't trust itself. If the monitor refuses, it flashes red.
Timings are configuration. A technician can change them. But a changed plan is still validated at construction. Freedom to configure. No freedom to be unsafe.
The plan check catches a bad configuration. The monitor catches a bug in the controller. Different failures. Different guards. Both cheap.
Validate the plan. Monitor the output.
Full breakdown in the lecture.