What is PFHd?
PFHd (Probability of dangerous Failure per Hour) is the average frequency at which a safety function fails dangerously, expressed as a number per hour (1/h), and is the quantity used to determine the Performance Level (PL) under ISO 13849-1 and the SIL under IEC 62061. The smaller the PFHd, the smaller the chance that an emergency stop, light curtain or door interlock fails to act at the decisive moment. Current editions of the standards call the quantity PFH; the older name PFHd is still widely used in datasheets and in everyday safety engineering.
In an OT context, you meet PFHd when designing, buying and modifying a Safety PLC, a safety relay or sensors for functional safety.
🧠 What exactly does PFHd mean?
PFHd describes how often, on average, a safety-related control system suffers a dangerous failure: a failure that stops the safety function from working without the system moving to a safe state. A failure that actually stops the machine (a safe failure, see Fail-safe) does not count.
A PFHd of 1 × 10⁻⁷ per hour statistically means one dangerous failure per ten million operating hours of the function. That is not a guarantee for one individual machine, but an average over a large population and over the service life. ISO 13849-1 uses a standard mission time of 20 years for this calculation.
The name has changed over the years:
| Standard and edition | Abbreviation | Official description |
|---|---|---|
| ISO 13849-1:2006 and 2015 | PFHd | Average probability of dangerous failure per hour |
| IEC 62061:2005 | PFHd | Probability of dangerous failure per hour |
| IEC 62061:2021 | PFH | Average frequency of dangerous failure per hour |
| ISO 13849-1:2023 | PFH | Average frequency of a dangerous failure per hour, identical to PFH in IEC 62061 and IEC 61508 |
Technically nothing changes: it is a frequency per hour, not a probability. That is why the new editions speak of “frequency”.
🔢 Which PFHd belongs to which PL and SIL?
Each Performance Level and each high-demand SIL corresponds to a PFHd band:
| Performance Level | PFHd range (1/h) | Comparable SIL (IEC 62061 / IEC 61508) |
|---|---|---|
| PL a | ≥ 10⁻⁵ to < 10⁻⁴ | none |
| PL b | ≥ 3 × 10⁻⁶ to < 10⁻⁵ | SIL 1 |
| PL c | ≥ 10⁻⁶ to < 3 × 10⁻⁶ | SIL 1 |
| PL d | ≥ 10⁻⁷ to < 10⁻⁶ | SIL 2 |
| PL e | ≥ 10⁻⁸ to < 10⁻⁷ | SIL 3 |
| - | ≥ 10⁻⁹ to < 10⁻⁸ | SIL 4 (IEC 61508 only, not used for machinery) |
A lower PFHd therefore means a more reliable safety function. Note that a PFHd value alone is not enough. ISO 13849-1 also requires a suitable category, sufficient measures against common cause failures and control of systematic faults. IEC 62061 and IEC 61508 impose comparable architectural requirements through hardware fault tolerance.
🔄 What is the difference between PFHd and PFDavg?
PFHd applies to safety functions that are demanded frequently or act continuously, the so-called high demand mode. According to IEC 61508 this is the case when the demand rate is more than once per year. That suits machinery: a door interlock or light curtain is used many times a day.
In the process industry, a safety instrumented system is often demanded rarely, for example an overpressure trip that may need to act once every ten years. There, IEC 61511 works with PFDavg, the average probability that the function fails at the moment of demand. The required SIL then usually follows from a LOPA or HAZOP.
| Characteristic | PFHd / PFH | PFDavg |
|---|---|---|
| Mode of operation | High demand or continuous | Low demand (once per year or less) |
| Unit | Dangerous failures per hour | Dimensionless probability (0 to 1) |
| Typical standards | ISO 13849-1, IEC 62061 | IEC 61511 |
| Typical application | Machine safety, robot cells | Process protection, emergency shutdown |
| Range for SIL 1 | ≥ 10⁻⁶ to < 10⁻⁵ per hour | ≥ 10⁻² to < 10⁻¹ |
| Main drivers | MTTFd, diagnostics, architecture | Proof test interval, redundancy |
📐 How is PFHd calculated?
Under ISO 13849-1, the PFHd follows from four ingredients per channel or subsystem:
- Category (B, 1, 2, 3 or 4) - the architecture, from a single unmonitored channel to a dual-channel structure with fault detection and redundancy
- MTTFd - the mean time to dangerous failure per channel: low 3 to 10 years, medium 10 to 30 years, high 30 to 100 years (see MTTF)
- DCavg - the average diagnostic coverage: none below 60%, low 60 to 90%, medium 90 to 99%, high from 99%
- CCF - measures against common cause failures; categories 2, 3 and 4 need at least 65 out of 100 points
For a simple channel without diagnostics, the PFHd is roughly 1 divided by the MTTFd in hours. An MTTFd of 100 years (876,000 hours) thus gives about 1.14 × 10⁻⁶ per hour: PL c. For the higher categories, Annex K of the standard contains tables with the PFHd for each combination of category, MTTFd and DCavg.
For wearing parts such as a contactor or door switch, you calculate the MTTFd from the manufacturer’s B10d value: MTTFd = B10d / (0.1 × n_op), where n_op is the number of operations per year. A door that opens every two minutes therefore reduces the MTTFd of its switch considerably.
The total PFHd of a safety function is the sum of its subsystems: sensor, logic and actuator. The free SISTEMA software from the German institute IFA (part of DGUV) performs this calculation; version 3.x follows ISO 13849-1:2023, while version 2.x still follows the 2015 edition.
🔧 What does a PFHd calculation look like in practice?
An example with fictitious but realistic datasheet values: a robot cell whose access is guarded by a light curtain, with a safety PLC as the logic and two contactors as the output. The risk assessment requires PLr d.
| Subsystem | Source of the value | PFHd (1/h) |
|---|---|---|
| Type 4 light curtain | Manufacturer datasheet | 1.5 × 10⁻⁸ |
| Safety PLC with safe inputs and outputs | Manufacturer certificate | 5 × 10⁻⁹ |
| Two contactors, category 3 with feedback monitoring | Calculated from B10d, n_op and DCavg | 2.5 × 10⁻⁸ |
| Total | Sum | 4.5 × 10⁻⁸ |
The total falls within the PL e and SIL 3 band, comfortably better than the required PL d. Even so, the function only reaches PL e if the lowest category and the systematic requirements also allow it. The light curtain must also be mounted at the correct safety distance: a perfect PFHd does not help if a person can reach the hazard zone before the machine has stopped.
Typical requirements in machine building:
| Application | Usually required level | Maximum PFHd |
|---|---|---|
| Emergency stop on a packaging machine | PL c or d, per risk assessment | < 3 × 10⁻⁶ or < 10⁻⁶ |
| Door interlock on a robot cell | Often PL d, category 3 | < 10⁻⁶ |
| Safety PLC in a press installation | PL d or e | < 10⁻⁶ or < 10⁻⁷ |
| Light curtain at a manual loading station | PL d or e | < 10⁻⁶ or < 10⁻⁷ |
🏭 How does PFHd fit into European regulation?
The Machinery Directive 2006/42/EC requires control systems to be safe and reliable, but does not mention PFHd. EN ISO 13849-1 and EN IEC 62061 are harmonised standards; following them gives a presumption of conformity. EN ISO 13849-1:2023 was listed through Implementing Decision (EU) 2024/1329, and the reference to the 2015 edition is withdrawn on 15 May 2027.
From 20 January 2027 the Machinery Regulation (EU) 2023/1230 applies. It also requires safety-relevant software to be protected against corruption. A PFHd calculation does not account for an attacker: a safety PLC with an excellent PFHd can still be modified through an unprotected engineering workstation. Combine functional safety with IEC 62443 for that reason. The calculation belongs in the technical file that supports the CE marking.
✅ What are best practices for PFHd?
- Request PFHd values - use certificates or manufacturers’ SISTEMA libraries rather than estimates
- Calculate with real usage - switching frequency determines the MTTFd of wearing parts; record your assumptions
- Substantiate diagnostics - a high DCavg requires demonstrable tests, for example backed by an FMEA of the failure modes
- Look at the whole chain - a PL e component does not automatically make the function PL e
- Recalculate after changes - new components, software or cycle times go through MOC
- Replace in time - schedule replacement of wearing parts at T10d and keep an eye on the 20-year mission time
❓ Frequently asked questions
What is the difference between PFHd and PFH?
PFHd and PFH describe the same quantity: the average frequency of a dangerous failure per hour. PFHd is the name used in ISO 13849-1:2015 and IEC 62061:2005, and PFH is the name in IEC 62061:2021 and ISO 13849-1:2023. Nothing changes in the calculation or in the limit values per PL and SIL.
What PFHd is required for PL e?
For Performance Level e, the PFHd of the complete safety function must be at least 10⁻⁸ and less than 10⁻⁷ per hour. PL e also requires a suitable architecture, usually category 4 or category 3 with high MTTFd and medium diagnostic coverage. PL e corresponds to SIL 3.
Can I add up the PFHd values of components?
Yes, the PFHd of a safety function is the sum of the PFHd values of the subsystems for detection, logic and output. ISO 13849-1:2023 and IEC 62061 both describe this summation of subsystem values. If a subsystem has no PFHd value from the manufacturer, you determine it with the tables in Annex K of ISO 13849-1, based on category, MTTFd and DCavg.
Is a lower PFHd always better?
A lower PFHd means a lower chance of a dangerous failure, but reliability beyond the required level often costs extra hardware and maintenance. The goal is to reach the required PLr or SIL with a well-founded margin. An overly optimistic PFHd based on unsupported diagnostic claims is more dangerous than an honest, slightly higher value.
Which software calculates PFHd?
The most widely used tool is SISTEMA from the German institute IFA, which is free of charge, including for commercial use. Version 3.x supports ISO 13849-1:2023 and includes libraries with PFHd and B10d values from manufacturers. Suppliers of safety components also offer their own PFHd calculation aids.
Does PFHd also apply in the process industry?
In the process industry, safety functions are usually demanded rarely, and IEC 61511 then uses PFDavg instead of PFHd. PFHd applies there only to functions in high demand or continuous mode. In machine building, PFHd is the standard measure.
📌 In summary
PFHd is the average frequency of dangerous failure per hour that you use to demonstrate that a safety function achieves the required PL or SIL. The value follows from category, MTTFd, diagnostics and CCF, and bridges risk assessment and standard-compliant design under ISO 13849-1 or IEC 62061.