A SIF that trips when there is no hazard costs production, wears equipment and teaches operators to distrust it, which leads to bypasses. The spurious trip rate (STR) and its inverse, the mean time to fail spuriously (MTTFS), belong in the design basis next to PFDavg.
What causes spurious trips
Safe failures (λSU, λSD) and, if the design trips on detected dangerous failures, also λDD. Common cause also applies to safe failures.
Effect of voting
- 1oo1: any safe failure trips. STR ≈ λS.
- 1oo2: either channel trips: STR ≈ 2·λS. Best for safety, worst for spurious trips.
- 2oo2: both must trip: very low STR, but no safety fault tolerance.
- 2oo3: two must trip: STR very low (two independent safe failures within the repair window, plus the common cause share), with HFT 1 for safety. That is why 2oo3 is the standard for transmitters on critical trips.
Worked example
One transmitter channel with λS = 3 × 10⁻⁶ per hour (β = 10 % for the redundant cases):
| Voting | MTTFS (years) |
|---|---|
| 1oo1 | about 38 |
| 1oo2 | about 20 |
| 2oo3 | about 380 |
The safety result moves the other way: 1oo2 gives the lowest PFDavg, 2oo3 slightly higher, 1oo1 the highest.
In the SRS
State the maximum acceptable spurious trip rate or minimum MTTFS ("Spurious trip requirement" in First Out AI). It guides the voting choice and the decision whether detected failures should trip or only alarm.
In First Out AI
The result shows the mean time to spurious trip on paid plans, and the "Detected failure trips the function" option on each group decides whether λDD counts towards spurious trips.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.