家电功能安全软件评估指引 61/7586/INF (二 )

国际电工委员会 

第61技术委员会：家用和类似用途电器的安全 

关于在第2部分中对使用提供保护功能的电子电路的器具应用功能安全要求指南。

本指南文件涉及IEC 60335-1功能安全要求的应用（基于第6.1版），由IEC TC 61/AG 23制定。

解释性说明——电磁兼容（EMC）测试的选择 

AG23承认，由于技术复杂性，针对电磁兼容（EMC）测试选择的指南需要进行额外的工作。

AG23致力于开发和发布本指南的未来附录或修订版，以提供更详细的指导。在此期间，建议基于特定产品的风险评估来选择测试。

Introduction: 

The intention of this guide is to supplement the existing guidance already published in “Guidance document concerning functional safety of appliances using programmable electronic circuits” (61/6434/INF) to assist Maintenance Teams, Working Groups, Project Teams, Advisory Groups and Sub-Committees under IEC TC61 with the understanding, justification and applicability of the functional safety requirements and to inform of the factors that must be considered when writing requirements that may invoke functional safety. It is not intended for this guide to be a replacement of any existing published guidance. 

本指南旨在对《关于使用可编程电子电路的器具之功能安全的指南文件》（61/6434/INF）中已发布的内容进行补充，以协助IEC TC61下属的各维护团队、工作组、项目团队、咨询小组及分委会，更好地理解、论证并应用功能安全要求，同时阐明在制定可能涉及功能安全的要求时必须考虑的各项因素。本指南无意取代任何现行已发布的指导性文件。

Each TC61 subgroup have the responsibility to carefully consider (on a case-by-case basis) the applicability of any requirements for functional safety when compliance may depend on the correct operation of an electronic circuit. Protective electronic circuits (henceforth referred to as “PECs”) are defined as an “electronic circuit that prevents a hazardous situation under abnormal operating conditions” where “parts of the circuit may also be used for functional purposes”. This implies that, by definition, the PEC term can only be used when referring to electronic circuits relied upon for compliance with Clause 19. However, there are many examples as defined in Parts 2, typically in Clauses 20, 22, 24 and 32, where an electronic circuit may be relied upon for compliance performing some safety critical function in the end product, but not otherwise specified in a related Clause 19 requirement in the Parts 2. Currently, there is no suitable term defined for such an application. 

TC61的各下属小组负有责任，逐案审慎评估功能安全相关要求的适用性——特别是当合规性依赖于电子电路的正确运作时。

保护性电子电路（下称“PEC”）被定义为“在异常运行条件下防止危险状况发生的电子电路”，且“该电路的某些部分亦可用于实现功能性用途”。这意味着，根据定义，“PEC”一词仅适用于那些为确保符合第19章要求所依赖的电子电路。

然而，第2部分标准（特别是第20、22、24及32章）中存在许多此类案例：终端产品中的电子电路虽执行着某些安全关键功能，且合规性依赖于该电路，但在第2部分的第19章相关要求中却未对此作出明确规定。目前，针对此类应用尚未定义合适的术语。

The intent of whether such circuits need to meet at least the full equivalence of a PEC is specifically the responsibility of each MT/WG/PT/SC to consider whilst developing their requirements, with the support and guidance of AG 23. There are already several existing variations of the PEC equivalent requirements in comparison of the Parts 2. The reasoning behind this stems from the purpose of the function required in the Part 2. Requirements in a Part 2 for a primary function of the appliance, the failure of which (if it were to occur) would directly result in an unsafe condition, should likely require at least the full PEC equivalence. Each TC61 subgroup have to consider this carefully and for any lesser functional intent, such as for a secondary function or for a situation where the requirement is for a backup function, or for the condition that are unlikely to cause the failure mode in a particular product situation, a lower level or partial set of requirements may be acceptable. 

各MT/WG/PT/SC在AG 23的支持和指导下制定相关要求时，须自行负责审慎判定：此类电路是否至少需要满足与保护性电子电路（PEC）完全等效的要求。

目前，各第2部分标准中已存在多种类似于PEC的差异化要求。其根本原因在于第2部分所界定功能的具体目的：若某器具主要功能的要求一旦失效（即发生故障）将直接导致不安全状态，则该要求通常应至少满足与PEC完全等效的标准。

各TC61下属小组须对此进行仔细考量；而对于安全性预期较低的功能，若属于次要功能、备用功能，或在其特定的产品应用场景中极难引发故障模式，则采用较低层级或部分等效的要求可能是可接受的。

For example, Clause 22.201 of Annex B of IEC 60335-2-2:2019 details specific safety-critical requirements for automatic vacuum cleaners to have some form of lifting detection means to stop operation when hazardous moving parts may become accessible due to contact with the floor being lost, in addition to critical edge detection for situations where possible uncontrolled decent may occur. As it is clear such functions in the end-product are clearly safety-critical (since the resulting hazard

could be injury from mechanical parts or personal impact and property damage from an uncontrolled decent), at least the full PEC equivalent criteria are required. 

例如，IEC 60335-2-2:2019附录B第22.201条详细规定了自动吸尘器的特定安全关键要求：除针对可能发生失控坠落情况的临界边缘检测外，器具还应具备某种形式的提升检测装置，以便在因脱离地面接触可能导致危险运动部件外露时停止运行。鉴于此类终端产品功能显然属于安全关键性质（因其引发的危害可能包括机械部件造成的人员伤害、人体撞击风险，以及失控坠落导致的财产损失），因此必须满足至少与保护性电子电路（PEC）完全等效的判定准则。

The PEC equivalent criteria: 

The full PEC equivalent requirements can be written as follows and forms a part of the compliance evaluation criteria after the functional requirement has been stated (therefore normally written in Italics): 

“If compliance relies on the operation of an electronic circuit, the test is repeated under the following conditions applied separately: 

– the fault conditions in a) to g) of 19.11.2 applied one at a time to the electronic circuit; 

– the electromagnetic phenomena tests of 19.11.4.1 to 19.11.4.7 applied to the appliance. The tests are carried out with surge protective devices disconnected, unless they incorporate spark gaps. 

If the electronic circuit is programmable, the software shall contain measures to control the fault/error conditions specified in Table R.1 and is evaluated in accordance with the relevant requirements of Annex R.” 

PEC等效判定准则：

在满足前述功能要求的基础上，完整的PEC等效要求表述如下，并构成符合性评估准则的一部分（因此通常以斜体书写）：

“若器具的符合性依赖于某一电子电路的正常运行，则应在下述各项条件分别施加的情况下重复进行测试：

– 针对该电子电路，依次单独施加19.11.2中a)至g)规定的故障条件；

– 针对器具，施加19.11.4.1至19.11.4.7规定的电磁现象抗扰度试验。除非浪涌保护装置包含火花间隙，否则试验时应将其断开。

若该电子电路为可编程类型，则其软件应包含控制表R.1所列故障/错误条件的措施，并依据附录R的相关要求进行评价。”

Explanation: 说明：

The first sentence is a caveat that ensures this requirement only applies to electronic circuits used to ensure compliance. This intentionally allows an alternative approach to compliance where the protective function is defeated without compromising the normal operation of the product, repeating the test, and ensuring the product is compliant. 

首句为一项限制性说明，旨在确保该要求仅适用于为保障符合性而设置的电子电路。这特意允许了一种替代合规路径：

即在确保产品正常运行不受影响的前提下，即便该保护功能失效，仍可通过重复测试来验证产品的符合性。

The first dashed item invokes Clause 19.11.2 for the single electrical fault assessment as all appliances must be single fault tolerant to ensure safety is maintained. Clause 19.11.3 is not specifically required to be called out in the Parts 2, since the requirement wording has been specifically chosen to be technically equivalent to Clause 19.11.3, in that both require a safe test outcome when the specific safety-related functional test is performed in conjunction with the simultaneous electrical fault. It is important to understand that when compliance is determined to this requirement, in the same way as Clause 19.11.3, a fault may occur at any point in an appliance operating cycle, but the evaluation of the safety-related functional test in the Part 2 is specifically considered when the protective circuit is performing the protective function, (such as the point when an automatic vacuum is approaching or on a critical edge). 

首条破折项援引了第19.11.2条，旨在进行单一电气故障评估——所有器具必须具备单故障耐受能力，以确保持续的安全性。第19.11.3条无需在第2部分中特别援引，因为此处所选的要求措辞在技术层面已等同于第19.11.3条；二者均要求在实施特定的安全相关功能测试的同时引入电气故障，并能取得安全的测试结果。需着重理解的是：与适用第19.11.3条的情形相同，当判定是否符合此项要求时，意味着器具运行周期内的任意节点均可能发生故障；但在评估第2部分中的安全相关功能测试时，应特指保护电路正在执行保护功能之时（例如自动吸尘器接近临界边缘或处于该边缘之上时）。

The second dashed item calls up the need to evaluate such electronic circuits for susceptibility to electromagnetic phenomena and is equivalent to the second paragraph of Clause 19.11.4. Clauses 19.11.4.1 and 19.11.4.2, for electrostatic discharge and radiated fields respectively, can be applied to all constructions, whether or not connected to a mains supply. However, Clauses 19.11.4.3 to 19.11.4.7 can only apply to constructions with a direct mains supply. This means that for an isolated construction, such as a battery-operated mode of an appliance where there is no direct connection to mains, these specific Clauses do not need to be called out. You can see a good example of this in Clause 22.201 of Annex B of IEC 60335-2-2:2019. 

第二条破折项指出，必须评估此类电子电路对电磁现象的敏感性，这等同于第19.11.4条第二段的内容。其中，针对静电放电和辐射场的第19.11.4.1条和第19.11.4.2条适用于所有结构，无论其是否连接市电供电。然而，第19.11.4.3条至第19.11.4.7条仅适用于直接连接市电供电的结构。这意味着对于隔离型结构（如器具的电池供电模式且无直接市电连接），无需援引这些具体条款。IEC 60335-2-2:2019附录B第22.201条即为典型范例。

The final paragraph of the requirement specifically addresses the need for any software contained within such safety-related electronic controls and relied upon for compliance, needing to be evaluated to the Table R.1 measures. Specific consideration needs to be made here on a Part 2 basis whether Table R.2 needs to be called out for any functions where failure could potentially result in direct danger to life or serious harm (such as explosion). 

该要求的末段明确指出：若此类安全相关电子控制器内含软件，且器具符合性依赖于该软件，则必须依据表R.1所列措施进行评估。在此基础上，第2部分需特别考量：对于任何一旦失效可能直接导致生命危险或严重伤害（如爆炸）的功能，是否需援引表R.2的要求。

Compliance criteria: 符合性判定准则：

Although not explicitly stated in the requirement text, the criterion by which compliance is determined when Clause 19.11.2 and 19.11.4 is referenced outside of Clause 19 is that of both failure of the safety-related functional test and Clause 19.13 for the overarching fail-safe criteria of the Part 1, unless explicitly stated otherwise. Each TC61 subgroup may consider additional or even alternative criteria for such an evaluation, but this would need to be carefully justified. In most cases, the approach should be the text above as verbatim. For instance, for an automatic vacuum, it would be unacceptable for the mobile part to drop over a critical edge or be on fire as a result of a single fault or EMC susceptibility test and this requires consideration of both the Part 2 test and Clause 19.13.

尽管上述要求文本未显式说明，但当在第19章之外援引第19.11.2条和第19.11.4条时，其符合性判定依据应为：安全相关功能测试的失败情况，以及第1部分中作为总体故障安全准则的第19.13条——除非另有明确说明。各TC61下属小组可考虑为此类评估增设甚至采用替代性判定准则，但这必须经过充分的论证。在大多数情况下，应采用上文所述的原文措辞。例如，对于自动吸尘器而言，若因单故障或电磁抗扰度测试导致移动部件从临界边缘坠落或引发火灾，则是不可接受的；这要求必须同时考量第2部分的测试与第19.13条的要求。

综上：

1）保护性电子电路（下称“PEC”）被定义为“在异常运行条件下防止危险状况发生的电子电路“，PEC不光是考虑19章异常保护，还需要考虑part 2 章节比如：20、22、24及32章；

2）重复考虑19.11.2 a) 到g) 单一故障失效情况下，确保持续的安全性；

3）电磁场干扰EMP 测试，19.11.4.1 ESD 静电放电和19.11.4.2 辐射场测试，针对所有器具进行施加， 而19.11.4.3 到19.11.4.7 则仅适用与与主电源相连的器具；

4）如果涉及到爆炸等特殊危险时，则需要按照R.2 表格，C类软件评估。

原创不易，欢迎大家在阅读时发表评论，点赞关注本公众号，你的关注是我前进最大动力！