Hardware safety metrics calculator
Compute the single point fault metric, latent fault metric and probabilistic hardware failure metric from an FMEDA-style list, against the targets for each ASIL.
Safety and securityFree to useHow it worksSourcesWhere it helps
Fills the inputs below with typical figures. Replace any of them with your own.
- Against the ASIL D targets
- Meets all three
- 143 FIT safety-related in total
- Single-point fault metric
- 99.09%
- Target at least 99%: meets the target
- Latent fault metric
- 99.21%
- Target at least 90%: meets the target
- PMHF, simplified
- 2.415 FIT
- Target below 10 FIT: meets the target
- Single-point and residual
- 1.298 FIT
- 0.2 FIT single-point, 1.098 FIT residual
- Latent
- 1.117 FIT
- Latent multiple-point faults left uncovered
Single-point, residual and latent rates added for each element.
- CPU core pair0.796 FIT33%
- SRAM with ECC0.597 FIT25%
- Flash with ECC0.398 FIT16%
- Bus interconnect0.395 FIT16%
- Clock and reset0.199 FIT8%
- Window watchdog0.03 FIT1%
- Peripherals not used by the safety function0 FIT0%
Show the data as a table
| Item | Contribution (FIT) |
|---|---|
| CPU core pair | 0.796 FIT |
| SRAM with ECC | 0.597 FIT |
| Flash with ECC | 0.398 FIT |
| Bus interconnect | 0.395 FIT |
| Clock and reset | 0.199 FIT |
| Window watchdog | 0.03 FIT |
| Peripherals not used by the safety function | 0 FIT |
| Element | Failure mode | Fault class | Mode rate (FIT) | Single-point (FIT) | Residual (FIT) | Latent (FIT) |
|---|---|---|---|---|---|---|
| CPU core pair | Wrong result | Residual fault (covered by a safety mechanism) | 28 | 0 | 0.28 | 0.2772 |
| CPU core pair | Stuck or no output | Residual fault (covered by a safety mechanism) | 12 | 0 | 0.12 | 0.1188 |
| SRAM with ECC | Bit error | Residual fault (covered by a safety mechanism) | 30 | 0 | 0.3 | 0.297 |
| Flash with ECC | Corrupt read | Residual fault (covered by a safety mechanism) | 20 | 0 | 0.2 | 0.198 |
| Clock and reset | Wrong frequency | Residual fault (covered by a safety mechanism) | 10 | 0 | 0.1 | 0.099 |
| Bus interconnect | Wrong data | Residual fault (covered by a safety mechanism) | 9.8 | 0 | 0.098 | 0.09702 |
| Bus interconnect | Address decoder stuck | Single-point fault (no safety mechanism) | 0.2 | 0.2 | 0 | 0 |
| Window watchdog | Fails silent | Multiple-point fault, latent | 3 | 0 | 0 | 0.03 |
| Peripherals not used by the safety function | Any | Safe fault | 30 | 0 | 0 | 0 |
| Debug and trace logic | Any | Safe fault | not safety-related | 0 | 0 | 0 |
- Single-point fault metric (solid line, circles)
- ASIL D target (dashed line, squares)
Show the data as a table
| Coverage on every residual row (%) | Single-point fault metric | ASIL D target |
|---|---|---|
| 0 | 23.1 | 99.0 |
| 60 | 69.1 | |
| 70 | 76.8 | |
| 80 | 84.5 | |
| 90 | 92.2 | |
| 95 | 96.0 | |
| 97 | 97.6 | |
| 99 | 99.1 | 99.0 |
Every residual row would need about 98.9% coverage for the single-point target.
| Coverage | Single-point metric | Latent fault metric | PMHF (FIT) | All three targets |
|---|---|---|---|---|
| 0% | 23.08% | 99.91% | 110 | Missed |
| 60% | 69.15% | 99.30% | 44.81 | Missed |
| 70% | 76.83% | 99.27% | 33.94 | Missed |
| 80% | 84.50% | 99.25% | 23.07 | Missed |
| 90% | 92.18% | 99.23% | 12.2 | Missed |
| 95% | 96.02% | 99.22% | 6.763 | Missed |
| 97% | 97.56% | 99.22% | 4.589 | Missed |
| 99% | 99.09% | 99.21% | 2.415 | Met |
Sign in to save your inputs and come back to them later.
How it works
This tool rolls an FMEDA-style list of failure modes up into the three hardware metrics of ISO 26262: the single-point fault metric, the latent fault metric and the probabilistic metric for random hardware failures. It compares them with the targets for ASIL B, C and D, shows which elements hold the result back, and shows how much more diagnostic coverage would help.
- Give each failure mode a rate. Each row is one failure mode of one element. The element's failure rate in FIT (failures per 10^9 device hours) is repeated on each of its rows, and the share says how much of that rate goes to this mode. Rows of the same element should add up to 100%.
mode rate = element FIT x share / 100 - Classify the fault. A safe fault cannot lead to a violation of the safety goal. A single-point fault does so directly, with no safety mechanism. A residual fault is the part of a mechanism-covered fault that the mechanism misses. A multiple-point fault needs a second fault first and is detected, perceived or latent. Only the single-point and residual rates go into the single-point metric.
single-point rate = mode rate (class single-point); residual rate = mode rate x (1 − diagnostic coverage) (class residual) - Find the latent share. The covered part of a residual row, and every row classed as multiple-point latent, can sit hidden until a second fault arrives. Latent fault coverage is the share of it that a test, a second mechanism or the driver finds within the fault tolerant time or the lifetime. What it misses is the latent rate.
latent rate = covered rate x (1 − latent coverage), where covered rate = mode rate x diagnostic coverage; for a multiple-point latent row, latent rate = mode rate x (1 − latent coverage) - Single-point fault metric. The share of the safety-related failure rate that is not a single-point or residual fault. The total includes safe faults unless you switch that off.
SPFM = 1 − (single-point + residual) / (total safety-related FIT) - Latent fault metric. Of the failure rate that is not single-point or residual, the share that is not latent.
LFM = 1 − latent / (total safety-related FIT − single-point − residual) - Probabilistic metric for random hardware failures. The tool uses the simplified, conservative form common in vendor FMEDAs: every residual and single-point fault counts in full, and every latent multiple-point fault is added in full as if it could violate the goal on its own. The full quantification in ISO 26262-5 clause 9 and its informative annexes weights the dual-point terms by the vehicle lifetime and the test interval, and gives a lower figure. Use the simplified sum for early design and the full form for the safety case.
PMHF (simplified) = single-point + residual + latent, in FIT; 1 FIT = 10^-9 per hour - Compare with the targets. The commonly published targets are: single-point metric at least 90%, 97% and 99%; latent fault metric at least 60%, 80% and 90%; PMHF below 100, 100 and 10 FIT, for ASIL B, C and D. You can replace any of them if your project has agreed different values.
pass = SPFM ≥ target and LFM ≥ target and PMHF < target - What-if on diagnostic coverage. The same roll-up is repeated with one coverage figure applied to every residual row. The coverage that meets the single-point target is solved from the same formula, holding the single-point faults fixed.
required coverage = 1 − ((1 − SPFM target) x total − single-point) / (residual-class mode rate)
Assumptions
- Failure rates are constant (exponential) and the modes are independent, so rates add.
- The covered part of a residual row is treated as a possible latent fault, reduced by the latent fault coverage. This is the usual conservative vendor treatment.
- Safe faults are counted in the total, as in the common FMEDA convention. The switch removes them if your method excludes them.
- The failure rates in the presets are editorial round figures chosen to show how the metrics behave. Replace them with rates from your own FMEDA, such as SN 29500, IEC TR 62380 or supplier data.
- The targets are the commonly published values for ASIL B, C and D. ASIL A has no hardware metric targets.
Limits and warnings
- This is a roll-up of the numbers you enter. It does not decide the fault classes, the coverage figures or the failure mode shares, which need the analysis in ISO 26262-5 clause 8 and its coverage guidance.
- The PMHF is the simplified sum and overstates the full quantification. A design that passes it passes the full form on the same data; a design that fails it may still pass the full form.
- Dependent failures, common cause and the fault tolerant time interval are not modelled. Treat them in a separate dependent-failure analysis.
- Latent fault coverage is a single figure per row. The vehicle lifetime and the test interval are not modelled apart.
- It is not a substitute for a safety assessment. The standard itself, and your assessor, decide what counts as compliant.
Sources
The methods and default figures rest on these public sources. The wording here is our own; read the source for its full text.
- ISO 26262-5:2018, Road vehicles, Functional safety, Part 5: Product development at the hardware level (clause 8, evaluation of the hardware architectural metrics; clause 9, evaluation of safety goal violations due to random hardware failures), International Organization for Standardization, 2018. The metrics and the method, followed in our own words. No text or tables are copied.
- Be confident around automotive functional safety (SLYP685) (opens in a new tab), Texas Instruments (Tomas Urban), 2020. Published SPFM, LFM and PMHF targets by ASIL, and the worked FMEDA roll-up whose formulas the simplified PMHF follows.
- The ABCs Of ISO 26262 (opens in a new tab), Semiconductor Engineering (Kurt Shuler), 18 December 2014. Second public statement of the SPFM and LFM targets for ASIL B, C and D.
- Renesas Functional Safety Support for Automotive (2): A Customizable Option for Precise Safety Analysis (opens in a new tab), Renesas Electronics (Bartt Richards), 24 March 2021. Public statement of the ASIL D targets: SPFM above 99%, LFM above 90%, PMHF below 10 FIT.
Where it helps
The lifecycle stages this tool serves: 3 stages in 2 lifecycles.
More safety and security tools
- Safety integrity level determination
- Fault tree calculator
- Fault injection campaign sizer
- Safety function failure probability calculator
- Threat risk assessment calculator
- Vulnerability severity calculator
- Side-channel leakage assessment
- Software update impact assessment
- SBOM licence checker
- Development assurance objectives checklist
- Medical device classification helper
Method notev1Formula, ranges, sources and limits
Rolls a list of failure modes up into the single-point fault metric, the latent fault metric and a simplified probabilistic metric for random hardware failures, and compares them with the targets for ASIL B, C and D.
Formula
mode rate = element FIT x share / 100; single-point rate = mode rate (class single-point); residual rate = mode rate x (1 − diagnostic coverage) (class residual); latent rate = covered rate x (1 − latent coverage), where covered rate = mode rate x diagnostic coverage; for a multiple-point latent row, latent rate = mode rate x (1 − latent coverage); SPFM = 1 − (single-point + residual) / (total safety-related FIT); LFM = 1 − latent / (total safety-related FIT − single-point − residual); PMHF (simplified) = single-point + residual + latent, in FIT; 1 FIT = 10^-9 per hour; pass = SPFM ≥ target and LFM ≥ target and PMHF < target; required coverage = 1 − ((1 − SPFM target) x total − single-point) / (residual-class mode rate)
| Input | Unit | Range it holds for | Comes from |
|---|---|---|---|
| Target ASIL | choice | B, C, D | Your figure |
| Single-point metric target override, 0 for the published figure | % | 0 to 100 | Your figure |
| Latent fault metric target override, 0 for the published figure | % | 0 to 100 | Your figure |
| PMHF target override, 0 for the published figure | FIT | from 0 | Your figure |
| Count safe faults in the total | choice | yes, no | Your figure |
Outputs: Safety-related failure rate (FIT); Single-point fault metric (%); Latent fault metric (%); PMHF (simplified) (FIT).
Assumptions
- Failure rates are constant (exponential) and the modes are independent, so rates add.
- The covered part of a residual row is treated as a possible latent fault, reduced by the latent fault coverage. This is the usual conservative vendor treatment.
- Safe faults are counted in the total, as in the common FMEDA convention. The switch removes them if your method excludes them.
- The failure rates in the presets are editorial round figures chosen to show how the metrics behave. Replace them with rates from your own FMEDA, such as SN 29500, IEC TR 62380 or supplier data.
- The targets are the commonly published values for ASIL B, C and D. ASIL A has no hardware metric targets.
Uncertainty: The arithmetic is exact for the rows entered. The result is only as good as the failure rates, mode shares and coverage figures, and the PMHF is the conservative simplified sum. The failure mode rows are not part of the register inputs; the register uses the default microcontroller rows.
Known limits
- This is a roll-up of the numbers you enter. It does not decide the fault classes, the coverage figures or the failure mode shares, which need the analysis in ISO 26262-5 clause 8 and its coverage guidance.
- The PMHF is the simplified sum and overstates the full quantification. A design that passes it passes the full form on the same data; a design that fails it may still pass the full form.
- Dependent failures, common cause and the fault tolerant time interval are not modelled. Treat them in a separate dependent-failure analysis.
- Latent fault coverage is a single figure per row. The vehicle lifetime and the test interval are not modelled apart.
- It is not a substitute for a safety assessment. The standard itself, and your assessor, decide what counts as compliant.
Where the method comes from
The Hub's own roll-up of the metrics defined in ISO 26262-5, following the FMEDA layout vendors publish. The targets are the commonly published values for each ASIL.
Reference example, checked by test: Worked by hand in this method note from the default microcontroller safety island rows (editorial failure rates), ASIL D, safe faults counted in the total. Safety-related failure rate 143; Single-point fault metric 99.0923; Latent fault metric 99.2117; PMHF (simplified) 2.41502.
Versions
- v1 (2026-10-25): First version, built from the tool idea.
Terms on this page
- SPFM
- An ISO 26262 hardware metric giving the fraction of a safety-related element's failure rate that is not attributable to single point or residual faults, that is, faults that alone cause a safety go...
- LFM
- Sensor techniques that prevent pulse-width-modulated LED light sources from appearing as flickering, banded or blacked-out in captured images.
- FMEDA
- The quantitative analysis that assigns a failure rate to every hardware part, splits it across failure modes, and credits each safety mechanism with a diagnostic coverage.
- ASIL
- The risk classification assigned to a hazardous event in ISO 26262, ranging from A (lowest) to D (highest).
- ISO 26262
- The automotive functional safety standard that defines a safety lifecycle for electrical and electronic systems, assigning Automotive Safety Integrity Levels from A to D and prescribing the analysi...
- Single-point fault
- A hardware fault that leads directly to violation of a safety goal with no safety mechanism covering it.
- PMHF
- The average probability per hour that random hardware failures violate a safety goal, expressed in FIT.
- Diagnostic coverage
- The percentage of a part's dangerous failure rate that a given safety mechanism detects or controls in time.
- Failure mode
- The way in which a part or function fails, as seen from outside, such as an open, a short, a stuck output, a drift or a loss of function.
- FIT
- The standard failure rate unit, one failure per billion device hours of operation.
- Safe fault
- A fault that cannot by itself or in combination with another fault lead to violation of a safety goal, for example a fault in unused logic or in a block whose output the safety function ignores.
- Safety goal
- The top-level safety requirement produced by the HARA, stating what must not happen at vehicle level to avoid a hazardous event, together with its ASIL, safe state and fault tolerant time interval....
Need help acting on this?
Tell us what you're after and leave your email: we'll connect you with the right person on the Hub.