1. Purpose of the gate
A recurring review of field failures, returns, vulnerabilities, customer integration issues and modifications, deciding whether the safety and security case still holds and whether certificates need updating.
This gate is held repeatedly through the service life. It asks whether the safety and security case still holds given what has happened in the field. Field failure rates are compared with the FMEDA, vulnerabilities and updates are reviewed, every modification since the last review is checked for its impact analysis and decision, and certificates are checked against the current configuration.
It is where slow drifts are caught: a failure mode that is rising, a manual section customers keep misreading, a set of small changes that together touch a certified characteristic.
The review covers the operation and modification phases of the IEC 61508 lifecycle and the vulnerability handling and update practices of IEC 62443-4-1. It does not replace the impact analysis each modification needs before release; it checks that those analyses were done, that their routes were right, and that their combined effect has not quietly changed what was certified. The modification route for each change reviewed is frozen here: a minor change under the existing certificate, a change with partial reassessment, or a new product version.
Field data is weighed with care. Returns are a biased sample, because many failures are never returned, and observed failure rates need enough operating experience before they mean much. Reviewers therefore look at trends and failure modes as well as rates, and ask whether a rising return pattern points to a systematic fault, which affects every unit, rather than a random one.
11 more sections for registered members.