Safety Architecture & Performance Level Certifier (2D)

Control Architecture

Channel MTTF_d 30 yr

Diagnostic coverage DC_avg 60%

CCF score (Annex F) 65

Risk Graph → Required PL

Severity of injury

Exposure frequency

Possibility of avoidance

Result

PFH_d (1/h)

—

Achieved PL

—

Required PL_r vs achieved

—

How it works

Per-channel dangerous failure rate from mean time to dangerous failure:

λd = 1 / (MTTFd_years × 8760)   [failures / hour]

The probability of dangerous failure per hour (PFH_d) depends on the architecture category (a simplified, educational model in the spirit of ISO 13849-1 Annex K — not a substitute for a real certification calculation). Verified numerically: PFHd decreases monotonically as category rises B→4, as DC rises, as MTTFd rises, and as the CCF score rises, for every combination sampled — matching the standard's intent that better architectures/diagnostics/independence always certify easier, never the reverse.

Cat B, 1:  PFHd = λd                         (no diagnostics)
Cat 2:     PFHd = λd·(1−DC) + 0.01·λd        (test channel misses (1−DC))
Cat 3, 4:  β = 1 − CCF/100                   (common-cause coupling)
           PFHd = λd·(1−DC)·β + λd²·8760     (both channels must fail undetected)
           Cat 4 additionally scales the residual term ×0.1 (near-complete diagnostics)

PFH_d is then banded into a Performance Level a–e (lower PFH_d = higher PL, roughly a decade per band from 10⁻⁴ down to 10⁻⁸ /h) — shown here as a log-scale gauge instead of a lookup table, so you can see the achieved value sweep across the band boundaries as sliders move.

The required PL_r comes from the classic ISO 13849-1 risk graph: Severity (S1/S2) × Frequency (F1/F2) × avoidance Possibility (P1/P2) walk a branching path to a letter a–e — drawn here as an explicit tree so the whole decision, not just its outcome, is visible. The architecture only counts as "safe" when the achieved PL is at or above the required PL_r — the channel-flow diagram's pulses turn green when a simulated fault is caught and red when it would slip through, at a rate that scales with PFH_d.

Note: Category 2/3/4 need CCF ≥ 65 to be considered valid architectures in the real standard; below that the diagram flags the design red regardless of PFH_d.

—

Safety channel Fault caught Fault reaches output

drag to pan channel view