First Out

Calculation methods

Hardware fault tolerance, SFF and the architectural constraints

The difference between the IEC 61511 fault tolerance requirement and the IEC 61508 Route 1H check, how to calculate SFF, and a worked example.

2 min read · First Out AI knowledge library

A low PFDavg alone is not enough: the standards also limit how much a design may rely on a single device. This is the architectural constraint, expressed as minimum hardware fault tolerance (HFT).

Hardware fault tolerance

HFT is the number of faults a subsystem can have while still performing its safety function. 1oo1 and 2oo2 have HFT 0; 1oo2 and 2oo3 have HFT 1; 1oo3 has HFT 2. A device that is redundant internally (a logic solver with redundant processors) can carry its own HFT.

Two routes in the standards

  • IEC 61511 (process sector). The current edition sets a minimum HFT per SIL for each subsystem, independent of SFF, with conditions under which it can be reduced (for example, proven-in-use devices in lower SILs). First Out AI reports this as "Fault tolerance (IEC 61511)", the governing check for process SIFs.
  • IEC 61508-2 Route 1H. Device-level: the maximum SIL claimable depends on HFT, the safe failure fraction and whether the element is Type A (simple, well-understood failure modes) or Type B (complex, e.g. with software). Route 2H uses field reliability data with confidence limits instead of SFF. First Out AI shows Route 1H as informative on paid plans.

Refer to the standards themselves for the tables; First Out AI applies them in the engine.

Safe failure fraction

SFF = (λSD + λSU + λDD) / (λSD + λSU + λDD + λDU)

It answers: of all failures, how many are safe or detected?

Worked example

A transmitter with λSD = 1 × 10⁻⁶, λSU = 2 × 10⁻⁶, λDD = 3 × 10⁻⁶ and λDU = 1 × 10⁻⁶ per hour:

SFF = (1 + 2 + 3) / (1 + 2 + 3 + 1) = 6/7 = 85.7 %

A shutdown valve with λSU = 1.6 × 10⁻⁶ and λDU = 0.9 × 10⁻⁶ and no diagnostics has SFF = 64 %. As a single Type A element this limits the claim under Route 1H. Increasing diagnostics (partial stroke reported as λDD) or redundancy raises the architectural limit.

Common mistakes

  • Using SFF to argue a design meets IEC 61511 fault tolerance: the process standard's requirement is on HFT.
  • Counting "no effect" failures as safe failures to inflate SFF.
  • Forgetting the solenoid valve or the interposing relay in the final element subsystem.

In First Out AI

Element type, systematic capability and internal fault tolerance are in the group details. The result shows HFT and the required HFT per group, SFF, and the SIL limited by each route, so you can see which check limits the achieved SIL.

Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.