Each subsystem's own sound failure choice can still add up to an incoherent whole without coordination

What it is

In a mixed system made of several subsystems, each subsystem facing a fault may independently choose to stop, isolate, or continue in degraded mode, and each local decision can look sound within its own safety design. Explicit coordination requires looking at these decisions together and verifying the combination still produces a controllable system-level state. The problem is that what looks "safe" to one subsystem can be exactly the support another subsystem depends on to stay safe itself.

Why it happens

A power system that isolates a local short circuit acts safely toward the actuator that caused the fault, but if that same power feed also serves the cooling system and the communications module, the same isolation drags cooling and communications down with it — and each of those failures can produce its own safety consequence, one the designer of the original "cut power" decision never had to consider, because from its own boundary, cutting power was the correct response. Network degradation follows the same pattern: sacrificing communication with a supervisory system to keep local real-time control uninterrupted looks sound locally, but once supervision loses visibility it may act on stale information that conflicts with actual local state. The underlying mechanism is that any single subsystem's failure response is designed to cover only its own boundary — fault propagation paths, cross-subsystem dependencies, and whose response should take priority all fall outside any one subsystem's own safety analysis and must be written explicitly into an interface contract.

Where it stops holding

Supplier boundaries, separate certification regimes, and independently operating controllers all limit how far centralized coordination can actually go — the internal fault logic of another vendor's subsystem may simply not be available to you. And introducing a unified central coordinator to solve this problem creates a new single point of failure that can affect every subsystem at once; the benefit of coordination and the new concentrated risk it introduces must be weighed together, not judged only by the upside.

Applying it

Build a cross-subsystem fault matrix that lists, for every possible local response, its effect on power, communications, cooling, braking, and human control — rather than reviewing each subsystem's own response in isolation.

• How to check: run joint fault injection instead of testing units alone — trigger multiple subsystems' responses simultaneously or in the sequence a real fault would propagate, and observe whether the combined system state remains controllable. The overview display must show each subsystem's current strategy alongside system-level remaining capability, so an operator can tell at a glance whether "each part is safe" actually adds up to "the whole is safe."

Related

• Same group: Y4.01.1 Fail-safe behavior · Y4.01.2 Fail-operational behavior · Y4.01.3 Choosing fail-safe versus fail-operational
• Nearby: Y4.02 Redundancy and voting · Y7.01 Systemic causes of error
• Search terms: Coordinated degradation across subsystems · functional safety · safety-critical systems