Pattern 03 · Failure
Graceful Degradation
When the system can’t do what it’s supposed to, it steps down to a defined fallback state and says so — without panic or silence.
The mechanism
full capability → restore
- 01Full capabilityAll systems nominal
- 02Fault detectedSensor, link or model loss
- 03 · Key momentStep downTo the next defined fallback
- 04Signal limitsWhat still works, what doesn’t
- 05RestoreOr escalate via a Handoff
At 03: Fallbacks are designed in advance as a ladder: full → reduced → minimal-safe → stop.
At 05: Restore when you can; hand control to the human when you can’t.
Without / with the pattern
Without
Fault occurs, then Silence or alarm flood, then Operator guesses
Either nothing changes on screen, or everything screams at once. No one can tell what still works.
With the pattern
Fault occurs, then Calm step-down, then Known limits
The system names its new state and limits, so the operator adjusts instead of panicking.
Related patterns
- Precedes · 01The HandoffWhen the ladder runs out of fallbacks, the system escalates by handing control back.
- Follows · 07Capability DisclosureDisclosure draws the envelope before anything starts; degradation is what happens when the machine reaches that edge while running.
- Complements · 10Explainable FaultDegradation is the step down; this is the part that says which fault caused it. A fallback nobody can name is hard to work with.
- In tension with · 14Alert TriageStepping down produces alerts by design, and each rung has consequences that look like faults. The ladder is only legible if the step-down is one event rather than fifty.
Sources
The fallback states have to exist before the fault does. A system that improvises its way down cannot tell the operator what it can still be trusted with, which is the thing they most need to know. Work out the ladder in advance, and make each rung specific enough that the operator can tell which tasks are still available and which have gone.
- The “Problem” of Automation: Inappropriate Feedback and Interaction, Not “Over-Automation”Paper
- SAE J3016 — Taxonomy and Definitions for Terms Related to Driving Automation SystemsStandard
- UN Regulation No. 157 — Automated Lane Keeping Systems (ALKS)Standard
- BEA Final Report — Air France Flight AF447, Rio de Janeiro to ParisIncident