Fail-safes

A fail-safe is a mechanism that defaults to a safe state when something goes wrong. Failure of a component triggers a response that limits damage rather than amplifying it. Dead man's switch on a train: release the handle and the brakes apply. Circuit breaker: overload trips the circuit and cuts power. Fuse: excess current melts the fuse and opens the circuit. The design principle is that the system should fail safe — toward a known, bounded bad outcome — not fail open into catastrophe. The opposite of fail-safe is fail-dangerous: when the safety system itself fails or when the default state is unsafe. High-reliability systems are built with fail-safes so that single-point failures don't cascade.

Fail-safes can be physical (fuse, pressure relief valve), procedural (checklist, approval step), or organisational (segregation of duties, mandatory cooling-off). The common element is that the default or triggered state is safe rather than unsafe. The discipline is identifying failure modes and ensuring that each has a fail-safe response. What happens when the primary control fails? When the operator is wrong? When the sensor lies? The answer should be "the system goes to a safe state" or "the system stops until verified," not "the system continues and we hope."

The model applies beyond engineering. Contracts can have fail-safes: breach triggers termination or remedy rather than continued exposure. Decisions can have fail-safes: if key assumptions are violated, the decision is revisited. The strategic question is always: what is the failure mode, and what is the default or triggered behaviour? If the default is "keep going," you may have built a fail-dangerous system. If the default is "stop or limit damage," you have a fail-safe.