FTTI is measured, not guessed: simulating fault tolerant time intervals

Ask a program where its fault tolerant time interval came from and you usually get one of three answers: it was inherited from the previous project, it was set to a round number that felt conservative, or it appeared in a requirement nobody can trace. Then the whole safety concept gets budgeted against it — diagnostic intervals, reaction times, watchdog windows — as if the number were a fact about the world.

FTTI is a fact about the world. It is the time span from a fault’s occurrence until the hazardous event becomes unavoidable, and it is determined by physics: vehicle speed, surface friction, actuator authority, the geometry of what the vehicle can hit. Physics can be simulated. So on my current program — safety concepts for test equipment that operates alongside SAE L3-L4 autonomous trucks on a closed proving ground — I built a simulation tool to compute it instead of assuming it.

Why guessing fails in both directions

An FTTI that is too generous is an undetected safety gap: the fault reaction arrives after the situation is already unrecoverable, and no metric in your FMEDA will reveal it, because every calculation downstream inherited the wrong budget. An FTTI that is too conservative is quietly expensive in the other direction: it forces faster diagnostics, tighter watchdog windows, and higher-rate monitoring than the hazard actually requires, and teams burn architecture effort meeting a number that was never real.

Both failure modes come from the same root: treating FTTI as an input when it is actually an output — of the hazard, the operational situation, and the vehicle dynamics.

What the simulation actually does

The tool models the closed-track operational situations from the hazard analysis: the vehicle’s state (speed, heading, load), the fault’s effect on actuation (loss of braking, stuck steering command, unintended acceleration), and the evolution of the scenario from fault injection until the hazard boundary — the point past which the safe state can no longer be reached. Sweep the scenario space, take the governing case, and the margin between fault and hazard boundary is the FTTI for that hazardous event. Subtract the measured fault detection and reaction times and what remains is your actual engineering margin — not a felt sense of conservatism, but a number with a derivation behind it.

Three things surprised me in practice:

1. The governing scenario is rarely the intuitive one. The obvious worst case — highest speed, heaviest load — was not always the binding constraint. Low-speed scenarios with reduced actuator authority produced tighter intervals more than once. This is exactly the kind of result that convention-based FTTI never surfaces.
2. FTTI varies more across hazards than programs assume. Using one program-wide FTTI means every safety mechanism is budgeted against the single tightest hazard. Deriving it per hazardous event relaxed several timing chains and let the tightest one get genuine attention.
3. The derivation becomes evidence. When the assessor asks where the interval comes from, the answer is a documented simulation with stated assumptions, not archaeology. The FTTI moved from the weakest link in the timing argument to one of the strongest.

The assumptions are the analysis

A simulation is only as defensible as its inputs, so the model’s assumptions — friction coefficients, actuator response curves, detection thresholds for “hazard boundary” — are treated as safety-relevant data: sourced, reviewed, and version-controlled alongside the results. Where an assumption could not be sourced, we measured it on the track. Vehicle-dynamics runs on the proving ground closed the loop between the model and reality; a simulation that has never been confronted with a physical test is a hypothesis, not evidence.

The general point

FTTI is one instance of a wider pattern: safety concepts are full of numbers that are treated as tradition but are actually computable — with modest, purpose-built tooling that one engineer can produce. Every number you can derive instead of assume converts a soft spot in the safety argument into evidence. That trade is almost always worth making.