Risk Assessment and FMEA Analysis Practice for Home Appliances

Introduction

In functional safety certification for home appliances, risk assessment is the foundation of the entire safety lifecycle. IEC 60730-1 Annex H explicitly requires systematic risk analysis for electronically controlled devices to identify potential hazards, assess risk levels, and determine appropriate safety measures. This article will provide an in-depth explanation of the core risk assessment method—FMEA (Failure Mode and Effects Analysis)—and demonstrate its application in home appliances through practical cases.

★ Insight ───────────────────────────────────── Three Key Values of Risk Assessment

1. Systematic Identification: Avoid missing critical failure modes through structured methods
2. Quantifiable Decision-Making: Objectively compare risk treatment priorities through RPN scoring
3. Traceability: Establish a complete traceability chain from hazard identification to measure verification ─────────────────────────────────────────────────

1. Role of Risk Assessment in IEC 60730

1.1 Overview of Standard Requirements

IEC 60730-1 Annex H establishes risk assessment as a mandatory requirement for functional safety evaluation. Section H.5 “Fault Evaluation” of the standard explicitly states:

For control systems using software, systematic fault analysis must be conducted to identify all fault modes that could lead to unsafe conditions, and to evaluate the effectiveness of existing protective measures.

The results of risk assessment directly affect:

• Safety classification of control functions (Class A/B/C)
• Software structure selection (single-channel/dual-channel)
• Determination of fault detection measures
• Scope definition of testing and verification

1.2 Four Objectives of Risk Assessment

Objective	Description	Output
Hazard Identification	Systematically identify all potential hazard sources	Hazard list
Risk Evaluation	Analyze hazard occurrence probability and consequence severity	Risk level
Measure Determination	Select appropriate safety measures based on risk levels	Safety function design
Integrity Verification	Confirm measures effectively reduce risks	Verification report

1.3 Relationship with Other Functional Safety Activities

                    ┌──────────────┐
                    │  Product     │
                    │  Definition  │
                    └──────┬───────┘
                           ↓
                    ┌──────────────┐
                    │  Risk        │ ← Focus of this article
                    │  Assessment  │
                    │  (FMEA)      │
                    └──────┬───────┘
                           ↓
        ┌──────────────────┼──────────────────┐
        ↓                  ↓                  ↓
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ Software      │ │ Safety        │ │ Test          │
│ Structure     │ │ Measure       │ │ Strategy      │
│ Selection     │ │ Design        │ │ Definition    │
└───────────────┘ └───────────────┘ └───────────────┘

2. Risk Identification Methods

2.1 Comparison of Common Risk Analysis Methods

Method	Full Name	Analysis Direction	Applicable Scenarios	IEC 60730 Application
FMEA	Failure Mode and Effects Analysis	Bottom-up	Component-level fault analysis	✅ Must use
FMECA	Failure Mode, Effects, and Criticality Analysis	Bottom-up + risk prioritization	FMEA with risk ranking	✅ Recommended
FTA	Fault Tree Analysis	Top-down	Specific hazard event analysis	⚠️ Supplementary
HAZOP	Hazard and Operability Study	Guideword system analysis	Process control systems	⚠️ Specific scenarios

2.2 FMEA Analysis Process

┌─────────────────────────────────────────────────────────┐
│                   FMEA Analysis Process                  │
└─────────────────────────────────────────────────────────┘

  ┌─────────┐   ┌─────────┐   ┌─────────┐   ┌─────────┐
  │ System  │ → │ Function│ → │  Fault  │ → │ Effect  │
  │ Definition│  │ Identification│ Identification│ Analysis│
  └─────────┘   └─────────┘   └─────────┘   └─────────┘
                                             │
                                             ↓
  ┌─────────┐   ┌─────────┐   ┌─────────┐   ┌─────────┐
  │ Measure │ ← │  Risk   │ ← │   SOD   │ ← │ Detection│
  │ Improvement│  │ Prioritization│  Scoring │  Response│
  └─────────┘   └─────────┘   └─────────┘   └─────────┘

2.3 Fault Mode Identification

Hardware Fault Modes

Fault Type	Typical Manifestation	Detection Difficulty	Example
Open Circuit	Pin breakage, solder joint detachment	Medium	Sampling resistor open causing false measurement
Short Circuit	Pin short, component breakdown	Low	MOSFET short causing continuous conduction
Parameter Drift	Resistance change, capacitance degradation	High	Sampling resistor drift causing measurement error
Performance Degradation	Aging, fatigue	High	Capacitance decrease causing filtering failure
Intermittent Fault	Poor contact, timing issues	Very high	Loose connector causing intermittent failure

Software Fault Modes

Fault Type	Typical Manifestation	Detection Difficulty	Example
Data Corruption	RAM bit flip, variable overflow	High	Sample value overflow causing false judgment
Program Flow Error	Infinite loop, unexpected jump	Medium	Watchdog failure causing hang
Timing Error	Task timeout, response delay	Medium	Protection response delay
Logic Error	Condition judgment error	High	Charging state judgment error
Communication Error	Packet loss, checksum failure	Low	CAN communication interruption

★ Insight ───────────────────────────────────── Hierarchical Analysis of Fault Modes Hardware faults can usually be detected through physical measurement (voltage, current, temperature); while software faults are more hidden, requiring multiple layers of protection to ensure reliability:

1. Program flow monitoring (watchdog, state machine)
2. Data integrity checking (CRC, checksum)
3. Reasonableness checking (boundary checking, range validation) ─────────────────────────────────────────────────

3. Detailed FMEA Analysis Steps

3.1 Core Scoring Parameters

FMEA analysis quantifies risk through three dimensions:

Severity (S)

Score	Degree	Description	Home Appliance Example
10	Extremely Hazardous	No warning, could cause death	Battery fire/explosion
9	Very Serious	Could cause permanent injury	High-voltage electric shock
8	Serious	Requires medical emergency	Burn injury
7	High	Permanent minor injury	Equipment damage
6	Moderate	Requires medical treatment	Minor burn
5	Low	Temporary injury	Function failure
4-1	Minor or Less	Minor discomfort or no impact	Performance degradation

Occurrence (O)

Score	Probability	Typical Failure Frequency	Home Appliance Reference
10	Extremely High	>1/10	Frequent mechanical switch operation
9	Very High	1/20	Relay mechanical wear
8	High	1/100	Capacitor aging
7	Moderate High	1/500	Sensor drift
6	Moderate	1/1,000	Solder joint fatigue
5	Low	1/10,000	MCU occasional fault
4-1	Very Low or Less	<1/100,000	Component early failure

Detection (D)

Score	Likelihood	Detection Capability	Home Appliance Example
10	Absolutely Impossible	No detection measures	Pure hardware mechanical fault
9	Very Remote	Only discovered after failure	MCU without self-test
8	Remote	Random testing possible	Periodic functional test
7	Very Low	Periodic inspection possible	Annual maintenance inspection
6	Low	Periodic testing possible	Cyclical self-test
5	Moderate	Self-test non-real-time	Power-on self-test
4	Moderately High	Periodic real-time self-test	Per-minute detection
3	High	Real-time monitoring	Per-second detection
2	Very High	Almost certain detection	Redundant detection
1	Almost Certain	Multiple redundancy + real-time	2-out-of-3 logic

3.2 RPN Calculation and Evaluation

RPN (Risk Priority Number) = Severity (S) × Occurrence (O) × Detection (D)

Risk Acceptance Criteria:

RPN Range	Risk Level	Measure Requirements	Timeline
1-50	Low Risk	Acceptable, continuous monitoring	Next version improvement
51-100	Medium Risk	Improvement measures needed	Improve within 3 months
101-200	High Risk	Must take measures	Improve within 1 month
201-1000	Very High Risk	Immediate corrective measures	Immediate rectification

3.3 Three Levels of FMEA Analysis

Local Effect

Consequences of the fault on directly affected components or subsystems.

Example: Current sampling resistor open

• Local effect: Current detection circuit outputs 0V

System Effect

Impact of the fault on the entire control system functionality.

Example: Current sampling resistor open

• System effect: BMS cannot accurately detect charging current

End Effect

Final consequences of the fault on users, equipment, or environment.

Example: Current sampling resistor open

• End effect: Possible overcurrent without protection, leading to battery thermal runaway

4. Risk Acceptance Criteria

4.1 IEC 60730 Risk Acceptance Principles

Although the standard does not provide an explicit risk acceptance matrix, it implies requirements through:

1. Fault Tolerance Time: For Class B functions, fault detection and response must be completed within the fault tolerance time
2. Fault Detection Coverage: Software architecture must be capable of detecting all fault modes listed in Table H.2
3. Safe State Definition: Any detected fault must be able to bring the system into a safe state

4.2 Home Appliance Risk Acceptance Matrix

              Severity (S)
            High │    Medium    │    Low
               │         │
    ┌───────────┼───────────┼───────────┐
 High │ Unacceptable│ Undesired │ Acceptable│
    │ (Immediate  │ (Must     │ (Continuous│
    │  Improve)   │  Improve) │  Monitor) │
    ├───────────┼───────────┼───────────┤
 Low  │ Undesired │ Acceptable│ Acceptable│
    │ (Must     │ (Continuous│ (Continuous│
    │  Improve) │  Improve) │  Monitor) │
    └───────────┴───────────┴───────────┘
              Occurrence (O)

4.3 ALARP Principle Application

In risk assessment, the ALARP (As Low As Reasonably Practicable) principle is widely adopted:

        Risk Level
          High
           │
           │    Unacceptable Region
           │    (Must reduce risk)
           │
    ───────┼────────────
           │    ALARP Region
           │    (Cost-benefit analysis)
           │
    ───────┼────────────
           │    Acceptable Region
           │    (Continuous monitoring)
           ↓
          Low

5. Practical Case Demonstration

5.1 Case Background: Water Heater Over-Temperature Protection

Product Description:

• Product Type: Storage electric water heater
• Control Method: MCU-controlled heating element
• Safety Function: Prevent water temperature from causing scalding or container rupture

Function Definition:

Function	Safety Class	Fault Tolerance Time	Defined State
Over-temperature protection	Class B	5 seconds	Disconnect heating circuit

5.2 FMEA Analysis Table

Component	Fault Mode	Fault Cause	Local Effect	System Effect	End Effect	S	O	D	RPN	Detection Measure	Response Measure
NTC Temperature Sensor	Open	Wire break	Reads minimum temperature	False low temperature	Continuous heating	9	4	3	108	Open detection	Disconnect heating
NTC Temperature Sensor	Short	Sensor damage	Reads maximum temperature	False high temperature	Stop heating	5	3	2	30	Short detection	Normal response
ADC Sampling	Accuracy Drift	Reference voltage drift	Reading error	Threshold judgment offset	Possible over-temperature	8	5	5	200	Dual ADC comparison	Disconnect heating
MCU Program	Freeze	Watchdog failure	Program unresponsive	Protection failure	Continuous heating	9	2	4	72	Hardware watchdog	System reset
Relay	Welded	Contact weld	Cannot open	Protection failure	Continuous heating	9	4	4	144	Status feedback	Alarm + backup protection
Heating Element	Breakdown Short	Insulation aging	Continuous heating	Protection may fail	Container overpressure	8	2	3	48	Current monitoring	Disconnect main power

5.3 High-Risk Item Analysis and Improvement

Item 1: NTC Sensor Open (RPN=108)

Problem Analysis:

• When sensor is open, ADC reading is at minimum value
• Software misjudges as low temperature, may continue heating
• Leads to serious scalding risk

Improvement Measures:

Measure Type	Specific Solution	Detection Improvement	New RPN
Hardware Improvement	Add pull-up resistor, outputs high level when open	D: 3→2	72
Software Improvement	Open detection logic + range check	D: 3→2	72
System Improvement	Add mechanical thermostat as backup protection	D: 3→1	36

Post-Implementation Effect:

Original: RPN = 9 × 4 × 3 = 108 (High Risk)
Improved: RPN = 9 × 4 × 1 = 36 (Low Risk, Acceptable)

Item 2: ADC Accuracy Drift (RPN=200)

Problem Analysis:

• Reference voltage drift causes temperature reading error
• May lead to incorrect overcharge or undercharge judgment
• Extremely high risk level

Improvement Measures:

// Dual ADC sampling comparison implementation
typedef struct {
    uint16_t adc1_value;
    uint16_t adc2_value;
    uint16_t final_value;
} TempSample_t;

uint16_t read_temperature_safe(void) {
    TempSample_t sample;

    // 1. Dual ADC sampling
    sample.adc1_value = ADC1_Read(TEMP_CHANNEL);
    sample.adc2_value = ADC2_Read(TEMP_CHANNEL);

    // 2. Comparison check
    uint16_t delta = abs(sample.adc1_value - sample.adc2_value);

    if (delta > ADC_THRESHOLD) {
        // ADC mismatch, possible fault
        error_handler(ERR_ADC_MISMATCH);
        return SAFE_DEFAULT_TEMP;
    }

    // 3. Average value
    sample.final_value = (sample.adc1_value + sample.adc2_value) / 2;

    // 4. Range check
    if (sample.final_value < TEMP_MIN || sample.final_value > TEMP_MAX) {
        error_handler(ERR_TEMP_OUT_OF_RANGE);
        return SAFE_DEFAULT_TEMP;
    }

    return sample.final_value;
}

Post-Implementation Effect:

• Detection improved from 5 to 2 (almost certain detection)
• New RPN = 8 × 5 × 2 = 80 (Medium risk, requires continuous improvement)

5.4 Case Summary

Through systematic FMEA analysis, this case achieved:

Improvement Item	Before Improvement	After Improvement	Effect
Sensor Open Detection	None	Hardware + Software dual detection	RPN reduced by 67%
ADC Accuracy Monitoring	Single path	Dual path comparison	RPN reduced by 60%
Relay Status Feedback	None	Status readback verification	New protection
Backup Protection	Pure software	Hardware mechanical thermostat	Independent protection

★ Insight ───────────────────────────────────── FMEA-Driven Safety Design Iteration This case demonstrates how FMEA drives continuous improvement in safety design:

1. Identify high-risk items (RPN > 100)
2. Analyze root causes and improvement paths
3. Implement multi-level protection measures
4. Verify improvement effectiveness (recalculate RPN)
5. Form closed-loop documentation This iterative method ensures the effectiveness and traceability of safety measures. ─────────────────────────────────────────────────

6. Common Pitfalls and Best Practices

6.1 Common Pitfalls

Pitfall 1: FMEA Only Needs to Be Done Once

Misconception: FMEA is a one-time activity, can be archived once completed.

Correct Practice: FMEA is a living document, should be updated when:

• Design changes occur
• New fault modes are discovered
• Field failures occur
• Regular reviews (e.g., annually)

Pitfall 2: The Lower the RPN, The Better

Misconception: Pursue lowering RPN for all items to the minimum.

Correct Practice: Based on ALARP principle, balance safety and cost:

• Prioritize high-risk items
• Reasonably improve medium-risk items
• Continuously monitor low-risk items

Pitfall 3: Rely on Software to Solve All Problems

Misconception: Any fault can be detected and protected through software.

Correct Practice: Follow failure-oriented design principles:

• Hardware first: independent protection devices
• Software assistance: detection and response
• Redundant design: multi-level protection

Pitfall 4: Detection Measures Only Need to Be Listed

Misconception: In FMEA, just listing detection measures is sufficient, no need for verification.

Correct Practice: All detection measures must be verified:

• Fault injection testing
• Boundary condition testing
• Long-term reliability testing

6.2 Best Practices

Practice 1: Establish FMEA Checklist

FMEA Completeness Checklist:
□ All safety functions analyzed
□ Table H.2 fault modes covered
□ Hardware and software faults considered
□ Three-level effects (local/system/end) analyzed
□ SOD scoring has clear basis
□ RPN > 100 items have improvement plans
□ All detection measures have verification methods
□ Document version clearly traceable

Practice 2: Use Structured Templates

Column	Content	Filling Requirements
Function/Component	Clear analysis object	Down to component level
Fault Mode	Standardized fault description	Reference Table H.2
Fault Cause	Root cause analysis	Not limited to surface causes
Effect Analysis	Three-level effect description	Clear and specific
Detection Measure	Specific detection method	Verifiable implementation
SOD Scoring	Standard-based scoring	Note scoring basis
Improvement Plan	High-risk item measures	Clear timeline

Practice 3: Team Review Mechanism

FMEA Review Process:
┌─────────────┐
│ Initial     │ → Scoring and measures complete
│ Draft       │
└──────┬──────┘
       ↓
┌─────────────┐
│ Peer        │ → Other engineers review
│ Review      │
└──────┬──────┘
       ↓
┌─────────────┐
│ Expert      │ → Functional safety expert confirmation
│ Review      │
└──────┬──────┘
       ↓
┌─────────────┐
│ Approval    │ → As baseline document
│ Release     │
└─────────────┘

Practice 4: Closed Loop with Testing and Verification

FMEA → Test Cases → Test Execution → Result Feedback → FMEA Update
   ↑                                            │
   └────────────────────────────────────────────┘

6.3 Relationship Between FMEA and Other Safety Activities

Activity	Relationship with FMEA	Output/Input
Hazard Analysis	Prerequisite to FMEA	Hazard list → FMEA
Functional Safety Assessment	FMEA is core input	FMEA → Assessment report
Fault Injection Testing	FMEA defines test scope	Test results → FMEA verification
Safety Requirement Definition	FMEA drives safety requirements	Safety requirements → FMEA measures
Design Verification	FMEA defines verification scope	Verification results → FMEA update

Conclusion

Risk assessment and FMEA analysis are foundational work for IEC 60730 functional safety certification. Through systematic FMEA analysis, you can:

1. Comprehensively Identify Risks: Avoid missing critical fault modes
2. Quantify Risk Levels: Objectively compare risk priorities through RPN
3. Drive Safety Design: Select appropriate measures based on risk levels
4. Establish Traceability Chain: Complete records from hazard identification to verification

Effective FMEA is not a one-time document, but a dynamic management process throughout the product lifecycle. Through continuous review, update, and verification, FMEA becomes an important guarantee for product functional safety.

---

Reference Standards

1. IEC 60730-1:2022 Annex H - Household and similar electrical automatic controls - Functional safety requirements
2. IEC 60812:2018 - Analysis techniques for system reliability - Procedure for failure mode and effects analysis (FMEA)
3. IEC 61508:2010 - Functional safety - Basic standard

---

The author is a functional safety certification assessment engineer. The content is organized based on IEC 60730-1 Annex H requirements and actual certification experience.