What is Fail-safe?
Fail-safe is a design principle in which a system is built so that a fault, loss of power or loss of communication automatically brings it into a predefined safe state, keeping people, the environment and the installation protected. The premise is not that nothing ever goes wrong, but that the most likely faults (a broken wire, a power failure, a hung processor) push the process towards the safe side. In industrial automation, fail-safe design underpins emergency stops, safety relays, safety PLCs and Safety Instrumented Systems.
The underlying premise is: if something goes wrong, the system must fail safely, even if that means the process temporarily stops.
🧠 How does the fail-safe principle work?
A fail-safe design uses stored energy or physics to reach the safe state. No active energy is needed to become safe; energy is needed to keep the installation out of the safe state. Typical mechanisms:
- Spring return - a pneumatic control valve or actuator with a spring moves to its spring position on loss of instrument air or power.
- Normally energised (de-energise to trip) - the safety signal is ‘high’ while everything is healthy. To the logic, a broken wire, a loose terminal or a failed power supply looks exactly like a trip.
- Gravity and brakes - a lift brake or motor brake is spring-applied and released electrically; when power is lost, the brake engages.
- Watchdog and timeout - a controller or communication link must ‘check in’ regularly. If it does not, the outputs go to a safe value.
- Positive opening and force-guided contacts - an emergency stop button opens its contact mechanically, even if the contact has welded (direct opening action, IEC 60947-5-1 Annex K). A safety relay has force-guided contacts and monitors the normally closed contacts of the contactors it drives through a feedback loop, so that a welded contact is detected and a restart is blocked.
The idea predates electronics. George Westinghouse’s first air brake of 1869 was not fail-safe: if the brake pipe leaked, the train could not brake. His automatic air brake, patented in 1872, inverted the principle. Air pressure holds the brakes off, so a ruptured pipe or a wagon breaking away makes the brakes apply rather than fail.
🏭 Which safe state do you choose per application?
The safe state is not always ‘off’ or ‘closed’. It follows from the risk analysis, for example a HAZOP or LOPA, and may differ from device to device.
| Application | Fail-safe behaviour | Why this direction? |
|---|---|---|
| Fuel gas valve on a furnace | Spring closes the valve (fail-closed, FC) | No more fuel to the flame |
| Cooling water valve on an exothermic reactor | Spring opens the valve (fail-open, FO) | Cooling must continue during a failure |
| Control valve in a flow process | Stays in position (fail-last, FL) | Sudden opening or closing would cause pressure surges |
| Lift | Spring-applied brake engages, safety gear grips on overspeed | The car must not fall or drift |
| Machine with a rotating axis | Stop category 0 or 1 per IEC 60204-1, often via Safe Torque Off in the drive | No motion without energy |
| Output of a PLC or controller on an internal fault | Outputs to a preset safe value (usually 0) | No uncontrolled actuation |
| Transmitter on a 4-20 mA loop | Signal to ≤ 3.6 mA or ≥ 21 mA (NAMUR NE 43) | The logic recognises the fault and can trip |
The FC, FO and FL designations come from the process instrumentation symbols of ISA-5.1 and appear next to every valve on a P&ID. Choosing the wrong failure direction is a classic design error: a cooling water valve that closes on air failure turns a fault into a hazard.
⚙️ How does fail-safe fit into functional safety?
Fail-safe is part of functional safety and SIL concepts, but not the same thing. The standards make the principle measurable:
- IEC 61508 distinguishes safe and dangerous failure modes. The safe failure fraction (SFF) expresses the share of failures that are safe or detected by diagnostics. Together with hardware fault tolerance, it determines which SIL a subsystem may claim.
- IEC 61511 for the process industry requires the choice between de-energise to trip and energise to trip to be recorded in the safety requirements specification. Energise to trip is permitted, for instance for deluge systems where a spurious trip itself causes damage, but only with extra measures such as power supply monitoring and line monitoring of the wiring.
- ISO 13849-1 for machinery requires basic safety principles in every category, and the lists in ISO 13849-2 include the de-energisation principle. Without that foundation no Performance Level can be claimed. IEC 62061 is the equivalent SIL-based machinery standard.
- The Machinery Directive 2006/42/EC requires that a fault in the hardware or software of the control system does not lead to hazardous situations. The Machinery Regulation (EU) 2023/1230, applicable from 20 January 2027, adds reasonably foreseeable malicious attempts by third parties.
A safety PLC is often the logic solver of the SIS itself. When it detects an internal fault, it drives its own outputs to the safe state; it does not need to alert another system to do so.
🔄 What is the difference between fail-safe, fail-secure and fail-operational?
| Term | Behaviour on failure | Typical example |
|---|---|---|
| Fail-safe | System goes to a safe state, even if the process stops | Emergency stop circuit, spring-return valve |
| Fail-secure | System remains closed or locked | Electric lock on a server room that stays locked on power loss |
| Fail-operational | System keeps functioning, possibly degraded | Redundant flight controls in an aircraft |
| High Availability | Service stays available via redundancy and failover | Redundant SCADA server pair |
| Fail-open (network) | Traffic passes through unfiltered | Inline device with bypass on failure |
Safety and security clash directly at doors. An escape door must open on power loss (fail-safe for people), while a vault door must stay shut (fail-secure for assets). Fail-safe does not mean ‘reliable’ or ‘fault-free’ either: a fail-safe installation may actually stop more often, because every broken wire causes a trip.
🔐 What does fail-safe mean for OT security?
In IT/OT environments the term gains a second layer. As early as 1975, Saltzer and Schroeder formulated the principle of fail-safe defaults: access is denied by default and only granted explicitly. You see it in access control and in the default deny rule of a firewall.
- Network devices - a firewall between SCADA and the office network should block when it fails, whereas an inline device inside a control loop is sometimes better off passing traffic. Record that choice deliberately, just as you would for a valve.
- Safe communication - PROFIsafe and CIP Safety guard every telegram with a timeout and a CRC. If no valid message arrives within the configured time, the safety outputs fall back to their safe value; PROFIsafe calls this passivation, with fail-safe substitute values. Recovery (reintegration) usually requires operator acknowledgement.
- Data diodes are physically one-way: neither a defect nor an attack can reverse the direction.
- HMI notifications - a fail-safe action must be visible, so the operator knows why the process has stopped and does not simply reset it.
The TRITON attack of 2017 shows both sides. The attackers tried to reprogram Triconex safety controllers, but a bug in their code caused the controller to detect an anomaly and bring the plant to its safe state. The fail-safe design worked, and the investigation into those unexplained trips brought the attack to light. It also shows that an attacker who can change the safety logic can disable fail-safe behaviour itself. That is why IEC 62443 calls for separating safety systems and strictly managing engineering access.
🔧 How do you design fail-safe behaviour in practice?
- Define the safe state per function - from the risk analysis, not from habit. Record whether a valve must be FC, FO or FL.
- Choose the energy direction - de-energise to trip by default; energise to trip only with justification and with power supply and line monitoring.
- Configure controller outputs - set the behaviour on CPU stop or communication loss per output card (0, last value or a fixed value) and test it.
- Use diagnostics - choose transmitters with NE 43 fault signalling and I/O with test pulses, so that silent faults become visible.
- Balance availability - every fail-safe trip costs production. Voting such as 2-out-of-3 with redundancy limits spurious trips without giving up safe behaviour. Never bypass a trip structurally with an interlock override.
- Test periodically - disconnect a cable, shut off the air, switch off the power and check that the system really goes to its safe state. Include any UPS in the review: it can mask a power failure.
❓ Frequently asked questions
What does fail-safe mean?
Fail-safe means that a system automatically goes to a safe state when it fails. The term covers mechanical, electrical and software designs in which the most likely faults lead to a stop or a safe position rather than to a hazard.
Is fail-safe the same as redundancy?
No, fail-safe and redundancy are different principles. Fail-safe ensures that a fault leads to a safe state, and the process is allowed to stop. Redundancy keeps the process running by adding a second component. Safety systems often combine the two.
What is the difference between fail-safe and fail-secure locks?
A fail-safe door lock opens on power loss, so people can escape. A fail-secure lock stays locked on power loss to protect assets or rooms. Fail-safe behaviour is therefore the usual choice for escape routes.
Why are safety circuits normally energised?
A normally energised safety circuit (de-energise to trip) turns a broken wire, a power failure or a loose terminal into a trip. That way a wiring fault never becomes an unnoticed, dangerous failure. The drawback is that such faults lead to spurious shutdowns.
What does a fail-safe PLC do on an internal fault?
A fail-safe PLC (safety PLC) monitors itself with diagnostics, redundant processing and watchdogs. When it detects a fault, it puts its safety outputs into the safe state, usually de-energised. The installation only restarts after repair and acknowledgement.
Can a cyberattack bypass fail-safe behaviour?
Yes, an attacker with access to the safety logic can in principle disable fail-safe behaviour or define the safe state incorrectly. Safety systems should therefore be separated from the process network, with strict management of engineering workstations. Hardware measures such as spring-return valves and mechanical emergency stops keep working even then.
📌 In summary
Fail-safe means: in the event of a failure, the system automatically transitions to a state in which people, machines and processes remain protected. It is a fundamental concept in process Safety, SIL and industrial automation, from the spring-return valve and the normally energised emergency stop to the watchdog in PROFIsafe. Choose the safe state per function based on risk analysis, test it periodically and protect the safety logic against cyberattacks as well.