Pattern 15 · During
Stop Anywhere
Anyone near or responsible for the machine can always stop it, through one unmistakable control that works in every mode, and the stop holds until a human deliberately releases it.
The mechanism
machine is running → a human releases it
- 01Machine is runningIn any mode, attended or not
- 02Someone needs it stoppedOperator, bystander, remote support
- 03 · Key momentOne control, always liveUnmistakable, and mode-independent
- 04The stop latchesIt holds without being held
- 05A human releases itDeliberately, at the point it was triggered
At 03: ISO 13850 and IEC 60204-1 reserve red on yellow for emergency-stop actuators and for nothing else, so the control is identifiable by someone who has never used this machine before.
At 04: Once pressed the stop command is maintained until the device is reset — the machine cannot decide the emergency is over.
Without / with the pattern
Anti-pattern: No Brakes for Bystanders
Machine misbehaves, then Nobody present can halt it, then It keeps going
No Brakes for Bystanders: a Waymo confused by cones asked its remote fleet response team for help and was given incorrect guidance. It later pulled out, parked partly in the road, then moved off as a roadside assistant approached — and neither the remote team nor the person standing next to it could stop it.
With the pattern
Machine misbehaves, then Anyone present stops it, then It stays stopped
The authority to halt the machine belongs to whoever is in a position to see that it should be halted, and the stop does not expire on its own.
Related patterns
- Requires · 12Return of ControlA latched stop is only safe if resuming is a deliberate act. Both patterns lean on the same rule: the machine does not decide when the human is finished.
- In tension with · 11Readiness CheckOne assumes a supervisor who can act; this assumes nobody reliable is watching and gives the stop to whoever is there. Designing for both means deciding whose authority wins.
Sources
The Waymo story has to be used carefully, because it is a news report rather than an investigation and the research says as much. What makes it worth keeping is the shape rather than the detail: a machine that had already asked for help, received the wrong help, and then moved while a person responsible for it was close enough to touch it.3 Whether or not that account is accurate in every particular, it describes the gap this pattern names — the authority to stop was held by people who were not there, and the person who was there had none.
Industrial machinery settled this a long time ago, and the settlement is more specific than "fit a big red button". The colour combination is reserved, so the control is legible to someone who has never seen this machine.2 The stop latches, so stopping is not a thing you have to keep doing. And the reset is deliberate and local, so the machine cannot conclude on its own that the emergency has passed.1 The open problem is what any of that means for a vehicle on a public road, where everyone nearby is a bystander and none of them can reach anything.