Siemens F-CPU Safety Integrity: IEC 61508 SIL Architecture Guide

1. Overview: Safety Integrity Level in Functional Safety

Safety Integrity Level (SIL) is the relative, discrete target level of risk reduction that a Safety Instrumented Function (SIF) must achieve. It is defined by IEC 61508 as the probabilistic confidence that a safety-related system performs its required function under all stated conditions within a defined period. SIL is not a property of a single component; it is a property of the complete safety loop: sensor, logic solver, wiring, barriers, and final element (actuator).

For process industries, the companion standard IEC 61511 (functional safety: safety instrumented systems for the process industry sector) restricts the achievable level to SIL 1, SIL 2, or SIL 3. IEC 61508 also defines a SIL 4 tier, but it is rarely applied outside transport, nuclear, or military domains. Note: the SIL scale per IEC 61508 runs 1 through 4, not 1 through 5; any reference to "SIL 5" is non-standard terminology.

For machine safety, the equivalent risk-reduction measure is Performance Level (PL) a through e defined in ISO 13849-1. PL and SIL are not interchangeable units, but they are mappable per Eaton's SIL vs. PL cross-reference and the IEC 62061 mapping table.

2. IEC 61508/61511 SIL Targets: PFD and PFH

IEC 61508 quantifies SIL using two failure-probability metrics, depending on the mode of operation:

• Low Demand Mode (PFD_avg) — average Probability of Failure on Demand. Demand rate ≤ 1 per year. Used for SIFs that bring a process to a safe state on infrequent event triggers (e.g., ESD, HIPPS, fire & gas).
• High Demand / Continuous Mode (PFH) — Probability of dangerous Failure per Hour. Used for SIFs that continuously maintain safe state (e.g., burner management, robot cell interlocks).

The achieved SIL of a SIF is calculated as the sum of the PFD contributions of every subsystem in the loop:

PFD_SIF = PFD_sensor + PFD_{logic solver} + PFD_actuator

A common engineering rule of thumb (the 100/10/10 split, sometimes called the λ or 1% rule) budgets sensor, logic solver, and final element to roughly equal 10% each of the target PFD, leaving 70% headroom. For a SIL 3 target PFD of 10^-3, this gives 10^-4 per subsystem, which is the foundation for choosing dual-channel (1oo2) architectures at the sensor and final element.

3. Architecture Notation: 1oo1, 1oo2, 2oo2, 2oo3, 1oo2D

The MooN (M-out-of-N) voting architecture determines how many channels must agree before the safety function actuates. The IEC 61508 / IEC 61511 notation is:

Siemens F-I/O modules support channel- and module-level 1oo1, 1oo2, and 2oo2 topologies directly through hardware configuration in STEP 7 / TIA Portal. Sensor-level 2oo3 voting is typically built in the application code or achieved with redundant transmitters and a voting block.

4. Siemens SIMATIC Safety System Family

Siemens offers three product lines for safety automation, each TÜV-certified and PROFIsafe-capable. The selection depends on availability, redundancy, and integration requirements. For the official configuration manual, refer to the SIMATIC S7 F/FH Systems manual (entry ID 12490443).

4.1 Distributed Safety (S7-300F / S7-400F + ET 200S F / ET 200M F / ET 200SP F)

Distributed Safety is a single-channel fail-safe CPU that can be mixed with standard I/O on the same rack or PROFINET segment. Fail-safe signals are transported over PROFIsafe V2 to remote ET 200 stations. Typical catalog numbers include:

• 6ES7315-6FF04-0AB0 — CPU 315F-2 PN/DP, F-capable, 512 KB work memory, integrated PN and DP interfaces
• 6ES7317-6FF04-0AB0 — CPU 317F-2 PN/DP, 1.5 MB work memory
• 6ES7414-3FM07-0AB0 — CPU 414F-3 PN/DP for S7-400F
• 6ES7421-1FH20-0AA0 — SM 421 F-digital input module (S7-400)
• 6ES7326-2BF10-0AB0 — SM 326 F-DI 24x DC, 1oo2/2oo2 selectable
• 6ES7336-4GE00-0AB0 — SM 336 F-AI 6x 15-bit, 1oo2 redundant analog input

Achievable level: up to SIL 3 per TÜV certificate when used with PROFIsafe V2 and the approved F-library blocks.

4.2 F-CPU with S7-400H Redundancy (S7-400FH)

S7-400FH combines an S7-400H redundant pair (two synchronized CPUs with optical fiber sync links) with the F-runtime. Both CPUs execute the F-program; if one fails, the other continues without interruption. The pair has the same MTBF as a single F-CPU of the same type, because the redundancy is for availability, not for SIL improvement. Catalog numbers:

• 6ES7416-3FR05-0AB0 — CPU 416F-3 PN/DP
• 6ES7416-3HS07-0AB0 — CPU 416-3 H (combined with F-Runtime License)

Achievable level: SIL 3, with hot-standby bumpless switchover on PROFIsafe nodes. Used in continuous processes where a single CPU failure must not interrupt the safety function.

4.3 S7-1500F / S7-1500FH (TIA Portal Generation)

The current generation uses S7-1500F CPUs in STEP 7 TIA Portal V15 or later. Catalog numbers:

• 6ES7515-2FM02-0AB0 — CPU 1515F-2 PN
• 6ES7516-3FN02-0AB0 — CPU 1516F-3 PN/DP
• 6ES7517-3FP00-0AB0 — CPU 1517F-3 PN/DP
• 6ES7518-4FP00-0AB0 — CPU 1518F-4 PN/DP
• 6ES7517-3HP00-0AB0 — CPU 1517H or 1518HF for redundant SIL 3

Distributed I/O: ET 200SP HF (6ES7155-6AU30-0CN0 IM) with F-DI / F-DQ / F-AI / F-AQ modules. The PROFIsafe profile is V2.6 with 32-bit CRC and watchdog time typically configured between 10 ms and 1500 ms.

5. PROFIsafe Protocol

PROFIsafe is the safety bus profile overlaid on PROFINET (or PROFIBUS) defined in IEC 61784-3-3. The current profiles are:

The CRC is computed by the F-host CPU and checked at the F-device. Any single-bit corruption, message reordering, duplication, delay beyond the watchdog, or address mismatch triggers a fail-safe state at the F-device, independent of the standard PLC cycle. The "black channel" principle means PROFIsafe can share the same PROFINET cable as standard traffic — safety is not a property of the physical layer.

6. TÜV Certification and the F-Certificate

The TÜV certificate is the document that elevates a PLC from "general purpose" to "safety approved". The certificate covers the F-CPU, F-I/O, F-runtime, and the F-library. It defines:

• Achievable SIL (1, 2, or 3) per channel configuration
• Permissible architectures (1oo1, 1oo2, 2oo2)
• Proof test interval (typically 10 years for IEC 61508)
• Diagnostic coverage (DC) used in PFD calculation
• Safe failure fraction (SFF) per IEC 61508-2 Clause 7.4.4

The certificate is product-specific. Adding a non-certified module to the F-station invalidates the SIL claim for the entire loop. Verify the certificate is current; expired certificates (e.g., for EOL products) cannot be renewed.

7. Safety Loop Requirements: Sensor to Actuator

Achieving SIL requires every element in the loop to be fit for purpose. The typical elements and their responsibilities:

Digital input self-tests performed by Siemens F-DI modules at fixed intervals include: short-circuit test pulse, open-circuit detection, discrepancy time monitoring between dual channels, and over-temperature monitoring. Test interval is typically 1 ms to 10 ms; the result feeds the module's internal diagnostic coverage (DC ≥ 90% typical for 1oo2 F-DI). F-DQ modules monitor output voltage, leakage, and cross-fault to adjacent outputs.

8. S7 F/FH Configuration Procedure (STEP 7 Classic)

The following procedure applies to SIMATIC S7-300F / S7-400F / S7-400FH in STEP 7 V5.5 with the Distributed Safety option package (V5.4 SP5 or later). For TIA Portal, see the S7-1500F Programming Guideline.

8.1 Prerequisites

• STEP 7 V5.5 + Distributed Safety V5.4 SP5 or later
• F-CPU catalog number compatible with the installed F-Runtime license
• F-library version matched to F-Runtime (F-Blocks: FB 181 to FB 215, FC 173 to FC 188)
• TÜV certificate for the F-CPU and F-I/O on file

8.2 Step-by-Step Configuration

1. Insert the F-CPU from the hardware catalog. HW Config assigns the F-capability based on catalog data.
2. Add F-I/O modules. For each F-module, double-click and set:\ul>
3. PROFIsafe address (1–1022; must be unique per PROFINET subnet)
4. Sensor evaluation: 1oo1, 1oo2 equivalent, or 2oo2 equivalent
5. Discrepancy time for 1oo2 / 2oo2 (typically 100–3000 ms; shorter = faster fault detection but more nuisance trips on bouncing contacts)
6. Short-circuit test enable (recommended: ON; disable only for inputs driving mechanical switches where the test pulse causes contact wear)
7. Behavior on F-CPU stop: passivate the channel or hold last value
8. Compile and download HW Config to the F-CPU.
9. In the safety program (separate OB 35 / OB 82 / F-OB), call the F-application blocks:\ul>
10. F-ESTOP1 — emergency stop with optional cross-fault detection
11. F-FDBACK — feedback monitoring for actuator
12. F-DI / F-DQ — channel drivers for F-I/O access
13. F-COM — safe communication between F-CPUs (S7-400FH only)
14. Compute the F-runtime signature. This signature is unique to the program and must be logged in the safety book.
15. Sign the F-program with the safety password. TÜV witness required for first sign-off; subsequent password holders can re-sign.
16. Perform the SAT (Site Acceptance Test): force each F-input, verify the expected fail-safe state at the F-output, log results in the safety book.

9. Achievable SIL by Architecture (Siemens F-CPU)

10. Software Restrictions in F-Programs

F-runtime imposes hard restrictions that distinguish it from a standard PLC program:

• No direct bit memory, no standard timers/counters inside the F-OB. All F-tags are placed in the F-DB and accessed only through F-Blocks.
• No indirect addressing, no pointer arithmetic, no dynamic DB access.
• No standard communication blocks (PUT/GET, BSEND/BRCV). Only F-SEND / F-RCV with safe CRC.
• No use of standard organization blocks other than the F-OBs themselves.
• Constant test intervals for inputs are enforced by the F-runtime. The application code cannot suppress them.
• Modifications to the F-program require a new safety signature, password re-entry, and SAT re-execution.

These restrictions exist to maintain a deterministic, analyzable code path. IEC 61508-3 Clause 7.4 lists the techniques and measures required for the SIL claim; the F-runtime implements them at the language level so the application engineer inherits the compliance.

11. Verification: SAT and Proof Test

Verification has three levels:

1. Design verification — SIF design per IEC 61511-1 Clause 11, including PFD calculation, architecture selection, and SIF specification.
2. SAT (Site Acceptance Test) — functional verification of every SIF before plant start-up. Document the result in the safety book.
3. Proof test — periodic test to reveal undetected dangerous failures. Proof test interval is part of the PFD calculation; missing a proof test interval reduces the achieved SIL. Typical interval: 1–10 years depending on application.

12. SIL vs. PL Mapping Reference

For machine safety projects where ISO 13849-1 PL is the contract requirement, use the following mapping (from IEC 62061 Annex A and ISO 13849-1 Annex H):

The mapping is approximate; for any given SIF, calculate the achieved PL and SIL separately rather than treating them as interchangeable.

13. Troubleshooting Matrix

14. Commissioning Checklist

1. Verify F-CPU and F-I/O catalog numbers match the TÜV certificate.
2. Verify the F-Runtime version on the CPU against the F-library version in the project.
3. Verify the PROFIsafe address of every F-device is unique and matches HW Config.
4. Verify the safety program signature is recorded in the safety book.
5. Force each F-input individually; verify the expected fail-safe action at the F-output.
6. Verify passivation and re-integration behavior (does the system require manual ACK_NEC or auto-reintegrate?).
7. Verify the proof test interval is logged in the maintenance system.
8. Verify the safety password is stored per the customer's security policy.