Diagnostic Coverage Factor in PFD Calculations: 3 Guardrails

Sensor diagnostics are the most flattering input a SIF designer can add to a calculation. Switch them on, and the probability of failure on demand drops sharply. Sometimes far enough to move a sensor from SIL 1 into SIL 2 — with no change in the field.

That is exactly why the number deserves scrutiny. A diagnostic coverage factor (DCF) you cannot defend looks compliant on paper. In practice, it overstates protection. In the third session of our SIS Mastery series, we worked through when diagnostics belong in a calculation and when they do not.

This article sets out three guardrails to apply before claiming a diagnostic coverage factor in PFD calculations. It also covers how to set a realistic mean repair time.

Consider a 1oo1 sensor subsystem with every parameter held constant except one. With a DCF of 85%, the calculated PFD lands comfortably in the SIL 2 band. Set the same DCF to zero, and the result only reaches SIL 1.

Nothing physical changed. The instrument, the proof test interval and the failure rates are identical. One input moved, and the claimed integrity level moved with it.

For a designer under pressure to demonstrate a target SIL, that leverage is obvious. However, leverage cuts both ways. If the basis for 85% is thin, the calculation is optimistic by a full integrity level. The gap then shows up only when the SIF is asked to act.

The formula we use throughout this series comes from ISA TR84. It is deliberately simple, and it makes the role of diagnostics easy to see.

Total failure rate (λ) splits into four components:

PFD calculations concern the dangerous side only, so λD is where attention belongs. λDU — dangerous undetected — is the largest driver of safety risk. These failures stop the SIF from acting, and nothing reveals them until a proof test finds them or a genuine demand exposes them.

Typical dangerous undetected failures include:

Several of these resist detection even during a full stroke test. Damaged valve internals, for instance, often only surface during an overhaul in the workshop.

λDD covers the opposite case. Here, the equipment itself reports that its safety mission is impaired. A sonic flow meter detects sensor fouling. A free-space radar transmitter detects moisture in the microwave coupler area. Most modern transmitters run continuous health checks, then drive the output to a burnout value and hand a bad PV to the logic solver.

This is the first question to answer, and the answer sits in the logic solver configuration rather than the datasheet.

Industry consensus is straightforward. If a detected failure only raises an alarm, and no automated action follows, then λDD should be added back into λD — meaning no diagnostic credit. The equipment knows it is impaired, but nothing in the system responds without a human noticing.

Credit applies when detection triggers automatic action. A direct trip on a bad PV qualifies. So does the common compromise of an automatic maintenance override switch (auto-MOS). There, the alarm starts a timer, giving the operator a window to arrange an override and a permit. If the operator does not act before it elapses, the SIF trips. That delay does not disqualify the credit, because the action is still automatic.

Diagnostics only earn their place in a PFD calculation when an automatic action occurs upon detection.

Once you do claim diagnostics, mean repair time (MRT) enters the calculation as well. We return to that below.

A functional safety datasheet from the manufacturer is the usual source for DCF. The formula is simple enough:

DCF = λDD ÷ (λDD + λDU)

Take a Yokogawa pressure transmitter datasheet, plug in the quoted FIT values, and the arithmetic might return 85%. The problem is scope. That figure describes a transmitter head, and a DP level measurement is not a transmitter head.

The real subsystem also includes impulse lines, isolation valves, manifold valves, and sometimes tracing. Every one of those introduces dangerous undetected failure modes that the manufacturer never sees.

A vendor sees the transmitter head. You own the whole loop.

The figures below are illustrative, not field data. They come from a hypothetical FMEA on 300 generic DP level measurements over 10 years. Their purpose is to show the method, not to supply numbers you can reuse.

Totals: λDD = 20, λDU = 11.

DCF = 20 ÷ (20 + 11) = 64.5%

That is roughly 20 percentage points below the 85% the datasheet alone suggested. Use the higher figure, and your PFD comes out lower than reality supports.

Where the transmitter head genuinely is the whole subsystem, vendor data may be fine. Otherwise, recalculate. If no FMEDA certificate exists, run a small FMEDA on the surrounding hookup instead. Nobody is asking you to analyze the electronics — only the loop around them.

Some functional safety manuals quote diagnostic coverage above 90%. Treat that as optimistic.

Human factors sit in the loop regardless of how good the electronics are. Someone still performs the repair. Someone still sets the maintenance override switch. Capping the claim at 90% leaves room for that reality, and being conservative costs little.

Manufacturer data also tends to run optimistic against industry sources such as OREDA, SINTEF or the Shell master equipment list used in IMS. Before accepting a vendor figure, ask two questions: does the failure rate data come from field returns, and is there an FMEDA certificate behind it?

MRT is the time needed to repair a failure and restore the system to operation. It covers three phases:

Many sites use MRT values that are far shorter than practice supports. A pressure or temperature transmitter is usually on the shelf, so a short MRT is defensible. A Coriolis flow meter may not be stocked, and it may need a vendor specialist on site. Those situations take considerably longer.

Two practical rules follow. First, define MRT per equipment type rather than per SIF, because MRT is a property of the device. Grouping pressure transmitters, radar level transmitters, and Coriolis meters separately is manageable; doing it instrument by instrument is not.

Second, MRT only applies when the device can be repaired on stream. A guided wave radar bolted into a vessel cannot be cleaned without breaking containment. Even though its diagnostics warn you correctly, the process has to be tripped to a safe state before repair. In that case MRT does not belong in the PFD calculation at all. Final elements often fall into the same category.

Both come up constantly, and both are usually handled the wrong way.

Partial stroke testing is better modeled as a separate test than as a diagnostic. The reason is the 100× rule. A diagnostic test interval must be short enough, relative to the demand rate, to genuinely reduce the probability of failure. For a low-demand SIF with a demand once every two years, that implies partial stroke testing roughly every week. Few sites test that often. Model it alongside full stroke and overhaul tests instead.

MVC (measurement, validation and comparison) compares two sensors measuring the same property at different positions — two level measurements on one vessel, for example. In most implementations, MVC is configured in the DCS and only alarms. Guardrail 1 therefore applies, and no diagnostic credit should be taken.

Master equipment in IMS SIS arrives preconfigured with failure rates, beta factors, MRT and diagnostic coverage, because a PFD calculation cannot run without them. The module then carries those parameters through SIF design and verification, keeping the basis for each claim traceable for Functional Safety Assessment.

Preconfigured is not the same as validated for your site, though. If master equipment assumes an 8-hour MRT, that assumes a warehouse spare exists. Review it against your own conditions, exactly as you would review any vendor figure.

Software and templates do not absolve an engineer from thinking. Whether data comes from a vendor, an industry standard or from us, your job is to check that it fits your site.

For related reading, see our article on PFD and test coverage factors, or run a quick check with the PFD and SIL calculator.

A short checklist for SIF designers, reliability engineers and functional safety leads, to work through before using a diagnostic coverage factor in PFD calculations:

Data is rarely complete, and it does not need to be. It needs a documented basis you can defend.