Safety function failure probability calculator

How it works

A safety function is only as good as the chance that it fails dangerously. For a function that is demanded rarely, that chance is the average probability of failure on demand (PFDavg). For one that is demanded often or runs all the time, it is the failure frequency per hour (PFH). This tool applies the simplified equations of IEC 61508-6 Annex B to five channel architectures side by side, then finds the SIL band each reaches and the limit set by the safe failure fraction and hardware fault tolerance.

1. Split the dangerous failure rate. Dangerous failures are either detected by diagnostics (lambda DD) or undetected until a proof test or a demand finds them (lambda DU). If you enter the total dangerous rate and a diagnostic coverage DC, the split follows. Safe failures (lambda S) matter only for the safe failure fraction and, for 1oo2D, the detected share of them.lambda DD = DC x lambda D; lambda DU = (1 − DC) x lambda D; SFF = (lambda S + lambda DD) / (lambda S + lambda DD + lambda DU)
2. Work out the downtimes. An undetected failure sits unseen for half the proof test interval on average, plus the time to repair once found. A detected failure lasts only the time to restore. The channel downtime weights the two by their share of the dangerous rate. For a pair of channels the second failure sees an unseen failure that has lasted a third of the interval.tCE = (lambda DU / lambda D) x (T1 / 2 + MRT) + (lambda DD / lambda D) x MTTR; tGE = (lambda DU / lambda D) x (T1 / 3 + MRT) + (lambda DD / lambda D) x MTTR
3. Count common cause failures. A share beta of undetected failures, and a share beta D of detected failures, hit every channel at once. They behave like one channel and are added on top of the independent term. The independent rate is what is left after taking the common cause share out.lambda i = (1 − beta D) x lambda DD + (1 − beta) x lambda DU; common cause term = beta D x lambda DD x MTTR + beta x lambda DU x (T1 / 2 + MRT)
4. Low demand: PFDavg by architecture. One channel fails the function when it fails. Two channels in 2oo2 fail it when either does. In 1oo2 both must fail, so the first failure (either channel) has to be followed by a second during the downtime. In 2oo3 any pair of the three can supply the second failure. 1oo2D adds the effect of detected safe failures and of the diagnostic circuit's own coverage K.1oo1: lambda D x tCE; 2oo2: 2 x lambda D x tCE; 1oo2: 2 x lambda i^2 x tCE x tGE + common cause term; 2oo3: 6 x lambda i^2 x tCE x tGE + common cause term; 1oo2D: 2 x (1 − beta) x lambda DU x ((1 − beta) x lambda DU + (1 − beta D) x lambda DD + lambda SD) x t'CE x t'GE + 2 x (1 − K) x lambda DD x t'CE + beta x lambda DU x (T1 / 2 + MRT), with t'CE = (lambda DU x (T1 / 2 + MRT) + (lambda DD + lambda SD) x MTTR) / (lambda DU + lambda DD + lambda SD) and t'GE = T1 / 3 + MRT
5. High demand or continuous: PFH by architecture. Here the measure is how often the group reaches a dangerous failure. A first dangerous failure in one channel is only a hazard if the other already hides an undetected one, so the second term is lambda DU times the channel downtime. A detected failure that comes last is assumed to drive the system to its safe state.1oo1: lambda DU; 2oo2: 2 x lambda DU; 1oo2: 2 x lambda i x (1 − beta) x lambda DU x tCE + beta x lambda DU; 2oo3: 6 x lambda i x (1 − beta) x lambda DU x tCE + beta x lambda DU; 1oo2D: 2 x ((1 − beta) x lambda DU + (1 − beta D) x lambda DD + lambda SD) x (1 − beta) x lambda DU x t'CE + 2 x (1 − K) x lambda DD + beta x lambda DU
6. Find the SIL band. The bands are decades. For low demand, SIL 1 is a PFDavg from 1e-2 up to but not including 1e-1, SIL 2 from 1e-3, SIL 3 from 1e-4, SIL 4 from 1e-5. For high demand, SIL 1 is a PFH from 1e-6 per hour up to but not including 1e-5, SIL 2 from 1e-7, SIL 3 from 1e-8, SIL 4 from 1e-9.SIL from probability = the band that contains PFDavg or PFH
7. Apply the architectural limit (route 1H). Whatever the arithmetic says, the SIL of a subsystem is capped by its structure. A single channel starts from a base SIL set by the element type and the safe failure fraction: type A gives SIL 1, 2 and 3 for a fraction below 60%, from 60% to below 90%, and 90% or more; type B gives not allowed, 1, 2 and 3 for below 60%, 60% to below 90%, 90% to below 99%, and 99% or more. Every unit of hardware fault tolerance adds one step, to a ceiling of SIL 4. The SIL reached is the lower of the probability band and this limit.SIL reached = min(SIL from probability, base SIL(type, SFF) + HFT, 4)
8. Check the equations still apply. The simplified equations are first-order. They hold while lambda DU x T1 is small. The tool warns when it passes 0.1 and shows how much the single channel value is overstated.check: lambda DU x T1 < 0.1; one channel exact PFDavg = 1 − (1 − exp(−x)) / x with x = lambda DU x T1

Sources

The methods and default figures rest on these public sources. The wording here is our own; read the source for its full text.

• IEC 61508-6:2010, Functional safety of electrical/electronic/programmable electronic safety-related systems, Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3, International Electrotechnical Commission, April 2010. Annex B (informative): the simplified equations for PFDavg (clause B.3.2) and for the failure frequency in high demand or continuous mode (clause B.3.3). Cited by name, annex and clause only; the method is written here in our own words.
• IEC 61508-1:2010 and IEC 61508-2:2010, Functional safety of electrical/electronic/programmable electronic safety-related systems, International Electrotechnical Commission, April 2010. Part 1: the SIL target failure measures for low demand and high demand or continuous mode. Part 2, clause 7.4.4: architectural constraints, type A and type B elements, and route 1H. Cited by name and clause only.
• Chapter 8: PFD formulas in IEC 61508 (opens in a new tab), M. A. Lundteigen and M. Rausand, RAMS Group, NTNU (lecture slides, version 0.1), 2011. Explains the equivalent downtimes tCE and tGE, the group failure frequency and the beta factor terms used for 1oo2 and 2oo3.
• Chapter 8: Calculation of PFH (opens in a new tab), M. Rausand and M. A. Lundteigen, RAMS Group, NTNU (lecture slides, version 0.1), 2011. Explains the high demand equations for 1oo1, 1oo2 and 2oo3 and the assumption about a detected failure occurring last.
• SIL Calculations: Easy or Difficult? (technical guide, 61508 Association toolbox talk by IMC Teesside) (opens in a new tab), 61508 Association, 7 November 2012. Shows the 1oo1, 1oo2, 2oo2, 2oo3 and 1oo2D equations of the 2000 edition of Part 6 and a worked 1oo1 example (lambda DU of 1e-9, lambda DD of 1e-6, restoration of 8 hours, one year test interval, PFD of 1.24e-5), which the unit test reproduces.