What is fail-closed inspection, and why does it matter?

Most conversations about machine vision are about detection: how small a scratch the camera can see, how well the AI tells a dent from a reflection. Those questions matter. But on a production line, there is a second question that matters just as much and is asked far less often: what does the station do when it cannot see?

Things go wrong at an inspection station every day

A camera cable works loose. A trigger arrives before the part is in position. A light fails and every image is dark. The PC is restarted in the middle of a shift. An inspection program is missing a file after an update. The network to the PLC drops for two seconds.

None of these is unusual. The question is what verdict the line receives when one of them happens.

Fail-open and fail-closed

A fail-open station treats "no answer" as "good". The result bit to the PLC stays at OK by default, a timeout is ignored, or the last good result is reused. The line keeps running and nobody notices. The defective parts that passed during the fault are found later, often by your customer.

A fail-closed station treats "no answer" as "reject". If it cannot prove that a part is good, the part is not good. The line may stop or fill a reject bin, which is visible and annoying, but nothing bad ships quietly.

A reject you can see is a problem you can fix. An escape you cannot see is a problem your customer finds for you.

What fail-closed means in practice

Saying "fail-closed" is easy. These are the rules that make it real. They are the rules Gorad Vision is built on, and they are a good checklist for any system:

• A part is OK only if every expected camera view reports OK. An error, a timeout, a missing or empty result, or an unknown answer all count as NG (reject).
• If a check cannot find the feature it is meant to inspect, that check is NG, not skipped.
• A tool or AI model that is not configured, is missing its files or cannot compute returns a fault, and a fault means NG. There is no "always OK" default program.
• The verdict and its reason are written to a record before the PLC is told. If the record cannot be written, the part is not passed.
• The station checks that the line is safe to inspect at every trigger, not only at start-up.
• Only approved, verified inspection programs can run. An unapproved or tampered program does not go live.

The PLC is part of the loop

Fail-closed is a property of the whole loop, not just the vision software. If the PLC waits for a result bit and, when none arrives, lets the part through, the loop is fail-open no matter how careful the station is.

A clean handshake between station and PLC usually has a ready signal, a trigger, separate OK and NG result bits, an acknowledge, and a heartbeat that toggles while the station is healthy. The PLC logic should treat each of these as a reject or a stop:

• no result before the cycle timeout,
• both result bits set, or neither,
• a heartbeat that stops toggling.

How to test your own station

You do not need special tools. With the line in a safe state and someone from quality present, try these one at a time and watch what verdict reaches the PLC:

1. Unplug one camera during a cycle.
2. Cover a lens, or switch off the light.
3. Rename or remove the active inspection program, or its model file.
4. Disconnect the network cable between the station and the PLC.
5. Restart the inspection PC in the middle of a run.
6. Send a trigger with no part in position.

Every one of these should produce a reject or a stop, with a clear reason on screen. If any of them produces an OK, you have found a way for bad parts to ship.

The trade-off, honestly

A fail-closed station will reject good parts while something is broken. That costs scrap or re-inspection, so faults need to be visible and quick to fix: a clear reason on the operator screen, an alarm, and a record of what happened. But a false reject during a fault is recoverable. An escape is not.