Fail-safe vs fail-secure: What's the difference, & how to choose