(3) Safe fail. There are many ways a complex system may
fail. The principle of safe fail means that the system
should fail ‘‘safely’’; either that internal components
may fail without the system as a whole failing, or that
the system fails without causing harm. One common
example is fail-silence mechanisms—fail-silence (also
called ‘‘negative feedback’’) mechanisms are introduced
to achieve self-shutdown in case of device failure or
when the operator loses control. A classical example is
the dead man’s handle that stops the train when the
driver falls asleep. One of the most important safety
measures in the nuclear industry is to ensure that
reactors close down automatically in critical situations