Software should refuse an operation when it cannot establish that the action is permitted, the system is in a suitable state, and the necessary inputs are trustworthy—and when continuing could cause harm. The response need not always be a full shutdown: it may block one command, switch to a safe reduced mode, correct a fault in time, or ask a qualified person to take control.
What should trigger a refusal?
Base the decision on the operation’s risk and the system’s current state, not on a blanket preference for stopping. NASA’s requirements for safety-critical software identify concrete checks: whether a command is allowed in the current mode, whether prerequisites are met, whether commands arrive in a valid sequence, and whether input and output integrity checks pass. If a failed check means the operation cannot be performed safely, block it before execution. NASA software safety requirements describe these controls in the context of safety-critical systems.
As an Amazon Associate I earn from qualifying purchases.
- Authority and prerequisites: Is this action permitted now, and have required conditions been satisfied?
- State and sequence: Is the system’s state known, and is the command valid at this point in the sequence?
- Data integrity: Have relevant inputs and outputs passed their required integrity checks?
- Hazard timing: Can the fault be corrected before the consequence of continuing would occur?
For ordinary applications, applying these checks is a risk-based design approach, not a claim that NASA rules legally govern all software. The more serious or irreversible the consequence, the stronger the case for refusing to proceed on uncertain state or untrusted data.
How to choose the safest response
Refusal is a decision about the operation, not necessarily about turning off the whole system. Compare the consequences of continuing, stopping, and delaying; the time available for mitigation; confidence in inputs and system state; whether reduced functionality remains safe and useful; how reversible the action is; and whether a qualified operator can intervene safely. NASA guidance describes timely fault correction as one possible mitigation; if the system cannot mitigate safely, it should reach a safe state. NASA-STD-8739.8
#1 Best Overall
| Response | Use it when | Design consideration |
|---|---|---|
| Block or cancel the operation | A prerequisite, state, integrity, or sequence check fails and the action cannot safely proceed. | Make clear whether the command was rejected, initiated, or is still processing. |
| Continue in a reduced mode | A smaller set of functions can be shown to remain safe and useful. | Define which functions remain available and prevent unsafe paths back to normal operation. |
| Correct the fault in time | The system can mitigate the fault before a hazardous consequence would occur. | Do not treat a proposed correction as sufficient unless it completes within the available time. |
| Move to a safe state or shut down | Continuing or attempting correction would create greater risk, and the system needs a stable condition. | A safe state is system-specific; it may preserve reduced functionality rather than power everything off. |
| Request human control | Automation reaches a defined safety threshold and a qualified person can take over safely. | Make the handoff clear and ensure the person has enough information and time to act. |
NASA’s safety-critical software handbook says that if a failure cannot be prevented, the software should be able to place the system into a safe state from which it can later recover; it notes that the state may have reduced functionality. NASA Software Engineering Handbook, SWE-134 This is why “fail closed” should not be interpreted as “always power off”: the safest response depends on the failure mode and the hazard analysis.
When should software hand control to a person?
Ask for human control when automation reaches or exceeds a defined operational safety threshold and a person can safely take over. NASA crew-interface guidance calls for protective action or a request for safe operator control when such a threshold is exceeded. It also specifies human-operator initiation for autonomous robotic systems, including restart after an emergency or protective stop. NASA crew-interface requirements
These are requirements in a human-spaceflight context, not universal rules for every app. The threshold, fallback behavior, and authority to restart should be established for the specific system under its hazard analysis and applicable domain requirements.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should a refusal be explained?
Tell the user or operator what action was blocked, what condition caused the refusal, what happened to the system or transaction, and what safe next step is available. For example: “Transfer paused because the destination account could not be verified. No funds were sent. Verify the account details or contact support.” This is an illustrative example, not a quoted or tested message.
Rank #3
In safety-critical interfaces, distinguish critical errors from noncritical status messages. Indicate whether a command was received, started, rejected, or remains in progress; ambiguous status can lead an operator to repeat an action or assume it succeeded. FAA software-safety material emphasizes unambiguous error messages and a single-action path out of current processing to a known stable state. FAA Advisory Circular 20-115D
How should recovery be designed?
Refusal should leave the system in a state from which a controlled recovery is possible where feasible. Preserve the state or logs needed for diagnosis, provide a clear recovery route, and guard against an unsafe restart. NASA human-factors guidance frames error handling as prevention first, followed by detection and correction, then limiting the effects of errors that remain. It also requires, within its human-spaceflight context, the capability to detect and recover from human error and inadvertent changes in system status. NASA crew-interface requirements
Rank #4
- Prevent predictable mistakes: Make invalid or out-of-sequence actions difficult to initiate.
- Detect and explain failures: Identify the failed condition and show the system’s current status.
- Contain the effects: Cancel the operation or transition to a safe mode before the hazard occurs.
- Recover deliberately: Provide a controlled path to restore operation, with restart authority appropriate to the risk.
Are there universal thresholds for refusing to continue?
No single percentage, timeout, or risk score determines when all software should stop. NASA and FAA materials cited here provide requirements and design principles for particular safety-critical or aviation contexts, not a general-purpose threshold for every application. A system’s limits should come from its hazard analysis, validation, and applicable standards; compliance decisions require checking the rules for the relevant domain and jurisdiction.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
