Computation of the MTTF_D

(average time before a dangerous failure occurs)

The true reliability of a component is never exactly known, but statistics and reliability theory give us the tools for its estimation.

The failure rate λ is the measure of reliability of a component; it gives the number of failures per unit time (hour).

Its reciprocal, called mean time between failures, is commonly indicated with the short form MTBF (mean time between failures) or MTTF (mean time to failure) in case of the first failure after the initial start-up. MTTF is measured in years.

For the computation of the PFH_D, it is important to know only the MTTF_D, i.e. only the faults that can cause a dangerous system operation.

To help the designer to select which faults to consider, EN ISO 13849-2 (Annexes A to D) provides, for each technology, a list of relevant faults and the conditions under which it is possible to assume that they cannot occur (faults exclusion).

The list is not exhaustive and, if necessary, additional faults can be added depending on the particular application.

In practice, for each SRP / CS it is advisable to build a list of all components used and for each of them establish the faults to be considered on the basis of the list of faults provided in EN ISO 13849-2, then determine if the type of fault is a dangerous fault, or if has no safety relevance or if can be excluded a priori.

For ease of computation or in case of uncertainty, the standard makes it possible to consider, for each component, 50% of possible faults as dangerous (worst case), therefore:

MTTF_D = 2 x MTTF

Furthermore, to simplify, the following criterion was adopted:

• If a « first fault » directly triggers a second fault, the probability of occurrence of this second fault is the same as that of the first fault; it follows that the first fault and all those originated by it must be considered as a single fault.If, in some circumstances, two faults have the same common origin, they must be considered as a single fault (CCF).
• The simultaneous occurrence of two or more faults due to separate causes is highly unlikely (product of two probabilities extremely low on their own) and therefore is not considered. This means that it is generally acceptable that the simultaneous occurrence of multiple independent faults can generate a hazard.
• Each SRP / CS must be reasonably reliable so that the probability of a “first failure” is low; therefore, MTTFD values of less than 3 years are not considered.

MTTF_D: where to get data?

The hierarchical procedure for finding reliability data should be as follow:

1. Use of manufacturer’s data
2. Use of data of table C.1 of the Standard for most commonly used mechanical, hydraulic, pneumatic, electrical components for which the failure mechanism is due to wear of materials
3. Use of data of tables C.2 to C.7 for electronic components
4. Select 10 years

The use of data of table C.1 is allowed only if it is possible to prove that good engineering practices have been followed This means:

• The components selected have been designed and manufactured according to basic safety principles and well tried safety principles according to ISO13849-2 or other relevant standard. (Confirmed in component’s data sheet).
• The manufacturer specifies that the component is appropriate for the application and operating conditions of the user.
• The manufacturer of the SRP/CS, declares that the component is used respecting basic and well tried safety principles according to ISO 13849-2.