Abstract
The IEC 61508 standard provides guidance on when to use PFD (Probability of Failure on Demand) and when to use PFH (Dangerous Failure Frequency) as a measure for risk reduction of a Safety Instrumented System (SIS). The standard relates this choice to the demand rate on the SIS, referring to low demand and high demand systems. However, this distinction seems somewhat arbitrary. The paper considers the question of appropriate use of PFD and PFH measures. A new approximation is derived for the average PFD, and demonstrates how this depends on the rate of demands on the SIS, assuming that these demands also serve as a functional test. Further, the Hazard Rate, HR, i.e. the rate of demands on the SIS occurring when the SIS is failed, is considered. Also relations between the average PFD, PFH and HR are provided. The main results are obtained for a single non-redundant SIS, but are valid also with respect to common cause failures of a redundant SIS. More general approximations can be obtained, as is exemplified for the 1-out-of-2 voting configuration of a redundant SIS unit. It is argued that the new general expression for average PFD or HR should be applied as measures for risk reduction for both low and high demand systems; the PFH being most relevant for systems operating in so-called continuous mode.