In short. A fault-tolerant system keeps the load supplied through any single failure, without operator action. It needs independent paths, detection that is fast and reliable, isolation that is selective, and spare capacity that is real. The claim must be verified by failure testing, because untested redundancy is a hope, not a property.
What “tolerant” means
The key is to define the fault set. Typical single failures include a generator not starting, a breaker failing to close or open, a UPS failing, a cable fault, a controller failure and loss of a utility feed. A design is tolerant of these if the load continues with no or acceptable interruption and without an operator.
Ingredients
| Ingredient | Purpose |
|---|---|
| Independent paths | No single element on both |
| Spare capacity | Survivors carry the load |
| Fast, selective protection | Clear the fault, isolate only the faulted part |
| Automatic transfer | No dependence on human reaction |
| Monitoring | Detect hidden failures before they matter |
| Fail-safe control | Loss of control leaves a safe state |
Single-fault analysis
- List every component on the single-line diagram.
- For each, consider its failure and trace the effect on every load.
- Where a load is lost, either add redundancy or accept the risk explicitly.
- Repeat for control, communications, DC supply and environmental support.
See FMEA and failure scenarios.
Hidden failures
The worst failures are the silent ones: a standby generator whose battery is dead, a relay disabled during maintenance, a breaker that does not trip because its shunt trip coil has failed. Fault tolerance depends on finding these through monitoring and testing, and on alarms that reach people. Examples include battery monitors, trip circuit supervision and periodic functional tests.
Where tolerance usually breaks
- Common-cause events, such as a fire in a shared room or flooded basement. See common-cause failure.
- Control and communication networks that are single or shared.
- Protection that is not selective, so a small fault takes out a large part.
- Maintenance states, where redundancy is reduced.
- Human error, particularly during switching.
Worked illustration
A site has two generators, two UPS and two feeds, drawn as 2N. A single-fault review finds that both UPS output breakers are controlled from one PLC powered from one 24 V supply. Loss of that supply disables both. The fix is two PLCs, or a redundant controller with separate supplies, plus fail-safe breaker states. The review needed no new generators or UPS; it needed attention to control and support systems.
Testing tolerance
- Failure injection tests: open the utility, fail a generator start, trip a breaker, remove a control supply.
- Record the outcome against the expected result.
- Repeat after significant changes.
Fault tolerance is more than redundancy
Fault-tolerant architecture means that a single failure of any component does not interrupt the load, and that the failure is contained so it does not cascade.
| Property | How it is achieved |
|---|---|
| Single-fault tolerance | Duplicate paths and components |
| Containment | Sectionalising, selective protection, fire separation |
| Independence | Separate rooms, routes, controls |
| Detectability | Monitoring that shows faults before the second failure |
| Repairability | Spares, procedures and access |
Where designs fail
- Shared dependencies hidden in the design: one control power supply, one fuel pump, one cooling loop.
- Protection that trips more of the system than the fault.
- Hidden failures: standby equipment that failed silently and is found only when needed.
Defence in depth
Add layers: primary protection, backup protection, breaker failure, bus sectionalising, plus operational layers such as monitoring and drills.
Test the claim
For each component, state what happens if it fails and prove it by a test or simulation. Untested fault tolerance is a hope. See failure simulation testing.
See single-point-of-failure elimination.
Common mistakes
- Counting equipment redundancy but not control redundancy.
- Ignoring hidden failures.
- Relying on operator action for the first response.
What to send us
Send the single-line diagram, control architecture and fault set you want covered. Send your application details. See also single-point-of-failure elimination.
Questions engineers ask
What is the difference between redundant and fault tolerant?
Redundant means spare equipment exists. Fault tolerant means the system continues through failure, which needs independence, detection, isolation and control.
Can a system be fault tolerant to every failure?
No. Define the failure set and accept the residual risks that remain.
How do I find hidden failures?
Through supervised circuits, monitoring, periodic functional tests and alarm review.
Is human action allowed in a tolerant design?
For the first response, no. Operators handle recovery and repair after the system has already tolerated the fault.
This guide gives general principles. Fault-tolerance claims should be verified by testing.