Safety Architecture & Performance Level Certifier

Control Architecture

Channel MTTF_d 30 yr

Diagnostic coverage DC_avg 60%

CCF score (Annex F) 65

Risk Graph → Required PL

Severity of injury

Exposure frequency

Possibility of avoidance

Result

PFH_d (1/h)

—

Achieved PL

—

Required PL_r vs achieved

—

How it works

Per-channel dangerous failure rate from mean time to dangerous failure:

λd = 1 / (MTTFd_years × 8760)   [failures / hour]

The probability of dangerous failure per hour (PFH_d) depends on the architecture category (a simplified, educational model in the spirit of ISO 13849-1 Annex K — not a substitute for a real certification calculation):

Cat B, 1:  PFHd = λd                         (no diagnostics)
Cat 2:     PFHd = λd·(1−DC) + 0.01·λd        (test channel misses (1−DC))
Cat 3, 4:  β = 1 − CCF/100                   (common-cause coupling)
           PFHd = λd·(1−DC)·β + λd²·8760     (both channels must fail undetected)
           Cat 4 additionally scales the residual term ×0.1 (near-complete diagnostics)

PFH_d is then banded into a Performance Level a–e (lower PFH_d = higher PL, roughly a decade per band from 10⁻⁴ down to 10⁻⁸ /h).

The required PL_r comes from the classic ISO 13849-1 risk graph: Severity (S1/S2) × Frequency (F1/F2) × avoidance Possibility (P1/P2) walk a branching path to a letter a–e. The architecture only counts as "safe" here when the achieved PL is at or above the required PL_r — the 3D diagram's channel pulses turn green when a simulated fault is caught and red when it would slip through, at a rate that scales with PFH_d.

Note: Category 2/3/4 need CCF ≥ 65 to be considered valid architectures in the real standard; below that the diagram flags the design red regardless of PFH_d.

—

Safety channel Fault caught Fault reaches output

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.