History Main / FailSafeFailure

** The 1994 Cajon Pass Runaway: An Atchison Topeka and Santa Fe freight train lost control while descending the steep grade and rear-ended a halted Union Pacific coal train, costing over $4 million of damage. Investigators from the NTSB found that the train's air brakes failed to trigger due to a blockage in the air line.

** [[https://en.wikipedia.org/wiki/San_Bernardino_train_disaster The 1989 Cajon Pass Runaway]], (better known as the San Bernardino train disaster) was caused by two critical factors. The primary one was that the station clerk at Southern Pacific's Mojave Yard underestimated the weight of the cargo, which is trona, when the shipping documents he received from the shipper's superintendent did not indicated a number of weight for each hopper car. Using his experience he measured around 60 tons of trona across 69 hopper cars which had a total light weight of approximately 2100 tons, meaning 69 cars x 60 tons = 4140 of the cargo + 2100 tons of the hopper cars = 6140 tons in total, according to the paperwork. It was later revealed that every car was loaded up to 100 tons more material than the first station clerk has estimated. Add the total 6900 tons of the cargo with the total light weight of 2100 tons of the hopper cars and you get a 9000 ton juggernaut. The second factor was that the train has less braking power than the head-end engineer had thought. Of the 6 locomotives involved, only 2 had fully operational dynamics. One had limited dynamics and the other 3 didn't work at all, including one of the two helper units added to the rear-end of the train. One more secret was revealed; when the helper engineer pulled the emergency brakes, it cut all the braking action of the dynamic brakes. At that time it was a safety feature to keep the wheels from locking and sliding. In this case, with the fully operational air brakes melting away, the dynamic brakes were the only thing holding the train back. Without them, the train took off and exceeded up to 110 mph before crashing at a curve into a small residential area at San Bernardino, killing 4 people. As a result, Southern Pacific changed their rules so that every train without a specified weight was assumed to be carrying its maximum allowable load.

** The 1994 Cajon Pass Runaway: An Atchison Topeka and Santa Fe freight train lost control while descending the steep grade and rear-ended a halted Union Pacific coal train, costing over $4 million of damage. Investigators from the NTSB found that

** [[https://en.wikipedia.org/wiki/San_Bernardino_train_disaster The 1989 Cajon Pass Runaway]], (better known as the San Bernardino train disaster) was caused by two critical factors. The primary one was that the station clerk at Southern Pacific's Mojave Yard underestimated the weight of the cargo, which is trona, when the shipping documents he received from the shipper's superintendent did not indicated a number of weight for each hopper car. Using his experience he measured around 60 tons of trona across 69 cars which had a total light weight of approximately 2100 tons meaning 69 cars x60 tons =4140 of the cart + 2100 tons of the hopper cars = 6140 tons in total, according to the paperwork. It was later revealed that every car was loaded up to 100 tons more material than the first station clerk has estimated. Add the total 6900 tons of the cargo with the total 2100 tons of the light weight hopper cars and you get a 9000 ton juggernaut. The second factor was that the train has less braking power than the head-end engineer had thought. Of the 6 locomotives involved, only 2 had fully operational dynamics. One had limited dynamics and the other 3 didn't work at all, including one of the two helper units added to the rear-end of the train. Another secret was revealed is when the helper engineer pulled the emergency brakes, it cut all the braking action of the dynamic brakes. At that time it was a safety feature to keep the wheels from locking and sliding. In this case, with the fully operational air brakes melting away, the dynamic brakes were the only thing holding the train back. Without them, the train took off and exceeded up to 110 mph before crashing at a curve into a small residential area at San Bernardino.
*** The pipeline rupture that followed 13 days later didn't have to happen either. When removing and examining the piece of pipe that burst after the fire was put out, Investigators from the NTSB found gashes of the pipe. Some possible suspects where believed to be several front-end loaders and a large backhoe used in the derailment and were near where the pipe was located. The damage was believed to be done either the removal of the wreckage or the clean up of the spilled cargo. Another factor of why the pipe failed was that the company who operated the pipeline rushed their inspection

** [[https://en.wikipedia.org/wiki/San_Bernardino_train_disaster The 1989 Cajon Pass Runaway]], (better known as the San Bernardino train disaster) was caused by two critical factors. The primary one was that the station clerk at Mojave Yard underestimated the weight of the cargo, which is trona, when the shipping documents he received from the shipper's superintendent did not indicated a number of weight for each hopper car. Using his experience he measured around 60 tons of trona across 69 cars which had a total light weight of approximately 2100 tons meaning 69x60=4140+2100=6140 tons in total according to the paper work. It was later revealed that each car was loaded up to 100 tons more material than the first station clerk estimated. Add the total 6900 tons of the cargo with the total 2100 tons of the light weight hopper cars and you get a 9000 ton juggernaut.

Thanks to FinaglesLaw (or just ignorant writers), on TV a system's failsafe will ''never'' work when it's needed the most, nor will it actually be fail''safe'' — usually it'll be quite the opposite, sometimes referred to as "fail deadly". The only reference to an emergency shutdown you'll be likely to hear is a panicked tech yelling "It won't shut down!" as the system runs wild. It's supposed to make the phenomenon of ExplosiveInstrumentation more plausible, by [[HandWave acknowledging it's not supposed to blow up in your face]], but a failure elsewhere of a key safety lockout means it can, and ''will''. It also justifies how something that is supposedly governed by industry-wide standards, regulatory law, and years of engineering refinements could go so [[DisasterDominoes horribly wrong]] in the first place.

What's a failsafe? Well, the world is full of a lot of dangerous machinery and devices. Huge electrical turbines and nuclear reactors, power lines carrying enough juice to light a whole city and pipelines carrying millions of tons of explosive petroleum. Trains speeding down the tracks at 300 km/h, trucks that weigh 40 tons rolling down the freeways, aircraft that weigh more than ''400'' tons flying over our heads. And that's just the stuff that ''isn't'' designed to kill anyone. There's plenty of stockpiled bombs, missiles and such out there too. These could all cause some spectacular collateral damage if they suddenly went out of control.

Contrary to popular understanding, "fail safe" does not mean "safe from failing", i.e. [[TemptingFate "failure-proof"]] — it means that if (when) it fails, it will do so in a way that leaves it safe. When something is described as "fail safe", it means that it has been designed and built so that a critical mechanical failure or operator mistake will cause the system in question to default to its safest possible state, quickly and automatically, without any human intervention. Consider the following: if you're at an intersection where there's a traffic light, and it fails, if it "fails safe" then either it goes dark or all four directions show a red signal. If it showed green in all four directions, that would be a failure to fail safe. For more info, see [[Analysis/FailsafeFailure the Analysis page]]. Real Life Failsafe Failures are often caused by an improbable and unanticipated conjunction of two or more failure conditions (one of which will often turn out to have never worked in the first place).

Compare the way Hollywood treats personal vehicles when the owner is always [[DrivesLikeCrazy Driving Like Crazy]] or [[TheAllegedCar leaving his car in a state of neglect]], In Hollywood a decrepit car that endangers its occupants and everyone around it is frequently [[RuleOfFunny treated as comedy]], and all too often this same insouciance extends to things capable of inflicting serious damage should one lose control of them. There's usually NoPlansNoPrototypeNoBackup or Lock-out/Tag-out procedures, and the BigRedButton is frequently unguarded.

See also NoOSHACompliance, OverrideCommand, DeadFootLeadfoot, InventionalWisdom and PlotDrivenBreakdown. Often invoked in a chain of DisasterDominoes. For other examples where safety features go wrong, see CorruptedContingency.

*** This was a problem that most Japanese ships had during WWII, particularly their carriers. They had very intricate and sophisticated damage control systems, but they were very valuable; A single hit could knock out the entire system. This was in contrast to USN ships, which had multiple reduatncies; i.e if some part of the ship went "Boom!" there was usually 2-3 other stations around the ship where the systems could be activated.

** And the reason that there were even warning placards in the first place? In 1972 there was a American Airlines flight that had the exact same problem, but that one got a small but significant lucky break: not all of the control lines were severed, so the pilots retained some level of control and managed to land the plane with no loss of life. [[note]]The American Airlines DC-10 was lightly loaded when the blowout happened, so the cabin floor only suffered a partial collapse.[[/note]] Because the only way that the FAA could force [=McDonnell=] Douglas to fix the planes was to ground them all and not let them fly before the door was repaired, there was a gentlemen's agreement between the head of the FAA and [=McDonnell=] Douglas to put in this "failsafe" rather than fix the fundemental issue.

* [[UsefulNotes/RMSTitanic The sinking]] of the ''Titanic'' on 15 April 1912 was so unexpected because of its novel failsafe design, with multiple watertight compartments that should have been able to keep it afloat if any one or two compartments was breached, or even all four of the forward compartments were lost. The bulkheads that were supposed to seal off the compartments, while extending above the waterline, were not sealed at the top, meaning that they could still overflow and fill other compartments if the ship's equilibrium was sufficiently shifted, such as by say ''five'' of the front compartments all filling up due to multiple breaches in the hull along its side. And once the five front compartments flooded, this ''accelerated'' the sinking of the ship as the water weighed down the front of the ship, causing the stern to rise into the air and eventually leading to the ship breaking in half from the strain. The fact that all the water was in the front also hindered the pumps meant to help remove water if the ship flooded, which were at the rear. It's now believed that if there had been no compartments and the ship had flooded evenly, the ship would have sunk much more slowly, allowing help to arrive in time. And of course, the final failsafe on any ship--the lifeboats--failed to save most of the passengers, because there weren't enough of them. The ''Titanic'' had room to carry enough lifeboats, but it sailed with only one-third of its capacity. Contrary to urban legend, this wasn't because the builders thought the ship was unsinkable and dodged regulations; carrying only a fraction of lifeboat capacity was standard practice at the time, based on assumptions about how slowly passenger ships sank--it was expected that help would arrive before the ship had to be completely evacuated and the lifeboats would simply ferry the passengers to the rescue vessels, and several previous disasters involving lifeboats horrifically destroyed by stormy seas while those on the afflicted vessels survived in time for rescue made them seem unreliable in the face of ship design failsafes. The only ships that sailed with enough lifeboats for everybody were warships, which were expected to go down in conditions where they would sink ''fast''. There ''were'' regulations on the bare-minimum number of lifeboats to be carried, but they were based around the weight of the ship, not passenger capacity, and the number aboard ''Titanic'' as-built was already ''over'' that limit. The ''Titanic'' just had the poor luck to sink in a situation where the closest ship (the ''Californian'') couldn't receive her distress calls due to the lack of round-the-clock wireless operations, and the second closest (the ''Carpathia'') was too far away to reach the ''Titanic'' before it sank[[note]]this is where the ship sinking more slowly might have made a critical difference[[/note]].

* [[UsefulNotes/RMSTitanic The sinking]] of the ''Titanic'' on 15 April 1912 was so unexpected because of its novel failsafe design, with multiple watertight compartments that should have been able to keep it afloat even if one compartment was breached (of course, multiple compartments were breached in the collision). The bulkheads that were supposed to seal off the compartments, while extending above the waterline, were not sealed at the top, meaning that they could still overflow and fill other compartments, something of a design flaw. And once the front compartments flooded, this ''accelerated'' the sinking of the ship as it weighed down the front of the ship, causing the stern to rise into the air and eventually leading to the ship breaking in half from the strain. The fact that all the water was in the front also hindered the pumps meant to help remove water if the ship flooded, which were at the rear. It's now believed that if there had been no compartments and the ship had flooded evenly, the ship would have sunk much more slowly, allowing help to arrive in time. And of course, the final failsafe on any ship--the lifeboats--failed to save most of the passengers, because there weren't enough of them. The ''Titanic'' had room to carry enough lifeboats, but it sailed with only one-third of its capacity. Contrary to urban legend, this wasn't because the builders thought the ship was unsinkable and dodged regulations; carrying only a fraction of lifeboat capacity was standard practice at the time, based on assumptions about how slowly passenger ships sank--it was expected that help would arrive before the ship had to be completely evacuated and the lifeboats would simply ferry the passengers to the rescue vessels. The only ships that sailed with enough lifeboats for everybody were warships, which were expected to go down in conditions where they would sink ''fast''. There ''were'' regulations on the bare-minimum number of lifeboats to be carried, but they were based around the weight of the ship, not passenger capacity, and the number aboard ''Titanic'' as-built was already ''over'' that limit. The ''Titanic'' just had the poor luck to sink in a situation where the closest ship (the ''Californian'') couldn't receive her distress calls due to the lack of round-the-clock wireless operations, and the second closest (the ''Carpathia'') was too far away to reach the ''Titanic'' before it sank[[note]]this is where the ship sinking more slowly might have made a critical difference[[/note]].

** Similarly Android has on its security options[[note]]From Android 8 ("Oreo") onwards, it is in the permissions of apps as some file browsers instead[[/note]] a checkbox to allow to install app packages bypassing the Google Playstore. It's desactivated by default and if you check it, it will warn you of possible damages -so have fun if that apk file that supposedly had a game contains also something much nastier-.

** Averted with elevator at the beginning. After Payne blows the cabels, the emergency brakes do exactly what they're supposed to and stop the elevator. The problem is that Payne has put additional bombs on ''them'', and threatens to destroys them unless paid. Then Played straight when it turns out the crane Jack and Harry hooked to the car to secure it couldn't hold the weight either.

See also NoOSHACompliance, OverrideCommand, DeadFootLeadfoot, InventionalWisdom and PlotDrivenBreakdown. Often invoked in a chain of DisasterDominoes.

** The main protagonists, the six Toa Mata were created to awaken Mata Nui if he was ever put him in a comatose state. When this happened, the Toa's travel-pods were launched into space and drawn back to Mata Nui, who had crash-landed on an ocean planet. Their guiding system immediately stopped working, causing the Toa to drift in the sea for a thousand years until their homing beacon was reactivated. By the time they began their mission, their muscle tissue had decayed, multiple universe-wide organisations the Toa never heard of were at war, and Mata Nui was close to death.

* In one episode of ''WesternAnimation/{{Archer}}'', a computer virus infects the mainframe and threatens to upload all the spies' names to the virus' creator. They get the idea to just unplug the mainframe until everything can be sorted out, but it turns out the mainframe has a battery backup. Behind a nearly indestructible locked door. Whose lock is controlled by the mainframe.
* In ''WesternAnimation/Ben10SecretOfTheOmnitrix'', the titular device gets messed with in such a way as to cause it to start a countdown to an explosion that will destroy ''the entire universe''. The subversion is that [[spoiler:that ''is'' the failsafe. The creator figured that destroying the universe itself was better than having the thing fall into the wrong hands]]. Which raises a number of questions that have never really been resolved.
* In the WesternAnimation/BugsBunny cartoon ''WesternAnimation/HareLift'', Bugs and Yosemite Sam are aboard a pilot-less aircraft. After an extended argument, [[ItMakesSenseInContext Bugs rips out the plane's steering yoke]]. In response, Sam pushes a button marked "autopilot". A [[SkeleBot9000 thin, beeping robot]] then emerges and upon seeing the condition of the plane's controls, [[ScrewThisImOuttaHere immediately grabs one of two parachutes and jumps]].
* In ''WesternAnimation/KingOfTheHill'', Peggy goes skydiving, but both her chute and emergency chute fail to deploy. She ends up breaking several bones.
* ''WesternAnimation/{{Megas XLR}}'':

* ''WesternAnimation/MyLittlePonyFriendshipIsMagic'', season 2, episode 1 almost invokes this by name. Magical chaos is running wild. Twilight Sparkle, having seen this happen before ([[MagicMisfire mainly from her own spells]]), has developed a [[GameBreaker failsafe spell]] for just this sort of occasion, and sees no reason to [[HoldingBackThePhlebotinum not use it at the first sign of major trouble]]. But this time, [[JerkAssGods the source]] is stronger than she is used to, so...

* A lot of the crises in ''WesternAnimation/TransformersRescueBots'' could have been avoided if the scientists in Griffin Rock ever bothered to implant failsafes in their tech.

* The SL-1 reactor, site of the only fatality directly caused by a nuclear incident in the US. It was built for and run by the US Army as a prototype for a small, semi-portable reactor to power mobile command centers. A technician was performing a maintenance test on it while it was shut down. Said test required him to manually elevate the reactor's only control rod a few inches. He raised it up almost 2 feet. The reactor became instantly active and went prompt critical[[note]]Despite what HollywoodScience says, a reactor GoingCritical is ''not'' a bad thing. All it means is that the reaction is self-sustaining, i.e., it's turned on. '''Prompt''' critical, on the other hand, means you're screwed before you even have time to say "OhCrap."[[/note]], the sudden power spike caused the water in the reactor to superheat and flash to steam, and the pressure surge ejected the control rod, which [[ImpaledWithExtremePrejudice impaled the technician on the roof of the compartment]]. Luckily the other failsafes that weren't violated/ignored to do this kicked in and shut down the reactor, but not before the other two people at the site were killed by the explosion - while also receiving enough radiation to require all three to be buried in lead-lined coffins entombed in cement.

*** It ''still'' gets even better - there has been a rumor that the alarm was turned off so false alarms wouldn't wake people up. No wonder 11 people died.

* Sarge's quote in the quotes section from ''Machinima/RedVsBlue'' highlights his tendency to build machines with "failsafes" that end up backfiring on him somehow. For example, the bomb that he built into Lopez could be armed remotely, but Sarge designed it so that he himself couldn't disarm it, just in case he was captured and brainwashed into helping the Blues. [[SarcasmMode Brilliant.]]

* The fire in 1980 at the MGM Grand in Las Vegas. The fire took out the automatic fire alarm that would have warned guests of the fire. The back up system for the fire alarm was the public adress system as well as the phone system that could be used to call guests in their room. However, the smoke from the fire made going to the room where those things could be control from impossible.

* ''VideoGame/HalfLife'': When things go awry at the Anomalous Materials research department of the Black Mesa science facility, the classic exchange is heard:
-->"Shutting down... attempting shut down... it's not... it's-it's not- it's not shutting down, it's not-''([[KilledMidSentence screaming]])''"
** In ''VideoGame/HalfLife2: Episode 1''. The Citadel's dark energy reactor had a failsafe that was deactivated by the Combine as part of a XanatosGambit. Reactivating the failsafe doesn't prevent the reactor GoingCritical as its condition had already deteriorated, but it slows the process enough to allow the rebels to evacuate.

* A RAID system with multiple hard drives is supposed to guard against hard drive failures by using redundant drives, but if all the drives are purchased from the same manufacturer that happens to have a bad batch, all of the drives can fail simultaneously. This happened to Wiki/ThisVeryWiki in 2020.

* ''VideoGame/DivinityOriginalSinII'': A {{Magitek}} supercomputer within a PocketDimension detected interference with the crystal that anchors it in the physical world, [[AIIsACrapshoot decided]] that the most plausible explanation was a sabotage attempt, and killed all its operators with its security failsafes. The interference was from a playful dog.

* The game ''[[VideoGame/ChzoMythos 7 Days a Skeptic]]'' features, on an advanced space ship, an escape pod door that opens whether or not there is an escape pod that can be boarded behind it. Almost needless to say, if there's no escape pod, one is greeted by hard vacuum.

* The game ''7 Days a Skeptic'' features, on an advanced space ship, an escape pod door that opens whether or not there is an escape pod that can be boarded behind it. Almost needless to say, if there's no escape pod, one is greeted by hard vacuum.

** Florence was inspired to become an engineer by an incident when her wheelchair-bound human companion was stranded outdoors in a cold rainstorm. The motorized chair disabled itself to prevent water damage to its electronics, not considering that water damage to the ''operator'' could be more serious.

** Florence was inspired to become an engineer by an incident when her wheelchair-bound human companion was stranded outdoors in a cold rainstorm. The motorized chair disabled itself to prevent water damage to its electronics, not considering that water damage to the ''operator'' could be a higher priority.