ISO 13849 Common Cause Failure Explained – CCF and the 65-Point Assessment
Redundancy is an important design principle in many safety-related control systems.
Two independent channels can help ensure that a single component failure does not lead to the loss of the safety function.
However, redundancy only provides the intended benefit if both channels are not simultaneously affected by the same underlying cause.
This is where Common Cause Failure (CCF) becomes important.
ISO 13849 requires engineers to consider measures against Common Cause Failures when designing relevant safety-related control system architectures.
This article explains what CCF means, why it matters for redundant systems and how the ISO 13849 CCF assessment supports the evaluation of suitable preventive measures.
What Is a Common Cause Failure?
A Common Cause Failure occurs when multiple elements fail as the result of a common cause.
Consider a safety function with two redundant channels:
Channel 1 → Safety Function
Channel 2 → Safety Function
The architecture is intended to tolerate certain individual faults.
But imagine that both channels are exposed to the same excessive temperature, electrical disturbance or contamination.
A single external or systematic cause could then impair both channels.
The apparent redundancy may no longer provide the expected fault tolerance.
CCF analysis therefore asks an important question:
Could one common cause defeat multiple channels of the safety-related system?
Why CCF Matters in Redundant Safety Systems
Redundancy is often used to improve the fault tolerance of a safety-related control system.
For example, a machine safety function might contain:
Two sensor channels
↓
Safety controller
↓
Two output contactors
If one channel fails, the second channel can help maintain the required safety function.
However, simply duplicating components does not automatically create true independence.
Two redundant components may still share:
- the same physical environment
- the same power source
- the same installation space
- similar susceptibility to interference
- common wiring routes
- identical design weaknesses
If a single cause can affect both channels, the benefit of redundancy can be reduced significantly.
Measures against CCF therefore form an important part of designing redundant safety architectures.
Common Cause Failure vs Independent Failure
It is useful to distinguish between independent failures and Common Cause Failures.
Independent Failure
An individual component fails without directly causing the redundant component to fail.
For example, one contactor experiences an internal failure while the second contactor remains functional.
The redundant architecture may be able to tolerate this situation.
Common Cause Failure
One underlying cause affects multiple components or channels.
For example, excessive environmental temperature causes both channels to malfunction.
In this case, redundancy may provide much less protection because the supposedly independent channels are affected simultaneously.
This distinction explains why Functional Safety cannot rely on redundancy alone.
Common Cause Failure vs Common Mode Failure
The terms Common Cause Failure and Common Mode Failure are sometimes used interchangeably, but they describe different concepts.
A Common Cause Failure focuses on the cause:
One common cause leads to failures in multiple elements.
A Common Mode Failure focuses on the failure behavior:
Multiple elements fail in the same way or mode.
The concepts can overlap, but they are not identical.
For ISO 13849 evaluation, the important engineering question is whether common causes could compromise the independence assumed by the safety-related architecture.
Typical Causes of CCF
Common Cause Failures can originate from many sources.
Typical examples include:
Environmental Conditions
Excessive temperature, humidity, vibration, contamination or other environmental influences can affect multiple channels simultaneously.
Electrical Influences
Overvoltage, electromagnetic interference or shared supply problems can affect several safety-related components.
Physical Proximity
Redundant channels routed or installed closely together may be exposed to the same mechanical damage, contamination or thermal event.
Design Similarities
Identical components can sometimes share susceptibility to the same failure mechanism.
Installation and Maintenance Errors
Common installation practices or maintenance errors can introduce vulnerabilities affecting multiple channels.
The purpose of CCF measures is therefore not simply to add more components.
It is to reduce the likelihood that one cause can defeat multiple parts of the safety architecture.
CCF in ISO 13849 Categories
CCF becomes particularly important for architectures that depend on multiple channels.
Categories 3 and 4 use redundant structures to achieve fault tolerance.
The effectiveness of these architectures depends partly on ensuring that the channels are sufficiently protected against common causes.
If both channels can be disabled by the same event, the theoretical redundancy may not provide the expected safety benefit.
Category and CCF therefore address different aspects:
Category describes architectural and fault-behavior characteristics.
CCF measures help protect redundant elements against shared causes of failure.
A Category 3 or Category 4 architecture should therefore not be viewed as complete simply because two channels are present.
The ISO 13849 CCF Assessment
ISO 13849-1 provides a structured approach for evaluating measures against Common Cause Failures.
The method uses a point-based assessment.
Different preventive measures contribute points toward the overall CCF evaluation.
These measures address areas such as:
- separation and segregation
- diversity
- design and application experience
- competence and training
- environmental influences
- electromagnetic compatibility
The objective is not to calculate an exact numerical probability of a Common Cause Failure.
Instead, the assessment provides a structured way to demonstrate that appropriate CCF prevention measures have been considered.
Why Are 65 Points Important?
For the applicable ISO 13849 CCF assessment, a minimum score of:
65 points
is required.
This threshold is important because the CCF assessment is not simply informational.
The designer needs to demonstrate that sufficient measures against Common Cause Failures have been implemented.
However, the score should not be treated as a checklist exercise where engineers simply collect enough points and stop thinking about the actual design.
The selected measures need to be applicable and genuinely implemented in the system.
A measure that exists only in documentation but is not reflected in the real architecture provides no practical protection against CCF.
Separation and Segregation
Physical separation is one of the most intuitive ways of reducing exposure to common causes.
Consider two redundant signal paths.
If both wires are routed together through the same vulnerable location, a single mechanical event could damage both.
Separating the channels can reduce this risk.
Depending on the system, segregation can involve:
- separate wiring routes
- physical distance between channels
- protective barriers
- independent connectors
- separation of electronic circuits
The appropriate measure depends on the actual hazards and architecture.
Separation should therefore be based on the physical failure mechanisms that could affect multiple channels.
Diversity
Diversity can reduce the likelihood that identical vulnerabilities affect redundant channels.
This can involve differences in:
- technology
- operating principles
- component types
- implementation methods
For example, two sensing channels based on different physical principles may respond differently to certain environmental or systematic influences.
However, diversity is not automatically beneficial in every situation.
Different technologies can introduce additional complexity and different failure mechanisms.
The engineering objective is not simply to make the channels different.
It is to determine whether diversity meaningfully reduces susceptibility to relevant common causes.
Want to Learn ISO 13849 in More Detail?
Our professional ISO 13849 online training explains how safety functions, Performance Levels, architectural categories, reliability parameters and verification fit together in machinery Functional Safety.
The course provides a structured introduction to the standard with practical engineering explanations and examples.
Environmental Conditions and CCF
Environmental influences are a classic source of Common Cause Failures.
Two redundant components located in the same environment may both be exposed to:
- high temperature
- low temperature
- humidity
- vibration
- contamination
- electromagnetic interference
Engineers therefore need to consider whether the selected components are suitable for the intended operating environment.
Protective measures can also be required to prevent environmental conditions from affecting multiple channels simultaneously.
This illustrates an important principle:
Electrical redundancy does not automatically provide environmental independence.
Two perfectly separate signal channels can still share the same environmental vulnerability.
Competence and Design Measures
CCF prevention is not limited to physical architecture.
Engineering processes and organizational measures also contribute to avoiding common vulnerabilities.
Appropriate competence, design practices and application experience can help engineers identify common-cause mechanisms before they become embedded in the design.
This is particularly important because some CCF risks are not obvious from a simplified block diagram.
A schematic may show two completely separate channels while both still depend on the same installation practice, environmental condition or engineering assumption.
Practical Example – Redundant Safety Contactors
Consider a machine safety function using two contactors to remove power from a hazardous motor.
A simplified architecture is:
Safety Controller
↓
Contactor K1 + Contactor K2
↓
Motor Power Removed
The two contactors provide redundancy.
If K1 fails to open, K2 may still interrupt the hazardous energy.
However, engineers should also consider potential common causes.
For example:
Shared excessive temperature could affect both contactors.
Contamination could influence both switching devices.
Incorrectly selected components could share the same vulnerability.
A common installation error could compromise both channels.
The engineering task is therefore not merely to verify that two contactors exist.
It is to determine whether sufficient measures prevent a single cause from defeating both.
CCF vs Diagnostic Coverage
CCF and Diagnostic Coverage address different problems.
Diagnostic Coverage asks:
How effectively are dangerous failures detected?
CCF asks:
Could one common cause affect multiple channels?
A diagnostic mechanism can detect many individual faults while the system remains vulnerable to a common environmental or electrical influence.
Similarly, strong CCF prevention does not mean that individual dangerous failures will necessarily be detected.
Both concepts therefore contribute different aspects to the safety-related design.
CCF vs MTTFd
MTTFd describes the expected reliability of components or channels with respect to dangerous failures.
CCF addresses dependencies between redundant elements.
These are fundamentally different questions.
MTTFd:
How frequently can dangerous failures be expected?
CCF:
Could multiple elements fail because of the same underlying cause?
A system can use highly reliable components and still be vulnerable to CCF.
Likewise, strong separation between channels does not compensate for inadequate component reliability.
How CCF Contributes to Performance Level Evaluation
The achieved Performance Level depends on several characteristics of the safety-related control system.
A simplified relationship is:
Category + MTTFd + DCavg + CCF + Systematic Measures → Achieved PL
Each parameter addresses a different aspect of the system.
Category → architecture and fault behavior
MTTFd → component or channel reliability
DCavg → diagnostic effectiveness
CCF → protection against common causes affecting redundant elements
These parameters should therefore not be viewed as interchangeable.
A strong result in one area cannot automatically compensate for weaknesses in another.
CCF Evaluation with SISTEMA
SISTEMA supports the evaluation of safety-related control systems according to ISO 13849-1.
When modeling relevant architectures, engineers can document the parameters required for Performance Level evaluation, including CCF-related information where applicable.
This helps integrate the CCF assessment into the overall evaluation of the safety function.
However, SISTEMA does not replace the underlying engineering analysis.
The engineer still needs to determine whether claimed CCF measures are actually implemented and appropriate for the real machine design.
A software model cannot compensate for insufficient physical separation, unsuitable environmental design or incorrect engineering assumptions.
Common CCF Mistakes
Several mistakes should be avoided when evaluating Common Cause Failures.
Assuming Two Channels Are Automatically Independent
Redundant components can still share environmental, electrical or physical dependencies.
Treating the 65-Point Assessment as Paperwork
The measures used to obtain the required score need to exist in the actual design.
Relying Only on Diagnostics
Diagnostics and CCF prevention address different failure mechanisms.
Ignoring Physical Installation
Cable routing, component placement and environmental exposure can be just as important as the logical architecture.
Assuming Diversity Is Always Better
Diversity should address relevant common vulnerabilities rather than simply adding unnecessary complexity.
How CCF Fits into the ISO 13849 Workflow
The CCF assessment forms part of the broader evaluation of the safety-related control system.
A simplified engineering flow is:
Risk Assessment
↓
Define Safety Function
↓
Determine PLr
↓
Select Architecture
↓
Evaluate MTTFd
↓
Evaluate DCavg
↓
Evaluate CCF Measures
↓
Determine Achieved PL
↓
Verify PL ≥ PLr
CCF is therefore not a standalone safety analysis.
It contributes to demonstrating that the implemented safety-related architecture can provide the required risk reduction.
Key Takeaways
Common Cause Failure (CCF) describes failures of multiple elements resulting from a common underlying cause.
CCF is particularly important in redundant safety architectures because one common cause can potentially compromise multiple channels simultaneously.
ISO 13849 uses a structured point-based assessment for measures against CCF, with a minimum score of 65 pointsrequired where the assessment applies.
Relevant measures include separation, diversity, appropriate design practices and protection against environmental influences.
CCF should not be confused with MTTFd or Diagnostic Coverage.
Each parameter addresses a different aspect of Functional Safety:
MTTFd → Reliability
DCavg → Fault Detection
CCF → Independence from Common Causes
Together with the architectural Category and other applicable requirements, these factors contribute to the achieved Performance Level.
Learn More About ISO 13849
Understanding Common Cause Failures is an important part of designing robust safety-related control systems.
Our ISO 13849 training explains how Performance Levels, Categories, MTTFd, Diagnostic Coverage, CCF and verification fit together within the machinery Functional Safety process.
Explore our professional ISO 13849 online training →
