ISO 13849 MTTFd Explained – Mean Time to Dangerous Failure
Reliability is an important part of evaluating safety-related control systems according to ISO 13849.
One of the key parameters used for this purpose is MTTFd – Mean Time to Dangerous Failure.
MTTFd describes the expected reliability of a component or channel with respect to failures that can lead to a dangerous condition. Together with the selected Category, Diagnostic Coverage and measures against Common Cause Failures, it contributes to determining the achieved Performance Level of a safety function.
This article explains what MTTFd means, how it is classified and how it fits into the overall ISO 13849 Performance Level evaluation.
What Does MTTFd Mean in ISO 13849?
MTTFd stands for Mean Time to Dangerous Failure.
It is a statistical reliability parameter describing the expected mean operating time before a dangerous failure occurs.
The important word is dangerous.
ISO 13849 is not simply interested in how often a component fails. It is particularly concerned with failures that can impair the ability of the safety-related control system to perform its required safety function.
For example, consider a safety-related switching element used to remove power from a hazardous machine drive.
A failure that prevents the machine from operating may result in downtime, but it does not necessarily represent a dangerous failure.
A failure that prevents the switching element from removing power when the safety function is demanded can, however, be safety-critical.
MTTFd therefore focuses specifically on the reliability of components and channels with respect to dangerous failure modes.
MTTF vs MTTFd – What Is the Difference?
MTTF and MTTFd are related reliability concepts, but they should not be treated as identical.
MTTF – Mean Time to Failure
describes the expected mean time until a failure occurs.
MTTFd – Mean Time to Dangerous Failure
considers specifically those failures classified as dangerous with respect to the safety function.
This distinction is essential in Functional Safety.
A component can have several possible failure modes, and not every failure necessarily creates a dangerous situation.
The safety-related analysis therefore needs to consider which failure modes can prevent the required safety function from being performed.
Why Is MTTFd Important for the Performance Level?
The achieved Performance Level of a safety function cannot be determined from the architecture alone.
A simplified relationship is:
Category + MTTFd + DCavg + CCF + Systematic Measures → Achieved Performance Level
MTTFd represents the reliability contribution within this evaluation.
A system architecture may provide redundancy and diagnostics, but the reliability of the components used within the individual channels remains important.
In general, components with a higher MTTFd have a lower expected rate of dangerous failures.
However:
A high MTTFd alone does not guarantee a high Performance Level.
The complete architecture and the other relevant ISO 13849 parameters must still be evaluated.
The Three MTTFd Classes in ISO 13849
For Performance Level evaluation, ISO 13849 classifies MTTFd into three ranges:
| MTTFd Classification | MTTFd Range |
|---|---|
| Low | 3 years ≤ MTTFd < 10 years |
| Medium | 10 years ≤ MTTFd < 30 years |
| High | 30 years ≤ MTTFd ≤ 100 years |
These classifications make it easier to combine component or channel reliability with architectural Category and Diagnostic Coverage during Performance Level evaluation.
Low MTTFd
A low MTTFd represents the lowest of the three reliability classes.
The estimated mean time to dangerous failure is between 3 and less than 10 years.
Depending on the architecture and other parameters, this can limit the achievable Performance Level.
Medium MTTFd
A medium MTTFd represents an intermediate level of reliability.
The estimated mean time to dangerous failure is between 10 and less than 30 years.
This range is frequently relevant when evaluating practical safety-related control architectures.
High MTTFd
A high MTTFd represents the highest MTTFd class used for the Performance Level evaluation.
The range is:
30 years ≤ MTTFd ≤ 100 years
Values above 100 years are generally limited to 100 years for the relevant calculation approach.
This limitation is important because an unrealistically high calculated reliability value should not be used to compensate indefinitely for weaknesses elsewhere in the safety-related design.
Does an MTTFd of 100 Years Mean the Component Will Last 100 Years?
No.
This is one of the most important misconceptions surrounding MTTFd.
An MTTFd of 100 years does not mean that a specific component will operate for 100 years before it fails.
MTTFd is a statistical reliability parameter, not a guaranteed service life.
It represents expected failure behavior across a population of components under defined assumptions and operating conditions.
Individual components can fail much earlier or much later.
MTTFd should therefore not be interpreted as:
Component Lifetime = MTTFd
Other concepts such as mission time, useful life, maintenance intervals and manufacturer specifications must be considered separately where relevant.
How Is MTTFd Determined?
The method used to determine MTTFd depends on the component and the available reliability information.
Several sources can be relevant.
Manufacturer Reliability Data
For many safety-related components, manufacturers provide reliability information that can support ISO 13849 calculations.
This can significantly simplify the engineering evaluation, particularly for established safety components.
However, engineers still need to ensure that the data is applicable to the actual operating conditions and intended use.
Reliability Data from Standards or Databases
Where appropriate manufacturer data is unavailable, suitable reliability data from recognized sources may be used according to the applicable methodology.
The selected values and assumptions should be documented and technically justified.
Calculation from Component Failure Data
For electronic components, MTTFd can be related to the dangerous failure rate.
In a simplified conceptual form:
MTTFd ≈ 1 / λd
where:
λd = dangerous failure rate
This relationship illustrates an important principle:
A lower dangerous failure rate results in a higher MTTFd.
The actual evaluation must use appropriate reliability data and the methods applicable to the component and architecture being analyzed.
MTTFd for Mechanical and Electromechanical Components
Not every component is primarily characterized by operating hours.
Mechanical, hydraulic, pneumatic and electromechanical components may be strongly influenced by the number of operating cycles.
Examples include:
- contactors
- relays
- valves
- mechanical switches
For such components, parameters such as B10d can become relevant.
B10d represents the number of cycles at which 10% of a population of components have failed dangerously under specified conditions.
The operating frequency of the component can then be used to derive an MTTFd value.
This is important because the same component can produce different reliability results depending on how frequently it is operated.
A contactor switching once per hour experiences a very different operating profile from one switching several times per minute.
From B10d to MTTFd
For components characterized by B10d, the operating cycles need to be related to the actual application.
A commonly used relationship is based on:
B10d
and
nop – Mean Number of Annual Operations
Conceptually:
B10d + Operating Frequency → MTTFd
The annual number of operations can depend on factors such as:
- operating days per year
- operating hours per day
- average time between operations
This demonstrates why reliability evaluation cannot always be performed using component data alone.
Application-specific usage matters.
Two identical components installed in different machines can therefore contribute different MTTFd values because their operating profiles differ significantly.
MTTFd of a Channel
A safety-related control system can contain multiple components connected within one channel.
The reliability of the complete channel therefore depends on the dangerous failure behavior of all relevant components within that channel.
Conceptually:
Sensor + Logic + Output Elements → Channel MTTFd
A channel with several components cannot simply be assigned the MTTFd of its most reliable component.
The relevant dangerous failure contributions must be combined according to the applicable ISO 13849 calculation method.
This channel-level reliability is then used together with the architecture and diagnostic measures when evaluating the achieved Performance Level.
MTTFd in Redundant Architectures
Categories 3 and 4 commonly use redundant structures.
A simplified architecture might contain:
Channel 1
and
Channel 2
Both channels contribute to maintaining the safety function when certain faults occur.
However, redundancy does not make component reliability irrelevant.
The MTTFd of the individual channels still contributes to the overall Performance Level evaluation.
At the same time, additional parameters become particularly important:
Diagnostic Coverage describes how effectively dangerous faults are detected.
Common Cause Failure measures address failures that could affect multiple channels simultaneously.
This is why ISO 13849 does not evaluate MTTFd in isolation.
MTTFd vs Diagnostic Coverage
MTTFd and Diagnostic Coverage describe two fundamentally different characteristics.
MTTFd asks:
How frequently can dangerous failures be expected?
Diagnostic Coverage asks:
How effectively are dangerous failures detected?
A system can therefore combine high component reliability with weak diagnostics, or lower component reliability with stronger diagnostic measures.
Neither parameter should be considered independently when evaluating the complete safety-related control system.
This distinction becomes especially important for Categories 2, 3 and 4, where diagnostic measures form an important part of the architecture.
MTTFd vs Category
Another common misunderstanding is to treat MTTFd as an alternative to architectural redundancy.
It is not.
The Category describes important structural and fault-behavior characteristics of the safety-related control system.
MTTFd describes the reliability of the relevant components or channels with respect to dangerous failures.
A highly reliable single-channel architecture does not automatically provide the same fault tolerance as a redundant architecture.
Similarly, adding redundancy does not eliminate the need to consider component reliability.
Both parameters therefore contribute different information to the Performance Level evaluation.
Practical Example – Safety Contactor
Consider a safety-related machine function that uses contactors to remove electrical power from a hazardous drive.
The manufacturer provides a suitable B10d value for the contactor.
To evaluate its contribution to the safety function, the engineer also considers how often the contactor operates.
Machine A
The safety-related switching operation occurs relatively infrequently.
The number of annual operations is therefore low.
Machine B
The same contactor is used in an application where it switches much more frequently.
The number of annual operations is significantly higher.
Even though both machines use the same component, the application-specific operating profile differs.
The resulting reliability evaluation can therefore differ as well.
This illustrates a fundamental principle:
Component reliability data must be considered together with the actual application conditions.
Simply copying an MTTFd value from another project without evaluating the operating profile can lead to an incorrect Performance Level calculation.
How SISTEMA Uses MTTFd
SISTEMA supports the evaluation of safety-related control systems according to ISO 13849-1.
Within a SISTEMA model, engineers can represent safety functions and their associated subsystems.
Reliability parameters such as MTTFd can then be considered together with:
- Category
- Diagnostic Coverage
- Common Cause Failure measures
- subsystem architecture
This makes SISTEMA particularly useful for evaluating more complex safety-related control systems.
However, SISTEMA does not determine whether the engineering assumptions are correct.
The engineer remains responsible for selecting appropriate reliability data, defining the architecture correctly and representing the actual application.
Common MTTFd Mistakes
Several mistakes should be avoided when working with MTTFd.
Treating MTTFd as Guaranteed Lifetime
MTTFd is a statistical reliability parameter and should not be interpreted as the expected service life of an individual component.
Ignoring the Operating Profile
For cycle-dependent components, operating frequency can significantly influence the resulting reliability evaluation.
Using Reliability Data Without Checking Applicability
Manufacturer or database values need to be appropriate for the component, operating conditions and application.
Looking at MTTFd in Isolation
A high MTTFd does not automatically result in a high Performance Level.
Architecture, diagnostics, CCF and other requirements still need to be considered.
Assuming Redundancy Makes MTTFd Unimportant
Even redundant systems rely on components whose dangerous failure behavior must be evaluated.
Want to Learn ISO 13849 in More Detail?
Our professional ISO 13849 online training explains how safety functions, Performance Levels, architectural categories, reliability parameters and verification fit together in machinery Functional Safety.
The course provides a structured introduction to the standard with practical engineering explanations and examples.
How MTTFd Fits into the ISO 13849 Workflow
MTTFd becomes relevant after the machinery risk assessment has identified the required safety functions and their required Performance Levels.
A simplified workflow is:
Hazard Identification
↓
Risk Assessment
↓
Safety Function
↓
Determine PLr
↓
Design SRP/CS
↓
Evaluate Category, MTTFd, DCavg and CCF
↓
Determine Achieved PL
↓
Verify PL ≥ PLr
MTTFd is therefore one part of the engineering evidence demonstrating that the implemented safety-related control system provides sufficient risk reduction.
Key Takeaways
MTTFd stands for Mean Time to Dangerous Failure and describes the expected reliability of components or channels with respect to dangerous failures.
ISO 13849 distinguishes three MTTFd classes:
Low: 3 to less than 10 years
Medium: 10 to less than 30 years
High: 30 to 100 years
MTTFd is a statistical reliability parameter and should not be interpreted as guaranteed component lifetime.
For cycle-dependent components, parameters such as B10d and the actual number of operating cycles can be important for determining MTTFd.
Most importantly, MTTFd is only one part of the Performance Level evaluation.
The achieved Performance Level depends on the combination of architecture, reliability, diagnostics, measures against Common Cause Failures and other applicable requirements.
Learn More About Machinery Functional Safety
Understanding MTTFd is one part of evaluating safety-related control systems according to ISO 13849.
Engineers also need to understand Performance Levels, architectural Categories, Diagnostic Coverage, Common Cause Failures and the relationship between machinery risk assessment and safety-related control system design.
Our professional online training portfolio provides structured introductions to machinery safety standards and explains how these engineering concepts connect in practice.
Explore our professional Machinery Functional Safety online training courses →
