Tagged harden
8 pieces
- · 6 min read
Negative Controls: Prove Your Check Can Fail Before You Trust Its Green
Before trusting any green check, make it go red on a known broken input. Three concrete forms: inject a known defect and confirm the suite fails, keep a must-fail case in CI as a meta test on the harness, and physically drive an out of range condition to confirm the alarm fires.
- · 7 min read
Human in the Loop or Safe State: Choosing Your Fallback
When a system cannot proceed safely, it has two options: hand the decision to a person, or take a defined safe action itself. Which one is correct is decided by whether a person is reachable inside the time the situation allows, and that single test resolves most of the argument.
- · 18 min read
A Test That Has Never Failed Is a Decoration
A passing suite, a clean demo and green CI are evidence of nothing until somebody has watched the check go red on a known broken input. Passing is a property of the test, not of the code. The only credible proof any check works is a negative control: break the thing it guards and confirm the check fails.
- · 7 min read
Model Confidence or Independent Verification
A confidence threshold is the cheapest thing that looks like a safety control, and it fails in the one place you need it: models are most confident on inputs they have never seen. The decision is not what threshold to set, it is whether your task has a cheap grounded check, because that determines whether verification is available at all.
- · 6 min read
Perception Accuracy Is Not Control Safety
A 99 percent accurate detector is not a 99 percent safe robot, and the gap is not a matter of degree. Safety depends on which errors occur, how they are distributed in space and time, what the system does when it is uncertain, and whether the safe behaviour is enforced somewhere the perception stack cannot override.
- · 7 min read
The Update That Bricks the Fleet: OTA Failure Modes
An over-the-air update is the only operation where a bug can remove your ability to fix the bug. That single property should determine the entire design, and it produces requirements that look excessive until you consider what the alternative costs: a truck roll per unit, or a fleet you cannot reach at all.
- · 7 min read
What a Regulator Asks About Your Biosignal Front End That Your Bench Never Did
Your bench asks whether the signal looks right. A reviewer asks what the system does when it is wrong, across every unit you will ship, in conditions you did not choose. Those are different questions, and the second one is answered in the analog front end months before there is software to test.
- · 7 min read
Five Questions for Your Next AI Design Review
You should not have to read a trace to know whether an agent is safe to ship. Five questions, none of them technical, each with a right answer and a recognisable wrong one. They take ten minutes and they find the failure modes that pass every demo, because the failures live in what the system does when it does not succeed.