A safety barrier is more than a signal
The Urda collision shows how a safety function can become distributed across technical fallback, communication and procedures, and how switching a system's mode to another can also change its mode of failure.
Read the review