fail-operative system