Dead Man's Switch

A Dead Man's Switch detects failure by monitoring the absence of an expected health signal, rather than by detecting the presence of a failure signal. A healthy system emits a continuous heartbeat — a periodic message, a regularly-updated timestamp, an always-firing alert rule, a successful liveness probe — and an external observer counts these heartbeats. When the heartbeat stops, the observer raises an alarm. Silence itself is the signal.

The pattern's value emerges from a recursive problem: any failure detector is itself a system that can fail. If you monitor your application with a monitoring service, what monitors the monitoring service? Adding more layers of detection creates infinite regress without ever solving the underlying problem — at some point a watchdog at the top of the chain has to be trusted, and that watchdog can still fail silently.

Dead Man's Switches resolve this by inverting the question. Instead of asking 'did something go wrong?' (which requires the detector to be functional), they ask 'is the system still saying it's alive?' (which requires only that you can count messages). The final observer is typically as simple as possible — a CloudWatch alarm watching SNS message rate, a cron job checking a file timestamp, a load balancer health check expecting a specific response — and lives in a different failure domain from the system being monitored.

The pattern is widely used outside software too: hardware watchdog timers, train operator vigilance devices, two-person nuclear authorization, certificate expiry monitors. All share the structure of 'continuous proof of life' rather than 'alert on failure.'