A safety instrumented function in low demand mode is judged by its average probability of failure on demand (PFDavg): the fraction of time the function would not work if a demand came. For a single channel the reasoning is simple and worth knowing by heart, because every other architecture is built from it.
The idea
A dangerous undetected failure (rate λDU, per hour) sits hidden until a proof test finds it. Right after a perfect proof test the probability that the channel has failed is zero. It then grows almost linearly: after a time t it is about λDU·t. At the next test (interval T1) it is back to zero. The average of a straight line from 0 to λDU·T1 is half its height:
PFDavg ≈ λDU · T1 / 2
Two smaller terms are usually added:
- Repair after the test: while a failure found at the test is repaired, the function is unavailable: λDU · MRT (mean repair time).
- Detected failures: a dangerous failure the diagnostics find (λDD) still leaves the function unavailable during repair unless the failure trips the process: λDD · MTTR.
PFDavg ≈ λDU · (T1/2 + MRT) + λDD · MTTR
Worked example
A shutdown valve with actuator and solenoid, λDU = 2 × 10⁻⁶ per hour, proof tested once a year (T1 = 8,760 h), MRT = 8 h, no diagnostics.
| Term | Calculation | Value |
|---|---|---|
| Undetected, average over the interval | 2 × 10⁻⁶ × 8,760 / 2 | 8.76 × 10⁻³ |
| Repair after test | 2 × 10⁻⁶ × 8 | 1.6 × 10⁻⁵ |
| PFDavg | 8.8 × 10⁻³ (SIL 2 band) |
Double the interval to two years and PFDavg doubles to about 1.75 × 10⁻², which is in the SIL 1 band. Nothing about the hardware changed; only the test strategy did.
What the simple formula leaves out
- Imperfect proof tests. If the test reveals only part of λDU, the rest stays hidden until overhaul or replacement. That part grows over the whole mission time and usually dominates. See "Proof test coverage and why it dominates the result".
- Mission time and renewal. The formula assumes the device is as good as new after every test.
- Partial stroke tests. These clear part of λDU more often than the proof test.
- Time-dependent averaging. First Out AI integrates PFD(t) over the mission time with each part of λDU cleared by the test that actually reveals it, so its result is slightly different from the hand formula. The "Perfect test (IEC 61508-6)" column in the results table shows the simplified-equation value as a cross-check.
In First Out AI
Enter one group with voting 1oo1, the four failure rates, T1 in years and PTC in percent. The result table shows the group's PFDavg and its share of the total. Use the what-if panel to see the effect of halving T1.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.