Fail-Safe vs Fail-Secure
When a system fails, it can default to the safe state or the secure state, and these are not always the same choice.
What Happens on Failure
Every system will eventually fail, lose power, crash, or lose communication, and the designer must decide what state it defaults to. Fail-safe means it defaults to the state that minimizes harm to people. Fail-secure means it defaults to the state that maximizes protection of assets. The canonical example is a door: fail-safe unlocks so people can escape a fire; fail-secure locks so intruders cannot enter.
The Same Word, Different Fields
Terminology varies. In safety engineering, fail-safe means the system moves to a benign condition. In security, fail-secure (sometimes fail-closed) means access is denied on failure, while fail-open means access is granted. A firewall that fails open lets all traffic through, convenient but insecure; one that fails closed blocks everything, secure but potentially disruptive.
Choosing Correctly
- Life-safety functions almost always fail-safe: hazards must be removed even if the system dies
- Access-control functions often fail-secure: a broken lock should not become an open door
- The choice depends on which outcome is worse when the component fails
When They Conflict
The door example shows the tension directly: you cannot be both fail-safe and fail-secure with a single mechanism. Real facilities resolve this with layered design, for example emergency egress that releases on a life-safety signal while normal access stays fail-secure otherwise.
Fusion Context
A fusion plant's protective functions are fail-safe by design: on loss of control or power, the machine moves toward a safe, de-energized condition rather than an uncertain one. In the Hyperion breeder and burner designs, a magnet-protection trip or loss of the control link drives the system toward its safe state, because the worst outcome of failing safe is a halted machine, while the worst outcome of failing the other way is equipment damage or a hazard.