Free calculator · no sign-up
Proof test interval calculator
The longest proof test interval that keeps one subsystem within its PFDavg target, with voting, common cause, coverage and mission time, plus the test due dates and the curve that shows how much margin you have.
Failure rates, per channel
Test quality and life
PFDavg over the mission time for intervals from 1 month up to 10 years. The red dashed line is the target; the dot marks the longest interval that meets it. Hover or tap for values, or focus the chart and use the arrow keys.
Test due dates
One subsystem, constant failure rates, no partial stroke testing. In a full function every subsystem shares the PFDavg budget; the First Out AI tool runs a what-if on the interval for the whole function and reports which subsystem limits it. Calculations run in your browser; nothing you enter here is sent anywhere.
Method
How the interval is found
The calculator searches for the longest interval T1, between one day and the mission time, for which the time-averaged PFDavg of the PFDavg calculator stays at or below the target. The search is a bisection on a logarithmic scale, stopped when the interval is known to within 0.05 %.
Rule of thumb for one channel
Perfect test: T1 ≈ 2 · (PFDt − λDU·MRT − λDD·MTTR) / λDU Imperfect test: T1 ≈ 2 · (PFDt − (1−PTC)·λDU·MT/2) / (PTC·λDU) No interval works when (1 − PTC) · λDU · MT / 2 ≥ PFDt. PFDt is the target PFDavg.
The rule of thumb is linear; the calculator keeps the exponential and the shorter last interval before the end of the mission time, so its result is usually a little longer.
Worked check
1oo1, λDU = 500 FIT, coverage 95 %, mission time 20 years, target 5 × 10⁻³. The untested share alone gives 0.05 × 5 × 10⁻⁷ × 175,200 / 2 ≈ 2.2 × 10⁻³. What is left, 2.8 × 10⁻³, allows T1 ≈ 2 × 2.8 × 10⁻³ / (0.95 × 5 × 10⁻⁷) ≈ 11,800 h, about 16 months. At 80 % coverage the untested share is already 8.8 × 10⁻³ and no interval meets the target.
Before you adopt an interval
- Check the maximum interval in the device safety manual and the assumptions in the SRS.
- Round down to a practical cycle: a turnaround, an outage or a calendar quarter.
- Make sure the test procedure really achieves the coverage you entered.
- Record the basis in the proof test procedure and revisit it at each periodic review.
Questions
Short answers; the knowledge library has the long ones.
How do I calculate the maximum proof test interval?
Find the longest interval for which PFDavg stays at or below the target. For one channel with a perfect test it is roughly twice the target divided by λDU. With redundancy, common cause or imperfect coverage the relation is not linear, so the calculator solves it numerically.
Why does the calculator say the target cannot be reached?
Failures the proof test does not reveal accumulate over the whole mission time. When that share alone exceeds the target, no interval is short enough. Raise the coverage, for example with a leak test or a timed closure, shorten the mission time or change the design.
Should I use the SIL band limit as the target?
Many companies keep a margin below the band limit, for example half of it, because failure data is uncertain. If a LOPA gave a required PFD, use that value, after allowing for the other subsystems of the function. Follow your company's rule.
What else limits the proof test interval?
The maximum interval in the device safety manual, the turnaround cycle, wear and test-induced failures, regulatory or insurer requirements, and the assumptions in the SRS. The calculated value is an upper limit, not a recommendation.
Updates by email
New calculators, worked examples and articles, about once a month.
Short, technical and free. No third-party marketing; unsubscribe from any email with one click.
The interval that matters is the one the whole function can live with. See which subsystem limits it.
Free engineering aid. It supports engineering judgement and does not replace it; it is not certified software. Check every result with a competent functional safety engineer before changing a test interval.