A tendon-driven manipulator having redundant tendons may possess more flexibility in operation, such as optimizing the performance of tendons, reducing the burden of each tendon, and providing fail-safe features. The purpose of this paper is to investigate the design of tendon-driven manipulators with a fail-safe feature, that is, to synthesize a system that may still remain controllable as any of the tendons have broken down or malfunctioned. Characteristics of tendon-driven manipulators are briefly discussed. Criteria for tendon-driven manipulators with redundant tendons and fail-safe feature are then established. Subsequently, constraints for such system are derived from the structure of tendon-driven manipulator. Associated with the criteria, manipulators can remain controllable when any of the tendons fails to function. Finally, a geometric method for determining the structure is developed. Examples of two-DOF and three-DOF tendon-driven manipulators are demonstrated.