Calculators
Calculate the PFD of a safety function
In low demand mode a safety function is measured by its average probability of a dangerous failure on demand, the PFD. It always consists of three links, namely sensor, logic solver and final element, and its PFD is the sum of the three. Look at only one of them and the answer comes out too favourable.
Result
- PFD of the safety functionSum of sensor, logic solver and final element
- —
- SIL range reached
- —
- Sensor contribution
- —
- Logic solver contribution
- —
- Final element contribution
- —
- Largest contribution
- —
- Share of the largest contribution
- —%
Please fill all fields with valid numbers.
A guide, not a design to standard. We give no warranty for the correctness of the results. The applicable standards and case-by-case verification govern.
The grey values are an example. Simply enter your own.
Matching services
Calculating is the easy part.
A formula gives you a number. Designing a plant also demands installation method, grouping, discrimination, the standards in force and a look at the installed base. That is what we take on.
Method and questions
PFD and SIL
Probability of failure on demand to EN 61508 and VDI/VDE 2180, across sensor, logic solver and final element.
Discuss a projectWorked example
The default case the calculator starts with, worked through once. Change the values above and it recalculates immediately.
Inputs
- Proof test interval T₁ in years
- 1
- Common cause failures β
- 2 %
- Sensorarchitecture
- 1oo2 ·two channels, one is enough
- Sensorfailure rate λ_du
- 300 FIT
- Logic solverarchitecture
- 1oo2 ·two channels, one is enough
- Logic solverfailure rate λ_du
- 100 FIT
- Final elementarchitecture
- 1oo1 ·single channel
- Final elementfailure rate λ_du
- 800 FIT
Result
- PFD of the safety function
- 3.54 · 10⁻³
- SIL range reached
- SIL 2 (PFD from 10⁻³ to below 10⁻²), provided the architectural constraints are met.
- Sensor contribution
- 2.85 · 10⁻⁵
- Logic solver contribution
- 9.01 · 10⁻⁶
- Final element contribution
- 3.50 · 10⁻³
- Largest contribution
- The final element governs the result. That is the usual case, because this is where the mechanics are and where failure rates are highest.
- Share of the largest contribution
- 98.9 %
Formula and standards
Formula
- PFD = PFD_sensor + PFD_logic + PFD_final element
- per subsystem, 1oo1: PFD = λ_du · T₁ / 2
- 2oo2: PFD = λ_du · T₁
- 1oo2: PFD = ((1−β) · λ_du · T₁)² / 3 + β · λ_du · T₁ / 2
- 2oo3: PFD = ((1−β) · λ_du · T₁)² + β · λ_du · T₁ / 2
- 1oo3: PFD = ((1−β) · λ_du · T₁)³ / 4 + β · λ_du · T₁ / 2
Assumptions and standards
- Simplified equations to IEC 61508-6 Annex B, as also used by VDI/VDE 2180 Part 3. They hold for small values of λ_du · T₁ and become inaccurate as the product approaches 1.
- Proof test interval and β apply to all three subsystems here. In practice they can differ, since a valve is often tested differently from a transmitter. A shared assumption is common for a first estimate, but not for a verification.
- The calculation assumes no diagnostics and no repair time. λ_du covers dangerous undetected failures only. The result is therefore on the safe side.
- The common cause share behaves like a single-channel system and cannot be reduced by adding channels. Above a certain β it governs a subsystem on its own.
- THIS CALCULATOR DOES NOT DETERMINE A SIL. The achievable level also depends on the architectural constraints of IEC 61508-2, namely hardware fault tolerance (HFT) and safe failure fraction (SFF), and on systematic capability. The PFD is a necessary, not a sufficient condition.
Why is looking at the sensor not enough?
Because the safety function is a chain. It detects (sensor), decides (logic solver) and acts (final element). If one link fails, the function does not work, however good the others are. That is why the three PFD values are added, and why in practice the weakest link almost always governs the result.
Why is the final element usually the largest contribution?
Because that is where the mechanics are. A safety valve with its solenoid has failure rates an order of magnitude above a transmitter or a safety controller, and it is rarely made redundant. A second sensor then improves nothing, and the calculation shows this immediately in the contribution share.
What do 1oo1, 1oo2 and 2oo3 mean?
MooN means M out of N channels have to perform the safety function for it to act. 1oo2 has two channels and one is enough. That raises safety but also the number of spurious trips. 2oo2 requires both channels and doubles the probability of failure compared with 1oo1. It protects against spurious trips, not against failure. 2oo3 is the usual compromise.
Where do I get λ_du?
From the device safety manual, often as part of the SIL certificate. It usually gives a breakdown into λ_sd, λ_su, λ_dd and λ_du. Only λ_du counts here, meaning the dangerous failures no diagnostic detects.
Does this replace a SIL verification?
No. The calculator works with simplified assumptions, one shared proof test interval and no diagnostics. A verification treats each subsystem with its own boundary conditions, checks the architectural constraints of IEC 61508-2 and systematic capability, and is documented. That is work we support.
Contact
Planning a system right now?
We take on the electrical design, from sizing and EPLAN schematics to the finished documentation. A call or three lines are enough.
Direct
- Phone+49 (0) 5247 4070-66
- Emailinfo@fisekon.com
- AvailabilityMon to Fri, 8 am to 5 pm CET
Or write to us
We usually reply within one working day.