Fail-safe

Fail-safe or fail-secure describes a device or feature which, in the event of failure, responds in a way that will cause no harm or at least a minimum of harm to other devices or danger to personnel. Fail-safe components of a system are distinguished from fail-secure components in that, in the former, component failure allows but does not cause or invite a certain improper system behavior, whereas in the latter, component failure does not allow a certain improper system behavior, although some proper behaviors are impeded. For example, a lock that unlocks at the wrong time has failed, but it may be considered fail-safe if its failure does not send the door flying open or attract undue attention to the door's unlocked state. In contrast, a fail-secure lock will remain locked during a failure, but cannot be unlocked even by the correct key.

Definitions

• “A device that will provide its intended function upon loss of power.” (2007 NFPA-80)
• An operation which ensures that a failure of equipment, process, or system does not propagate beyond the immediate environs of the failing entity.

For instance, if power fails to a door, the door will allow exit but not entry.

Examples

Mechanical or physical

An F/A-18A Hornet lights its afterburners to maintain full power following a night arrested landing aboard the aircraft carrier USS Harry S. Truman

• Aircraft landing on an aircraft carrier increase the throttle to full power at touchdown. If the arresting wires fail to capture the plane, it safely takes off again.^[1]
• Coiling/Rolling Fire Doors that are activated by building alarm systems or local smoke detectors must close automatically when signaled regardless of power. In case of power outage the coiling fire door does not need to close, but must be capable of automatic closing when given a signal from the building alarm systems or smoke detectors. A temperature sensitive fusible link may be employed to hold the fire doors open against gravity or a closing spring. In case of fire, the link melts, releases the doors and they close.
• Luggage carts in airports in which the hand-brake must be held down at all times. If it is released, the cart will stop. See dead man's switch.
• Air brakes on railway trains and air brakes on trucks. The brakes are held in the 'off' position by air pressure created in the brake system. Should a brake line split, or a carriage become de-coupled, the air pressure will be lost and the brakes applied. It is impossible to drive a train or truck with a serious leak in the air brake system.
• Motorized gates - In case of power outage the gate can be pushed open by hand with no crank or key required. However, as this would allow virtually anyone to go through the gate, a fail-secure design is used: In a power outage, the gate can only be opened by a hand crank that is usually kept in a safe area.
• During early Apollo program missions to the Moon, the spacecraft was put on a free return trajectory – if the engines failed at lunar orbit insertion, the craft would safely coast back to Earth.

Electrical or electronic

• Avionics using redundant systems to perform the same computation with voting logic to determine the "safe" result.
• Traffic light controllers use a Conflict Monitor Unit to detect faults or conflicting signals and switch an intersection to all flashing red, rather than displaying potentially dangerous conflicting signals, e.g. showing green in all directions.^[2]
• The automatic protection of programs and/or processing systems when a hardware or software failure is detected in a computer system. A classic example is a Watchdog timer. See fail-safe (computer).
• A control operation or function that prevents improper system functioning or catastrophic degradation in the event of circuit malfunction or operator error; for example, the failsafe track circuit used to control railway block signals.
• The iron pellet ballast on the Bathyscaphe is dropped to allow the submarine to ascend. The ballast is held in place by electromagnets. If electrical power fails the ballast is released, and the submarine then ascends to safety.
• Inside a modern CPU are implementations to prevent damage through overheating. In the event of cooling failure, the CPU will throttle then shut down beyond a critical temperature threshold to avoid damage.

Strategic

• A system that has been structured such that it cannot fail (or that the probability of such failure is extremely low) to accomplish its assigned mission, regardless of environmental factors; for example, the hardening of a nuclear missile bunker, or the dispersion of nuclear bombers to multiple secret locations.

Other terminology

Fail-safe (foolproof) devices are also known as Poka-Yoke devices. Poka-yoke, a Japanese term, was coined by Shigeo Shingo, a quality guru.

Related

• Control theory
• Dead man's switch
• Fail-deadly
• Fault-tolerant system
• Interlock
• Safe-life design
• Safety engineering
• Poka-yoke
• EIA-485

References