What is SFF (Safe Failure Fraction)? - Understanding the Difference from DCavg

What is SFF?

SFF (Safe Failure Fraction) is an indicator representing “how many of the failures that occur can be treated as safe failures?”
It may sound complicated, but let’s take a look at the types of failures first.

Classify failures into 3 types

An ideal safety device will not suffer from any failures, but in reality, someday they will fail.
To get the clear picture of SFF, let’s classify failures into 3 types.

1. Safe Failure
2. Dangerous Failure
3. Detected Failure

Let’s take a look at these 3 types one by one.

1. Safe Failure

This is a type of failure that causes the system to enter a safe state.
Let’s imagine a safety relay unit which has failed and its output has turned to OFF.
If the machine stops consequently, there is no danger.
Such a failure is called a Safe Failure.
In other words, it is “a failure which is inconvenient but not dangerous.”

2. Dangerous Failure

This is a type of failure that causes the safety functions to stop working.
The following is an example:

• The emergency button was pressed.
• But the machine did not stop.

In this case, safety functions are not working when required.
Such a failure is called a Dangerous Failure.
In other words, it is “a failure that can cause an accident.”

3. Detected Failure

However, even in the event of a failure, there are cases where the safety device can detect the fault on its own.
Examples are as follows:

• • Safety PLC performs internal diagnostics.
  • Circuit faults are detected.
  • Error messages are displayed.

Such a failure is called a Detected Failure.

What is important here is that failures are first classified into “Safe Failures” and “Dangerous Failures,” and then further classified into “Detected Failures” and “Undetected Failures.”

In fact, there are cases where

• even if it is a Dangerous Failure
• it can be found (detected) by diagnostic functions.

This means that “whether it is safe or dangerous” is different from “whether it is detected or undetected.”

Familiar example: the door of a microwave oven

A microwave oven has a safety mechanism which prevents the oven from heating when its door is opened.
This mechanism prevents microwaves from being emitted outside even if the door is opened.

Now, suppose this safety mechanism fails.

Case 1: Safe Failure

Safety mechanism (e.g. the system to detect the door status) has failed, and the door is determined to be “opened.”

Results:

• The microwave oven does not start to heat.
• The food is not heated.
• It is inconvenient, but there are no safety problems.

→ Safe Failure

Case 2: Dangerous Failure (undetected)

The safety mechanism has failed, but the door is determined to be “closed” even though it is opened.

Results:

• Heating function of the microwave oven is activated.
• Safety functions do not work.
• Faults are not detected.

→ Dangerous Failure (undetected)

Case 3: Dangerous Failure (detected)

A fault has occurred in the safety mechanism.

Results:

• Unusual signals are output.
• Control circuits detect the fault.
• The oven’s operation is stopped, showing error messages etc.

→ Dangerous Failure (detected)

What does SFF represent?

Now, let’s return to SFF.
SFF represents how many of all the failures are “Safe Failures” or “Dangerous Failures detected by diagnostic functions.”
This means that the value of SFF gets higher when the number of “Dangerous Failures (undetected)” is small.
Conversely, the value of SFF gets lower when the number of “Dangerous Failures (undetected)” is large.

Understanding SFF with an example

Suppose 100 failures occur in a device.
The breakdown of the failures is as follows:

• Safe Failures: 60
• Dangerous Failures (detected): 30
• Dangerous Failures (undetected): 10

In this case, the failure most likely to cause accidents is “Dangerous Failures (undetected):10.”
The remaining 90 failures are

• Safe Failures, or
• Dangerous Failures (detected)

Therefore, it is possible to avoid danger one way or the other.
So the device’s SFF = 90%.

Then how is it different from DCavg?

This is the most confusing point.
Although SFF and DCavg are similar, their roles are different from each other.

What SFF evaluates

SFF looks at the breakdown of failures in a whole device.
Namely, it evaluates:

• How many Safe Failures are there?
• How many Dangerous Failures (detected) are there?
• How many Dangerous Failures (undetected) are there?

What DCavg evaluates

DCavg (Average Diagnostic Coverage) represents how many Dangerous Failures can be detected.
Namely, it focuses solely on Dangerous Failures, and indicates what percentage of them can be detected with diagnostic function.

Compare them using an example

Suppose a device which experiences failures as shown below:

• Safe Failures: 60
• Dangerous Failures (detected): 30
• Dangerous Failures (undetected): 10

In this case, SFF is 90% as explained earlier.
On the other hand, if we look at Dangerous Failures only, there are 40 failures in total (30 detected and 10 undetected), and 30 of them are detected.
Therefore, DCavg is 30 ÷ 40 = 75%.

Differences between SFF and DCavg in simple expressions

SFF is an indicator representing “how few Dangerous Failures (undetected) occur.”
On the other hand, DCavg is an indicator representing “how many Dangerous Failures can be detected.”
In other words, the difference between SFF and DCavg can be described as follows:

• SFF looks at the whole failures.
• DCavg looks at Dangerous Failures only.

Summary

To understand SFF, it is important to first understand what types of failures are there.

• Safe Failures: Failures that result in a safe state
• Dangerous Failures: Failures that can result in safety functions becoming inoperative (and cause accidents)
• Dangerous Failures (detected): Dangerous Failures which is detected with diagnostic functions

SFF represents “the ratio of Safe Failures and Dangerous Failures (detected) within all the failures.”
Therefore, the smaller the number of Dangerous Failures (undetected), the higher the value of SFF.

Also, the differences between SFF and DCavg can be described as follows:

• SFF is an indicator looking at the whole failures.
• DCavg is an indicator looking at the percentage of Dangerous Failures (detected).

To achieve a high SIL, it is important not only to ensure the resistance failure (to reduce Dangerous Failures), but also to establish mechanisms to detect failures quickly with diagnostic functions.

Appendix: To make SIL higher

There are primarily two ways to enhance safety:

(1) Make the device resistant to failures

This approach reduces the probability of a Dangerous Failure occurring.
This is related to the indicators PFH and PFDavg.

(2) Enable early detection of Dangerous Failures

Even if a failure occurs, this approach allows you to respond with diagnostic functions before the failure results in a dangerous state.
This is related to DCavg and SFF.

In other words, it is important to consider enhancing safety from two perspectives:

• Reduce the number of failures
• Detect Dangerous Failures

Related Products