Functional Safety · worked example, computed with First Out AI
High demand mode: why PFDavg gives the wrong answer
An interlock that is challenged on every batch is not a low-demand function. Calculated with PFDavg it appears to meet SIL 2. Calculated as a frequency of dangerous failure, as IEC 61511 requires, it does not.
Scenario
A solids charging valve on a batch reactor must not open while the reactor is under pressure. The interlock blocks the valve's opening command when pressure is above a low threshold. Operators charge the reactor about six times a day, so the interlock is demanded about 2,000 times a year.
IEC 61511 treats a function demanded more than once a year as high demand. Its target is then an average frequency of dangerous failure per hour (PFH), and SIL 2 means a PFH below 10⁻⁶ /h.
Verification in high demand mode
| Design | PFH | Band | Min. HFT met for SIL | Function SIL | Against target |
|---|---|---|---|---|---|
| Single transmitter, single solenoid | 1.0 × 10⁻⁶ /h | SIL 1 | 1 | SIL 1 | Short |
| 1oo2 transmitters, 1oo2 solenoids | 1.1 × 10⁻⁷ /h | SIL 2 | 3 | SIL 2 | Meets |
The same design viewed the wrong way
Calculated as if it were low demand, the single-channel design gives a PFDavg of 8.0 × 10⁻³, inside the SIL 2 band. That number assumes the function is rarely asked to act and has a whole proof test interval to reveal its failures. At 2,000 demands a year, a dangerous failure is found by the next demand, not by the next test, so the hazard frequency follows the failure rate itself.
Recommended design and data
| Subsystem | Voting | λDU /h | λDD /h | λS /h | β | Proof test | Coverage | Renewal / overhaul | Partial stroke | Type | SC | SFF |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Pressure transmitters | 1oo2 | 2.0 × 10⁻⁷ | 5.0 × 10⁻⁷ | 3.0 × 10⁻⁷ | 5% | 1 yr | 95% | 20 yr | – | B | SC 3 | 80.0% |
| Logic solver | 1oo1, internal HFT 1 | 1.0 × 10⁻⁹ | 5.0 × 10⁻⁷ | 2.0 × 10⁻⁷ | – | 10 yr | 100% | 20 yr | – | B | SC 3 | 99.9% |
| Interlock solenoids | 1oo2 | 8.0 × 10⁻⁷ | 0 | 6.0 × 10⁻⁷ | 10% | 1 yr | 90% | 10 yr | – | A | SC 3 | 42.9% |
Function mission time (averaging horizon): 10 yr. Renewal / overhaul is when failures that no test reveals are cleared for each subsystem.
Findings
With single devices the PFH is 1.0 × 10⁻⁶ /h, the SIL 1 band. In high demand mode IEC 61511 also requires a hardware fault tolerance of one for SIL 2, which a single channel cannot give.
Redundant transmitters and solenoids bring the PFH to 1.1 × 10⁻⁷ /h and meet both requirements. The common cause term of the solenoids is now the largest contributor.
Recommendations
- Classify each function's demand mode from the actual demand rate before choosing the calculation.
- For this interlock, use two transmitters and two solenoids, voted 1oo2, with separate power.
- Use the frequent demands as diagnostic evidence: log every blocked command and compare it with the pressure signal.
Worked example with an illustrative design and data, chosen to show the method; it is not a client project. Failure rates are typical of published device certificates and are not taken from any reliability database. Computed with the First Out AI engine v0.3.0 on 28.10.2026. First Out AI supports engineering judgement and does not replace it: results must be checked by a competent functional safety engineer, and First Out AI is not certified software. This is not engineering advice for a specific plant.