Fault detection, isolation and recovery
Design the failure behaviour deliberately, and test it where failing is free.
Fault detection, isolation and recovery
Failure handling is the least-tested part of most flight software, because triggering a real failure to check the response is expensive and dangerous. So the recovery logic is written, hoped over, and rarely exercised until it matters.
Fault detection has to separate a real failure from noise fast enough to act, without firing on every transient. Getting that boundary wrong either grounds a healthy aircraft or misses the fault that brings it down, and both failure modes are hard to reproduce on demand.
Failsafe treats fault detection, isolation and recovery as designed behaviour with defined triggers and responses, and injects faults in Crosswind to test them safely. The response to a lost link, a dead motor or a bad sensor is verified before the aircraft ever meets one.
Failsafe's limits are the design envelope from Planform, so the aircraft protects itself against the boundaries it was actually built to.
Tell us what you are flying and where the programme is losing time. We will tell you honestly which of these helps and which does not.