Should fail to open, or simply just fail at last position, perhaps with a warning or alarm. If it failed closed, you'd probably want to tie that into a system trip. You would not want to keep running while cooling water was lost, unless you like the smell of burned bearings. Or maybe you're counting on high bearing temp alarm to shut down. In any case, and on the other hand, failing open, or at last pos, would allow you to keep running at while you give some thought to maintenance schedules, rather than dealing with a total shutdown just because some valve decided to go to sleep.
If it ain't broke, don't fix it. If it's not safe ... make it that way.