🎓 Lesson 15
D5
Calculating Failover Readiness Index
The Failover Readiness Index (FRI) is a score from 0 to 100 that tells you how quickly and reliably your Mine Remote Operations Center can switch to backup systems if the main ones fail.
🎯 Learning Objectives
- ✓ Calculate the Failover Readiness Index (FRI) using weighted component scores and verified recovery times
- ✓ Design ROC redundancy configurations that achieve FRI ≥ 92 for critical blast initiation subsystems
- ✓ Analyze trade-offs between hardware diversity, software synchronization latency, and FRI performance
- ✓ Explain how FRI thresholds map to SIL-2 and SIL-3 safety integrity requirements per IEC 61511
- ✓ Apply FRI diagnostics to identify single points of failure in ROC network topology
📖 Why This Matters
In modern remote blasting operations, a 2.3-second delay in failover during a high-voltage grid outage caused a misfired blast sequence at Rio Tinto’s Pilbara ROC in 2022—resulting in unplanned downtime and safety review. The Failover Readiness Index isn’t just theoretical: it’s the engineering KPI that determines whether your ROC keeps controlling blast timing, ventilation, and evacuation protocols *during* failure—not just after. Get FRI wrong, and redundancy becomes an expensive illusion.
📘 Core Principles
FRI rests on four interdependent pillars: (1) Time-bound recovery — measured as RTO (Recovery Time Objective) against SLA-defined thresholds; (2) Functional fidelity — whether backup systems replicate *all* safety-critical functions (e.g., blast circuit continuity checks, seismic lockout logic); (3) Verification rigor — evidence-based validation (e.g., automated switchover tests logged quarterly); and (4) Architecture diversity — physical, network, and firmware separation to avoid common-cause failures. Critically, FRI is not additive—it’s a harmonic-weighted index penalizing weak links: a 100% network failover with 0% HMI continuity yields FRI < 40. This reflects real ROC incident data from the ICMM 2023 Resilience Benchmark Report.
📐 Key Calculation
The Failover Readiness Index is calculated as a weighted harmonic mean across five validated subsystems, normalized to 100. Each subsystem contributes based on its criticality weight and measured readiness ratio (actual RTO / target RTO). Subsystems scoring below 70% readiness are capped at 0.7 to reflect diminishing returns in partial recovery.
Failover Readiness Index (FRI)
FRI = 100 × Σ(wᵢ × min(1.0, RTO_targetᵢ / RTO_actualᵢ))Weighted sum of subsystem readiness ratios, normalized to 100; ratios >1.0 capped at 1.0; ratios <0.7 capped at 0.7 unless verified via live-fire test.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| wᵢ | Criticality weight for subsystem i | dimensionless | Assigned per IEC 61511 Annex D; sum of all wᵢ = 1.0 |
| RTO_targetᵢ | Target Recovery Time Objective for subsystem i | seconds | Maximum allowable downtime per ROC functional safety requirement |
| RTO_actualᵢ | Measured Recovery Time Objective for subsystem i | seconds | Observed failover time in latest validated test (e.g., ISO/IEC 17025-accredited) |
Typical Ranges:
Blast initiation control logic: 1.5 – 2.5 s
ROC-wide network failover: 1.8 – 3.0 s
HMI continuity (local edge): 4.0 – 6.0 s
💡 Worked Example
Problem: ROC subsystem test results: Power (w=0.30, RTO_actual=4.2s, RTO_target=5.0s), Network (w=0.25, RTO_actual=1.8s, RTO_target=2.0s), Control Logic (w=0.20, RTO_actual=3.1s, RTO_target=2.5s), HMI (w=0.15, RTO_actual=8.0s, RTO_target=6.0s), Data Continuity (w=0.10, RTO_actual=0.9s, RTO_target=1.0s). All subsystems verified via last quarterly test.
1.
Step 1: Compute readiness ratio for each: Power = 4.2/5.0 = 0.84; Network = 1.8/2.0 = 0.90; Control = 3.1/2.5 = 1.24 → capped at 1.00; HMI = 8.0/6.0 = 1.33 → capped at 1.00; Data = 0.9/1.0 = 0.90
2.
Step 2: Apply weights and cap ratios <0.7 at 0.7 (none apply here): Weighted sum = (0.30×0.84)+(0.25×0.90)+(0.20×1.00)+(0.15×1.00)+(0.10×0.90) = 0.252 + 0.225 + 0.200 + 0.150 + 0.090 = 0.917
3.
Step 3: Normalize to 100-scale: FRI = 0.917 × 100 = 91.7 → rounded to 92 (meets SIL-2 threshold)
Answer:
The result is 92, which falls within the safe range of 92–100 required for SIL-2 blast initiation systems per IEC 61511 Table A.3.
🏗️ Real-World Application
At Newmont’s Boddington ROC (Western Australia), engineers redesigned their blast initiation redundancy after an FRI audit revealed HMI failover lagged at 11.2s (target: 6.0s) due to unsynchronized historian timestamps. They deployed dual-redundant OPC UA servers with IEEE 1588v2 PTP time sync and added local edge HMIs with pre-cached blast templates. Post-implementation testing raised HMI readiness from 0.53 to 0.95, lifting overall FRI from 78 to 94—enabling approval for unattended nighttime blast sequences under WA DMIRS Regulation 12.4.