SIL Calculation with PFD and PFH for Siemens S7 F-CPU Safety

SIL Calculation with PFD and PFH for Siemens S7 F-CPU Safety Systems

1. Overview

Safety Integrity Level (SIL) verification of a SIMATIC S7 F-system requires quantitative proof that the average Probability of Failure on Demand (PFD_avg) or the average Probability of Failure per Hour (PFH_avg) of the Safety Instrumented Function (SIF) falls inside the target band defined by IEC 61508-1 for the demanded SIL. The calculation must combine:

• The dangerous undetected failure rate (λ_DU) and dangerous detected failure rate (λ_DD) of every F-CPU, F-I/O, sensor, and final element that participates in the function.
• The diagnostic coverage (DC) of each subsystem, as proven in the manufacturer's FMEDA report.
• The common cause failure (CCF) factor β for the chosen channel architecture.
• The proof test interval (T_proof) for low-demand mode or the dangerous exposure time for high-demand/continuous mode.

Siemens publishes the SIL/PFD/PFH values for every F-CPU (CPU 315F-2 PN/DP, CPU 317F-2 PN/DP, CPU 319F-3 PN/DP, CPU 416F-2, CPU 416F-3 PN/DP, CPU 417F-4 PN/DP) and for every F-module (ET 200S, ET 200SP, ET 200MP, ET 200pro) in the relevant product manuals and the TÜV-certified SIMATIC Safety – Integrated Safety Application Note. A working source for these values is the Siemens Industry Online Support portal, entry ID 27832836 ("PFD and PFH values for SIMATIC F-modules").

2. SIL Target Bands per IEC 61508-1

Select the appropriate target band based on the demand rate of the SIF. The same SIL can be reached in either PFD_avg or PFH_avg depending on whether the SIF operates in low-demand (≤ 1 demand/year) or high-demand/continuous mode.

If the SIF runs in mixed mode, calculate both metrics and use the stricter of the two as the binding value.

3. PFD / PFH Architecture Formulas

Each voting architecture in IEC 61508-6 gives a closed-form PFD/PFH expression. The most common architectures for S7 F-CPU SIFs are summarized below. Use T = T_proof for low-demand PFD calculations, and assume a Mean Time To Restoration (MTTR) of 8 h for high-demand PFH if a shorter value cannot be justified.

For high-demand mode, the analogous PFH expressions replace (λ_DU × T)/2 with λ_DU directly, and the squared terms reduce to (1 − β) × λ_DU for the cross-failure component. The full tables are in IEC 61508-6, Annex B.

4. Subsystem Combination Rules

Total PFD_avg,tot of a SIF is the sum of the PFD_avg of the sensor subsystem, the logic subsystem, and the final element subsystem, because the failures are independent (separated by barriers, different physical locations, different power feeds):

PFDavg,tot = PFDavg,Sensor + PFDavg,Logic + PFDavg,FinalElement

The 100-1 rule (IEC 61511-1 §11.5) allocates at least 1 % and at most 35 % of the total PFD_avg budget to any single subsystem. When the SIF mixes 1oo1 and 1oo2 sub-channels, compute the per-channel PFD first, then combine with the CCF beta factor for the redundant part.

For an F-CPU logic subsystem, use the manufacturer-published value for the CPU plus the F-DI/F-DO combination:

PFDavg,Logic = PFDCPU + PFDF−DI + PFDF−DO

5. Siemens F-CPU and F-Module Portfolio

Confirm the firmware/F-toolkit version because the SIL-conformant PFD/PFH values are only valid when the F-CPU runs the correct F-library and the F-modules are configured per the certified parameter sets. Match the version pair below.

For each part number, Siemens provides an individual FMEDA-based PFH/PFD value, plus safe failure fraction (SFF) and DC numbers in the product manual. The TÜV certificate number (e.g., Z10 09 03 10089 002 for S7-300F) is printed in the manual cover page and must be referenced in the verification report.

6. Where to Obtain Manufacturer PFD/PFH Values

Siemens maintains a consolidated list of PFD/PFH values for all certified F-modules in the SIMATIC Safety Application Note, available through Siemens Industry Online Support (search term "PFD PFH SIMATIC Safety"). The same values are also embedded in the Safety Evaluation Tool (SET), which is a TÜV-certified calculation spreadsheet.

Two procedures are accepted in a TÜV report:

1. Direct quotation from the manufacturer manual: cite the manual edition, the table number, and the page. For S7-400F, the values are in the manual "SIMATIC S7-400F and S7-400FH – Safety Engineering" (entry ID 12405836 in Siemens support).
2. Calculation with the Safety Evaluation Tool: open the SET project, import the PFD/PFH of each module, and export the calculation as a PDF signed with the TÜV stamp. The exported PDF is treated as primary evidence by certification auditors.

7. Safety Evaluation Tool Workflow

The Safety Evaluation Tool (SET) is the TÜV-certified spreadsheet shipped by Siemens for the verification of safety functions built with SIMATIC F-modules. Recommended sequence:

1. Open a new SIF project and enter the SIL target (e.g., SIL 2, PFD_avg ≤ 10⁻², PFH_avg ≤ 10⁻⁶).
2. Insert the sensor subsystem. Choose the architecture (1oo1, 1oo2, 2oo2, 2oo3). Enter the sensor λ_DU, DC, and T_proof. For Siemens F-DI modules, the values are auto-filled from the module catalog.
3. Insert the logic subsystem. Pick the F-CPU from the catalog; pick the F-DI and F-DO modules. The tool automatically sums the PFD/PFH of all logic components.
4. Insert the final element (valve, contactor, drive). Enter its λ_DU, β, and T_proof.
5. Apply the 100-1 rule check. The tool highlights any subsystem that exceeds 35 % of the SIL budget.
6. Export the calculation as PDF and append the F-configuration printout, the F-signature, and the TIA / STEP 7 hardware configuration.

8. Handling Non-Failsafe Analog Outputs

As of the current SIMATIC portfolio, several F-analog input modules exist (e.g., ET 200SP F-AI 4xI 0(4)-20mA HF, 6ES7 136-6PA00-0CA0), but the catalog of F-analog outputs is more limited. If a SIF must drive a 4–20 mA control valve from an S7 F-CPU, two architectures are accepted by TÜV:

1. Standard analog output plus downstream safety relay: A standard 6ES7 135-4GB01-0AB0 (SM 332 AO 8) generates the setpoint; a downstream hard-wired safety relay (e.g., 3SK1 SIRIUS or 3RK3 MSS) performs the shutdown. The standard AO is not part of the SIF; only the safety relay and the wiring carry the SIL PFD budget.
2. F-DO pulse-width + external I/P converter: An F-DO 6ES7 136-6DC00-0CA0 generates a pulse-width signal; a current-to-pressure converter or a positioner with safety certificate handles the SIL function. The F-DO enters the PFD budget; the converter enters as the final element.

9. Risk Graph and LOPA for Target SIL Determination

Before the PFD/PFH calculation, the required SIL must be derived from a risk assessment. The two methods accepted by IEC 61511 are:

• Risk graph – A semi-quantitative matrix (consequence severity C, exposure frequency F, possibility of avoidance A, probability of occurrence W) that yields the required SIL directly. The four-parameter variant in IEC 61511-1 §8.2.2 is the most common.
• Layer of Protection Analysis (LOPA) – A quantitative method that counts independent protection layers (IPLs) against a target tolerable frequency. The remaining gap between process risk and tolerable risk defines the required SIL of the SIF.

For a SIL 2 target with a tolerable event frequency of 10⁻⁶ per year, a process frequency of 10⁻² per year, and two independent IPLs each credited with a 10× reduction, the SIF must deliver a PFD_avg between 10⁻³ and 10⁻². The 100-1 rule then splits the 10⁻³ budget between sensor, logic, and final element.

Detailed LOPA and risk-graph worksheets are in the ABB technical paper "SIL methodology – a methodology for SIL verification" (document 9AKK1074920701), which also covers the use of fault-tree analysis for SIL selection. Cross-reference the ABB document when the SIF overlaps both process and machine safety (IEC 61511 + IEC 62061).

10. Worked Example: SIL 2 SIF with S7-300F

Target: SIL 2 in low-demand mode, T_proof = 5 years (43 800 h).

Subsystems:

• Sensor: 1oo2 pressure transmitter, λ_DU = 2 × 10⁻⁷ /h, β = 5 %.
• Logic: CPU 315F-2 PN/DP (6ES7 315-6TH13-0AB0) with SM 326F-DI (6ES7 326-1BK02-0AB0) and SM 326F-DO (6ES7 326-2BF01-0AB0). From the manual, PFD_CPU+DI+DO = 6.0 × 10⁻⁵.
• Final element: 1oo2 solenoid valve, λ_DU = 5 × 10⁻⁷ /h, β = 5 %, T_proof = 5 years.

Step 1 – Sensor PFD_avg (1oo2, T = 43 800 h):

PFDSensor = (1 − 0.05)² × (2×10⁻⁷ × 43 800)² / 3 + 0.05 × (2×10⁻⁷ × 43 800) / 2

≈ 1.36 × 10⁻⁴ + 2.19 × 10⁻³ ≈ 2.32 × 10⁻³

Step 2 – Logic PFD_avg (from Siemens manual):

PFDLogic = 6.0 × 10⁻⁵

Step 3 – Final element PFD_avg (1oo2):

PFDFE = (1 − 0.05)² × (5×10⁻⁷ × 43 800)² / 3 + 0.05 × (5×10⁻⁷ × 43 800) / 2

≈ 8.5 × 10⁻⁴ + 5.5 × 10⁻³ ≈ 6.35 × 10⁻³

Step 4 – Total:

PFDtot = 2.32×10⁻³ + 6.0×10⁻⁵ + 6.35×10⁻³ = 8.73 × 10⁻³

Step 5 – Compare to SIL 2 band (10⁻³ to 10⁻²): 8.73 × 10⁻³ is inside the band, but the final element is at 73 % of the budget and violates the 100-1 rule. Tighter solutions:

• Shorten T_proof on the valve to 2 years, which drops PFD_FE to ≈ 2.5 × 10⁻³.
• Switch the sensor from 1oo2 to 2oo2 with annual proof test, dropping PFD_Sensor below 5 × 10⁻⁴.
• Add an external safety relay as a fourth IPL (LOPA credit, not SIF credit).

11. Diagnostic Coverage and CCF Considerations

Diagnostic coverage is the fraction of dangerous failures detected by automatic diagnostics. S7 F-CPUs self-diagnose the CPU, the F-bus (PROFIsafe), and the F-module-internal logic; this yields DC ≥ 90 % for most logic faults. Sensor and final element DC must be calculated from the FMEDA, with values of 60 %–90 % typical for solenoid valves and 70 %–95 % for certified pressure transmitters.

Common cause failure β is non-zero for redundant channels. The IEC 61508 default is β = 10 %; Siemens accepts β = 5 % for F-DI/DO on PROFIsafe with diversified routing and TÜV-checked separation. Document the CCF scorecard (separation, diversity, training, environment) in the verification report per IEC 61508-2 Annex E.

12. Verification, Documentation, and Audit

1. Generate the Safety Evaluation Tool PDF and attach the TÜV certificate number of the F-CPU family.
2. Cross-check the TIA / STEP 7 hardware configuration: F-CPU part number, F-library version, F-block signature (F_CRASH, F_STOP, F_FDBACK, F_TIME logic block family for ET 200SP F).
3. Attach the field wiring drawing showing 24 V supply separation, shield grounding at one end, and channel-by-channel labeling per IEC 61508-2.
4. Capture the F-signature (CSE:CRC over the F-block DB) and archive it for 20 years – the value must match the design-basis number stored in the F-CPU.
5. Record the proof test interval and schedule the next proof test in the CMMS.
6. For TÜV submission, also include the FMEDA excerpt and the IEC 62061 "Practical Application" example document (Siemens support entry ID 23996473) where machine safety is involved.

13. Common Pitfalls

14. Reference Documents and Standards

• IEC 61508 (parts 1–7): Functional safety of E/E/PE systems – the basis for SIL bands and architectural constraints.
• IEC 61511 (parts 1–3): Functional safety – Safety Instrumented Systems for the process industry sector.
• IEC 62061: Functional safety of safety-related control systems for machinery – used together with EN ISO 13849-1.
• Siemens Industry Online Support – SIMATIC Safety manuals and entry ID 27832836 (PFD/PFH values) and 23996473 (IEC 62061 example with S7 Distributed Safety).
• ABB technical paper "SIL methodology – a methodology for SIL verification" (document 9AKK1074920701), covering LOPA, fault tree, and risk graph selection of the required SIL.