What is Common Cause Failure (CCF)? A Clear Explanation of Why Duplication Doesn't Guarantee Safety

In safety devices and machine safety circuits lies a following concept: two components with the same function should be provided so that the system will remain safe even if one of them fails.

This intentional duplication is called redundancy.

For example, if signals from a safety switch are monitored by two circuits, even if one of the circuits fails, the other circuit continues to work normally so that the safety function will be maintained.

However, here is an issue: What if the two circuits fail simultaneously due to the same cause?

Such a failure is called Common Cause Failure (CCF).

This article explains what Common Cause Failure is, why it is important in safety designs, and what countermeasures are there, as simply as possible.

What is “redundancy” in the first place?

To begin with, let’s consider “redundancy” in order to understand Common Cause Failure.
Suppose there is a safety switch that detects the opening and closing of a machine’s door.

In case the circuit, which outputs the signals of the opening and closing of the door, fails inside the safety switch, there is a possibility that the machine does not stop its operation even if the door is opened.

To avoid such a situation, there is a solution using the safety switch with two such internal circuits and processing the respective signals from the safety switch through two independent circuits.

By configuring the same safety functions using the multiple circuits like the picture above, the possibility of the other circuit’s detecting faults increases, even if one circuit fails.

This is the basic concept of redundancy: even if one fails, it is still okay because there is another one.

However, there are cases where “both fail”

Now, let’s consider what happens if both of them fail.
Suppose that circuits A and B are composed of different components respectively but both are connected to the common power supply.

What if a serious fault happens to the power supply?
It is possible that not only circuit A but also circuit B may fail at the same time.

In other words, even if you think you have separated them into two, they are in fact vulnerable to the same cause.

This is the basic concept of Common Cause Failure (CCF).
ISO 13849-1 defines CCF as follows:

• By one or more events,
• a failure simultaneously occurs in two or more separated channels of multiple channels,
• leading to the failure of a safety function

Familiar example

It may be easiest to understand Common Cause Failure by imagining a spare key.

Suppose you have a spare key in preparation for losing your house key.
You may think “As I have two house keys, it will still be fine even if I lose one.”
But what if you hold the house keys on the same key chain?
In case you drop the whole key chain, you will lose both keys simultaneously.

This means that it is not sufficient just to have two keys.

This example illustrates the importance of ensuring that both are not lost due to the same cause.
The same concept applies to safety circuits.

What can be the common cause?

There are various causes that trigger Common Cause Failures.
The typical ones are as follows:

1. High Temperature
   If two circuits are installed in the same location and the temperature of the location gets extremely high, both circuits can be affected.
2. Electric Fault
   For example, if “overvoltage (where power voltage gets abnormally high)” occurs, there is a possibility that multiple circuits using the same power supply fail simultaneously.
3. Electromagnetic Noise
   Strong electromagnetic noise can cause simultaneous malfunctions and failures of multiple circuits.
4. Water, Humidity, and Corrosion
   If two circuits are placed in the same environment, both circuits can be affected by the same factors such as water, humidity, and corrosion.
5. Issues in Cables
   If the signal lines of two safety circuits are bundled in one cable, damages to the cable can affect the two circuits simultaneously.
6. Issues in Design and Software
   The causes are not limited to hardware.
   For example, if two circuits have an identical design defect, the defect can cause both circuits to fail in the same way.

This means that the causes of CCF are not limited to the “failure of component itself.”
They can include factors that commonly affect multiple circuits, such as temperature, power supply, noise, wiring, design, and installation.

What does it mean to be “independent”?

What is important here is the concept of “independence.”
Let’s consider the two circuits below:

As each circuit has its own power supply separately, even if a trouble happens to one power supply, it will hardly affect the other.

Adversely, if power is supplied to the two circuits as shown below, there is a possibility that both circuits are affected simultaneously when the “shared part” ― power ― fails.

In reality, however, it is not always practical to separate everything perfectly.
Thus, it is important to consider “how to design the shared parts and how many Common Cause Failures can be prevented.”

Duplication does not necessarily guarantee safety

The discussion so far can be summarized as follows:

Individual Failure
Circuit A → Failure
Circuit B → Normal

In this case, safety functions may be maintained by circuit B.

Common Cause Failure

In this case, even if two circuits are prepared, there is a possibility that both fail.

In other words, “redundancy alone cannot always enhance safety sufficiently,” therefore, in addition to redundancy, it is important to make sure that “two circuits will not fail simultaneously due to the same cause.”

How is CCF related to SIL and PL?

Common Cause Failure is also critical when we consider SIL and PL.
For example, SIL requires us to think about the probability of safety function working properly when needed and the frequency of dangerous failures.

However, it is not sufficient to simply consider “possibility of circuit A failing” and “possibility of circuit B failing” separately.
This is because there is a possibility of circuits A and B failing simultaneously due to the same cause unless A and B are perfectly independent.

IEC 61508 puts importance on consideration of Common Cause Failure and dependent failure when determining SIL.

ISO 13849-1 also includes a system to evaluate measures against CCF and describes various methods to reduce Common Cause Failures such as physical separation and precautions against environmental conditions.

How can we reduce CCF?

Then, what should be done to reduce Common Cause Failures?

The key is “to reduce the likelihood that both fail simultaneously due to the same cause.”

Example approaches are as follows:

• Physically separate two circuits properly
• Consider common causes of power supply and wiring
• Check environmental conditions such as temperature and humidity
• Implement measures against electromagnetic noise
• Implement measures against electrical faults such as overvoltage
• Prevent the same design error from affecting multiple circuits
• Adopt proper safety principles

ISO 13849-1 provides a checklist to evaluate the measures to reduce CCF so that these measures can be assessed by scoring them.

Appendix:
Achieving a CCF score of 65 points or higher is one of the conditions to configure safety circuit of Safety Categories 2, 3, and 4. Conversely, if the score is less than 65 points, we can consider that the safety circuit does not fulfill the requirements of CCF measures necessary for Safety Categories 2, 3, or 4. However, Safety Category and PL are not determined by CCF score alone. Other factors such as fault-detection methods and redundancy should also be evaluated.

Key points to remember about CCF

To sum up Common Cause Failure in one phrase, “it is a situation where multiple safety circuits fail simultaneously due to the same cause.”

A safety system cannot be secure enough with the concept of “it will remain safe even if one component fails.”
We further need to consider “whether both components will not fail simultaneously due to the same cause.”
This is the key point when we are addressing Common Cause Failure (CCF).

Summary

Finally, let us summarize the key points of Common Cause Failure (CCF):

・CCF is a situation where multiple circuits or components fail due to one cause.
・When CCF occurs, even a safety circuit with redundancy can encounter the simultaneous failure of multiple circuits.
・The causes of such failures include overvoltage, temperature, humidity, noise, wiring problems, and design errors.
・Therefore, not only “redundancy” but also “enhanced independence” is important.
・CCF is the key point to consider safety performance level such as SIL and PL.
・To enhance safety, it is necessary to implement measures to avoid the simultaneous failure in multiple circuits due to the same cause.

When we design safety circuits, simply “providing duplication to ensure safety in the event of a failure” is not sufficient.
To ask yourself “What if both fail due to the same cause?” is the first step to prevent CCF.

Related Products