May need to be fail-closed.