ISO 13849 Diagnostic Coverage Explained – DC and DCavg
Diagnostic measures are an important part of many safety-related control systems designed according to ISO 13849.
While reliable components reduce the probability of dangerous failures occurring, diagnostics help detect dangerous failures when they occur.
This concept is described by Diagnostic Coverage (DC).
For the evaluation of safety-related control systems, DCavg – average Diagnostic Coverage is particularly important. Together with Category, MTTFd and measures against Common Cause Failures, it contributes to determining the achieved Performance Level.
This article explains what DC and DCavg mean, how Diagnostic Coverage is classified and how it fits into the ISO 13849 Performance Level evaluation.
What Is Diagnostic Coverage in ISO 13849?
Diagnostic Coverage describes the effectiveness of diagnostic measures in detecting dangerous failures.
Conceptually, it answers the question:
How many of the relevant dangerous failures can our diagnostic measures detect?
A safety-related control system can contain components that fail in different ways.
Some failures may be immediately detected by monitoring mechanisms, while others can remain undetected.
Diagnostic Coverage provides a way to characterize this diagnostic effectiveness.
This becomes particularly important in architectures where fault detection is part of the strategy for maintaining the required safety integrity.
What Is the Difference Between DC and DCavg?
DC refers to the Diagnostic Coverage associated with a component, subsystem or diagnostic measure.
DCavg represents the average Diagnostic Coverage used for evaluating the safety-related parts of the control system.
This distinction becomes important because a safety function can contain several elements with different dangerous failure rates and different levels of diagnostic coverage.
For example:
Sensor → Logic → Output
The sensor may have one level of diagnostic effectiveness, the logic another, and the output element another.
The resulting DCavg therefore needs to represent the diagnostic performance of the relevant parts of the safety-related system rather than simply selecting one individual DC value.
How Is Diagnostic Coverage Determined?
At a conceptual level, Diagnostic Coverage compares the rate of detected dangerous failures with the total rate of dangerous failures.
The principle can be expressed as:
DC = Detected Dangerous Failures / Total Dangerous Failures
A higher DC means that a larger proportion of dangerous failures is detected by the diagnostic measures.
However, determining appropriate DC values requires an understanding of:
- possible failure modes
- dangerous failure behavior
- implemented diagnostic mechanisms
- which failures those diagnostics can detect
- limitations of the diagnostic measures
Diagnostic Coverage should therefore be based on technically justified failure and diagnostic analysis rather than an arbitrary percentage.
Diagnostic Coverage Classes in ISO 13849
For Performance Level evaluation, Diagnostic Coverage is grouped into several ranges:
| DC Classification | Diagnostic Coverage |
|---|---|
| None | DC < 60% |
| Low | 60% ≤ DC < 90% |
| Medium | 90% ≤ DC < 99% |
| High | DC ≥ 99% |
These classes simplify the use of diagnostic effectiveness within the overall Performance Level evaluation.
None
Diagnostic Coverage below 60% is classified as None for this purpose.
This does not necessarily mean that absolutely no diagnostic mechanisms exist. It means that the diagnostic effectiveness does not reach the threshold for the Low classification.
Low
Low Diagnostic Coverage ranges from:
60% to less than 90%
Diagnostic measures detect a meaningful portion of dangerous failures, but substantial undetected failure modes may remain.
Medium
Medium Diagnostic Coverage ranges from:
90% to less than 99%
A significantly larger proportion of dangerous failures is detected.
High
High Diagnostic Coverage starts at:
99%
Achieving this level requires highly effective diagnostic measures and appropriate technical justification.
Importantly, High DC does not mean that every possible failure is detected.
Examples of Diagnostic Measures
Diagnostic mechanisms depend strongly on the technology and architecture being used.
Typical examples can include:
- plausibility checks between signals
- comparison of redundant channels
- input and output monitoring
- cross-monitoring
- watchdog mechanisms
- test pulses
- feedback monitoring
- periodic functional tests
Consider two redundant position sensors.
If both sensors measure the same physical quantity, their signals can be compared.
A significant disagreement between the channels can indicate a fault.
Similarly, an output contactor can use feedback contacts to determine whether its actual switching state corresponds to the commanded state.
The effectiveness of each diagnostic mechanism depends on which dangerous failure modes it can actually detect.
Want to Learn ISO 13849 in More Detail?
Our professional ISO 13849 online training explains how safety functions, Performance Levels, architectural categories, reliability parameters and verification fit together in machinery Functional Safety.
The course provides a structured introduction to the standard with practical engineering explanations and examples.
DCavg in a Safety-Related Control System
A safety function commonly consists of several elements.
Consider a simplified chain:
Input → Logic → Output
Each part can have its own dangerous failure behavior and diagnostic effectiveness.
For example:
Input: Safety sensor with diagnostic measures
Logic: Safety controller with internal diagnostics
Output: Contactors with feedback monitoring
The individual DC values cannot simply be averaged arithmetically.
DCavg needs to account for the relevant dangerous failure contributions of the different parts.
This means that an element with a significant dangerous failure contribution and weak diagnostics can have an important effect on the overall DCavg.
The calculation therefore needs to reflect the actual safety-related architecture and applicable failure data.
Diagnostic Coverage vs MTTFd
MTTFd and Diagnostic Coverage describe two different aspects of Functional Safety.
MTTFd asks:
How frequently can dangerous failures be expected?
Diagnostic Coverage asks:
How effectively can dangerous failures be detected?
A component can therefore have a high MTTFd but limited diagnostics.
Alternatively, a component may have strong diagnostic mechanisms but a lower MTTFd.
Neither parameter replaces the other.
Instead, both contribute to the overall evaluation of the safety-related control system.
Diagnostic Coverage and Categories
Diagnostic Coverage becomes particularly relevant when looking at the architectural Categories of ISO 13849.
For example, Category 2 introduces testing of the safety function at suitable intervals.
Categories 3 and 4 use redundant architectures in which diagnostic measures can help identify dangerous faults within the channels.
However, the Category cannot be determined from DC alone.
The architectural requirements, fault behavior and applicable diagnostic measures must be considered together.
Likewise, a high DC value does not automatically transform an architecture into Category 4.
How Does DCavg Influence the Performance Level?
The achieved Performance Level depends on several interacting parameters.
A simplified relationship is:
Category + MTTFd + DCavg + CCF + Systematic Measures → Achieved PL
DCavg therefore contributes to the achievable Performance Level, particularly for architectures that rely on fault detection.
But it should never be evaluated in isolation.
For example, strong diagnostics cannot automatically compensate for an unsuitable architecture or inadequate component reliability.
Similarly, excellent component reliability does not remove the need for appropriate diagnostic measures where they are required by the selected architecture.
Diagnostic Coverage and Common Cause Failures
Redundant architectures introduce another important consideration.
Two channels can appear independent but still be vulnerable to a Common Cause Failure (CCF).
For example, both channels might be affected by:
- the same environmental condition
- a shared power supply problem
- contamination
- incorrect installation
- electromagnetic interference
Diagnostic Coverage and CCF therefore address different problems.
DCavg concerns the detection of dangerous failures.
CCF measures address the possibility that a common cause can affect multiple channels.
Both need to be considered where applicable.
Practical Example – Guard Door Monitoring
Consider a machine with a guard door that must stop hazardous motion when opened.
The safety function contains:
Guard Door Sensor
↓
Safety Controller
↓
Contactors
Several diagnostic mechanisms can be implemented.
The safety controller can monitor the sensor signals for inconsistencies.
Internal diagnostics can monitor parts of the logic.
Feedback contacts can be used to verify whether the contactors actually reached the commanded safe state.
Together, these measures improve the ability of the system to detect dangerous failures.
However, the resulting DCavg cannot simply be assumed from the number of diagnostic mechanisms.
Engineers need to consider which dangerous failure modes are actually detected and which remain undetected.
This distinction is fundamental to a meaningful Diagnostic Coverage evaluation.
Common Diagnostic Coverage Mistakes
Several misunderstandings should be avoided when evaluating DC and DCavg.
Assuming More Diagnostics Automatically Means High DC
The number of diagnostic mechanisms alone does not determine Diagnostic Coverage.
What matters is their effectiveness in detecting relevant dangerous failures.
Calculating DCavg as a Simple Arithmetic Average
Different elements can contribute differently to dangerous failure behavior.
DCavg therefore requires the appropriate weighted evaluation rather than simply averaging individual percentages.
Assuming 99% Means Every Fault Is Detected
High Diagnostic Coverage does not mean perfect fault detection.
Some dangerous failure modes can remain undetected.
Looking at DCavg in Isolation
Diagnostic Coverage is only one part of the Performance Level evaluation.
Category, MTTFd, CCF and systematic aspects remain important.
How SISTEMA Supports DCavg Evaluation
SISTEMA supports engineers in evaluating safety-related control systems according to ISO 13849-1.
The safety function can be modeled using its relevant subsystems and components.
Diagnostic Coverage values can then be considered together with other parameters such as:
- Category
- MTTFd
- CCF
- system architecture
This helps engineers evaluate the resulting Performance Level consistently.
However, the quality of the result still depends on the engineering inputs.
SISTEMA cannot determine whether an assumed diagnostic mechanism actually detects the failure modes claimed by the engineer.
Key Takeaways
Diagnostic Coverage (DC) describes how effectively diagnostic measures detect dangerous failures.
DCavg represents the average Diagnostic Coverage used in the evaluation of the safety-related control system.
ISO 13849 distinguishes the classifications None, Low, Medium and High, with High Diagnostic Coverage beginning at 99%.
Diagnostic Coverage and MTTFd describe different characteristics: MTTFd concerns the occurrence of dangerous failures, while DC concerns their detection.
DCavg must be evaluated together with Category, MTTFd, CCF and other applicable requirements when determining the achieved Performance Level.
Most importantly:
High Diagnostic Coverage alone does not guarantee a high Performance Level.
Learn More About ISO 13849
Diagnostic Coverage is one of several parameters engineers need to understand when designing and evaluating safety-related control systems.
Our ISO 13849 training explains how safety functions, Performance Levels, Categories, MTTFd, Diagnostic Coverage and verification fit together within a structured Functional Safety process.
Explore our professional ISO 13849 online training →
