What PFD actually measures
A safety instrumented function sits idle for years and must work the one time it is called. PFDavg is the probability it will be in a failed state when that demand arrives — averaged over the proof test interval, because the probability of a hidden failure grows steadily between tests and resets when the function is tested.
The critical term is λDU — dangerous undetected failures. Failures the diagnostics catch do not contribute, because they are announced and repaired. Only the silent ones matter, which is why diagnostic coverage has such leverage on the result.
SIL bands (low demand mode)
| SIL | PFDavg | Risk reduction |
|---|---|---|
| 1 | 10⁻² to 10⁻¹ | 10 – 100 |
| 2 | 10⁻³ to 10⁻² | 100 – 1,000 |
| 3 | 10⁻⁴ to 10⁻³ | 1,000 – 10,000 |
| 4 | 10⁻⁵ to 10⁻⁴ | 10,000 – 100,000 |
Worked example
A transmitter with λDU = 5×10⁻⁷ per hour, proof tested annually (8,760 hours), 1oo1:
- PFDavg = 5×10⁻⁷ × 8,760 ÷ 2 = 2.19×10⁻³
- Risk reduction factor = 1 ÷ 0.00219 = 457
- That falls in the SIL 2 band — but only just, and only for this subsystem
Add a logic solver at 1×10⁻⁴ and a shutdown valve at 8×10⁻³ and the loop totals 1.03×10⁻², which lands in SIL 1. The valve dominates — as it almost always does.
Field notes
- The final element usually governs. Shutdown valves have far higher dangerous undetected failure rates than transmitters, so effort spent on redundant sensors while ignoring the valve rarely moves the loop PFD. Partial stroke testing is the standard remedy.
- Redundancy is limited by common cause. The β factor captures failures that defeat all channels at once — a shared impulse line, a common power supply, one incorrect configuration applied twice. Without diversity, doubling the hardware does not square the reliability.
- Proof test interval is often the cheapest lever because PFD scales linearly with it. Halving the interval halves PFD — no capital cost, just discipline.
- Proof test coverage is rarely 100%. A test that exercises the transmitter but never strokes the valve leaves part of the loop untested, and the real PFD is worse than the calculation suggests.
- SIL is a property of the function, not the device. A transmitter is "SIL 2 capable"; the loop achieves a SIL only when architecture, proof testing and systematic capability are all assessed together.
- These are the simplified IEC 61508 formulas. Full verification uses vendor FMEDA data, MTTR terms and often a reliability tool.
Frequently asked questions
How is PFDavg calculated for a 1oo1 architecture?
PFDavg ≈ λDU × TI ÷ 2, where λDU is the dangerous undetected failure rate per hour and TI the proof test interval in hours. The division by two comes from averaging the probability across the test interval, since it grows roughly linearly between tests.
What PFD does each SIL band require?
For low demand mode: SIL 1 is 10⁻¹ to 10⁻², SIL 2 is 10⁻² to 10⁻³, SIL 3 is 10⁻³ to 10⁻⁴ and SIL 4 is 10⁻⁴ to 10⁻⁵. Lower PFD means higher integrity — a SIL 3 function fails on demand less than once in a thousand demands.
What is the risk reduction factor?
Simply the reciprocal of PFDavg. A PFDavg of 0.002 gives an RRF of 500, meaning the safety function reduces the frequency of the hazardous event by a factor of 500. Many people find RRF more intuitive than the probability itself.
Does shortening the proof test interval improve SIL?
Yes, and it is often the cheapest lever available — PFDavg is directly proportional to the interval, so halving it halves PFDavg. But testing has practical limits, and beyond a point redundancy or better-rated devices are the only way forward.
Simplified calculation for reference and education only. Functional safety verification is safety-critical work governed by IEC 61508 and IEC 61511 and must be performed by competent personnel using certified failure data. See our disclaimer.