Identifying what a dangerous state is is usually left to the person writing the requirements. Often that's a completely different department from the engineers who implement them.
I think failures should be designed for (or at least explicitly defined) even if the requirements do not include them.