Error in Inspection Time Interval

IEC 60601-1 says… Estimate the probability per time pe of an electrical failure and of an oxygen leak po. Determine the accepted probability of dangerous failures [fire] per time r. Calculate the inspection time interval tc = r/(0.5*pe*po).

A friend asked, “What’s the 0.5 for? It doesn’t account for the fire event sequence: leak before spark.” I posted correction tc = r/((po/(po+pe))*pe*po) and notified the IEC committee which acknowledged, “We’ll consider your suggestion for edition 4.”

[An earlier, shorter version of this article on www.LinkedIn.com, July 5, 2018. This version describes an inspection-time and risk-analysis template.]

Risk-Based Inspection (RBI)

Risk is expected cost: P[failure]*(Cost of failure), SUM[P[failure j]*(Cost of failure j); j=1,2,…], INTEGRATE[P[failure j at age t]*(Cost of failure j at age t)dt, t = 0 to ???, j=1,2,…], or discounted costs of future failures. Refer to Jorgenson, McCall, and Radner for inspection policies for randomly failing equipment.  

RBI became fashionable in the oil and gas industry where the effects of corrosion or other one-way processes call for periodic inspection. RBI deserves credit for taking into account costs and probabilities [API RP 581]. RBI simplifies the inspection time to avoid some statistics. 

There is a lot of guidance for oxygen use and fire risk [EIGA; Fluke; ANSI/AAMI; Ordin; Taghipour et al.; The WHO, ISO 14971:2007; NHS]. For medical equipment that uses oxygen, the IEC misoversimplified the computation of risk-based inspection time. 

Standard Error

2013 ANSI/AAMI ES60601-1:2005 & A1:2012 “Medical Electrical Equipment, Oxygen-Rich Environment,” sub-clause 11.2.2.1 b) 3) says, 

“The cause of the hazardous situation is: a leak occurs and is not detected, some time later an electrical failure occurs that starts an ignition. The time interval tc for checking the seals can be calculated as follows:

Estimate the probability per time pe of an electrical failure that exceeds the values given in 11.2.2.1 a).

Estimate the probability per time of an oxygen leak po:

Determine the accepted probability of dangerous failures per time r:

Calculate tc = r/(0.5*pe*po).”

In September 2017, I posted a correction, tc = r/((po/(po+pe))*pe*po), and notified the relevant IEC committee representatives, because  P[X(leak) < Y(spark)] = po/(po+pe) for independent exponentially distributed time random variables X and Y with means 1/po and 1/pe. 

That correction is an oversimplification. It doesn’t account for all possible events before inspection time tc. Both those tc formulas result in too long inspection times, and the probability of “dangerous failure” is greater than “accepted probability” r-value, because P[X(leak) < Y(spark)]*po*pe*tc is not the same as P[X(leak) < Y(spark) < tc].

Multiple Events?

Later the friend said, “… the event [electrical failure] we’re describing is quite complex and may involve multiple events.  For example, think about the spark event: we don’t care if any numbers of sparks happen before the oxygen leak occurs, so we have to be careful to exclude those sparks and only consider what happens after the leak.” “But what we actually want is the ‘time it takes to get the first spark after the oxygen leak,’ which is not the same as P[X(leak)<Y(spark)<tc] – the first spark after the leak might be the 100^th spark overall, but since the first 99 happened before the leak they had no effect.”

Electrical failures may be recurrent events so “the cause of the hazardous situation” could be the occurrence of at least one spark after O2 leak but before (end of) inspection time interval tc. I.e., under the assumption of constant electrical failure rate, sparks could be events in a Poisson process. Furthermore, the probability of failure depends on proximity of inspection time tc to the time to first leak, time between sparks, and tc. 

Alternative “hazardous situation” ignition probabilities in inspection time interval tc are: 

0.5*po*pe*tc; (IEC ANSI/AAMI 60601-1 recommendation)

(po /(po+pe))*po*pe*tc;  (September 2017 recommendation)

P[X < Y < tc] where X and Y are independent, exponentially distributed times to first O2 leak and first electrical failure; and 

P[Leak AND at least one spark after leak AND before tc], the integral from  y = 0 to tc of 
(1–Exp(pe*(–tc + y)))*po*Exp[–po*y]dy (Sparks are a Poisson process.).

Mathematica gives formulas for P[X < Y < tc] and P[Leak (X) AND at least one spark (Y) after leak AND before tc]. They have been implemented in an Excel workbook IECompar.xlsx in the list of files on https://sites.google.com/site/fieldreliability/. Observations:

0.5*po*pe*tc < (po /(po+pe))*po*pe*tc  when po > pe, which means inspection time interval tc = r/(0.5*po*pe) is too long; 

P[X < Y < tc] is slightly less than 0.5*po*pe*tc for small po and pe but much greater for larger po and pe relative to tc, which means time interval tc will be too long; and 

P[Leak AND at least one spark after leak AND before tc] is greater than P[X < Y < tc]. 

Figure 1. Probability of leak followed by electrical failure before tc, for alternative formulas. The last two alternatives are the upper line, practically the same for chosen event rates. 

These observations call for correction of IEC/AAMI EC60601-1 sub clause 11.2.2.1 b) 3) to the correct time interval tc and perhaps to recommend detection and reporting when at least one electrical failure has occurred. The IEC and AAMI have acknowledged that “will be considered for edition 4. maybe in 2019” [Weir].  

Risk of delay [ISO 14971:2007]

The inspection time interval tc is too long resulting in greater “hazardous situation” probability of dangerous failure than the input “accepted probability” r-value. The workbook IECompar.xlsx includes a risk analysis template [Tables 1 or 2]. Send data if you would like to test the hypotheses of exponential times between events and their independence or if you would like me to compute your products’ risks. 

Tables 1 and 2 show spreadsheet risk analysis templates. Risk = E[count*P[Failure per unit time]*cost per failure]. Be realistic. Get inventory counts, event data, and costs. Make event rate estimates, test hypotheses, estimate confidence intervals, and do sensitivity analyses. Adjust inspection time tc based on experience. Consider and evaluate alternatives’ marginal costs (bang-per-buck). Supplement with subjective “analyses”, RPNs, ranks, or categorical ratings a la ISO 14971:2007, FMEA, RCM, etc. Table columns are: Equipment, ignition source(s), inspect, and…

“Count” is the number of medical-electronic oxygen-enhanced equipment units in the field

“r” is the acceptable probability of failure, leak followed by electrical failure before inspection time tc

“po” and “pe” are the leak and electrical failure rates per unit time

“tc” is your current inspection time interval, tc = r/(0.5*po*pe) (table 1) or tc = r/((po/(po+pe))*pe*po) (table 2) 

“P{fail}” is the computed probability of failure during inspection interval tc, depending on whether electrical failure is recurrent process

“$/Failure” is the cost of “hazardous situation” (ignition) plus replacement cost

“Risk” formula depends on whether electrical failure is a one-time event or Poisson process. 

“Risk per year” converts risk assuming continuous operation and time unit is hours.

Table 1. Risk analysis. Risk = E[Cost] per inspection interval tc. Time units of r, po, and pe must be commensurate; e.g., per hour. tc = r/(0.5*pe*po). Compare computed risk with “accepted probability” r-value times cost per failure = risk).  See below this table for the rest of the columns.

	Equipment	Ignition source(s)	Inspect
1	Concentrator	Concentrator electrical, external	Concentrator, environ-mental flammables
2	O2 tank and supply Electro-surgical equipment, O2 masks, ventilators	External	Environment flammables
3	CPAP+Q2	CPAP	CPAP
4	BiPAP+O2	BiPAP	BiPAP
5	AEDs and defibrillators in O2	Defibrillator	Defibrillator
6	Anesthesia with O2	External	Environment flammables
7	Nebulizer with O2	Nebulizer	Nebulizer
8	Transcutaneous O2 supplies	Equipment	Equipment
9	Chemicals with Oxygen peroxides, etc.	Airliner cabin oxygen masks? Other? Airbags?
10	O2 reservoir bags	External

Table 1 continued. Equipment is in same row-order as above.

	Count	R	po	Pe	tc (hrs)	Poisson?	P[Fail]	$/Fail	Risk	Risk/year
1	10000	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$8,645,970	$3,789,529
2	100	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$86,460	$37,895
3	10000	0.0001	0.0001	0.0002	10,000	TRUE	0.39958	$1,000	$3,995,764	$3,502,687
4	10000	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$8,645,970	$3,789,529
5	10000	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738,225	$1,638,464
6	100	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$37,382	$16,385
7	10000	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738,225	$1,638,464
8	5000	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$4,322,985	$1,894,764
9	10	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738	$1,638
10	100	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$37,382	$16,385

Table 2. Same as above except for pe-values, tc = r/((po/(po+pe))*pe*po), and risks.

	Count	R	Po	Pe	tc (hrs)	Poisson?	P[Fail]	$/Fail	Risk	Risk/year
1	10000	0.0001	0.0001	0.001	11,000	TRUE	0.63015	$1,000	$6,301,451	$5,021,684
2	100	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$86,460	$37,895
3	10000	0.0001	0.0001	0.0002	15,000	TRUE	0.60353	$1,000	$6,035,267	$3,527,010
4	10000	0.0001	0.0001	0.005	10,200	TRUE	0.63205	$1,000	$6,320,460	$5,431,878
5	10000	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738,225	$1,638,464
6	100	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$37,382	$16,385
7	10000	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738,225	$1,638,464
8	5000	0.0001	0.0001	0.0001	20,000	TRUE	0.86460	$1,000	$4,322,985	$1,894,764
9	10	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$3,738	$1,638
10	100	0.0001	0.0001	0.0001	20,000	FALSE	0.37382	$1,000	$37,382	$16,385

Shocks?

What if shock causes both O2 leak and electrical failure? Shocks (internal or external) could cause simultaneous O2 leak and electrical failure. Then failure probability is P[X <= Y < tc]. The additional failure mode is shock before O2 leak or inspection.  Suppose times X(leak) = min(X1, X3) and Y(spark) = min(X2, X3) where X1 is distributed exponential(po), X2 is distributed exponential(pe), X3 is distributed exponentially (at rate pboth), and all three are independent. Then X and Y have the Marshall-Olkin bivariate exponential distribution. This distribution provides a convenient alternative hypothesis to independence of leak and shock; independence is pboth º 0. 

P[X<=Y<tc] = P[fail] = P[X1<X2<tc AND X3>X2] + P[X3<tc AND X1>X3] because X1<X2 and X3< tc are mutually exclusive events. Mathematica computes approximations and exact formulas. Workbook IECompar.xlsx compares exact vs. approximate and P[X<=Y<tc] vs. P[X<Y<tc]. There is no need for approximation with exact formulas. The difference between P[X<=Y<tc] and P[X<Y<tc] depends on pboth. 

There are other bivariate Poisson models, but it seems excessive to extend the analyses to Poisson shocks AND leaks. On the other hand, there are numerical methods to estimate and evaluate the failure probabilities if event times have distributions other than exponential. Send data to pstlarry@yahoo.com, and I will test hypotheses, estimate distributions, and evaluate failure probabilities.

References:

EIGA, “Fire Hazards of Oxygen and Oxygen-Enhanced Atmospheres,” IGC Doc 04/09/E 

Fluke, “Medical Equipment QA Inspection Program Development and Procedures”

ANSI/AAMI, “Guidance for the use of medical equipment maintenance strategies and procedures,” EQ89:2015 

Paul M. Ordin, “Mishaps with Oxygen in NASA Operations,”  NASA TM X 67953,(1971) https://ntrs.nasa.gov/search.jsp?R=19720004407 2018-06-22T21:51:22+00:00Z

Sharareh Taghipour, Dragan Banjevic, Andrew K.S. Jardine, “Reliability Analysis of Maintenance Data for Medical Devices,” Quality and Reliability Engineering International, Volume 27, Issue 1, pp. 71-84, 2011

The WHO, “Medical Device Regulations…,” www.who.int, 2003

ISO 14971:2007,“…Application of Risk Management to Medical Devices,” 2007-03-01

NHS, Scotland, “Risk of Fire When Using Defibrillators in an Oxygen Enriched Atmosphere,” SAN(SC)95/03, May 1995

American Petroleum Institute, API RP 581 Risk-Based Inspection Technology 2nd ed., Washington, D.C.: American Petroleum Institute, 2008

D. W. Jorgenson, J. J. McCall, and R. Radner, Optimal Replacement Policy, North-Holland Publishing, 1967 

Marshall, A.W., Olkin, I., “A Multivariate Exponential Distribution”,  J. Amer. Statist. Assoc., 62, 30-44, 1967

Weir, Rob, “How to Write a Standard (If You Must)”, https://www.robweir.com/blog/2006/12/how-to-write-standard-if-you-must.html