Must Fire Alarm for Mech. Shutdown be Fail-Safe?

We have a project where a control module is connected to the mechanical controls that is programmed to the variable frequency drive for a fan on a large unit. When a duct detector senses smoke, the control module (which is normally-open circuit) will close the circuit, sending a signal to the mechanical controls which shuts down the unit.

On this project we had a bad set of control modules that didn't work. We discovered this in testing with the local jurisdiction, and swapped out the modules and the system now works correctly. 

Both the jurisdiction and I wondered whether this normally-open arrangement is acceptable. If a control module were to fail, the duct detector would not be able to close the circuit on the module and the fan would remain running. In this scenario, there would be no supervision or way to know that the control module failed other than someone standing at the fan or finding the issue during testing.

My inclination is that in the future these modules could be normally-closed and open upon duct detection. That way if the module fails and opens on its own, the unit will shutdown in a "failure" mode.

Is it code required that this arrangement be fail-safe?

Posted anonymously for discussion. Discuss This | Submit Your Question | Subscribe