ISO 13849 Key Parameters Calculation: In-Depth Analysis of MTTFd, DC, and CCF

Introduction

In the design of safety-related control parts (SRP/CS) of machinery control systems, the ISO 13849-1 standard provides a systematic approach to determine Performance Level (PL). The determination of PL is not arbitrary; it is based on quantitative calculations of three key parameters:

• MTTFd (Mean Time To Dangerous Failure): Mean Time To Dangerous Failure, measuring component reliability
• DC (Diagnostic Coverage): Diagnostic Coverage, measuring fault detection capability
• CCF (Common Cause Failure): Common Cause Failure prevention, measuring redundancy channel independence

These three parameters work together with the system architecture Category to determine the PL level that the system can achieve through the bar chart provided by the standard or precise calculation methods. This article will provide an in-depth explanation of the definitions, calculation methods, and practical applications of these three key parameters.

Parameter Relationship Overview

<placeholder>
┌─────────────────────────────────────────────────────────────────────┐
│                    PL Calculation Parameter Relationship             │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│                        ┌─────────────┐                             │
│                        │  Category   │                             │
│                        │ (Architecture)│                            │
│                        └──────┬──────┘                             │
│                               │                                    │
│         ┌─────────────────────┼─────────────────────┐              │
│         │                     │                     │              │
│         ▼                     ▼                     ▼              │
│  ┌─────────────┐      ┌─────────────┐      ┌─────────────┐        │
│  │   MTTFd     │      │   DCavg     │      │    CCF      │        │
│  │             │      │             │      │             │        │
│  │Component    │      │ Fault       │      │ Independence│        │
│  │Reliability  │      │Detection    │      │             │        │
│  │             │      │             │      │             │        │
│  │Unit: years  │      │Unit: %      │      │Unit: points │        │
│  └──────┬──────┘      └──────┬──────┘      └──────┬──────┘        │
│         │                    │                    │                │
│         └────────────────────┴────────────────────┘                │
│                              │                                      │
│                              ▼                                      │
│                      ┌─────────────┐                               │
│                      │     PL      │                               │
│                      │(via bar chart)│                             │
│                      └─────────────┘                               │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
</placeholder>

1. MTTFd: Mean Time To Dangerous Failure

1.1 Definition and Basic Concepts

MTTFd (Mean Time To Dangerous Failure) is one of the core parameters in the ISO 13849-1 standard, defined as the expected mean time to dangerous failure.

From a technical perspective, MTTFd represents the average working time of a component or system before a dangerous failure occurs. This parameter directly reflects the hardware reliability level: the higher the MTTFd value, the more reliable the component, and the lower the probability of dangerous failure.

There is a mathematical relationship between MTTFd and failure rate:

MTTFd = 1 / λD

Where:
- λD = Dangerous failure rate (failures/hour)
- MTTFd unit: years (1 year ≈ 8760 hours)

When understanding MTTFd, note the following points:

1. Dangerous Failure vs. Safe Failure: MTTFd only considers dangerous failures, which are faults that can lead to safety function failure. Safe failures (such as fail-safe actions) are not included in the calculation.

2. Statistical Mean Value: MTTFd is a statistical expected value, not the actual lifetime of an individual component. The actual failure time may be greater or less than MTTFd.

3. Time Unit: In the standard, MTTFd is expressed in years for engineering convenience.

1.2 MTTFd Classification

ISO 13849-1 divides MTTFd into three levels for use in bar charts:

MTTFd Range	Level Code	Description	Typical Application
3 years ≤ MTTFd < 10 years	Low	Basic reliability	Low-risk scenarios
10 years ≤ MTTFd < 30 years	Medium	Medium reliability	Typical applications
30 years ≤ MTTFd ≤ 100 years*	High	High reliability	High-risk scenarios

*Note: For Category 4 architecture, the upper limit of MTTFd is 2500 years

Important Notes:

• MTTFd should not be less than 3 years, otherwise it does not meet basic safety requirements
• The upper limit of MTTFd is to avoid over-reliance on the high reliability of a single component
• Category 4 allows higher MTTFd (2500 years) because its architecture has better fault tolerance

1.3 MTTFd Data Sources

In practical engineering, obtaining accurate MTTFd data is the first step in calculation. In order of priority, MTTFd data sources include:

Priority	Data Source	Reliability	Description
1	Component manufacturer data	Highest	Datasheets, FMEDA reports
2	Industry databases	High	SN 29500, IEC 62380, FMD
3	Standard Annex C values	Medium	ISO 13849-1 Annex C
4	Analogous estimation	Low	Extrapolation based on similar components

Best Practices:

• Prioritize FMEDA (Failure Modes, Effects, and Diagnostic Analysis) reports provided by manufacturers
• For safety-critical components, require suppliers to provide reliability data
• When using industry databases, pay attention to matching application conditions
• Analogous estimation is only applicable to preliminary assessment; final design should use measured data

1.4 Typical Component MTTFd Reference Values

Based on ISO 13849-1 Annex C and industry experience, the following are reference MTTFd values for typical components:

Electromechanical Components

Component Type	Typical MTTFd	Application Conditions	Notes
Signal relay	100 years	Derated use	Low current load
Power relay	20 years	Rated load	Rated current
Contactor	20-50 years	Normal use	Depends on operating frequency
Emergency stop button	50 years	Low operating frequency	Mechanical life
Position switch	30 years	Normal use	Industrial environment
Connector	1000 years	Single-point connection	Stable connection

Electronic Components

Component Type	Typical MTTFd	Application Conditions	Notes
Thin film resistor	1000 years	50% derating	Low power application
Ceramic capacitor	100 years	Derated use	Voltage derating
Electrolytic capacitor	20 years	High temperature derating	Temperature sensitive
Diode	1000 years	Forward application	Standard rectification
Transistor	500 years	Derated use	Power derating
Digital IC	100-500 years	Normal application	Depends on complexity
MCU	50-200 years	Safety application	Derated use

Hydraulic/Pneumatic Components

Component Type	Typical MTTFd	Application Conditions	Notes
Pneumatic solenoid valve	30 years	Clean air supply	Regular maintenance
Hydraulic solenoid valve	20 years	Clean oil	Oil management
Pneumatic cylinder	50 years	Normal use	Seal maintenance
Hydraulic cylinder	30 years	Normal use	Seal maintenance

1.5 MTTFd Calculation Methods

Single-Channel System Calculation

For series systems (where any component failure causes system failure), the MTTFd calculation formula is:

1/MTTFd_channel = Σ(1/MTTFd_i)

That is:
MTTFd_channel = 1 / (1/MTTFd_1 + 1/MTTFd_2 + ... + 1/MTTFd_n)

Calculation Example:

A simple emergency stop safety circuit contains the following components:

• Emergency stop button: MTTFd = 50 years
• Safety relay: MTTFd = 100 years
• Contactor: MTTFd = 30 years

Calculation steps:

1/MTTFd_channel = 1/50 + 1/100 + 1/30
               = 0.02 + 0.01 + 0.0333
               = 0.0633

MTTFd_channel = 1/0.0633 ≈ 15.8 years

Therefore, the MTTFd level of this channel is Medium (10-30 years).

Calculation Using B10D Data

For electromechanical components with wear characteristics (such as relays, switches), B10D data is typically used to calculate MTTFd.

B10D Definition: Number of operations when 10% of components experience dangerous failure.

Calculation formula:

MTTFd = B10D / (0.1 × nop)

Where:
- B10D = Number of dangerous failures provided by manufacturer
- nop = Number of operations per year (operations/year)

Calculation Example:

A relay has the following parameters:

• B10D = 2,000,000 operations (dangerous failure)
• Annual operations nop = 100,000 operations/year

MTTFd = 2,000,000 / (0.1 × 100,000)
      = 2,000,000 / 10,000
      = 200 years → High level

1.6 BMS Application Example

Case: BMS Voltage Sampling Channel MTTFd Calculation

A single channel contains the following components:

Component	Quantity	Individual MTTFd	1/MTTFd Contribution
Voltage divider resistors	2	1000 years	0.001 × 2
Filter capacitor	1	100 years	0.01
ADC	1	200 years	0.005
MCU processing	1	100 years	0.01

Calculation:

1/MTTFd_channel = 0.001 + 0.001 + 0.01 + 0.005 + 0.01
               = 0.027

MTTFd_channel = 1/0.027 ≈ 37 years

Conclusion: The MTTFd level of this voltage sampling channel is High (≥30 years).

2. DC: Diagnostic Coverage

2.1 Definition and Basic Concepts

Diagnostic Coverage (DC) is a quantitative measure of the fault detection capability of safety-related parts.

Standard definition: A measure of diagnostic effectiveness, the ratio of detected dangerous failure rate to total dangerous failure rate.

Calculation Formula:

DC = λDD / λD

Where:
- λDD = Detected dangerous failure rate
- λD = Total dangerous failure rate

DC values are expressed as percentages, ranging from 0% (no diagnosis) to 100% (complete diagnosis).

When understanding DC, note the following:

1. Only Dangerous Failures Considered: DC only measures the detection capability for dangerous failures; safe failures do not affect the DC value.

2. Online Diagnosis: DC evaluates online diagnostic capability during system operation, excluding startup self-tests.

3. Weighted Average: Multi-module systems use DCavg (weighted average diagnostic coverage).

2.2 DC Classification

ISO 13849-1 divides DC into four levels:

DC Range	Level Code	Description	Typical Characteristics
DC < 60%	None	No effective diagnosis	Basically no diagnostic measures
60% ≤ DC < 90%	Low	Basic diagnosis	Basic monitoring measures
90% ≤ DC < 99%	Medium	Comprehensive diagnosis	Multiple diagnostic measures
DC ≥ 99%	High	Complete diagnosis	Redundancy + cross-diagnosis

2.3 DCavg Calculation Method

For safety-related systems containing multiple modules, the weighted average diagnostic coverage (DCavg) needs to be calculated.

Calculation Formula:

DCavg = (DC1/MTTFd1 + DC2/MTTFd2 + ... + DCn/MTTFdn)
        / (1/MTTFd1 + 1/MTTFd2 + ... + 1/MTTFdn)

This formula embodies an important concept: modules with lower MTTFd (higher failure rates) have a greater impact on DCavg.

Calculation Example:

A safety system contains three modules:

Module	MTTFd	DC	DC/MTTFd
Input	50 years	90%	0.018
Logic	100 years	99%	0.0099
Output	30 years	60%	0.02

Calculation:

DCavg = (0.018 + 0.0099 + 0.02) / (0.02 + 0.01 + 0.0333)
      = 0.0479 / 0.0633
      = 75.7% → Low level

Although the input and logic modules have higher DC, the output module’s low DC and low MTTFd reduce the overall DCavg.

2.4 Typical Diagnostic Measures and DC Values

Based on ISO 13849-1 Annex E, the following are typical diagnostic measures for each functional module and their corresponding DC values:

Input Module Diagnostics

Diagnostic Measure	DC Value	Application Scenario	Implementation Points
No diagnosis	0%	Basic input	Not recommended for safety functions
Range check	60%	Analog sensors	Set upper and lower limits
Cross comparison	90%	Dual sensors	Independent measurement
Full diverse redundancy	99%	High safety requirements	Different technical principles
Periodic test pulse	90%	Digital inputs	Regular testing
Timeout monitoring	60%	Communication inputs	Watchdog mechanism

Logic Module Diagnostics

Diagnostic Measure	DC Value	Application Scenario	Implementation Points
No diagnosis	0%	Simple logic	Hardwired logic
Watchdog	60%	Program monitoring	Timeout reset
Program flow monitoring	70%	Execution sequence	Flow checking
Memory checksum	90%	RAM/Flash	Periodic verification
Dual-channel comparison	99%	Redundant CPU	Cross verification
Clock monitoring	60%	Clock checking	Frequency monitoring

Output Module Diagnostics

Diagnostic Measure	DC Value	Application Scenario	Implementation Points
No diagnosis	0%	Basic output	Not recommended
Output state readback	60%	Relay contacts	Feedback checking
Load current monitoring	90%	Power output	Current detection
Force-guided contacts	99%	Safety relay	Mechanical interlock
Dual output comparison	90%	Redundant output	State comparison
Short circuit detection	90%	Semiconductor output	Current/voltage monitoring

2.5 BMS Application Example

Case: BMS Voltage Protection Channel DC Assessment

Module	Diagnostic Measure	DC Assessment	Description
Voltage sampling	Dual ADC cross comparison	90%	Redundant measurement
Digital filtering	Range check + rate of change	60%	Signal reasonableness check
Threshold comparison	Independent comparator backup	99%	Hardware comparator
Shutdown output	State readback + current monitoring	90%	Double confirmation

Assuming equal MTTFd for each module, simple average:

DCavg = (90% + 60% + 99% + 90%) / 4 = 84.75% → Low

Improvement Recommendation: Enhance the diagnostic capability of the digital filtering module, for example by adding signal trend analysis, which can increase DC from 60% to 90%, thereby bringing DCavg to Medium level.

3. CCF: Common Cause Failure Prevention

3.1 Definition and Basic Concepts

Common Cause Failure (CCF) is an issue that must be重点考虑 in redundant system design.

Standard definition: Failure caused by one or more events that causes two or more independent channels in a multi-channel subsystem to fail simultaneously.

CCF is important because it is the “Achilles’ heel” of redundant systems. Even if the system uses a multi-channel redundant architecture, if there exists a common cause that can cause all channels to fail simultaneously, the advantage of redundancy is completely lost.

Typical Scenarios:

1. Power Failure: A single power supply powers two redundant channels; power failure causes both channels to fail simultaneously
2. Environmental Factors: Overheating, vibration, contamination, and other environmental factors affect multiple channels simultaneously
3. Software Defects: Identical software code running in two channels, same bug causes simultaneous failure
4. Design Errors: Design specification errors affect all channels
5. Maintenance Errors: Maintenance personnel perform incorrect maintenance on both channels simultaneously

3.2 Common Common Cause Failure Sources

Category	Failure Source	Typical Example	Prevention Measures
Physical Factors	Temperature	Overheating causes two chips to fail simultaneously	Thermal design + temperature monitoring
	Vibration	Vibration causes connectors to loosen simultaneously	Vibration damping + physical separation
	Contamination	Dust causes optocouplers to fail simultaneously	Sealing + clean environment
Electrical Factors	Power	Power failure causes channels to fail simultaneously	Redundant power supply
	EMC	Surge causes channels to be damaged simultaneously	EMI protection + isolation
	Ground loop	Common ground causes interference coupling	Electrical isolation
Design Factors	Software	Same software bug affects multiple channels	Diverse design
	Specification	Incorrect specification affects all channels	Independent verification
	Interface	Interface design defect affects multiple channels	Interface standardization
Manufacturing Factors	Process	Batch defects affect all components	Incoming inspection + screening
	Assembly	Assembly errors affect multiple channels	Process control
Operational Factors	Maintenance	Incorrect maintenance affects multiple channels	Maintenance procedures
	Operation	Misoperation affects multiple channels	Operator training

3.3 CCF Quantification Method

ISO 13849-1 Annex F provides a CCF scoring table to quantify the effectiveness of common cause failure prevention measures. For Category 2, 3, and 4 architectures, the CCF score must reach or exceed 65 points.

Scoring Table Structure:

Measure Category	Specific Measure	Score	Implementation Points
Separation/Isolation
	Physical space separation	15	Different PCB areas/different boards
	Electrical isolation	20	Optocoupler/isolator/isolated power
Diversity
	Different technology	20	Different types of sensors/actuators
	Different design	10	Different design teams/methods
Design/Application
	Overvoltage protection	15	TVS/varistor/clamping
	Overcurrent protection	10	Fuse/resettable fuse
	EMC measures	20	Filtering/shielding/grounding
Assessment/Analysis
	FMEA analysis	5	Specific analysis for CCF
Maintenance
	Online diagnosis	10	Continuous or periodic diagnosis
Training
	Personnel training	5	Design/maintenance personnel training

Scoring Principles:

• Total score must be ≥ 65 points
• Measures must be actually implemented, not just planned
• Scoring should be conservative; take lower score when in doubt
• Document scoring basis for audit

3.4 CCF Scoring Example

Case: BMS Dual-MCU System

A BMS uses a dual-MCU redundant architecture (Category 3) and requires assessment of CCF prevention measures.

Measure	Implementation	Score	Basis
Physical separation	Two MCUs located in different PCB areas	15	PCB layout
Electrical isolation	ADC inputs use isolation amplifiers	20	Circuit schematic
Overvoltage protection	TVS + voltage regulator circuit	15	BOM + testing
Overcurrent protection	Resettable fuse	10	BOM + testing
EMC measures	Filtering + shielding + grounding design	20	EMC test report
Online diagnosis	Periodic self-test + cross monitoring	10	Software documentation
Personnel training	Design personnel training records	5	Training records
Total Score		90	≥65 ✓

The system’s CCF score is 90 points, meeting the standard’s 65-point requirement.

4. Bar Chart Application Method

4.1 Bar Chart Overview

The bar chart (ISO 13849-1 Figure 12 / Annex K) is a graphical tool for simplified PL determination. By combining MTTFd level, DCavg level, and Category, you can directly look up the corresponding PL value.

Basic Principle:

• X-axis: MTTFd level
• Bars: PL values for different DCavg levels
• Y-axis: Corresponding PL level

4.2 Bar Chart Numerical Tables

Category B

MTTFd	DC: None	PL
Low	-	a
Medium	-	b
High	-	b

Note: Category B has no diagnostic capability, can only reach PL b at most.

Category 1

MTTFd	DC: None	PL
Low	-	Not applicable
Medium	-	Not applicable
High	-	c

Note: Category 1 requires MTTFd to be High, can reach PL c.

Category 2

MTTFd	DC: None	DC: Low	DC: Medium	PL
Low	a	b	b	-
Medium	b	c	c	-
High	c	c	d	-

Category 3

MTTFd	DC: None	DC: Low	DC: Medium	DC: High	PL
Low	a	b	c	c	-
Medium	b	c	d	d	-
High	c	d	d	e	-

Category 4

MTTFd	DC: Low	DC: Medium	DC: High	PL
Low	c	d	e	-
Medium	d	d	e	-
High	d	e	e	-

Note: Category 4 requires DC to be at least Low, can reach PL e at most.

4.3 Usage Steps

1. Determine Category: Determine the category based on system architecture (B/1/2/3/4)
2. Calculate MTTFd: Determine the MTTFd level of the channel
3. Calculate DCavg: Determine the average diagnostic coverage level of the system
4. Look up Table to Determine PL: Based on the above parameters, check the corresponding table

5. Comprehensive Calculation Examples

Case 1: BMS Overcurrent Protection Subsystem

System Description:

• Function: Detect battery pack current, cut off circuit when threshold is exceeded
• Target PLr: d
• Architecture: Category 2

Step 1: MTTFd Calculation

Component	MTTFd	Source
Current sensor	100 years	Manufacturer data
Sampling resistor	500 years	Annex C
ADC	200 years	Manufacturer data
MCU	100 years	Safety manual
MOSFET driver	100 years	Annex C
MOSFET	50 years	Manufacturer data

1/MTTFd_channel = 1/100 + 1/500 + 1/200 + 1/100 + 1/100 + 1/50
               = 0.01 + 0.002 + 0.005 + 0.01 + 0.01 + 0.02
               = 0.057

MTTFd_channel = 1/0.057 ≈ 17.5 years → Medium

Step 2: DCavg Calculation

Module	Diagnostic Measure	DC
Current sensor	Range check + zero point calibration	90%
ADC	Reference voltage comparison	90%
MCU	Watchdog + program flow monitoring	70%
MOSFET	Conduction state readback	90%

DCavg = (0.9/100 + 0.9/200 + 0.7/100 + 0.9/50) / (1/100 + 1/200 + 1/100 + 1/50)
      = (0.009 + 0.0045 + 0.007 + 0.018) / (0.01 + 0.005 + 0.01 + 0.02)
      = 0.0385 / 0.045
      = 85.6% → Low

Step 3: CCF Scoring

Measure	Score
Electrical isolation (isolated sampling)	20
Overvoltage protection	15
EMC measures	20
Periodic diagnosis	10
Total Score	65 ≥ 65 ✓

Step 4: Determine PL

Check Category 2 table:

• MTTFd = Medium
• DCavg = Low
• PL = c

Conclusion: Achieved PL = c < Target PLr = d, Design does not meet requirements!

Improvement Solutions:

Solution 1: Improve DCavg

• Add dual ADC cross comparison → DC increases to 99%
• New DCavg ≈ 92% → Medium
• New PL = d ✓

Solution 2: Upgrade to Category 3

• Dual-channel redundant architecture
• Even with DCavg = Low, PL d can be achieved

Case 2: BMS Dual-MCU Overtemperature Protection (Category 3)

Target PLr: e

Parameters:

• MTTFd_channel1 = 30 years → High
• MTTFd_channel2 = 30 years → High
• DCavg = 95% → Medium
• CCF = 85 points ✓

Check Category 3 table:

• MTTFd = High
• DCavg = Medium
• PL = d

Conclusion: Achieved PL = d < Target PLr = e, improvement needed.

Improvement Solutions:

1. Improve DCavg to High (≥99%)
2. Or upgrade to Category 4 architecture

6. Frequently Asked Questions

Q1: Where is the most reliable source of MTTFd data?

A: In order of priority:

1. Component manufacturer’s FMEDA reports or safety manuals
2. Recognized industry databases (SN 29500, FMD-2016)
3. Typical values from ISO 13849-1 Annex C
4. Conservative estimates based on similar components

Q2: What if I cannot obtain MTTFd for a certain component?

A: Use a conservative estimation strategy:

• Refer to values of similar components
• Use values from Annex C
• If uncertain, use a lower MTTFd value (more conservative)

Q3: How to determine the MTTFd of each module when calculating DCavg?

A: The MTTFd of each module is the series calculation result of MTTFd of all components in that module. If the module is too complex for precise calculation, simplified estimates can be used, but conservative principles should be maintained.

Q4: Must the CCF score reach 65 points?

A: Yes, for Category 2, 3, and 4, the CCF score must reach or exceed 65 points. This is a mandatory requirement of the standard, not an option. Scoring should be based on actually implemented measures, not just design intent.

Q5: What is the difference between bar chart and precise calculation?

A:

• Bar chart: Simplified method, gives conservative PL level, suitable for most engineering applications
• Precise calculation: Uses Markov models and other methods to calculate PFH, suitable for complex systems or scenarios requiring precise analysis

The bar chart is conservative; if the bar chart result meets requirements, precise calculation is usually not necessary.

Q6: What level can BMS systems typically achieve for MTTFd?

A: Typical BMS subsystems:

• Single-channel voltage sampling: MTTFd approximately 30-50 years (High)
• MCU processing logic: MTTFd approximately 50-100 years (High)
• Power switches: MTTFd approximately 20-50 years (Medium-High)

Specific values depend on component selection, derating design, and application environment.

7. Summary

The three key parameters of ISO 13849-1 provide quantitative assessment methods for the design of safety-related control systems:

1. MTTFd: Ensures components are sufficiently reliable from a reliability perspective
2. DC: Ensures faults can be detected in a timely manner from a diagnostic perspective
3. CCF: Ensures redundant channels are truly independent from an independence perspective

These three parameters work together, combined with system architecture categories, to ultimately determine the Performance Level (PL) that the system can achieve. In practical engineering, you should:

1. Prioritize selection of high-reliability components (high MTTFd)
2. Design comprehensive diagnostic mechanisms (high DC)
3. Implement effective common cause failure prevention (high CCF score)
4. Select appropriate architecture category based on target PL

Through systematic parameter calculation and architecture design, safety-related control parts can be ensured to meet expected safety integrity requirements.

References

Standard Clauses

Content	Standard Clause
MTTFd definition	ISO 13849-1:2023 3.1.32
MTTFd calculation	ISO 13849-1:2023 6.1.4
MTTFd typical values	ISO 13849-1:2023 Annex C
DC definition	ISO 13849-1:2023 3.1.35
DC estimation	ISO 13849-1:2023 Annex E
CCF definition	ISO 13849-1:2023 3.1.13
CCF quantification	ISO 13849-1:2023 Annex F
Bar chart	ISO 13849-1:2023 Annex K

Recommended Reading

• ISO 13849-1:2023 “Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design”
• IFA Report 2/2017e “Design of safety-related control systems based on ISO 13849-1”
• SN 29500 Siemens Component Reliability Database
• IEC 62380 Electronic Equipment Reliability Data Handbook

---