Fail-safe does not necessarily imply that the system will continue operating after a fail. If the system stops operating but does not create a dangerous situation, it is still fail-safe. A non-essential service on board an aircraft such as the entertainment system can be fail-safe if it just stops operating because a fuse blows. If upon a failure the fuse does not blow and as a result the system catches fire after a short-circuit, it is not fail-safe.
Fail-soft does indeed mean that after a failure, essential services are still functional, although in aviation context this is mostly referred to as graceful degradation. A fly-by-wire system such as on board the A320 is fail soft:
- If all flight computers are functioning, the system flies with normal law active, providing protections against getting into unsafe regions of the flight envelope.
- Upon certain detected failures, the system switches to alternate law, still with some protections in place.
- Upon further failures, the system switches to direct law: no more flight envelope protections, just surface deflection proportional to stick deflection.
So this flight computer system is fail-soft and fail safe. The electronic flight control system as a whole is fail safe: if all flight computers are lost, the system has hydro-mechanical connections from pedals to the rudder and from the trim wheel to the stabiliser.
Hydraulic systems require special attention regarding fail-safety, since a stuck servo valve can command a constant velocity: the actuator runs into one of its stops and has a hard-over failure. An elevator that is stuck in full up deflection is not safe, so the pitch control system needs to make provisions for fail-safety if this fault occurs. For instance by allowing left and right elevators to normally work in unison, but uncoupling them after a detection of a hard-over failure. The working elevator can then be commanded to full opposite position, making the elevator system fail-safe but not fail-soft: pitch command must now be done with the stabiliser trim. One elevator stuck in the mid position would be fail-safe, and control with the other elevator provides graceful degradation.
The flight control system on board an F-16 is fail-operational: upon a system failure, full system function continues, no degradation. It is triple redundant, meaning there are four systems on board that carry out the same function, while only one is required. The four systems function independently, and a monitoring system determines if all four outputs are within a pre-determined range. If three are and one is not, this system is switched off and the other three continue. This can happen once more, but if there are only two systems operational the voting system would not know which of the two has failed.
