Guidelines for safety system certification

The primary objective is to demonstrate and document that the PSDI safety system satisfies specification and operational requirements for safe operations. Appendix B to 1910.217 says the program should cover activities "from design evaluation through the completion of the installation test and the annual recertification/revalidation tests" and show that hazards have been eliminated or reduced to an acceptable level through design, devices, warnings, or procedures (Appendix B to 1910.217).

• Include documented evidence from hazard analysis (HA), failure mode effect analysis (FMEA), and operational analysis.
• Cover residual hazards with warnings, labeling, or procedures.
• Keep records from initial certification through installation testing and annual recertification.

Both the manufacturer and the employer share responsibility: each manufacturer must maintain product quality of parts, components and subsystems, and each employer must maintain the installed system in a non-degraded condition. Appendix B emphasizes consistent quality control to keep certified/validated safety attributes effective (Appendix B to 1910.217).

• Manufacturers: quality control of supplied parts and assemblies.
• Employers: maintenance, inspections, and preventing degradation after installation.

Yes—analytical methods may be used in place of, in combination with, or to support tests when they can satisfy specification requirements. Appendix B states that analyses are acceptable where existing data exist or when testing is not feasible, but the analysis must be documented with assumptions, conclusions, safety factors, and limits (Appendix B to 1910.217).

• Analyses must clearly state basis, items analyzed, conclusions, safety factors, and limits.
• Use testing to validate analytical predictions where practical.

A similarity analysis report must show the article is similar in design, manufacturing process, and quality control to a previously certified item, and include application details and prior usage data establishing adequacy. Appendix B requires identification of the part, the previous item, and supporting data from earlier certifications, plus the usual analysis report elements (basis, conclusions, safety factors, and limits) (Appendix B to 1910.217).

• Document prior certification history and how the items are equivalent.
• Identify any changed or increased requirements and limit tests to those areas.

Similarity analysis is not acceptable when the internal or external stresses on the item being certified are not defined. Appendix B warns that similarity analysis should not be used if the stresses or conditions affecting the item are not clearly established (Appendix B to 1910.217).

• If loading, temperature, cycles, or environmental stresses are unknown or differ from the reference article, do not rely solely on similarity analysis.
• Perform targeted tests or detailed analysis for areas of change.

An analysis report must identify the basis for the analysis, the hardware or software items analyzed, conclusions, safety factors, and the limits of the analysis, and must clearly state any assumptions and their effects on conclusions. Appendix B lists these items as required content for analysis reports (Appendix B to 1910.217).

• State assumptions explicitly and describe how they affect results.
• For similarity analyses, add prior usage data and application details.

Yes—certification/validation should confirm hazards identified by design analyses (HA, FMEA) have been eliminated or reduced and that residual hazards from operational analyses are addressed by warnings, labels, or procedures. Appendix B states the process should confirm elimination or reduction of hazards and handling of residual hazards (Appendix B to 1910.217).

• Use HA/FMEA to drive design fixes and device selection.
• Use operational analysis to define training, warnings, and labeling needs.

When design, manufacturing, or application changes exist, certification/validation should focus additional or partial tests on changed or increased requirements rather than assuming prior certification covers them. Appendix B advises concentrating tests on areas of change when similarity to prior designs is not exact (Appendix B to 1910.217).

• Document changes and perform targeted testing or analysis for those areas.
• Update certification documentation to reflect differences and test results.

No—the guidelines are nonmandatory and employers or manufacturers are encouraged to recommend other approaches if they can improve safety or reduce cost. Appendix B explicitly describes these as nonmandatory guidelines for developing certification documents (Appendix B to 1910.217).

• If you use an alternative approach, document the rationale and evidence that it provides equal or better safety.
• Ensure any alternative still achieves the certification objective: safe operation and hazard control.

Certification/validation applies to both hardware and software: hardware below the system level may be certified by test and/or analysis, and analyses can cover hardware or software items where appropriate. Appendix B indicates that certification/validation of hardware design below system level should be done by test and/or analysis and that analytical methods can be used when applicable (Appendix B to 1910.217).

• For software, use validated analytical methods, simulations, and documented tests to show behavior under expected conditions.
• Include software assumptions, limitations, and acceptance criteria in the analysis report.

Assumptions must be clearly stated and the analysis must describe how those assumptions affect conclusions and limits. Appendix B requires that assumptions be documented and their effects on conclusions be included in analysis reports (Appendix B to 1910.217).

• List each assumption, its justification, and sensitivity (how results change if assumption varies).
• Identify conditions under which the analysis would no longer be valid.

Annual recertification/revalidation verifies the installed PSDI system continues to meet safety specifications and operational requirements over time. Appendix B states the guidelines apply from design evaluation through the installation test and the annual recertification/revalidation tests, indicating the need for periodic reassessment (Appendix B to 1910.217).

• Perform documented tests and inspections annually to detect degradation or drift.
• Update records and corrective actions based on findings.

Yes—existing data can be used when available, and analyses may be used in lieu of test when justified. Appendix B allows use of existing data or analytical methods where they satisfy specification requirements, provided the analysis report documents the basis and limits (Appendix B to 1910.217).

• Ensure prior data apply to current design, environment, and expected stresses.
• Document any gaps and supplement with focused testing if needed.

Employers should address residual hazards with warnings, labeling, safety instructions, or other appropriate means. Appendix B specifies that the certification/validation process should confirm residual hazards identified by operational analysis are addressed by such measures (Appendix B to 1910.217).

• Use clear labels, operator instructions, and training to mitigate residual risks.
• Document how each residual hazard is controlled and periodically verify effectiveness.

When tests are not feasible, analytical methods and analyses—supported by existing data—may be used, but the report must fully document the basis, items analyzed, conclusions, safety factors, and limits. Appendix B allows analyses in lieu of tests when justified and requires clear documentation of assumptions and limits (Appendix B to 1910.217).

• Validate analytical models against similar tested systems where possible.
• Clearly state conditions where the analysis does not apply.

The program should ensure each supplier maintains product quality, because consistent supplier quality is necessary to maintain the safety attributes of the certified PSDI system. Appendix B says each manufacturer supplying parts, components, subsystems, and assemblies needs to maintain product quality (Appendix B to 1910.217).

• Include supplier quality agreements, incoming inspection, and traceability.
• Require suppliers to provide certification data or test results when needed.

If previous design, history and application are similar but not equal or more exacting, additional or partial certification/validation tests should focus on the changed or increased requirements. Appendix B advises concentrating testing on areas of change when similarity is not exact (Appendix B to 1910.217).

• Identify differing environmental stresses (temperature, vibration, contamination) and test accordingly.
• Document the justification for any limited testing and the results.

No—the appendix provides nonmandatory guidelines; it does not replace or alter the mandatory requirements in the main PSDI standard, 1910.217. Employers must follow mandatory rules in 1910.217, and may use Appendix B guidance to develop certification documents (Appendix B to 1910.217).

• Use the mandatory standard for regulatory compliance and the appendix for best-practice guidance and documentation structure.

If temporary energization is necessary for testing or positioning, follow a controlled sequence that protects employees—clear tools/materials, remove employees from hazardous areas, remove lockout/tagout devices as the procedure requires, energize with employee protection, then de-energize and reapply energy controls when done. While Appendix B itself covers certification activities, related safe testing procedures must be consistent with energy-control procedures such as those in 1910.147; OSHA’s interpretation on temporary energization/testing explains the required sequence in practice: clear machines, remove employees, remove LOTO devices as specified, energize with protection, and re-isolate after testing (see OSHA letter at https://www.osha.gov/laws-regs/standardinterpretations/2024-10-21).

• Plan tests in the procedure, document protections, and only energize for the limited time required.
• Ensure authorized employees follow the documented sequence and protections.

Retain documentation showing hazard analyses, FMEA results, test reports, analysis reports (including basis, assumptions, safety factors, and limits), similarity analysis data if used, installation test results, and annual recertification records. Appendix B lists required report elements and describes the certification/validation process from design through revalidation (Appendix B to 1910.217).

• Maintain records so future similarity analyses or revalidations can reference prior data.
• Include supplier certifications and maintenance/inspection logs.

If supplier parts change, the employer should require the supplier to provide new quality data or perform targeted revalidation testing focused on the changed component; Appendix B stresses that each manufacturer must maintain quality and that certification should address changed or increased requirements when similarity is incomplete (Appendix B to 1910.217).

• Require supplier change notices and updated certification documents.
• Perform tests or analyses to confirm the change does not degrade system safety.