Accendo Reliability

Your Reliability Engineering Professional Development Site

  • Home
  • About
    • Contributors
  • Reliability.fm
    • Speaking Of Reliability
    • Rooted in Reliability: The Plant Performance Podcast
    • Quality during Design
    • Critical Talks
    • Dare to Know
    • Maintenance Disrupted
    • Metal Conversations
    • The Leadership Connection
    • Practical Reliability Podcast
    • Reliability Matters
    • Reliability it Matters
    • Maintenance Mavericks Podcast
    • Women in Maintenance
    • Accendo Reliability Webinar Series
    • Asset Reliability @ Work
  • Articles
    • CRE Preparation Notes
    • on Leadership & Career
      • Advanced Engineering Culture
      • Engineering Leadership
      • Managing in the 2000s
      • Product Development and Process Improvement
    • on Maintenance Reliability
      • Aasan Asset Management
      • CMMS and Reliability
      • Conscious Asset
      • EAM & CMMS
      • Everyday RCM
      • History of Maintenance Management
      • Life Cycle Asset Management
      • Maintenance and Reliability
      • Maintenance Management
      • Plant Maintenance
      • Process Plant Reliability Engineering
      • ReliabilityXperience
      • RCM Blitz®
      • Rob’s Reliability Project
      • The Intelligent Transformer Blog
    • on Product Reliability
      • Accelerated Reliability
      • Achieving the Benefits of Reliability
      • Apex Ridge
      • Metals Engineering and Product Reliability
      • Musings on Reliability and Maintenance Topics
      • Product Validation
      • Reliability Engineering Insights
      • Reliability in Emerging Technology
    • on Risk & Safety
      • CERM® Risk Insights
      • Equipment Risk and Reliability in Downhole Applications
      • Operational Risk Process Safety
    • on Systems Thinking
      • Communicating with FINESSE
      • The RCA
    • on Tools & Techniques
      • Big Data & Analytics
      • Experimental Design for NPD
      • Innovative Thinking in Reliability and Durability
      • Inside and Beyond HALT
      • Inside FMEA
      • Integral Concepts
      • Learning from Failures
      • Progress in Field Reliability?
      • Reliability Engineering Using Python
      • Reliability Reflections
      • Testing 1 2 3
      • The Manufacturing Academy
  • eBooks
  • Resources
    • Accendo Authors
    • FMEA Resources
    • Feed Forward Publications
    • Openings
    • Books
    • Webinars
    • Journals
    • Higher Education
    • Podcasts
  • Courses
    • 14 Ways to Acquire Reliability Engineering Knowledge
    • Reliability Analysis Methods online course
    • Measurement System Assessment
    • SPC-Process Capability Course
    • Design of Experiments
    • Foundations of RCM online course
    • Quality during Design Journey
    • Reliability Engineering Statistics
    • An Introduction to Reliability Engineering
    • An Introduction to Quality Engineering
    • Process Capability Analysis course
    • Root Cause Analysis and the 8D Corrective Action Process course
    • Return on Investment online course
    • CRE Preparation Online Course
    • Quondam Courses
  • Webinars
    • Upcoming Live Events
  • Calendar
    • Call for Papers Listing
    • Upcoming Webinars
    • Webinar Calendar
  • Login
    • Member Home

by Larry George 4 Comments

Error in Inspection Time Interval

Error in Inspection Time Interval

IEC 60601-1 says… Estimate the probability per time pe of an electrical failure and of an oxygen leak po. Determine the accepted probability of dangerous failures [fire] per time r. Calculate the inspection time interval tc = r/(0.5*pe*po).

A friend asked, “What’s the 0.5 for? It doesn’t account for the fire event sequence: leak before spark.” I posted correction tc = r/((po/(po+pe))*pe*po) and notified the IEC committee which acknowledged, “We’ll consider your suggestion for edition 4.”

[An earlier, shorter version of this article on www.LinkedIn.com, July 5, 2018. This version describes an inspection-time and risk-analysis template.]

Risk-Based Inspection (RBI)

Risk is expected cost: P[failure]*(Cost of failure), SUM[P[failure j]*(Cost of failure j); j=1,2,…], INTEGRATE[P[failure j at age t]*(Cost of failure j at age t)dt, t = 0 to ???, j=1,2,…], or discounted costs of future failures. Refer to Jorgenson, McCall, and Radner for inspection policies for randomly failing equipment.  

RBI became fashionable in the oil and gas industry where the effects of corrosion or other one-way processes call for periodic inspection. RBI deserves credit for taking into account costs and probabilities [API RP 581]. RBI simplifies the inspection time to avoid some statistics. 

There is a lot of guidance for oxygen use and fire risk [EIGA; Fluke; ANSI/AAMI; Ordin; Taghipour et al.; The WHO, ISO 14971:2007; NHS]. For medical equipment that uses oxygen, the IEC misoversimplified the computation of risk-based inspection time. 

Standard Error

2013 ANSI/AAMI ES60601-1:2005 & A1:2012 “Medical Electrical Equipment, Oxygen-Rich Environment,” sub-clause 11.2.2.1 b) 3) says, 

“The cause of the hazardous situation is: a leak occurs and is not detected, some time later an electrical failure occurs that starts an ignition. The time interval tc for checking the seals can be calculated as follows:

Estimate the probability per time pe of an electrical failure that exceeds the values given in 11.2.2.1 a).

Estimate the probability per time of an oxygen leak po:

Determine the accepted probability of dangerous failures per time r:

Calculate tc = r/(0.5*pe*po).”

In September 2017, I posted a correction, tc = r/((po/(po+pe))*pe*po), and notified the relevant IEC committee representatives, because  P[X(leak) < Y(spark)] = po/(po+pe) for independent exponentially distributed time random variables X and Y with means 1/po and 1/pe. 

That correction is an oversimplification. It doesn’t account for all possible events before inspection time tc. Both those tc formulas result in too long inspection times, and the probability of “dangerous failure” is greater than “accepted probability” r-value, because P[X(leak) < Y(spark)]*po*pe*tc is not the same as P[X(leak) < Y(spark) < tc].

Multiple Events?

Later the friend said, “… the event [electrical failure] we’re describing is quite complex and may involve multiple events.  For example, think about the spark event: we don’t care if any numbers of sparks happen before the oxygen leak occurs, so we have to be careful to exclude those sparks and only consider what happens after the leak.” “But what we actually want is the ‘time it takes to get the first spark after the oxygen leak,’ which is not the same as P[X(leak)<Y(spark)<tc] – the first spark after the leak might be the 100th spark overall, but since the first 99 happened before the leak they had no effect.”

Electrical failures may be recurrent events so “the cause of the hazardous situation” could be the occurrence of at least one spark after O2 leak but before (end of) inspection time interval tc. I.e., under the assumption of constant electrical failure rate, sparks could be events in a Poisson process. Furthermore, the probability of failure depends on proximity of inspection time tc to the time to first leak, time between sparks, and tc. 

Alternative “hazardous situation” ignition probabilities in inspection time interval tc are: 

0.5*po*pe*tc; (IEC ANSI/AAMI 60601-1 recommendation)

(po /(po+pe))*po*pe*tc;  (September 2017 recommendation)

P[X < Y < tc] where X and Y are independent, exponentially distributed times to first O2 leak and first electrical failure; and 

P[Leak AND at least one spark after leak AND before tc], the integral from  y = 0 to tc of 
(1–Exp(pe*(–tc + y)))*po*Exp[–po*y]dy (Sparks are a Poisson process.).

Mathematica gives formulas for P[X < Y < tc] and P[Leak (X) AND at least one spark (Y) after leak AND before tc]. They have been implemented in an Excel workbook IECompar.xlsx in the list of files on https://sites.google.com/site/fieldreliability/. Observations:

0.5*po*pe*tc < (po /(po+pe))*po*pe*tc  when po > pe, which means inspection time interval tc = r/(0.5*po*pe) is too long; 

P[X < Y < tc] is slightly less than 0.5*po*pe*tc for small po and pe but much greater for larger po and pe relative to tc, which means time interval tc will be too long; and 

P[Leak AND at least one spark after leak AND before tc] is greater than P[X < Y < tc]. 

Figure 1. Probability of leak followed by electrical failure before tc, for alternative formulas. The last two alternatives are the upper line, practically the same for chosen event rates. 

These observations call for correction of IEC/AAMI EC60601-1 sub clause 11.2.2.1 b) 3) to the correct time interval tc and perhaps to recommend detection and reporting when at least one electrical failure has occurred. The IEC and AAMI have acknowledged that “will be considered for edition 4. maybe in 2019” [Weir].  

Risk of delay [ISO 14971:2007]

The inspection time interval tc is too long resulting in greater “hazardous situation” probability of dangerous failure than the input “accepted probability” r-value. The workbook IECompar.xlsx includes a risk analysis template [Tables 1 or 2]. Send data if you would like to test the hypotheses of exponential times between events and their independence or if you would like me to compute your products’ risks. 

Tables 1 and 2 show spreadsheet risk analysis templates. Risk = E[count*P[Failure per unit time]*cost per failure]. Be realistic. Get inventory counts, event data, and costs. Make event rate estimates, test hypotheses, estimate confidence intervals, and do sensitivity analyses. Adjust inspection time tc based on experience. Consider and evaluate alternatives’ marginal costs (bang-per-buck). Supplement with subjective “analyses”, RPNs, ranks, or categorical ratings a la ISO 14971:2007, FMEA, RCM, etc. Table columns are: Equipment, ignition source(s), inspect, and…

“Count” is the number of medical-electronic oxygen-enhanced equipment units in the field

“r” is the acceptable probability of failure, leak followed by electrical failure before inspection time tc

“po” and “pe” are the leak and electrical failure rates per unit time

“tc” is your current inspection time interval, tc = r/(0.5*po*pe) (table 1) or tc = r/((po/(po+pe))*pe*po) (table 2) 

“P{fail}” is the computed probability of failure during inspection interval tc, depending on whether electrical failure is recurrent process

“$/Failure” is the cost of “hazardous situation” (ignition) plus replacement cost

“Risk” formula depends on whether electrical failure is a one-time event or Poisson process. 

“Risk per year” converts risk assuming continuous operation and time unit is hours.

Table 1. Risk analysis. Risk = E[Cost] per inspection interval tc. Time units of r, po, and pe must be commensurate; e.g., per hour. tc = r/(0.5*pe*po). Compare computed risk with “accepted probability” r-value times cost per failure = risk).  See below this table for the rest of the columns.

 EquipmentIgnition source(s)Inspect
1ConcentratorConcentrator electrical, externalConcentrator, environ-mental flammables
2O2 tank and supply Electro-surgical equipment, O2 masks, ventilatorsExternalEnvironment flammables
3CPAP+Q2CPAPCPAP
4BiPAP+O2BiPAPBiPAP
5AEDs and defibrillators in O2DefibrillatorDefibrillator
6Anesthesia with O2ExternalEnvironment flammables
7Nebulizer with O2NebulizerNebulizer
8Transcutaneous O2 suppliesEquipmentEquipment
9Chemicals with Oxygen peroxides, etc.Airliner cabin oxygen masks? Other? Airbags? 
10O2 reservoir bagsExternal 

Table 1 continued. Equipment is in same row-order as above.

 CountRpoPetc (hrs)Poisson?P[Fail]$/FailRiskRisk/year
1100000.00010.00010.000120,000TRUE0.86460$1,000 $8,645,970 $3,789,529
21000.00010.00010.000120,000TRUE0.86460$1,000 $86,460 $37,895
3100000.00010.00010.000210,000TRUE0.39958$1,000 $3,995,764 $3,502,687
4100000.00010.00010.000120,000TRUE0.86460$1,000 $8,645,970 $3,789,529
5100000.00010.00010.000120,000FALSE0.37382$1,000 $3,738,225 $1,638,464
61000.00010.00010.000120,000FALSE0.37382$1,000 $37,382 $16,385
7100000.00010.00010.000120,000FALSE0.37382$1,000 $3,738,225 $1,638,464
850000.00010.00010.000120,000TRUE0.86460$1,000 $4,322,985 $1,894,764
9100.00010.00010.000120,000FALSE0.37382$1,000 $3,738 $1,638
101000.00010.00010.000120,000FALSE0.37382$1,000 $37,382 $16,385

Table 2. Same as above except for pe-values, tc = r/((po/(po+pe))*pe*po), and risks.

 CountRPoPetc (hrs)Poisson?P[Fail]$/FailRiskRisk/year
1100000.00010.00010.00111,000TRUE0.63015$1,000 $6,301,451 $5,021,684
21000.00010.00010.000120,000TRUE0.86460$1,000 $86,460 $37,895
3100000.00010.00010.000215,000TRUE0.60353$1,000 $6,035,267 $3,527,010
4100000.00010.00010.00510,200TRUE0.63205$1,000 $6,320,460 $5,431,878
5100000.00010.00010.000120,000FALSE0.37382$1,000 $3,738,225 $1,638,464
61000.00010.00010.000120,000FALSE0.37382$1,000 $37,382 $16,385
7100000.00010.00010.000120,000FALSE0.37382$1,000 $3,738,225 $1,638,464
850000.00010.00010.000120,000TRUE0.86460$1,000 $4,322,985 $1,894,764
9100.00010.00010.000120,000FALSE0.37382$1,000 $3,738 $1,638
101000.00010.00010.000120,000FALSE0.37382$1,000 $37,382 $16,385

Shocks?

What if shock causes both O2 leak and electrical failure? Shocks (internal or external) could cause simultaneous O2 leak and electrical failure. Then failure probability is P[X <= Y < tc]. The additional failure mode is shock before O2 leak or inspection.  Suppose times X(leak) = min(X1, X3) and Y(spark) = min(X2, X3) where X1 is distributed exponential(po), X2 is distributed exponential(pe), X3 is distributed exponentially (at rate pboth), and all three are independent. Then X and Y have the Marshall-Olkin bivariate exponential distribution. This distribution provides a convenient alternative hypothesis to independence of leak and shock; independence is pboth º 0. 

P[X<=Y<tc] = P[fail] = P[X1<X2<tc AND X3>X2] + P[X3<tc AND X1>X3] because X1<X2 and X3< tc are mutually exclusive events. Mathematica computes approximations and exact formulas. Workbook IECompar.xlsx compares exact vs. approximate and P[X<=Y<tc] vs. P[X<Y<tc]. There is no need for approximation with exact formulas. The difference between P[X<=Y<tc] and P[X<Y<tc] depends on pboth. 

There are other bivariate Poisson models, but it seems excessive to extend the analyses to Poisson shocks AND leaks. On the other hand, there are numerical methods to estimate and evaluate the failure probabilities if event times have distributions other than exponential. Send data to pstlarry@yahoo.com, and I will test hypotheses, estimate distributions, and evaluate failure probabilities.

References:

EIGA, “Fire Hazards of Oxygen and Oxygen-Enhanced Atmospheres,” IGC Doc 04/09/E 

Fluke, “Medical Equipment QA Inspection Program Development and Procedures”

ANSI/AAMI, “Guidance for the use of medical equipment maintenance strategies and procedures,” EQ89:2015 

Paul M. Ordin, “Mishaps with Oxygen in NASA Operations,”  NASA TM X 67953,(1971) https://ntrs.nasa.gov/search.jsp?R=19720004407 2018-06-22T21:51:22+00:00Z

Sharareh Taghipour, Dragan Banjevic, Andrew K.S. Jardine, “Reliability Analysis of Maintenance Data for Medical Devices,” Quality and Reliability Engineering International, Volume 27, Issue 1, pp. 71-84, 2011

The WHO, “Medical Device Regulations…,” www.who.int, 2003

ISO 14971:2007,“…Application of Risk Management to Medical Devices,” 2007-03-01

NHS, Scotland, “Risk of Fire When Using Defibrillators in an Oxygen Enriched Atmosphere,” SAN(SC)95/03, May 1995

American Petroleum Institute, API RP 581 Risk-Based Inspection Technology 2nd ed., Washington, D.C.: American Petroleum Institute, 2008

D. W. Jorgenson, J. J. McCall, and R. Radner, Optimal Replacement Policy, North-Holland Publishing, 1967 

Marshall, A.W., Olkin, I., “A Multivariate Exponential Distribution”,  J. Amer. Statist. Assoc., 62, 30-44, 1967

Weir, Rob, “How to Write a Standard (If You Must)”, https://www.robweir.com/blog/2006/12/how-to-write-standard-if-you-must.html

Filed Under: Articles, on Tools & Techniques, Progress in Field Reliability?

« The Pro’s and Con’s of Using Pre-Existing Logic in Root Cause Analysis (RCA)
Root Cause Analysis »

Comments

  1. Larry George says

    December 29, 2021 at 4:35 PM

    Darn. I’ve done it again; I submitted a symbol that didn’t translate…
    “What if shock causes both O2 leak and electrical failure? Shocks (internal or external) could cause simultaneous O2 leak and electrical failure. Then failure probability is P[X £ Y < tc]" should have ended with P[X<=Y<tc] several places in the section starting with that sentence. You could have a spark at the same time as the oxygen leak, before inspection, and you get fire or worse.

    Reply
    • Fred Schenkelberg says

      January 1, 2022 at 8:50 AM

      I’ve updated the text to replace the pound(?) symbol with the <= - I think I caught them all cheers, Fred

      Reply
  2. Andrew Kelleher says

    February 9, 2022 at 10:44 PM

    I am guessing the equation is based on a simple ratio, i.e.: t1/t2 = p1/p2, where t2 = 1 year (time-period for a normalised risk assessment and equal to the time-period for defining po and pe and r). If p2 is the probability of a fire, and if po << 1 (i.e. no more than 1 oxygen leak per year) and pe << 1 (i.e. no more than 1 spark per year), then it follows that in approx. 50% of scenarios the oxygen leak occurs before the spark, and hence p2 = 0.5*po*pe. Hence, at the end we have tc = r/(0.5*pe*po).

    However, the article is a good example to demonstrate that our tools that make assumptions that we often do not understand and in many cases are not 100% applicable to our particular case. In such cases, an "optimal" design cannot be realized. And it is increasingly our task to find an optimal solution. Perhaps the biggest assumption made by the above equation is that the inspection task will be 100% effective (i.e. probability of detection = 1) in finding the oxygen leak or the electrical fault.

    If you have a particular standard scenario that you would like to "model" to achieve an optimal result, contact me via http://www.rams-mentat.com and we can build the model together.

    Reply
    • Larry George says

      February 10, 2022 at 9:57 AM

      Thanks for explaining the assumption for the formula tc = r/(0.5*pe*po). Table 1 was computed using that formula, to compare with table 2 using the correct formula tc = r/((po/(po+pe))*pe*po). Unfortunately, both tables were cut off on the right so the cost comparison was missing. I will think how to fix. Meanwhile, I will a version of the article and workbook to anyone who asks.

      Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Articles by Larry George
in the Progress in Field Reliability? article series

Join Accendo

Receive information and updates about articles and many other resources offered by Accendo Reliability by becoming a member.

It’s free and only takes a minute.

Join Today

Recent Articles

  • Self-Discipline Part 1
  • Is Safety Training Helpful?
  • FINESSE Facilitation: What Are Best Practices for Qualitative Assessment Analysis?
  • ISO 9001 Context and in the Real World, What do we do?
  • The Galvanic Corrosion Piping Trap!

© 2023 FMS Reliability · Privacy Policy · Terms of Service · Cookies Policy

This site uses cookies to give you a better experience, analyze site traffic, and gain insight to products or offers that may interest you. By continuing, you consent to the use of cookies. Learn how we use cookies, how they work, and how to set your browser preferences by reading our Cookies Policy.