SPFM, LFM and PMHF: ISO 26262 hardware metrics in plain words

ISO 26262-5 asks hardware teams to show, with numbers, that random hardware faults are unlikely to violate a safety goal. Three metrics do this. Here is what each one means and how it is calculated.

The inputs

For every hardware element that can affect the safety goal, the FMEDA lists its failure modes with:

• Failure rate (λ) in FIT, failures per 10⁹ hours, from a source such as IEC 62380 or SN 29500.
• Safe fraction: the share of failures that cannot violate the safety goal.
• Diagnostic coverage (DC): the share of the remaining failures a safety mechanism detects or controls, for residual faults and for latent faults.

Splitting the failure rate

• Safe faults: λ × safe fraction.
• Single-point faults: non-safe faults with no safety mechanism at all.
• Residual faults: the non-safe faults a safety mechanism misses: λ non-safe × (1 − DC).
• Multiple-point faults: the faults the mechanism covers. Those it would not notice in time are latent: λ MPF × (1 − DC latent).

The three metrics

• SPFM (single-point fault metric) = 1 − (single-point + residual) ÷ total λ. It shows how well the design covers faults that directly violate the goal.
• LFM (latent fault metric) = 1 − latent ÷ (total λ − single-point − residual). It shows how well faults that hide until a second fault occurs are found.
• PMHF (probabilistic metric for random hardware failures) is the average probability per hour of violating the goal, mainly single-point and residual faults plus a dual-point part that depends on lifetime and fault detection time.

Targets

• ASIL B: SPFM at least 90%, LFM at least 60%, PMHF below 100 FIT.
• ASIL C: SPFM at least 97%, LFM at least 80%, PMHF below 100 FIT.
• ASIL D: SPFM at least 99%, LFM at least 90%, PMHF below 10 FIT.

A quick example

One failure mode with λ = 100 FIT, 50% safe, DC 99% and latent DC 90%:

• Non-safe 50 FIT; residual 50 × 1% = 0.5 FIT; covered 49.5 FIT, of which latent 4.95 FIT.
• SPFM = 1 − 0.5 ÷ 100 = 99.5%. LFM = 1 − 4.95 ÷ 99.5 = 95.0%.
• Both meet ASIL D. The single-point and residual part of PMHF is 0.5 FIT.

Practical tips

• Enter each failure mode separately (open, short, drift); they often have very different safe fractions and coverage.
• Justify every DC value. ISO 26262-5 Annex D gives typical values (low 60%, medium 90%, high 99%), but your safety case needs analysis or fault-injection evidence.
• Start early. A rough FMEDA during architecture design tells you where safety mechanisms are needed, long before the schematic is frozen.

Try it

Our free ISO 26262 hardware metrics calculator works out SPFM, LFM and the single-point and residual part of PMHF from your failure modes, checks them against the ASIL targets and exports a simple FMEDA to Excel. It is a planning aid: the FMEDA for your safety case must use your own qualified tools and reviewed data.