Calculates PFDavg for each subsystem of a safety instrumented function — sensor, logic solver, final element — and the overall achievable SIL, using the standard IEC 61508-6 Annex B simplified low-demand equations. This checks the probability side only; a complete IEC 61511 SIL verification also confirms architectural constraints (SFF/HFT) and systematic capability, which this tool does not evaluate.
Standard method — stated scope limits apply
Sensor
Logic Solver
Final Element
λᴅᵁ (dangerous undetected failure rate) is normally taken straight from the component's SIL certificate, in FIT (failures per 10⁹ hours). β only matters for a redundant (1oo2/2oo3) architecture — it's the fraction of failures that hit every channel at once (e.g. a shared power supply, a common calibration error) and so aren't protected by the redundancy at all.
Enter subsystem data and verify.
About This Calculation
Verifying that a Safety Instrumented Function (SIF) actually achieves its required Safety Integrity Level means calculating PFDavg (average Probability of Failure on Demand) from the dangerous-undetected failure rates of every subsystem — sensor, logic solver, final element — combined according to their architecture (simplex, redundant voting) and proof-test interval, per the simplified equations in IEC 61508-6 Annex B. This is the probability half of SIL verification specifically; a complete verification per IEC 61511 also requires confirming architectural constraints (hardware fault tolerance limits) and systematic capability, which depend on the certified component data sheets, not just the failure-rate math this calculator performs.
Frequently Asked Questions
What does PFDavg actually mean in plain terms?
It’s the average probability that a safety function will FAIL to act when a genuine demand occurs, averaged over the time between proof tests — a PFDavg of 0.001 means roughly a 1-in-1000 chance the safety function won’t work correctly on any given demand, which corresponds to a SIL 2 rating in low-demand mode.
Why does proof-test interval matter so much to PFDavg?
A dangerous-undetected fault sits silently until either a real demand exposes it (too late) or a proof test finds it first — PFDavg grows roughly with the SQUARE of proof-test interval for redundant architectures (and linearly for simplex), so halving the interval between proof tests can dramatically improve the achieved SIL for the same hardware.
Does adding redundancy (1oo2, 2oo3) always improve PFDavg?
It substantially reduces the INDEPENDENT-failure contribution, but a common-cause failure fraction (beta) that affects multiple channels simultaneously bypasses the redundancy benefit entirely for that fraction of failures — which is why beta, representing shared failure modes like a common power supply or calibration error, is a critical, separate input, not an afterthought.
Is passing the PFDavg calculation enough to claim a SIL rating for the whole SIF?
No — IEC 61511 also requires the architecture to meet minimum hardware fault tolerance requirements for the claimed SIL (which can cap the achievable SIL regardless of how good the PFDavg number is) and requires the component to have adequate systematic capability, both of which come from the manufacturer’s SIL certificate, not from this failure-rate calculation alone.