Where the clock stops
The clock stops when the last downstream action has stopped. A screen saying the request was received does not stop it.
What is time to halt (TTH)?
Time to halt (TTH) is the time between a request to halt an automated system and the moment it stops acting.
Time to halt (TTH) is the time from a request to halt a system to the moment it has stopped acting. The request can come from an operator or from a person the system affects. A TTH target says how fast a halt has to work.
The casebook's “time to halt” measures a different interval, from the first harm to the halt. Robodebt was halted the month the Federal Court forced the question, three years and four months after the first harm. A system can stop fast on request and still run for years before anyone with authority makes the request.
A hypothetical case. A payments platform sets a five-second TTH target. Any queued transfer stops within five seconds of a person pressing the halt control.
In the glossary: Time to halt (TTH).
Mechanism, drawn
Time to halt and blast radius
Time to halt runs from the halt request to the moment the last downstream action stops. A screen saying the request was received does not stop the clock. If a halt takes longer than the harm takes to spread, the halt control protects no one. The casebook's time to halt is a different interval: from the first harm to the halt.
In practice
What to look for
The slowest halts
An average can look fine while the slowest halts still do harm. Set p95 and p99 targets for the actions that do the most harm.
A record of each missed target
Keep a TTH histogram for each endpoint, the dependencies that slowed it, and a review of every missed target.
Where the standards use it:
- STD-01 — The Temporal Bill of Rights (standard). Map TTH targets to the timing obligations in Article I and Article III.
- STD-01 evidence pack. Check time to halt against runtime logs and halt receipts.
What is a reasonable TTH target?
The faster an action does harm, the shorter the target. The highest-risk actions need to stop in under a second, or within a few seconds.
Does a fast halt fix the problem?
No. A halt contains the harm. The rule that produced it still has to be corrected by its owner, and the people harmed still have to be restored.