What Is a Dead Man's Switch?
A control that acts when the operator stops responding. In software, it means alerting on the absence of a signal rather than the presence of an error.
A dead man's switch is a control that acts automatically when its operator stops responding. The defining property is inversion: the switch does something because nothing happened, rather than because something did.
The term comes from railways. Early electric locomotives fitted a handle the driver had to hold down or periodically acknowledge, and releasing it applied the brakes. If the driver was incapacitated, the train stopped without anyone deciding it should.
The same idea in software
In monitoring, a dead man's switch means a job checks in on a schedule and the monitor alerts when a check-in does not arrive. The job never has to detect or report its own failure.
That matters because a failing process is often in no condition to report anything. A script killed by the out-of-memory reaper, a container evicted mid-run, a server that lost power, and a cron daemon that was never restarted after a reboot all produce identical output: nothing at all.
Conventional error alerting requires the failing thing to still be working well enough to send an alert. A dead man's switch removes that dependency, which is why it catches the failures nothing else does.
The alert timing follows directly from the schedule. A monitor expecting a check-in every 60 minutes with a 10-minute buffer raises an alert 70 minutes after the last successful signal, and it does so identically whether the cause was a crash, a power loss or a severed network link.
Where the pattern shows up
| Domain | Implementation | What triggers it |
|---|---|---|
| Rail transport | Driver's safety device / vigilance control | Handle released or acknowledgement missed |
| Power tools | Dead man's control on chainsaws, mowers | Operator releases the lever |
| Gym equipment | Treadmill safety key on a lanyard | Key pulled when the runner falls |
| Software monitoring | Heartbeat ping with an expected interval | Ping does not arrive within interval plus grace |
| Information release | Scheduled publication unless cancelled | Owner fails to check in before the deadline |
The two meanings, kept separate
Outside monitoring, the phrase often means an arrangement that releases information if someone stops checking in, a device some journalists and whistleblowers have described using. The mechanism is identical; the purpose is not.
In an operations context the phrase almost always means the monitoring pattern. If you are reading vendor documentation, assume that reading unless the text says otherwise.
What it does not solve
A dead man's switch detects absence, not incorrectness. A job that runs on schedule, processes zero records and exits cleanly will ping happily while doing nothing useful.
Catching that requires the job to assert something about its own work, such as reporting the row count it processed, rather than merely reporting that it reached the end of the script.
Related concepts
This pattern underpins heartbeat and cron monitoring, which depends in turn on a well-chosen grace period. The broader failure class it addresses is covered in what is a silent failure.