Glossary · Fault behavior and system states
Hardware fault tolerance (HFT)
Also known as: HFT
German: Hardware-Fehlertoleranz (HFT)
In functional safety under IEC 61508 and IEC 61511, hardware fault tolerance (HFT) is the ability of a subsystem to continue to perform its safety function in the presence of hardware faults. An HFT of N means that N+1 faults could cause the loss of the safety function.
- Functional safety
In one sentence
Hardware fault tolerance (HFT) of N means a subsystem keeps its safety function with N faults; N+1 faults could cause its loss.
Example
Two pressure transmitters voted 1oo2 have an HFT of 1: one transmitter can fail dangerously and the other still trips the process.
How it applies
- Architecture: HFT is set by the voting arrangement. A 1oo1 or 2oo2 arrangement has HFT 0, 1oo2 and 2oo3 have HFT 1, and 1oo3 has HFT 2.
- Architectural constraints: IEC 61508 and IEC 61511 require a minimum HFT depending on the SIL and, in IEC 61508 Route 1H, on the Safe failure fraction (SFF) and the element type. These constraints apply in addition to the failure probability calculation.
- Common cause: Redundancy only helps if the channels do not fail together. Common-cause failure (CCF) must be considered in every redundant design.
- Documentation: State the voting and HFT per subsystem in the design documents and SIL verification. Operating and maintenance instructions should explain what happens when one channel is bypassed, since this temporarily reduces the HFT.
HFT vs. category
HFT is the IEC 61508 and IEC 61511 measure of redundancy. The categories of ISO 13849-1 also describe fault behavior, but they combine redundancy with diagnostic requirements. They correspond only approximately.