! Reference

NBS

Publications

NAT'L INST. OF STAND & TECH

AlllDb a37im

NBSIR 76-1096

Guidelines for the Determination

and Development of Generic

Safety Standards

Robert G. Hendrickson

Institute for Applied Technology

National Bureau of Standards

Washington, D. C. 20234

June 1976

Final

Issued August 1976

Prepared for Consumer Product Safety Commission

5401 Westbard Avenue

" thesda, Maryland 20207

-QC

IGO

.U56

75-1096

1976
I
GUIDELINES FOR THE DETERMINATION

AND DEVELOPMENT OF GENERIC

SAFETY STANDARDS

NBSIR 76-1096

National Bureau of Standards

Library, E-01 Admin. BIdg.

OCT 2 5 1982

Robert G. Hendrickson

Institute for Applied Technology

National Bureau of Standards

Wasfiington, D. C. 20234

June 1976

Final

Issued August 1976

Prepared for Consumer Product Safety Commission

5401 Westbard Avenue

Bethesda. Maryland 20207

U.S. DEPARTMENT OF COMMERCE, Elliot L Richardson, Secretary

Edward O. Vetter, Under Secretary

Dr. Betsy Ancker-Johnson, Assistartt Secretary for Science and Technology

NATIONAL BUREAU OF STANDARDS. Ernest Ambler, Acting Director

Table of Contents

Page

Chapter I. F-oundations and Background I-l

Introduction I-l

A. What Is A Generic Standard? 1-2

B. Principal Elements of Generic Safety Standards 1-2

C. Hazard, Risk, Exposure, Accident and Control 1-6

D. Process of Generic Standard Development 1-7

E. Organization of the Guidelines 1-8

Chapter II. Product -Hazard Analysis II -1

Introduction II-l

A. Principal Factors in the Analysis of Product -Hazard

Characteristics II-l

B. Combinations of Principal Factors II -3

C. Procedure for the Determination of the Generic Case II -5

D. Technical Approach 11-10

Introduction 11-10

1. Injury Severity Analysis and Classification 11-11

1.1. Injury Types 11-11

1.2. Tabulations of Product -Severity Data 11-12

1.3. Injury Severity and the CPSA 11-13

2. Product Characteristics 11-14

Introduction 11-14

2.1. Product Involvement 11-14

2.2. Product Safety Requirements 11-15

2.3. Product Functional Performance 11-16

ii
III f
Table of Contents (continued)

Page

3. Classification of Hazard 11-17

4. Method of Analysis 11-20

4.1. Assignment Criteria 11-22

4.2. Identifying the Countermeasure 11-23

4.3. Characterizing the Test Method 11-24

E. Summary II -2S

Chapter III. Developing the Generic Standard III-l

Introduction III-l

A. Product Characteristics Modified by Generic Standard III-l

B. Hazard Characteristics Controlled by Generic Standard III-l

C. Countermeasure and Test Methods Ill -2

D. Form of the Standard Ill

E . Content of the Standard III-3

F. Generic Standards and the Process of Development III-3

Chapter IV. Impact Evaluation of Generic Standard IV

Introduction IVA. Technological Impacts IV

B. Cost -Benefit IVC. Estimate of Hazard or Injury Reduction IV3

D. Other Factors in Impact Analysis IV-4

Appendix. The Elements of Fault-Tree Analysis A-1

Introduction A

1. Fault -Tree Analysis A

2. Fault -Tree Logic A

3. Example of Fault -Tree Diagram A6

4. Benefits of Fault-Tree Analysis A-8

iii
Figures Page

I-l Factors in Standards Development 1-3

II-l Flow Chart of Analytic Procedure II-6

1I-2A Severity Tabulation Matrix 11-12

1I-2B Severity Tabulation Matrix 11-13

II-3 Product Involvement Scoring Matrix 11-15

11-4 Product Safety Scoring Matrix 11-16

11-5 Product Performance Scoring Matrix 11-17

11-6 Generic Standard Development 11-21

A-1 Example, Fault-Tree Diagram A-6

Tables

II-l Array of Combinations of Principal Factors 11-4

11-2 Summary of Methods and Data Sources. 11-10

11-3 Hazard Type Classifiers 11-18

11-4 Classification of Factors in Hazard Creation 11-19

lV-1 Cost-Benefit Array IV-2

iv
ABSTRACT

These guidelines were prepared to assist the CPSC in the development

of generic safety standards. This development is based on conceptual

models of product -hazard interactions and analyses of accident sequences,

product clustering, and hazard characteristics.

The motivation for these guidelines is based on a perceived need

to evolve generic standards instead of manifold product-specific standards;

to expedite the standard development process; and to enhance the efficiency

of standards for consumer product safety.

v
iiI!
CHAPTER 1. FOUNDATIONS AND BACKGROUND

Introduction

These guidelines have been prepared for the purpose of assisting in

the analysis, development and evaluation of generic safety standards. They

provide a systematic approach to the investigation of product -hazard problems,

starting with the principal factors to be analyzed and ending with a

discussion of likely changes in the traditional process of standards

development

A generic safety standard is associated with a large number of

consumer product -types. The scope of a generic standard is in direct

contrast with a product-specific standard, which addresses the control

of a single product or product -type. The ideal generic standard has a

single test method for all products intended to be covered by the standard.

The success, however, and also the greatest challenge, of a generic

standard lies in its capability to address a variety of product- types

and yet retain sufficient clarity and specificity to be an effective

instrument of regulation.

In these guidelines, the development of a generic standard is based

on a multi-stage analysis which begins with product -accident data and

ends with an identification of a countermeasure , or countermeasures , and

a test-method for compliance. Generic standards may also arise from

the need to streamline and consolidate a number of extant standards

which address a common problem; or may evolve from a need to synthesize

portions of extant standards which are similar or related and would be

more effective or efficient if restated under a new, single generic

standard.

I-l
A. IVhat Is A Generic Standard?

The basic elements of a standard address product identification, which

includes descriptions, classifications, sizes and tolerances; references

and definitions; safety specifications, which include requirements as they

pertain to materials, design, construction, physical attributes, and

environment; functional performance; test procedures; quality control;

product limitations; and exceptions to the standard.

A generic safety standard addresses all of these elements and is

obligated to provide the same degree of quality and integrity as any other

standard. Although a generic safety standard covers a large number of

products or product-types as opposed to the product-specific standard,

it must provide an adequate and workable equivalent of each part of a

product -specific standard. This is true for several reasons:

(1) The countermeasure must be clearly defined in order that it may

be applied to each product -type covered by the standard,

• (2) The test method, or methods, must be clearly identified as to

the product-types for which they are applicable,

(3) All criteria and special requirements must be unambiguous,

(4) Interpretation and application of the standard must be clear

and direct, and '

^

, ,-

(5) The user must feel secure that the generic standard is as

effective as the product -specific standards it displaces.

B. Principal Factors of Generic Safety Standards

In order to understand the nature of a generic safety standard more

systematically, we examine in this section a general overview of the

*A countermeasure is defined as a means, device, or expedient to counter,

modify or rectify a potential hazard.

1-2
process for determining the generic situation. Chapters II and III

elaborate :md ex]olicate this process in greater detail. It is our

intent here only to explore the general nature of the factors as they

relate to the analysis of product -hazard problems.

If an analysis of accident data shows that a large number of products

are associated with a common hazard, and the hazard produces approximately

the same type and severity of injury under similar environmental conditions

then a generic situation probably exists and it is likely that a counterr.easure to the hazard can be specified. The principal factors involved

in making an assessment of a generic case are given in Figure I-l.

develop

product

specific

std

number of products

in hazard cluster ;_smallj —

large^

character of

injury

wide range ', j_of_effectsJ

separate effects

^ countermeasures

; narrow range of

I effects measurable

|_bY_ single parameter

risk manifestation?

I product

I_ dependent

hazard/risk essentially

the same for all products

in cluster

10

"universal" test method?

separate

test methods

develop \^ product

j specific

/

std.

no

11

test'melKod" is |

|_ product dependent ; vyes 12

develop Generic Standard

Figure I-l: Factors in Standards Development

1-3
Figure I-l depicts the major factors that are involved in deci4ing

between a generic or product- specific standard. Box 1 addresses the number of

products associated with an identified hazard. If this number is relatively

small (without defining what "small" is) , it may be desirable to treat

the problem on an individual product basis, thereby precluding a generic

approach. If, however, the number of products or product - types is relatively

large (i.e., great enough to achieve an expected efficiency in preparation time

and scope of coverage) we proceed to Box 2. Box 2 addresses the character

of the injury associated with the hazard. If the injury occurs with a

wide range of effects (Box 3) , it may be necessary to measure these

effects in different ways. This may require, in the worst case, as many

countermeasures as there are diverse effects. The consequence of this

is the need to provide a separate test method for each required countermeasure

(Boxes 4 and 5). This logic, therefore, leads to the conclusion that productspecific regulation may be the only satisfactory way to address this

product -hazard problem.

If, on the other hand, the character of the injury (Box 2) is slight

in its range of effects and can be represented by a single parameter, or by

a manageable set of related parameters (Box 6) , then the regulation of the

hazard by generic means has greater likelihood. The next factor which bears

directly on our analysis is the determination of how the hazard is manifested

in each product- type (Box 7). If the level of risk- -defined as a probability

of injury--cannot be described independently of the specific product

characteristics (Box 8) , we may find that a generic description of the

risk cannot be made for the entire cluster of products. If this occurs, then

1-4
we are forced into the situation that leads back to the need for

separate test methods (Box 5). If, however, the risk is essentially the

same for all products in the cluster (Box 9) , the generic property is

not lost and, in principle, a single countermeasure can be determined.

All that remains is to determine the feasibility of a single, universal

test method (Box 10). If this is not possible, and technological development

of a universal test method is not feasible, then we must rely on test

methods which are product-specific (Box 11) . It is not necessarily true

that this would preclude a generic approach to the problem, however. If

the number of test methods needed is equal to the number of product

types in the cluster, then we are forced back to the logic of Box 5 if

the number of types is large. Otherwise, a generic concept is still

feasible, even with multiple test methods. The ideal realization is to

obtain a universal test method which would provide the basis for a

succinct and comprehensive generic standard (Box 12)

In summary, we find that the factors are: (1) that the number of

products associated with a hazard is large, (2) that the character of

the injury shows a narrow range of effects which are depictable by a

single or few descriptors, (3) that the hazard is essentially the same

for all products in the cluster, and (4) that a single test method is

available or can be developed. A generic standard becomes a reasonable

alternative for regulating product -hazard combinations satisfying these

four conditions.

A consequence of this approach is the requirement to collect and

evaluate information on all the products which may be covered by the

standard, and to determine for each product-type the perceived hazard.

1-5
injury severity, countermeasure , and the most efficient test method. The

data are needed to ascertain the nature of the product -hazard relationship;

and the selection of product -types as candidates for regulation is based on

repeated and increasingly refined evaluations of product-hazard characteristics.

C. Definitions of Hazard, Risk, Exposure, Accident and Control

Definitions

In order to understand the concepts and analysis contained in these

guidelines, and to clarify arguments and necessary conditions for the

development of generic standards, we introduce working definitions of

hazard, risk , exposure , accident , and control. Our definitions are as

follows:

(1) hazard--a direct or indirect source of injury or damage,

(2) risk--a probability of injury or damage,

(3) exposurea subjection to an action or event,

(4) accident- -an event which results in injury or damage,

(5) control- -a restraint on or influence over a hazard or

risk.

As a source of danger a hazard is usually directly related to a

form of energy. The form may be mechanical, electrical, thermal, chemical,

electromagnetic, radiative, or auditory.

Risk is sometimes equated to hazard, but we assume risk to be related

to the control of the hazard and the use of the product.

Exposure is a variable which has been the subject of extensive

analyses in a variety of safety problems. Each analysis has tended to

define exposure in a way that is amenable to quantification but still

retains enough generality to cover a wide range of interpretations.

1-6
Tlic major difficulty in measuring exposure lies in its dependence upon

unpredictable causal factors and interactions. It is difficult to

define the point at which exposure ends and the process of an accident

begins

An evaluation of accident causation is made difficult because if

the evaluation is to be useful in making decisions about product safety, it

should include human factors, environmental conditions and product characteristics in scenarios which reflect the likely combinations that may occur

The definition of control includes not only the substantive restraint

of a hazard, but also those controls which are derived from the use of

the product and the perceived respect for the risk.

Since these five variables, to which are attached specific definitions

can take a variety of forms, the job of analysis is difficult; but if an

approximation to their phenomena is possible, and in many cases it is,

conclusions can be drawn which provide the basis for developing a generic

or product -specific regulation.

D. Process of Generic Standard Development

The development of a voluntary product-specific standard has

traditionally included about seven major factors:

1. number and expertise of participants,

2. orientation to the standard to be developed,

3. trade-offs or negotiations among interested parties,

4. study of affected or related existing standards,

5. problems of liability,

6. data collection,

7. consensus process for approval.
How are these factors changed if our standard is now generic

instead of product-specific? First , the number of participants will

be greater, and certainly each product- type should be represented,

as a minimum. Second , each member of the group developing the standard

must think in terms of generic coverage rather than product -specific

coverage. Third , negotiations on countermeasures and a test method

may be far more difficult for many product- types than for a single product.

Fourth, the displacement of existing standards may be unprecedented in the

experience of the members; therefore, care must be taken to ensure the

quality and integrity of the generic standard vis-a-vis the standards

it replaces. Fifth , it is unlikely that addressing liability will be

markedly different from present procedures. Sixth , data collection

becomes more extensive and more difficult for purposes of decision

making within the committee on product -hazard inferences, countermeasures,

and test methods. And Seventh , the consensus process will be affected

because of the potential impact of the standard on greater segments of

industry. Qiapter III, F, discusses these issues in greater detail, but

it is critical that a thorough analysis of product-hazard factors be

carried out in order to provide a clear portrayal of the hazard and its

countermeasure

.

E. Organization of the Guidelines

These guidelines are organized into four functional areas: the structures

needed for the analysis and evaluation of product -hazard problems (Chapter II)

;

the methodology needed to develop a generic standard (Chapter III) ; a

summary of items for consideration in an impact evaluation (Chapter IV)

;

and a summary of the elements of fault-tree analysis (Appendix).

1-8
CHAPTER II. PRODUCT -HAZARD ANALYSIS

Introduction

Chapter I presented a general outline for product -hazard analysis as

a first step toward a systematic, empirical investigation of product

safety.

In this chapter these concepts are developed into an analytic

procedure for identifying generic properties in product -hazard combinations.

Metliods for tabulating data and developing decision information are

presented for each phase of the procedure.

The following sections identify the principal factors in the analysis

of product -hazard characteristics, examine the regulatory form of each

combination of the principal factors, examine the phases for the determination

of properties of product-hazard characteristics which are amenable to

generic control, and review methods and data sources associated with

each phase of the investigation. Taken as a whole, the contents of

these sections constitute a procedure for studying a variety of problems

associated with hazards, safety, controls, and data development.

A. Principal Factors in the Analysis of Product-Hazard Characteristics

Product -hazard characteristics tend to be associated, primarily,

with four basic factors of accident phenomena: injury types, injury

severity, morbidity parameters, and product involvement.

Injury type is described by a general class label such as laceration , bum , fracture , contusion , hematoma , and so on.

Injury severity is defined as the extent of physical trauma to the

accident victim, and, depending on the injury type, may have a wide

range of possible descriptions.

II-l
1

A morbidity parameter is a quantitative description of the injury

severity, where such descriptions are meaningful and practicable in a

medical or analytical context. Examples would be an amount of certain

radiation per unit area of exposure or a diagnosis as a set of specified

morbidity parameters.

Product involvement is essentially the way in which a product

contributes to an accident and any subsequent injuries.

Each of these factors plays a critical role in our analytic procedure.

They will be used to develop qualitative criteria for generic properties of

product -hazard characteristics. In the material to follow in Section C,

two modifiers are associated with each of these factors. These modifiers

are used to identify the extent of the factor in the accident phenomena.

For each of the terms "injury type" and "injury severity," we specify

whether the factor has a narrow or wide range of effects. For the "morbidity

parameter" we specify whether the trauma is describable by a single

parameter or by multiple parameters of physical damage; and for "product

involvement" we specify whether the mechanism by which an injury is

produced can or cannot be described in general terms for all products

which produce the injury. If it can be stated that an injury of a

particular type and severity can be generically associated with a

product-type or a class of products, then we use the term independent

when referring to product involvement. If it cannot be stated as independent,

then the product involvement cannot be described generically at the

product-type or class level, i.e., we lose the ability to describe the

effects generically. In this case the term dependent is used in referring

to product involvement.

II-2
Although narrow and witb are c|ual i tat Ivc modifiers, it is intended tliat

"one or few" is impiietl when using narrow, and "several or- iii.uiy" is iiiij)lied

when using wide . In the context of the analysis of Section C below,

these terms will assume meaning relative to the problem under investigation.

For a specific problem, the analyst will know, or determine by repeated

application of fault-tree analysis, empirical evaluation, or testing, how many

is implied by the modifier narrow and how wide the range of effects will

be. The values for these modifiers will determine, to a large degree,

the likelihood of using a generic regulation.

By attaching modifiers to each of the factors a number of combinations

are created, each of which has its own characteristics and consequences

as it relates to countermeasures . With four factors and a choice of two

modifiers for each factor, sixteen combinations are possible. Section B,

below, enumerates these combinations and discusses the consequences of

each

B. Combinations of Principal Factors

The four factors and their modifiers are presented as combinations

in Table II -1. At the top of the table the four factors are given, and

in the right-hand column a comment is provided about the regulatory form

best suited for each combination. In the table, let N = narrow, W e wide,

S E single, M = multiple, I = independent, D = dependent, stand for the

modifiers

Of these sixteen combinations, one (# 2) seems ideally suited to generic

formulation, and three others (# 4, 8, 12) suited to generic formulation,

if the complexity of multiple test methods does not defeat the advantages

of generic control. Most of the combinations appear to result in situations

which may require product- specific regulation. If this is true,

II-3
Table II-l: Array of Combinations of Principal Factors

CONMINT

(a) (b) (d) ——

1 N N s D product dependency suggests product -speci fie

regulation (PSR)

2 N N s I ideally suited for generic regulation

3 N N M D product dependency and multiple parameters

suggest PSR

4 N N M I generic regulation may be possible with

multiple test methods

5 N W S D not likely to occur; single parameter

measure unlikely

6 N W S I not likely to occur; single parameter

measure unlikely

7 N w M D product dependency, wide severity and multiple

parameters suggest PSR

8 N w M

1

I generic regulation may be possible with

multiple test methods

9 W N S D not likely to occur; single parameter

measure unlikely

10 W N S I not likely to occur; single parameter

measure unlikely

11 w N M D product dependency, wide injury type,

multiple parameters suggest PSR

12 w N M I generic regulation may be possible with

multiple test methods

13 w W S D not likely to occur; single parameter

measure unlikely

14 w W S I not likely to occur; single parameter

measure unlikely

15 w w M D PSR; all factors show worst condition

16 w w M I PSR; wide range of injury type and

severity, and multiple parameters

Legend

:

N s narrow

W = v'ide

S 5 single

M E multiple

I E independent

D 5 dependent

PSR E product -specific regulation

II-4
liowever, for a particular product -hazard problem will depend on the

nature of the injury type iind severity, anil the extent to which a proposed

countenueasure is tlependent on pioduct characteristics.

Sections C and D, which lollow, present a procedure ;ind data sources

for resolving these issues fv ' a particular problem. They indicate also

which methods are needed to develop information for making decisions in

each phase of the investigation.

C. Procedure for the Determination of the Generic Case

In the analysis of product -hazard regulation there are three major

issues to address: the injury mechanism, the control of that mechanism,

and the test method. Figure II -1 displays a procedure for analyzing and

evaluating these issues. Information about countermeasures , test method

and the injury mechanism is also generated as a result of this analysis.

Our approach is to use the logic displayed in Figure II -1 as a

basis for a stepwise procedure of evaluations. A procedure follows in

which each step includes comments concerning methods and data sources

appropriate to the operations of that step.

Procedure

STEP I : The first task is to develop the product -hazard cluster.

This development is based on identifying a particular set of products,

or product -types, that are directly associated with the occurrence of a certain

hazard. Assigning products initially to the cluster is based on statistical

evidence and a fault-tree analysis* of suspected product -types. The data

*The elements of fault-tree analysis are given in the appendix.

II-5
Produrt-Hnzard

Cluster

Product Coni]ionent

(Per product -type)

Risk- Producing

Circumstances

Statistics of InjuryPopulation Data

(a)

(b)

(c)

(d)

Single Test

Method Feasible

Inj ury

Mechanism

Injury i Type(s) r

I

Is Mechanism Controllable

With Single Countermeasure?

fNarrow , r • • 4. ^Wide ^ injury types

Narrow

Wide

}f 1 „ } morbidity parameter (s)

{^i'Tjl"" ) range of injury severity

Multiple^

r Dependent

Independent

of product type

C#: 5,6,9,10,13,14

Not Possible or

Not Likely to Occur

C#: 1,3,7,11,15,16

Product -Type Specific

Regulation

Oh 2,4,8,12

Is Countermeasure Testable

By Single Test Method?

yes

cO

Single Test

Method

no

C#: 4,8,12

Multiple Test

Methods

10

But Requires 1 Generic Standard Regulation | Development

*The numbers referred to correspond to the combination numbers in Table II -1,

Figure II -1: Flow Chart of Analytic Procedure

II-6
sources for this step are statistical compilations, in-depth reports

and product -t>T)e descriptions. It iiiay occur that the cluster is too

small for further consideration for generic control. Hiis decision is

left to the analyst.

STEP II: Analyze the product component and risk- producing circumstances (Boxes 2 and 4 of Figure II -1). The analyst should develop a

precise description of the manner in which the product component is

involved in the hazard. The risk (degree of hazard control) and the

accident sequence should be described in specific detail. This information

is obtained from descriptions of product components and an engineering study,

or other evaluation, of the risk-producing circumstance. The use of a

fault-tree analysis will be of great assistance in providing the needed

details. The analyses of this step and Step III are used in Step IV.

STEP III : Develop from accident frequency data, population demographics,

and injury severity data, the range of injury severity and descriptors

of injury types. The intent of this step is to characterize the number

of injury types by population classes which are associated with a product

hazard cluster and to determine the morbidity parameters associated with the

types of injury (Box 3 of Figure II -1).

STEP TV : Use fault- tree analysis to determine the causes and contributing

factors or events in the injury-producing mechanism; obtain a specific

description of injury type(s) and population affected. The results of

this step should provide preliminary information about the injury mechanism

and what form its control may take. This step may require a "boot-strap"

operation to get started. The analyst should postulate the injury-mechanism

and then refine its description and character with repeated evaluations of

data, fault -tree analysis and product attributes.

II-7
STEP V: Ascertain those countermeasures which can be used to correct

the perceived product -hazard problem. This determination is based on

the evaluation of four conditiqns:

(1) the number and character of injury types,

(2) the number and character of injury severities,

(3) the number of morbidity parameters needed to characterize the

injury severities,

(4) the relationship between the countermeasures and product- type (s)

.

Table II -1 enumerates the possible combinations of these four conditions,

based on an understanding of narrow as few and wide as many . Just how

"few" and how "many" must be determined by the analyst. This decision

is based on his perception of the degree of generality he is willing to

accept as a basis for generic regulation. For an effective generic

standard, "narrow" should be no more than two, and 'Vide" should be

greater than two. Otherwise, either the problem can be treated by

separating the effects and analyzing them on that premise or the problem

is not likely amenable to generic regulation.

Box 6 of Figure II -1 shows the sixteen combinations of Table II-l.

A study of Table II -1 reveals that three groups emerge, the first with

generic possibilities (Box 7) , the second with little likelihood of

occurrence (Box 8) , and the third for which a product -specific approach

seems to be more appropriate than a generic one (Box 9) . The numbers

shown in Boxes 7, 8, and 9 refer to the combinations of Table II -1. It

should be noted that for a particular problem these conclusions, as

represented by the comments with Table II -1 and the logic of Figure II-l,

may be different in some degree, and such differences might lead to

modifications of our general conclusion about these combinations and

II-8
their generic properties. Boxes 8 and 9 are not developed further, since

they show that either the combination is unlikely or the combination

appears to be better suited for, product -specific regulation. Box 7 is

the next step of our analysis which addresses the resolution of issues

concerning test methods.

STEP VI : Determine whether a single test method can be specified. It is

necessary to use information on the injury mechanism, product components,

and the number of and differences among the identified morbidity parameters

(ref. Step III). A suggested method for addressing these issues is to use

the fault -tree approach. When fully developed, it provides an appropriate

level of detail about matters concerning testing and countermeasures

As a result of this evaluation we expect either a generic standard to

emerge with a single test method (C#2) or a generic standard with several

test methods (C#4, 8, 12).

Step VI might reveal that a test method can be specified, but may not

be readily available in a current standard. The analyst should consider

developing the test method for the generic standard if it is feasible to

do so. Further, if test requirements can be grouped into a single set

of specifications, or if several test methods can be replaced by a

single test method, then a single test method should be considered.

We summarize in Table II-2, below, the data sources and methods

of analysis which may be utilized in the steps of an investigative

procedure. To a large degree the problem under study will determine

which methods, data sources, etc., will be used. Table II -2 is only

intended as a general guide and reminder for the analyst. The table

includes several methods which are not described in the text: rank-ordering

by value, rank-ordering by index, correlation analysis, and factor analysis.

n-9
Tliese techniques are conceptually difficult and require a familiarity with

advanced statistical methods to be used effectively; they also require

detailed data structures in order to perform between- cluster and withincluster analyses. Their inclusion in Table II-2 is for completeness and

to remind the user of their existence in the case that fault- tree analysis

is inadequate but appropriate data sources are available. Professional

assistance should be obtained if these methods are employed.

T.'ble II-2: Suiinary of Methods and Data Sources

D. Method of Analysis

Introduction

Sections A, B, C, above, describe the process by which the generic

case is identified and analyzed. In this section the details of the

11-10
analysis are developed. Tliese details address the classifications of

injury, injury severity, products, :md hazard. Tlic classifications provide

the basis for determining the commonality of the hazard ;uTion^ the producttypes, establish that product-types are correctly evaluated, and determine

appropriate countermeasures and test-method characteristics. Further,

these classifications are intended to be used in conjunction with and

provide input to a fault- tree analysis. The fault- tree method provides

an opportunity for obtaining a number of additional insights (see Appendix)

above and beyond the primary objectives of identifying countermeasures

and test-methods.

1. Injury Severity Analysis and Classification

1.1. Injury Types

There are three levels at which injury types may be organized.

The first, and most general, employs broad classification descriptors such

as toxicity, shock, pressure, bums, and mechanical. Within this scheme

each of these descriptors may be subdivided into more detailed descriptors

which denote the sources of injury, such as noise under the descriptor,

pressure .

The second level uses medical descriptors which depict the injury

as a type of diagnosis. Examples of this classification are fracture,

dislocation , concussion , laceration , hematoma , and so on. The number of

such descriptors would be adapted to the injury types associated with

the product -hazard combinations under study. Presumably, these would

be very few in number, but it is important to capture in the classification plan any wide variation of hazard- injury combinations which may

be present.

11-11
'Hie third level combines the medical descriptors of the second

level with descriptors which specify body-pcirts and appropriate characteristics

of the affected population, such as age , sex , and env i roiunent .

To determine whether the hazard is generic or product - spec i f ic , the

third level of injury- type classification will probably have to be used;

the first or second levels may not provide sufficient resolution

to determine the issue for or against a generic approach. It is important

also to have a scheme in which accident data may be organized to display

distributional characteristics. If multivariate analysis is to be

done, particularly factor analysis, then a classification scheme at the

third level is required.

1.2. Tabulations of Product -Severity Data

A great deal can be learned about product -severity relationships

from tabulations of accident data when arrayed in particular ways. Figures IIand II-2B show dummy matrices of two possible organizations of data.

Figure II-2A: Severity Tabulation Matrix

Product- Type Code No. : XYZ

Diagnosis: Thermal Bum

Disposition Severity Class

of Patient A B C D E

1

1

i

-4" '

' 5

11-12
Figure II-2B: Severity Tabulation Matrix

Body Part

j Product -'lype Code No. : XYZ

1 Diagnosis: Thermal Bum

j Population Group:

1 Severity Class

A B C D E

1

2

3

4

cJ

i

1 These tabulations will show the general relationships among variables

of interest, and can be used to develop input data for any of the evaluation

methods in these guidelines. A composite of such tables provides a

picture of product clusters in regard to diagnosis, severity and body

part as they relate to product- type.

1.3. Injury Severity and the CPSA

Section 9(c)(1) of the Consumer Product Safety Act states, in

part, that prior to promulgating a consumer product safety rule, the

Commission shall make appropriate findings for inclusion in such rule

with respect to--

(a) The degree and nature of the risk of injury the rule is designed

to eliminate or reduce; and

(b) The approximate number of consumer products, or types, or classes

thereof, subject to such rule.

11-13
It is clear that these words imply (1) a requirement to depict the

hazard and its countermeasure , and (2) an estimate of the impact of a

rule on a class of product -types, or on separate products. Severity is

the critical variable in the development of a countermeasure or evaluating

a rule's impact. Consequently, in the identification and presentation

of severity data, characteristics and consequences are both central to

and technically requisite for the development of a standard.

2. Product Characteristics

Introduction

We now examine ways in which product characteristics can be

structured for purposes of analysis and evaluation. Although a standard

usually addresses a product's performance, it is important to emphasize

that all aspects of a product's history, from design to distribution and

use, should be considered when identifying hazard and determining

corrective measures for perceived risks.

Our interest in products ranges over three broad areas: involvement

in the dynamics of the accident, safety requirements, and functional

performance. Our evaluation of these areas is based on "scoring"

a product or product-type by filling in a matrix of interacting factors.

2.1. Product Involvement

Figure II -3 is a scoring layout for depicting the nature of

a product's involvement in an accident sequence. The information on

which scores or groupings are made may be derived from in-depth accident

reports, special studies, interviews, and fault- tree analysis. Scoring

product involvement may be done either by checking a characteristic

11-14
according to the interaction or by assigning a number which represents

the importance of the interaction. The "checking" method serves only to

alert the user of a problem, whereas "assigning a numlicr" serves to

represent the severity of a problem. It may not be possible to score a

product properly until a fault- tree study is made or an engineering

evaluation of the interaction is performed.

Figure II-3: Product Involvement Scoring Matrix

Product Characteristics

Interaction Modes

Consumer Use Environmental

Normal ! Abnormal Stress Normal Abnormal

Design

Construction

Materials

Components

Performance

Deterioration

Total Score

The analyst should adapt the number or detail of these characteristics

and the interaction modes as appropriate. Whatever scores are used should

be consistent for all three phases of the product investigation.

2.2. Product Safety Requirements

Figure II-4 is a scoring matrix for evaluating a product's

safety characteristics. Each product is graded with regard to its safety

features for the user; degree of compliance with safety standards; and

for the safety of product components, where those components may involve

a potential hazard if controls deteriorate, are absent, or are inadequate.

11-15
Figure 11-4: Product Safety Scoring Matrix

Safety Features

Product Characteristics User Product Components Compliance

Design

Construction

Strength

Energy Source

Thermal Conditions

Noise

Vibrations

Edges

Spacing

Stability .

Surfaces

Mechanical Action

Total Score

As before, this scoring matrix may need to be adapted for a specific

problem; it is assumed the analyst can make the necessary changes in the

scoring matrix to suit his needs.

2.3. Product Functional Performance

Figure II -5 is a scoring matrix for evaluating a product's

functional performance. Each product is rated on its engineering and

physical properties. We wish to determine how the product responds to

11-16
conditions which may create a hazardous condition, an unsafe substance,

or a dangerous energy potential. 'Ilie score should reflect the presence

of controls as they appear in the make-up of the product's configuration.

As before, it may be necessary to perform an engineering evaluation before

a score can be assigned.

Figure II-5: Product Functional Performance Scoring Matrix

Sources of Stress

Product Element j

Ilil

1, kk '1/

Materials

Design

Construction

Strength

Energy Source

Temperature ,

Noise

Vibration

Durability

[Total Score

3. Classification of Hazard

The primary reason for classifying hazards is to distinguish those

characteristics of the hazard which determine whether a generic standard

is possible. It is essential to study carefully all aspects of the

11-17
product -hazard imd liazard- injury phenomena in order to separate or

resolve hazards which appear to be similar. Tliis analysis provides the

basis for specifying appropriate countermeasures. It is equally essential

to identify the range of variation a hazard may have because it is

critical to determining whether a condition is correctable by a generic

regulation.

A hazard should be classified according to the maimer in which it is

associated with the following:

1. type,

2. factors in Hazard Creation,

3. primary and Secondary Sources of Hazard,

4. hazard Manifestations.

These are now discussed in turn.

Hazard Type may be described by the following table* of descriptors:

Table II-3: Hazard Type Classifiers

Mechanical

Cut

Puncture

Bruise

Fracture

Particle in Eye

Bum

Electrical

Thermal, heat

Thermal, cold

Radiation

Chemical

Pressure

Acceleration

Crushing, fluid

Crushing, solid

Pinching

Noise

Vibration

Shock

Electrical

Pressure

Contact

Physiological

Trauma

Cold Immersion

Toxicity

Asphyxiation

Organic Damage

Respiratory System

Circulatory System

Dermatosis

Others

Exhaustion

Chill

*Hammer, W. , "Handbook of System and Product Safety," Prentice -Hall,

1972, Chapter 4. U-IS
Fault-tree analysis is recommended for classifying factors that create

or contribute to the hazard. Ihis analysis identifies liow the factors

involve the characteristics of the product, its mode of use, and the

ability of the user to abuse the product. We specify these possibilities

in Table II -4.

Table II-4: Classification of Factors in Hazard Creation

Product Characteristics Product Safety Control Product Performance

Design

Construction

Materials

Performance

Durability

Components

Materials Materials

Design 5 Construction Design 5 Construction

Strength

Energy Supply

Hazard Type

Reliability

Strength

Convenience Factors

Normal Mode

Abnormal Mode

Deterioration

The identification of primary and secondary sources of hazard provides

information about the combination of events and conditions which contribute

to the creation of a hazard. This information is required for

establishing the nature and scope of a countermeasure to the hazard.

If the countermeasure is directed toward modifying hazard sources rather

than hazard control, then both the countermeasure and the test method

may be product-type dependent. The generic case is lost if the hazard

sources are different for each product- type. A better opportunity for

generic control is obtained if the countermeasure and test method are

directed toward hazard control.

Hazard manifestation refers to the nature of an accident and any subsequent

injury, but it may also be important to consider how it relates to product

durability, reliability and non-consumer safety problems.

11-19
All possible modes, variations and forms of the hazard should be

ascertained. If the hazard is capable of creating other hazards, or

displays itself in varying degrees of severity depending upon conditions,

then each manifestation may have to be treated separately. Countermeasures

designed against the hazard source may be totally different from

countermeasures designed to control the manifestations of the hazard.

The best method for analyzing these conditions appears to be

the fault -tree diagram, supported by engineering evaluations of the product

in scenarios which cover appropriate user-product modes.

4. Method of Analysis

Given that the classifications of injury and severity, product

involvement, and hazard have been carried out, our investigation is ready

for the next step: to develop the product -hazard combinations and assign

these combinations to groups or clusters according to some criteria.

Figure II -6 presents a procedural diagram. The formation of producthazard combinations is based on bringing together the classifications of

injury and severity with product involvement. The specification of the

countermeasure and the characteristics of the test method are developed

from the attributes of the product-hazard combinations in the cluster.

The critical aspects of this process are the assignment criteria and the

identification of the countermeasure.

4.1. Assignment Criteria

The assignment of product- types to a cluster is based on five

broad criteria:

1. hazard characteristics and intensity,

2. product component.

11-20
Data

Injury 5 Severity

Classification

Product Involvement

Classification

WProduct - Hazardy

Combination

\; Countermeasure

Test Method (s)

Figure II-6: Generic Standard Development

11-21
3. physical injury mechanism,

4. population affected,

5. human factor level.

The criterion of hazard characteristics and intensity deals with

the injury type, severity and range of physical effects associated with

the hazard. This criterion establishes the basic attribute of the

cluster and the product-hazard combinations. The remaining four criteria

determine the differences or similarities among products and their

ultimate assignment.

The second criterion, product component, determines the extent to

which products have components in common which are associated either with

the hazard or the process of injury. It may be that a given regulation

can be made for a cluster of products even if there are differences in

their hazard-associated components. This situation could arise from a

safety problem which is primarily related to performance or the injury

mechanism rather than product components. This criterion may serve as

an independent test or as a subsidiary test of the third criterion.

The mechanism by which the injury occurs is the third criterion, and

we are concerned here with the mechanical aspects of product involvement,

the forces applied, and the dynamics of the user- forces -product components

mix. The recommended method for evaluating the product -hazard combination

for this criterion is fault -tree analysis, which should provide the necessary

description of the accident scenario. We discuss below the need to

evaluate carefully any proposed countermeasure against the details of

the accident scenario and to ascertain the capability of the countermeasure

to control the injury mechanism of each product in the cluster.

. n-22
The fourth criterion, population affected, is intended to

distinguish products, if it is critical to do so, on the basis of the

age or sex, or on some other demographic variables, of the population

experiencing the accident.

The fifth criterion, human factor level, distinguishes those producthazard combinations in which the injury mechanism is primarily caused by

an act or motion of the user. This criterion attempts to separate the

primarily human factors accident from the primarily mechanically produced

accident. The appropriate countermeasure for the former is more difficult

to specify than the countermeasure for the latter, and is likely to

address the interaction of the user with the product. In the latter

case, however, the countermeasure assumes that human activity is not a

significant contributor to the accident, and therefore addresses a

product component or mechanism. There is a middle ground in which a

countermeasure may have to address some aspect of human activity in its

control of the product. How these interactions affect the assignment of

a product to a cluster depend on the product -hazard combination being

investigated.

4.2. Identifying the Countermeasure

At this point in the analysis, product-types are assumed to be

assigned a cluster, and the cluster is characterized by the common

attributes of its members. The next step is to define a single countermeasure

for all the products in the cluster and determine that the countermeasure is

applicable to each product in the cluster.

11-23
Tlie countemieasure will be more effective if it can address the

injury-mechanism directly. If the injury -mechanism involves a complex

sequence of interactions and human activities, the countermeasure may be

limited to an indirect control of the hazard. If this occurs, a deeper

examination of a fault -tree analysis may be necessary to identify those

conditions for which direct control can be established. If this cannot

be easily done, it may be necessary to use the injury-mechanism criterion

a second time to separate products in a cluster into two groups, one

amenable to the specification of a countermeasure and the other for

which control cannot be isolated and addressed by a countermeasure.

When the countermeasure has been established, each product should

be examined in the light of the countermeasure to determine whether there

is any condition or situation not covered or addressed by the countermeasure, and whether the statement of the control is ambiguous with regard

to individual products. This process of checking the injury-mechanism

of each product against the countermeasure, and verifying that the productcountermeasure relation is correct, is a necessary fine-tuning and should

be iterated until as many products as possible are adequately and effectively

covered by the final definition of the countermeasure.

4.3. Characterizing the Test Method

A test method is usually a specified procedure which uses

test equipment, data, criteria, and instructions to determine product

compliance to a standard. The test method may address safety, or some

aspect of product reliability and durability.

A test method for a generic safety standard depends directly on the

specifications of the countermeasure. The countermeasure must be defined

11-24
in technical terms and must specify all conditions to be satisfied. The

basis for a test method is established when the countermeasure is presented

as a technical requirement. Since the test method is intended for a

large number of product -types, it is likely that it will have to be

developed directly from the specifications of the countermeasure; but it

may also be possible to customize a satisfactory test method by using

appropriate parts of existing standards.

The problem of multiple test methods arises for those situations in

which the technical requirements of the countermeasure cannot be fulfilled

by a single test method, or one in which the product- types are such that a

test method is needed for groups of types, even though a single countermeasure

is in effect.

This latter situation may be simplified by splitting a generic standard

with multiple test methods into separate standards; but this will depend

on the relative efficiencies of the multiple version versus the single.

It is not a requirement of a generic standard that it must have only one

test method; however, this is the ideal case.

E . Summary

lapter II has developed the concepts given in Chapter I into a

method of analysis which provides the basis for developing a generic

safety standard. The salient points of this method are the classification

of the product and injury data, the extensive use of the fault- tree

diagram, and the iterative process of evolving the specifications of the

countermeasure. The essential portion of the process, on which hangs

the success or failure of the effort, is the development of the cluster,

whose properties are those of its members. The degree to which these

11-25
properties are different or similar with regard to the product and the

hazard determine whether a universal countermeasure and test method can

be obtained.

A determined application of the assignment criteria and the faulttree analysis should provide a tool of adequate sophistication for most

problems of generic standards development, but judgment is a necessary

part of making the scientific analysis work effectively.

11-26
CHAPTER III. DEVELOPING TlUl CEJ^ERIC STANDAR13

Introduction

With the results of the investigative procedure of Chapter II

in hand, we are now ready to prepare the generic standard as a formal

instrument for review and evaluation. The documentation should include an

exposition of the product characteristics to be modified, the hazard

to be controlled, the countermeasures to be imposed, and the manner in

which the test method will apply.

A. Product Characteristics Modified by Generic Standard

All aspects of the modification of the product or product -type should

be clearly detailed in both qualitative and technical terms. It is important

to know how the characteristics of any product change so that an evaluation

can be made concerning the impact on performance, efficiency and cost

of the modified product. The direct and indirect consequences of the countermeasure should be explained, and any assumptions or latent conditions

clearly stated.

B. Hazard Characteristics Controlled by Generic Standard

All aspects of the manner and degree in which the countermeasure

controls or modifies the hazard must be given. The control should be

stated in terms of appropriate scenarios of use and environment, and under

what conditions there are exceptions to all or part of the intent of the

control. The countermeasure should include, as appropriate, all necessary

data or technical descriptions pertinent to evaluating its effectiveness

and understanding the way in which it functions as a control.

III-l
C. Countermeasure and Test Methods

Both the countermeasure and the test method (s) should be supported

with pertinent technical information for their implementation and understanding.

These will include the requirements as imposed by the CPSA, any criteria,

exceptions, conditions, test materials, etc. needed for any part of the

implementation of the generic standard. The test method will be supported

by descriptions and procedures for use, and by threshold criteria for

safe product performance. Any needed equipment will be identified for

use, whether it is in a laboratory test, or in a test designed for use

at the point of fabrication, after production, or after retail. Any

impact of the control or test method on any aspect of the normal quality

control should be evaluated to determine consequences concerning performance,

efficiency or cost.

D. Form of the Standard

The analyst may be able to utilize existing standards, or parts thereof,

in the development of the form and content of his generic safety standard.

Test methods or descriptive material, either technical or instructional,

may be borrowed for inclusion; therefore, the analyst should review all

pertinent and appropriate extant standards for sources of material which

are directly applicable to the statement of a new generic standard. The

analyst should keep in the mind the three forms inclusions may take: the

standard may be developed by selecting appropriate sections, or other

materials , from parts of other extant standards (eclectic) ; it may be

adapted from an existing standard by modifying a portion or portions of the

standard (adaptive) ; or it may be developed by abstracting portions of

other standards and evolve from their incorporation and synthesis (synthetic)

.

III-2
E. Content of the Standard

The standard should provide descriptions of the expected product

performance; modifications of the construction of the product; test

method specifications, use, criteria, data, exceptions, conclusions, test

materials, and any special conditions; and any additional features of

control above and beyond the principal countermeasure.

F. Generic Standards and the Process of Development

A number of reports and books have appeared recently which deal with

various aspects and problems of developing voluntary, product -specific

standards. The principal concerns are the effectiveness of the

traditional process to produce good standards, motivations for standards

development, and the role that standards play in commerce.

These issues are involved and complicated. Standards which address

uniformity, quality and interchangeability would be even more complicated

the standard is generic. Since the generic safety standard, as perceived

and presented in these guidelines, is directed to the regulation of

hazard, there is greater likelihood of a successful development than if

the effort addressed the much more difficult problems of uniformity,

quality or interchangeability. Addressing safety in a generic way seems

less likely to change the traditional development process than a similar

effort for one of the more complex aspects of product attributes.

In Oiapter I, Section D, seven principal impacts on the traditional

process were listed. These will not be repeated here, but the reader

should review them as an integral part of the discussion of this section.

These seven suggest that the development of a generic standard requires

in-3
different approaches to data collection, to membership selection, to the

business of trade-offs, and to accommodations of the consensus process.

The form and extent of the impact will be determined to a large degree

by the standard to be developed and the pressures behind the need for

the standard. All of the procedures of surveying existing standards,

field experience, hazard and injury information now become dependent on

distinctions among similarities and differences ol the products to be

regulated.

The most difficult aspects of the process will be determining the

proper membership and representation in the committee for developing the

standard, and the ability to achieve a consensus on the standard.

However difficult these tasks are, the generic safety standard should

have the advantage of being easier to address in context. It may be

possible to evolve the standard from revisions of existing standards or

to come to quick agreement on the specifications of a generic test

method, or metiiods. The objectives of the standard must be properly

perceived by the developing committee, however, and the committee must

evaluate the effectiveness of the standard in addressing the safety requi

ments of the products to be covered. :

III-4
CHAPTER IV. IMPACT EVALUATION OF GENERIC STANDARD

Introduction

The effectiveness of a safety standard is measured by the efficiency

of its regulation and the degree to which it achieves its principal objective,

improved safety. Once a generic standard has been promulgated, however,

it may have an immediate and long range impact on the manufacturer, the

public and the market.

The following sections point up some of these major areas of impact

and suggest how they might be evaluated.

A. Technological Impacts

An area of positive influence is that in which a regulation introduces

an improved technological process or in some way enhances a product line

in terms of quality or performance. It is also possible that patentable

concepts are developed as a result of safety and performance regulation.

The analyst, therefore, should be aware of these possibilities by reviewing

the industry's response to regulation, studying the application for patents,

and observing the technical integrity of new product lines. In the absence

of other measures of impact the influence on technology could be an

important signal of regulatory influence.

B. Cost -Benefit

The most direct impacts of a regulation are the cost of compliance

and the benefit to the consumer. Conversely, the intact may also provide

benefits to the manufacturer and higher costs to the consumer. It follows

then that we may have cost and benefits for both the consumer and the manufacturer. The following table attempts to list some of these for both of the

IVprincipal concerned parties, lliey may not all apply in a particular

case but they are potentially present, and are provided more in the nature

of a check list.

Table IV- 1: Cost- Benefit Array

Consumer Manufacturer i

1 Item Cost Benefit Cost Benefit | Better product

performance

may be higher

or no change

greater

efficiency

product

modification

^—

,

more sales, ! bigger market !

\ Improved

safety

may be higher

or no change

fewer accidents , lower

severity

may be higher

or no change

public acceptance

,| enliances

reputation

| Teclinological

improvement

may be higher,

lower, or no change

better efficiency and

performance

may be higher,

lower or no change

new or enlarged

market

Compliance higher unit

cost

safer

product

testing or process

modification

public acceptance,

retain market

position

It may occur that the hazards involve more than just the manufacturer,

i.e., improper installation, handling, and so on, in which case the costbenefit equation becomes more complex and difficult to evaluate. It is

preferred that the costs and benefits of Table IV- 1 be expressed numerically

in order to obtain a measurable impact of a regulation on the product, on

the manufacturer's technical and financial position, and on public reaction

to improved safety and performance. To develop an economic model of these

costs and benefits is beyond the scope of these guidelines; the analyst

should engage experts in cost -benefit analysis to evolve an appropriate

model and its attendant data input requirements.

IV2
C. Estimate of Hazard or Injury Reduction

Since the reason for rei^iilation is to provide a sjiecific improvement

in the safety of the products it regulates, :in estimate of its effectiveness

is essential to its evaluation. The various ways in which an estimate can

be made fall into two groups: monitoring the population which uses the

product, or conducting a technical evaluation in which the estimate is

based on a simulation.

The monitoring of the user population can be done by watching the

accident statistics for any changes or shifts in product-hazard relationships. Unfortunately, this approach can be easily confused by other

factors which may obscure or defeat observing particular changes. This

is the problem of the signal-to-noise ratio in observing information.

A second problem is the possible long delay before an effect does occur,

in which case monitoring is an expensive investment with uncertain results.

A second monitoring technique is to perform a "before" and "after" statistical

experiment, but here, as above, the problems of signal-to-noise,

delayed effects, exogenous variables changing the context of the experiment,

tend to discourage the use of this method. A third method is to conduct

a study of the movement of products in use and gather data on the effectiveness of the regulation in the context of actual scenarios of productenvironment combinations.

The methods of technical evaluation are an engineering evaluation

of the regulated products and a fault -tree analysis of the modified

products. The engineering evaluation entails an experimental test of the

countermeasure and measuring the product's performance under appropriate

and rigorous test conditions.

IV3
The use o£ a fault-tree analysis as a probabilistic model may

provide a reasonably good estimate of effectiveness. If probabilities

or weights are assigned to each condition contributing to an injury, then

an overall probability or index of occurrence can be computed. If this

is done on the product's fault-tree before and after the regulatory control,

the difference is a measure of the reduction of the hazard. The principal

difficulty is obtaining reliable estimates of probabilities or weights

for each process in the fault- tree scheme.

D. Other Factors in Impact Analysis

In addition to the items of the sections above, an evaluation of

the impact of a regulation should include an examination of those voluntary

standards the regulation is displacing; ascertaining whether or not the

scope of the regulation is adequate or weakened by being overextended;

evaluating the conditional or compromising effects of assumptions or

special conditions; and determining whether the regulation places an

unwarranted burden on the process of compliance by virtue of its technical

or qualitative requirements.

IV-4
APPENDIX

Tlie Elements of Fault-Tree Analysis

i

A-1
ANALYTIC STRUCllJRl- FOR I lAZAI^l) i:VAJ.UAT ION

Introduction

One of the most effective teclmiques for identifying and tracing

hazard sources is fault- tree analysis. In addition to its main purpose,

it also contributes to the development of count ermeasures and estimates

of risk reduction by virtue of its structure and detail.

The material for this section is based on the excellent text by

W. Hammer,^ who in turn acknowledges his indebtedness to the basic work

on and development of the fault -tree method by the Bell Telephone Laboratories

and the Boeing Company. ^ The concept has been developed by others into an

elaborate method of analysis. The full structure of this method is too

complex for the purposes of analyzing consumer product hazards, so we

have modified the concepts to the needs of our evaluations.

1. Fault-Tree Analysis

The technique of fault-tree analysis is based on the following steps:

1. A description of the hazard under study is set down in terms

of its quantitative, operational and qualitative characteristics.

If these are incomplete the technique will aid in their discovery.

2. All factors which contribute directly or in combination to the

occurrence of the hazard are reviewed. This establishes an

initial list of conditions and events needed for the analysis.

^Hammer, W. , "Handbook of System and Product Safety," Prentice-Hall, 1972

(Chapter 9)

.

2 Ibid. , page 238.

. : A-2
3. A "tree" is prepared by diagramming contributing events and

conditions which show interrelationships to each other and the

hazard. The process begins with the events or conditions that

could directly cause the hazard. This is the first level of

development. As the technique traces back through cause and

effect relationships, events and conditions that contribute in

some way to the existence of the hazard are added to the tree.

As these elements are added, the first level becomes

configured with greater detail in the form of branches and nodes,

taking on the nature of a "tree" structure.

4. The circumstances under which each element appears in the faulttree are determined. Each portion of the diagram which depicts

a sequence capable of producing the hazard is studied carefully

to determine in precise terms the nature of its contribution.

5. For each branch of the tree which is determined to contribute

directly or indirectly to the hazard, suitable expressions of

the interactions of events and conditions are developed in

terms of "and" and "or" logic.

6. The probabilities of events and conditions are assigned to each

branch, if this information is known. In the evaluation of producthazard combinations the probabilities of occurrence may have to

be replaced by a qualitative, judgmental model of the possibilities

for certain events and conditions.

7. Interactions are studied or simulated to obtain data on the most

critical or likely combination of events and conditions which may occur,

A3
identifying single point or factor contributions, and identifying

all elements which, when modified, could alter the character of the

hazard.

Our method is based upon two qualifying conditions:

(1) No operation is partially successful; it either fails or operates

properly , and

(2) Basic failures are not necessarily independent of each other.

If two or more basic failures are related, i.e., a subsequent failure

or condition is directly traceable to a prior failure or condition, then

the diagram of interactions should depict this sequence, even if the model

becomes more conplicated in its description of such dependent elements.

2. Fault-Tree Logic

functions have to be provided for, and this is done through the use of

conventional symbols which are combined to produce a flow-chart of

interactions. The following symbols are based on Hammer.

In order to develop a fault- tree diagram, certain basic, logical

Y

AND gate. Output Y exists if and only if all of

X, , X^, X_, X. occur or exist simultaneously.

Y

OR gate. Output Y exists if and only if any one or

combination of X, , X^, X , X. occurs or exists.

A4
INHIBIT gate. Permits applying a condition or a

restriction. iTie input and condition or restriction

must be satisfied for an output to exist.

Identification of a particular event. As part of a

sequence it usually describes an input or output.

An event, usually a malfunction, given in terms of a

component of a product or as some combination of

conditions.

An event normally expected to occur. Usually always

occurs unless affected by a failure or condition.

An event not developed further because of lack of

information or of insufficient consequence. Could be

used to indicate the need for further study.

Indicates and stipulates restrictions. When used with

an AND gate, the restriction must be fulfilled before

the event can occur. When used with an OR gate, the

event may not occur in the presence of both or all

inputs simultaneously. When used with an INHIBIT gate,

stipulation is a variable condition.
A connecting symbol to another part of the tree within the

same major branch. Has the same functions, sequence,

and numerical values.

A connecting symbol to another part of the tree within

the same major branch. Has the same functions and sequence,

i but not numerical values.

With these symbols, any simple or complex sequence of events or

conditions may be depicted and logically related. Its power is limited

only by data which may be incomplete or unreliable, and by interactions

which are not conceptually understood or amenable to symbolic representations.

Not only does the fault -tree diagram provide a clear characterization of a

hazard but it also provides for the identification of primary and secondary

factors or elements in the failure sequence, and highlights the specific

points at which countermeasures are to be directed.

3. Example of Fault-Tree Diagram

Assume for the example that there is a hypothetical product

capable of inflicting a laceration in three different ways. Two ways

may occur in normal use and the third only after the product has been

damaged. Let the source of the injury be from an exposed sharp edge, a

mechanism capable of pinching, and from an exposed ragged edge, a

result of the product having an easily broken component. Figure A-1

is a simplified fault- tree diagram of the hazard and its sources. In

this figure the OR gates are labeled as and the AND gates as

A,, A^, and A^. At the top of the diagram is the injury; the injury is

A-6
1

LACnRATION

I

0

2 3

EXPOSED 1 EXPOSED

SHARP EDGE j RAGGED EDGE

' A,

4

PINCHING

A

1 6

DESIGN^

/

FORCE^

J L.

FRANGIBLE j COMPONENT "AC!^lON" {

1 MATERIAL | COMPONENT 1

11

/ POOR^ ~ X material^,

\ strength]

^^IGN

icONSTRUC-

\ TION /

10

>F.

Figure A-1: Example, fault -tree diagram

nOTE: F-j^ is a force level beyond which a breakage occurs and '^^ is a

force level to produce a laceration from mechanical pinching. The elements

in circles are indicated as possible sources of malfunction.

Alinked to the three possible causes by an OR gate, O-j^. Each cause is then

linked to its sources and conditions, A study of this example would

indicate that poor design and use of improper material or construction

contribute to two of the hazards. If, in the third case, pinching,

the action component (element 9 in the fault- tree diagram) is functional,

then the countermeasure would be in the form of a safety guard and consumer

information about the risk; if the pinching is not associated with the

product's legitimate function, then the countermeasure should address

the design or construction of the product. The circled elements in the

diagram specify elements which represent malfunctions. These interactions

may require engineering evaluations in order to depict them in the

fault-tree diagram. In such cases the fault-tree analysis will have to

wait on this information before it can be completed; it has provided,

however, a definite benefit in that the diagram exposed the need for an

engineering evaluation,

4. Benefits of Fault-Tree Analysis

In addition to its power as a descriptive tool for product-hazard

interactions and depicting product characteristics, fault-tree analysis

may provide insight into the comparison of products, energy efficiency,

and information needed by the public on product performance.

As a tool for the development of generic safety standards, the

method provides a basis for a comparative analysis of product -types if

weights or probabilities can be assigned to the interactions depicted by

the fault-tree diagram.

A-8
One of the principal assets of fault- tree analysis is its exposure

of how well the product -hazard or product-event interactions are understood,

described and quantified. If the method does properly portray the actual

interactions and conditions, discrepancies or inconsistencies will be apparent

in the course of the evaluation of the countermeasure and test-method.

These exposures may be of the sort that can be resolved only if an engineering

evaluation of the problem is conducted, and therefore the fault -tree

analysis will serve to signify these points of ambiguity or misrepresentation.

The areas in which fault- tree analysis provides insight and

guidance are:

1J. •

2. exposure and human factors,

3. countermeasures

,

4. probabilities or weighted effects,

5. engineering evaluations

,

6. product characteristics,

7. analysis of energy use,

8. comparison of products or performance,

9. design changes.

10. consumer information,

11. test method characteristics.

A-9
11 ii
NBS-1 14A (REV 7-7 fi

U.S. DEPT. OF COMM. BIBLIOGRAPHIC DATA

SHEET

1. IM MI K ,\ 1 ION OK Kl I'OK 1 NO,

NBSIR 76-1096

2. (m.v'i a, , , ....,,,11 \',-.

3. K, , ipn iii ' A, , ,11 N,..

4. ri 1 1.1- SI H I I 1 I.I- Guidelines for the Determination and Development of Generic

Safety Standards

5. I'nI.li, .III,,,, n.ir,' June ly/o

6. 1 'f r 1 or mill ( )r ^.mi 1 / .i( 1 1 m * i>,l( 3053

7. AirrHOR(S)

Robert G. Hendrickson

8. I'lTliirinmg Org. in. Kcpdii Nn.

9. PI;RI-0RM1N(> ORCANI/A ITON NAMI-. AND ADDRI-SS NATIONAL BUREAU OF STANDARDS

DEPARTMENT OF COMMERCE

WASHINGTON, D.C. 20234

10. l'r..|< > t/ I'.isis Vl'i.rk Uim N,.. 441 .143?,

11. ( onir.u i /C'lr.int No.

12. Sponsoring Org.in ization Name- antl ( ompletc AJdres.s (Street, City, State, ZIP)

Consumer Product Safety Commission

Washington, D.C. 20207

13. 1 ypi' iif Report & PiTioil

( ovrrcd Final

14. Sponsoring Agency ( ode 118

15. SUPPl.I-MKNTARI' NOTI-S

16. ABSTRA( r (A 200-word or less (actual sumrTtary ol most si^ilicant information. If documvnt ine/irdc.s a significant

bibliography or literature survey, mention it here.) "These guidelines were prepared to assist the CPSC in the development of generic

safety standards. This development is based on conceptual models of product hazard

interactions and analyses of accident sequences, product clustering, and hazard

characteristics

The motivation for these guidelines derives from a perceived need to expedite

the standard development process and to enhance the efficiency of standards for consumer product safety."

17. KEY WORDS (six to twelve enfnes, alphabetical order; capitalize only the first letter of the first key word unless a proper name; separated by semicolons

)

Operations research - NS

Management need

18. AVAILABILITY ^Unlimited

Q_ For Official Distribution. Do Not Release to NTIS

Order From Sup. of Doc, U.S. Government Printing Office Washington, D.C. 20402, SD Cat. No. CH

QjfOrder I'rom National Technical Information Service (NTIS)

Springfield, Virginia 221'Sl

19. SLCURITY CLASS

(THIS REPORT)

UNCL ASSIFIED

20. SEC URITV CLASS

(THIS PAGE)

UNCLASSIFIED

21. NO. OF PAGi:S

57

22. Price

$4.50

USCOMM-DC 29042-P74


ii

a.j\I1 itiII