The emergency stop
Every serious machine has a big red mushroom button. Hit it and the machine stops.
A few things about e-stops in the machine standards:
- It's a complementary protective measure. ISO lists it alongside safeguarding, not instead of it. You don't skip the guard because you have a stop button.
- It must be reliable. The ISO e-stop standard sets a minimum reliability level for the stop function.
- It stays stopped until someone deliberately resets it. Releasing the button doesn't restart the machine.
The bot e-stop
A bot needs a stop that's clear, fast and total.
- One word that halts work. "Stop" means stop everything in progress, not finish the current task first.
- It covers routines too. Scheduled work is paused, not just the conversation.
- It doesn't restart itself. After a stop, the bot waits to be told to resume.
- You know where it is. Like the red button, you shouldn't have to search for it. Know how to turn routines off and remove a connector before you need to.
Write the stop rule into the bot's principles. Then also know the real off switch, the settings that turn routines and access off, because a written rule depends on the bot reading it.
Fail-safe design
A fail-safe machine goes to a safe state when something fails. A brake that's held off by pressure clamps shut when pressure is lost. An interlock that loses power stops the machine.
The question: when something goes wrong, does it fail toward safe or toward harm?
Fail-safe for bots
The bot version of "safe state" is hold.
- Draft by default. The safe state for an email is a draft. If anything is unclear, it stays a draft. In our review of 90 bot templates, at least 22 drafted by default.
- Silence means hold. If the bot asks "Shall I send this?" and gets no answer, it doesn't send. No reply is never a yes.
- Missing data means stop, not guess. If the file isn't there, the bot says so. See Don't make it up.
- Routines ship off. A new scheduled routine starts turned off until a person turns it on. That showed up in 25 of the 90 templates.
- On error, report. If a step fails, the bot stops the chain and reports what happened.
Safety-rated monitoring
In machine safety, some systems watch the machine and stop it when it leaves safe limits: a speed monitor, a light curtain.
For bots: a check that watches for out-of-bounds behavior. A budget limit on usage. A tester bot that runs after each change. A log someone actually reads. The bot can't be the only thing watching itself.
Where bots differ
A mushroom button cuts power. Physics guarantees it. A bot's "stop" depends on the bot reading and following it, unless you use the settings that actually turn things off. Know both.
Also, a machine that stops is safe. A bot that stops halfway can leave work half done: a file half edited, three of five emails drafted. The stop needs a record of where it stopped, so a person can pick it up. That part has no clean factory parallel.
Back to Machine safety for bots.