My main benefit from this community, relates to seing how other people reflect and interpret on the requirements of 61508, while having a chance to provide my own interpretation, and getting it critiqued.

@Anth Gunn and @Richard Kelly, please correct me if you see it differently, but in my understanding of 61508, a 1oo2 system would absolutely be a HFT=1 system (in my opinion it is even the textbook example of a HFT=1 solution). Whether it satisfies a SIL claim is a different matter that has two sides. The first side is the architecture constraint, as Richard points out wrt. Route 1H - The requirements are summarized in Table 2 for Type A components (61508-2 p. 26) and Table 3 for Type B components (61508-2 p. 27). For type B components, the architecture of a HFT=1 limits you to a SIL1 claim, if you have SFF of less than 60%. It doesnt mean that your system will reach SIL1, it just mean that if your dangerous detected and safe failures combined, reaches an SFF below 60%, you cannot go higher than SIL1. To reach SIL1, you need to reach the reliability goals, which is the second side of the matter. For your operating mode (low demand or high/continuous demand), you need to satisfy the PFDavg or PFH goals set by Table 2 and Table 3 (61508-1, p33-34), calculated based on architecture, diagnostic coverage, diagnostic inteval, proof test interval, etc. However, regardless of the result of your reliability analysis, the architecture contraint still limits the claimed SIL level. Let me know where im wrong.

Seems really detailed and meticulous - Looking forward to digging in deeper!

I completed my FS engineering certification with Tüv rheinland, and I really liked that course, so am I am looking into the CS certifications as well: https://www.tuv.com/landingpage/en/training-functional-safety-cyber-security/detail-pages/zertifikate/cs-specialist.html

Does the need for a new SIF come from a modification to the system, or how is it motivated? In the machinery sector, modifications requiring additional safety functions, would typically be considered "a significant modification", potentially requiring a new CE-marking, including an assessment of the safety system as a whole.