Measuring safety instrumented systems

Process safety tutorial: PFD or PFH? The probability of failure on demand (PFD) and the average frequency of dangerous failure per hour (PFH) are two ways to measure safety instrumented systems (SISs). Control Engineering China explains when PFD or PFH should be used to measure SISs effectively.


Yiliu Liu is associate professor in the department of production and quality engineering, Norwegian University of Science and Technology. Courtesy: Control Engineering ChinaWhen engineers evaluate the performance of safety instrumented systems (SISs), two measures are available. The more common measure is the probability of failure on demand (PFD), and the other is the average frequency of dangerous failure per hour (PFH). The abbreviation PFH is from the 1997 version of IEC 61508, which is a multi-industry international standard that covers functional safety of automatic systems. IEC 61508-1997 uses the term probability of failure per hour; in recent literature the term PFH is still used, but the definition has been specified as the average frequency of dangerous failure (per hour). In what cases should PFD be used, or is PFH a more effective measure of SISs?

Low demand, high demand

In the generic international standard IEC 61508, it is stated that PFD (the average PFD or PFDavg in most instances) is the measure for SISs operating in the low-demand mode, while PFH can be used in the high- and continuous-demand mode.

Demands can be some events that need the responses of SISs, otherwise they may result in hazards to equipment, personnel, plant, and environment. Thus there is a need to define low-, high-, and continuous-demand modes.

IEC 61508 also gives some guidelines on how to distinguish low- and high-demand modes. Low-demand mode is when demands occur no more than once a year. High-demand mode is when demands occur more than once a year.

The classification is easy to understand and follow, but why select one year as the borderline between the two modes, rather than six months or two years?

Clues are available from the failure modes and maintenance strategies of SISs. Although self-diagnostic functions have been installed on many modern SISs, some dangerous failures are still undetectable by self-diagnosis and are only revealed in the regular proof tests.

These dangerous undetected (DU) failures are always regarded as the main contribuitor of the unavailability of SISs. In the simplified calculation of PFDavg for a single-component SIS (such as a shut-down valve), the measure is the product of its DU failure rate and half of the proof test interval, which is actually the mean downtime of the SIS.

Such a calculation does not consider demands and namely assumes that the failed SIS will be restored before a demand comes. In other words, the calculation of PFDavg is partly based on the assumption that when a DU failure occurs, the probability is that the SIS is fixed in the coming proof test and maintenance should be higher than that a demand comes. In the long term, the proof test frequency should be higher than the demand frequency.

Many SISs are tested once a year, so it is natural to adapt such a frequency as the highest demand frequency that can guarantee the above assumption is valid. Although such a test frequency actually means the rate of the failed SIS to be restored is around the inverse of half a year, once a year can be a conservative boundary between the two demand modes. 

Meanings of measures

Implications of the two measurements are a bit different. PFDavg is equal to the long-term average proportion of time where the SIS is unable to perform its function, and so it can be understood as the average unavailability of the system. Meanwhile, PFH has some similarities with another common measure in reliability analysis—rate of occurrences of failures. PFH at a certain moment can be regarded as an unconditional failure rate of an item. If we consider the long term, PFH can be the average rate of the failures.

With the differences, it is understandable why two sets of safety integrity level targets are listed in IEC 61508 for PFD and PFH.

Yiliu Liu is an associate professor in the department of production and quality engineering, Norwegian University of Science and Technology (NTNU). The article is submitted and translated by Control Engineering China. Edited by Joy Chang, Control Engineering,


See other manufacturing and Control Engineering China coverage at 

ONLINE extra

See additional stories about safety instrumented systems (SISs) below.

No comments
The Engineers' Choice Awards highlight some of the best new control, instrumentation and automation products as chosen by...
The System Integrator Giants program lists the top 100 system integrators among companies listed in CFE Media's Global System Integrator Database.
The Engineering Leaders Under 40 program identifies and gives recognition to young engineers who...
This eGuide illustrates solutions, applications and benefits of machine vision systems.
Learn how to increase device reliability in harsh environments and decrease unplanned system downtime.
This eGuide contains a series of articles and videos that considers theoretical and practical; immediate needs and a look into the future.
Robot advances in connectivity, collaboration, and programming; Advanced process control; Industrial wireless developments; Multiplatform system integration
Sensor-to-cloud interoperability; PID and digital control efficiency; Alarm management system design; Automotive industry advances
Make Big Data and Industrial Internet of Things work for you, 2017 Engineers' Choice Finalists, Avoid control design pitfalls, Managing IIoT processes
This article collection contains several articles on the Industrial Internet of Things (IIoT) and how it is transforming manufacturing.

Find and connect with the most suitable service provider for your unique application. Start searching the Global System Integrator Database Now!

Big Data and bigger solutions; Tablet technologies; SCADA developments
SCADA at the junction, Managing risk through maintenance, Moving at the speed of data
Flexible offshore fire protection; Big Data's impact on operations; Bridging the skills gap; Identifying security risks
click me