ANNEX II – Certificates and others

SIMATIC
Industrial software
PFDavg and PFH values for components with use in SIMATIC
Safety, Distributed Safety and F/FH Systems
Product Information

Security information
Siemens provides products and solutions with industrial security functions that support the secure operation of plants,
solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept.
With this in mind, Siemens’ products and solutions undergo continuous development. Siemens recommends strongly that
you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g. cell
protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party
products that may be in use should also be considered. You can find more information about industrial security on the
Internet (http://www.siemens.com/industrialsecurity).
To stay informed about product updates as they occur, sign up for a product-specific newsletter. You can find more
information on the Internet (http://support.automation.siemens.com).

PFDavg and PFH values for components with use in SIMATIC Safety,
Distributed Safety and F/FH Systems
This product information contains important information on the F-systems SIMATIC Safety, Distributed Safety and F/FH
Systems. The Product Information is part of the product supplied. The statements provided in it should be considered more
up-to-date than other documentation if uncertainties arise.

PFDavg and PFH values

The following tables contain the PFDavg and PFH values for individual components with use in SIMATIC Safety (S),
Distributed Safety (D) and F/FH Systems (F) with a repair time of 100 hours:
F-CPUs S7-1200/1500 Operation in low demand Operation in high demand or With a S D F
mode continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency of
dangerous failure on a dangerous failure [h-1]
demand
For all F-CPUs < 2E-05 < 1E-09 20 years x - -

© Siemens AG 2015. All rights reserved

A5E37013247-AA, 12/2015 9
S7-300/400 F-CPUs Article number Operation in low Operation in high demand With a S D F
demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
IM 151-7 F-CPU 6ES7151- < 1.5E-05 < 3.5E-10 10 years x x -
7FA21-0AB0 < 3E-05 < 3.5E-10 20 years
IM 151-8F PN/DP CPU 6ES7151- < 4E-05 < 1E-09 10 years x x -
8FB01-0AB0 < 8E-05 < 1E-09 20 years
IM 154-8F PN/DP CPU 6ES7154- < 4E-05 < 1E-09 10 years x x -
8FB01-0AB0 < 8E-05 < 1E-09 20 years
IM 154-8FX PN/DP CPU 6ES7154- < 4E-05 < 1E-09 10 years x x -
8FX00-0AB0 < 8E-05 < 1E-09 20 years
CPU 315F-2 DP 6ES7315- < 2E-05 < 5E-10 10 years x x -
6FF04-0AB0 < 4E-05 < 5E-10 20 years
CPU 315F-2 PN/DP 6ES7315- < 4E-05 < 1E-09 10 years x x -
2FJ14-0AB0 < 8E-05 < 1E-09 20 years
CPU 317F-2 DP 6ES7317- < 4E-05 < 1E-09 10 years x x -
6FF04-0AB0 < 8E-05 < 1E-09 20 years
CPU 317F-2 PN/DP 6ES7317- < 4E-05 < 1E-09 10 years x x -
2FK14-0AB0 < 8E-05 < 1E-09 20 years
CPU 317TF-3 PN/DP 6ES7317- < 4E-05 < 1E-09 10 years - x -
7UL10-0AB0 < 8E-05 < 1E-09 20 years
CPU 319F-3 PN/DP 6ES7318- < 1E-04 < 3E-09 10 years x x -
3FL01-0AB0 < 2E-04 < 3E-09 20 years
CPU 414F-3 PN/DP 6ES7414- < 4.5E-05 < 1E-09 10 years x x -
3FM06-0AB0 < 9E-05 < 1E-09 20 years
6ES7414- < 4.5E-05 < 1E-09 10 years x x -
3FM07-0AB0 < 9E-05 < 1E-09 20 years
CPU 416F-2 6ES7416- < 4.76E-05 < 1.09E-09 10 years x x -
2FN05-0AB0 < 9.52E-05 < 1.09E-09 20 years
6ES7416- < 4.5E-05 < 1E-09 10 years x x -
2FP07-0AB0 < 9E-05 < 1E-09 20 years
CPU 416F-3 PN/DP 6ES7416- < 4.5E-05 < 1E-09 10 years x x -
3FS06-0AB0 < 9E-05 < 1E-09 20 years
6ES7416- < 4.5E-05 < 1E-09 10 years x x -
3FS07-0AB0 < 9E-05 < 1E-09 20 years
CPU 410-5H 6ES7410- < 1.9E-04 < 4.3E-09 10 years - - x
5HX08-0AB0 < 3.8E-04 < 4.3E-09 20 years
< 2.8E-04* < 6.3E-09* 10 years - - x
< 5.6E-04* < 6.3E-09* 20 years
CPU 412-5H PN/DP 6ES7412- < 1.9E-04 < 4.3E-09 10 years - - x
5HK06-0AB0 < 3.8E-04 < 4.3E-09 20 years
CPU 414-5H PN/DP 6ES7414- < 1.9E-04 < 4.3E-09 10 years - - x
5HM06-0AB0 < 3.8E-04 < 4.3E-09 20 years

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
10 A5E37013247-AA, 12/2015
S7-300/400 F-CPUs Article number Operation in low Operation in high demand With a S D F
demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
CPU 416-5H PN/DP 6ES7416- < 1.9E-04 < 4.3E-09 10 years - - x
5HS06-0AB0 < 3.8E-04 < 4.3E-09 20 years
CPU 417-5H PN/DP 6ES7417- < 1.9E-04 < 4.3E-09 10 years - - x
5HT06-0AB0 < 3.8E-04 < 4.3E-09 20 years
WinAC RTX F based controller < 1E-04 < 3E-09 10 years x x -
* With use in an extended temperature range up to max. 70°C.

Safety-related communication Operation in low Operation in high demand With a S D F

demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
< 1E-05* < 1E-09* 20 years x x x
* Note on S7-300/400 F-CPUs:
The PFDavg value is valid under the assumption that a maximum of 25 F-I/Os are involved in a safety function. If more than
25 F-I/OS are used, you need to add 3.5E-7 per F-I/O for this safety function.
The PFH value is valid under the assumption that a maximum of 100 F-I/Os are involved in a safety function. If more than
100 F-I/OS are used, you need to add a 4E-12 for each F-I/O for this safety function.

S7-1200 F-I/O Article number Operation in low Operation in high demand With a S D F
demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
SM 1226 6ES7226- SIL 2: < 5E-04 SIL 2: < 1E-08 20 years x - -
F-DI 16 x 24 VDC 6BA32-0XB0 SIL 3: < 1E-05 SIL 3: < 1E-10
SM 1226 6ES7226- SIL 3: < 1E-05 SIL 3: < 4E-09 20 years x - -
F-DQ 4 x 24 VDC 6DA32-0XB0
SM 1226 F-DQ 2 x Relay 6ES7226- SIL 3: < 1E-05 SIL 3: < 4E-09 20 years x - -
6RA32-0XB0

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
A5E37013247-AA, 12/2015 11
ET 200SP F-I/O Article Operation in low Operation in high demand With a S D F
number demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
F-DI 8x24VDC HF 6ES7136- SIL 3: < 2E-05 SIL 3: < 1E-09 20 years x x -
6BA00-0CA0
F-DQ 4x24VDC/2A PM HF 6ES7136- SIL 3: < 2E-05 SIL 3: < 1E-09 20 years x x -
6DB00-0CA0
F-PM-E 24VDC/8A PPM ST 6ES7136- SIL 3: < 2E-05 SIL 3: < 1E-09 20 years x x -
6PA00-0BC0
F-RQ 6ES7136- SIL 2: < 1E-04 SIL 2: < 1E-08 20 years x x -
1x24VDC/24..230VAC/5A 6RA00-0BF0 With function test 1x per With function test 1x per
year year
SIL 3: < 1E-05 SIL 3: < 6E-09 20 years x x -
With function test 1x per With function test 1x per
month month

S7-300/ET 200M F-I/O Article Operation in low Operation in high demand With a S D F
number demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
SM 326; DI 24 x DC24V 6ES7326- SIL 2: < 8E-04 SIL 2: < 1E-08 20 years x x x
1BK02-0AB0 (alternative: SIL 2: < 1E- SIL 3: < 1E-09
05 + 3.5E-05 per input)
SIL 3: < 2E-05
SM 326; DI 8 x NAMUR 6ES7326- SIL 2: < 1E-03 SIL 2: < 2E-08 20 years x x x
1RF01-0AB0 (alternative: SIL 2: < 2E- SIL 3: < 1E-09
05 + 1.3E-04 per input)
SIL 3: < 3E-05
SM 326; 6ES7326- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
F-DO 10 x DC 24V/2A PP 2BF10-0AB0
SM 326; DO 8 x DC 24V 6ES7326- SIL 3: < 1E-05 SIL 3: < 3E-09 20 years x x x
/2A PM 2BF41-0AB0
SM 336; 6ES7336- 1-channel: 1-channel: 20 years x x x
F-AI 6 x 0/4…20mA HART 4GE00-0AB0 SIL 3: < 1E-04 SIL 3: < 1E-08
2-channel: 2-channel:
SIL 3: < 1E-05 SIL 3: < 1E-09

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
12 A5E37013247-AA, 12/2015
ET 200S F-I/O Article number Operation in low Operation in high demand With a S D F
demand mode or continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency
dangerous failure on of a dangerous failure [h-1]
demand
4/8 F-DI DC24V 6ES7138-4FA05- SIL 2: < 1E-03 SIL 2: < 1E-08 20 years x x x
PROFIsafe 0AB0 SIL 3: < 1E-05 SIL 3: < 1E-09
4 F-DO DC24V/2A 6ES7138-4FB04- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
PROFIsafe 0AB0
4 F-DI/3 F-DO DC24V 6ES7138-4FC01- SIL 2: < 1E-03 SIL 2: < 1E-08 20 years x x x
PROFIsafe 0AB0
PM-E F pm DC24V 6ES7138-4CF03- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
PROFIsafe 0AB0
PM-E F pp DC24V 6ES7138-4CF42- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
PROFIsafe 0AB0
PM-D F DC24V 3RK1 903-3BA02 SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
PROFIsafe
With a mission time of 20 years, the following values apply to the 1 F-RO DC24V/AC24..230V/5A 6ES7138-4FR00-0AA0:
Load according Current Max. permitted Operation in low demand Operation in high demand or S D F
to actions mode continuous mode
IEC 60947-5-1 low demand mode high demand/continuous mode
DC13/AC15
According to IEC 61508:2010: According to IEC 61508:2010:
PFDavg = Average probability PFH = Average frequency of a
of a dangerous failure on dangerous failure [h-1]
demand
DC13 I <= 5A Max. 1 action SIL 3: < 4E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 3 actions SIL 3: < 1,2E-04 SIL 3: < 2E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
I <= 2.5A Max. 1 action SIL 3: < 3E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 3 actions SIL 3: < 8E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
I <= 1.25A Max. 1 action SIL 3: < 2E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 3 actions SIL 3: < 5E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 1 action — SIL 3: < 8E-09 x x x
permitted per With function test 1x per
hour month

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
A5E37013247-AA, 12/2015 13
Load according Current Max. permitted Operation in low demand Operation in high demand or S D F
to actions mode continuous mode
IEC 60947-5-1 low demand mode high demand/continuous mode
DC13/AC15
According to IEC 61508:2010: According to IEC 61508:2010:
PFDavg = Average probability PFH = Average frequency of a
of a dangerous failure on dangerous failure [h-1]
demand
AC15 I <= 3A Max. 1 action SIL 3: < 2E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 3 actions SIL 3: < 5E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 1 action — SIL 3: < 7E-09 x x x
permitted per With function test 1x per
hour month
I <= 1.5A Max. 1 action SIL 3: < 1E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 3 actions SIL 3: < 3E-05 SIL 3: < 1E-09 x x x
permitted per With function test 1x per With function test 1x per
day month month
Max. 1 action — SIL 3: < 4E-09 x x x
permitted per With function test 1x per
hour month

F-I/O ET 200pro Article number Operation in low demand Operation in high demand or With a S D F
mode continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency of
dangerous failure on a dangerous failure [h-1]
demand
8/16 F-DI DC24V 6ES7148- SIL 2: < 1E-03 SIL 2: < 2E-08 20 years x x x
PROFIsafe 4FA00-0AB0 SIL 3: < 2E-05 SIL 3: < 1E-09
4/8 F-DI/ 6ES7148- SIL 2: < 1E-03 SIL 2: < 1E-08 20 years x x x
4 F-DO DC24V/2A 4FC00-0AB0 SIL 3: < 2E-05 SIL 3: < 1E-09
PROFIsafe
F-Switch PROFIsafe 6ES7148- SIL 2: < 1E-03 SIL 2: < 1E-08 20 years x x x
4FS00-0AB0 SIL 3: < 1E-05 SIL 3: < 1E-09

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
14 A5E37013247-AA, 12/2015
F-I/O ET 200eco Article number Operation in low demand Operation in high demand or With a S D F
mode continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency of
dangerous failure on a dangerous failure [h-1]
demand
4/8 F-DI DC24V 6ES7148- SIL 2: < 8E-04 SIL 2: < 1E-08 20 years x x x
PROFIsafe 3FA00-0XB0 SIL 3: < 1E-05 SIL 3: < 1E-09

F-I/O ET 200iSP Article number Operation in low demand Operation in high demand or With a S D F
mode continuous mode mission
low demand mode high demand/continuous time of
According to IEC mode
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency of
dangerous failure on a dangerous failure [h-1]
demand
EM138 6ES7138- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
8 F-DI Ex NAMUR 7FN00-0AB0
EM138 4 F-DO 6ES7138- SIL 3: < 1E-05 SIL 3: < 1E-09 20 years x x x
Ex 17,4V/40mA 7FD00-0AB0
EM138 4 F-AI 6ES7138- 1-channel: 1-channel: 20 years x x x
Ex HART 7FA00-0AB0 SIL 3: < 1E-04 SIL 3: < 1E-08
2-channel: 2-channel:
SIL 3: < 1E-05 SIL 3: < 1E-09

Fail-safe GSD based DP slaves Operation in low demand Operation in high demand or With a S D F
Fail-safe GSD based IO devices mode continuous mode mission
low demand mode high demand/continuous time of
Fail-safe PA field devices
According to IEC mode
Fail-safe HMI devices
61508:2010: According to IEC
PFDavg = Average 61508:2010:
probability of a PFH = Average frequency of
dangerous failure on a dangerous failure [h-1]
demand
Fail-safe GSD based DP slaves: See Technical Data for fail-safe GSD based DP slave
Fail-safe GSD based IO devices: See Technical Data for fail-safe GSD based IO device
Fail-safe PA field devices: See Technical Data for fail-safe PA field device
Fail-safe HMI devices: See technical specifications on the fail-safe HMI device
Other fail-safe devices: See technical specifications on the fail-safe device

Determine the contribution of the F-system to the PFDavg and PFH values
The contribution of the fail-safe system to the PFDavg and PFH values of a safety function is determined by adding the
PFDavg- and PFH values of the F-CPUs and F-I/Os involved.
The contribution of the safety-related communication is added to this. Please note that several F-systems can be involved in
a safety function.
You determine the PFDavg and PFH values of a safety function by adding the contribution of the fail-safe system to the
contribution of the encoders and actuators involved in the safety function.

PFDavg and PFH values for components with use in SIMATIC Safety, Distributed Safety and F/FH Systems
A5E37013247-AA, 12/2015 15
Calculation example
A safety function is implemented with a SIMATIC Safety F-system. The F-CPU and F-I/O listed in the following table are
involved in the safety function.
20 years was selected as the mission time. The fail-safe signal modules operate in safety mode for SIL3/Kat.4/PLe.
Operation is in high demand mode:
F-CPU, F-SMs and safety-related Quantity Operation in high demand or continuous mode
communication involved in the safety function high demand/continuous mode
According to IEC 61508:2010:
PFH = Average frequency of a dangerous failure [h-1]
CPU 319F-3 PN/DP 1 3E-09
6ES7318-3FL01-0AB0
SM 326; DO 10 ☓ DC 24V/2A 1 1E-09
6ES7326-2BF10-0AB0
SM 326; DI 24 ☓ DC 24V 2 2E-09
6ES7326-1BK02-0AB0
Safety-related communication 1E-09
Total 7E-09

Siemens AG
Division Digital Factory
Postfach 48 48
90026 NÜRNBERG
GERMANY

PFDavg and PFH values for components withPFH

PFDavg and use in SIMATIC
values Safety, Distributed
for components with useSafety and F/FH
in SIMATIC Systems
Safety, Distributed Safety and F/FH Systems
A5E37013247-AA,
16 12/2015 A5E37013247-AA, 12/2015