MTTFd
Measure
Topic overview
Quick facts
MTTFd expresses, per channel of a safety-related control circuit, the expected mean time until a failure that could prevent the safety function from operating, in years.
ISO 13849 classifies it in bands: low (3 to 10 years), medium (10 to 30 years), and high (30 to 100 years), and combines the band with the architecture category and diagnostic coverage in the standard's lookup table to determine the achieved .
Values are capped at 100 years per channel (with a limited exception to 2500 years for category 4), a deliberate ceiling that prevents extraordinary component reliability from substituting for architectural robustness.
For electronic components MTTFd derives from failure rates; for electromechanical and pneumatic components it derives from B10d, the number of cycles at which ten percent of a test population has failed dangerously, converted using the actual number of operations per year in the application.
This makes MTTFd application-dependent: the same contactor has a very different MTTFd on a circuit that cycles every ten seconds than on one that cycles once a shift.
Channel MTTFd is computed by combining the dangerous failure contributions of all components in the channel using the parts-count method, and asymmetric dual-channel designs are symmetrized with the standard's formula before the table lookup.
MTTFd bands (ISO 13849-1)
Why MTTFd matters to your program
MTTFd is one of the levers that decides whether a safety circuit achieves its required PL with the components already chosen, or needs redesign.
Because B10d-based values depend on cycling frequency, machine duty assumptions made casually at design time can invalidate the safety rating when a customer runs the machine harder than assumed, a liability that lands on the machine builder.
It also disciplines procurement: components without published B10d or MTTFd data cannot participate in the calculation, effectively excluding uncertified bargain parts from safety circuits.
Working with MTTFd
The controls engineer collects reliability data for every component in each channel of the safety function, manufacturer MTTFd or B10d values, or database values where justified, converts cycle-based data using the real expected operations per year, and combines them per channel.
The result is banded and fed with category and diagnostic coverage into the ISO 13849 table, usually via SISTEMA, which manufacturers support with component libraries. The calculation is done during circuit design and revisited if components or duty cycles change.
Reviewers check the data sources, the realism of the operations-per-year assumption, whether wear components will be replaced within their T10d life (the point at which the B10d assumption expires), and whether the capping rules were applied.
Common MTTFd mistakes
MTTFd and its standards
MTTFd is defined and governed by ISO 13849-1 - defines performance levels (pl) for safety functions implemented in control systems, including pneumatic and hydraulic parts.
Category + MTTFd + DC to PL (simplified)
| Category | MTTFd | DCavg | Achievable PL |
|---|---|---|---|
| B | Low-Medium | None | a-b |
| 1 | High | None | c |
| 2 | Low-High | Low-Medium (60-90%) | a-d |
| 3 | Low-High | Low-Medium (60-90%) | a-e |
| 4 | High | High (>=99%) | e |
Industries where MTTFd applies
Industrial Machinery programs lean on MTTFd because the sector covers fixed and mobile machinery, packaging lines, and manufacturing equipment.
Ask our team about MTTFd
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Bodo SeifertPrincipal Safety EngineerLeads automotive, autonomy, AI/ML, cybersecurity, and functional-safety work. His experience covers electronic-control development, vehicle testing, advanced engineering, autonomous-truck safety, assessment, and training.Terms related to MTTFd
How each connects to MTTFd:
Programs that deal with MTTFd almost always involve Performance Level in the same phase.
Both MTTFd and Safety Function sit under ISO 13849-1, so evidence for one usually references the other.
Safe Torque Off is governed by ISO 13849-1 as well, which is why the two show up together in audits.
Both MTTFd and Functional Safety Certification sit under ISO 13849-1, so evidence for one usually references the other.
SIL is a measure of the same kind; teams comparing the two usually need both.
Understanding MTTFd is easier with Functional Safety as context, and vice versa.
Understanding MTTFd is easier with Risk Assessment as context, and vice versa.
Teams working on MTTFd typically encounter Hierarchy of Risk Reduction in the same program.