FMEDA Rollup Calculator — System SPFM, LFM and PMHF
Enter a failure rate and diagnostic coverage for each element. The calculator rolls them up to system SPFM, LFM and PMHF, checks them against the ASIL targets, and tells you which element is spending your budget.
| Element | λ (FIT) | Safe % | DCSPF % | DCLF % | λSPF+RF |
|---|
Runs entirely in your browser. Nothing is uploaded, stored, or sent anywhere.
Why the rollup is where the argument happens
A single-element calculation tells you whether one part can reach a target. It does not tell you whether your system does, because the system metrics are ratios of sums, and sums are dominated by their largest terms. A part with excellent coverage sitting next to a part with poor coverage does not average out to something acceptable — the poor one sets the result almost by itself.
That is why this tool highlights the dominant contributor. In most real designs one or two elements supply the majority of the escaping failure rate, and every hour spent improving coverage elsewhere is close to wasted. Load the example and change the microcontroller’s coverage, then change the CAN transceiver’s by the same amount, and watch how differently the system responds.
How the numbers combine
SPFM = 1 − Σλ_SPF+RF / Σλ_SRLFM = 1 − Σλ_latent / (Σλ_SR − Σλ_SPF+RF)PMHF ≈ Σλ_SPF+RF + T_life × Σi<j λ_latent,i × λ_latent,jThe dual-point term sums over unordered pairs of elements — two independent latent faults, in different places, coinciding inside the operating lifetime. That is a more faithful treatment than squaring the total latent rate, which would double-count and would also count each element against itself. It is still second order in λ, so it stays far below the single-point term in any realistic design; if it ever dominates your result, check the inputs before believing it.
What this does not replace
- A real FMEDA works per failure mode, not per element: each part’s failure rate is distributed across modes, and each mode is argued against a specific safety mechanism.
- Diagnostic coverage is an input here. Earning those percentages is the actual work, and it has to be justified mode by mode rather than assumed.
- Dependent failures — common-cause and cascading — are outside this arithmetic entirely, and they are frequently what an assessor challenges first.
- Base failure rates need a recognised source (IEC 62380, SN 29500, FIDES or supplier data) and a stated mission profile. Two analyses of the same board can differ by more than a factor of two on mission profile alone.
- The pairwise term assumes independence between elements and a detection interval equal to the full lifetime. A shorter argued interval lowers it further.
Where this fits
FMEDA and FMEA review is one of our primary service lines, at board and silicon level. If the rollup is not landing where you need it, a gap review is the usual next step: one to two weeks, and it ends in a written report you keep. Every block in our safety soft-IP catalog ships with its own FMEDA and published SPFM/LFM figures, so you can see what a completed one looks like.
More free tools
Each of these runs entirely in your browser. Nothing is uploaded, stored or sent anywhere, and none of them needs an email address.