Clause 5.7: Intervenability
Intervenability describes how far an operator can step in to prevent harm or hazard.
What clause 5.7 is
Intervenability describes how far an operator can step in to prevent harm or hazard. The point is to see the current state and move the system out of a hazardous state into a safe one. It is more fundamental than ordinary operability because its purpose is harm prevention, not ease of use. The second edition places it under safety.
What the 2023 edition said
The first edition placed intervenability under usability and described seeing the state, moving out of a hazardous state into a safe one, and the difference from operability.
What the second edition changes
The characteristic moves under safety, following the 2023 base model, which makes safety a top-level characteristic. The substance is unchanged.
The FDIS text is not public. The change line above is read from the public draft, which is not the FDIS and may differ. No clause level diff is invented here. The ISO stage record is the authority for the dates.
Why it matters to the buyer
The move is not cosmetic. Under safety, intervenability has to connect to the hazard analysis, the safe state and the operator's authority. Under usability it was easy to treat as a button.
What to write in the requirement
Define the safe state for each hazardous condition, the observable signals that tell the operator the state, and the action that moves the system to safety. Test the transition. Record who is authorised and how the authority is delegated out of hours.
Evidence a reviewer asks for
A reviewer will ask what the safe state is and who can put the system into it at three in the morning.
- Safe stateThe safe state defined per hazardous condition, with the observable signals that announce it
- Transition testA dated test of the move from the unsafe to the safe state, with the time taken
- AuthorityThe operator role, the delegation and the out-of-hours arrangements
Where it commonly fails
- A stop control with no defined safe state
- The operator cannot observe the state
- No out-of-hours authority
What to do before publication
Connect the intervention to the hazard analysis. A control that is not tied to a hazard is decoration.
Read across
Source for clause 5.7: ISO/IEC 25059, Clause 5.7, retrieved 20 October 2026. The change line rests on the public draft of the second edition and ISO page 88234. The requirement, evidence and gaps are written from our record. Every source.