System Safety · Picture Book
What Does Fail-Closed Mean?
When the safety light breaks, the gate stays shut.
1. The gate needs a green light
The gate opens only when the system can prove that the request is allowed.
2. No answer means stop
If the policy is missing or the check fails, the gate does not guess.
3. A safe stop can ask for help
The system can ask a clarifying question or hand the decision to the host.
4. “Use the old copy” is a separate rule
A last-known-good fallback works only when an older safe copy was saved and the system was told to use it.
Longer version: Fail-Closed reference entry
Sources: RFC 4949; Saltzer and Schroeder, “The Protection of Information in Computer Systems” (1975).