There’s a difference between the Fault Tolerant Time Interval (FTTI) and the Fault Reaction Time Interval (FRTI). One should fit within the other. But for some reason there seems to be a lot of confusion amongst the functional safety community about how to define each term.
So what does the ISO 26262 standard say? Part 1, 1.44 defines FRTI as, “time-span from the detection of a fault (1.42) to reaching the safe state (1.102)”. Part 1, 1.45 defines FTTI as, “time-span in which a fault (1.42) or faults can be present in a system (1.129) before a hazardous (1.57) event occurs”. Figure 4 below shows that timing for both the FTTI and FRTI begin when the fault occurs.
The Fault Tolerant Time Interval should be determined for each safety goal. The FTTI is simply the time that a fault can be present in a system before a hazard occurs. Therefore the FTTI represents a total target time the system needs to meet in order to transition to a safe state. The system, whenever possible, needs to switch to a safe state within the FTTI.
In contrast to the FTTI, the FRTI is determined by the item’s time to achieve a safe state. FRTI begins once a fault has been detected. Note that the standard only shows the time when a fault is detected, and does not include “maturation timing” of a fault. There may be cases where getting to a safe state will occur prior to maturing of a fault. However, if notification of the driver is part of the safety mechanism for the safety goal, the fault maturation will need to be included in the FRTI.
To ensure safety of a system the time from the detection of a fault plus the time for the system to achieve a safe state shall be less than the FTTI for the safety goal. This idea can be illustrated in the following equation:
FTTI > Diagnostic Test Interval (DTI) + Fault Reaction Time Interval (FRTI)
When analyzing the FTTI of a system, all the propagation delays of all the sub-systems will need to be summed. Knowing the DTI and FRTI of each sub-system will help confirm that the safe state can be reached by the FTTI period. If the FRTI of a parent system is known, then the allocation of the remaining FTTI can be distributed to the children sub-systems. It is good practice to reduce the remaining FTTI by some margin of time to allow for dependent time delays between the children sub-systems or between the child and parent systems.