About this calculator
Use the low-demand modes to estimate PFDavg from failure rates and proof testing. Use the high-demand mode to estimate PFH with explicit demand interval (DI), diagnostic test interval (DTI) and partial diagnostic credit.
For high-demand screening, the PFH calculator also works as a diagnostic test interval calculator: change DI or DTI to see how partial diagnostic credit changes the residual λDD contribution and PFH SIL band.
Worked example
A transmitter with λDU = 100 FIT (100 × 10⁻⁹ per hour) is proof tested once a year (T = 8,760 h): PFDavg ≈ 100 × 10⁻⁹ × 8,760 / 2 = 4.38e-4, an RRF of about 2,283. That sits in the SIL 3 band for this one channel — the SIF as a whole still has to be verified.
For the PFH example, DI = 1 s, DTI = 100 ms, λDU = 500 FIT and λDD = 8,500 FIT give 95.16% partial diagnostic credit and PFH ≈ 9.11e−7 per hour, in the SIL 2 quantitative band. The method follows exida’s published nonredundant high-demand treatment.
When to go further
A claim for a Safety Instrumented Function needs every subsystem — sensors, logic solver and final elements — with their voting and common cause, plus architectural constraints and systematic capability. SIL Verification does that and shows which gate limits the claimed SIL. For architecture alone, use the SFF / HFT calculator; for the background, read PFDavg: meaning, model and assumptions.
PFH diagnostic-credit basis: exida, Safety Instrumented Function Verification, equations 2 and 3.
Questions
The average probability that a safety function fails to act when a demand occurs, in low-demand mode. Its inverse is the risk reduction factor (RRF), and its band gives the quantitative SIL: below 10⁻¹ SIL 1, below 10⁻² SIL 2, below 10⁻³ SIL 3 and below 10⁻⁴ SIL 4.
It treats one device or channel in 1oo1. A real SIF has sensors, a logic solver and final elements, often redundant, with common cause, and its claimed SIL also depends on architectural constraints and systematic capability. SIL verification covers all of that.
Proof-test coverage below 100% leaves a share of dangerous undetected failures until the end of the mission time; restoration time adds the time a revealed failure takes to repair; λDD adds the time detected failures spend being repaired. Each makes the result more realistic and usually higher.
For a nonredundant high-demand function, the calculator uses no diagnostic credit below DI/DTI = 2, partial credit from 2× to below 100×, and full credit at 100× or more. It then calculates PFH as λDU plus the uncredited share of λDD. Credit is valid only when a detected fault initiates the safe state within the process safety time.
Failure rates use FIT (failures per 10⁹ hours). PFDavg uses years for proof-test and mission intervals. PFH demand and diagnostic intervals can use milliseconds, seconds, minutes, hours or days.