Safe failure fraction is one number that quietly decides how much extra hardware redundancy a safety system actually needs.
This guide breaks down what counts as a safe failure, what counts as a dangerous one, and walks through the exact math behind the SFF of a real device.
Safe failure fraction is the proportion of a safety device's total failures that either lead to a safe state or get caught by internal diagnostics, rather than failing dangerously and silently.
Safe Failure Fraction: The Number Behind Hardware Fault Tolerance
Every component in a safety instrumented system fails eventually. What matters is how it fails, and whether anyone finds out.
Some failures push the system to a safe state on their own. Others get caught by built-in diagnostics before they cause harm. The dangerous ones are the failures that stay hidden until a real demand happens.
This same silent-failure risk is covered in our guide to SIS safety lifecycle stages.
SFF measures how much of a device's total failure rate falls into the safer categories, and it directly affects the SIL a piece of hardware can support.
The Four Ways a Safety Component Can Fail
Safe Detected
Fails toward safety, and diagnostics confirm it happened right away.
Safe Undetected
Fails toward safety, but nothing flags it. Still not dangerous, just quiet.
Dangerous Detected
Could cause harm, but internal diagnostics catch it before it matters.
Dangerous Undetected
Could cause harm, and nothing catches it. This is the failure everyone designs against.
Only the last category, dangerous undetected, sits completely outside SFF. Every other type of failure counts toward it, and pushing it down through diagnostics is the same idea used in SIL verification calculations like PFDavg.
How the SFF Formula Actually Works
The formula compares the failures that are either safe or caught by diagnostics against every failure the device can have.
Written simply: SFF equals safe failures plus dangerous detected failures, divided by all failures combined, safe and dangerous, detected and undetected, as explained in this overview of SIL architectural constraints under IEC 61508.
A higher SFF means fewer failures are silently dangerous, which is exactly what a safety system wants.
Try It: SFF Calculator
Enter the three failure rates below, in any consistent unit, to calculate the SFF of a device.
Working an Example by Hand
Take a transmitter with a safe failure rate of 200 FIT, a dangerous detected rate of 150 FIT, and a dangerous undetected rate of 50 FIT.
λDD = 150 FIT
λDU = 50 FIT
Step 1: λD = λDD + λDU = 150 + 50 = 200 FIT
Step 2: Total = λS + λD = 200 + 200 = 400 FIT
Step 3: SFF = (200 + 150) ÷ 400 = 350 ÷ 400 = 0.875, or 87.5%
An 87.5% SFF means only 12.5% of this device's failures are the dangerous, silent kind that architectural safeguards need to cover.
Why SFF Decides How Much Hardware Redundancy Is Required
IEC 61508 links SFF directly to a requirement called hardware fault tolerance, or HFT, the number of faults a subsystem can survive without losing its safety function.
A device with a low SFF needs a higher HFT, meaning more redundant channels, to reach the same SIL as a device with a high SFF and a lower HFT requirement.
This is the same redundancy logic covered in our guide to DCS controller redundancy, where extra hardware compensates for weaker single-channel reliability.
| SFF Range | Type A, Minimum HFT for SIL 2 | Type B, Minimum HFT for SIL 2 |
|---|---|---|
| Below 60% | 1 | 2 |
| 60% to 90% | 1 | 1 |
| 90% to 99% | 0 | 1 |
| 99% or above | 0 | 0 |
Type A subsystems use simple, well-understood components. Type B subsystems, like microprocessor-based devices, need higher SFF to reach the same hardware fault tolerance, as detailed in this back-to-basics explanation of SFF.
How Engineers Actually Improve a Device's SFF
Add internal diagnostics
Converting a dangerous undetected failure into a dangerous detected one raises SFF without touching the hardware count.
Choose components with published failure data
Certified failure rate data lets engineers calculate SFF accurately instead of guessing.
Add redundant channels where SFF alone falls short
When diagnostics cannot raise SFF enough, extra hardware fault tolerance closes the gap, the same principle behind SCADA redundancy architecture at the system level.
Verify the achieved SFF against the target SIL
Recalculate SFF whenever a component or diagnostic changes in the design.
Document the SFF calculation for the safety file
Keep the numbers traceable, since assessors will ask how the SFF value was derived.
Good Practices Around SFF
✓ Do
- Use manufacturer-certified failure rate data for SFF calculations
- Recalculate SFF whenever diagnostics or components change
- Check both SFF and hardware fault tolerance against the target SIL
- Keep the SFF calculation documented and traceable
✗ Don't
- Assume a high SFF alone guarantees the target SIL is met
- Use generic or estimated failure rate data when certified data exists
- Ignore the Type A versus Type B distinction for a component
- Skip re-verification after a design change affecting diagnostics
Worth Reading if You Want to Go Deeper
Common Questions on SFF
External References
- Pr Electronics: IEC 61508 Functional Safety, SIL, HFT, SFF, Type A/B
- exida: Back to Basics, Safe Failure Fraction (SFF)
What We Learn Today
- SFF measures how much of a device's total failures are safe or caught by diagnostics, rather than dangerous and hidden.
- The formula is SFF = (safe failures + dangerous detected failures) divided by all failures combined.
- A worked example showed a device with 200 FIT safe, 150 FIT dangerous detected, and 50 FIT dangerous undetected failures reaching an SFF of 87.5%.
- SFF, together with hardware fault tolerance and Type A or Type B classification, decides how much redundancy a safety subsystem needs to reach its target SIL.