Measuring safety instrumented systems

Process safety tutorial: PFD or PFH? The probability of failure on demand (PFD) and the average frequency of dangerous failure per hour (PFH) are two ways to measure safety instrumented systems (SISs). Control Engineering China explains when PFD or PFH should be used to measure SISs effectively.


Yiliu Liu is associate professor in the department of production and quality engineering, Norwegian University of Science and Technology. Courtesy: Control Engineering ChinaWhen engineers evaluate the performance of safety instrumented systems (SISs), two measures are available. The more common measure is the probability of failure on demand (PFD), and the other is the average frequency of dangerous failure per hour (PFH). The abbreviation PFH is from the 1997 version of IEC 61508, which is a multi-industry international standard that covers functional safety of automatic systems. IEC 61508-1997 uses the term probability of failure per hour; in recent literature the term PFH is still used, but the definition has been specified as the average frequency of dangerous failure (per hour). In what cases should PFD be used, or is PFH a more effective measure of SISs?

Low demand, high demand

In the generic international standard IEC 61508, it is stated that PFD (the average PFD or PFDavg in most instances) is the measure for SISs operating in the low-demand mode, while PFH can be used in the high- and continuous-demand mode.

Demands can be some events that need the responses of SISs, otherwise they may result in hazards to equipment, personnel, plant, and environment. Thus there is a need to define low-, high-, and continuous-demand modes.

IEC 61508 also gives some guidelines on how to distinguish low- and high-demand modes. Low-demand mode is when demands occur no more than once a year. High-demand mode is when demands occur more than once a year.

The classification is easy to understand and follow, but why select one year as the borderline between the two modes, rather than six months or two years?

Clues are available from the failure modes and maintenance strategies of SISs. Although self-diagnostic functions have been installed on many modern SISs, some dangerous failures are still undetectable by self-diagnosis and are only revealed in the regular proof tests.

These dangerous undetected (DU) failures are always regarded as the main contribuitor of the unavailability of SISs. In the simplified calculation of PFDavg for a single-component SIS (such as a shut-down valve), the measure is the product of its DU failure rate and half of the proof test interval, which is actually the mean downtime of the SIS.

Such a calculation does not consider demands and namely assumes that the failed SIS will be restored before a demand comes. In other words, the calculation of PFDavg is partly based on the assumption that when a DU failure occurs, the probability is that the SIS is fixed in the coming proof test and maintenance should be higher than that a demand comes. In the long term, the proof test frequency should be higher than the demand frequency.

Many SISs are tested once a year, so it is natural to adapt such a frequency as the highest demand frequency that can guarantee the above assumption is valid. Although such a test frequency actually means the rate of the failed SIS to be restored is around the inverse of half a year, once a year can be a conservative boundary between the two demand modes. 

Meanings of measures

Implications of the two measurements are a bit different. PFDavg is equal to the long-term average proportion of time where the SIS is unable to perform its function, and so it can be understood as the average unavailability of the system. Meanwhile, PFH has some similarities with another common measure in reliability analysis—rate of occurrences of failures. PFH at a certain moment can be regarded as an unconditional failure rate of an item. If we consider the long term, PFH can be the average rate of the failures.

With the differences, it is understandable why two sets of safety integrity level targets are listed in IEC 61508 for PFD and PFH.

Yiliu Liu is an associate professor in the department of production and quality engineering, Norwegian University of Science and Technology (NTNU). The article is submitted and translated by Control Engineering China. Edited by Joy Chang, Control Engineering,


See other manufacturing and Control Engineering China coverage at 

ONLINE extra

See additional stories about safety instrumented systems (SISs) below.

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
Each year, a panel of Control Engineering and Plant Engineering editors and industry expert judges select the System Integrator of the Year Award winners in three categories.
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Controller programming; Safety networks; Enclosure design; Power quality; Safety integrity levels; Increasing process efficiency
Additive manufacturing benefits; HMI and sensor tips; System integrator advice; Innovations from the industry
Robotic safety, collaboration, standards; DCS migration tips; IT/OT convergence; 2017 Control Engineering Salary and Career Survey
Featured articles highlight technologies that enable the Industrial Internet of Things, IIoT-related products and strategies to get data more easily to the user.
This article collection contains several articles on how automation and controls are helping human-machine interface (HMI) hardware and software advance.
This digital report will explore several aspects of how IIoT will transform manufacturing in the coming years.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Infrastructure for natural gas expansion; Artificial lift methods; Disruptive technology and fugitive gas emissions
Mobility as the means to offshore innovation; Preventing another Deepwater Horizon; ROVs as subsea robots; SCADA and the radio spectrum
Future of oil and gas projects; Reservoir models; The importance of SCADA to oil and gas
Automation Engineer; Wood Group
System Integrator; Cross Integrated Systems Group
Jose S. Vasquez, Jr.
Fire & Life Safety Engineer; Technip USA Inc.
This course focuses on climate analysis, appropriateness of cooling system selection, and combining cooling systems.
This course will help identify and reveal electrical hazards and identify the solutions to implementing and maintaining a safe work environment.
This course explains how maintaining power and communication systems through emergency power-generation systems is critical.
click me