FMEDA Workbench

FMEDA Workbench is a free online FMEDA (Failure Modes, Effects and Diagnostic Analysis) tool. You list the parts inside a device, classify how each failure mode affects the safety function, assign diagnostics, and it calculates the failure rate breakdown (λSD, λSU, λDD, λDU), the safe failure fraction (SFF), the diagnostic coverage (DC) and the highest SIL the hardware architecture allows under IEC 61508 or IEC 61511. It suits engineers and students who want to see where a safety manual's numbers come from, and runs in your browser with no account.

How to use it

1. Open the examples to start from a worked analysis (pressure transmitter, temperature sensor, safety relay, power supply, solenoid driver, smart transmitter) or a blank sensor, logic or final element template. Guided analysis walks you through six steps: orient, build, classify, diagnose, interpret and improve.
2. Describe the device and its application: Type A or B, standard, route, hardware fault tolerance, demand mode, trip direction, and whether the logic solver alarms on out-of-range current.
3. In the Component tier, add parts from the component library to the worksheet, or create your own. Each part brings its base failure rate (FIT), its failure mode distribution and where both come from.
4. Classify each failure mode as safe, dangerous, annunciation or no effect — or give it an output effect (fail high, fail low, in range) and let the trip direction decide — and assign a diagnostic technique.
5. Read SFF, DC and the architectural limit.
6. The Subsystem tier starts from a manufacturer's safety manual figures instead. Define your safety function, map the manufacturer's fail-high and fail-low rates onto it, add logic-solver diagnostics and compare the result with the manufacturer baseline.
7. Export: download the analysis as JSON, share it as a link, print a PDF report, or send the result to SIF Builder as a sensor, logic solver or final element.

Method and assumptions

• Each worksheet row's failure rate is base FIT × mode distribution × quantity. A row's class splits it into safe detected and undetected (SD, SU), dangerous detected and undetected (DD, DU), annunciation (AU) or no effect (NE).
• Output effects follow exida practice for 4–20 mA devices. Fail high (21 mA or more) and fail low (3.6 mA or less, NAMUR NE 43) are classed by the trip direction: toward the trip is safe; away from it is dangerous, detected when the logic solver alarms on out-of-range current and undetected when it doesn't. In-range failures are always dangerous and split by the row's DC. With no trip direction set, those rows need a manual class.
• A row's DC is capped by its technique's IEC 61508-2 Annex A rating (low 60 %, medium 90 %, high 99 %) and never exceeds 99 %. On safe rows DC only splits SD from SU.
• SFF = (λS + λDD) / (λS + λD) and DC = λDD / λD. No-effect and annunciation failures are excluded from both; annunciation is reported separately.
• The architectural limit uses IEC 61508-2 Route 1H (Tables 2 and 3: Type, SFF band, HFT) or Route 2H, and IEC 61511-1:2016 Table 6 when the standard is IEC 61511 (minimum HFT per SIL, by demand mode). It is the highest SIL the architecture allows, not the SIL of a safety function, which also needs its PFDavg or PFH and the systematic capability of every element.
• In the Subsystem tier the total failure rate never changes. Fail-high and fail-low rates map through the trip direction as above; in-range dangerous undetected failures are never moved to safe. Published SD, SU, DD and DU figures are used as given, with a warning when the manufacturer assumed the other trip direction. A logic-solver diagnostic converts only undetected dangerous failures (λDD gains DC_ext × λDU), and counts only when it runs and reacts within the process safety time. Credit one diagnostic per mode. Two diagnostics on one mode combine as 1 − (1 − DC₁)(1 − DC₂) only when they detect independent sets of failures; two checks of the same kind do not add.

Technical Notes

• Library failure rates are illustrative, order-of-magnitude values at IEC 61709 reference conditions (40 °C, about 50 % stress), not copied from SN 29500 or any handbook. Mode distributions are author judgement, for passive and discrete parts informed by FMD-91. Each library part states its rate source and distribution source.
• Diagnostic techniques carry their IEC 61508-2 Annex A table and rating.
• Classification defaults are hints for a typical de-energise-to-trip path; review every one for your circuit and application.
• This is an educational tool, not a substitute for formal safety analysis
• The "What is an FMEDA?" sketch (Learn menu) uses these figures: 4 to 20 mA is the standard analogue signal range (IEC 60381-1); 3.6 mA is the NAMUR NE 43 fail-low level; the resistor's 1 FIT and its 60 / 35 / 5 % split between open, drift and short are the library's film resistor (illustrative rate, mode distribution informed by FMD-91). One FIT is one failure in 10⁹ device hours.

History

Built as a companion to the SIF Builder tool. SIF Builder works at the level of the safety instrumented function; FMEDA Workbench goes one level deeper, to the component failure modes behind a device's safety data. Together they cover the hardware side of SIL verification: device failure rates, the architectural limit and the PFDavg of a safety function. Systematic capability, software and the rest of the safety lifecycle are outside both tools.

Questions

Can I use the results for certification? No. Real FMEDAs depend on the actual circuit, stress and environment, and are reviewed by assessors. Treat the results as a learning aid.

Does IEC 61508 require a certified FMEDA? No. IEC 61508-2 requires the SFF and DC of each element to be determined, usually with an FMEDA, and a functional safety assessment. Third-party certification is common practice, and IEC 61511 also accepts devices selected by prior use.

Is my analysis stored anywhere? Your current analysis and any components sent to SIF Builder stay in your browser on this device. A share link carries the analysis inside the link itself.