ISO 26262-5:2018 · Hardware architectural metrics
SPFM, LFM and PMHF calculator.
Enter your FMEDA summary, see the three ISO 26262-5 hardware metrics, and follow how each result is worked out from your own numbers. Every field below explains what it means, its unit, and where its value comes from.
What these three numbers tell you
SPFM, in %
How well the design protects against faults that can violate the safety goal on their own. A high value means few such faults remain uncovered.
LFM, in %
How well the design finds hidden faults. A latent fault does no harm yet, but it waits for a second fault to complete the path to a violation.
PMHF, in FIT
The average probability per hour, over the vehicle's life, that random hardware failures violate the safety goal. SPFM and LFM are ratios, while PMHF is an absolute value.
Rates are in FIT. 1 FIT means one failure per 109 hours, so a 100 FIT part fails on average once in 10 million hours. Values usually come from reliability handbooks such as IEC 62380 or SN 29500, from supplier data, or from field data. Calculate one set of metrics per safety goal, and include only hardware that relates to that goal.
Failure rates, in FIT
"Intended function" means the hardware doing the job. "Safety mechanism" means the hardware that watches it.
Hours the vehicle actually operates, not calendar time. This is how long a latent fault can stay hidden. The example in ISO 26262-10 uses 10,000 hours.
How long the vehicle keeps operating after a warning until it is repaired. The example in ISO 26262-10 uses 20 hours.
Where the failure rate goes
How your result is worked out
These lines update with the values you enter above, so you can check each result by hand.
- SPFM = 1 − (single-point + residual) ÷ total, in %
1 − (0 + 4) FIT ÷ 410 FIT = 99.02% - LFM = 1 − latent ÷ (total − single-point − residual), in %
1 − (6 + 4) FIT ÷ (410 − 0 − 4) FIT = 97.53% - PMHF, part 1: faults that act alone
0 + 4 = 4 FIT - PMHF, part 2: mechanism fails silently, then the function fails
½ × 4 FIT × 186 FIT × 10⁻⁹ × 10000 h = 0.0037 FIT - PMHF, part 3: mechanism fails and is reported, then the function fails before repair
16 FIT × 186 FIT × 10⁻⁹ × 20 h = 6.0e-5 FIT - PMHF, part 4: function fault stays silent, then the mechanism fails
½ × 6 FIT × 20 FIT × 10⁻⁹ × 10000 h = 0.0006 FIT - PMHF, part 5: function fault is reported, then the mechanism fails before repair
180 FIT × 20 FIT × 10⁻⁹ × 20 h = 7.2e-5 FIT - PMHF = sum of all five parts
4.00 FIT = 4.00e-9 per hour
The ½ appears when a latent fault has to come before the second fault. Order matters there, and averaging over the lifetime gives the ½. Detected faults use the shorter repair time instead. If your design has several mechanisms, adding them into one line makes the dual-point part an approximation.
How to decide which field a fault belongs in
Ask these questions for each failure mode in your FMEDA, in this order.
- Can this fault significantly raise the chance of violating the safety goal, alone or with one other fault? If not, it is a safe fault.
- Can it violate the goal by itself? If so, check the coverage. With no mechanism in that element, it is a single-point fault. With a mechanism, the part not controlled is residual, and the controlled part is dual-point.
- Does it need a second independent fault to cause a violation? Then it is dual-point, like a fault in a safety mechanism.
- Will anyone find out in time? If a mechanism detects it or the driver perceives it, enter it as detected. If not, it is latent.
Faults that need three or more independent faults are usually treated as safe, unless the technical safety concept shows they matter. ISO 26262-5:2018, Annex B describes this classification.
Example: from one part to the fields above
A sensor interface has a failure rate of 100 FIT. These percentages are illustrative. Your values come from your own analysis.
| Step | Calculation | Goes into |
|---|---|---|
| 40% of its failures cannot affect the goal | 100 FIT × 40% = 40 FIT | Safe faults |
| Coverage of the other 60 FIT is 95% | 60 FIT × 5% = 3 FIT | Residual faults |
| 90% of the covered 57 FIT is reported | 57 FIT × 90% = 51.3 FIT | Intended function, detected |
| The remaining 10% is silent | 57 FIT × 10% = 5.7 FIT | Intended function, latent |
| Check: the parts add up | 40 + 3 + 51.3 + 5.7 = 100 FIT |
Repeat this for every safety-related part, then add up each column. Those totals are what you enter in the calculator.
Worked example: PMHF of a 2oo3 architecture
2oo3 means two out of three. Three identical channels feed a voter, which follows the majority, so one failed channel is outvoted. The safety goal is violated when two channels have failed. Change the values below and watch which term dominates. It is usually what the channels share, not two independent faults.
The rate of faults in one channel that can give a wrong output.
The share of those faults that hit channels together, for example through a shared supply, clock, temperature or design error. β is a modelling idea used in IEC 61508-6, and your value should come from a dependent failure analysis.
How much of a channel's failure rate the system notices, for example when the voter sees a disagreement.
The voter has no backup in this model, so each of its faults counts as a single point.
Operating hours. An unnoticed failed channel stays failed for this long.
How long a known failed channel stays in the system before it is taken out of use or repaired.
PMHF ≈ λv + βλ + 3[(1−β)λ]²(1−DC)T + 6[(1−β)λ]²·DC·τISO 26262 gives no 2oo3 formula. This first-order estimate is our own: it counts two independent channel failures, common-cause failures and a voter that acts as a single point. With the default values it gives 3.03 FIT, the same as an exact Markov model of these assumptions to that precision. For real designs, use a fault tree or a Markov model.
The reference targets
| Metric | ASIL B | ASIL C | ASIL D | Reference |
|---|---|---|---|---|
| SPFM | (≥ 90%) | ≥ 97% | ≥ 99% | ISO 26262-5:2018, Table 4 |
| LFM | (≥ 60%) | (≥ 80%) | ≥ 90% | ISO 26262-5:2018, Table 5 |
| PMHF | (< 100 FIT) | < 100 FIT | < 10 FIT | ISO 26262-5:2018, Table 6 |
Parentheses mark ASILs where the standard recommends the target instead of requiring it. This is not the parenthesis notation used for ASIL decomposition. 100 FIT equals 10−7 per hour, and 10 FIT equals 10−8 per hour.
SPFM
The share of the safety-related failure rate that is not single-point or residual. Follows Equation C.7 in Annex C of Part 5.
LFM
Of what remains after removing single-point and residual faults, the share that is not latent. Follows Equation C.8 in Annex C of Part 5.
PMHF
Follows the first-order formula for one intended function and one safety mechanism in ISO 26262-10:2018, 8.3.2.4. We checked it against the numeric example printed there.
These targets are possible reference values. A project can also derive them from a similar well-trusted design, and the PMHF values apply to an item made of a single system. This tool supports learning and early estimates. It does not replace your FMEDA, your fault tree or an assessment.
If you miss a target
SPFM too low
Sort your FMEDA by single-point and residual rate, then work on the top contributors. Add a mechanism where none exists, or raise the coverage of the one you have.
LFM too low
Look for faults nobody would notice. Test your safety mechanisms, for example with a startup self-test, and make sure corrected errors are reported.
PMHF too high
Check the terms above. If single-point and residual dominate, as they usually do, improve coverage or use parts with lower failure rates. If dual-point dominates, shorten how long faults stay hidden.
Common mistakes
- Thinking a good SPFM means a good PMHF. SPFM is a ratio and PMHF is absolute. A 5,000 FIT design with a 99% SPFM still has 50 FIT of single-point and residual faults, which misses the ASIL D PMHF target of 10 FIT.
- Treating PMHF as a failure rate. It is an average probability per hour over the lifetime. The unit looks the same, but the two values are different things.
- Calculating per part instead of per safety goal. The targets apply to the hardware of the item for each safety goal, so a part can fall below the percentage while the item still meets it.
- Using calendar time for the lifetime. The formula uses operating hours only.
- Claiming coverage or safe faults without evidence. Both directly improve the results, so each needs a rationale that a reviewer can check.
- Forgetting the safety mechanisms' own faults. Mechanisms fail too, and those rates belong in the analysis.
Go deeper
Need the numbers behind the summary?
The FMEDA simulator takes you from a real schematic to these metrics, part by part. The hardware metrics guide explains the theory behind them.