Free calculator · no sign-up
PFDavg calculator
Average probability of failure on demand for one subsystem, with MooN voting, common cause, repair time, proof test coverage and mission time. The chart shows PFD(t) over the life of the function, with the date and value under the cursor.
Failure rates, per channel
Testing and repair
PFD rises between proof tests and drops at each test; what a test does not reveal stays until the end of the mission time. Hover or tap for the date and value, or focus the chart and use the arrow keys.
- IEC 61508-6 simplified, perfect test
- –
- Time average at 100 % coverage
- –
- Added by untested failures
- –
Test dates
One subsystem, constant failure rates, no partial stroke testing. The full First Out AI tool combines sensors, logic solver and final elements, then checks hardware fault tolerance (Route 1H, Route 2H, IEC 61511) and systematic capability, and writes the SRS and proof test drafts. Calculations run in your browser; nothing you enter here is sent anywhere.
Method
How the numbers are calculated
Two results are shown. The simplified value uses the IEC 61508-6 equations for a perfect proof test, averaged over one test interval. The headline value follows the probability of failure through time and averages it over the whole mission time, so it also captures failures the proof test does not reveal.
Simplified equations (perfect proof test)
1oo1 PFDavg = λD · tCE 2oo2 PFDavg = 2 · λD · tCE 1oo2 PFDavg = 2 · λi² · tCE · tGE + CCF 2oo3 PFDavg = 6 · λi² · tCE · tGE + CCF 1oo3 PFDavg = 6 · λi³ · tCE · tGE · tG2E + CCF λD = λDU + λDD λi = (1 − βD) · λDD + (1 − β) · λDU tCE = (λDU / λD) · (T1 / 2 + MRT) + (λDD / λD) · MTTR tGE = (λDU / λD) · (T1 / 3 + MRT) + (λDD / λD) · MTTR tG2E = (λDU / λD) · (T1 / 4 + MRT) + (λDD / λD) · MTTR CCF = βD · λDD · MTTR + β · λDU · (T1 / 2 + MRT)
Time-domain average (with coverage and mission time)
x(t) = PTC · (t mod T1) + (1 − PTC) · (t mod MT) q(t) = 1 − e^(−(1−β) · λDU · x(t)) + (1−β) · λDU · MRT + (1−βD) · λDD · MTTR Pind(t) = Σ C(N, j) · q^j · (1 − q)^(N−j), j = N−M+1 … N Pcc(t) = 1 − e^(−β · λDU · x(t)) + β · λDU · MRT + βD · λDD · MTTR PFD(t) = 1 − (1 − Pind) · (1 − Pcc) PFDavg = average of PFD(t) from 0 to MT
For a single channel, β and βD are not applied. The average uses at least 400 points per test interval. The same equations run in the First Out AI engine, and this page is tested against it on hundreds of random cases; see methods and tests.
Worked check, 1oo1
λDU = 500 FIT = 5 × 10⁻⁷ per hour, yearly proof test (8,760 h), MRT 8 h, perfect coverage: PFDavg = 5 × 10⁻⁷ × (4,380 + 8) ≈ 2.2 × 10⁻³, inside the SIL 2 band, RRF about 456. Lower the coverage to 70 % with a 20-year mission time and the time average rises to about 1.5 × 10⁻² (SIL 1), almost seven times higher: the untested 30 % accumulates for 20 years.
Questions
Short answers; the knowledge library has the long ones.
What is PFDavg?
The average probability that a safety function, or one of its subsystems, fails to act when a demand occurs. It applies to low demand mode, where demands are expected no more than once a year, and sets the SIL band by probability: below 0.1 for SIL 1, below 0.01 for SIL 2, below 0.001 for SIL 3.
Why does the time-averaged PFDavg differ from the simplified equation?
The simplified equations assume a perfect proof test and average over one interval. The time average follows PFD(t) over the whole mission time, so failures the test does not reveal keep accumulating. At 100 % coverage the two agree closely; at lower coverage the time average is higher, and it is the realistic one.
What proof test coverage should I enter?
The fraction of dangerous undetected failures your actual procedure reveals. Take it from the device FMEDA or safety manual for the test you really perform. A valve that is only stroked, without a leak test or a timed closure under process conditions, often has far less than 100 %. See coverage by device type.
Is a PFDavg result enough to claim a SIL?
No. The whole function, sensors, logic solver and final elements in series, must meet the probability target, the hardware fault tolerance requirement and the systematic capability requirement. This page covers the probability of one subsystem; the app does the rest.
Which failure rate unit should I use?
Any of them: FIT, per hour, per million hours or per year. Certificates and FMEDA reports usually give FIT. Pick the unit before typing; the calculator converts internally. The failure rate converter handles MTTF as well.
Updates by email
New calculators, worked examples and articles, about once a month.
Short, technical and free. No third-party marketing; unsubscribe from any email with one click.
One subsystem is a start. Verify the whole function, with fault tolerance and systematic capability, in the same browser.
Free engineering aid. It supports engineering judgement and does not replace it; it is not certified software. Check every result with a competent functional safety engineer before it is used in a design or a safety case.