Introduction
As the wave of intelligence sweeps through the home appliance industry, from rice cookers to washing machines, from air conditioners to water heaters, microcontrollers (MCUs) and software algorithms have become the core brain of modern home appliances. However, when software controls critical functions such as heating, cooling, and operation of devices, a software defect or hardware failure can lead to serious consequences—thermal runaway fires, battery explosions, equipment damage, and more.
This is precisely the context in which IEC 60730-1 Annex H was born. As an international standard for software functional safety in home appliances, Annex H establishes a rigorous framework of safety requirements for automatic electrical controls that use software.
★ Insight ─────────────────────────────────────
Key Understanding of Standard Positioning
- IEC 60730 is a functional safety supplement to product safety standards (such as IEC 60335), working together to ensure overall safety
- Annex H specifically addresses controls using software—pure hardware or mechanical designs are not subject to this appendix
- This standard is the industry application version of IEC 61508 (functional safety base standard) in the home appliance field
─────────────────────────────────────────────────
1. What is IEC 60730-1
1.1 Standard Full Name and Positioning
IEC 60730-1 is fully titled “Automatic electrical controls for household and similar use - Part 1: General requirements.”
The standard is developed by the International Electrotechnical Commission (IEC), with the latest version being IEC 60730-1:2022 (6th Edition).
1.2 Position of Annex H in the Standard
Annex H is a normative appendix of IEC 60730-1, titled “Requirements related to functional safety”.
IEC 60730-1 Standard Structure
├── Chapters 1-20: General Safety Requirements
│ ├── Traditional safety requirements such as electrical safety, insulation, temperature rise
│ └── Basic safety specifications applicable to all controls
└── Annex H: Functional Safety Requirements ← Focus of this article
├── H.3: Terms and definitions
├── H.4: Structural requirements
├── H.5: Fault evaluation
├── H.6: Electromagnetic compatibility (EMC)
├── H.7: Software requirements
├── H.11-H.16: Fault protection requirements
├── H.22: Class A/B/C classification
└── H.25: Software architecture requirements1.3 Product Scope
Annex H applies to the following products:
| Product Category | Typical Examples |
|---|---|
| Major Appliances | Refrigerators, washing machines, air conditioners, water heaters, ovens |
| Small Appliances | Rice cookers, microwave ovens, vacuum cleaners, coffee makers |
| Kitchen Appliances | Dishwashers, food processors, blenders |
| Power Tools | Electric drills, saws, sanders |
| Energy Storage Systems | Battery Management Systems (BMS), home energy storage devices |
★ Insight ─────────────────────────────────────
Product Safety vs Functional Safety
Traditional product safety focuses on protection during normal conditions—preventing electric shock, fire, etc. through physical means such as insulation, creepage/clearance, and flame-retardant materials. Functional safety focuses on response during fault conditions—ensuring that control systems can respond correctly and enter a safe state when a fault occurs.
─────────────────────────────────────────────────
2. Class A/B/C Classification System
The core innovation of IEC 60730-1 lies in classifying control functions into three categories based on their importance to safety:
2.1 Class A: Non-Safety-Related Controls
Definition: Control functions that are not used to ensure equipment safety
Characteristics:
- Faults do not result in safety risks
- No functional safety measures required
- Not subject to Annex H software structure requirements
Typical Applications:
- Room temperature regulation (comfort control)
- Timer switch functions
- Power consumption display, status indication
- User interface interaction
2.2 Class B: Preventing Unsafe States
Definition: Control functions intended to prevent equipment from entering unsafe states, whose failure does not directly lead to danger
Characteristics:
- Used for safety protection but not directly facing danger
- Must reach a safe state under single fault conditions
- Requires fault detection mechanisms
- Software must meet Annex H requirements
Typical Applications:
| Application Scenario | Safety Function | Control Class |
|---|---|---|
| Water heater | Over-temperature protection (preventing excessive water temperature) | Class B |
| BMS | Overvoltage/undervoltage protection | Class B |
| BMS | Overcharge/over-discharge protection | Class B |
| Air conditioner | Compressor overload protection | Class B |
| Motor | Overcurrent protection | Class B |
| Pressure vessel | Pressure limiter | Class B |
2.3 Class C: Preventing Special Hazards
Definition: Control functions intended to prevent special hazards (such as explosions) or whose failure could directly lead to danger
Characteristics:
- Prevents special hazards such as explosions
- Faults may directly lead to danger
- Requires the highest level of redundancy and monitoring
- Must consider both first and second faults
Typical Applications:
- Burner control systems
- Closed water system thermal cutouts
- Explosion-proof related control systems
2.4 Classification Comparison
| Characteristic | Class A | Class B | Class C |
|---|---|---|---|
| Safety Dependency | Not safety-dependent | Prevents unsafe states | Prevents special hazards |
| Failure Consequence | Does not lead to danger | Does not directly lead to danger | May directly lead to danger |
| Software Assessment | Not required | Requires Annex H assessment | Requires rigorous assessment |
| Fault Tolerance | Not considered | Single fault condition | First + second faults |
| Typical Example | Room thermostat | Temperature limiter | Burner control |
★ Insight ─────────────────────────────────────
Why Energy Storage Systems Typically Require Class B
BMS protection functions in energy storage systems (overvoltage, overcurrent, over-temperature, etc.) fall under Class B because:
- These functions prevent unsafe states
- A single fault does not directly lead to danger (other protection layers exist)
- Aligns with cost-effectiveness principles (Class C requirements are excessive)
─────────────────────────────────────────────────
3. Core Requirements of Annex H
3.1 Table H.1: Additional Information Requirements
Table H.1 specifies the list of information that must be provided for functional safety assessment:
| Clause | Requirement | Description |
|---|---|---|
| H.1 | Protection measure test instructions | How to verify protection functions |
| H.2 | Other control effect descriptions | Interaction with other controls |
| H.3 | Software sequence documentation | Software flow description |
| H.4 | Program documentation | Code and design documentation |
| H.5 | Software fault analysis | FMEA and other analysis reports |
| H.6 | Software class and structure | Class classification and architecture |
| H.7 | Analysis measures | Fault control measures taken |
| H.8 | Fault detection time | Declaration of time to detect faults |
| H.9 | Fault response | Response after fault detection |
| H.10 | Second fault analysis | Required for Class C |
| H.11 | Fault reaction time | Time for entire response chain |
| H.12 | Control function class | A/B/C classification description |
3.2 Table H.2: Fault/Error Control Measures
This is the most critical table in Annex H, specifying acceptable measures for different component faults.
| Component/Fault | Class B/C Requirement |
|---|---|
| CPU Registers (Stuck-at, DC faults) | Periodic self-test or functional test |
| Program Counter (stuck, jump errors) | Program flow monitoring, watchdog |
| Clock (frequency abnormality) | Frequency monitoring, independent clock source |
| Program Memory (single/multi-bit faults) | CRC, checksum |
| Data Memory (dynamic faults) | March test, GALPAT |
| Interrupt Handling (lost/too frequent) | Interrupt monitoring, reasonableness check |
| External Communication (data errors) | Hamming Distance 3 (Class B) or 4 (Class C) |
| I/O Peripherals (fault conditions) | Output feedback, reasonableness check |
3.3 Software Structure Requirements
Based on Class categories, Annex H specifies different software structure options:
Available Class B Structures:
-
Single Channel + Functional Test (H.3.16.5)
- Introduce test data before operation
- Suitable for startup testing
-
Single Channel + Periodic Self-Test (H.3.16.6)
- Periodically test components during operation
- Most commonly used Class B structure
-
Dual Channel Without Comparison (H.3.16.1)
- Two independent channels without comparison
- Redundant design
Available Class C Structures:
-
Single Channel + Periodic Self-Test + Monitoring (H.3.16.7)
- Add independent monitoring means
-
Dual Channel (Homogeneous) + Comparison (H.3.16.3)
- Two identical channels compare outputs
-
Dual Channel (Heterogeneous) + Comparison (H.3.16.2)
- Two different channels compare outputs
- Highest reliability level
3.4 Key Fault Control Techniques
1. Watchdog Timer (H.3.18.10.4)
Type Selection:
- Window Watchdog: Detects program running too fast or too slow (recommended)
- Timeout Watchdog: Only detects timeout
- Independent Watchdog: Independent clock source (high reliability)
Configuration Requirements:
- Independent clock source
- Reasonable timeout period
- Correct watchdog feeding strategy
2. Memory Testing
| Memory | Detection Technique | Detection Capability |
|---|---|---|
| Flash | CRC/Checksum | Single and multi-bit errors |
| RAM | March test, GALPAT | Coupling faults, stuck faults |
| EEPROM | Checksum | Single-bit errors |
3. Program Flow Monitoring (H.3.18.10)
Ensures the program executes in the predetermined sequence, detecting anomalies such as runaway or infinite loops.
Implementation Methods:
- State machine monitoring
- Flag bit checking
- Time slot monitoring
★ Insight ─────────────────────────────────────
Criticality of Fault Detection Time
The standard requires faults to be detected and responded to within the “fault tolerating time.” For rapidly developing hazards (such as short circuits), millisecond-level detection is needed; for slower hazards (such as over-temperature), second-level detection may be sufficient. This time is a core parameter in risk assessment.
─────────────────────────────────────────────────
4. Relationship with Other Functional Safety Standards
4.1 Functional Safety Standard System
IEC 61508
(Base Standard - All Fields)
|
+------------------+------------------+
| | |
IEC 62061 ISO 13849 IEC 60730
(Machine Safety- (Machine Safety- (Household and Similar
SRP/CS) PL Assessment) Controls-Annex H)
| |
+ +
IEC 61513 IEC 62619
(Nuclear Field) (Battery Systems)4.2 IEC 60730 vs IEC 61508
| Comparison Dimension | IEC 60730 | IEC 61508 |
|---|---|---|
| Positioning | Home appliance controller industry standard | Functional safety base standard |
| Application Field | Household and similar use | All electrical/electronic systems |
| Safety Level | Class A/B/C | SIL 1-4 |
| Complexity | Relatively simple | Highly complex |
| Documentation Requirements | Table H.1 checklist | Detailed safety plan |
| Implementation Cost | Relatively low | Higher |
4.3 Relationship with Safety Standards
Functional safety and product safety (safety regulations) are complementary:
Product Safety
(Basic Assurance)
Electrical Insulation, Creage
Flame Retardant Materials, Protection
+
+
Functional Safety
(Active Protection)
Fault Detection, Safety Response
↓
Overall SafetySafety Standard References to Annex H:
- IEC 60335-1 (Household Appliance Safety): References software assessment requirements
- IEC 62619 (Lithium Battery Safety): Requires protection functions to comply with functional safety
- UL 1973 (Energy Storage Batteries): Explicitly requires Class B protection
5. Implementation Roadmap Recommendations
5.1 Implementation Steps
1. Requirements Analysis
├─ Identify all control functions
├─ Analyze failure consequences
└─ Determine Class classification
2. Architecture Design
├─ Select software structure (single channel + self-test, etc.)
├─ Design fault detection mechanisms
└─ Define safe states
3. Detailed Design
├─ Hardware selection (MCU, sensors, etc.)
├─ Software module design
└─ Fault response logic
4. Implementation Development
├─ Write code
├─ Unit testing
└─ Integration testing
5. Verification and Validation
├─ Fault injection testing
├─ EMC testing (Level 3)
└─ Functional safety assessment
6. Certification Application
├─ Prepare technical documentation
├─ Coordinate assessment testing
└─ Obtain certification certificate5.2 Common Implementation Challenges
| Challenge | Solution |
|---|---|
| Unclear Class Classification | Conduct systematic FMEA analysis to evaluate failure consequences |
| Long Fault Detection Time | Optimize self-test algorithms, use hardware acceleration |
| Watchdog and CPU Share Same Source | Use external watchdog chip or independent clock source |
| Memory Testing Destroys Data | Use non-destructive testing algorithms |
| EMC Testing Failure | Add hardware filtering, optimize PCB layout |
| Incomplete Documentation | Use standard templates, establish documentation system |
5.3 Certification Assessment Process
Project Start → Data Collection → Risk Assessment → Document Review
↓
Hardware Assessment → Software Assessment → Test Verification → System Integration Assessment
↓
Report Preparation → Certification Decision → Certificate IssuanceTypical Assessment Cycle:
- Simple Class B products: 4-6 weeks
- Medium complexity Class B: 6-10 weeks
- Complex systems (such as BMS): 10-16 weeks
6. Summary and Outlook
IEC 60730-1 Annex H provides a clear implementation framework for software functional safety in home appliances. Through core elements such as Class A/B/C classification, software structure requirements, and fault control techniques, this standard helps manufacturers build reliable software control systems.
Key Takeaways:
- Clear Positioning: Annex H is a functional safety supplement to product safety standards
- Scientific Classification: Class A/B/C reasonably graded based on failure consequences
- Clear Structure: Table H.1 and H.2 provide clear implementation guidelines
- Feasible Implementation: From single channel + self-test to dual channel comparison, multiple options available
Future Trends:
- Deepening Intelligence: Application of AI and machine learning in home appliances requires new functional safety approaches
- Interconnectivity: Remote control of IoT devices brings new safety challenges (H.9.12.4)
- Standard Evolution: IEC 60730-1:2022 has been updated, need to pay attention to version changes
- Regional Differences: UL 60730 is basically consistent with IEC 60730 in Annex H, but national differences must be noted
For home appliance product engineers and software developers, understanding and implementing IEC 60730-1 Annex H requirements is not only a necessary condition for products to enter international markets, but also the cornerstone of building user trust and ensuring product safety.
Reference Resources
Standard Documents:
- IEC 60730-1:2022 - Automatic electrical controls - Part 1: General requirements
- IEC 61508 series - Functional safety of electrical/electronic/programmable electronic safety-related systems
Related Standards:
- IEC 60335-1 - Household and similar electrical appliances - Safety
- IEC 62619 - Secondary lithium cells and batteries for industrial applications
- UL 60730-1 - Standard for Automatic Electrical Controls (US version)
Further Reading:
Document Version: 1.0 For questions or need further technical support, please contact relevant certification bodies or functional safety experts
