Design so that the failure mode is itself the safe state.
A dead-man's switch on a train stops the train. The design question is always which state is safe: a fire door that fails locked and a security door that fails open are the same engineering mistake in opposite directions.
In practice
- A railway signal that loses power shows red; a lift that loses power stops between floors and holds.
- A door that fails locked is right for a vault and lethal for a stairwell, and the same mechanism is both.