Fail-safe

<h2 id="examples">Examples</h2>
<h3>Mechanical or physical</h3>
Examples include:

<ul><li>Safety valves – Various devices that operate with <a href="/facts/Fluid/wLnMhBC0">fluids</a> use <a href="/facts/Fuse_(hydraulic)/Cjx58d4V">fuses</a> or <a href="/facts/Safety_valve/2QQS5g4X">safety valves</a> as fail-safe mechanisms.</li>
<li>Roller-shutter fire doors that are activated by building alarm systems or local smoke detectors must close automatically when signaled regardless of power. In case of power outage the coiling fire door does not need to close, but must be capable of automatic closing when given a signal from the building alarm systems or smoke detectors. A temperature-sensitive <a href="/facts/Fusible_link/c2x1q8bI">fusible link</a> may be employed to hold the fire doors open against gravity or a closing spring. In case of fire, the link melts and releases the doors, and they close.</li>
<li>Some airport <a href="/facts/Baggage/1mHowmQw">baggage</a> <a href="/facts/Cart/f1wRNE8W">carts</a> require that the person hold down a given cart's handbrake switch at all times; if the handbrake switch is released, the brake will activate, and assuming that all other portions of the braking system are working properly, the cart will stop. The handbrake-holding requirement thus both operates according to the principles of "fail-safety" and contributes to (but does not necessarily ensure) the fail-security of the system. This is an example of a <a href="/facts/Dead_man%2527s_switch/Xv2PQhkJ">dead man's switch</a>.</li>
<li><a href="/facts/Lawnmower/sVtTfejM">Lawnmowers</a> and <a href="/facts/Snow_blower/jEBq8ev6">snow blowers</a> have a hand-closed lever that must be held down at all times. If it is released, it stops the blade's or rotor's rotation. This also functions as a dead man's switch.</li>
<li><a href="/facts/Air_brake_(rail)/xDcamejB">Air brakes</a> on railway <a href="/facts/Train/0mkFQDg9">trains</a> and <a href="/facts/Air_brake_(road_vehicle)/GhQnan8L">air brakes</a> on <a href="/facts/Truck/9GMJWsQU">trucks</a>. The brakes are held in the "off" position by air <a href="/facts/Pressure/eyc37GRG">pressure</a> created in the brake system. Should a brake line split, or a carriage become uncoupled, the air pressure will be lost and the brakes applied, by springs in the case of trucks, or by a local air reservoir in trains. It is impossible to drive a truck with a serious leak in the air brake system. (Trucks may also employ <a href="/facts/Wig_wag_(truck_braking_systems)/GhQnan8L">wig wags</a> to indicate low air pressure.)</li>
<li>Motorized gates – In case of power outage the gate can be pushed open by hand with no crank or key required. However, as this would allow virtually anyone to go through the gate, a fail-secure design is used: In a power outage, the gate can only be opened by a hand crank that is usually kept in a safe area or under lock and key. When such a gate provides vehicle access to homes, a fail-safe design is used, where the door opens to allow fire department access.</li>
<li> A <a href="/facts/Railway_semaphore_signal/qPCs28FB">railway semaphore signal</a> is specially designed so that, should the cable controlling the signal break, the arm returns to the "danger" position, preventing any trains passing the inoperative signal.</li>
<li><a href="/facts/Isolation_valve/AUtsSr29">Isolation valves</a>, and control valves, that are used for example in systems containing hazardous substances, can be designed to close upon loss of power, for example by spring force. This is known as fail-closed upon loss of power.</li>
<li>An <a href="/facts/Elevator/ug3nh0o8">elevator</a> has brakes that are held off brake pads by the tension of the elevator cable. If the cable breaks, tension is lost and the brakes latch on the rails in the shaft, so that the elevator cabin does not fall.</li>
<li>Vehicle air conditioning – Defrost controls require vacuum for diverter damper operation for all functions except defrost. If vacuum fails, defrost is still available.</li></ul>
<h3>Electrical or electronic</h3>
Examples include:

<ul><li>Many devices are protected from <a href="/facts/Short_circuit/r09vaaeQ">short circuit</a> by <a href="/facts/Fuse_(electrical)/xN78ylMS">fuses</a>, <a href="/facts/Circuit_breaker/vbw6cWSe">circuit breakers</a>, or <a href="/facts/Current_limiting/YjYf608t">current limiting</a> circuits. The electrical interruption under overload conditions will prevent damage or destruction of wiring or circuit devices due to overheating.</li>
<li><a href="/facts/Avionics/F4gQJBJn">Avionics</a><a class="footnote-ref" id="fnref:5" href="#fn:5">5</a> using <a href="/facts/Redundancy_(engineering)/odqzTmIo">redundant systems</a> to perform the <a href="/facts/Triple_modular_redundancy/QzscWD2F">same computation using three different systems</a>. Different results indicate a fault in the system.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a></li>
<li><a href="/facts/Drive-by-wire/1qnGSQID">Drive-by-wire</a> and <a href="/facts/Fly-by-wire/nhyXB248">fly-by-wire</a> controls such as an Accelerator Position Sensor typically have two potentiometers which read in opposite directions, such that moving the control will result in one reading becoming higher, and the other generally equally lower. Mismatches between the two readings indicates a fault in the system, and the <a href="/facts/Engine_control_unit/Q1uYhmyN">ECU</a> can often deduce which of the two readings is faulty.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a></li>
<li><a href="/facts/Traffic_light/v5pwcfsQ">Traffic light</a> controllers use a Conflict Monitor Unit to detect faults or conflicting signals and switch an intersection to an all flashing error signal, rather than displaying potentially dangerous conflicting signals, e.g. showing <a href="/facts/Green/gFTac7St">green</a> in all directions.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a></li>
<li>The automatic protection of programs and/or processing systems when a <a href="/facts/Computer_hardware/8jSjsCNv">computer hardware</a> or <a href="/facts/Software/RP79lVSW">software</a> failure is detected in a <a href="/facts/Computer_system/SQe1aK05">computer system</a>. A classic example is a <a href="/facts/Watchdog_timer/QaXKTqL8">watchdog timer</a>. See <a href="/facts/Fail-safe_(computer)/rasrYlJk">Fail-safe (computer)</a>.</li>
<li>A <a href="/facts/Control_operation/umJaqX4j">control operation</a> or function that prevents improper system functioning or <a href="/facts/Catastrophic_failure/X5NDNv9r">catastrophic</a> degradation in the event of <a href="/facts/Electronic_circuit/IRfQ6Cc2">circuit</a> malfunction or operator error; for example, the failsafe <a href="/facts/Track_circuit/Txl75Un6">track circuit</a> used to control <a href="/facts/Railway_signaling/yK37bHt7">railway block signals</a>. The fact that a flashing amber is more permissive than a solid amber on many railway lines is a sign of a failsafe, as the relay, if not working, will revert to a more restrictive setting.</li>
<li>The iron pellet ballast on the <a href="/facts/Bathyscaphe/bGWTfoow">Bathyscaphe</a> is dropped to allow the submarine to ascend. The ballast is held in place by <a href="/facts/Electromagnet/3YMYtSMX">electromagnets</a>. If electrical power fails, the ballast is released, and the submarine then ascends to safety.</li>
<li>Many <a href="/facts/Nuclear_reactor/8xqjIbge">nuclear reactor</a> designs have neutron-absorbing control rods suspended by electromagnets. If the power fails, they drop under gravity into the core and shut down the chain reaction in seconds by absorbing the neutrons needed for fission to continue.</li>
<li>In <a href="/facts/Industrial_automation/3YlF2K5q">industrial automation</a>, alarm circuits are usually "<a href="/facts/Normally_closed/vqbNDgYm">normally closed</a>". This ensures that in case of a wire break the alarm will be triggered. If the circuit were normally open, a wire failure would go undetected, while blocking actual alarm signals.</li>
<li>Analog sensors and modulating actuators can usually be installed and wired such that the circuit failure results in an out-of-bound reading – see <a href="/facts/Current_loop/FCnMkkWn">current loop</a>. For example, a potentiometer indicating pedal position might only travel from 20% to 80% of its full range, such that a cable break or short results in a 0% or 100% reading.</li>
<li>In control systems, critically important signals can be carried by a complementary pair of wires (<signal> and <not_signal>). Only states where the two signals are opposite (one is high, the other low) are valid. If both are high or both are low the control system knows that something is wrong with the sensor or connecting wiring. Simple failure modes (dead sensor, cut or unplugged wires) are thereby detected. An example would be a control system reading both the <a href="/facts/Normally_open/vqbNDgYm">normally open</a> (NO) and <a href="/facts/Normally_closed/vqbNDgYm">normally closed</a> (NC) poles of a <a href="/facts/Switch/vqbNDgYm">SPDT</a> selector switch against common, and checking them for coherency before reacting to the input.</li>
<li>In <a href="/facts/HVAC_control_system/9EUfV10U">HVAC control systems</a>, <a href="/facts/Actuators/mF9qVJJR">actuators</a> that control dampers and valves may be fail-safe, for example, to prevent coils from freezing or rooms from overheating. Older <a href="/facts/Pneumatic_actuators/FQEH81rs">pneumatic actuators</a> were inherently fail-safe because if the air pressure against the internal diaphragm failed, the built-in spring would push the actuator to its home position – of course the home position needed to be the "safe" position. Newer electrical and electronic actuators need additional components (springs or capacitors) to automatically drive the actuator to home position upon loss of electrical power.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a></li>
<li><a href="/facts/Programmable_logic_controller/bqh0GAdb">Programmable logic controllers</a> (PLCs). To make a PLC fail-safe the system does not require energization to stop the drives associated. For example, usually, an emergency stop is a normally closed contact. In the event of a power failure this would remove the power directly from the coil and also the PLC input. Hence, a fail-safe system.</li>
<li>If a <a href="/facts/Voltage_regulator/RWQATaje">voltage regulator</a> fails, it can destroy connected equipment. A <a href="/facts/Crowbar_(circuit)/zkTmPxkS">crowbar (circuit)</a> prevents damage by short-circuiting the power supply as soon as it detects overvoltage.</li></ul>
<h3>Procedural safety</h3>
As well as physical devices and systems fail-safe procedures can be created so that if a procedure is not carried out or carried out incorrectly no dangerous action results. 
For example:

<ul><li>Spacecraft trajectory - During early <a href="/facts/Apollo_program/IC1Ek1Ao">Apollo program</a> missions to the Moon, the spacecraft was put on a <a href="/facts/Free_return_trajectory/2oquNMDy">free return trajectory</a> — if the engines had failed at <a href="/facts/Lunar_orbit/486BxvD6">lunar orbit</a> insertion, the craft would have safely coasted back to Earth.</li>
<li>The pilot of an aircraft landing on an <a href="/facts/Aircraft_carrier/90vrSN0V">aircraft carrier</a> increases the throttle to full power at touchdown. If the <a href="/facts/Arresting_wire/oHfhhnhj">arresting wires</a> fail to capture the aircraft, it is able to take off again; this is an example of fail-safe practice.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a></li>
<li>In <a href="/facts/Railway_signalling/yK37bHt7">railway signalling</a> signals which are not in active use for a train are required to be kept in the 'danger' position. The default position of every controlled absolute signal is therefore "danger", and therefore a positive action — setting signals to "clear" — is required before a train may pass. This practice also ensures that, in case of a fault in the signalling system, an incapacitated signalman, or the unexpected entry of a train, that a train will never be shown an erroneous "clear" signal.</li>
<li>Railroad engineers are instructed that a railway signal showing a confusing, contradictory or unfamiliar aspect (for example a <a href="/facts/Railway_signalling/yK37bHt7">colour light signal</a> that has suffered an electrical failure and is showing no light at all) must be treated as showing "danger". In this way, the driver contributes to the fail-safety of the system.</li></ul>
<h2 id="other-terminology">Other terminology</h2>
Fail-safe (<a href="/facts/Idiot_proof/kH2AHCmh">foolproof</a>) devices are also known as <a href="/facts/Poka-yoke/kGc3W5UE">poka-yoke</a> devices. Poka-yoke, a <a href="/facts/Japanese_language/EEv485a5">Japanese</a> term, was coined by <a href="/facts/Shigeo_Shingo/CPSGJ0M1">Shigeo Shingo</a>, a quality expert.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a><a class="footnote-ref" id="fnref:12" href="#fn:12">12</a> "Safe to fail" refers to civil engineering designs such as the <a href="/facts/Room_for_the_River_(Netherlands)/YpqfvwgF">Room for the River project in Netherlands</a> and the Thames Estuary 2100 Plan<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a><a class="footnote-ref" id="fnref:14" href="#fn:14">14</a> which incorporate flexible adaptation strategies or <a href="/facts/Climate_change_adaptation/RoUgv5FF">climate change adaptation</a> which provide for, and limit, damage, should severe events such as 500-year floods occur.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a>

<h3>Fail safe and fail secure</h3>
Fail-safe and fail-secure are distinct concepts. Fail-safe means that a device will not endanger lives or property when it fails. Fail-secure, also called fail-closed, means that access or data will not fall into the wrong hands in a security failure. Sometimes the approaches suggest opposite solutions. For example, if a building catches fire, fail-safe systems would unlock doors to ensure quick escape and allow firefighters inside, while fail-secure would lock doors to prevent unauthorized access to the building.
The opposite of fail-closed is called fail-open.

<h3>Fail active operational</h3>
Fail active operational can be installed on systems that have a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active operational) and a second failure can be detected – at which point the system will turn itself off (uncouple, fail passive). One way of accomplishing this is to have three identical systems installed, and a control logic which detects discrepancies. An example for this are many aircraft systems, among them <a href="/facts/Inertial_navigation_system/UzUTMhK2">inertial navigation systems</a> and <a href="/facts/Pitot_tube/5xSGoYJf">pitot tubes</a>.

<h3>Failsafe point</h3>
During the <a href="/facts/Cold_War/spJdJQ3q">Cold War</a>, "failsafe point" was the term used for the point of no return for American <a href="/facts/Strategic_Air_Command/Qp0Y5xpB">Strategic Air Command</a> nuclear bombers, just outside Soviet airspace. In the event of receiving an attack order, the bombers were required to linger at the failsafe point and wait for a second confirming order; until one was received, they would not arm their bombs or proceed further.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a> The design was to prevent any single failure of the American command system causing nuclear war. This sense of the term entered the American popular lexicon with the publishing of the 1962 novel <a href="/facts/Fail-Safe_(novel)/m6TWhFyg">Fail-Safe</a>.
(Other nuclear war command control systems have used the opposite scheme, <a href="/facts/Fail-deadly/pENDtlaJ">fail-deadly</a>, which requires continuous or regular proof that an enemy first-strike attack has not occurred to prevent the launching of a nuclear strike.)

<h2 id="see-also">See also</h2>

Look up fail-safe in Wiktionary, the free dictionary.

<ul><li><a href="/facts/Fail-fast_system/HuFuzIBn">Fail-fast system</a></li>
<li><a href="/facts/Control_theory/aIuERpn6">Control theory</a></li>
<li><a href="/facts/Dead_man%2527s_switch/Xv2PQhkJ">Dead man's switch</a></li>
<li><a href="/facts/EIA-485/YEABejzm">EIA-485</a></li>
<li><a href="/facts/Elegant_degradation/LRtLyo1s">Elegant degradation</a></li>
<li><a href="/facts/Failing_badly/F33VVMWL">Failing badly</a></li>
<li><a href="/facts/Fail-deadly/pENDtlaJ">Fail-deadly</a></li>
<li><a href="/facts/Fault_tolerance/rasrYlJk">Fault tolerance</a></li>
<li><a href="/facts/IEC_61508/ukK51hVR">IEC 61508</a></li>
<li><a href="/facts/Interlock/frBze9R9">Interlock</a></li>
<li><a href="/facts/Safe-life_design/X4woW3by">Safe-life design</a></li>
<li><a href="/facts/Safety_engineering/ywUBoqda">Safety engineering</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"Fail-safe". AudioEnglich.net. Accessed 2009.12.31 <a href="http://www.audioenglish.net/dictionary/fail-safe.htm" target="_blank">http://www.audioenglish.net/dictionary/fail-safe.htm</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">e.g., David B. Rutherford Jr., What Do You Mean It\'s Fail Safe? . 1990 Rapid Transit Conference <a href="https://web.archive.org/web/20111008021648/http://www.billpetit.com/Papers/Petit017.pdf" target="_blank">https://web.archive.org/web/20111008021648/http://www.billpetit.com/Papers/Petit017.pdf</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Force V: The history of Britain's airborne deterrent, by Andrew Brookes. Jane's Publishing Co Ltd; First Edition 1 Jan. 1982, ISBN 0710602383, p.144. <a href="/wiki/ISBN_(identifier)" target="_blank">/wiki/ISBN_(identifier)</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Bornschlegl, Susanne (2012). Ready for SIL 4: Modular Computers for Safety-Critical Mobile Applications. MEN Mikro Elektronik. Archived from the original (pdf) on 2019-06-09. Retrieved 2015-09-21. <a href="https://web.archive.org/web/20190609205912/https://www.menmicro.com/downloads/search/dl/sk/%22White%20Paper%3A%20Ready%20for%20SIL4%3A%20Modular%20Computers%20for%20Safety-Critical%20Mobile%20Applications%22/dx/1/" target="_blank">https://web.archive.org/web/20190609205912/https://www.menmicro.com/downloads/search/dl/sk/%22White%20Paper%3A%20Ready%20for%20SIL4%3A%20Modular%20Computers%20for%20Safety-Critical%20Mobile%20Applications%22/dx/1/</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Wragg, David W. (1973). A Dictionary of Aviation (first ed.). Osprey. p. 127. ISBN 9780850451634. <a href="9780850451634" target="_blank">9780850451634</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Bornschlegl, Susanne (2012). Ready for SIL 4: Modular Computers for Safety-Critical Mobile Applications. MEN Mikro Elektronik. Archived from the original (pdf) on 2019-06-09. Retrieved 2015-09-21. <a href="https://web.archive.org/web/20190609205912/https://www.menmicro.com/downloads/search/dl/sk/%22White%20Paper%3A%20Ready%20for%20SIL4%3A%20Modular%20Computers%20for%20Safety-Critical%20Mobile%20Applications%22/dx/1/" target="_blank">https://web.archive.org/web/20190609205912/https://www.menmicro.com/downloads/search/dl/sk/%22White%20Paper%3A%20Ready%20for%20SIL4%3A%20Modular%20Computers%20for%20Safety-Critical%20Mobile%20Applications%22/dx/1/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">"P2138 DTC Throttle/Pedal Pos Sensor/Switch D / E Voltage Correlation". www.obd-codes.com. <a href="http://www.obd-codes.com/p2138" target="_blank">http://www.obd-codes.com/p2138</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Manual on Uniform Traffic Control Devices, Federal Highway Administration, 2003 <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"When Failure Is Not an Option: The Evolution of Fail-Safe Actuators". KMC Controls. 29 October 2015. Retrieved 12 April 2021. <a href="https://www.kmccontrols.com/blog/when-failure-is-not-an-option-the-evolution-of-fail-safe-actuators/" target="_blank">https://www.kmccontrols.com/blog/when-failure-is-not-an-option-the-evolution-of-fail-safe-actuators/</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Harris, Tom (29 August 2002). "How Aircraft Carriers Work". HowStuffWorks, Inc. Retrieved 2007-10-20. <a href="http://science.howstuffworks.com/aircraft-carrier4.htm" target="_blank">http://science.howstuffworks.com/aircraft-carrier4.htm</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">Shingo, Shigeo; Andrew P. Dillon (1989). A study of the Toyota production system from an industrial engineering viewpoint. Portland, Oregon: Productivity Press. p. 22. ISBN 0-915299-17-8. OCLC 19740349 <a href="/wiki/ISBN_(identifier)" target="_blank">/wiki/ISBN_(identifier)</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">John R. Grout, Brian T. Downs. "A Brief Tutorial on Mistake-proofing, Poka-Yoke, and ZQC", MistakeProofing.com Archived 2016-03-19 at the Wayback Machine <a href="http://www.mistakeproofing.com/tutorial.html" target="_blank">http://www.mistakeproofing.com/tutorial.html</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">"Thames Estuary 2100 Plan" (PDF). UK Environment Agency. November 2012. Archived from the original (PDF) on 2012-12-10. Retrieved March 20, 2013. <a href="http://webarchive.nationalarchives.gov.uk/20121210131034/http://www.environment-agency.gov.uk/static/documents/Leisure/SE_TE2100_briefing.pdf" target="_blank">http://webarchive.nationalarchives.gov.uk/20121210131034/http://www.environment-agency.gov.uk/static/documents/Leisure/SE_TE2100_briefing.pdf</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">"Thames Estuary 2100 (TE2100)". UK Environment Agency. Retrieved March 20, 2013. <a href="http://www.environment-agency.gov.uk/homeandleisure/floods/125045.aspx" target="_blank">http://www.environment-agency.gov.uk/homeandleisure/floods/125045.aspx</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Jennifer Weeks (March 20, 2013). "Adaptation expert Paul Kirshen proposes a new paradigm for civil engineers: 'safe to fail,' not 'fail safe'". The Daily Climate. Archived from the original on May 13, 2013. Retrieved March 20, 2013. <a href="https://web.archive.org/web/20130513080832/http://wwwp.dailyclimate.org/tdc-newsroom/2013/03/flexible-infrastructure-climate-stress" target="_blank">https://web.archive.org/web/20130513080832/http://wwwp.dailyclimate.org/tdc-newsroom/2013/03/flexible-infrastructure-climate-stress</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">"fail-safe". Dictionary.com. Retrieved November 7, 2021. <a href="https://www.dictionary.com/browse/failsafe" target="_blank">https://www.dictionary.com/browse/failsafe</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
</ol>

Fail-safe open-in-new

Fail-safe