Modality Failover: Cross-Sensory Redundancy for Critical Software

1.Introduction

There is a photograph that circulates after every apartment fire in the deaf community: a smoke alarm, ceiling-mounted, intact, having done its job. The alarm sounded. Nobody heard it. The National Fire Protection Association's own analyses find that the risk of dying in a home fire is substantially higher for adults over 65 — more than double the general population rate — and the causes are architectural, not anecdotal: the alarm's one channel intersected the resident's zero available channels at the moment it mattered. The hardware worked. The system failed silently, and the silence is the design.

The same silent failure runs through civilian computing at a scale no one counts. Roughly 15% of U.S. adults report some degree of hearing difficulty — a share that rises steeply with age and is rising in absolute terms across the population. It is not a sensory statistic; it is an alerting-architecture statistic, because every one of those adults is running a computing stack whose entire critical-notification path assumes the ear. So is everyone else, at the times the ear is temporarily unavailable: the phone in a pocket, the user asleep, the headphones on, the shop floor at 95 dB, the driver whose eyes are (correctly) occupied. The channel-death states are not edge cases; they are the modal states of an ordinary day, and the alerting stack treats every one of them as someone else's problem.

The rest of the stack solved this shape of problem long ago. Storage engineers would not accept a filesystem whose write path had one disk and no mirror; network engineers do not accept one route and no failover; aviation requires dissimilar redundancy in flight-critical paths. The one component with a known, large, and growing failure rate — human perception of a single channel — is wired as a single string: app to OS to one speaker, or one LED, or one vibration motor, and out. RAID for the senses does not exist.

The thesis in one sentence: critical alerts need sensory failover as a platform protocol — criticality classes, per-person capability profiles, k-of-n modality delivery with acknowledgment-gated escalation, channel-health probing, and person-level escalation — and every piece of it already ships in some fragment of the industry, waiting for the composition.

One boundary up front, because this program demands precision between neighbors: P-006 (the attention scheduler) governs dispatch — when an interruption is allowed to cost the human. This paper governs delivery — once the interrupt is due, how the system guarantees it lands. The two protocols share a governor (an escalation that has failed the modality graph becomes an interruption question again), and cross-reference rather than overlap.

2.The channel model: what current alerts assume

Formally, today's alert path is a message m handed to an OS API, rendered on one chosen modality (a token — sound, banner, vibration — sometimes two in fixed combination), with delivery presumed equivalent to perception and perception presumed equivalent to action. Three assumptions, each false in a measurable subpopulation at any moment:

1. The channel is available. False under hearing impairment (15% of adults), visual impairment (the flash that never lands), tactile insensitivity (neuropathy, prosthetics), and situational occlusion (pocket, noise, sleep, fullscreen content, driving).
2. The channel's state is known. The OS does not know the headphones are on, the room is loud, the user is asleep, the phone is face-down on a muffler. It chooses a modality blind. Emergency broadcast systems made the one visible concession — a distinctive attention signal, mandatory vibration cadence — a fixed two-channel pattern that still assumes exactly those two channels.
3. Delivery equals receipt. No alert system in civilian computing asks whether the message was perceived; there is no acknowledgment, no escalation on silence, no audit of the silence. The hospital literature has a name for what the absence breeds — alarm fatigue, the normalization of unacknowledged alarms — and it has been a top-ranked health-technology hazard for most of a decade.

The clinical case is the instructive inversion: alarms fail there not because they are weak but because they are numerous, single-channel, and unacknowledged — hundreds of unactioned alerts per shift per bed, desensitizing the staff, while the specific critical signal drowns in its own redundancy. Modality failover and alarm governance are the same protocol seen from two ends: guaranteed delivery for the signals that matter, suppressed delivery for those that do not. A specification that solves only the first half recreates the hospital in every pocket.

3.The landscape: fragments everywhere, composition nowhere

Assistive retrofit hardware. The deaf community's alerting stack — strobes, bed shakers, wearable receivers — is the oldest proof that cross-modal delivery is demanded and buildable. It is per-device, per-room, purchase-by-purchase, mandated piecewise by building code (smoke-alarm requirements for identified disabilities) rather than composed into any platform. The retrofit market solved the hardware and never the protocol: each device bridges one alert source to one alternate sense, and the aggregate is a house full of point solutions that still miss every alert born outside their silos.

Emergency broadcasting. The state of the art at the message layer: OASIS's Common Alerting Protocol (born of the post-9/11 interoperability problem) standardized one alert message fanning out to many delivery paths — broadcast, SMS, siren, NOAA radio; the U.S. Wireless Emergency Alerts system carries mandatory distinctive tone-plus-vibration, and both platforms grant a rare privilege: the ability to sound on top of silent mode. CAP standardized the message; the receiving end — which sense, which device, whether the human noticed — remains outside the standard. The protocol of this paper is, in a precise sense, CAP's missing receiving layer.

OS accessibility settings. Each platform ships per-user sensory accommodations: LED-flash alerts, mono audio, visual replacements for haptics, per-channel override of silent mode, the (rarely granted) critical-alert privilege that permits overriding Do Not Disturb. These are settings, not semantics: the app still self-declares urgency, the OS still picks one modality, no acknowledgment exists, and the user is the integration layer — expected to anticipate every failure state of every app in every sensory circumstance and preconfigure it.

Automotive and industrial Human-Machine Interfaces. The domains with real safety culture: cross-modal redundancy in lane-departure warnings (haptic steering, audio, display), forklift and plant alarms with light-sound pairing, fatigue research, and the aviation tradition of dissimilar redundancy. All machine-specific, none platform-level, none civilian.

Sensory substitution research. The science that established the brain's cross-modal plasticity — Bach-y-Rita's work from the 1960s onward — proves channels are substitutable at perception level; the research line aims at prosthetic substitution rather than alerting, but it is the field's existence proof that the failover is biologically licensed.

On-call escalation systems. The operational world already runs acknowledgment-gated escalation as routine: paging systems walk a graph of channels and people until someone acknowledges, with timing budgets and audit. The semantics this paper needs — delivered ≠ acknowledged, escalate on silence, terminate on receipt — has been production-hardened in DevOps tooling for twenty years; it simply has never been pointed at humans' senses instead of engineers' phones.

Clinical alarm management. The Joint Commission's alarm-management safety goal and ECRI's hazard rankings institutionalized the antifatigue half: alarm hierarchy, tailored defaults, governance of which signals may interrupt. It is the negative-space proof: the medical world, having maximized alert count without a perception model, documented the catastrophe and built the governor — outside any general platform.

VERDICT: STRONG. Six mature fragments (assistive hardware, CAP/WEA, OS settings, automotive HMI, on-call escalation, clinical governance), zero compositions, and a platform-level home (the OS notification stack) that already owns every primitive it would need. No incumbent is in the gap; the gap is one product decision in every platform team's scope.

4.Why the gap survived

Engagement and safety share one pipe. The notification channel's economics are engagement economics: attention capture, re-engagement, growth. The engineering stack, the team charters, and the priority queues all optimized for more delivery of more messages, which is precisely the wrong objective for criticality-guaranteed delivery — and the two objectives fight inside every design review, with engagement holding the budget. Safety-critical delivery cannot be built as a feature inside an adversarial channel; it needs its own class, its own budget, and its own API — a structural separation the engagement stack has no incentive to volunteer.

Accessibility is a compliance surface, not an architecture. The retrofit pattern (per-device special-purpose solutions for identified disabled users) satisfied regulatory demand without ever changing the default path's architecture. The assistive market prices per-solution; a protocol would commoditize its silos. The result is the oldest pattern in this program's papers: the demand satisfied by point products, the architecture never built, the general population — whose channel death is situational rather than permanent — served by no one, because situational channel death is nobody's registered disability.

Delivery metrics end at the speaker. The observable telemetry stops at render time; perception happens in the unmeasurable dark. An organization cannot escalate on an acknowledgment it does not track, cannot fail over from a channel whose health it does not probe, and cannot govern a criticality it never recorded — three missing primitives, and all three are invisible in every dashboard that matters to the roadmap.

Liability asks no questions, so the stack answers none. The silent-miss failure (missed evacuation, missed glucose alarm, missed storm warning) lands in the incident-blameable-to-the-user zone: the alert "was delivered," the human "failed to notice." The aviation world learned to distrust exactly this sentence — "the warning was illuminated" — and wrote entire accident reports about it; civilian software has not yet had its report.

The default user is imaginary and fully sensoried. Every default in the stack encodes a young, rested, solo, quiet-room, phone-on-table user. The real distribution — sleeping, pocketed, occluded, impaired, noisy — is treated as the environment's problem, one workaround at a time, forever.

5.The specification

5.1 Criticality classes

Alerts carry a declared class, and the class is granted, not claimed: the platform issues criticality privileges the way it issues the rare override-DND entitlement today — by review, to accredited senders (civil-protection agencies, medical-device apps, safety systems), never self-declared by arbitrary apps. Three classes, with contract semantics:

• advisory — timeliness valuable, miss tolerable; engages no guarantees; routed through P-006's scheduler as ordinary interruption traffic.
• action — miss has real cost (medication, departure change, on-call page); guaranteed best-effort within a latency bound, acknowledgment-gated escalation once.
• life-safety — miss has death-or-injury class cost (evacuation, medical alarm, custody-level emergency); full k-of-n delivery, unbounded escalation budget, person-level termination.

The class list is a governance object: its definition of which sender may claim which class is exactly the legislative surface the emergency-broadcast world already operates, moved one layer down.

5.2 The capability profile

Each person holds a local, private sensory capability profile: the channels they can receive (auditory, visual, tactile — with the receiving end's variants: which ear, which hand, braille display, flash visibility), the ambient states that modulate availability (sleep with its stages, driving, headphone-on, noise floor, screen occlusion), and the schedules of those states. Estimation is local-first: declared where possible (the user says the alarm tone must be cross-modal at night), sensed where cheap (headphone jack state, microphone noise floor, motion state from the existing sensor hub, time-of-day priors), and never uploaded — the profile is P-009-grade private state, a biometric adjacency that the architecture keeps on-device by construction. The profile's output is a routing table, never a diagnosis: the OS learns which channels are currently live for this body in this context, and forgets the rest.

5.3 k-of-n delivery with acknowledgment-gated escalation

Delivery for action and life-safety classes becomes a coverage problem: the alert must land on k concurrently healthy modalities out of the profile's n available (k = 2 for life-safety — the RAID-1 principle: sound plus haptic plus visual simultaneously, not serially), and delivery is not success. The protocol's state machine is acknowledgment-gated, straight from the on-call tradition:

1. Emit on the k live channels, with distinctive class-specific patterns (the WEA tone-and-vibration discipline, generalized).
2. Watch for acknowledgment within the class's latency bound (a gesture, a tap, the wearable's confirm, the car's display touch).
3. Escalate on silence: walk the escalation graph — remaining modalities, then devices (wearable, bedside hub, car, TV, smart-speaker flash), then room (lights, if the home exposes them), then people: housemates, neighbors on a consented mesh, emergency contacts, and finally the emergency services pathway for life-safety class.
4. Terminate on acknowledgment, with the audit event recorded: which channel, which device, how long, what it took.

The graph walk is bounded by class (advisory: no walk; action: one step; life-safety: unbounded) and by the antifatigue governor (§5.5). The clinical alarm-fatigue literature is the design constraint walking in the front door: escalation that fires often and wrongly trains humans to ignore the walk, so the governor is a correctness requirement, not a comfort feature.

5.4 Channel health

Live channels are probed, not presumed: headphone state, noise floor, do-not-disturb context, wearable reachability, screen occlusion — the phone already senses most of this for other purposes, and the profile's routing table consumes it. Failed or degraded channels drop out of the live set before the alert chooses them. For the senses themselves, the acknowledgment stream is the probe: a user who never acknowledges the audio channel on night alerts has a profile that has already silently learned to route around that ear — aggregate, local, private, and self-maintaining.

5.5 The antifatigue governor

The safety layer must not become the engagement economy's next conquest, so the governor enforces: per-sender escalation budgets; silence-class routing (a sender that over-claims criticality is demoted by the platform's telemetry — the exact mechanism emergency-broadcast governance uses against alert abuse); silence debt accounting (P-006's attention-budget machinery, applied to the escalation graph); and class audit (the public, queryable record of who was granted life-safety privilege and what their miss and false-escalation rates are — the P-004 ledger discipline, applied to perception). The governor is what separates this specification from "a louder phone."

6.Evaluation design

1. Channel-death simulation. In controlled trials, degrade one channel at a time (noise, occlusion, sleep-stage-proxy) across alert classes; measure miss rate and acknowledgment latency for single-modality baselines versus k-of-n with escalation. The baseline's silent failures are the incumbent's score; the delta is the protocol's.
2. Capability-profile routing accuracy. Ground-truth the profile's routing table against declared reality (headphone state, noise floor, self-reported availability schedules): what fraction of routing decisions matched the person's actual live channels.
3. Escalation-specificity under adversarial senders. Simulate over-claiming senders and over-firing patterns; measure the governor's demotion latency and the human tolerance curve — the alarm-fatigue threshold moved from clinical folklore to a measured constant.
4. Night end-to-end. The hardest and most consequential case: sleeping user, phone charging out of reach, wearable on wrist — a life-safety alert's full walk (modalities → devices → room → people) with receipt verification at each stage, measured in wall-clock minutes. This study's number is the paper's headline deliverable: how long a house takes to notice its person did not notice.
5. Retrospective incident mapping. Re-run documented failure classes (missed evacuation alerts in deaf households, missed bedside medical alarms, overnight storm warnings for heavy sleepers) against the protocol's state machine: which escalation steps would have fired, when, against what acknowledgment latencies — the counterfactual audit that prices the incumbent in lives rather than anecdotes.

7.What this is not

This is not a louder notifications product — volume is the engagement stack's answer, and the protocol's answers are routing, redundancy, and receipt. This is not an assistive-device specification — the retrofit market serves its constituency; the protocol is the general layer underneath whose default path works for the situational channel death every body experiences nightly, with the permanent-impairment configurations as first-class profiles rather than bolt-ons. This is not P-006 — that paper schedules interruptions; this one guarantees landings; the boundary is clean (dispatch decides whether and when, delivery decides by which senses and with what proof of receipt), and the two share the budget machinery the way siblings share a kitchen. This is not a regulation proposal — though the class-governance surface is precisely what any future emergency-alert mandate would reference, the specification operates entirely inside a platform that volunteers it.

8.Objections, confronted

"Escalation that walks to bystanders and neighbors is a privacy and social nightmare." The person-graph is consented, local, and minimal — the delegated-operation machinery of P-013 provides its vocabulary (who may be escalated to, for which classes, at which hours), and every walk step is auditable and revocable. The nightmare version — a platform broadcasting your location to your contacts list — is a design failure this specification's consent choreography exists to prevent, not an inherent property of person-level escalation. The alternative is the current architecture's answer to the sleeping user: nobody.

"Senders will game criticality to own the top class." Yes — which is why the class is granted (accredited senders, platform review) and governed (the §5.5 demotion telemetry). This is the exact problem emergency-broadcast authorities solved at the message layer: alert fatigue from over-alerting authorities is a documented governance failure with a documented governance fix. The objection argues for the governor, not against the protocol.

"You cannot know whether a human perceived something without nagging them for acknowledgment." The acknowledgment forms are already-native gestures (dismiss, tap, wrist turn) at already-native moments, and the protocol's escalation only demands them for the classes that justify the cost — the action and life-safety tiers, where the alternative is not "no nag" but "no knowledge." The unacknowledged advisory class is untouched: nobody confirms a coupon. For life-safety, the on-call world has run this exact bargain for two decades, and every hospital and every pagee has accepted it, because silence must mean something.

"Situational sensing (headphones, noise, sleep) is unreliable and battery-hungry." The probes ride sensor states the phone already maintains for other subsystems (audio-route state, motion-idle, noise-floor taps that modern SoCs do at negligible cost), and the profile's priors degrade gracefully: when sensing is unsure, the default routing widens (more channels, not fewer). The failure mode of uncertain channel health is k-of-n overdelivery — one extra vibration — not silence. The objection's honest core is sleep-stage sensing, which is genuinely hard; the protocol's honest answer is that it does not need sleep stages, only the prior "it is 3 a.m. and the user granted night-cross-modal routing," which a schedule supplies.

"RAID for the senses is a cute metaphor, but senses are not disks — you cannot hot-swap a cochlea." The redundancy is at the delivery layer, not the organ: the protocol does not repair the ear, it routes around it in real time with the channels that remain — which is exactly what the deaf community's bed shakers do, one device and one alarm at a time, today, at retrofit prices. The metaphor's content is the engineering content: k-of-n, health-gated routing, and escalation on unacknowledged writes, pointed at perception instead of platters. The organ's non-substitutability at the biological layer is precisely why the failover must live one layer up, in the stack that chooses channels.

"This duplicates what WEA and emergency systems already do." WEA is the message layer's triumph and the perception layer's silence: the unique tone assumes the ear, the vibration assumes the pocket nerve, and beyond the phone there is no walk — no wearable, no room, no person, no acknowledgment, no escalation. CAP standardized one message, many delivery paths; nobody standardized the receiving side. This paper is that standard's missing half, and its composition with, not duplication of, the broadcast infrastructure.

9.Limitations

The capability profile's sensing ceiling is real: ambient state estimation (headphones on, actual noise exposure, sleep) is heuristic, and the protocol compensates with wider routing rather than knowledge — an overdelivery bias that is correct for safety and wasteful for battery, a trade the class structure bounds. Person-level escalation depends on social infrastructure (consented contacts, neighbor meshes) that is thin outside dense communities and absent in exactly the isolated households that need it most; the protocol routes around absence with the devices it has, and the coverage study (§6.5) must price this honestly. The criticality-class governance inherits the political economy of emergency-alerting — who accredits, who reviews, which nations' agencies participate — which is a legitimacy problem software cannot dissolve. Bystander escalation interacts with P-013's delegated-operation consent machinery, and the interaction's failure modes (stale escalation consents after family conflict) are estate-law-adjacent problems no state machine fully owns. And the antifatigue governor's thresholds are initially folklore with telemetry attached; the clinical alarm literature's constants will not transfer cleanly to the pocket, and calibrating them is a multi-year measurement program the specification enables but does not contain.

10.Conclusion

Every other failure-prone component in the stack has a failover story, and the one component guaranteed to fail every night — the sleeping human, the occluded channel, the aging ear — is wired as a single unprobed string from speaker to cortex. The fragments that would fix it have existed for decades in six different worlds: the deaf community's retrofit hardware, the broadcasters' one-message-many-paths discipline, the automotive cross-modal redundancy, the on-call acknowledgment walks, the clinical alarm-fatigue governors, and the sensory-substitution science that proved the brain does not care which channel arrives. What has never existed is the composition — criticality as a granted class, capability as a private local profile, delivery as k-of-n with escalation on silence, receipt as a first-class state, and a governor that keeps the safety layer from becoming engagement's next conquest. The specification above is buildable by any platform that decides perception is load-bearing. The first platform that does will have answered a question the fire-safety statistics have been asking for a hundred years: the alarm sounded — did anyone receive it?

11.References

1. National Fire Protection Association — home-fire death rates by age; adults 65+ at more than double the general rate. [Standards-body analyses; high confidence.]
2. NIDCD — roughly 15% of U.S. adults report some hearing difficulty. [Federal statistics; high confidence.]
3. OASIS Common Alerting Protocol (CAP) — one alert message, many delivery paths; born of post-9/11 alert interoperability. [Standard; high confidence.]
4. Wireless Emergency Alerts (WEA) — mandatory distinctive attention signal and vibration pattern; override-silent privilege. [Regulatory/platform record; high confidence.]
5. Bach-y-Rita, P. — sensory substitution research line from the 1960s onward. [Research line; high confidence on the line; specific-citation verification queued.]
6. The Joint Commission — National Patient Safety Goal on clinical alarm management; ECRI — repeated top ranking of alarm hazards in Top 10 Health Technology Hazards. [Institutional records; high confidence.]
7. iOS/Android — critical-alert privileges (override-DND entitlements), per-channel settings, LED-flash alert accommodation. [Platform records; high confidence.]
8. Automotive cross-modal warning design (haptic lane-departure, multimodal collision alerts). [Domain practice; high confidence.]
9. Paging/on-call escalation systems — acknowledgment-gated escalation, timing budgets, audit. [Operations practice; high confidence.]
10. NFPA 72 and building-code requirements for strobes and bed shakers in identified-disability installations. [Standards record; high confidence.]
11. p-rick P-006, The Attention Scheduler — dispatch-side protocol; this paper is the delivery-side sibling. [Program cross-reference.]
12. p-rick P-013, Delegated Operation — consent vocabulary for the person-level escalation graph. [Program cross-reference.]
13. p-rick P-004, Degradation Contracts — the ledger discipline the criticality-class governance borrows. [Program cross-reference.]
14. p-rick P-009, Circadian Orchestration — local, private biological-state handling precedent. [Program cross-reference.]

Working-paper note: references marked "verification queued" are recorded from domain knowledge at high confidence and await the program's live citation-verification pass (see agents.md); the verification ledger is maintained with the paper sources.