Mean Time to Dangerous Failure. In a safety system MTTF_D is the portion of failure modes that can lead to failures that may result in hazards to personnel, environment or equipment.

MTTF_D is critical to the determination of the performance level of a safety system. ISO 13849 defines three levels of MTTF_D:

ISO 13849 prescribes three methods to determine the MTTF_D of a safety channel:

1. use the manufacturer's failure data;
2. use the methods prescribed in Annexes C and D of ISO 13849-1
3. use 10 years (i.e. assume the channel has low integrity)

Mean Time to Failure (MTTF) is assumed constant during the useful life period of a component. The MTTF can be calculated according to:

${\displaystyle {\text{MTTF}}={\frac {1}{\lambda }}[hours]\!}$

where λ is the failure rate for the component.

The relationship between MTBF and MTTF is expressed as:

${\displaystyle {\text{MTBF}}=MTTF+MTTR\!}$

where MTTR is the mean time to repair.

The MTTF of a system is the sum of MTTF_S and MTTF_D. To understand the relationship between MTTF_S and MTTF_D consider the case of a switch that turns a motor on or off. The switch has two failure modes: the switch can fail stuck closed or the switch can fail stuck open. If the switch fails stuck open, the motor will never energize; as a result, the motor will not create any hazards due to its operation. In contrast, if the switch fails stuck closed, this failure can lead to a dangerous situation like for example the case where the operator needs to stop the motor, but the motor will not stop because the switch is stuck in the closed position. The failure mode where the switch is stuck in the open position is denominated the safe failure mode, whereas the stuck closed failure mode is denominated the dangerous failure mode. The likelihood of occurrence of a dangerous or safe failure may differ and is a function of several variables in the construction and design of a component. A poorly designed switch may have a higher proportion of dangerous failures (thus a lower MTTF_D), whereas switches rated for use in safety circuits may very well preclude the occurrence of stuck closed failure modes (thus have infinite or very high MTTF_D). Assessing the performance level of a safety system, requires knowing the distribution of the dangerous vs. safe failure modes of its components and ultimately a determination of its MTTF_D.

• "Reliability and Availability Basics". EventHelix.
• Nix, Doug (2017). "ISO 13849–1 Analysis, Part 4: MTTFd Mean Time to Dangerous Failure". Machinery Safety 101.