Clause 15.4.2.1 d) - Loss of ESSENTIAL PERFORMANCE

[eldercosta]

I am struggling with this paragraph of 60601-1:

15.4.2 Temperature and overload control devices
15.4.2.1 Application
...
d) Loss of function of the ME EQUIPMENT caused by operation of a THERMAL CUT-OUT or OVER-CURRENT RELEASE shall not result in the loss of ESSENTIAL PERFORMANCE or any of the HAZARDOUS SITUATIONS described in 13.1.

Compliance is checked by inspection of the design documentation and the RISK MANAGEMENT FILE.

In the design I am working on, there is no THERMAL CUT-OUT but I believe the input fuses and the output protection circuitry of the AC/DC converter meet the definition of OVER-CURRENT RELEASE and my question is how could one meet the requirement of keeping the ESSENTIAL PERFORMANCE (the part of not resulting in the HAZARDOUS SITUATIONS is OK).

Thanks in advance.

 

[Peter Selvey]

Essential performance should be defined differently depending on frequency that the test or clause represents. Broadly speaking there are three regions:

- tests that simulate realistic normal condition, where in general essential performance should be similar to advertised performance

- tests that simulate occasional conditions; conditions that can be expected at least once during lifetime e.g. low battery, blocked air filter, user miss, exposure to liquids (for devices not intended to be used with water but could be accidentally splashed), dropping etc., power interruption; in this case advertised performance is rarely required but if technically feasible the condition should be detected and action taken to minimise trouble, e.g. for a low battery the "essential performance" should be to detect the low battery just before trouble occurs, indicate to the user and prevent display of any data that is not reliable due to a low battery

and lastly

- tests that simulate or refer to rare fault conditions e.g. component faults that occur only once in hundreds or thousands of devices over the lifetime, for low to medium risk devices no essential performance is expected, for high risk it may still be reasonable to at least provide an alarm e.g. using a redundant circuit (example: infusion pumps, dialysis, infant incubators)

Obviously this is risk based, it depends on the frequency of the condition and severity of any outcomes.

 

[eldercosta]

Peter, thank you very much.