A validated quantitative basis for the IEC 61508 architectural constraints: does safe-failure-fraction-based hardware fault tolerance achieve its intended effect?

The functional-safety standard IEC 61508 caps the safety integrity level (SIL) that a safety instrumented system (SIS) subsystem may claim through 'architectural constraints': tabulated minimum hardware fault tolerance (HFT) requirements keyed to the subsystem's safe failure fraction (SFF). Lundteigen and Rausand (2009) argued that these constraints may not have the intended effect: the SFF conceals absolute failure rates, can be inflated by poor engineering choices, rests on unstandardized failure classification, excludes systematic (design and software) failures, and the remedy it motivates — higher redundancy — raises spurious trip rates with attendant secondary hazards. The underlying question remains open. No later work establishes the conditions under which SFF-based HFT credit actually reduces risk; the standards' second edition added an alternative compliance route (Route 2H) based on failure-rate data, which bypasses rather than repairs the critique. Of the research needs discussed by the authors and follow-on literature, spurious-trip quantification has advanced furthest, while the quantitative inclusion of systematic failures and objective safe-failure classification remain largely untouched. The problem is to determine whether and when the SFF-based architectural constraints achieve their intended effect, and to establish validated quantitative criteria for SIS hardware architecture selection that repair the identified weaknesses, either by establishing validity conditions for SFF-based determination or by replacing or constraining it with validated criteria.

Background

A safety instrumented system (SIS) is an instrumented protection layer — sensors, logic solvers, and final elements such as shutdown valves — designed to take an industrial process to a safe state when a hazardous condition arises (a 'demand'). The international standard IEC 61508 governs the functional safety of such electrical/electronic/programmable electronic systems. It assigns each safety function a safety integrity level (SIL 1–4), verified for hardware in two steps: (i) a probabilistic calculation showing that the average probability of failure on demand (PFDavg, for low-demand mode) or the probability of dangerous failure per hour (PFH, for high-demand or continuous mode) meets the SIL target; and (ii) 'architectural constraints' — tabulated minimum redundancy requirements for each subsystem, expressed as hardware fault tolerance (HFT), the number of hardware faults a subsystem can tolerate without losing the safety function. The required HFT is read from tables combining the target SIL, the subsystem type (type A: failure modes well understood with sufficient field data; type B: everything else, including programmable electronics), and the safe failure fraction (SFF), the proportion of all failures that are either safe or dangerous-but-detected by online diagnostics:$\mathrm{SFF}=(\lambda_S+\lambda_{DD})/(\lambda_S+\lambda_{DD}+\lambda_{DU})$, where$\lambda_S$,$\lambda_{DD}$and$\lambda_{DU}$are the rates of safe, dangerous detected, and dangerous undetected failures. A high SFF earns credit, permitting lower redundancy at a given SIL.

Lundteigen and Rausand (2009) asked whether these architectural constraints have the intended effect. Their critique: (a) SFF is a relative ratio that conceals absolute failure rates and diagnostic effectiveness, so equal SFF values can yield very different PFD and spurious-trip outcomes — a spurious trip being an unintended activation of the SIS, whose rate (STR) roughly follows$\lambda_S+\lambda_{DD}$; (b) SFF can be raised by design changes that are poor engineering (for example, letting weak hardware fail 'safely' and spuriously) while good engineering that reduces all failure rates proportionally leaves SFF unchanged, so the metric can reward unsafe and punish safe designs; (c) the classification of failures as 'safe' is not standardized, permitting selective counting and partial-component SFF computation; (d) PFD calculations exclude systematic failures — failures with deterministic causes such as design, implementation, software, and maintenance errors — even though such failures contribute materially to real SIS incidents; and (e) raising HFT, the standard's architectural remedy, multiplies spurious-trip opportunities (creating secondary hazards from process upsets and restarts), adds complexity, and yields diminishing benefit when common-cause failures (CCF, simultaneous failures of redundant channels from a shared cause) or systematic failures dominate. Concurrently, Yoshimura and Sato (2008) analyzed the safety achieved by the SFF using Markov models — a modelling technique representing a system as states with transition rates between them — and found its positive effect on the hazardous-event rate to be almost negligible for at least one system type. The unresolved question is whether and under what conditions the SFF-based HFT tables actually deliver the safety they are intended to guarantee, and what quantitative criteria should replace or constrain them.

Problem Statement

Determine, and put on a validated quantitative footing, whether and under what conditions the architectural constraints of IEC 61508 — the tables that set minimum hardware fault tolerance (HFT) from the safe failure fraction (SFF) — achieve their intended effect of guaranteeing adequate hardware safety integrity of safety instrumented system (SIS) subsystems; and establish corrected architectural criteria that remove the weaknesses identified in that critique. The problem has one common objective — trustworthy, scientifically defensible criteria for selecting SIS hardware architecture and redundancy. Related research needs discussed by Lundteigen and Rausand (2009, 2010) and by follow-on literature inform this objective: (1) quantitative reliability models that explicitly include systematic failures (including software and implementation errors) in probability of failure on demand (PFD) and architecture assessments, and how required HFT changes under such models; (2) stochastic modelling (for example by Markov chains, state-transition reliability models) of the relationship between SFF and PFD, establishing the conditions under which SFF correlates with PFD and those under which it does not; (3) objective, standardized rules for which failure modes (mechanical, electronic, firmware, and diagnostic behaviors) may legitimately be classified as 'safe' in SFF calculations, robust against selective counting and partial-component SFF computation; (4) failure databases capturing safe-failure and diagnostic data at granularity sufficient to support reliable SFF and PFD estimates; (5) methods to evaluate and mitigate the secondary hazards introduced by the increased spurious trip rates associated with higher HFT; and (6) techniques integrating qualitative system and functional analyses with quantitative reliability models so that model incompleteness and interactions are detected and treated. These needs are motivating context for that objective rather than independently mandatory deliverables, and they are interlinked rather than separable: the SFF–PFD validity conditions (2) are meaningful only given defensible failure classification (3) and adequate data (4); conclusions about required HFT interact with systematic failures (1) and with the spurious-trip side effects of redundancy (5); and quantitative models need to be checked against qualitative system analyses (6) to ensure they represent the systems being certified. The source's question encompasses both establishing and validating the conditions under which the SFF-based architectural constraints achieve their intended effect and establishing validated quantitative criteria that replace or constrain SFF-based determination; the 2009 paper itself concludes that architectural constraints may be required to compensate for systematic failures, but should not be determined based on the SFF, which it considers an unnecessary concept. Any proposed criteria must be quantitatively validated rather than merely asserted: 'quantitatively validated' here means the criterion rests on an explicit, reproducible quantitative argument — a derivation, a reliability model, or empirical failure data — and not on assertion alone.

References

1. Lundteigen, M. A., & Rausand, M. (2009). Architectural constraints in IEC 61508: Do they have the intended effect? Reliability Engineering & System Safety, 94(2), 520–525. DOI: 10.1016/j.ress.2008.06.003. https://doi.org/10.1016/j.ress.2008.06.003
2. Yoshimura, I., & Sato, Y. (2008). Safety achieved by the safe failure fraction (SFF) in IEC 61508. IEEE Transactions on Reliability, 57(4), 662–669. DOI: 10.1109/TR.2008.928250. https://doi.org/10.1109/TR.2008.928250
3. Lundteigen, M. A., & Rausand, M. (2008). Spurious activation of safety instrumented systems in the oil and gas industry: Basic concepts and formulas. Reliability Engineering & System Safety, 93(8), 1208–1217. DOI: 10.1016/j.ress.2007.07.004. https://doi.org/10.1016/j.ress.2007.07.004
4. Lundteigen, M. A., Rausand, M., & Utne, I. B. (2009). Integrating RAMS engineering and management with the safety life cycle of IEC 61508. Reliability Engineering & System Safety, 94(12), 1894–1903. DOI: 10.1016/j.ress.2009.06.005. https://doi.org/10.1016/j.ress.2009.06.005
5. Lundteigen, M. A., & Rausand, M. (2010). Reliability of safety instrumented systems: Where to direct future research? Process Safety Progress, 29(4), 372–379. DOI: 10.1002/prs.10390. https://doi.org/10.1002/prs.10390
6. Torres-Echeverría, A. C., Martorell, S., & Thompson, H. A. (2009). Design optimization of a safety-instrumented system based on RAMS+C addressing IEC 61508 requirements and diverse redundancy. Reliability Engineering & System Safety, 94(2), 162–179. DOI: 10.1016/j.ress.2008.02.010. https://doi.org/10.1016/j.ress.2008.02.010
7. Kim, S. K., & Kim, Y. S. (2013). An evaluation approach using a HARA and FMEDA for the hardware SIL. Journal of Loss Prevention in the Process Industries, 26(6), 1212–1220. DOI: 10.1016/j.jlp.2013.05.009. https://doi.org/10.1016/j.jlp.2013.05.009
8. Selvik, J. T., & Abrahamsen, E. B. (2017). How to classify failures when collecting data for safety-instrumented systems in the oil and gas industry. Journal of Risk Research, 20(7), 952–962. DOI: 10.1080/13669877.2015.1121910. https://doi.org/10.1080/13669877.2015.1121910
9. Innal, F., Lundteigen, M. A., Liu, Y., & Barros, A. (2016). PFDavg generalized formulas for SIS subject to partial and full periodic tests based on multi-phase Markov models. Reliability Engineering & System Safety, 150, 160–170. DOI: 10.1016/j.ress.2016.01.022. https://doi.org/10.1016/j.ress.2016.01.022
10. Jigar, A. A., Liu, Y., & Lundteigen, M. A. (2016). Spurious activation analysis of safety-instrumented systems. Reliability Engineering & System Safety, 156, 15–23. DOI: 10.1016/j.ress.2016.06.015. https://doi.org/10.1016/j.ress.2016.06.015
11. Hauge, S., Hokstad, P., Håbrekke, S., & Lundteigen, M. A. (2016). Common cause failures in safety-instrumented systems: Using field experience from the petroleum industry. Reliability Engineering & System Safety, 151, 34–45. DOI: 10.1016/j.ress.2015.09.018. https://doi.org/10.1016/j.ress.2015.09.018
12. Qi, M., Kan, Y., Li, X., Wang, X., Zhao, D., & Moon, I. (2020). Spurious activation and operational integrity evaluation of redundant safety instrumented systems. Reliability Engineering & System Safety, 197, 106785. DOI: 10.1016/j.ress.2019.106785. https://doi.org/10.1016/j.ress.2019.106785
13. Zhang, J., Kim, H., Liu, Y., & Lundteigen, M. A. (2019). Combining system-theoretic process analysis and availability assessment: A subsea case study. Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability, 233(4), 520–536. DOI: 10.1177/1748006X18822224. https://doi.org/10.1177/1748006X18822224
14. Brissaud, F. (2017). Using field feedback to estimate failure rates of safety-related systems. Reliability Engineering & System Safety, 159, 206–213. DOI: 10.1016/j.ress.2016.11.003. https://doi.org/10.1016/j.ress.2016.11.003
15. Jin, J., Xiong, W., & Xu, P. (2018). Research on architectural constraints analysis and an improvement method for safety instrumented systems. 2018 International Conference on Reliability, Maintainability and Safety (ICRMS). DOI: 10.1109/ICRMS.2018.00095. https://doi.org/10.1109/ICRMS.2018.00095
16. Cheraghi, M., & Taghipour, S. (2026). Evaluation of hazardous events and spurious activations for safety instrumented systems in all modes of operation. Reliability Engineering & System Safety, 265, 111620. DOI: 10.1016/j.ress.2025.111620. https://doi.org/10.1016/j.ress.2025.111620