Guide to Using BOMcheck and EN 505081 to Comply with RoHS2 Technical Documentation Requirements

Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements June 2012 Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements Copyright Copyright ENVIRON June 2012. All rights reserved. This Guide may be freely reproduced in its original form. ENVIRON thanks the International Electrotechnical Commission (IEC) for permission to reproduce Information from its International Standards IEC/PAS 62596 ed.1.0 (2009). All such extracts are copyright of IEC, Geneva, Switzerland. All rights reserved. Further information on the IEC is available from www.iec.ch. IEC has no responsibility for the placement and context in which the extracts and contents are reproduced by ENVIRON, nor is IEC in any way responsible for the other content or accuracy therein. Author Dr Aidan Turnbull Director of BOMcheck ENVIRON Box House, Box Wiltshire SN13 8AA, UK Tel: +44 1225 748420 Fax: +44 1225 748421 e-mail: aturnbull@environcorp.com ENVIRON welcomes all constructive feedback and suggestions for new content in future editions. Acknowledgements We wish to recognize the efforts of Dr Freimut Schröder, Siemens Healthcare, who had the vision and idea to create a commercial tool to manage supplier material information in a simple and cost-effective way, and invited ENVIRON to create BOMcheck to realize this vision. We would like to thank the members of the BOMcheck Industry Steering Group who provided valuable feedback during the writing of this Guide: Siemens Philips OSRAM GE Agfa Texas Instruments TE Connectivity Toshiba FUJIFILM Disclaimer This Guide comprises ENVIRON’s opinion concerning how Manufacturers can use the EN 50581:2012 European Standard and the BOMcheck system to comply with the Technical Documentation requirements contained in Directive 2011/65/EU on the Restriction of the Use of Certain Hazardous Substances in Electrical and Electronic Equipment (known as RoHS2). This opinion is based on the published legislation and guidance, and extensive research and consultation with industry and regulatory authorities but is not legally binding. A binding interpretation of Community legislation is the exclusive competence of the European Court of Justice. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements Executive Summary Directive 2011/65/EU on the Restriction of the Use of Certain Hazardous Substances in Electrical and Electronic Equipment (known as RoHS2) became European Law on 21 July 2011 and will take effect in EU Member States from 2 January 2013. RoHS2 brings a much wider range of equipment into scope but does not introduce any new substance restrictions. Another very important difference is that RoHS2 is a CE Marking Directive. RoHS2 requires Manufacturers to produce technical documentation which demonstrates that their products are RoHS compliant, in line with Module A of Decision 768/2008/EC. This is a significant difference compared to the RoHS1 Directive which does not prescribe any requirements for Manufacturers to maintain compliance documentation. RoHS2 also includes obligations for all EU Member States to perform systematic market surveillance including “appropriate checks on product compliance on an adequate scale, by means of documentary checks and, where appropriate, physical and laboratory checks on the basis of adequate samples”. In contrast, RoHS1 did not prescribe any enforcement procedures that Member States were required to implement. There are many different approaches that companies can use to draw up the required technical documentation to demonstrate that their products are RoHS compliant. Many companies already have established compliance processes and quality management systems for RoHS1 compliance and for other product regulatory requirements. Each company has to decide the best approach for drawing up the RoHS2 technical documentation which makes best use of their existing compliance processes and quality management systems. In October 2011 the European Commission issued a Mandate to CENELEC to develop a European Standard that Manufacturers can choose to follow to comply with the RoHS2 technical documentation requirements. European Standard EN 50581:2012 “Technical documentation for the evaluation of electrical and electronic products with respect to restriction of hazardous substances” was approved on 11 June 2012 by all CENELEC National Committees and, as per the Mandate, will be published in the Official Journal of the European Union as a RoHS2 Harmonised Standard. Under Article 16 (2) of the RoHS2 Directive, a Manufacturer who demonstrates compliance with EN 50581:2012 will automatically be deemed to be compliant to the RoHS2 technical documentation requirements. This Guide provides a step-by-step practical approach that Manufacturers can choose to adapt and implement in their supply chains to generate the required RoHS2 technical documentation for a product model and provide an EU Declaration of Conformity. This practical approach explains how Manufacturers can choose to use the EN 50581:2012 European Standard and the BOMcheck system to comply with the RoHS2 technical documentation requirements. How BOMcheck supports the process specified in EN 50581 for Manufacturers to comply with RoHS2 Technical Documentation requirements Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements The above diagram summarises the process specified in EN 50581 and highlights how using BOMcheck to collect the documents from suppliers (Clause 4.3.3) enables the Manufacturer to save time and effort to comply with the Clause 4.3.4 document evaluation requirements. The standardised process that suppliers follow to create materials declarations in BOMcheck ensures that these declarations already meet the Clause 4.3.4 quality and trustworthiness requirements (i.e. the Manufacturer does not need to carry out any additional document evaluation). If the Manufacturer’s assessment in Clause 4.3.2 determines that the supplier is also required to provide test reports to support their materials declarations, then the standardised process that suppliers follow to attach a test report to a declaration in BOMcheck requires the supplier to evaluate that the test report meets the Clause 4.3.4 quality and trustworthiness requirements (i.e. this reduces the time and effort for the Manufacturer to evaluate test reports). Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements Contents 1  RoHS1 and RoHS2 documentation requirements and enforcement .............................. 1 1.1  New Technical Documentation requirements for Manufacturers ....................................... 1 1.2  New Market Surveillance requirements for Member States ............................................... 3 2  RoHS2 requirements for Technical Documentation and Internal Production Control ..... 5 2.1  Technical Documentation .................................................................................................. 5 2.2  Internal Production Control ................................................................................................ 6 2.3  Conformity Marking and EU Declaration of Conformity ..................................................... 6 3  Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements ................................................................................................................ 7 3.1  Clause 4.3.1: Process that Manufacturer shall follow to create Technical Documentation 7 3.2  Clause 4.2: Content of Technical Documentation .............................................................. 8 3.2.1  Describing the product .......................................................................................................... 8 3.2.2  Relationship between the technical documents identified in Clause 4.3 and the corresponding materials, parts and/or sub-assemblies in the product .................................... 8 3.3  Clause 4.3.2: Supplier and Material Confidence Assessment ........................................... 9 3.3.1  Initial screening to identify if there are any materials, parts or sub-assemblies which do not have any risk of containing RoHS substances ....................................................................... 9 3.3.2  Assessing the probability of RoHS substances being present in materials, parts or sub-assemblies............................................................................................................................ 9 3.3.3  Assessing the trustworthiness of the supplier ...................................................................... 11 3.3.4  Assessment matrix to determine what types of documents are required for supplier parts ... 12 3.4  Clause 4.3.3: Collect the documents from suppliers ........................................................ 13 3.4.1  Using an assessment matrix to collect the required documents for a product model ............ 14 3.5  Clause 4.3.4: Evaluate the quality and trustworthiness of the documents ....................... 15 3.5.1  Evaluating the quality and trustworthiness of supplier declarations ...................................... 15 3.5.2  BOMcheck materials declarations already meet quality and trustworthiness requirements .. 16 3.5.3  Downloading BOMcheck material declarations for a list of parts and supplier codes ........... 17 3.5.4  Evaluating the quality and trustworthiness of analytical test reports..................................... 20 3.5.5  BOMcheck supplier is required to evaluate whether analytical test reports meet quality and trustworthiness requirements .............................................................................................. 20 3.6  Clause 4.3.5: Periodic review of the technical documentation ......................................... 23 4  About BOMcheck ........................................................................................................ 24 4.1  Shared industry-led web database system ...................................................................... 24 4.2  Process for using BOMcheck to gather declarations from suppliers ................................ 25 Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 4.3  BOMcheck Supplier Code provides unique identification of suppliers ............................. 27 4.4  Unique identification of supplier parts on BOMcheck ...................................................... 28 4.5  Using the mapping tool to map supplier parts to Manufacturer parts ............................... 29 4.6  Loading BOMcheck materials declaration data into the Manufacturer’s PLM system ...... 31 4.7  BOMcheck Data Security Certifications and Security Assessments ................................ 32 4.7.1  Contractual obligations and Administrator access restrictions at ENVIRON ......................... 33 4.7.2  TLS 1.2 (SSL 1.3) security encryption of all communication between BOMcheck and the company’s internet server ................................................................................................... 33 4.7.3  McAfee SECURE (Hacker Safe) Website Certification ........................................................ 34 4.7.4  BOMcheck web application security is audited by the Siemens Cyber Emergency Readiness Team .................................................................................................................................. 34 4.7.5  BOMcheck uses the same internet server arrangements as www.amazon.com .................. 35  Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 1 of 35 1 RoHS1 and RoHS2 documentation requirements and enforcement Directive 2011/65/EU1 on the Restriction of the Use of Certain Hazardous Substances in Electrical and Electronic Equipment (known as RoHS2) became European Law on 21 July 2011 and replaced the previous Directive 2002/95/EC2 (known as RoHS1). Member States are required to implement new Regulations to implement the new requirements in RoHS2, which will take effect from 2 January 2013. RoHS2 brings a much wider range of equipment into scope but does not introduce any new substance restrictions. For example, it includes timelines by which Category 8: Medical Devices and Category 9: Monitoring and Control Instruments must comply with the RoHS substance restrictions – these equipment categories were previously exempt under RoHS1. RoHS2 also introduces a new Category 11: All EEE not covered by any other category. Another very important difference is that RoHS2 is a CE Marking Directive. Article 7 of the RoHS2 Directive places new obligations on Manufacturers to draw up technical documentation, carry out internal production controls, provide an EU Declaration of Conformity and fix the CE Marking to compliant products. These new obligations are based on the “New Legislative Framework” (NLF) which consists of Decision 768/2008/EC and Regulation 765/2008/EC. Under RoHS2, Manufacturers must follow the procedures in Module A of Decision 768/2008/EC which prescribe the conformity assessment procedures that Manufacturers must implement and the technical documentation they must draw up to demonstrate that their products are RoHS compliant. This is a significant difference compared to RoHS1 which does not prescribe any requirements for Manufacturers to maintain compliance documentation. Regulation 765/2008/EC includes obligations for all EU Member States to perform systematic market surveillance including “appropriate checks on product compliance on an adequate scale, by means of documentary checks and, where appropriate, physical and laboratory checks on the basis of adequate samples”. RoHS1 does not prescribe any enforcement procedures that Member States are required to implement. In contrast, RoHS2 requires each Member State to carry out systematic market surveillance based on checking technical documentation provided by Manufacturers. 1.1 New Technical Documentation requirements for Manufacturers RoHS1 became European Law on 13 February 2003. The substance restriction requirements contained in Article 4.1 of RoHS1 (subject to further clarification under Article 5.1(a)) were quite brief: 4.1 Member States shall ensure that, from 1 July 2006, new electrical and electronic equipment put on the market does not contain lead, mercury, cadmium, hexavalent chromium, polybrominated biphenyls (PBB) or polybrominated diphenyl ethers (PBDE). National measures restricting or prohibiting the use of these substances in electrical and electronic equipment which were adopted in line with Community legislation before the adoption of this Directive may be maintained until 1 July 2006.” 5.1(a) establishing, as necessary, maximum concentration values up to which the presence of the substances referred to in Article 4(1) in specific materials and components of electrical and electronic equipment shall be tolerated On 18 August 2005 the European Commission clarified the RoHS1 substance restrictions by publishing Commission Decision 2005/618/EC. 1 ‘For the purposes of Article 5.1(a), a maximum concentration value of 0.1 % by weight in homogeneous materials for lead, mercury, hexavalent chromium, polybrominated biphenyls (PBB) and polybrominated diphenyl ethers (PBDE) and of 0.01 % by weight in homogeneous materials for cadmium shall be tolerated.’ The EU Member State Enforcement Authorities created an informal network to share information and experience on RoHS1 enforcement and in May 2006 the network published a “RoHS 1 Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2011:174:0088:0110:EN:PDF 2 Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2003:037:0019:0023:en:PDF Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 2 of 35 Enforcement Guidance Document3”. This Guidance starts by confirming that RoHS1 “does not prescribe any requirements in respect of compliance documentation that producers need to maintain or enforcement procedures that Member States need to undertake”. The document goes on to provide non-binding guidance to assist Member States with national enforcement of RoHS1 and to provide clarity to industry on how producers may demonstrate compliance with the RoHS substance restrictions. The RoHS1 Regulations in most Member States do not place any legal requirements on Manufacturers to provide technical documentation to RoHS Enforcement Agencies to demonstrate that their products are compliant to the RoHS substance restrictions. As a result, enforcement actions in most Member States are based on carrying out targeted X-ray fluorescence (XRF) analysis of higher risk products to detect infringements and then undertaking more detailed chemical analysis. The RoHS1 Regulations in the UK4 took a different approach and include the following legal requirements on UK Manufacturers: 8. Producers shall— (a) prepare technical documentation or other information showing that any electrical and electronic equipment which they have put on the market complies with the requirements of regulation 7; (b) retain that technical documentation or other information for a period of four years from the date on which they put the equipment on the market; and (c) if the Secretary of State so requests by notice in writing, submit that technical documentation or other information (or copies of it) to the Secretary of State within 28 days of the date of the notice. The UK Government Guidance Notes on the RoHS1 Regulations5 highlight that RoHS1 does not provide any prescribed methods that Manufacturers must follow to prepare technical documentation or other information to demonstrate that their products are RoHS compliant. However, the UK Government Guidance Notes do provide a helpful flow chart procedure in Annex D which a Manufacturer may choose to use as part of their RoHS1 compliance procedures. This RoHS1 compliance flow chart procedure was originally developed by Agfa and the Fraunhofer Institute and is used by many leading Manufacturers across Europe. In contrast to the RoHS1 Directive, Article 7 of the RoHS2 Directive places new legal obligations on Manufacturers to draw up technical documentation, carry out internal production controls, provide a EU Declaration of Conformity and fix the CE Marking to compliant products. RoHS2 also prescribes the conformity assessment procedures that Manufacturers must implement and the technical documentation they must draw up to demonstrate that their products are RoHS compliant. These new regulatory requirements are discussed in detail in section 2. Directives which require CE Marking are called “New Approach” Directives. RoHS1 is not a CE Marking Directive and is not based on the based on the principles in the New Approach Directives. However, many leading Manufacturers decided voluntarily to base their RoHS1 compliance programs on the conformity assessment requirements for New Approach Directives, and in particular to follow the guidance provided in the European Commission’s “Guide to the Implementation of Directives based on the New Approach and the Global Approach, 2000” , (also known as the ‘Blue Book’). Section 5.3 of the Blue Book explains that New Approach Directives require the Manufacturer to draw up technical documentation which should cover the design, manufacture and operation of the product and provide necessary information to demonstrate conformity of the product to the essential requirements of the relevant New Approach Directive. A large number of the products which are included in the scope of RoHS1 are already required to have CE Marking to comply with other EU New Approach Directives such as the Low Voltage Directive, EMC Directive, Machinery Directive, etc. Many Manufacturers, who were already required to produce technical documentation for other CE Marking Directives, decided to apply the 3 Available at http://www.bis.gov.uk/files/file30049.pdf 4 SI 2008/37 which is available at http://www.legislation.gov.uk/uksi/2008/37/pdfs/uksi_20080037_en.pdf and replaced SI 2005/2748 which is available at http://www.legislation.gov.uk/uksi/2005/2748/pdfs/uksi_20052748_en.pdf 5 Available at http://www.bis.gov.uk/assets/biscore/business-sectors/docs/r/11-526-rohs-regulations-government-guidance-notes Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 3 of 35 same conformity assessment procedures to manage RoHS1 compliance. As a result, there are a number of leading Manufacturers who already have considerable experience in developing suitable technical documentation to meet the regulatory requirements in RoHS2. We would like to thank these Manufacturers for sharing their experiences and providing valuable feedback during the writing of this Guide. 1.2 New Market Surveillance requirements for Member States The EU Member State Enforcement Authorities’ RoHS Enforcement Guidance Document, May 2006, starts by confirming that RoHS1 “does not prescribe any requirements in respect of compliance documentation that producers need to maintain or enforcement procedures that Member States need to undertake”. As a result, most Member States chose to carry out their RoHS1 enforcement activities by carrying out targeted X-ray fluorescence (XRF) analysis of higher risk products to detect infringements and then undertaking more detailed chemical analysis. For example, a recent RoHS1 enforcement action in Sweden6 in 2011 started with the purchase of products in toy stores and consumer electronic stores and was followed by selective analysis of components by XRF. If the screening analysis indicated that components contained banned substances then the components were sent to a laboratory for confirmation of the results. RoHS1 enforcement actions in the Netherlands7 also started with initial screening of products using XRF and then, for components that fail the screening, more detailed analysis by using chemical testing. The UK took a different enforcement approach for RoHS1. The UK Government Guidance Notes on the RoHS Regulations8 highlight that 41. ii. Those failing to submit compliance documentation at the request of the enforcement authority may be liable on summary conviction to a fine up to a level five on the standard scale (currently £5,000). The UK RoHS Enforcement Agency starts by sending a letter to the Manufacturer requiring them to provide technical documentation to demonstrate RoHS compliance for their products. The Agency provides a standard RoHS1 response template9 that the Manufacturer can use to complete their submission. Use of the RoHS1 response template is optional provided that the Manufacturer’s submission covers the following areas: ? Company details, supply arrangements and any certifications or registrations to RoHS compliance schemes ? Overview of regulated product ranges and any RoHS exclusions or materials exemptions claims ? Internal control processes including policies and procedures, supplier assessment methods, testing, other systems or records used to control compliance ? Overview of compliance records which are maintained as required under Section 8 of the UK RoHS Regulations 2008 ? Self-declaration statement of level and effectiveness of the Manufacturer’s compliance with the RoHS Regulations, signed by authorized individual. In contrast to the RoHS1 Directive, the RoHS2 Directive includes obligations for all EU Member States to perform systematic market surveillance. Article 18 of the RoHS2 Directive states: 18. Member States shall carry out market surveillance in accordance with Articles 15 to 29 of Regulation 765/2008. Articles 15 to 18 of Regulation 765/2008 require each Member State to: ? appoint a market surveillance authority with necessary powers, resources and responsibilities 6 Published at http://www.kemi.se/templates/News____6548.aspx 7 Details are published in Dutch at http://www.vrominspectie.nl/ 8 Available at http://www.bis.gov.uk/assets/biscore/business-sectors/docs/r/11-526-rohs-regulations-government-guidance-notes 9 Available at https://www.rohs.bis.gov.uk/onlineresponse/ Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 4 of 35 ? inform the European Commission and the public about the roles and responsibilities of their market surveillance authority ? establish communication and coordination mechanisms with other Member States market surveillance authorities ? review and assess their market surveillance activities at least every four years and communicate the results to all other Member States, the European Commission and the public Article 19 and Article 21 of Regulation 765/2008 require each Member State to instruct their market surveillance authority to carry out specific market surveillance and enforcement measures including: 19.1 Market surveillance authorities shall perform appropriate checks on the characteristics of products on an adequate scale, by means of documentary checks and, where appropriate, physical and laboratory checks on the basis of adequate samples. When doing so they shall take account of established principles of risk assessment, complaints and other information. 19.3 Where the market surveillance authorities of one Member State decide to withdraw a product manufactured in another Member State, they shall inform the economic operator concerned at the address indicated on the product in question or in the documentation accompanying that product. 21.1 Member States shall ensure that any measure taken to prohibit or restrict the product's being made available on the market, to withdraw it from the market or to recall it, is proportionate and states the exact grounds on which it is based. 21.2 Such measures shall be communicated without delay to the relevant economic operator, which shall at the same time be informed of the remedies available under the law of the Member State concerned and of the time limits to which such remedies are subject. 21.3 Prior to the adoption of a measure referred to in 21.1, the economic operator concerned shall be given the opportunity to be heard within an appropriate period of not less than 10 days. 21.4 Any measure referred to in 21.1 shall be promptly withdrawn or amended upon the economic operator's demonstrating that he has taken effective action. Article 27 and Article 28 of Regulation 765/2008 also place obligations on border control authorities to carry out specific market surveillance measures including: 27.1 The authorities of the Member States in charge of the control of products entering the Community market shall have the powers and resources necessary for the proper performance of their tasks. They shall carry out appropriate checks on the characteristics of products on an adequate scale, in accordance with the principles set out in Article 19(1), before those products are released for free circulation. 27.2 Where in a Member State more than one authority is responsible for market surveillance or external border controls, those authorities shall cooperate with each other, by sharing information relevant to their functions and otherwise as appropriate. 27.3 The authorities in charge of external border controls shall suspend release of a product for free circulation on the Community market when any of the following findings are made in the course of the checks referred to in paragraph 1: (b) the product is not accompanied by the written or electronic documentation required by RoHS2 Directive or is not CE marked in accordance with the RoHS2 Directive (c) the CE marking has been affixed to the product in a false or misleading manner. The authorities in charge of external border controls shall immediately notify the market surveillance authorities of any such suspension. 28.1 A product the release of which has been suspended by the authorities in charge of external border controls pursuant to Article 27 shall be released if, within three working days of the suspension of release, those authorities have not been notified of any action taken by the market surveillance authorities, and provided that all the other requirements and formalities pertaining to such release have been fulfilled. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 5 of 35 2 RoHS2 requirements for Technical Documentation and Internal Production Control Article 7(b) of the RoHS2 Directive states that the Manufacturer shall draw up the required technical documentation and carry out the internal production control procedure in line with Module A of Annex II of Decision 768/2008/EC or have the internal production control procedure carried out on their behalf. A Manufacturer is defined in Article 3(6) as any natural or legal person who manufactures EEE, or who has an EEE designed or manufactured, and markets it under his name or trademark. Module A of Annex II of Decision 768/2008/EC states that internal production control is the conformity assessment procedure whereby the Manufacturer fulfils the obligations for technical documentation, manufacturing, conformity marking and EU Declaration of Conformity, and ensures and declares on his sole responsibility that the EEE complies with the RoHS substance restrictions. There are many different approaches that companies can use to draw up the required technical documentation to demonstrate that their products are RoHS compliant. Many companies already have established compliance processes and quality management systems for RoHS1 compliance and for other product regulatory requirements. Each company has to decide the best approach for drawing up the RoHS2 technical documentation which makes best use of their existing compliance processes and quality management systems. In October 2011 the European Commission issued a Mandate to develop a European Standard that Manufacturers can choose to follow to comply with the RoHS2 technical documentation requirements. European Standard EN 50581:2012 “Technical documentation for the evaluation of electrical and electronic products with respect to restriction of hazardous substances” was approved on 11 June 2012 by all CENELEC National Committees and, as per the Mandate, will be published in the Official Journal of the European Union as a RoHS2 Harmonised Standard. Under Article 16 (2) of the RoHS2 Directive, a Manufacturer who demonstrates compliance with EN 50581:2012 will automatically be deemed to be compliant to the RoHS2 technical documentation requirements. This Guide provides a step-by-step practical approach that Manufacturers can choose to adapt and implement in their supply chains to generate the required RoHS2 technical documentation for a product model and provide an EU Declaration of Conformity. This practical approach explains how Manufacturers can choose to use the EN 50581:2012 European Standard and the BOMcheck system to comply with the RoHS2 technical documentation requirements. 2.1 Technical Documentation Module A of Annex II of Decision 768/2008/EC requires the Manufacturer to establish technical documentation which shall make it possible to assess the product’s conformity to the RoHS substance restrictions, and shall include an adequate analysis and assessment of the risks. The technical documentation shall specify the RoHS substance restrictions and cover the design and manufacture of the product. Module A specifies that the technical documentation shall contain, wherever applicable, ? A general description of the product ? Conceptual design and manufacturing drawings and schemes of components, sub-assemblies, circuits etc ? Descriptions and explanations necessary for the understanding of those drawings and schemes ? A list of the harmonised standards and/or other relevant technical specifications the references of which have been published in the Official Journal of the European Union, applied in full or in part, and descriptions of the solutions adopted to comply with aspects of the RoHS substance restrictions which are not covered by these standards or where the standards have only been implemented in part. ? Results of design calculations made, examinations carried out, etc, and ? Test reports Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 6 of 35 2.2 Internal Production Control Article 7(e) of the RoHS2 Directive 2011/65/EU requires the Manufacturer to ensure that procedures are in place for series production to remain in conformity. The Manufacturer shall take into account changes in product design and changes in the harmonised standards or in technical specifications which the Manufacture has applied in full or in part. In addition, Module A of Annex II of Decision 768/2008/EC states that the Manufacturer shall take all measures necessary so that the manufacturing process and its monitoring ensure compliance of the manufactured products with the technical documentation and with the requirements of the RoHS2 Directive. 2.3 Conformity Marking and EU Declaration of Conformity Module A of Annex II of Decision 768/2008/EC states that the Manufacturer shall draw up a written EU Declaration of Conformity for each product model and keep this together with the technical documentation for 10 years after the product has been placed on the market. The EU Declaration of Conformity shall identify the product for which it has been drawn up. Article 13 (2) states that it shall be translated into the language or languages required by the Member State on the market of which the product is placed or made available. Article 13(2) of the RoHS2 Directive states that the EU Declaration of Conformity shall contain the following elements and shall be updated 1. Model number or other means of uniquely identifying the product 2. Name and address of the manufacturer or his authorised representative 3. Statement that the EU Declaration of Conformity is issued under the sole responsibility of the manufacturer 4. Object of the declaration (identification of the product allowing traceability. It may include a photograph, where appropriate) 5. Statement that the object of the declaration described above is in conformity with the RoHS substance restrictions 6. Where applicable, references to the relevant harmonised standards used or references to the technical specifications in relation to which conformity is declared 7. Signature on behalf of the producer (name, function) and date of issue Article 7(g) of the RoHS2 Directive requires the Manufacturer to ensure that the product bears a type, batch or serial number or other element allowing its identification, or, where the size or nature of the product does not allow it, that the required information is provided on the packaging or in a document accompanying the product. Article 7(c) of the RoHS2 Directive 2011/65/EU states that where the Manufacturer can demonstrate that the required technical documentation has been drawn up and the internal production controls in line with Module A of Annex II of Decision 768/2008/EC have been implemented, then the Manufacturer can affix the CE marking to the finished product. If the Manufacturer has already affixed the CE marking to the product to claim conformity to another Directive (for example the Medical Devices Directive) and the Manufacturer continues to supply the product after the date that the product is required to comply with the RoHS2 requirements, under Article 16 (1) of RoHS2 this CE marking now means that the Manufacturer is also claiming that their product conforms to the RoHS substance restrictions. If a single EU Declaration of Conformity is developed to cover several Directives, then the EU Declaration of Conformity should state that compliance to the RoHS2 Directive requirements is the sole responsibility of the Manufacturer. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 7 of 35 3 Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements This Guide explains how Manufacturers can choose to use the EN 50581:2012 European Standard and the BOMcheck system to comply with the RoHS2 technical documentation requirements. The Guide explains the clause requirements in EN 50581 and provides ENVIRON’s recommended processes and procedures that the Manufacturer can adapt and implement to comply with these clause requirements. 3.1 Clause 4.3.1: Process that Manufacturer shall follow to create Technical Documentation All of the specific requirements that the Manufacturer must comply with (i.e. the ‘shalls’) are contained in Clause 4.2 and Clause 4.3 of EN 505081. Clause 4.2 of EN 50581 specifies the content that shall be included in the technical documentation. Clause 4.3.1 specifies the process that the Manufacturer shall follow to create and maintain the technical documentation, including: ? Supplier and material confidence assessment (Clause 4.3.2) ? Collect the technical documents (Clause 4.3.3) ? Evaluate the quality and trustworthiness of the technical documents (Clause 4.3.4) ? Periodic review of technical documentation (Clause 4.3.5) Figure 1 summarises these EN 50581 Clause requirements and highlights how using BOMcheck to collect the documents from suppliers (Clause 4.3.3) enables the Manufacturer to save time and effort to comply with the Clause 4.3.4 document evaluation requirements. The standardised process that suppliers follow to create materials declarations in BOMcheck ensures that these declarations already meet the Clause 4.3.4 quality and trustworthiness requirements (i.e. the Manufacturer does not need to carry out any additional document evaluation). If the Manufacturer’s assessment in Clause 4.3.2 determines that the supplier is also required to provide test reports to support their materials declarations, then the standardised process that suppliers follow to attach a test report to a declaration in BOMcheck requires the supplier to evaluate that the test report meets the Clause 4.3.4 quality and trustworthiness requirements (i.e. this reduces the time and effort for the Manufacturer to evaluate test reports). Figure 1. How BOMcheck supports the process specified in EN 50581 for Manufacturers to comply with RoHS2 Technical Documentation requirements Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 8 of 35 3.2 Clause 4.2: Content of Technical Documentation Clause 4.2 states that the Technical Documentation shall contain at least the following elements: ? A general description of the product ? Technical documents for materials, parts and/or sub-assemblies (see Clause 4.3) ? Information showing the relationship between the technical documents identified in Clause 4.3 and the corresponding materials, parts and/or sub-assemblies in the product ? List of harmonised standards and/or other technical specifications that have been used 3.2.1 Describing the product ENVIRON recommends that the product description should start by identifying the product model so that the technical documentation can be linked to the EU Declaration of Conformity for the product. Article 7(g) of the RoHS2 Directive 2011/65/EU requires the Manufacturer to ensure that the product bears a type, batch or serial number or other element allowing its identification, and Article 13(2) of the RoHS2 Directive states that the EU Declaration of Conformity shall contain the following elements: ? Model number or other means of uniquely identifying the product ? Object of the declaration (identification of the product allowing traceability. It may include a photograph, where appropriate) Manufacturers who carry out series production of the same product model will most likely choose to prepare the technical documentation and EU Declaration of Conformity at the product model number level. Including photographs of the product would be good practice. The product description should also include an assessment of the product against the 11 product categories contained in Annex I of the RoHS2 Directive to determine the deadlines for legal compliance. The Manufacturer may decide to take action ahead of these legal deadlines, for example to demonstrate early product compliance to their customers. The technical documentation should also identify whether the Manufacturer is claiming any of the exemptions contained in Annex III and Annex IV of the RoHS2 Directive 2011/65/EU for any parts or materials in the product, and the timescales for the expiry of these exemptions. 3.2.2 Relationship between the technical documents identified in Clause 4.3 and the corresponding materials, parts and/or sub-assemblies in the product To establish this relationship, the Manufacturer’s technical documentation must enable traceability of all materials, parts and sub-assemblies which are contained in the product model, by unique identification of: ? the supplier who is supplying the part, and ? the part number that the supplier uses to identify the part to the Manufacturer. ENVIRON recommends that the Manufacturer should generate the Bill of Materials (BOM) for the product model to produce a list of part numbers for all of the materials, parts and sub-assemblies which are contained in the finished product. The Manufacturer should then identify and assign the supplier(s) for each of these part numbers. This parts list may use the supplier’s part numbers, or it may use the Manufacturers own part coding system, provided that the relationship between the supplier’s part number and the Manufacturer’s part number is known. For example, if the Manufacturer has identified several alternative suppliers whose parts meet the specification for a Manufacturer part number, then these alternate suppliers and their supplier part numbers should be identified in the technical documentation. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 9 of 35 3.3 Clause 4.3.2: Supplier and Material Confidence Assessment Clause 4.3.2 states that the types of technical documents that are required for materials, parts and/or sub-assemblies shall be based on the Manufacturer’s assessment of ? the probability of restricted substances being present in materials, parts or sub-assemblies, and ? the trustworthiness of the supplier Materials that are added during the production process (such as solder, paint, adhesives) shall also be considered as part of the assessment. EN 50581 also notes that the Manufacturer may apply technical judgement when carrying out the materials assessment, as some substances are unlikely to be contained in certain materials (e.g. organic substances in metals). 3.3.1 Initial screening to identify if there are any materials, parts or sub-assemblies which do not have any risk of containing RoHS substances ENVIRON recommends that the Manufacturer should carry out an initial screening of the parts list to identify if there are any materials, parts or sub-assemblies in the product which do not have any risk of containing RoHS substances above the maximum concentration values. The Manufacturer should apply their own technical judgement of whether RoHS substances are not found in certain materials, parts and sub-assemblies. For example, an un-coated stainless steel screw does not contain any RoHS substances above the maximum concentration values. Similarly, a wooden case (e.g. for a hi-fi speaker) or a fabric filter (e.g. for a vacuum cleaner) will also not contain any RoHS substances above the maximum concentration values. The Manufacturer may decide to include their technical assessment of these parts in the product technical documentation and to not ask suppliers to provide materials declarations for such parts. 3.3.2 Assessing the probability of RoHS substances being present in materials, parts or sub-assemblies The International Electrotechnical Commission (www.iec.ch) is a leading global organisation that prepares and publishes International Standards for all electrical, electronic and related technologies. In 2009, the IEC published a Publicly Available Specification IEC/PAS 62596:2009 “Electrotechnical products – Determination of restricted substances – Sampling procedure – Guidelines”10. Table B1 in Annex 1 of IEC/PAS 62596:2009 provides an overview of the typical materials and components in electrotechnical products and an assessment the probability that they may contain any of the six RoHS restricted substances. IEC/PAS 62596:2009 notes that this table is to be used as guidance to assist in selecting components/materials for testing that have a high probability of containing a RoHS restricted substance. IEC/PAS 62596:2009 also notes that not every part listed in this table requires testing and not every “high” probability substance is intended to be tested. IEC/PAS 62596:2009 notes that the table provides a first indication of the relevant areas for testing. However as the electrotechnical industry covers many materials and components, and new innovations are made daily this matrix does not intend to be comprehensive. Also, the table may not be up-to-date with the current list of RoHS exemptions. ENVIRON recommends that the Manufacturer should use Table B1 in Annex 1 of IEC/PAS 62596:2009 as guidance to identify components/materials that have a high probability of containing a RoHS restricted substance. For example, a Manufacturer may decide to regard a material, part or sub-assembly as containing high risk materials if the table indicates that there is a high probability of it containing two or more RoHS substances. 10 IEC/PAS 62596 ed.1.0. Copyright © 2009 IEC Geneva, Switzerland.www.iec.ch Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 10 of 35 IEC/PAS 62596:2009 Table B.1 - Probability of presence of restricted substances in materials and components used in electrotechnical products L = Low probability, M = Medium probability, H = High probability, N/A = Not applicable Components/ materials Restricted substances Remarks Hg Cd Pb Cr (VI) PBBs PBDEs Mechanical parts Framework – metal L M H H N/A N/A Unpainted Housing – plastic L L L L L M Power cord/cable L H H L L M Thick film sensor L H M L L M Heat sink L L L L N/A N/A Screw, washer, fastener – metal L M M H N/A N/A Some are coated e.g. black and yellow chromate Glass – CRT, lamp glass-to-metal seal L M H L N/A N/A Pb in glass could be exempted Phosphorescent coating (e.g. CRT) L H L L N/A N/A LCD panel/screen H L H H L L Plasma panel/screen H L H H L L Pb in glass could be exempted Lamps, back light H L H M N/A N/A Hg used in backlights could be exempted Magnetic head L L H M N/A N/A Printed wiring board (PWB) PWB substrate/laminate L L L L L N/A Connector M L H L L H Capacitor – electrolytic L M H L L M Capacitor – chip-type L M M L L M Resistor – IMT-type L M H L L L Resistor – chip-type L H M L L L Diode L M M L L L Fuse L M H L L L Solder (process and hand soldering) L M H L N/A N/A Glue (red and white) L L M L M M Used to fix components Component termination coating L H H L N/A N/A Component mouldings L L L L L H Integrated circuit (IC) and BGAs L L H L L L Relay – mercury H L M L L L Relay – electromagnetic L H M L L L Switch – mercury H L M L L L Switch – mechanical M H M L L L Thermostats H M M L L L Flame sensors H M M L L L Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 11 of 35 Thermal imaging semiconductors H M M L L L Transformer (LOT) L M H L L M Accessories Remote controls L H H L L L External cable (e.g. Scart, USB, cinch) L H H L L L External power supply L H H L L M Materials Paint, ink and similar coating L H H M L L Adhesive M M M Polyurethane – high gloss H M M L L M Polyvinyl chloride (PVC) L H H M L M Styrene, polystyrene (HI-PS), ABS, polyethylene (PE), polyester L M M L L H Rubber L M M L L M Plastics – other L M M L L M Colorants (all plastics) red, orange, yellow, pink, green M H H H N/A N/A Metal L M H H N/A N/A Steel – other L L L H N/A N/A Steel – free-machining L L H L N/A N/A Copper alloy L H H L N/A N/A Pb in metal could be exempt Aluminium alloy L L H L N/A N/A Pb in metal could be exempt Metallic chromium plating L L L L N/A N/A Zinc coating L H H H N/A N/A Other metallic coatings L H L H N/A N/A Glass – other L M H M N/A N/A Pb could be exempt Ceramics L M H L N/A N/A Pb could be exempt 3.3.3 Assessing the trustworthiness of the supplier When a Manufacturer accepts a RoHS materials declaration from a supplier, the Manufacturer should consider their relationship with the supplier and take into account the supplier’s reputation and the Manufacturer’s level of confidence in the supplier. Manufacturers should look to establish a level of trust with their suppliers. Some suppliers will readily provide documentation showing RoHS compliance of the materials, parts and sub-assemblies that they supply, but others may have lesser levels of awareness and can not produce the necessary information. In extreme cases, forged documents stating compliance are given. Most manufacturers will already have a defined process of supplier qualification as part of their quality management system. This system should be extended to capture supplier qualification information critical to RoHS. This information could be based on audit, past experience, etc. The aim should be to determine if a supplier understands the RoHS substance restrictions and has effective management systems in place to ensure RoHS conformity. The supplier’s conformity management system should describe the quality control processes and procedures that are applied to ensure that series production remains in conformity, including how the supplier assesses their own suppliers. The conformity management system may also describe any Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 12 of 35 additional inspections or examinations which the supplier carries out (e.g. XRF screening of incoming materials, parts and sub-assemblies, audits of the supplier’s own suppliers, etc). The complexity of the supplier’s conformity management systems will depend on the size and nature of the supplier’s manufacturing operations. For example, a supplier who manufactures materials, parts or sub-assemblies at one facility where all of the other products manufactured and/or repaired at this facility are also required to be RoHS compliant. In this case, the conformity risk will reside in materials, parts or sub-assemblies coming from the supplier’s own supply chain. On the other hand, if the supplier’s manufacturing facility also manufactures and/or repairs non-RoHS compliant products then the supplier’s conformity management system will need to address conformity risks arising from possible cross-contamination between RoHS compliant and non-RoHS compliant process lines. In this case, the supplier’s conformity management system should include procedures for: ? Inventory management to ensure segregation of RoHS compliant and non-RoHS compliant materials, parts and sub-assemblies ? In-process quality control where parts mixing and/or cross contamination are possible (for example, segregation of lead and lead-free soldering process lines) ? Final product checking prior to shipment to ensure no parts mixing has occurred during manufacture If the supplier sub-contracts some of their manufacturing process (e.g. painting and coating processes) then the supplier’s conformity management system should also take account of the quality control systems which are applied at the sub-contractor’s facility. A complex sub-assembly or component may involve a number of manufacturing processes which take place at several different facilities and locations. Ensuring that series production remains in conformity requires adequate quality control systems to be in place at all of these facilities. After using a certain supplier over a sustained period of time, the Manufacturer’s knowledge and trust in the supplier’s conformity management system may increase. Where there may be less confidence in a supplier then an in-person audit (by the Manufacturer or an independent auditor) can be a more cost-effective alternative to the Manufacturer carrying out independent testing. An inspection of the supplier’s manufacturing processes and conformity management system can not only aid understanding from both Manufacturer and supplier, but can also build a level of trust. Alternatively, a supplier could provide evidence that they have effective RoHS compliance systems in place by gaining accredited certification to the IECQ Standard QC 080000: Electrical and Electronic Components and Products Hazardous Substance Process Management System Requirements. ENVIRON recommends that the Manufacturer should extend their existing supplier qualification and use the following criteria to categorise the supplier’s trustworthiness for RoHS conformity: ? Type A: Supplier has a very good understanding of RoHS, comprehensive and effective systems in place to ensure RoHS compliance, and requires selective analysis of high risk components /materials that it purchases from its suppliers ? Type B: Supplier has a good understanding of RoHS and has a system for ensuring RoHS compliance but may be lacking in some respect, e.g. does not require selective analysis of high risk components /materials that it purchases from its suppliers ? Type C: Supplier does not understand RoHS requirements or does not have systems to ensure compliance and does not check declarations from its suppliers for incoming components/materials 3.3.4 Assessment matrix to determine what types of documents are required for supplier parts ENVIRON recommends that the Manufacturer should establish an assessment matrix which combines the materials confidence assessment and the supplier confidence assessment to determine what types of documents are required for supplier parts. One example of an assessment matrix is provided in Figure 2. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 13 of 35 Figure 2: Example of an assessment matrix to determine what types of documents are required for supplier parts A Manufacturer who chooses to adopt the example assessment matrix in Figure 2 would require the supplier to provide the following documents for each material, part and/or sub-assembly: ? Type A Supplier: Supplier declaration and/or contractual agreement, or materials declaration is required for each material, part and/or sub-assembly. ? Type B Supplier: Materials declaration is required for each material, part and/or sub-assembly which has a medium or low probability of containing RoHS substances. Materials declaration and recent analytical test report are required for each material, part and/or sub-assembly that has a high probability of containing RoHS substances. ? Type C Supplier: Materials declaration is required for each material, part and/or sub-assembly which has a low probability of containing RoHS substances. Materials declaration and recent analytical test report are required for each material, part and/or sub-assembly that has a medium or high probability of containing RoHS substances. It is up to the Manufacturer to decide what criteria to apply when combining the materials confidence assessment and the supplier confidence assessment to determine what types of documents they will require from their suppliers. For example, some Manufacturers may decide that they will only require recent analytical test reports from Type C suppliers who supply materials, parts and/or sub-assemblies which have a high probability of containing RoHS substances. Other Manufacturers have decided to base their determination solely on their supplier confidence assessment – in other words, the Manufacturer has decided to treat all materials, parts and sub-assemblies as having a high probability of containing RoHS substances. 3.4 Clause 4.3.3: Collect the documents from suppliers Clause 4.3.3 states that as a result of the Manufacturer’s assessment, the following documents on materials, parts and/or sub-assemblies shall be collected. a) Supplier declarations confirming that the restricted substance content of the material, part, or sub-assembly is within the permitted levels and identifying any exemptions that have been applied. The declarations shall cover a specific material, part and/or sub-assembly, or a specific range of materials, parts and/or sub-assemblies. If the Manufacturer has issued a contractual agreement Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 14 of 35 to the supplier which includes the Manufacturer’s specification for the maximum content of restricted substances in a material, part or sub-assembly, then the supplier may provide the signed contract instead of providing a supplier declaration. and/or b) Material declarations providing information on specific substance content and identifying any exemptions that have been applied. and/or c) Analytical test results using the methods described or referenced in EN 62321. 3.4.1 Using an assessment matrix to collect the required documents for a product model In section 3.2.2 ENVIRON recommends that the Manufacturer should: ? generate the Bill of Materials (BOM) for the product model to produce a list of part numbers for all of the materials, parts and sub-assemblies which are contained in the finished product, and ? identify and assign the supplier(s) for each of these part numbers. To meet Clause 4.3.3 requirements, the Manufacturer should use their assessment matrix to assess this list of part numbers and suppliers in order to produce a table which summarises the types of documents which the suppliers are required to provide for these parts. ENVIRON recommends that the Manufacturer should include this table in the RoHS2 Technical Documentation for the product model to demonstrate how the results of the Manufacturer’s assessment are used to collect the required types of documents for the materials, parts and/or sub-assemblies in the product. Figure 3 provides an example table. Figure 3. Example table showing how the Manufacturer uses their assessment to collect the required types of documents for the materials, parts and/or sub-assemblies in a product model Probability that RoHS substances are present Supplier trustworthiness Type of documents which are required Part number Probability that RoHS substances may be present Supplier code Supplier qualification type (A, B or C) Materials declaration required? Analytical test report required? S1-Vac-Dial L 767767767 A Y N S2-Lever L 767767767 A Y N S3-Vac-Ind L 767767767 A Y N Dial-CPC1 L 898898898 B Y N Lever-CPC1 L 898898898 B Y N Reservoir-CPC1 L 898898898 B Y N CW-P35 H 113113113 B Y Y CAP-20MF M 113113113 B Y N RES-15OH M 113113113 B Y N Semi-M9 M 656656656 C Y Y Semi-R15 L 656565656 C Y N The Manufacturer can use this table to communicate their requirements to suppliers to make materials declarations in BOMcheck and, if required, to attach analytical test reports to their declarations. The Manufacturer should send the list of part numbers that they buy from the supplier and ask the supplier to confirm that the part numbers are included correctly in the list. The supplier should use exactly the same part numbers when they make their materials declaration(s) (or map the Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 15 of 35 customer’s part number to the supplier part numbers that the supplier has already made declarations for in BOMcheck) so that the Manufacturer can find the part numbers easily on BOMcheck. The Manufacturer can then use the list of part numbers and supplier codes to download PDF reports from BOMcheck which contain: ? materials declarations for the list of supplier parts in the product model (see section 3.4.3) ? analytical test reports that the Manufacturer’s assessment requires certain suppliers to provide for certain materials, parts and/or sub-assemblies in the product model (see section 3.4.5). 3.5 Clause 4.3.4: Evaluate the quality and trustworthiness of the documents Clause 4.3.4 states that the manufacturer shall establish procedures that shall be used to evaluate the documents provided by the supplier in order to determine their quality and trustworthiness. The manufacturer shall evaluate, in accordance with these procedures, the source and content of each document received in order to determine whether or not the material, part, or sub-assembly meets the specified substance restrictions. This evaluation will enable the manufacturer to decide whether the documents provide sufficient evidence of compliance to justify their inclusion in the technical documentation. If a particular document is: – considered to be of sufficient quality and trustworthiness, then it shall be included in the technical documentation; – not considered to be of sufficient quality or trustworthiness, then the manufacturer shall determine what further actions are necessary – possible actions include requesting additional information from the supplier or undertaking his own substance analysis. The UK RoHS Enforcement Authority has published a RoHS Guidance Producer Support Booklet11 which provides valuable advice on how to assess supplier material declarations and analytical test reports. 3.5.1 Evaluating the quality and trustworthiness of supplier declarations Clause 4.3.4 requires the Manufacturer to establish procedures that shall be used to evaluate the documents provided by the supplier in order to determine their quality and trustworthiness. The Manufacturer should read the supplier’s declaration carefully to assess what the supplier is declaring and whether this declaration is of sufficient quality and trustworthiness to be included in the technical documentation for the product model. If a particular document is not considered to be of sufficient quality or trustworthiness, then the manufacturer shall determine what further actions are necessary – possible actions include requesting additional information from the supplier or undertaking his own substance analysis. Clause 4.3.4 also requires the manufacturer to evaluate, in accordance with their procedures, the source and content of each document received. Did the Manufacturer receive the document directly from the supplier or via a third party broker? If the Manufacturer received the document from a third party broker, how does the Manufacturer ensure that they receive updates from the broker when the supplier produces updated compliance documentation for their parts? As discussed in Section 3.2.2, the Manufacturer’s technical documentation must enable traceability of all materials, parts and sub-assemblies which are contained in the product model, by unique identification of: ? the supplier who is supplying the part, and ? the part number that the supplier uses to identify the part to the Manufacturer. 11 http://www.bis.gov.uk/assets/bispartners/nmo/docs/rohs/support-literature/producer-support-booklet.pdf Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 16 of 35 To claim compliance to EN 50581, the Manufacturer should insist that the content of the supplier’s material declaration must: ? contain an unambiguous statement that all six RoHS restricted substances are not present above the maximum concentration values, or if an exemption is claimed the statement should specify the particular exemption(s) ? enable identification of the part number for the list of supplier materials, parts or sub-assemblies which are contained in the Manufacturer’s product ? be signed by an executive officer at the supplier who has authority to sign on behalf of the company Many suppliers provide declarations which are generic and do not identity the specific material, part and/or sub-assembly, or even a specific range of materials, parts and/or sub-assemblies. These supplier declarations do not meet the requirements in Clause 4.3.3 and can not be included in the technical documentation if the Manufacturer wants to claim compliance to EN 50581. The RoHS Guidance Producer Support booklet notes that the UK RoHS Enforcement Authority often sees declarations which do not confirm that the restricted substance content of the material, part, or sub-assembly is within the permitted levels. The supplier declaration may be stating that there was ‘no intentional use’ of the RoHS substances, that the parts used in the assembly were screened for RoHS compliance or that the declaration is limited to the non-use of lead in solder. These supplier declarations also do not meet the requirements in Clause 4.3.3 and also can not be included in the technical documentation if the Manufacturer wants to claim compliance to EN 50581. The UK RoHS Enforcement Authority also sees many supplier declarations that contain disclaimers such as ‘made best efforts’ or ‘to the best of senior management’s knowledge’. These disclaimers reduce the trustworthiness of the supplier’s declaration. The Manufacturer should evaluate the source and content of any supplier declarations that contain such disclaimers, to decide whether the documents provide sufficient evidence of compliance to justify their inclusion in the technical documentation. 3.5.2 BOMcheck materials declarations already meet quality and trustworthiness requirements All suppliers follow the same high quality, standardised processes to create their materials declarations in BOMcheck. These standardised processes ensure that the supplier materials declarations in BOMcheck already meet all of the requirements in Clause 4.3.4 for quality and trustworthiness - the Manufacturer does not need to carry out any additional document evaluation of these materials declarations. In particular, Manufacturers who use BOMcheck to gather material declarations from suppliers do not need to carefully assess what the supplier is declaring and whether this declaration is of sufficient quality and trustworthiness to be included in the technical documentation for the product model. Instead, the Manufacturer can choose to comply with EN 50581 by downloading the supplier material declarations from BOMcheck and including them directly into their technical documentation. This saves a significant amount of time and effort for the Manufacturer. Material declarations that a supplier creates on BOMcheck: ? Uniquely identify the supplier who is supplying the part, and the part number that the supplier uses to identify the part to the Manufacturer (see section 4.3). ? Provide the compliance status of the part for each individual RoHS substance restriction o If the supplier claims exemption(s) for any particular substance restriction then the supplier must select the specific exemption(s) from drop-down lists on BOMcheck. The specific exemptions are reported in the materials declaration. o If the supplier indicates that the part is non-compliant to a particular RoHS substance restriction then the supplier must provide the worst-case concentration of the RoHS substance in any homogenous material in the part ? Do not include any disclaimers. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 17 of 35 ? Are signed by an Authorised Individual at the supplier o The supplier registration process on BOMcheck creates an electronic signature for the supplier’s appointed Authorised Individual which complies with US CFR Part 11 Electronic Signature Regulations o When a Manufacturer downloads a Material Declaration from BOMcheck this is equivalent to the Manufacturer receiving a paper-based material declaration with a handwritten signature from the supplier’ BOMcheck includes built-in electronic signature arrangements which comply with US FDA Regulations. Title 21 CFR Part 11 of the US Code of Federal Regulations became effective on 20 August 1997 and defines criteria under which the FDA accept: “electronic records and electronic signatures as trustworthy, reliable and equivalent to paper records and handwritten signatures executed on paper” BOMcheck includes two types of controls12 to ensure that a supplier's electronic records stored on the www.BOMcheck.net database comply with Title 21 CFR Part 11 requirements: ? Administrative and procedural controls which the supplier must implement when they complete the online registration form at www.bomcheck.net/account/register to join BOMcheck, including compliance to the BOMcheck Member Rules for Suppliers published at www.bomcheck.net/suppliers/member-rules. Failure to comply with these Member Rules can result in termination of the Membership by ENVIRON. ? Technical software controls which are provided by the www.BOMcheck.net database system. A supplier who wishes to join BOMcheck must appoint an Authorised Individual with authority to generate substance declarations on the database. The Authorised Individual must complete the online application form and send a signed copy to ENVIRON. The application form requires the Authorised Individual to sign the following statements: “I confirm that I have been appointed with the authority to access the BOMcheck database and upload data on behalf of the company.” “I confirm that I have read, understood and agree to abide by all of the member rules.” “I confirm that I will not divulge my password to any other person or allow any other person to access the Database.” “Pursuant to Section 11.100 of Title 21 of the Code of Federal Regulations. I confirm that the company intends that all electronic signatures that I provide are the legally binding equivalent of traditional handwritten signatures.” 3.5.3 Downloading BOMcheck material declarations for a list of parts and supplier codes BOMcheck includes the ‘Check RoHS data’ tool which the Manufacturer can use to look up the materials declarations for a list of parts, Figure 4. The parts list must contain the part number in column 1 and can contain the BOMcheck Supplier Code in column 2. BOMcheck stores the part numbers exactly as they are provided by the supplier, including any dots, dashes, hyphens, slashes etc that the supplier has included. The Manufacturer can search the BOMcheck database by looking for an exact match between their parts list and the part numbers declared in BOMcheck, or by looking for a similar match. If the Manufacturer looks for a similar match, then BOMcheck searches the database by looking for a match when all dots, dashes, hyphens, slashes etc are removed from the part number in the Manufacturer’s parts list and from 12 Further details about these two types of controls and how BOMcheck maintains to Title 21 CFR Part 11 requirements are available at www.bomcheck.net/suppliers/electronic-signatures Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 18 of 35 the part numbers declared in BOMcheck. BOMcheck always reports the part numbers exactly as they are provided by the supplier. Figure 4. Using the ‘Check RoHS data’ tool in a Manufacturers Account to view the materials declarations for a list of supplier parts Figure 5 provides an example of RoHS materials declarations for a list of supplier parts that the suppliers have declared on BOMcheck. The Manufacturer can click on a part number to view further details about the compliance status of any part and can access any evidence documents that a supplier has attached to their declaration for this part (e.g. analytical test reports). The Manufacturer can choose to download the suppliers materials declarations as a PDF report, Figure 6, or as IPC 1752A XML files or as an Excel file (CSV format). Figure 5. BOMcheck displays RoHS materials declarations for a list of supplier parts Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 19 of 35 The PDF report provided by BOMcheck, Figure 6, contains the supplier materials declarations for the list of supplier parts in the product model. The Manufacturer can choose to download this PDF report and include it in their technical documentation to demonstrate that they have complied with EN 50581 requirements to: ? collect the material declarations that the Manufacturer’s assessment requires suppliers to provide for materials, parts and/or sub-assemblies in a product model, and ? evaluate that the suppliers materials declarations meet the quality and trustworthiness requirements. As discussed in section 3.4.2, BOMcheck includes built-in electronic signature arrangements which comply with US FDA Regulations (see section 3.4.2). When the Manufacturer downloads the BOMcheck PDF report containing the suppliers materials declarations for the list of supplier parts in the product model, this is equivalent to the Manufacturer receiving paper-based materials declarations with a handwritten signature from each of the suppliers. The PDF report shows the name of the Authorised Individual at the supplier and the date that they approved the materials declaration on BOMcheck, as well as the date that the declaration is effective from, Figure 6. Figure 6. BOMcheck provides a PDF report which contains the suppliers materials declarations for the list of supplier parts in the product model The Manufacturer can also choose to download the supplier materials declarations as IPC 1752A XML files and then load these data files into a PLM system (see section 4.4.3). The Manufacturer can then use the PLM system to generate a report on the supplier materials declarations for a list of supplier parts, and include the PLM reports in the technical documentation for the product model. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 20 of 35 3.5.4 Evaluating the quality and trustworthiness of analytical test reports The Manufacturer’s assessment may conclude that the supplier is also required to provide analytical test reports to support their materials declarations for certain materials, parts or sub-assemblies. Same as for supplier declarations and material declarations, Clause 4.3.4 requires the Manufacturer to establish procedures that shall be used to evaluate the analytical test reports provided by suppliers in order to determine their quality and trustworthiness. Clause 4.3.3 states that the analytical test report must use the methods described or referenced in EN 62321. In practice, Manufacturers can meet this requirement by stipulating that the test laboratory must be accredited to the ISO/IEC 17025 standard. As part of maintaining their accreditation to the ISO/IEC 17025 standard, a laboratory must demonstrate that they apply the appropriate test methods specified in IEC 62321 and keep abreast of scientific and technological advances in relevant areas. In their RoHS Guidance Producer Support booklet, the UK RoHS Enforcement Authority notes that Manufacturers often do not examine analytical test reports closely enough and there is a lack of knowledge on their interpretation which can result in an over-reliance on the reports provided. The Manufacturer should use the following criteria when they assess any test reports which are provided by their suppliers. How old is the report? All test reports should be dated to indicate when the report was issued and when the test was conducted. The list of materials, parts and sub-assemblies used to manufacture the final product may change over time, so if the test report was written before these changes it may no longer be relevant to the final product. A Manufacturer with a frequently changing product design or production processes may need to update more regularly any test reports that they require for the final product. Is the test laboratory accredited to the ISO/IEC 17025 standard? As part of their accreditation, a laboratory must apply the appropriate test methods specified in IEC 62321 and keep abreast of scientific and technological advances in relevant areas. Does the test report cover all of the relevant homogenous materials in the part or sub-assembly that require testing? The test report(s) should identify which homogenous materials within the part of sub-assembly contain high risk materials that require testing, and which materials within the part or sub-assembly do not require testing (e.g. because they do not contain high risk materials). A homogenous material that contains high risk materials may not require testing for all six of the RoHS substances. For example, organic substances such as PBBs and PBDEs are not found in metal parts. For electronic components on an assembled printed circuit board, further analysis may be required because it can be difficult to assess compliance at the homogenous material level. Do the test results confirm compliance? For each RoHS substance that was tested in each relevant homogenous material, the test results should show that the measured concentration of the RoHS substance does not exceed the maximum concentration values, or that the use of the RoHS substance in that homogenous material is covered by a valid exemption. The UK RoHS Enforcement Authority notes that they are often presented with RoHS test results that demonstrate that the product is non-compliant. This is a clear instance where no checking process is in place and a simple step can prevent the occurrence of larger problems. The UK RoHS Enforcement Authority notes that the need for test reports to be repeated regularly may depend on the risk of non-compliance as well as the risk to the environment. Where there is a risk of non-compliance, the frequency that analysis should be carried out may depend on the potential risk to the environment so that components/materials used in very large numbers would need to be analysed more regularly than components/materials used in small numbers. 3.5.5 BOMcheck supplier is required to evaluate whether analytical test reports meet quality and trustworthiness requirements If the Manufacturer’s assessment in Clause 4.3.2 determines that the supplier is also required to provide analytical test reports, then BOMcheck provides a standardised process that all suppliers follow to attach a test report to a materials declaration in BOMcheck. The standardised process requires the supplier to evaluate whether the test report meets the Clause 4.3.4 quality and Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 21 of 35 trustworthiness requirements. This reduces the amount of time and effort required by the Manufacturer to also evaluate these analytical test reports. When the supplier attaches RoHS analytical test report(s) to a materials declaration, BOMcheck requires the supplier to assess the analytical test report(s) to determine: ? Date of test report (dd/mm/yy). Test reports which are more than 1 year old are highlighted in yellow in BOMcheck (see Figure 7 and Figure 8). ? Is the test laboratory accredited to the ISO/IEC 17025 standard? ? Do the test report(s) cover all of the relevant homogenous materials in the part or sub-assembly that require testing? BOMcheck displays a guidance note to the supplier to explain that the test report(s) should identify which homogenous materials within the part or sub-assembly contain high risk materials that require testing, and which materials within the part or sub-assembly do not require testing (e.g. because they do not contain high risk materials). A homogenous material that contains high risk materials may not require testing for all six of the RoHS substances. For example, organic substances such as PBBs and PBDEs are not found in metal parts. ? Do test results confirm compliance? BOMcheck displays a guidance note to the supplier to explain that for each RoHS substance that was tested in each relevant homogenous material, the test results should show that the measured concentration of the RoHS substance does not exceed the maximum concentration values, or that the use of the RoHS substance in that homogenous material is covered by a valid exemption. If the supplier finds that an analytical test report does not meet some of these criteria, the supplier has the opportunity to obtain an improved test report which does meet the criteria. Requiring the supplier to carry out this assessment saves time and effort for the Manufacturer by providing the supplier an early opportunity to attach an acceptable RoHS test report. An analytical test report that does not meet these criteria can not be included in the technical documentation if the Manufacturer wants to claim compliance to EN 50581, and so would be rejected by a Manufacturer. Figure 5 highlights that when BOMcheck displays the RoHS materials declaration data for a list of supplier part numbers, the Manufacturer can choose to ‘Assess RoHS Test Reports’ for this parts list. BOMcheck then displays the suppliers’ evaluation of the quality and trustworthiness of their RoHS test reports for this parts list, Figure 7. Figure 7. Suppliers' evaluation of the quality and trustworthiness of RoHS test reports Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 22 of 35 The Manufacturer should review the supplier’s evaluations of the quality and trustworthiness of their RoHS test reports. The Manufacturer should also use the weblinks in the PDF report (i.e. the red underlined links in Figure 7) to view a sample of a supplier’s test reports to check that the supplier has evaluated their test reports against the criteria correctly. This is another factor that the Manufacturer can include in their assessment of the trustworthiness of the supplier (see section 3.2.3). Once the Manufacturer is happy with the supplier evaluations, then the Manufacturer can download the supplier evaluations of their RoHS test reports as a PDF report, Figure 8. The Manufacturer can include this PDF report in the technical documentation for the product model to demonstrate that they have complied with EN 50581 requirements to: ? collect the analytical test reports that the Manufacturer’s assessment requires certain suppliers to provide for certain materials, parts and/or sub-assemblies in a product model, and ? evaluate that the analytical test reports meet the quality and trustworthiness requirements. Figure 8. BOMcheck provides a PDF report of the suppliers' evaluation of quality and trustworthiness of RoHS test reports Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 23 of 35 Each RoHS test report that a supplier attaches to a declaration on BOMcheck has its own unique weblink URL which is publicly available, regardless of whether a person is logged into BOMcheck. This means that any person who receives the PDF report can use the weblinks in the PDF document to review the original RoHS test reports which the supplier attached to the materials declaration for their part(s). For example, the Manufacturer can send the PDF to a RoHS regulator or interested customer and they will be able to use the weblinks in the PDF document to review the original RoHS test reports, even though they are not logged into BOMcheck. The weblink URLs are maintained even if the supplier subsequently removes the test report when they next update a materials declaration for their part(s). 3.6 Clause 4.3.5: Periodic review of the technical documentation Clause 4.3.5 states that the Manufacturer shall: – perform a periodic review of the documents contained in the technical documentation to ensure that they are still valid; – ensure that the technical documentation reflects any changes to materials, parts or sub-assemblies in accordance with Clause 4.3.3. Clause 4.3.5 also includes a note which highlights that Article 7(e) of the RoHS2 Directive requires the Manufacturer to keep the technical documentation up-to-date with any changes to the product design and manufacturing process. Therefore, the Manufacturer needs to have processes in place to: 1. periodically review any product design and manufacturing changes to generate a new, up-to-date list of part numbers and supplier codes for all materials, parts and sub-assemblies which are contained in the finished product, and 2. check that the technical documentation includes materials declarations (and test reports if required) for any new part numbers and supplier codes in this updated list, and that the documents for existing part numbers and supplier codes continue to meet quality and trustworthiness requirements. Manufacturers can meet this second requirement by using the updated parts list to download new PDF reports from BOMcheck to include in the updated technical documentation for the product model. In particular, the Manufacturer can use the updated parts list to download new PDF reports which contain: ? materials declarations for the list of supplier parts in the product model ? analytical test reports that the Manufacturer’s assessment requires certain suppliers to provide for certain materials, parts and/or sub-assemblies in the product model. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 24 of 35 4 About BOMcheck 4.1 Shared industry-led web database system BOMcheck is an industry led solution which was launched by the COCIR European Trade Association in June 2008 to benefit all sectors of the electronics industry. www.BOMcheck.net is a shared industry-led web database system which provides tools and guidance for suppliers to publish and maintain their materials declarations in international standard formats for their customers to access, Figure 9. Figure 9. Shared industry-led web database for suppliers to publish materials declarations, and provide any analytical test reports that may be required The BOMcheck Steering Group comprises Siemens, Philips, GE, Sony Mobile, Osram, Toshiba, Agfa, Texas Instruments, Tyco Electronics and Fujifilm. The Steering Group meets every two months by web meeting and conference call to direct the development of new functions and features on BOMcheck and to plan joint roll out to suppliers. BOMcheck is used by over 370 Manufacturers and over 2,300 Suppliers, Figure 10. Figure 10. BOMcheck is used by over 370 Manufacturers and 2,300 Suppliers, June 2012 370 Manufacturers using BOMcheck to manage supplier regulatory compliance Global distribution of 2,300 Suppliers using BOMcheck to make materials declarations BOMcheck increases the quality and response rate for supplier materials declarations by providing benefits to suppliers: ? All manufacturers share one database system and one global list of restricted and declarable substances for materials declarations to their suppliers Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 25 of 35 ? BOMcheck system provides expert guidance on regulated substances worldwide, including requirements in North America, Asia Pacific and Europe ? Suppliers can choose to make a Regulatory Compliance Declaration (e.g. for REACH, RoHS, other regulatory requirements) or to make a Full Material Declaration (FMD), in which case BOMcheck automatically calculates a Regulatory Compliance Declaration (RCD) from the FMD data. Suppliers can choose to make the FMD confidential to certain customers and allow other customers only to see the RCD which BOMcheck calculates from the FMD data. ? The FMD tool includes built-in data validation. Suppliers declare each substance in each material by selecting from a searchable list of 524,000 substance names and CAS numbers. BOMcheck calculates the percentages of substances in materials and parts to calculate an up-to-date Regulatory Compliance Declaration. ? BOMcheck includes built-in electronic signature arrangements which comply with US FDA Regulations. When the Manufacturer downloads a supplier material declaration from BOMcheck this is equivalent to the Manufacturer receiving a paper-based declaration with a handwritten signature from the supplier. ? All suppliers data is updated centrally when the list of RoHS exemptions and regulated substances changes. Suppliers receive guidance and training on the regulatory changes and how to use the BOMcheck tools to re-certify their Regulatory Compliance Declarations ? Suppliers can attach evidence documents (e.g. analytical test reports) and can e-mail their declarations data to any manufacturer customers who are not on BOMcheck yet ? All BOMcheck tools and User Guides are available in Chinese, Japanese, German and English ? Free webinar training for suppliers. The monthly introduction webinars provide an overview of the RoHS, REACH, Batteries and Packaging regulations and a detailed demonstration of how suppliers can publish materials declarations in BOMcheck. When a supplier joins BOMcheck they are required to complete a recording training program (available in Chinese and English) which includes a step-by-step demonstration of all of the tools on BOMcheck. A recorded introduction webinar is available at www.BOMcheck.net in Chinese, German and English. 4.2 Process for using BOMcheck to gather declarations from suppliers The process for a Manufacturer to use BOMcheck to gather declarations from their suppliers is summarised in Figure 11. To join BOMcheck, the Manufacturer must sign a Manufacturer’s Agreement13 with ENVIRON. This requires the Manufacturer to send a letter to their suppliers asking them to join BOMcheck and publish material declarations for the part numbers that they supply to the Manufacturer. A standard letter is provided in Schedule 1 of the Manufacturer Agreement or the Manufacturer can develop an equivalent letter. The Manufacturer should send the list of supplier part numbers that they buy from the supplier and ask the supplier to confirm that their part numbers are included correctly in the list. The supplier should use exactly the same part numbers when they publish their materials declaration(s) so that the Manufacturer can find the supplier part numbers easily on BOMcheck. ENVIRON provides two live BOMcheck training webinars each month which suppliers can attend free-of-charge - one for suppliers in Asia Pacific and the EU suppliers and one for suppliers in North America and the EU. Suppliers can register to attend these live training webinars by visiting www.BOMcheck.net and selecting the registration links on the right hand side of the page. Suppliers can attend the training webinars as many times as they like, and can also forward the invitation to their suppliers. Each webinar lasts about 1.5 hours, including questions and answers, and provides: ? an overview of the RoHS, REACH, Batteries and Packaging regulations, and ? a detailed demonstration of how suppliers can publish materials declarations in BOMcheck When a supplier joins BOMcheck they are required to complete a recorded BOMcheck training program when they first login to the system. This recorded training webinar includes a step-by-step demonstration of all of the tools on BOMcheck. 13 A sample Manufacturers Agreement is available at http://www.bomcheck.net/manufacturers/request-agreement Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 26 of 35 Figure 11: Process for a Manufacturer to use BOMcheck to gather declarations from their suppliers A supplier who is already a member of BOMcheck and has made their declarations confidential to certain customers can add the Manufacturer to these confidentiality settings, for example by using the Update ALL RCDs tool or Update ALL FMDs tool, Figure 12. Figure 12. How a supplier can use the Update ALL RCDs or Update ALL FMDs tool in a Supplier Account to add the Manufacturer to the confidentiality settings for their declarations data on BOMcheck The Manufacturer Account on BOMcheck includes the ‘View suppliers list’ tool which the Manufacturer can use to identify their suppliers on BOMcheck, Figure 13. This enables the Manufacturer to download a list of all suppliers on BOMcheck, or to download a list of suppliers who have used the ‘View manufacturers list’ tool in their Supplier Account to inform the Manufacturer that they are on BOMcheck, Figure 14. The Manufacturer can also use the ‘View suppliers list’ tool to instruct BOMcheck to send them a notification e-mail (immediately, daily, weekly or monthly) when a supplier joins BOMcheck and uses the ‘View manufacturers list’ to inform the Manufacturer that they are on BOMcheck. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 27 of 35 Figure 13. ‘View suppliers list’ tool in a Manufacturer Account enables the Manufacturer to identify their suppliers on BOMcheck Figure 14. ‘View manufacturer list’ tool in a Supplier Account enables a supplier to inform their Manufacturer customers that they are on BOMcheck 4.3 BOMcheck Supplier Code provides unique identification of suppliers As discussed in Section 3.2.2, the Manufacturer’s technical documentation for RoHS2 must enable traceability of all materials, parts and sub-assemblies which are contained in the Manufacturer’s product model, by unique identification of: ? the supplier who is supplying the part, and ? the part number that the supplier uses to identify the part to the Manufacturer. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 28 of 35 To enable unique identification of the supplier who is supplying the part, each distinct supplier on BOMcheck is allocated one unique Supplier Code. The supplier is required to choose one of their DUNS numbers14 which then becomes their unique BOMcheck Supplier Code. Large companies may have several different DUNS numbers for different business addresses (e.g. for the head office, branch offices etc). BOMcheck recommends that the supplier should choose their highest level corporate DUNS number to become their BOMcheck Supplier Code, but in practice any of the supplier’s DUNS numbers is acceptable because: ? A DUNS number is unique to an assigned business and is never re-used (even if the business goes bankrupt). It is therefore impossible for two different suppliers to have the same BOMcheck Supplier Code. ? BOMcheck uses the DUNS number to verify the legal status of the business (one of the checks needed for CFR Part 11 Electronic Signature Regulations) ? DUNS provides a convenient global identification coding system. There are two exceptions to the rule that each distinct supplier on BOMcheck is allocated one unique Supplier Code: ? If a supplier has several distinct brands and each brand has its own part coding system then each brand must have its own unique Supplier Code on BOMcheck ? If a supplier has several distinct brands and each brand behaves as a separate company with its own set of customers then it may be appropriate for each brand to have its own unique Supplier Code on BOMcheck. The Manufacturer Account on BOMcheck includes the ‘View suppliers list’ tool which the Manufacturer can use to download a list containing the BOMcheck Supplier Code for every supplier on BOMcheck, Figure 13. The Manufacturer may have already established a different supplier coding system for its suppliers. In this case, the Manufacturer should establish and maintain a matrix table (for example in the IT / PLM system) to link the Manufacturer’s Supplier Code to the BOMcheck Supplier Code. 4.4 Unique identification of supplier parts on BOMcheck Each supplier part on BOMcheck is identified by a unique pair of values, Figure 15: ? The unique BOMcheck Supplier Code for that supplier, and ? The supplier part number Figure 15. Unique identification of a supplier part in BOMcheck To download the materials declarations for a list of supplier parts in BOMcheck, the Manufacturer should load a parts list into BOMcheck which contains the supplier part number in column 1 and the BOMcheck Supplier Code in column 2 (see section 3.5.3). BOMcheck includes built-in electronic signature arrangements which comply with US FDA Regulations (CFR Part 11 Electronic Signature Regulations – further information is available at http://www.bomcheck.net/suppliers/electronic-signatures. When the Manufacturer downloads the 14 A DUNS number is a unique nine-digit identification number which is used to identify legitimate registered businesses, and is allocated by Dun & Bradstreet (www.dnb.com) Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 29 of 35 supplier material declaration from BOMcheck this is equivalent to the Manufacturer receiving a paper-based material declaration with a handwritten signature from the supplier. 4.5 Using the mapping tool to map supplier parts to Manufacturer parts As discussed in Section 3.2.2, the Manufacturer’s technical documentation for RoHS2 must enable traceability of all materials, parts and sub-assemblies which are contained in the Manufacturer’s product model, by unique identification of: ? the supplier who is supplying the part, and ? the part number that the supplier uses to identify the part to the Manufacturer. In most cases the parts list in the RoHS2 technical documentation will comprise a list of supplier part numbers and supplier codes. However, larger Manufacturers often have their own part coding system and in some cases the RoHS2 technical documentation may use the list of Manufacturer part numbers, provided that the relationship between the supplier part number and the Manufacturer part number can be easily demonstrated. Many PLM systems store and maintain the relationship between the supplier part number and the Manufacturer part number in the master data for a product. In this case, the Manufacturer can use the list of supplier part numbers and supplier codes to download the materials declarations (see section 3.5.3). The Manufacturer can choose to download this PDF report and include it in their technical documentation to demonstrate that they have complied with EN 50581 requirements. The Manufacturer can also choose to download the supplier materials declarations as IPC 1752A XML files and then load these data files into a PLM system (see section 4.6). The Manufacturer can then use the PLM system to generate a report on the supplier materials declarations for a list of supplier parts, and include the PLM reports in the technical documentation for the product model But some PLM systems only allow one part number to be stored in the master data for a product and some Manufacturers choose to store their own Manufacturer part number instead of the supplier part number / supplier code. In this case, the Manufacturer needs to be able to use the materials declarations from their suppliers to generate a report showing the RoHS compliance status for the list of Manufacturer part numbers for all materials, parts and sub-assemblies in the product model. These Manufacturers also need to be able to easily demonstrate the relationship between the supplier code / supplier part number and the Manufacturer part number. To assist these Manufacturers, BOMcheck provides a mapping tool which a supplier, or Manufacturer that has a Super User Account15, can use to establish a relationship between the Manufacturer’s part number and the supplier part number / supplier code in BOMcheck. The mapping tool is provided in the Supplier Account but is not available in the Manufacturer Account – instead the Manufacturer needs to upgrade their BOMcheck Manufacturer account to a Super User Account to be able to use the mapping tool. The Super User Account requires the Manufacturer to select one of their company’s DUNS numbers which will then become their Manufacturer Code on BOMcheck. The Manufacturer Code is used to uniquely identify the Manufacturer Part numbers that the Manufacturer creates on BOMcheck by using the mapping tool. First of all, the supplier must publish a materials declaration for their supplier part number in BOMcheck. Then the supplier or a Super User can use the mapping tool16 to create the Manufacturer Part number in BOMcheck as a Mapping Number which points to the supplier part number. The relationship which is created when a Super User carries out the mapping is illustrated in Figure 16. The Mapping Number is a ‘virtual’ part number (i.e. an Alias) which points to a supplier part number that the supplier has already declared in BOMcheck. 15 As explained at http://www.bomcheck.net/manufacturers/super-user-account, when a person has a Supplier Account and works for a company that has a Manufacturer Account, BOMcheck provides a free upgrade to convert the Supplier Account into a Super User account 16 See Section 5.5 of the BOMcheck User Guide for Suppliers and Manufacturers – release 2.06 Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 30 of 35 Figure 16. Super User can create the Manufacturer Part number as a Mapping Number which points to the supplier part number The Mapping Number (Manufacturer Part number) has the same materials declaration status as the supplier part number. When the supplier updates the materials declaration for their supplier part number, BOMcheck automatically updates the materials declaration for the Mapping Number (Manufacturer Part number). A Mapping Number is shown in blue font on BOMcheck to differentiate it from a supplier part number which is shown in black font, Figure 17. When the supplier or the Super User uses the mapping tool to create a Mapping Number they can set the confidentiality of the Mapping Number so that the Mapping Number can be viewed by: ? All Manufacturers in BOMcheck, or ? Only selected Manufacturers, or ? Only the supplier or the Super User Figure 17. SiemensAG Super User has mapped part number SiemensABCD to supplier part number 3235-576158-00 and has set the confidentiality so that it can only be viewed by SiemensAG Figure 17 provides an example of a mapping that has been carried out by a Super User at SiemensAG. The Super User has mapped the Manufacturer Part number SiemensABCD to supplier part number 3235-576158-00, and has set the mapping confidentiality so that Manufacturer Part number SiemensABCD can only be viewed by other colleagues at SiemensAG who login to BOMcheck by using the SiemensAG Manufacturer Account. When another Manufacturer logs into BOMcheck they will be able view supplier part number 3235-576158-00 (because the supplier has allowed “All Manufacturers” to view this part number) but the other Manufacturer will not be able to view Manufacturer Part number SiemensABCD. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 31 of 35 4.6 Loading BOMcheck materials declaration data into the Manufacturer’s PLM system BOMcheck provides a range of flexible options for downloading materials declarations data into the Manufacturer’s PLM system. As highlighted in Figure 18, most companies start by manually downloading the materials declarations data from BOMcheck in IPC 1752A XML format to load into their PLM systems (IPC 1752A Class C XML and Class D XML formats are supported in BOMcheck). In general, most companies then progress to using the BOMcheck Application Programming Interface (API) to establish an automated connection between BOMcheck and the company’s PLM system. The API enables the company’s PLM system to send POST requests to BOMcheck to download data in IPC 1752A XML format directly into the PLM system. The POST request can specify the type of data that BOMcheck should provide and the particular location in the company’s PLM system where BOMcheck should save the data. The API uses SSL encryption to ensure the security of the POST request to BOMcheck and the data transfer from BOMcheck to the company’s PLM system. Many Japanese companies use the JAMP AIS XML format (www.jamp-info.com) to communicate information on the chemical content of products. BOMcheck includes tools which enable users to download FMD data from BOMcheck in JAMP AIS XML format. Some older PLM systems still use CSV format (for example, to import data which is generated by using Excel survey forms). BOMcheck includes an option to download data in CSV format to load into these older PLM systems. Figure 18. Phased development of interface at OSRAM to SAP Product and REACH Compliance17 Figure 19 highlights how the BOMcheck API can be used to load BOMcheck supplier declarations data into a PTC Windchill Product Analytics PLM system. Windchill Product Analytics (WPA) was formerly known as InSight and before that the system was known as EMARS. 17 This slide was presented by OSRAM and TechniData GmbH (a SAP company) at “Going Green – CARE INNOVATION 2010”, 9 November 2010, Vienna. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 32 of 35 Figure 19. Using the BOMcheck API to load supplier data into PTC Windchill Product Analytics18 Dr Aidan Turnbull of ENVIRON is the current co-Chair of the IPC 1752A International Standard (www.ipc.org/2-18b-committee). The IPC 1752A International Standard for Materials Declaration Management is widely supported by leading PLM solution providers including: ? PTC: Windchill Product Analytics (www.ptc.com/products/InSight) ? Dassault Systems: Material Compliance Central (MCC) (www.enovia.com) ? SAP: Product and REACH Compliance (www.sap.com/best-run-now/product-and-reach-compliance.epx) ? Oracle Agile: Product Governance and Compliance (www.oracle.com/ocom/groups/public/@ocompublic/documents/webcontent/018801.pdf) ? Siemens: Teamcenter (www.plm.automation.siemens.com/en_us/products/teamcenter) 4.7 BOMcheck Data Security Certifications and Security Assessments BOMcheck is designed and implemented to achieve the highest commercial data security standards in the world. All sensitive data on BOMcheck is stored securely by encrypting the data to PCI DSS standards. The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards. Administrator access to the BOMcheck system is restricted to only three security-approved ENVIRON staff and ENVIRON’s contract with each Member includes strict obligations on ENVIRON to ensure security and confidentiality of the Members’ data. The security of the data on BOMcheck is tested every day by McAfee who use thousands of different hacking techniques to attack the www.BOMcheck.net web database system. BOMcheck web application security is assessed during an annual 5 day audit by the Siemens Cyber Emergency Readiness Team. The most recent audit was completed in January 2012. The BOMcheck web database system is hosted using the same internet server arrangements as www.amazon.com. 18 This slide was presented by PTC and BOMcheck at a joint PTC/BOMcheck webinar “RoHS2 Compliance: Is your company ready?”, 14 July 2011 Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 33 of 35 4.7.1 Contractual obligations and Administrator access restrictions at ENVIRON Administrator access to the BOMcheck system is restricted to only three security-approved ENVIRON staff. These named individuals have received appropriate security training. BOMcheck Steering Group companies do not have any special access to the BOMcheck system. ENVIRON’s contract19 with each Supplier Member includes strict obligations on ENVIRON to ensure security and confidentiality of the Supplier Members’ data, including the following clauses: 5.7 ENVIRON will not use any other means to distribute the Member’s Data except via the Database. ENVIRON will not provide the Member’s Data to any party who has not signed a Manufacturer’s Agreement to use the Database. ENVIRON will not in any way sell, transfer, (sub-) license or otherwise commercially exploit the Data provided into the Database. 5.8 ENVIRON will treat any Data in the Database as strictly confidential and will not access the Member’s account unless instructed to do so by the Member. Exception to this is system statistics calculation such as e.g. number of Regulatory Compliance Declarations, number of Full Materials Declarations etc. Furthermore ENVIRON’s internal access to Data is restricted to specially selected persons that may need access under supervision of security personnel for system maintenance purposes 4.7.2 TLS 1.2 (SSL 1.3) security encryption of all communication between BOMcheck and the company’s internet server BOMcheck uses the TLS 1.2 (SSL 1.3) encryption protocol to prevent any eavesdropping or tampering of data which a company transmits to www.BOMcheck.net and data which a company receives from www.BOMcheck.net, Figure 20. Figure 20. TLS 1.2 (SSL 1.3) security encryption of all data to/from https://www.bomcheck.net As part of the TLS 1.2 (SSL 1.3) encryption protocol, BOMcheck encrypts the segments of network connections above the Transport Layer, using asymmetric cryptography for privacy and a keyed message authentication code for message reliability. When a user logs into BOMcheck, the BOMcheck system communicates with the user’s internet server to establish the parameters that will be used to ensure the highest level of security for the connection. BOMcheck chooses the strongest cipher and hash function that the user’s server is able to support and then uses this for all communications. BOMcheck then sends our digital certificate to the user’s server which includes the trusted certificate authority (CA) and BOMcheck’s public encryption key. The user’s internet server may contact the trusted certificate authority (CA) server and confirm the validity of the BOMcheck public encryption key before continuing. 19 The BOMcheck Supplier Member Rules are published at https://www.bomcheck.net/suppliers/member-rules Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 34 of 35 In order to generate the session keys used for the secure connection, the user’s server then encrypts a random number with the BOMcheck public encryption key and sends the result to www.BOMcheck.net. Only www.BOMcheck.net can decrypt this message using BOMcheck’s private key. This concludes the security handshake between BOMcheck and the user’s server and begins the secured connection. This random number is then used to encrypt and decrypt all data that a user transmits to www.BOMcheck.net and all data which a user receives from www.BOMcheck.net. If any one of the above steps fails, the TLS handshake fails and the connection is not created. 4.7.3 McAfee SECURE (Hacker Safe) Website Certification The BOMcheck web database system is certified to the McAfee SECURE (Hacker Safe) Website Certification Seal. As part of this certification, McAfee carries out intensive security tests of www.BOMcheck.net every day by attacking the www.BOMcheck.net web database system by using thousands of different hacking techniques. McAfee then publishes the results of these intensive security tests as a certificate on www.BOMcheck.net with today’s date, Figure 21. Figure 21. McAfee SECURE (Hacker Safe) Website Certification Further details about the McAfee SECURE (Hacker Safe) Website Certification Seal are available at http://www.mcafeesecure.com/us/products/mcafee_secure.jsp?tab=1. 4.7.4 BOMcheck web application security is audited by the Siemens Cyber Emergency Readiness Team BOMcheck web application security is assessed during a 5 day audit each year by the Siemens Cyber Emergency Readiness Team (CERT). The most recent audit was successfully completed in January 2012 to the satisfaction of Siemens. The web application security assessment of BOMcheck has been performed to the best knowledge of Siemens CERT, which is based on state-of-the-art know-how and many years of experience. Siemens CERT is determined to identify all security vulnerabilities within the scope of the assessment. However, due to the inherent nature of security assessments and the limited timeframe, it is impossible to guarantee that no vulnerability will remain undetected. Guide to Using BOMcheck and EN 50581 to Comply with RoHS2 Technical Documentation Requirements 35 of 35 4.7.5 BOMcheck uses the same internet server arrangements as www.amazon.com BOMcheck is hosted on servers which are provided by Amazon Web Services (AWS). AWS customers include Amazon, Ericsson, Hitachi, Virgin Atlantic, European Space Agency, US Department of State. AWS is compliant to several security certifications and third-party audit programs including: ? SAS70 Type II. The report covers the detailed controls that AWS operates along with an independent auditor opinion about the effective operation of those controls. ? PCI DSS Level 1. AWS has been independently validated to comply with the PCI Data Security Standard as a shared host service provider. ? ISO 27001. AWS has achieved ISO 27001 certification of the Information Security Management System (ISMS) covering infrastructure, data centers, and services. ? FISMA. AWS enables government agency customers to achieve and sustain compliance with the Federal Information Security Management Act (FISMA). AWS has been awarded an approval to operate at the FISMA-Low level. It has also completed the control implementation and successfully passed the independent security testing and evaluation required to operate at the FISMA-Moderate level. AWS is currently pursuing an approval to operate at the FISMA-Moderate level from government agencies. AWS datacenters are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access datacenter floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides datacenter access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to datacenters by AWS employees is logged and audited routinely. Further details about AWS security systems are available at: http://aws.amazon.com/security/ http://aws.amazon.com/about-aws/whats-new/2009/11/11/aws-completes-sas70-type-ii-audit/