What Is PFD, Availability, and MTBF in Functional Safety (IEC 61508)?

In safety instrumented systems (SIS), three metrics dominate reliability discussions: PFD (Probability of Failure on Demand), Availability, and MTBF (Mean Time Between Failures). If you are designing or auditing a safety function, understanding how these relate is essential—and they are all defined within the framework of IEC 61508.

---

What It Is

PFD is the probability that a safety function will fail to perform its intended action when a demand occurs. It is a core measure for low-demand mode safety functions (e.g., a pressure relief valve that operates only when pressure exceeds a setpoint).

From PFD, we derive Availability:

\[
\text{Availability} = 1 - \text{PFD}
\]

Availability represents the fraction of time the safety function is able to respond correctly. MTBF is the average operating time between two consecutive failures (including both dangerous and safe failures, depending on your classification).

In IEC 61508, these metrics are used to assign Safety Integrity Levels (SIL). The standard provides target PFD ranges for each SIL (e.g., SIL 2 requires \( \text{PFD}_{\text{avg}} \) between \(10^{-2}\) and \(10^{-3}\)).

---

How It Works: Formula and Steps

For a single safety function in low-demand mode, the average PFD is often estimated as:

\[
\text{PFD}_{\text{avg}} \approx \frac{\lambda_{\text{DU}} \cdot T_1}{2}
\]

Where:

• \( \lambda_{\text{DU}} \) = dangerous undetected failure rate (failures per hour)
• \( T_1 \) = proof test interval (hours)

Then:

\[
\text{Availability} = 1 - \text{PFD}_{\text{avg}}
\]

MTBF (for a repairable system) is:

\[
\text{MTBF} = \frac{1}{\lambda_{\text{total}}}
\]

Where \( \lambda_{\text{total}} \) is the sum of all relevant failure rates (dangerous + safe, detected + undetected), depending on your failure classification.

Steps to apply:

1. Identify all failure modes of each component in the safety function.
2. Classify them as safe/dangerous and detected/undetected (per IEC 61508).
3. Compute \( \lambda_{\text{DU}} \) for the whole function (sum of component contributions).
4. Choose the proof test interval \( T_1 \).
5. Calculate \( \text{PFD}_{\text{avg}} \), then Availability.
6. Compare the result to the SIL target table in IEC 61508.

---

A Worked Illustrative Example

Example data (illustrative only):

A safety function has a dangerous undetected failure rate:
\[
\lambda_{\text{DU}} = 2 \times 10^{-5} \text{ per hour}
\]

Proof test interval:
\[
T_1 = 8760 \text{ hours (1 year)}
\]

Step 1 — Compute PFDavg:
\[
\text{PFD}_{\text{avg}} = \frac{2 \times 10^{-5} \times 8760}{2} = 0.0876
\]

Step 2 — Availability:
\[
\text{Availability} = 1 - 0.0876 = 0.9124 \quad (\text{91.24%})
\]

Step 3 — MTBF (if total failure rate \( \lambda_{\text{total}} = 5 \times 10^{-5} \) per hour):
\[
\text{MTBF} = \frac{1}{5 \times 10^{-5}} = 20{,}000 \text{ hours}
\]

This PFDavg of 0.0876 would not meet SIL 2 (which requires \( \text{PFD}_{\text{avg}} < 10^{-2} \)). You would need a shorter proof test interval, redundancy, or a lower failure rate component.

---

Common Pitfalls

• Mixing up PFD and PFH: PFD is for low-demand mode; PFH (Probability of Failure per Hour) is for high-demand or continuous mode. IEC 61508 treats them separately.
• Ignoring proof test effectiveness: A partial proof test may not detect all dangerous failures, so your \( \lambda_{\text{DU}} \) may be underestimated.
• Using MTBF alone for SIL decisions: MTBF includes safe failures, which do not directly affect PFD. Always separate dangerous undetected failures.
• Assuming 100% availability: Even with a perfect design, proof testing and repair downtime reduce availability.

---

Closing

Mastering PFD, Availability, and MTBF is the first step toward credible functional safety assessments under IEC 61508. To quickly compute these values for your own safety functions, try the free tool at https://www.6sq.com/tools/pfd/ — it handles the arithmetic so you can focus on the engineering decisions.