Machinery Safety 101

Missing MTTFd data

What the heck is MTTFd???

When you first start to work through ISO 13849 – 1, the first thing that will smack you in the head are all the new acronyms. The first one you’ll run into is ‘PL’, of course, since the entire pur­pose of the stand­ard is to aid the design­er in determ­in­ing the reli­ab­il­ity Per­form­ance Level of the con­trol sys­tem. Shortly after that, you’ll find your­self face to face with MTTFd.

MTTFd, or the Mean Time To Fail­ure (dan­ger­ous), is the name giv­en to the expec­ted fail­ure rate per year for a com­pon­ent used in a sys­tem that is being ana­lyzed. This rate dif­fers from the straight fail­ure rate for the com­pon­ent because it’s lim­ited to the fail­ures that res­ult in a dan­ger­ous fail­ure mode, or that may lead to a hazard.

So how do you get this data?

Obtain­ing MTTFd data for a com­pon­ent should be easy for a design­er. Com­pon­ent man­u­fac­tur­ers who mar­ket com­pon­ents inten­ded for safety applic­a­tions should provide this data in the com­pon­ent spe­cific­a­tions, but there are thou­sands, per­haps mil­lions, of dif­fer­ent com­pon­ents being mar­keted today for use in safety sys­tems. Most of the major man­u­fac­tur­ers are already provid­ing this fig­ure or a fig­ure that can be used to derive MTTFd, B10d, but for many com­pon­ents, this data is simply not available.

Here are some ran­domly chosen examples of man­u­fac­turer­’s spe­cific­a­tion sheets that give this data:

Allen-Brad­ley Tro­jan™ T15 Inter­lock Switch

Pilz PNOZ X2 (pdf datasheet)

Pre­venta XPS MC Cata­log Safety Con­trol­ler (pdf 2015 Catalog)

B10d is the num­ber of cycles until 10% of the com­pon­ents being tested fail in a dan­ger­ous way. Using fail­ure rate data from the com­pon­ent’s data­sheet, it is pos­sible to estim­ate B10d from either B10 or T (the applic­a­tion depend­ent life­time of the com­pon­ent). Check out Annex C of the stand­ard if you want to see how this can be done.

But what do you do if the man­u­fac­turer of your favour­ite con­tact­or does­n’t provide ANY fail­ure data? Some major man­u­fac­tur­ers still don’t provide any fail­ure rate data at all, some provide expec­ted life­times under spe­cif­ic oper­at­ing con­di­tions. Some provide only EN 954 – 1:95 data. In the last case, I think this is one of the reas­ons for the EC Machinery Work­ing Group’s decision late last year to extend the trans­ition peri­od to ISO 13849 – 1:07. Need to know more about that decision?

Now what?

Unless you work for a large organ­iz­a­tion, insti­tut­ing a life test­ing pro­gram is not likely to be an option, since you either need a pro­trac­ted peri­od of time with a few com­pon­ents in test, or thou­sands of samples for a short time.

The stand­ard provides the option to use 10 years as a default where no oth­er data is avail­able. 10 years sounds like a long time at first blush, par­tic­u­larly if the planned life­time of the sys­tem involved is 20 years. Typ­ic­al MTTFd val­ues for high-reli­ab­il­ity com­pon­ents are in the hun­dreds of years, so by com­par­is­on, 10 years is almost noth­ing. Tables are also provided for some kinds of com­pon­ents, but the tables are neces­sar­ily lim­ited in size, so not every com­pon­ent will be listed.

Your only option is to use the data in the stand­ard, or pick up some of the oth­er pub­lic­a­tions that include com­pon­ent fail­ure data, like MIL-HDBK-217, IEC/TR 62380 (based on UTE 80810 & RDF 2000), NPRD 95 or IEC 61709 (based on Siemens SN 29500 doc­u­ments). Some of these doc­u­ments may be dif­fi­cult or impossible to obtain.

The res­ult of this lack of object­ive data from the com­pon­ent man­u­fac­tur­ers is:

  • Con­ser­vat­ive res­ults based on the min­im­um default MTTFd;
  • Poten­tial over-design of safety-related controls;
  • Increased man­u­fac­tur­ing costs for machine builders;

The reas­ons for this situ­ation vary by man­u­fac­turer, but ulti­mately it comes down to the cost of life test­ing com­pon­ents mul­ti­plied by a num­ber of com­pon­ents built by each man­u­fac­turer. Typ­ic­al life tests require load sim­u­lat­ors and switch­ing for thou­sands of com­pon­ents, as well as data log­ging to trap fail­ures and record rel­ev­ant data. In the case of flu­id power com­pon­ents (pneu­mat­ics and hydraul­ics), this becomes increas­ingly com­plex. For many com­pon­ent man­u­fac­tur­ers, the cost of the life test­ing is pro­hib­it­ive, even though this data is badly needed by their users.

Will we see an improve­ment in the future? The largest con­trols com­pon­ent man­u­fac­tur­ers are very likely to provide this data as they have it avail­able, mean­ing as they com­plete test­ing. New designs are much more likely to come with this data ini­tially, while it may be a long time before some of the old stand­ard com­pon­ents get time in the life test cell. Until then, lots of com­pon­ents will be assigned ’10 years’.

A big thank you to Wouter Leusden for the idea for this post!

Have a thought to share on this top­ic? Cor­rect an error in the art­icle? Sound off? Leave a comment!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.