Glossary term

Safe State

Engineering definition of a safe state covering fail-safe behavior, fault-to-safe time, stored energy, reset rules and validation evidence.

Branch: Industrial and Management Engineering
Glossary type: concept
Content: Glossary term
Updated: Jun 26, 2026
Revision: v1.0.0 · reviewed

Definition

concept

A safe state is a defined system condition in which risk has been reduced to an acceptable level for the relevant fault, operating mode or human exposure.

A safe state may mean power removed, motion stopped, pressure vented, torque disabled, therapy halted, brakes applied, outputs de-energized, payload shut down, controller authority reduced, or a latched fault requiring deliberate reset. It is not always the same as off, and it must be defined from the hazard, stored energy, timing and recovery requirements.

A safe state is the condition a system must reach when a fault, hazardous access, invalid command, unsafe measurement, communication loss or degraded mode requires risk reduction. It is the target condition, not the mechanism. An interlock, watchdog, protection relay, controller, brake, valve, shutdown trip or operator procedure may drive the system toward a safe state, but the safe state itself must be defined and verified.

The safe state is not always “off.” A spacecraft safe mode may keep heaters and communications alive. A medical device may stop therapy while preserving alarms. A power converter may disable gate drive while maintaining discharge monitoring. A robot cell may stop hazardous motion while keeping diagnostics energized.

State Definition

A safe state should be written as explicit conditions, not a vague label. A simple logical screen is:

S_{safe}=O_{hazard,off}\land E_{stored,below}\land R_{restart,blocked}

where the hazardous output is removed or controlled, stored energy is below the accepted limit and restart is blocked until the reset rule is satisfied. The exact terms depend on the hazard. For a motor drive, torque may matter. For a pressure system, vented pressure may matter. For a medical device, dose delivery and alarm state may matter.

Fault-to-Safe Timing

The time to reach a safe state can be budgeted as:

T_{safe}=T_{detect}+T_{logic}+T_{actuate}+T_{settle}

The timing requirement is:

T_{safe}\leq T_{req}

The safety margin is:

M_{safe}=T_{req}-T_{safe}

This timing should include real sensing, logic, communication, actuator response, mechanical stop, valve closure, relay dropout, brake engagement, discharge or stabilization behavior. A software bit changing state is not enough if the physical hazard persists.

Stored Energy

Safe-state design must consider stored energy. Rotating inertia, elevated load, compressed air, hydraulic pressure, charged capacitors, hot surfaces, chemical inventory and battery energy can remain hazardous after a command is removed.

For a first-order discharge or decay screen:

E(t)=E_0 e^{-t/\tau}

The time to fall below the safe energy threshold is:

\displaystyle t_{discharge}=-\tau \ln\left(\frac{E_{safe}}{E_0}\right)

This model is only a screen. Real discharge paths need component tolerances, fault conditions, temperature, contact state and measurement evidence.

Worked Example

A guarded electromechanical station must reach a safe state before a person can access the hazard. The access time is:

T_{req}=850\ \text{ms}

The measured chain is:

T_{detect}=25\ \text{ms},\quad T_{logic}=40\ \text{ms}

and:

T_{actuate}=120\ \text{ms},\quad T_{settle}=520\ \text{ms}

The fault-to-safe time is:

T_{safe}=25+40+120+520=705\ \text{ms}

The margin is:

M_{safe}=850-705=145\ \text{ms}

Now check stored energy. A capacitor bank starts with:

E_0=60\ \text{J}

The accepted maintenance threshold is:

E_{safe}=5\ \text{J}

With discharge time constant:

\tau=0.18\ \text{s}

the discharge time is:

\displaystyle t_{discharge}=-0.18\ln\left(\frac{5}{60}\right)=0.447\ \text{s}

Because 0.447 s is less than the 0.850 s access time, the first screen passes. The release still needs measured voltage or energy evidence under worst-case tolerance, not only the nominal calculation.

Boundary With Interlocks

An interlock is a constraint or mechanism. The safe state is the condition that the mechanism must achieve. Opening a guard switch is not the safe state. Stopped motion, disabled torque, blocked restart and verified access timing may be the safe state.

This distinction prevents weak validation. A test that proves only that an input bit changed does not prove the physical system is safe.

Recovery And Reset

A safe state should include restart rules. Many incidents occur after the initial trip, when equipment restarts unexpectedly, a latch is cleared without diagnosis or a controller boots with outputs enabled. A strong safe-state definition states whether reset is automatic, manual, local, remote, latched, supervised or inhibited until conditions are revalidated.

Degraded modes should also be named. A controlled degraded mode may be acceptable when risk is bounded and visible. A hidden degraded mode is not a safe state if operators or software continue as if the system were nominal.

Validation Evidence

Useful evidence includes hazard analysis, state-transition table, timing traces, stop-time measurement, actuator or relay dropout evidence, stored-energy discharge records, output-state measurements during reset and brown-out, interlock proof tests, watchdog fault injection, communication-loss tests, startup and recovery tests, alarm records and restart-inhibit verification.

Common mistakes include defining the safe state as “system off” without checking stored energy, treating a software flag as physical safety, ignoring restart behavior, omitting degraded modes, relying on a watchdog reset without output evidence, assuming a valve or relay reaches the safe position, and validating nominal trips without fault injection. A defensible safe-state claim states the hazard, the required state, the time limit, the reset rule and the evidence that the physical system reaches that state.

REF

Disciplines