Measuring safety instrumented systems
When engineers evaluate the performance of safety instrumented systems (SISs), two measures are available. The more common measure is the probability of failure on demand (PFD), and the other is the average frequency of dangerous failure per hour (PFH). The abbreviation PFH is from the 1997 version of IEC 61508, which is a multi-industry international standard that covers functional safety of automatic systems. IEC 61508-1997 uses the term probability of failure per hour; in recent literature the term PFH is still used, but the definition has been specified as the average frequency of dangerous failure (per hour). In what cases should PFD be used, or is PFH a more effective measure of SISs?
Low demand, high demand
In the generic international standard IEC 61508, it is stated that PFD (the average PFD or PFDavg in most instances) is the measure for SISs operating in the low-demand mode, while PFH can be used in the high- and continuous-demand mode.
Demands can be some events that need the responses of SISs, otherwise they may result in hazards to equipment, personnel, plant, and environment. Thus there is a need to define low-, high-, and continuous-demand modes.
IEC 61508 also gives some guidelines on how to distinguish low- and high-demand modes. Low-demand mode is when demands occur no more than once a year. High-demand mode is when demands occur more than once a year.
The classification is easy to understand and follow, but why select one year as the borderline between the two modes, rather than six months or two years?
Clues are available from the failure modes and maintenance strategies of SISs. Although self-diagnostic functions have been installed on many modern SISs, some dangerous failures are still undetectable by self-diagnosis and are only revealed in the regular proof tests.
These dangerous undetected (DU) failures are always regarded as the main contribuitor of the unavailability of SISs. In the simplified calculation of PFDavg for a single-component SIS (such as a shut-down valve), the measure is the product of its DU failure rate and half of the proof test interval, which is actually the mean downtime of the SIS.
Such a calculation does not consider demands and namely assumes that the failed SIS will be restored before a demand comes. In other words, the calculation of PFDavg is partly based on the assumption that when a DU failure occurs, the probability is that the SIS is fixed in the coming proof test and maintenance should be higher than that a demand comes. In the long term, the proof test frequency should be higher than the demand frequency.
Many SISs are tested once a year, so it is natural to adapt such a frequency as the highest demand frequency that can guarantee the above assumption is valid. Although such a test frequency actually means the rate of the failed SIS to be restored is around the inverse of half a year, once a year can be a conservative boundary between the two demand modes.
Meanings of measures
Implications of the two measurements are a bit different. PFDavg is equal to the long-term average proportion of time where the SIS is unable to perform its function, and so it can be understood as the average unavailability of the system. Meanwhile, PFH has some similarities with another common measure in reliability analysis—rate of occurrences of failures. PFH at a certain moment can be regarded as an unconditional failure rate of an item. If we consider the long term, PFH can be the average rate of the failures.
With the differences, it is understandable why two sets of safety integrity level targets are listed in IEC 61508 for PFD and PFH.
Yiliu Liu is an associate professor in the department of production and quality engineering, Norwegian University of Science and Technology (NTNU). The article is submitted and translated by Control Engineering China. Edited by Joy Chang, Control Engineering, email@example.com.
See other manufacturing and Control Engineering China coverage at
See additional stories about safety instrumented systems (SISs) below.