Calculation engine · Engine 2026.10.1
Validation of the calculation engine
Each case below is computed by the same engine that runs in the workspace and is stamped on issued reports, and compared with the closed-form expressions of IEC 61508-6:2010 Annex B. The tables are generated when the site is built, so they always show what the published engine returns.
- Engine
- 2026.10.1
- Benchmark cases
- 36
- Within tolerance
- 36 of 36
- Standards
- IEC 61508-2:2010, IEC 61508-6:2010, IEC 61511-1:2016
Common parameters
- Proof-test interval T1 = 8,760 h (1 year); mission time equal to T1 unless a row states otherwise.
- MTTR = MRT = 8 h; proof-test coverage 100 %; βD = β; identical channels — the conditions of the Annex B simplified equations.
- FIT = 10−9 failures per hour. PFDavg is dimensionless; PFH is per hour.
- Ratio = SILProof ÷ IEC reference. A build fails if any case falls outside its tolerance, so this page cannot be published with a failing case.
Low-demand PFDavg
Reference: IEC 61508-6:2010 B.3.2.2 (1oo1, 1oo2, 2oo3, 1oo3)
| Engine | Voting | λDU (FIT) | λDD (FIT) | β | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|---|---|
| Algebraic | 1oo1 | 1000 | 1000 | 0 % | 4.3960×10−3 | 4.3960×10−3 | 1.0000 | ±0.5 % |
| Markov | 1oo1 | 1000 | 1000 | 0 % | 4.3960×10−3 | 4.3831×10−3 | 0.9971 | ±3 % |
| Algebraic | 1oo2 | 1000 | 1000 | 10 % | 4.6051×10−4 | 4.6042×10−4 | 0.9998 | ±0.5 % |
| Markov | 1oo2 | 1000 | 1000 | 10 % | 4.6051×10−4 | 4.5785×10−4 | 0.9942 | ±3 % |
| Algebraic | 1oo2 | 500 | 2000 | 2 % | 5.0483×10−5 | 5.0426×10−5 | 0.9989 | ±0.5 % |
| Markov | 1oo2 | 500 | 2000 | 2 % | 5.0483×10−5 | 5.0276×10−5 | 0.9959 | ±3 % |
| Algebraic | 2oo3 | 1000 | 1000 | 5 % | 2.8969×10−4 | 2.8913×10−4 | 0.9981 | ±0.5 % |
| Markov | 2oo3 | 1000 | 1000 | 5 % | 2.8969×10−4 | 2.8763×10−4 | 0.9929 | ±3 % |
| Algebraic | 1oo3 | 2000 | 1000 | 2 % | 1.7696×10−4 | 1.7695×10−4 | 0.9999 | ±0.5 % |
| Markov | 1oo3 | 2000 | 1000 | 2 % | 1.7696×10−4 | 1.7390×10−4 | 0.9827 | ±3 % |
High-demand / continuous PFH
Reference: IEC 61508-6:2010 B.3.3.2 (Edition 2: last failure undetected)
| Voting | λDU (FIT) | λDD (FIT) | β | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|---|
| 1oo1 | 1000 | 0 | 0 % | 1.0000×10−6 | 1.0000×10−6 | 1.0000 | ±0.5 % |
| 1oo2 | 2000 | 0 | 2 % | 7.3714×10−8 | 7.3714×10−8 | 1.0000 | ±0.5 % |
| 1oo2 | 1000 | 1000 | 10 % | 2.0712×10−7 | 2.0712×10−7 | 1.0000 | ±0.5 % |
| 2oo3 | 2000 | 0 | 2 % | 1.4114×10−7 | 1.4114×10−7 | 1.0000 | ±0.5 % |
| 2oo3 | 1000 | 2000 | 2 % | 8.5378×10−8 | 8.5378×10−8 | 1.0000 | ±0.5 % |
| 1oo3 | 3000 | 1000 | 5 % | 2.0179×10−7 | 2.0179×10−7 | 1.0000 | ±0.5 % |
1oo2D diagnostic voting
Reference: IEC 61508-6:2010 B.3.2.2.5 and B.3.3.2.5. PFDavg: SILProof closed form (u² + 2u·d) against the IEC equivalent-time expression, tolerance ±15 %; PFH: the IEC expression
| Measure | λDU (FIT) | λDD (FIT) | λSD (FIT) | β | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|---|---|
| PFDavg | 25 | 120 | 0 | 5 % | 5.5356×10−6 | 5.5477×10−6 | 1.0022 | ±15 % |
| PFH (/h) | 25 | 120 | 0 | 5 % | 7.2550×10−9 | 7.2550×10−9 | 1.0000 | Same closed form |
| PFDavg | 500 | 2000 | 300 | 2 % | 4.5327×10−5 | 5.0436×10−5 | 1.1127 | ±15 % |
| PFH (/h) | 500 | 2000 | 300 | 2 % | 5.2129×10−8 | 5.2129×10−8 | 1.0000 | Same closed form |
| PFDavg | 1000 | 5000 | 1000 | 10 % | 4.4590×10−4 | 4.6391×10−4 | 1.0404 | ±15 % |
| PFH (/h) | 1000 | 5000 | 1000 | 10 % | 6.0730×10−7 | 6.0730×10−7 | 1.0000 | Same closed form |
Markov engine: short proof-test intervals and imperfect proof tests
Reference: 1oo1 closed form λDU[PTC(T1/2 + MRT) + (1 − PTC)·MT/2], λDU = 1000 FIT, PTC 90 %
| Proof-test interval | Mission time | Test cycles | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|
| 8760 h | 20 y | 20 | 1.2709×10−2 | 1.2580×10−2 | 0.9899 | ±3 % |
| 720 h | 25 y | 304 | 1.1281×10−2 | 1.1194×10−2 | 0.9923 | ±3 % |
| 168 h | 20 y | 1,043 | 8.8428×10−3 | 8.7904×10−3 | 0.9941 | ±3 % |
| 24 h | 10 y | 3,650 | 4.3980×10−3 | 4.3851×10−3 | 0.9971 | ±3 % |
Optional inputs: MRT, separate β_D and partial stroke test
Reference: IEC 61508-6:2010 B.3.2.2 / B.3.3.2 with MRT ≠ MTTR and β_D ≠ β; PST as a partial proof test
| Case | Voting | Inputs | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|
| MRT 72 h, MTTR 8 h | 1oo1 | λDU 1000, λDD 2000 FIT | 4.4680×10−3 | 4.4680×10−3 | 1.0000 | Same closed form |
| β 10 %, β_D 2 %, PFDavg | 1oo2 | λDU 1000, λDD 2000 FIT | 4.6269×10−4 | 4.6001×10−4 | 0.9942 | ±2 % |
| β 10 %, β_D 2 %, PFH (/h) | 1oo2 | λDU 1000, λDD 2000 FIT | 1.4756×10−7 | 1.4714×10−7 | 0.9972 | ±2 % |
| PST 60 % monthly, PTC 90 %, 20 y | 1oo1 | λDU 1000, λDD 2000 FIT | 1.0316×10−2 | 1.0316×10−2 | 1.0000 | Same closed form |
Route 1H: combining redundant legs
Reference: IEC 61508-2:2010 7.4.4.2.3 and 7.4.4.2.4; Tables 2 and 3
| Voting | Leg architectural SIL | Rule | IEC reference | SILProof | Ratio | Tolerance |
|---|---|---|---|---|---|---|
| 1oo2 | SIL 1, SIL 3 | Highest leg + 1 | SIL 4 | SIL 4 | — | Exact match |
| 2oo3 | SIL 3, SIL 1, SIL 1 | Second-highest leg + 1 | SIL 2 | SIL 2 | — | Exact match |
| 2oo2 | SIL 2, SIL 3 | Series: lowest leg | SIL 2 | SIL 2 | — | Exact match |
| 1oo2 | SIL 2, SIL 2 | Type A, SFF 75 %, HFT 1 (Table 2) | SIL 3 | SIL 3 | — | Exact match |
| 2oo3 | SIL 2, SIL 2, SIL 2 | Type B, SFF 95 %, HFT 1 (Table 3) | SIL 3 | SIL 3 | — | Exact match |
| 1oo3 | SIL 1, SIL 1, SIL 1 | Type B, SFF 75 %, HFT 2 (Table 3) | SIL 3 | SIL 3 | — | Exact match |
Method notes
- Algebraic engine — closed-form averaging, not the Annex B equivalent times. Each channel’s dangerous unavailability is piecewise linear over the mission: q(t) = λDU·[PTC·(t mod T1) + (1 − PTC)·t] + λDU·PTC·MRT + λDD·MTTR (a partial stroke test adds its own sawtooth). The M-of-N vote is taken at every instant on the independent part (1 − β)·q(t) and averaged over the mission exactly; for identical channels 1oo2 = E[q²] and 2oo3 = 3E[q²] − 2E[q³]. Common cause adds β times the mean channel unavailability: PFDavg = qβ + (1 − qβ)·PFDindependent. Final-element components in a leg are combined in series and legs and groups are voted the same way. Tolerance ±0.5 %: the Annex B equations are first-order approximations of the same quantity.
- Markov engine — continuous-time Markov chain with a periodic proof-test map, integrated over the mission time. Tolerance ±3 %: the chain averages the state probabilities exactly, where the closed forms approximate them.
- Short intervals and imperfect proof tests — the reference is the 1oo1 closed form with proof-test coverage: undetected failures not revealed by the proof test stay latent for the whole mission time.
- 1oo2D — a fault detected in one channel takes it out and the function continues 1oo1 on the other; faults detected in both channels trip it. PFDavg is averaged in closed form from u(t)² + 2·u(t)·d, where u(t) is the independent DU unavailability and d = ((1 − βD)·λDD + λSD)·MTTR, plus β·mean DU and βD·λDD·MTTR for common cause. The IEC B.3.2.2.5 expression weights the DU pair by equivalent times that include the detected rates, so it can understate it; the closed form stays at or above it here (tolerance ±15 %). PFH uses the B.3.3.2.5 expression.
- Route 1H — redundant legs are combined by the rule in IEC 61508-2 7.4.4.2.3/7.4.4.2.4; identical legs must give the same SIL as a Table 2/3 lookup at HFT = N − M.
- Engine version — the version changes whenever a calculation result can change. Issued reports and the workspace result panel carry the version that produced them.
Limits
- These cases check the engine against the standard's own expressions. They are not a third-party certification of SILProof.
- Not covered by a published reference: non-identical final-element trains, diverse sensor channels with mixed proof-test intervals, and the spurious-trip estimate. They are covered by internal consistency checks (for example, diverse channels with identical data must equal the identical-channel result).
- Route 2H and IEC 61511 Table 6 are rule checks on recorded evidence, not numerical results, and are not tabulated here.
- A correct engine does not make a correct claim: failure rates, β, proof-test coverage and intervals are your inputs. Results need competent, independent review against IEC 61508, IEC 61511 and your project procedures.
Found a result you believe is wrong? Report a calculation question with the inputs, and it will be checked against the standard.