A safety system that trips the plant for no real reason costs production, stresses equipment and teaches operators to distrust alarms. Measuring how often false shutdowns happen lets engineers balance safety against availability with real numbers.
Every safety instrumented function has two faces, protecting against hazards and avoiding needless shutdowns. This guide shows how false trip frequency is calculated and how voting changes it.
What Is Spurious Trip Rate?
The spurious trip rate, or STR, is the expected frequency at which a safety instrumented function shuts down the process when no real demand exists, usually expressed per hour or per year. It is driven by safe failures of sensors, logic and valves, and it is the availability side of every SIF design.
Its inverse is the mean time to fail spuriously, MTTFS. A function with MTTFS of 50 years is expected to cause one false shutdown every 50 years on average.
Safety and false trips pull in opposite directions. Adding channels that can each trip lowers the probability of failure on demand but raises nuisance shutdowns, as shown in voting architectures.
Why False Trips Matter
The last point is serious, since a bypassed function gives no protection at all. That is why IEC 61511 asks for a maximum acceptable false trip frequency in the specification, separate from the SIL target.
The safety system and control system also differ in this respect, see SIS and BPCS differences. Control faults cause upsets, while safety faults can cause full shutdowns.
4 Smart Voting Choices
Single channel, STR ≈ λS.
Either channel trips, STR ≈ 2λS.
Both must agree, STR ≈ 2λS² × MTTR.
Two of three agree, STR ≈ 6λS² × MTTR.
The 2oo3 scheme tolerates one safe failure without tripping, which is why it is favoured for large continuous units. Its logic is explained in 2oo3 voting logic.
MTTR in these formulas is the time to detect and repair the first failed channel. Fast repair keeps a second failure from lining up with the first.
Worked Examples from silsafe.net
silsafe.net shows a 1oo1 channel with a safe undetected failure rate of 0.000002 per hour, which gives an MTTFS of about 57.1 years. It also notes that 10 to 100 years per channel is typical acceptable guidance.
For 1oo2 sensors with diagnostics, the same source calculates a false trip rate of 0.0000028 per hour. That equals about one spurious trip every 41 years.
False Trip Formulas and MTTFS
1oo1: STR ≈ λS 1oo2: STR ≈ 2λS
2oo2: STR ≈ 2λS² × MTTR 2oo3: STR ≈ 6λS² × MTTR
Example: λS = 0.000002 per hour, MTTR = 8 h
1oo1: 1 ÷ (0.000002 × 8760) = 57.1 years
1oo2: 28.5 years
2oo2: STR = 0.000000000064 per hour, about 1783676 years
2oo3: STR = 0.000000000192 per hour, about 594559 years
These simple forms ignore common cause safe failures, which in practice set a floor on the redundant results. Add a beta factor term before trusting very large MTTFS numbers.
MTTFS Calculator
Treat the redundant figures as upper limits, since common cause effects usually dominate them. The single channel figures are most useful for comparing device choices.
Ways to Lower Nuisance Shutdowns
Final elements are a frequent source of false trips, see SIS final element reliability. Diagnostics also raise the safe failure fraction.
Proof testing must be planned so tests themselves do not trip the plant, as discussed in proof test interval and coverage.
- Quantifies availability alongside safety.
- Justifies voting and device choices.
- Reduces pressure to bypass functions.
- Supports production cost decisions.
- Safe failure data is often less reliable.
- Common cause is easy to overlook.
- Process upsets are not included.
- Simple formulas assume fast repair.
Both the false trip figure and PFDavg should be checked in SIL verification. The broader picture of hazards and systems is compared in process safety vs functional safety.
Deriving Trip Formulae PDF
Unit MTTFS Video
Spurious Trip Rate FAQ
Related Articles
- Voting Architectures in Safety Systems
- What Is 2oo3 Voting Logic
- SIS Final Element Reliability
- Safe Failure Fraction
- SIL Verification
External References
- Deriving STR Formulae, Dr Fan Ye, IChemE
- STR Explained, silsafe.net
- Safety Instrumented System, Wikipedia
What We Learn Today
- Spurious trip rate measures false shutdowns, and MTTFS is its inverse.
- 1oo2 doubles false trips while 2oo2 and 2oo3 reduce them.
- Diagnostics, device choice and maintenance keep nuisance trips low.