What is HFT? - Concept of "maintaining safety even in the event of failure"

Introduction

In the previous article, PFDavg and PFH were explained as the indicators of SIL (Safety Integrity Level).

Both of them represent “how likely safety functions fail.”

However, reducing the probability of dangerous failures is not the only way to enhance safety.
Even if a failure occurs, it is still important to establish a mechanism “which does not lose safety functions due to a single failure.”

At this point, what comes into play is HFT.

In this article, the points below will be explained:

• What is HFT?
• The difference between HFT=0 and HFT=1
• What is “Single Fault Tolerance”?
• Concept of redundancy (backup)
• Overview of 1oo2 and 2oo3
• How HFT differs from Cat.3 and Cat.4

What is HFT?

HFT is an abbreviation of “Hardware Fault Tolerance.”

Although the name may seem a little complicated, the concept is simple.
It represents “the maximum number of failures the system can endure and retain its safety functions.”

For example, suppose there is a safety system which stops a machine when its door is opened.
If there is only one safety sensor installed, the safety function will be lost when the sensor fails.

On the other hand, what if there are two sensors installed, performing the same safety functions respectively?
Even if one of them fails, another one may still work.

HFT evaluates this type of mechanism that does not immediately lose safety functions upon failure, and quantifies its durability against failures.

What does “HFT=0” mean?

It will be easy to understand the meaning of HFT=0,

if you regard it as the “state where there is no spare.”

For example, please imagine a system with only one single safety sensor.
As there is no spare safety sensor, there are 0 (zero) devices capable of safety function in the event of a failure.

In other words,

it is a status where no failure is tolerated.

As there is no tolerance for failure, it is represented as “HFT=0.”

What does “HFT=1” mean?

HFT=1 means a state where

“failure of up to 1 component is acceptable.”

For example, let’s consider a system which has two safety sensors.
Even if one of the sensors fails, the safety functions will be maintained as long as another sensor is normally working.
However, the safety functions will be lost if the remaining sensor fails.

This can be described as follows:

• The first component fails. → Still safe.
• The second one also fails. → Safety functions will be lost.

As explained above, the system “can withstand one failure,” therefore,

it is also called Single Fault Tolerance.

What does “HFT=N-1” mean?

When researching HFT, you may come across the formula below:

HFT = N-1

“N” represents “how many failures will cause the loss of safety functions.”

For example, if there is only one sensor, safety functions will be lost when that sensor fails.

This is represented as “N=1.”

Therefore, the formula will be solved as follows:

HFT = 1 – 1
         = 0

If there are two sensors, on the other hand,
where safety functions will be lost upon the failure of the second sensor, then “N=2.”

Therefore, the formula will be solved as follows:

HFT = 2 – 1
         = 1

At first glance, the formula may look difficult, but it simply represents “how many failures the system can endure” in number.

HFT=0 → The system can endure up to zero failures. (No failure is tolerated.)
HFT=1 → The system can endure up to one failure. (Single Fault Tolerance)

For your reference, there theoretically exist configurations of HFT=2 and HFT=3.
However, this article focuses primarily on HFT=0 and HFT=1 because these configurations are often used in the field of machine safety.

Why is HFT necessary?

It is impossible to reduce the failure rate of any device to zero.
No matter how highly reliable the component is, someday it will fail.

Therefore, safety design requires you to consider not only “preventing failure” but also “how far the safety can be maintained even if a failure occurs.”

HFT is a metric for this purpose.

What is redundancy?

A commonly used method to improve HFT is

redundancy.

Although it may sound difficult, it is sufficient to regard it as “having a backup ready.”

The examples are as follows:

• Install two sensors
• Use two PLCs
• Duplicate the safety circuits

The concept is similar to an airplane loaded with multiple engines.
The purpose is to avoid immediate loss of function even if one engine fails.

What is “1oo2”?

When explaining redundancy, the term “1oo2” often comes up.

It is an abbreviation of “1 out of 2.”
It stands for a configuration where “safety functions will operate as long as either one of the two fulfills the conditions.”

A typical example is the case where two safety sensors are used for stopping the machine if either of them detects danger.

It illustrates a situation where “two people are monitoring a machine, and if either of them notices danger, the machine will be stopped.”
This will maintain safety because, even if one person overlooks danger, another person can still notice it.

What is “2oo3”?

Other than 1oo2, configurations with more advanced redundancy are used.

The representative example is 2oo3.

It is an abbreviation of “2 out of 3.”
It stands for a configuration where “safety functions will operate as long as two out of three fulfill the conditions.”

In the following case, the machine will be decided to be on the “dangerous” side by majority vote and will be stopped:

• Sensor A → dangerous
• Sensor B → dangerous
• Sensor C → safe

This configuration makes it easy to reach a correct decision by majority vote, even if a single sensor behaves abnormally.
It can be illustrated as a mechanism which has three people consulting with each other and deciding by majority vote.

How is it different from Cat. 3 or Cat. 4?

If you have learned PL (Performance Level),
you may think “Isn’t it the same thing as Safety Category 3 or 4?”

In fact, the concept is very similar.
This is because both Cat. 3 and Cat. 4 also involve system structures (architectures) that aim at “maintaining safety functions even if one failure occurs.”

Therefore, they have some points in common with the concept of redundancy, such as duplicated sensors or circuits.
However, Cat.3 and Cat. 4 are the classifications which define “what kind of structures are required.”

On the other hand, HFT is an indicator which represents “how many failures the system can withstand.”
It has similar points, but they are not the same.

We can regard HFT as “target,” while Cat. 3 and Cat. 4 can be regarded as “means” to achieve the target.

Summary

HFT (Hardware Fault Tolerance) is an indicator which represents

“the maximum number of failures that the system can withstand while maintaining safety functions.”

Let’s summarize the key points:

• HFT=0 means no failures can be tolerated.
• HFT=1 means the system can withstand one single failure.
• Redundancy is used to improve HFT.
• 1oo2 and 2oo3 are the representative configurations with redundancy.
• They resemble Cat. 3 and Cat. 4, but they are different concepts (Cat. is means, whereas HFT is target).

If PFDavg and PFH are indicators representing “how likely it fails,”
HFT is an indicator representing “how many failures it can tolerate.”

To understand SIL, it is important to look at not only failure rates but also “mechanisms which maintain safety even after a failure occurs.”

Related Products