Calculating Probability of Failure on Demand

In this lesson, you will learn how to calculate the Probability of Failure on Demand (PFD) to determine if your safety instrumented function (SIF) meets its assigned Safety Integrity Level (SIL).

When a system operates in "low-demand" mode—where the safety function is triggered infrequently, such as an emergency shutdown system—we cannot rely on uptime metrics. Instead, we must quantify the probability that the system will fail to perform its safety task when a dangerous event occurs.

The Math Behind PFD

For a single, non-redundant component with a constant failure rate ($\lambda$), the probability of failure on demand is calculated based on the test interval ($TI$), which is how often you perform proof testing to uncover hidden failures.

The simplified formula for a single channel is: $PFD_{avg} \approx \frac{\lambda \cdot TI}{2}$

In this equation:

• λ (Lambda) is the dangerous undetected failure rate.
• TI is the time interval between proof tests.

Concrete Example

Imagine an embedded pressure sensor tasked with triggering a shutdown. If the manufacturer specifies a dangerous undetected failure rate of $1 \times 10^{-6}$ failures per hour, and your maintenance policy dictates a proof test every 4,000 hours (roughly every six months):

// Calculating PFD for a single sensor
double lambda = 1.0e-6;    // Failures per hour
double TI = 4000.0;        // Proof test interval in hours

double pfd_avg = (lambda * TI) / 2.0;

// Result: 0.002

A PFD_avg of 0.002 places this component within the range of SIL 2 (which typically requires a PFD between $10^{-3}$ and $10^{-2}$). If your safety requirements demand SIL 3 (a lower PFD), this calculation tells you that you must either choose a more reliable sensor with a lower λ or increase the frequency of your proof tests to shrink TI.

By calculating this value, you move beyond anecdotal reliability and provide a rigorous, verifiable foundation that your safety architecture will perform exactly when the system demands it.

Key Takeaway: The PFD for low-demand systems is fundamentally a function of the component's dangerous failure rate and the frequency at which you verify its readiness through testing.