← All chapters Chapter 28

Appendix G — The Fault-Tolerant Time Interval

The clock starts at the malfunction, not the fault.

The FTTI is read loosely because its start is disputed. It does not measure the age of a fault; it measures how long the malfunction may persist, so the clock starts when the fault first shows at the output. From that fixed start: one FTTI and safe state per malfunction, set by the customer, and a fault tree of its own whose top event is safe state not reached in time.