Missing MTTFd data

Dealing with the huge information void that exists while trying to complete reasonable control reliability assessments is a major challenge for every engineer or technologist tasked with this activity. Here are a few thoughts on what to do now, and where things may be going…

What the heck is MTTFd???

When you first start to work through ISO 13849-1, the first thing that will smack you in the head are all the new acronyms. The first one you’ll run into is ‘PL’, of course, since the entire purpose of the standard is to aid the designer in determining the reliability Performance Level of the control system. Shortly after that you’ll find yourself face to face with MTTFd.

MTTFd, or the Mean Time To Failure (dangerous), is the name given to the expected failure rate per year for a component used in a system that is being analyzed. This rate differs from the straight failure rate for the component because it’s limited to the failures that result in a dangerous failure mode, or that may lead to a hazard.

So how do you get this data?

Obtaining MTTFd data for a component should be easy for a designer. Component manufacturers who market components intended for safety applications should provide this data in the component specifications, but there are thousands, perhaps millions, of different components being marketed today for use in safety systems. Most of the major manufacturers are already providing this figure, or a figure that can be used to derive MTTFd, B10d, but for many components, this data is simply not available.

Here are some randomly chosen examples of manufacturer’s specification sheets that give this data:

Allen-Bradley Trojan™ T15 Interlock Switch

Pilz PNOZ X2 (pdf data sheet)

Preventa XPS MC Catalog Safety Controller (pdf 2015 Catalog)

B10d is the number of cycles until 10% of the components being tested fail in a dangerous way. Using failure rate data from the component’s data sheet, it is possible to estimate B10d from either B10 or T (the application dependent lifetime of the component). Check out Annex C of the standard if you want to see how this can be done.

But what do you do if the manufacturer of your favourite contactor doesn’t provide ANY failure data? Some major manufacturers still don’t provide any failure rate data at all, some provide expected lifetimes under specific operation conditions. Some provide only EN 954-1:95 data. In the last case, I think this is one of the reasons for the EC Machinery Working Group’s decision late last year to extend the transition period to ISO 13849-1:07. Need to know more about that decision?

Now what?

Unless you work for a large organization, instituting a life testing program is not likely to be an option, since you either need a protracted period of time with a few components in test, or thousands of samples for a short time.

The standard provides the option to use 10 years as a default where no other data is available. 10 years sounds like a long time at first blush, particularly if the planned lifetime of the system involved is 20 years. Typical MTTFd values for high-reliability components are in the hundreds of years, so by comparison, 10 years is almost nothing. Tables are also provided for some kinds of components, but the tables are necessarily limited in size, so not every component will be listed.

Your only option is to use the data in the standard, or pick up some of the other publications that include component failure data, like MIL-HDBK-217F, IEC/TR 62380 (based on UTE 80810 & RDF 2000), NPRD 95 or IEC 61709 (based on Siemens SN 29500 documents). Some of these documents may be difficult or impossible to obtain.

The result of this lack of objective data from the component manufacturers is:

  • Conservative results based on the minimum default MTTFd;
  • Potential over-design of safety related controls;
  • Increased manufacturing costs for machine builders;

The reasons for this situation vary by manufacturer, but ultimately it comes down to the cost of life testing components multiplied by number of components built by each manufacturer. Typical life tests require load simulators and switching for thousands of components, as well as data logging to trap failures and record relevant data. In the case of fluid power components (pneumatics and hydraulics), this becomes increasingly complex. For many component manufacturers, the cost of the life testing is prohibitive, even though this data is badly needed by their users.

Will we see an improvement in the future? The largest controls component manufacturers are very likely to provide this data as they have it available, meaning as they complete testing. New designs are much more likely to come with this data initially, while it may be a long time before some of the old standard components get time in the life test cell. Until then, lots of components will be assigned ’10 years’.

A big thank you to Wouter Leusden for the idea for this post!

Have a thought to share on this topic? Correct an error in the article? Sound off? Leave a comment!