Safety programmable controller (SIL 3 / PL e safety PLC)
Safety-rated programmable controllers · SIL 3 and PL e CPUs with dual-channel processing, safe inputs and OSSD outputs, PFH values, mission time and safety response time
A safety programmable controller is a PLC built and certified to execute safety functions, such as emergency stop, guard door and light curtain monitoring, so that a dangerous fault drives the machine to a safe state. Unlike a standard PLC it uses redundant processing and continuous self-diagnostics, and it is sold with published failure data for the safety calculation. Ask three things first: which SIL under IEC 61508 or IEC 62061 and which PL under ISO 13849-1 it is certified to, what PFH and mission time its certificate gives for the configuration you will use, and how many safe inputs and safe outputs (OSSD pairs) it brings and how they expand.
Safety-rated programmable controllers: safety CPUs and programmable modular safety controllers with safe digital inputs and outputs, certified to SIL and PL ratings for machine and process safety functions. Standard PLCs, with CPU selection, expansion counting and 24 V budgeting, are covered on the Programmable logic controller page; redundant hot-standby PLCs for availability, assembled PLC control cabinets and fieldbus remote I/O are covered on their own pages. Safety relays with fixed functions and safety sensors are outside this page.
CNFX editorial research · Sources checked October 12, 2026 · 3 sources
Read the SIL, PL and PFH for the configuration you will run
Rockwell Automation's GuardLogix 5580 safety data distinguish a single-channel (1oo1) SIL 2 system from a dual-channel (1oo2) SIL 3 system. The controller with its safety partner is listed at a PFH of 7.38E-11 per hour and a PFDavg of 6.46E-06 over a 20-year mission time; the controller alone is listed at 6.40E-09 and 5.61E-04. [1]
Rockwell states the useful life of GuardLogix controllers as 20 years, assumes that all detected failures lead to the safe state and that no proof test is needed within that life, and says the failure rates are valid for ambient temperatures up to 70 °C and altitudes up to 2,000 m. [1] Editorial calculation: 6.40E-09 ÷ 7.38E-11 ≈ 87, so in Rockwell's table the 1oo2 pairing lowers the PFH by a factor of about 87 compared with the controller alone. [1]
ABB describes its AC500-S as a safety PLC that uses 1oo2 hardware redundancy and extra diagnostics, certified by TÜV SÜD Rail up to SIL 3 (IEC 61508), maximum SIL 3 (IEC 62061) and PL e (ISO 13849-1), with a proof test interval set to 20 years. Its safety value table gives the SM560-S safety CPU a diagnostic coverage of 97%, an MTTFd of 1,280 years, a PFHd of 1.90E-09 under IEC 62061 and 8.95E-11 under IEC 61508 (high demand), a PFDavg of 7.90E-06, and a safe failure fraction of 98%. [2]
ABB warns that these values are calculated at an average temperature of +40 °C for both its 0 to +60 °C and –40 to +70 °C ranges, and that the average operating temperature must not exceed +40 °C. It also shows how configuration changes the rating: outputs of its DX581-S module are SIL 3 / PL e with output detection on, but SIL 2 / PL d, with a PFHd of 1.19E-08, with detection off. [2]
Give the supplier the safety functions and their required SIL and PL, the demand mode, the number and type of safety sensors and actuators, the safe outputs and their loads, the fieldbus or safety network to the standard PLC, cabinet temperature, the mission time you plan, and the certificates and safety manual you need.
02
Count safe inputs, OSSD output pairs and expansion
Schmersal's PSC1 programmable modular safety controller, as listed by AutomationDirect, processes signals from emergency stop switches, guard door switches, light curtains and other safety switchgear, with modular expansion to up to 216 inputs and outputs and safety functions up to SIL 3 (IEC 61508 / IEC 62061), PL e and Category 4 (EN ISO 13849-1). [3]
Each base unit carries 14 safe digital inputs, two pairs of PNP solid-state safety outputs (four single channels, 2 A each, derated above 30 °C), and two single-channel relays rated 2 A at 230 V AC or 24 V DC. A PSC1-10 takes up to two expansion modules, for at most 38 safety inputs and 20 configurable safe inputs/outputs; a PSC1-100 takes up to eight, for at most 110 safety inputs and 100 configurable safe inputs/outputs. [3]
The listing gives a supply range of 20.4–28.8 V DC, operating temperature of 0–50 °C, IP20, a 20-year mission time and PFH values of 1.22–1.26 × 10⁻⁸ per hour for the controllers, and notes that the minimum cycle (response) time set in the software depends on the number of expansion units connected. FB10 variants add EtherCAT, PROFINET and EtherNet/IP and FB10-MT variants Modbus TCP. [3]
03
Published safety data side by side
Values are taken from each maker's document for the named configuration; they are not interchangeable between products.
Explore company information and manufacturing capabilities, then discuss the scope of your project with a relevant supplier.
Share this page
Compiled and source-reviewed by the CNFX editorial team.
Each manufacturer above links to the page on that company's own website where the product is listed, with the date we checked it. How we source and review
· Page last updated 13 October 2026
Buyer questions
What PFH does a SIL 3 safety controller list?
Rockwell lists GuardLogix 5580 with safety partner at 7.38E-11 per hour; ABB lists its SM560-S CPU at 8.95E-11 under IEC 61508. [1][2]
Do safety PLCs need proof testing?
Rockwell assumes no proof test is needed within the 20-year useful life of GuardLogix; ABB sets the AC500-S proof test interval to 20 years. [1][2]
How many safe I/O can a modular safety controller take?
Schmersal's PSC1 expands to up to 216 inputs and outputs; a PSC1-100 with eight expansion modules reaches 110 safety inputs. [3]
Sources and what still needs a direct check
Sources checked 2026-10-12. Rockwell Automation, ABB and Schmersal are makers publishing safety data for their own controllers; the Schmersal data come from AutomationDirect's catalogue listing. Certificates and the original safety manuals govern any safety calculation.
