Glossary · Fault behavior and system states
Fail-operational behavior
Also known as: fail-operational
In functional safety, fail-operational behavior is behavior in which operation continues, possibly in a degraded mode, despite specified faults. It requires redundancy or fault tolerance for the functions that must keep working.
- Functional safety
- Systems engineering
In one sentence
Fail-operational behavior keeps a system working despite specified faults, usually through redundancy, where stopping would itself be hazardous.
Example
The extraction system of a paint booth switches to a redundant fan when the main fan fails, because stopping extraction would let solvent vapor accumulate.
How it applies
- Functional safety: Fail-operational designs are needed where stopping does not lead to a safe state or creates a new hazard. They rely on redundancy and fault tolerance, and they cover only the faults that were specified.
- Integrated systems: State which faults the system tolerates, for how long, and what happens at the next fault. Continuing after a fault without detecting and reporting it uses up the redundancy unnoticed.
- Technical documentation: Operators and maintenance staff need to know that the system is running with reduced redundancy and how quickly it must be repaired.
Fail-operational vs. fail-safe behavior
Fail-safe behavior reacts to a fault by reaching or keeping a safe state, typically by stopping. Fail-operational behavior keeps the function running. Which one is appropriate follows from the risk assessment.