Safe failure fraction is an arbitrary metric used within IEC 61508 (and other guidance) in order to set architectural rules (or constraints). This is a metric based on diagnostic coverage. It has been introduced as a result of standards in the safety-related systems area. It combines the proportion of revealed ‘dangerous’ failures with those that are not ‘dangerous’.
What is Safe Failure Fraction?
Safe Failure Fraction is a measure derived from the ratio of safe failures and diagnosed dangerous failures to the total number of failures. Mathematically:
SFF= (Safe Failures + Diagnosed Dangerous Failures) / Total Failures (Safe + Dangerous)
A high number is good which indicates a system with a lower likelihood of undetected dangerous failures, thus making it more reliable and safer for use. It measures the natural tendency of an instrument to fail safety or detect dangerous failures.
Meaning of 100% is that there are NO failures classified as dangerous that are not detected by automatic diagnostics. 100% is the best that can be achieved. This percentage increases for products with superior inherent safety or highly effective automatic diagnostics.
Breaking Down the Key Components
Safe Failures: A ‘safe’ failure is a failure of an element and/or subsystem and/or system that plays a part in implementing the safety function that:
- results in the spurious operation of the safety function to put the EUC (or part thereof) into a safe state or maintain a safe state; or
- increases the probability of the spurious operation of the safety function to put the EUC (or part thereof) into a safe state or maintain a safe state
Diagnosed Dangerous Failures: These are failures that could potentially jeopardize system safety but are identified through diagnostic mechanisms before leading to a hazardous situation.
Total Failures: The sum of all safe and dangerous failures within the system.
Applying Safe Failure Fraction
The calculation of SFF varies depending on the complexity of components:
- Type A Components: These are well-defined components with predictable failure modes and accessible fault data. Examples of products typically classified as Type A include relays, solenoids, pneumatic boosters, actuators, valves and even simpleelectronic modules with resistors, capacitors, op amps, etc.
- Type B Components: More complex components that may lack comprehensive failure data or predictable fault behavior, such as microprocessors or programmable devices. Any smart product with a microprocessor or complex ASIC (Application SpecificIntegrated Circuit) is considered Type B. These are classified Type B because of their complex designs in combination with a relatively short operational history for any given generation.
In the following Tables ‘m’ refers to the number of items which need to succeed. The Tables provide the maximum Safety Integrity Level (SIL) which can be claimed for each safe failure fraction band. The word simplex infers no redundancy and is referred to as Hardware Fault Tolerance 0. The expression ‘m + 1’ implies 1 out of 2, 2 out of 3 etc redundancy. It is referred to as Hardware Fault Tolerance 1. Similarly (m + 2) infers 1 out of 3, 2 out of 4 etc and is referred to as Hardware Fault Tolerance 2.
Top References:
- Back to Basics 20 – Safe Failure Fraction, SFF | exida
- Safety Instrumented Systems Verification by William M. Goble Harry Cheddie
- Reliability, Maintainability and Risk by Dr. David J. Smith
