Fail Safe Default¶
When failure occurs, force the system into the least harmful reachable state rather than allowing uncontrolled continuation.
The Diagnostic Story¶
Symptom: When something goes wrong, the system keeps acting — energized, open, outputting — because it was designed to continue rather than to stop. Operators debate what to do under emergency pressure without a pre-defined answer. Alarms fire but nothing in the system changes state. Overrides quietly become routine and the failure mode remains ambiguous to everyone depending on the system.
Pivot: Name the least harmful reachable state and connect detection or uncertainty thresholds directly to a transition into it. Make that transition automatic or procedural, constrain manual overrides, communicate the resulting state clearly, and require explicit recovery criteria before normal operation resumes.
Resolution: Failure severity drops because the system lands in a bounded, unambiguous state rather than continuing to operate unsafely. Emergency response becomes faster and clearer, reliance on perfect human attention under pressure decreases, and recovery discipline prevents the unsafe condition from being quietly re-introduced.
Reach for this when you hear…¶
[industrial safety] “If the sensor fails or goes offline, the valve needs to close — I don't want 'unknown state' to default to open.”
[access control] “When the authentication service is unreachable, the answer has to be deny, not allow — the safe default can't be 'let everyone through while we figure it out.'”
[aviation] “We design for the scenario where the pilot is incapacitated — what does the system do on its own, and is that state one we can survive?”
Mechanisms / Implementations¶
- Emergency Stop: Provides an immediate human-triggered interruption that forces machinery, workflow, or action into a safer stopped state when continuation is hazardous.
- Dead-Man Switch: Requires continuing confirmation, pressure, presence, or heartbeat; if the signal disappears, the system assumes loss of control and enters the safe state.
- Trip Switch or Circuit Trip: Disconnects, interrupts, or isolates energy, flow, or action when a threshold is crossed, converting abnormal continuation into a bounded safe state.
- Automatic Shutdown: Uses embedded logic, monitoring, or control software to stop or suspend operation when defined anomalies, limits, or missing signals occur.
- Fail-Closed or Fail-Open Design: Selects a physical, procedural, or access-control default that either blocks continuation or releases passage depending on which state is safer.
- Safe Mode: Keeps only tightly bounded capabilities active for diagnostics, preservation, or recovery while preventing the risky parts of full operation.
- Watchdog Timer: Detects a stuck, unresponsive, or stalled controller by requiring periodic check-ins, then triggers reset, shutdown, or safe-mode entry.
- Containment on Alarm: On alarm, closes compartments, quarantines suspect data, isolates a hazard, pauses release, or blocks propagation until the condition is cleared.
Related Abstractions¶
Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.
Built directly on (2)
Also references 10 related abstractions
- Constraint: Limits possibilities to guide outcomes.
- Continuity: Smooth change without jumps.
- Controllability: Ability to steer system.
- Invariance: Properties unchanged under transformation.
- Observability: Infer internal state externally.
- Resilience: Absorb shocks and adapt.
- Risk Aversion: Preference for certainty.
- Robustness: Maintain functionality under stress.
- State and State Transition: Captures system condition and evolution.
- Threshold: Safe vs harmful levels.
Variants¶
Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.
Protective Shutdown · risk or failure variant · recognized
A fail-safe variant that deliberately stops operation when continued action would be more dangerous than halting.
Safe Mode Operation · implementation variant · merge review
A restricted operating variant that preserves basic diagnostics, recovery, or essential low-risk function after anomaly while blocking hazardous capabilities.
Fail-Closed Default · implementation variant · recognized
A fail-safe variant in which failure blocks access, flow, action, transaction, or release by default.
Fail-Open Default · implementation variant · recognized
A fail-safe variant in which failure opens, releases, vents, unlocks, or permits passage because blockage would be more harmful.
Passive Safe Default · implementation variant · recognized
A fail-safe variant in which the system naturally returns to a safer state when power, control, signal, or attention is lost.