What is PFH? - Understanding how it differs from PFDavg -

When researching safety devices for factories, you may come across the terms “PFH” and “PFDavg.”

This article explains PFH and answers the following questions:

• What does the number represent?
• When is it used?
• How is it different from PFDavg?

To start with the conclusion: What is PFH?

PFH (Average frequency of a dangerous failure of the safety function [h-1]^※ is

a numerical value which represents “how often a dangerous failure occurs.”

More precisely speaking, it means the “average frequency of dangerous failures per hour.”

Now let’s take a look at the term “dangerous failure.”

※ This is a definition from IEC 61508.
IEC 62061 defines it as “Probability of a dangerous Failure per hour (PFHD),”
and ISO 13849 defines it as “Average probability of dangerous failure per hour (PFHD).”
In this article, we will use the abbreviation PFH based on IEC 61508.

What is a “dangerous failure”?

Safety devices are used to “prevent danger.”

For example:

• Stops the machine when a person approaches
• Stops the machine when the door opens
• Stops the machine when a fault is detected

However, as safety devices are mechanical objects, they can sometimes fail.

The problem is the case where “the safety functions stop working as a result of the failure.”

This is called a “dangerous failure.”
For example:

• The machine does not stop even though a person approaches.
• The machine does not stop even though the door is opened.
• Faults cannot be detected.

In other words, PFH is a number representing “how often such dangerous failures may happen.”

PFH is a concept of “per hour”

One of the main characteristics of PFH is that it is based on “time.”

Normally, “1/h” is used as its unit.

It means “per hour.”

Important: This is a different concept from PFDavg

This is an important point.

Although PFH and PFDavg may seem similar, they actually “look at different things.”

PFDavg is about “Can it work when needed?”

PFDavg is a concept used for the “safety function which barely works in normal situations.”

The examples are as follows:

• Emergency stop
• Emergency shutdown
• Protection functions that work only in abnormal situations

These safety functions usually do not work under normal circumstances.
In other words, they are the type which “works only when needed.”

Therefore, PFDavg focuses on “whether the safety function works reliably when it is required.”

PFH is used for “safety functions which constantly operate”

On the other hand, PFH is used for the “safety functions which frequently work or constantly monitor.”

The examples are as follows:

• Safety circuit which is constantly monitoring
• Safety function which frequently switches between ON and OFF
• System which is constantly monitoring during a continuous operation

For these safety functions, it is not sufficient to “work only at the required moment.”
It is necessary for them to keep on working during operation.

Therefore, what matters is “whether or not dangerous failures occur during the constant monitoring and controlling.”

In other words, “how often dangerous failures occur” needs consideration based on the passage of time.

That is why PFH evaluates “how frequently dangerous failures occur per hour.”

Key factor for PFH is “length of operation time”

PFH indicates, for example, “how often dangerous failures occur every one hour.”

This means, the longer the operation time, the higher the “probability of dangerous failure during that time.”

Therefore, PFH focuses on “how unlikely dangerous failures are to occur even in a long-time operation,” which will be achieved, for example, by the following measures:

• Inherently durable design
• Configurations resistant to dangerous failures
• Mechanisms to detect faults immediately

The typical examples to improve PFH of safety switches are as follows:

• Redundancy
• Self-diagnostics
• Mutual monitoring
• Fail-safe design

But isn’t “time” a factor in PFDavg as well?

At this point, you may think

“But doesn’t PFDavg value also get higher as time passes?”

This is a very natural question, and in fact, time is also related to PFDavg.

For PFDavg, what matters is “how long failures are left untreated”

Suppose, for example, there is a safety function which normally stands by.

Even if the safety function fails, there is a possibility that “the failure is not noticed until it is needed.”

This will lead to a hazardous situation where “it does not work in case of an emergency.”

In other words, PFDavg draws our attention to “how long the failure can be left unaddressed.”

The reason inspection cycles matter

“Probability of failure at the required moment” will become higher in the following cases:

• Inspection is done only once a year
• Failure has been left unaddressed for 6 months straight

Conversely,

• If test is done every day
• If failures can be detected immediately

then the risk will be reduced.

In other words, PFDavg puts its importance on “length of time for failures to hide from detection.”

Therefore, it is easier to reduce PFDavg if a safety function has a “mechanism for early detection of failures” by the following measures:

• Self-diagnostic function
• Periodical testing
• Fault-detecting function

This is because they can reduce the “risks where safety functions do not work in case of an emergency.”

The difference in “time” between PFH and PFDavg

To summarize, PFH and PFDavg are both related to time.

However, there is a difference in “how they treat time.”

PFH

It calculates “how often dangerous failures occur during operation.”

In other words, the “frequency of failure” is considered with the passage of time in mind.

Example: PFH = 1 x 10^-7/h

This calculation illustrates “on average, there are 10^-7 dangerous failures per one-hour operation.”

In other words, it can be regarded as “on average, there is one dangerous failure per 10 million hours of operation.”

As the operation time increases, the “probability of failure during that time” also increases, therefore, PFH focuses on “how unlikely dangerous failures are to occur in spite of a long-time operation.”

PFDavg

It calculates the possibility where “failures may have already occurred when safety function is requested.”

This means that the key is “how long failures hide from detection.”

Example: PFDavg = 1 x 10^-3

This calculation illustrates “on average, there can be one dangerous failure per 1,000 requests of safety function.”

This is why “early detection of faults” is important for PFDavg.

Relationship with SIL

PFH and PFDavg are also related to SIL (Safety Integrity Level).

SIL gives numerical evaluation to the following points:

• How unlikely it is for dangerous failures to occur
• How high the safety is

For the evaluation, as one of the “important indicators of reliability of safety function,”
PFH is used for the safety functions that:

• frequently work
• constantly monitor
  (Safety Function #1: Constantly in running mode)

And PFDavg is used for the safety functions that:

• normally stand by
• work only when needed
  (Safety Function #2: Normally in standby mode)

The smaller PFH value, the better

The smaller PFH value means the greater safety.

This is because it means dangerous failures are less likely to occur.

The reason PFH is on the catalog of safety switches

Sometimes you may come across “PFH” in the catalog of safety switches.

The value is there to represent “how much the product can contribute to safety.”

In the safety standards below, in particular, it is important “how unlikely safety functions are to suffer dangerous failures.”

• ISO 13849-1
• IEC 62061
• IEC 61508

The evaluation uses indicators such as:

• PFH
• PFDavg

Particularly, PFH is sometimes used for safety components such as safety switches which:

• conduct constant monitoring
• frequently work

That is why PFH is listed as one of the product specifications.

Summary

PFH is a numerical value representing “how often dangerous failures occur per hour.”

The major difference from PFDavg can be described as follows:

• PFH → “how frequently dangerous failures occur during operation”
• PFDavg → “whether safety function can work when needed”

This means that the applicable evaluation criteria and indicators depend on “how safety function is used.”

At first, you may find it a little difficult, but if you focus on whether the safety function is:

• “constantly monitoring type”
• “standby type,”

then the difference between PFH and PFDavg will become fairly understandable.

Related Products