What the calculator is for
A proof test finds the dangerous undetected failures that the diagnostics cannot, and returns the device to as-good-as-new. The longer the interval, the longer a hidden failure can wait for a demand, so PFDavg grows with the interval. This calculator turns a target PFDavg into the longest interval that meets it.
- Simple form: PFDavg ≈ λDU × PTC × T / 2, so T = 2 × PFDavg / (λDU × PTC).
- With a mission time MT: PFDavg ≈ λDU × [PTC × T / 2 + (1 − PTC) × MT / 2], adding the failures the proof test cannot find.
Worked example
A transmitter has λDU = 200 FIT, the proof test covers 95 % of its dangerous undetected failures, and its share of the SIF budget is PFDavg = 2 × 10⁻³. The simple form gives T = 2 × 2 × 10⁻³ / (2 × 10⁻⁷ × 0.95) = 2.4 years.
That ignores the 5 % never found by the test. Over a 15-year mission they add 2 × 10⁻⁷ × 0.05 × 15 × 8,760 / 2 = 6.57 × 10⁻⁴ to PFDavg, and the interval drops to 1.61 years. Below 100 % coverage, always check the untested share.
Setting the interval in practice
The calculated interval is an upper limit, not a recommendation. Plants usually round down to a shutdown or maintenance cycle, check that the test can really be done safely at that frequency, and keep the interval within the device's useful life. When the result is shorter than practical, look at the other levers: a more complete proof test, partial-stroke testing for valves, a device with a lower λDU, or redundancy.
Quick reference
| λDU (FIT) | 10⁻¹ | 10⁻² | 10⁻³ |
|---|---|---|---|
| 50 | 457 | 45.7 | 4.57 |
| 100 | 228 | 22.8 | 2.28 |
| 200 | 114 | 11.4 | 1.14 |
| 500 | 45.7 | 4.57 | 0.457 |
| 1000 | 22.8 | 2.28 | 0.228 |
Common mistakes
- Assuming a perfect proof test. Few tests reach every failure mode; a realistic PTC is often 70 % to 95 %.
- Forgetting the untested share. With PTC below 100 %, the failures the test misses build up over the whole mission and can use most of the PFDavg budget on their own.
- Applying it to the whole SIF. This is a 1oo1 estimate for one device; the SIF combines sensors, logic and final elements, often redundant.
- Intervals beyond the device's useful life. A constant failure rate only holds within the useful life stated by the manufacturer.
Basis
The simplified 1oo1 low-demand expressions of IEC 61508-6 Annex B with proof test coverage, as used for screening in IEC 61511 practice. Repair time and detected failures are left out; use SIL verification for the complete function.