Functional Safety Is More Than a PFDavg Calculation

Last updated October 2026

Ask most people what functional safety involves and you’ll hear about safety integrity levels (SIL), the average probability of failure on demand (PFDavg), the risk reduction factor (RRF), architecture, failure rates and voting.

The functional safety PFDavg calculation is real work, and it matters. It’s also the most visible part of the job, because it produces a number and software automates it.

However, this is where people get tripped up. Functional safety under IEC 61511 is much more than that. Every safety instrumented function (SIF) has two other design gates to clear, and functional safety management has to run for the whole life of the safety instrumented system (SIS).

Below is a high-level reminder of the rest of functional safety beyond PFDavg, with links to the articles that go deeper.

PFDavg Is One of Three Design Gates

SIL verification has three independent gates, and a SIF has to pass all three:

PFDavg – the quantitative gate. The calculated failure probability has to land in the SIL band.
Systematic capability – each device has to be fit for the SIL, through IEC 61508 certification or documented prior use. The math has no effect on it.
Architectural constraints – the hardware fault tolerance (HFT) has to be enough for the SIL. A SIL 3 SIF built from a single instrument, logic solver and final element in 1oo1 fails this gate whatever its PFDavg.

An architecture shortfall is fixed only with better equipment or more redundancy. Changing the calculation inputs does nothing for it. Each gate is covered in depth in SIL Verification: The Three Gates Every SIF Must Clear.

The Maths Assumes a Well-Run Plant

Every functional safety PFDavg rests on operating assumptions. Proof tests run at the stated proof test interval (TI) and reach the stated proof test coverage (Cpt). Repairs finish within the mean time to restore (MTTR). Devices fail at their published failure rates.

However, a lot of facilities don’t operate as well as they should. They miss proof tests or perform them poorly, skip replacement requirements, and run without spares in stores, so repairs overrun. A general lack of training and awareness lets the SIS slide down the priority list.

How well a facility runs its SIS program can be categorized in tiers. At SIL Safe, we call this the Plant Maturity Profile (PMP). At a low-maturity site, failure rates also climb above the published figures, and on the same hardware the gap between a near-perfect program and an average one can cost a full SIL level.

Functional Safety Management Rhymes With a Quality Program

Functional safety isn’t a quality program, but it rhymes with one. Both rest on documented procedures, defined roles, competence records, controlled changes, independent reviews and audits, and IEC 61511 requires every one of them.

Functional safety management, set out in Clause 5 of IEC 61511, is that system. It keeps the assumptions behind the functional safety PFDavg valid for the life of the SIS.

Competence, Planning and Independent Checks Are Requirements

Everyone with a life-cycle role has to be competent for that role, and that competence has to be documented and periodically reassessed (5.2.2). A manager vouching for someone isn’t documentation.

Safety planning assigns each life-cycle activity to a role and sets when it’s done and to what criteria. That plan is what later checks measure against.

A functional safety assessment (FSA) checks each SIF against the plan, with at least one assessor independent of the work. A functional safety audit is mainly for operating plants. It periodically checks that the functional safety management system is in place and being followed.

Requirements During Operations

Proof test and inspection records document each proof test: the procedure used, who performed it, and the as-found and as-left condition.
The site compares actual demand rates and failure rates with the assumptions behind the hazard and risk assessment (H&RA) and the SIL verification, and corrects course when reality is worse (5.2.5.3).
Management of change (MOC) requires an impact analysis before any SIS modification, application program changes included. If the change affects safety, work returns to the first life-cycle phase it touches.
Cybersecurity is a requirement too. The 2016 edition of IEC 61511 added a SIS security risk assessment (8.2.4), and the SIS design has to be resilient to the threats it identifies. It’s a growing focus as SIS equipment connects to plant networks and the threats keep changing over the life of the SIS.

Machinery Safety Uses Similar Math Under a Different Program

Machinery safety, under ISO 13849-1 and IEC 62061, protects the person working at the machine. IEC 61511 protects against major accidents.

The calculations look similar, and some machinery safety practitioners still calculate PFDavg. The program around them is built on the machine’s risk assessment and safety circuit validation instead of the IEC 61511 safety life-cycle.

A facility can legitimately need both. Trouble starts when the machinery program is applied to process hazards and the team takes the familiar calculations as proof it has done functional safety.

Common Mistakes

A machinery safety program mistaken for functional safety. A facility had both machinery hazards and IEC 61511 process hazards, and a successful machinery safety program. Its safety circuit validation document calculated a functional safety PFDavg, mean time to failure (MTTF), common cause failure and Cpt, so the team believed functional safety was done. It had no safety requirements specification (SRS), no documented functional safety management, no FSAs and no documented factory or site acceptance test. Nobody on staff held a functional safety certification, revision control was minimal, and logic solver programming was uncontrolled. The calculations were the only part of the safety life-cycle that existed.

A proof test interval stretched by maintenance. In a typical scenario, the maintenance team moves a SIF’s proof test from every three years to every six as a routine maintenance change. Nobody checks it against the SIL verification. For a 1oo1 SIF, PFDavg scales roughly with TI, so it about doubles, and the SIF may no longer meet its SIL. On paper it still passes, because the verification report still shows the three-year TI.

Calculations left behind after a merger. In another typical scenario, the functional safety people leave one by one over the years after a merger. New leadership knows there’s a gap. They find the functional safety PFDavg calculations on file and take them as proof the SIS is fine, but nobody left is competent to run audits or manage the life-cycle. The paperwork outlived the program.

Frequently Asked Questions

Isn’t functional safety the same thing as a PFDavg calculation?

No. The PFDavg is one of three design gates, and design is one phase of a life-cycle that runs until the SIS is decommissioned. You also need systematic capability, enough HFT, competent people, FSAs, audits, proof testing, MOC and a check that the plant behaves the way the calculation assumed. The functional safety PFDavg gets the attention because it’s the part that produces a number.

Couldn’t a facility choose to use SIL-certified components and calculate a PFDavg but not do functional safety?

Sure, but it’s an odd choice. It has been done, and we’ve seen it. The more likely scenario is a facility choosing SIL-certified components for a little extra confidence, skipping the functional safety PFDavg calculation, and not claiming functional safety at all. Where it goes wrong is a site that runs the calculation and then believes it has an IEC 61511 program.

We already run Performance Level calculations for our machinery safety. Doesn’t that cover our process hazards too?

No. A Performance Level (PL) under ISO 13849-1 is sized to protect the person at the machine, and the program behind it leaves out much of the IEC 61511 life-cycle, such as the SRS, staged FSAs and tracking demands against the design. Process hazards need their own H&RA, SIL targets and SIFs. If one safety PLC handles both, decide and document which functions are SIFs.

I worked at a plant that wasn’t well run, and we had SIFs there. Does that actually change anything?

Yes. Every PFDavg assumes the plant tests on time, tests well, repairs quickly and keeps failure rates where the data says they are. A poorly run site breaks those assumptions, and on the same hardware that can cost a full SIL level. At SIL Safe, we rate this with the Plant Maturity Profile (PMP), which tiers a plant by how well it runs its SIS program and adjusts inputs like TI, Cpt, MTTR and failure rates to match.

Search site