# Calculation of the Dangerous Failure Rate of the Safety Function
## 1 Introduction
It is a case of one of the basic safety features of the ESRCS. SI is indicated by the safety integrity level (SIL). SIL does not relate to ESRCS, but to SF, which is realized by ESRCS. ESRCS can realize (and usually does) multiple SFs, and each SF may or may not be realized with a different SIL. According to the paper [1], safety integrity (SI) consists of three parts--systematic safety integrity (SystF-SI), software safety integrity (SW-SI), and hardware safety integrity (HW-SI). In general, it is valid that ESRCS hardware can dispose mainly of random failures, but also systematic failures and software have only systematic failures. For this reason, only systematic failure safety integrity (SystF-SI) and random failure safety integrity (RandF-SI) can be taken into account. Because systematic faults have different effects in the different life cycle phases and safety measures are dependent on the specific application, a quantitative SI analysis of the SF is not possible. SystF-SI forms a non-quantifiable part of SI, and compliance with the requirements for SystF-SI is demonstrated by applying appropriate (prescribed for each SIL) techniques and measures for the avoidance of ESRCS systematic faults, which realizes the given SF. RandF-SI forms a quantifiable part of SI and is subject to quantitative analysis. The occurrence of random failures over time can be described by reliability parameters (for example, random failure rate). The need to use quantitative methods (probabilistic approach) to evaluate RandF-SI indirectly follows from the SIL-table in the paper [1], which defines the average frequency of dangerous failure of the SF in high-demand mode of operation (PFH) for SIL as follows:  
* for SIL 1 is valid 10-6 h-1 \(\leq\) PFH \(<\) 10-5 h-1;
* for SIL 2 is valid 10-7 h-1 \(\leq\) PFH \(<\) 10-6 h-1;
* for SIL 3 is valid 10-8 h-1 \(\leq\) PFH \(<\) 10-7 h-1;
* for SIL 4 is valid 10-9 h-1 \(\leq\) PFH \(<\) 10-8 h-1. SI is affected by various factors, as shown in Figure 1. These factors should also include quality management and safety management, which cover all phases of the ESRCS life cycle. It defines phases for these tasks that need to be performed to achieve the specifiedsafety objectives. Other factors (reliability, diagnostics, architecture recovery, and technical independence) belong to the technical and operational parameters of the SRCS. An appropriate quantitative analysis method should be used for RandF-SI analysis. The most suitable method allows respecting the influence of as many factors as possible that affect RandF-SI. The most used methods include fault tree analysis (FTA) [4] and reliability block diagram (RBD) [5; 6]. In the paper [6], the RBD method is used to determine the simplified algebraic expression for the probability of failure on demand (PFD) for a system with architecture 2 out of 4. Simplification relates to respecting the impact of several factors on PFD. A similar problem, but on a more general level, is solved by the paper [7]. The great advantage of these methods is that they are supported by many software tools (PTC Windchill, Item Software, BQR Reliability Engineering Ltd.,... ), which provide not only tools for analysis but also for creating the presentation of the achieved results. The disadvantage of these static methods is that they do not allow a comprehensive assessment of the impact of several factors (impact of diagnostic coverage, recovery intensity, the impact of SF architecture change... ) on the monitored parameter of ESRCS, resp. SF. FTA and RBD methods are static methods and were originally developed to evaluate the reliability and availability parameters of the system. These methods assume that the system has two states and is in one of these two states at any given time. What states are considered depends on the analysed property (functional--non-functional, up--down, safe--dangerous).