IEC 60601-2-25 Clause 201.12.4.101 Indication of Inoperable ECG

This test is important but has a number of problems in implementation. To understand the issue and solution clearly, the situation is discussed in three stages - the ECG design aspect the standard is trying to confirm; the problems with the test in the standard; and finally a proposed solution. 

The ECG design issue

Virtually all ECGs will apply some opamp gain prior to the high pass filter which removes the dc offset. This gain stage has the possibility to saturate with high dc levels. The point of saturation varies greatly with each manufacturer, but is usually in the range of 350 - 1000mV. At the patient side a high dc offset is usually caused by poor contact at the electrode site, ranging from an electrode that is completely disconnected through to other issues such as an old gel electrode. 

Most ECGs detect when the signal is close to saturation and trigger a "Leads off" or "Check electrodes" message to the operator. Individual detection needs to be applied to each lead electrode, and both positive and negative voltages, this means that there are up to 18 different points (LA, RA, LL, V1 - V6). Due to component tolerances, the points of detection in each lead often vary by around 20mV  (e.g. LA points might be +635mV, -620mV, V3 might be +631mV, -617mV etc). 

If the signal is completely saturated it will appear as a flat-line on the ECG display. However, there is a small region where the signal is visible, but distorted (see Figure 1). Good design ensures the detection occurs prior to any saturation. Many ECGs automatically show a flat line once the "Leads Off" message is indicated, to avoid displaying a distorted signal. 

Problems with the standard

The first problem is the use of a large ±5V offset. This is a conflict with the standard as Clause 201.12.4.105.2 states that ECGs only need to withstand up to ±0.5V without damage. Modern ECGs use ±3V or less for the internal amplifiers, and applying ±5V could unnecessarily damage the ECG. 

This concern also applies to the test equipment (Figure 201.106). If care is not taken, the 5V can easily damage the precision 0.1% resistors in the output divider and internal DC offset components.  

Next, the standard specifies that the voltage is applied in 1V steps. This means it is possible to pass the test even though equipment fails the requirement. For example an ECG may start to distort at +500mV, flatline by +550mV, but the designer accidentally sets the "Leads Off" signal at +600mV. In the region of 500-550mV this design can display a distorted signal without any indication, and from 550-600mV is confusing to the operator why a flat line appears. If tested with 1V steps these problem regions would not be detected and a Pass result would be recorded. 

Finally the standard allows distortion up to 50% (a 1mV signal compressed to 0.5mV). This is a huge amount of distortion and there no technical justification to allow this given the technology is simple to ensure a "Leads Off" message appears well before any distortion. The standard should simply keep the same limits for normal sensitivity (±5%).

Solution 

In practice, it is recommended that a test engineer start at 300mV offset and search for the point where the message appears, reduce the offset until the message is cleared, and then slowly increase again up to the point of message while confirming that no visible distortion occurs (see Figure 2). The test should be performed in both positive and negative directions, and on each lead electrode (RA, LA, LL, V1 to V6). The dc offset function in the Whaleteq SECG makes this test easy to perform (test range up to ±1000mV), but the test is also simple enough that an ad-hoc set up is easily prepared.  

Due to the high number of tests, it might be temping to skip some leads on the basis that some are representative. Unfortunately, experience indicates that manufacturers sometimes deliberately or accidentally miss some points on some leads, or set the operating point to the wrong level, such that distortion is visible prior to the message appearing. As such it is recommended that all lead electrodes are checked. Test engineers can opt for a simple OK/NG record, with the operating points on at least one lead kept for reference. Detailed data on the other leads might be kept only if they are significantly different. For example, some ECGs have very different trigger points for chest leads (V1 - V6). 

Due to the nature of electronics, any detectable distortion prior to the "Leads Off" message should be treated with concern, since the point of op-amp saturation is variable. For example one ECG may have 10% distortion at +630mV while sample might have 35% distortion. Since some limit should apply (it is impossible to detect "no distortion") It is recommended to use a limit of ±5% relative to a reference measurement taken with no dc offset. 

The right leg

The right leg is excluded from the above discussion: in reality the right leg is the source of dc offset voltage - it provides feedback and attempts to cancel both ac and dc offsets; an open lead or poor electrode causes this feeback to drift towards the internal rail voltage (typically 3V in modern systems). This feedback is via a large resistor (typically 1MΩ) so there is no risk of damage (hint to standards committees - if 5V is really required, it should be via a large resistor).

More research is needed on the possibility, effects and test methods for RL. It is likely that high dc offsets impact CMRR, since if the RL drive is pushed close to rail voltage, it will feedback a distorted signal preventing proper noise cancellation. At this time, Figure 201.106 is not set up to allow investigation of an offset to RL while providing signals to other electrodes which is necessary to detect distortion. For now, the recommendation is to test RL to confirm that at least an indication is provided, without confirming distortion.

View fullsize

Figure 1: With dc offset, the signal is at first completely unaffected, before a region of progressive distortion is reached finally ending in flat line on the ECG display. Good design ensures the indication to the operator (e.g. "LEADS OFF") appears well before any distortion

View fullsize

Figure 2: The large steps in the standard fail to verify that the indication to the operator appears before any distortion. Values up to 5V can also be destructive for the ECG under test and test equipment. 

View fullsize

Figure 3; Recommended test method; search for the point when the message is displayed, reduce until message disappears, slowly increase again check no distortion up to the message indication. Repeat for each lead electrode and both + and - direction.

IEC 60601-2-25 Clause 201.8.5.5.1 Defibrillator Protection

General information on defibrillator testing can be found in this 2009 article copied from the original MEDTEQ website.

One of the significant changes triggered by the IEC 60601-2-25 2011 edition is the inclusion of the defibrillator proof energy reduction test via the general standard (for patient monitors, this test already existed via IEC 60601-2-49). Previously, diagnostic ECGs tended to use fairly low impedance contact to the patient, which helps to improve performance aspects such as noise. The impact of the change is that all ECGs will require higher resistors in series with each lead, as detailed in the above article. The higher resistors should trigger retesting for general performance, at least for a spot check.

Experience from real tests has found that with the normal diagnostic filter (0.05Hz to 150Hz), the baseline can take over 10s to return, exceeding the limit in the standard. Although most systems have automated baseline reset (in effect, shorting the capacitor in an analogue high pass filter, or the digital equivalent), the transients that occur after the main defibrillator pulse can make this difficult for the system to know when the baseline is sufficiently stable to perform a reset.  The high voltage capacitor used for the main defibrillator pulse is likely to have a memory effect causing significant and unpredictable baseline drift well after the main pulse. If a reset occurs during this time, the baseline can easily drift off the screen, and due to the long time constant of the 0.05Hz filter, can take 15-20s to recover. 

The usual workaround is that most manufacturers declare in the operation manual that during defibrillation special filters should be used (e.g. 0.67Hz). The issue raises the question of why diagnostic ECGs need to have defibrillator protection, and if so, how this is handled in practice. If defibrillator protection is really necessary, sensible solutions may involve the system automatically detecting a major overload and switching to a different filter for a short period (e.g. for 30s). It is after all an emergency situation: expecting the operator to have read, understand and remember a line from the operation manual, and as well have the time and presence of mind to work through touch screen menu system to enable a different filter setting while at the same time performing defibrillation on the patient is a little bit of a stretch. 

Powered by Squarespace

IEC 60601-2-25 CSE database - test experience

The standard IEC 60601-2-25:2011 includes tests to verify the accuracy of interval and duration measurements, such as QRS duration or the P-Q interval.

These tests are separated into the artificial waveforms (the CTS database) and the biological waveforms (the CSE database). The CSE database is available on CD-ROM and must be purchased from the INSERM (price $1500, contact Paul Rubel, prubel.lyon@gmail.com)[1].

In principle, the database tests required by IEC 60601-2-25:2011 should be simple: play the waveform (in digital or analogue form), compare the data from the equipment under test to the reference data. In practice, there are some considerations and complications. This document covers some of the issues associated with the CSE database.  

First, it should be confirmed that the equipment under test actually measures and displays global intervals, rather than intervals for a specific lead. As stated in Annex FF.2 of the standard:

“The global duration of P, QRS and T are physiologically defined by the earliest onset in one LEAD and the latest offset in any other LEAD (wave onset and offset do not necessarily appear at the same time in all LEADS because the activation wavefronts propagate differently).”

Global intervals can be significantly different to lead intervals. This becomes evident from the first record of the database (#001), where the reference for the QRS duration is 127ms, while the QRS on LEAD I is visibly around 100ms. The following image is from the original “CSE Multilead ATLAS” analysis for recording #001 shows why: the QRS onset for Lead III (identified with the line and sample number 139) starts much earlier than for Lead I.

If the equipment under test does not display global intervals, it is not required to test using the CSE database to comply with IEC 60601-2-25.

The next aspect to be considered is whether to use waveforms from the MO1 or MA1 series.

The MO1 series is the original recording, and contains 10s with multiple heart beats. Each heart beat is slightly different, and the reference values are taken only for a specific heart beat (generally the 3rd or 4th beat in the recording). The beat used for analysis can be found from the sample number in the file “MRESULT.xls” on the CD-ROM[2]. The MO1 recordings are intended for manufacturers using the software (digital) route for testing their measurement algorithms. Many ECGs perform the analysis by averaging the results from several beats, raising a potential conflict with the standard since the reference values are for a single beat only. It is likely that the beat to beat variations are small and statistically insignificant in the overall analysis, as the limits in the standard are generous. However manufacturers investigating differences in their results and the reference values may want to check other beats in the recording.

The MO1 files can played in analogue form but there are two disadvantages: one is to align the equipment under test with the reference beat, the second is looping discontinuities. For example Record 001 stops in the middle of a T-wave, and Lead V1 has a large baseline drift. If the files are looped there will be a large transient and the potential for two beats to appear together; the ECG under test will have trouble to clear the transient events while attempting to analyze the waveforms. If the files are not looped, the ECG under test may still have trouble: many devices take around 5s to adjust to a new recording, by which time the reference beat has already passed.

The MA1 series overcomes these problems by isolating the selected beat in the MO1 recording, slightly modifying the end to avoid transients, and then stitching the beats together to make a continuous recording of 10 beats. The following image superimposes the MA1 series (red) on top of the MO1 series (purple) for the 4th beat on Lead I. The images are identical except for a slight adjustment at the end of the beat to avoid the transient between beats:

 The MA1 series is suitable for analogue and digital analysis. Unlike MO1 files which are fixed at 10.0s, the MA1 files contain 10 whole heart beats, so the length of the file varies depending on the heart rate. For example, record # 001 has a heart rate around 63bpm, so the file is 9.5s long. Record 053 is faster at 99bpm, so the file is only 6s long. As the file contains whole heart beats, the file can be looped to allow continuous play without limit. There is no need to synchronize the ECG under test, since every beat is the same and the beat is always the reference beat.

The only drawback of the MA1 series is the effect of noise, clearly visible in the above original recording. In a real recording, the noise would be different for each beat, and helps to cancel out errors if averaging is used. For manual analysis (human), the noise is less of a concern as we can visually inspect all leads simultaneously, from this we can generally figure out the global onset even in the presence of noise. Software usually looks at each lead individually and can be easily tricked by the noise. This is one reason why ECGs often average over several beats. Such averaging may not be effective for the MA1 series since the noise on every beat is the same.

Finally, it should be noted that the CSE database contains a large volume of information much of which is irrelevant for testing to IEC 60601-2-25. Sorting through this information can be difficult. Some manufacturers and test labs, for example, have been confused by the file “MRESULTS.xls” and attempted to use the reference data directly. 

In actual case, file “MRESULTS.xls” does not contain the final reference values used in IEC tests. They can be calculated from the raw values (by selective averaging), but to avoid errors it is best to use the official data directly.

Most recent versions of the CD-ROM should contain a summary of the official reference values in three files (all files have the same data, just difference file format):

• IEC Biological ECGs reference values.pdf
• IEC Biological ECGs reference values.doc
• CSE_Multilead_Library_Interval_Measurements_Reference_Values.xls

If these files were not provided in the CD-ROM, contact Paul Rubel (prubel.lyon@gmail.com).

[1] The CSE database MA1 series are embedded in the MEDTEQ/Whaleteq MECG software, and can be played directly without purchasing the CD-ROM. However the CD-ROM is required to access the official reference values.

[2] For record #001, the sample range in MRECORD.xls covers two beats (3rd and 4th). The correct beat is the 4th beat, as shown in the original ATLAS records, and corresponds to the selected beat for MA1 use.

IEC 60601-2-25 Overview of CTS, CSE databases

All ECG databases have two discrete aspects: the digital waveform data, and the reference data. The waveform data is presented to the ECG under test, in either analogue or digital form (as allowed by the standard), and the ECG under test interprets the waveform data to create measured data. This measured data is then compared against the reference data to judge how well the ECG performs. These two aspects (waveform data, reference data) need to be considered separately. This article covers the databases used in IEC 60601-2-25.  

CTS Database

The CTS database consists of artificial waveforms used to test for automated amplitude and interval measurements. It is important to note that the standard only applies to measurements that the ECG makes: if no measurements are made, no requirement applies; if only the amplitude of the S wave in V2 is measured, or duration of the QRS of Lead II, that is all that needs to be tested. In the 2011 edition the CTS database is also used for selected performance tests, some of which needs to be applied in analogue form. 

All the CAL waveforms are identical for Lead I, Lead II, V1 to V6, with Lead III a flatline, aVR inverted and aVL, aVF both half amplitude, as can be predicted from the ECG Leads relationship. The ANE waveforms are more realistic, with all leads having similar but different waveforms. A key point to note with the ANE20000 waveform is the large S amplitude in V2, which usually triggers high ringing in high order mains frequency filters - more on that on another page.  

The CTS waveform data is somewhat of a mystery. in 2009 MEDTEQ successfully bought the waveforms from Biosigna for €400, but that organisation is now defunct (the current entity bears no relation). The standard states that the waveforms are part of the CSE database and available from INSERM, but this information is incorrect, INSERM is responsible for CSE only. According to Paul Rubel (INSERM), the CTS database was bought by Corscience, but their website contains no reference to the CTS database, nor where or how to buy it.  

Adding to the mystery, In the 2005 edition of IEC 60601-2-25 the CTS reference data was mentioned in the normative text but completely missing in the actual appendixes. The 2011 edition finally added the data but there are notable errors. Most of the errors are easily detected since they don't follow the lead definitions (for example, data for Lead I, II and III is provided, and this must follow the relation Lead III = Lead II - Lead I, but some of the data does not),  

Almost certainly, the situation is affected by a moderately wide group of individuals associated with the big manufacturers that are "in the know" and informally share both the waveform and reference data with others that are also "in the know" - otherwise it seems odd that the errors and omissions would persist. Those of us outside the the group are left guessing. The situation is probably illegal in some countries - standards and regulations are public property and the ability to verify compliance should not involve secret knocks and winks. 

The good news is that thanks to Biosigna, MEDTEQ and now Whaleteq has the CTS database embedded in the MECG software. And the reference data is now in the standard. This provides at least one path for determining compliance. We are not permitted to release the digital data. 

The experience from actual amplitude tests has been good. Most modern ECGs (software and hardware) are fairly good at picking out the amplitudes of the input waveform and reporting these accurately and with high repeatability. Errors can be quickly determined to be either:

• mistakes in the reference data (which are generally obvious on inspection, and can be double checked against the displayed waveforms in MECG software);
• due to differences in definitions between the ECG under test and those used in the standard;
• due to the unrealistic nature of the test waveforms (for example, CAL50000 with a QRS of 10mVpp still retains a P wave of just 150µV); or
• an actual error in the ECG under test  

For CTS interval measurements, results are mixed. Intervals are much more difficult for the software as you need to define what is a corner or edge (by comparison, peak is peak, it does not need a separate definition). Add a touch of noise, and the whole interval measurement gets messy. Which is probably why the standard uses statistical analysis (mean, deviation) rather than focusing on any individual measurement. Due to the statistical basis, the recommendation here is to do the full analysis first before worrying about any individual results. 

CSE Database

For the CTS database, the standard is actually correct to refer to INSERM to obtain both the waveform and reference data. The best contact is Paul Rubel (prubel.lyon@gmail.com). Unlike CTS, the CSE database uses waveforms from real people and real doctors were involved in measuring the reference data. As such it is reasonable to pay the US$1500 which INSERM requests for both the waveforms and reference data,

The MECG software already includes the CSE database waveforms, output in analogue form, as allowed  under the agreement with Biosigna. However it is still necessary to buy the database from INSERM to access the digital data and reference data.

More information and experience on the CSE database is provided in this 2014 article.

IEC 60601-2-25 Update Guide (2005 to 2011 edition)

For the second edition of this standard, IEC 60601-2-25 and IEC 60601-2-51 were combined and re-published as IEC 60601-2-25:2011 (Edition 2.0).

The standard has of course been updated to fit with IEC 60601-1:2005 (the 3rd edition). Also, similar to IEC 60601-2-27, the opportunity has been taken to correct some of the errors in requirements and test methods for performance tests that existed in the previous edition. However, compared to the update of IEC 60601-2-27, the changes are far more extensive making it difficult to apply the new standard in a gap analysis approach. Experience also indicates that historical data for existing equipment is often of limited quality, so it may anyhow be an excellent opportunity to do a full re-test against the new standard.

Despite the updated tests, it seems that significant errors still persist, which is to be expected given the number of complexity of the tests.

The table below provides an overview of corrections, changes and problems found to date in the new standard. This table was compiled during the real tests against new standard.

One major change worth noting is that requirements for ECG interpretation (the old clause 50.102 in IEC 60601-2-51) have been completely removed from the standard. There is no explanation for this, however the change is of interest for the CB scheme since it is now possible to objectively test compliance with all performance tests.

Table: List of changes, corrections and problems in IEC 60601-2-25:2011
(compared to IEC 60601-2-25:1993/A1:1999 + IEC 60601-2-51:2003)

Clause	Subject	Type	Content
201.1.1	Scope	Change	The scope statement has been reworded, so for unusual cases it should be checked carefully. There has been a common mistake that IEC 60601-2-25/IEC 60601-2-51 should not be applied to patient monitors, and a similar mistake can also expected for this edition. However, the correct interpretation has always been  that if the patient monitor provides an ECG record intended for diagnostic purposes, then diagnostic standard should also be applied. This would then depend on the intended purpose statement (and contraindications) associated with the patient monitor. However, manufacturers of patient monitors with 12 lead ECG options, with measurements of amplitudes, durations and intervals or automated interpretations might find it difficult to justify a claim of not being for diagnostic purpose.
201.5.4	Component values	Change	For test circuits, resistors are now required to be ±1% (previously 2%)
201.6.2	Classification	New	The ECG applied part must now by Type CF (previously there was no restriction).
201.7.4.101	Detachable lead wires	Change	Detachable lead wires must be marked at both ends (identifier and/or colour)
201.7.9.2.101	Instructions for use	Change	Requirements for the operation manual have been substantially modified in the new standard (see standard for details). Note: it seems that HF surgery got mentioned twice in item 6) and 12), possibly as a result of combining two standards (IEC 60601-2-25 and IEC 60601-2-51)
201.8.8.5	Defibrillator proof tests	Change	Due to the size of the clause, it is difficult to fully detect all changes. However, at least the following changes have been found: The test combinations (Table 201.103) now includes 12 lead ECGs (i.e. C1 ~ C6 should also be tested) The energy reduction test is now included (previously not required for diagnostic ECGs) The test with ECG electrodes is now removed The energy reduction test is a major change: many diagnostic ECGs have no series resistors which helps to limit noise, improve CMRR. To pass the energy reduction test, ECG lead wires should have at least 1k resistors and preferably 10k (as discussed in the technical article on Defibrillator Tests). With this series resistance, the impact of the ECG gel electrodes is reduced, and perhaps this is the reason for making the test with electrodes obsolete. The test result anyhow depended on the type of ECG electrodes, which is often outside the control of the manufacturer, making the test somewhat unrepresentative of the real world.
201.12.1.101	Automated interpretation	Change	Automated interpretation is now removed from the standard. Note that it is still expected to be covered by regulatory requirements, such as Annex X of the MDD.
201.12.1.101.1.2	Automated amplitude measurements	Correction	The limits stated in the requirements has now been corrected to match the test method (5% or 40uV). The reference values for CAL and ANE waveforms have now been included in the standard (Annex HH). The previous edition stated that these values were there, but they were missing.
		Problem	In the Annex HH reference data, the polarity of some S segment values is wrong (CAL 20500, aVL, aVF , and V3 for all of the ANE waveforms). There may be other errors that get revealed with time.
201.12.1.101.3	Automated interval measurements (CAL/ANE)	Problem	The requirement statement refers to global measurements (with 17 waveforms, up to 119 measurements), however the compliance statement refers to measurements from each lead (for a 12 lead ECG, up to 1428 measurements if all durations/intervals are measured). Not all ECGs provide global measurements, so this really should be clarified. Because of this it is also unclear about the removal of 4 outliers "for each measurement". If global measurements are used, this would imply that 4 out of the 17 measurements can be removed from the statistical analysis (which seems a lot). However, if lead measurements are used, this implies 4 out of 204 measurements, which is more reasonable.
201.12.4	General test circuit	Correction / change	The test circuit is now correctly and harmonized with IEC 60601-2-27:2011, IEC 60601-2-47 and also ANSI/AAMI EC 13. Previously the 300mVdc offset was placed in parallel with the test signal which meant the impedance of the dc supply appeared in parallel with the 100Ω resistor and reduced the test signal. The dc offset is now placed in series where this problem does not occur. However, it is noted that for one test the 300mV DC offset is still required to be applied "common mode" using the old circuit. Also, in the old standard the resistance between RL/N to the test circuit was 100Ω, whereas now it is a 51kΩ//47nF. A conservative interpretation is that all tests should be repeated with the new circuit, given the significant change (although experience indicates the results don't change).
201.12.4.101	Indication of inoperable ECG	Problem	The standard indicates that the test should be performed with 1V steps, up to 5V. However, the point of saturation normally occurs well below 1V (experience indicates this is from 400 - 950mV). This means it is possible to pass the test, without passing the requirement. The standard should instead require the dc voltage to be increased in steps of 5 or 10mV to ensure that the indication of saturation is provided before the signal amplitude starts to reduce.
201.12.4. 102.3.2	Test of network	Change	The previous test (application of 2mV and 6mV waveforms to various leads) is now replaced with the CAL and ANE waveform, with a limit of 10%
		Problem	The above change has interesting points. The first is that one might ask why the test is needed, since the CAL and ANE waveforms have already been tested under 201.12.1.101 (automated amplitude measurements). However, Clause 201.12.1.101 can be done by digital analysis, whereas this test is for the full system including the ECG's hardware. Also, not all ECGs measure all amplitudes.  It therefore requires the ability to generate CAL and ANE test signals by analogue (with laboratory 1% accuracy) which many laboratories may not have. That said, the test really does not really seem to test the networks correctly. As in the old standard, the networks are best tested by providing a signal to one lead electrode only, whereas the CAL/ANE waveforms provide the same signal to all leads simultaneously, except RA which is grounded. Although some analysis is required it seems clear that at least part of the lead network cannot be tested by the CAL/ANE waveforms. Finally, one might ask why there is a 10% limit for the test method, while the requirement statement says 5%. The reason could be that the basic measurement function is 5%, while the lead networks add another 5%, thus providing an overall 10% error. This is a clear relaxation on the previous edition, which seems unnecessary given that modern electronics (and software) easily handles both the measurement and network well below the 5% in the old standard.
201.12.4.103	Input Impedance	Correction	The previous version of the standard had an allowable limit of 18% (for reduction with 620k in series), but Table 113 incorrectly had an effective 6% limit. The 6% limit could be met at 0.67Hz, but most ECGs failed at 40Hz (the input impedance changes with frequency). The new standard now corrected this to a limit of 20%, aligned with IEC 60601-2-27. The requirement to test with a common mode 300mV to RL has been removed.
201.12.4.104	Required GAIN	Change / Problem	The previous standard included a test of a 1mV step to verify the sensitivity (mm/mV), with a limit of 5%. This test and the limit are now removed, which means there is no objective measurement to verify that a 1mV step corresponds to 10mm on the ECG record. This may or may not be deliberate: it opens the possibility that manufacturers may use a gain of "10mm/mV" in a nominal sense only, with the actual printed record being scaled to fit the report or screen. The classic 5mm pink background grid also then also scaled to give the appearance of 10mm/mV, even though the true measurement reveals strange values such as 7mm/mV (on a small screen) or 13mm/mV (on a printed record). Using the definition, "GAIN" is the "ratio of the amplitude of the output signal to the amplitude of the input signal". The text in 201.12.4.104 refers to the amplitude on the ECG record. Putting these together, it seems the literal interpretation is that 1mV input should be 10mm on the ECG record. Also several tests provide the allowable limits in mm (e.g. CMRR test limit is 10mm), if the outputs are scaled this would make little sense. But in the absence of any criteria (limit), it is all a bit vague. If scaling is allowed, it should be clearly stated, and limited to a suitable range otherwise it can get confusing (e.g. at "10mm/mV", a 1mV indication should be in the range of 8-14mm. The scaling and reference grid should be accurate to within 5%, although in the digital world, this may be not necessary to test beyond a spot check to detect software bugs. Finally all limits in the standard should be converted to mV or uV as appropriate.
201.12.4.105.1	CMRR	Change	The test is the same except that the DC offset is now included in the CMRR test box, and the RL/N lead electrode is no longer required to be switched (test is harmonized with IEC 60601-2-27). Previously, the standard indicated that the dc offset is not required, because it has been tested elsewhere.
201.12.4.105.3	Filter affecting clinical interpretation	New	The standard now requires the ECG report to include an "indication" that the clinical interpretation may be affected by filter settings (if applicable). However, there is no clear statement about what is an acceptable "indication". It could mean text such as "Warning the interpretation: might not be valid due to the use of filters"; on the other hand it could mean just making sure that the filters used are clearly shown on the record, perhaps adjacent to the interpretation (allowing the user to make thier own conclusion). What makes the issue more confusing is that some manufacturers might apply the filters only to the printed waveforms, while the interpretation is still performed on the unfiltered data (to ensure that the filters don't mess up to the interpretation), or worse, some kind of mixed situation (e.g. only mains hum filter is allowed for interpretation).
201.12.4.105.3	Notch filter effect (on ANE20000)	Change	The allowable limit for ringing in the ST segment has now been increased from 25uV to 50uV. Test experience indicates that the impact of notch filters for the waveform ANE 20000 on Leads I, II and III, aVR, aVL, aVF is minimal. However, the very large S amplitude on Leads V2 (1.93mV) and V3 (1.2mV) can cause a large amount of ringing in the ST segment, which is probably the reason for the change in limit. It is possible that previous tests have been limited to inspection of Lead II with the assumption that the ANE20000 waveform is the same for all leads (a mistake which the author has made in the past). In fact, the test should be done with a full 12 lead ECG simulator, with each lead inspected one by one. If the notch filter is applied in hardware (in part or full), the test should be done in analogue form.
201.12.4.106	Baseline, general	Change	Many of the baseline tests have now been removed, such as temperature drift, stability, writing speed and trace width, presumably because in the modern electronic / digital world these are not worth the effort to test. Most ECGs use a high pass filter and digital sampling, which means there is no real possibility for baseline drift.
201.12.4.106.2	Channel crosstalk	Change	The previous edition mixed up leads and lead electrodes (for example, putting a signal on RA/R results in a signal on Leads I, II, aVx, and Vx) so the criteria never made any sense. In practice the test needed to be adapted. Fortunately, this test has now been corrected and updated to give clear direction on where lead electrodes should be connected and also which leads to inspect for crosstalk. The test is the same as in IEC 60601-2-27:2011.
		Problem	In step c) of the compliance test, the standard says to inspect Leads I, II and III, but this appears to be a "cut and paste" typographical mistake. The correct lead is only Lead I (Leads II, III will have a large signal not related to crosstalk). Similarly, in step d) this should be only Lead III. Steps e), f) and g) are all correct.
201.12.4.107.1.1	High frequency response	Change	For frequency response, previously all tests A to E were applied, in the new standard only tests (A and E) or (A, B, C and D) are required. Also the limit for test E has been slightly reduced (made stricter) from -12% to -10%.
201.12.4.107.1.2	Low frequency response	Change	The allowable slope has been changed from 250uV/s to 300uV/s, perhaps in recognition that a single pole 0.05Hz high pass filter (typically used in many ECGs) could not pass the 250uV/s limit. Theoretical simulations showed that 0.05Hz single pole filter produces a slope of 286uV/s.
		Problem	Minor mistake in the standard: the requirement statement does not include the limit for the slope of 300uV/s. This is however included in the compliance statement.
201.12.4.107.2	Linearity and dynamic range	Change / problem	The previous test method used a 1mVpp signal, but required the minimum gain. For an ECG with typical minimum gain of 2.5mm/mV, this meant that the test signal was only 2.5mm, which then conflicted with the diagram. The new standard corrected this, but made the slight mistake of saying "10mV" rather than "10mm". But the test only makes sense if 10mm is used.
201.12.4.108.3.1	Time and event markers	Change / problem	It appears as if the authors of the standard were getting a bit tired by this stage. Both editions of the standard fail to provide a test method, and it is not really clear what to do. The compliance statement is effectively "X shall be accurate to within 2% of X", which makes no sense. In the latest edition, things have got worse, with the reference to test conditions referring to a clause that has no test conditions (201.12.4.107.3). In practice one would expect the time markers to be accurate to within 2% compared to either a reference signal (e.g. 1Hz for time makers of 1s), and/or against the printed grid. Of course, all of this really has not much impact in the digital world with crystal accuracy of 50ppm (software bugs notwithstanding).
201.12.4.109	Pacemaker tests	Change	The previous pacemaker tests (51.109.1 and 51.109.2) have been combined and extensively reworked: The requirement statement has been changed to include pacing pulses of 2mV to 250mV and durations 0.5 to 2.0ms The test circuit for pacemaker has been defined the point of measurement of amplitude after the pulse is changed from 50ms to 120ms (3mm) the test with the triangle pulse (or CAL ECGs) is removed the test method now includes a calibration step (item e)) to ensure the 2mV pulse is accurate there is now no requirement to declare the impact of filters (big point) the test is now clearly required for all electrodes, tested one by one as per Table 201.108
		Problem	Although the requirement statement refers to 0.1ms, there is no test for this.  Also, the status of filters is not clear. Most ECGs use hardware or software "blanking" when a pacing pulse is detected, leaving a clean ECG signal for further processing including filters. This means that the filter setting has no impact on how the ECG responds. However, some manufacturers don't use this method, allowing the display to be heavily distorted with the pulse, with the distortion varying greatly depending on the filters used. Ideally, the standard should encourage the former approach, but at least if heavy distortion can occur for some filter settings, this should be declared.

High Frequency, High Voltage - Measurement Accuracy

This article looks at some of the issues dealing with measurement uncertainty at high frequency found with IEC 60601-2-2 measurements, and the solutions offered by MEDTEQ. It provided in a Q&A format.  

Are oscilloscopes (scopes) and high voltage probes traceable at the frequency associated with ESU measurements?

Almost certainly no, although it is always worth to check specifications and calibration records. Most scopes and HV probes have accuracy specifications which only apply at "low frequency", typically less than 1kHz. Calibration normally follows the specification so only covers this low frequency area. Calibration at both high voltage and high frequency is an extremely difficult area and even the national standards laboratories have limited coverage (e.g. NIST is limited to 100Vrms/1MHz).

Most scopes and probes are designed to prioritise bandwidth and time base accuracy over accuracy in the vertical axis (voltage). They are not designed to provide stable, laboratory accuracy at high frequency, so traceable calibration would not make sense.

View fullsize

Example response shown in the "typical specifications" section of an active high voltage probe (as provided by the manufacturer). Note the visibly different zones at 10kHz, 100kHz and 1MHz indicating different compensation schemes are used. 

But the marking on the scope and probe show 100MHz? 

This is the "3dB bandwidth" which the frequency where the error exceeds 29%. This error is obviously too high for normal laboratory tests and may seem to have little practical meaning. In theory a laboratory could calculate the 1% bandwidth, around 14MHz for a 100MHz probe/scope. However, this assumes a simple, flat first order response which is not true - in order to achieve a wide bandwidth, various forms of adjustable compensation are applied, resulting in different measurements systems at different frequencies. It's not an exact science and most manufacturers target a flatness of around ±0.5dB for each component which is reasonable considering the difficulties. Even so, this is still a fairly high error of around ±10% for the full system (scope + probe), and exceeds the recommendation in IEC 60601-2-2. Also it should be clear that flatness in the passband is rarely part of the declared  or "guaranteed specifications". Traceability is a function of both the points of calibration and equipment specifications, since it is impractical to calibrate equipment under the full range of use. Or to put it another way, if equipment is used outside of the specified range, it should be calibrated at the points of interest, i.e. for IEC 60601-2-2, calibration should be performed at 400kHz.  

View fullsize

A good quality DMM such as the Fluke 8845A will clearly indicate the errors at different frequencies as part of the formal specifications. Scopes and probes don't have these formal specifications, even though labelled for high frequency. 

Does the same issue apply to DMMs (digital multimeters)?

No - good quality DMM manufacturers declare not only the headline accuracy, but also the frequency range which the accuracy is maintained. Within a this range, DMM measurement systems are typically designed to be inherently flat with no frequency compensation. As such, calibration at 50Hz, for example, can be considered representative of 500Hz, 5kHz and 50kHz if these frequencies are in the specified range.   

In contrast, probes and scopes employ various compensation schemes which take over at higher frequencies. In HV probes for example, the measurement system at 50Hz is completely different to the system used at 50kHz. As such, it is not possible to say that measurement at low frequency is representative of higher frequencies.

It is not to say that scopes and probes are bad, it is extremely (incredibly) difficult to provide flat passband for the wide range of voltages and frequencies which users demand. And in many cases 10% is fine . Perhaps the only complaint is the way specifications are written can easily lead a user to assume the low frequency specifications also apply at mid range frequencies in the passband.   

What if the probe compensation adjustment is done? 

Compensation adjustment is import to keep the accuracy in the ±0.5dB (~6%) range. But it is an approximate method, typically performed at 1kHz only and not suitable to establish legal traceability. It is noted that many scopes and probes exhibit different errors at different frequencies. Compensation is also usually capacitance based, which is much more susceptible to temperature, time, frequency and voltage than a resistor based system. Compensation also depends combination of the probe with the particular scope, channel and cable used.  

Are there other issues?

Apart from the basic frequency response, there are a number of other issues which can affect accuracy. Most oscilloscopes are only 8 bit in the first place which is just 256 steps from top to bottom of the screen (a typical 4.5 digit DMM has 40000 steps). Scopes also have 2-3 LSBs of noise. This means for example, on a scope set to 2kV/div (±8kV range), the noise will be around 200V. This alone is 5% of a 4000Vp waveform, which is on top of the bandwidth issues above. From experience, dc offsets in the scope and probe (in particular, active probes) can easily add another 2-3% and are often unstable with time. This makes peak measurements at best a rough indication in the 10-15% range for a typical set up. 

For rms measurements, the scope sample rate and sample length need to be sufficient for an accurate calculation. As a general rule of thumb, you should have at least 10 cycles for a low crest factor waveform, and 20 cycles or more may be needed for high crest factors.  However, too many cycles can slow the sample rate so that information is lost. Some scopes offer "cycle rms" which eliminates the problem, but the algorithm for detecting a "cycle" should be checked as it is possible for the software to be confused by pulse waveforms.  

Why is it so difficult?

The technical issues with accurate rms measurement increase as a function of Vrms²x frequency. Wide bandwidth requires low resistance to minimise the impact of stray capacitance and other effects (e.g. standard 50Ω), but low resistance is not practical at high voltage due to the power and heat (try putting 100Vrms on a 50Ω resistor). Another problem is that main use of scopes is for diagnostic purpose and timing, hence the widespread use of 8 bit resolution which is more than enough for those tasks. As scopes went digital, the temptation obviously exists to add various measurement functions such as peak and rms. But these software functions and the associated measurement systems were never really scrutinised by the industry as to whether they provided reliable measurements with traceable accuracy.   

Why can MEDTEQ offer accurate, traceable measurement?

The MEDTEQ equipment tackles a relatively small range up to 1MHz and up to 1200Vrms with analogue based designs (compared to 100MHz/20kVrms offered by probes/scopes). This smaller area is challenging but not impossible.

A first target was to develop a reliable 1000:1 divider for use in the MEDTEQ HFIT (High Frequency Insulation Tester). After many years of experimenting with chains of SMD resistors, it was finally established that that the upper limit for a resistive divider without compensation was 300Vrms for 0.1% error at 500kHz (11MHz 3dB bandwidth). Beyond this, the competing constraints of power dissipation and bandwidth cannot be met. This was based on literature, experiments to determine stray capacitance for mounted SMD parts, modelling and tests.

To handle the higher voltages up to 7200Vp/1200Vrms as associated with the HFIT 7.0, a chain of "mica" capacitors are used. In general, capacitors are unreliable in measurement systems, being susceptible to voltage, frequency, temperature and time. However, mica capacitors are known for their stability under a wide range of conditions. Experience with this design, including units returned for periodic calibration have given confidence in this solution better than 0.5% from 320-460kHz (the range of HFIT use).    

To calibrate the divider, specially developed HF meters have been used . It is planned to release a range of meters around mid-2017 under the name "HFVM" (high frequency voltmeter). To calibrate the divider, two HFVMs are used, one with a range of 200V, and a second meter with 200mV. A "home made" high frequency amplifier is driven by a digital function generator is used to provide around 150Vrms at the test frequencies of 320kHz/400kHz/460kHz. An oscilloscope monitors the test waveform for harmonic distortion and confirm it is <0.3%.  

Although the current HFIT 7.0 contains only 1000:1 divider, the HFIT 8.0 (under preliminary release) includes also internal metering using the HFVM design. The preliminary release versions were validated and performed well within the 2% design specification when compared against external reference methods, over a wide range of voltages, crest factors.    

How are the HFVMs designed? 

Inside the HFVM, rms voltage is derived from the "explicit" method, which separates the measurement into three stages: square -> mean -> square root. This is known to have a relatively wide bandwidth, and the core device for squaring the waveform has a 40MHz bandwidth. The explicit method has a complication in the wide dynamic range in output of the square stage. Fortunately this complication is unrelated to the frequency response, and so could be investigated and solved at low frequency. In contrast, modern DMMs use an "implicit" (feedback) rms/dc solution which does not suffer the wide dynamic range, but has limited frequency response.  

For peak detection, MEDTEQ has invented a new method which has the equivalent accuracy of a 13 bit scope running at 100MHz, but without the complication. It is a simple method which can be thought of as a hybrid between hardware and software, with an algorithm that searches for the peak, rather than measuring it. A key benefit of this approach is that it does not use any diodes as are common in peak detection, as diodes are difficult characterise at high frequency with parameters such as diode reverse recovery time, leakage and capacitance influencing the result.  

How is rms traceability provided?

The HFVMs are calibrated against a Fluke 8845A 6.5 digit meter, itself calibrated by JQA. They are tested at a "comfortable" frequency such as 1kHz or 10kHz where the Fluke has high accuracy specifications and there are no questions about traceability.

To verify the bandwidth, the HFVM is validated against thermal methods, using MEDTEQ's HBTS which has 0.01°C resolution, and can be set up to detect errors as small as 0.1% deviation from 50Hz to 500kHz. A home made device called "HFCAL" provides a stabilised output within 0.1% from 5kHz to 500kHz (the HFCAL itself is not calibrated as the stability is confirmed by thermal methods). A typical set up uses a 50.00Vrms which is connected to the Fluke, HFIT, and an a resistor designed to have around 20°C rise. The resistor is kept in a specially designed thermal block which can detect rms voltage changes of 0.1% or better as verified at low frequency, again using the Fluke as the traceable reference. The Fluke is then removed, and the frequency adjusted to 10, 20, 50, 100, 300, 400 and 500kHz. Via the temperature observed by the HBTS, the rms output of the HFCAL can be monitored as being stable within 0.2%. The indicated values of the HFVM is also observed and confirmed to be within 50.00Vrms ±0.1%.    

Due to the complexity of working in high frequency, the HFVM is also designed to be inherently accurate (for both peak and rms), which means they works "as assembled" without any adjustments. All potentially limiting factors such as resistor tolerances, op-amp slew rate, stray parameters and the like are designed to be negligible. The design bandwidth is >11MHz, the point calculated to have 0.1% error at 500kHz. No frequency compensation is applied. This focus on an inherently accurate design is considered important as ensures the thermal validation above is genuinely independent. It would not be acceptable if, for example, the HFVM included compensation at high frequency that was first adjusted using a thermal method, and later verified by a similar method.

The thermal experiments above have also been repeated many times in both ad-hoc and formal settings, and the HFVM itself has undergone several iterations. Despite different configurations, components, resistors the design has given a reliable 0.2% bandwidth of 500kHz, which is far more accurate than required for IEC 60601-2-2 testing.  

Is MEDTEQ traceability legal?

Yes and no. Traceability itself is provided as described above. However, a medical device manufacturer would be using MEDTEQ as a subcontractor (or supplier) for purpose of the regulations such as the medical device directive. This is fine as long as some kind of assessment is performed to confirm that MEDTEQ is an appropriate supplier. Recently, HFIT calibration/shipping reports are provided with an explanation how traceability is provided. However, in the future it is planned to provide a detailed validation report, similar to what might be expected for software validation of test equipment.

What about laboratory ISO 17025 traceability with accreditation?

No. In addition to traceability itself, ISO 17025 requires quality assurance, management systems, insurance and audits by an accreditation agency. MEDTEQ cannot offer this. Calibration agencies are being contacted for support to develop a special program for the high frequency, high voltage area.

In the background it has to be kept in mind that no virtually no accredited agencies work in the high voltage/high frequency region. As such, there may be two options available:

1. Refer to the calibration of the high voltage probes and scopes. This is the current practice and accepted for the time being. But keep in mind the potential for real world errors especially in poorly adjusted high voltage probes; equipment settings and other issues mentioned above. Use the MEDTEQ devices (e.g. HFIT divider) as cross check and investigate the errors.
   
   or
    
2. Discuss with the lab QA department/accreditation agencies for special allowance until such time as traceable calibration is provided by ISO 17025 accredited agencies. In pure regulations and accreditation only traceability is required. There will always be some unusual situations where accredited 3rd party ISO 17025 calibration simply does not exist. While internal procedures or accreditation agencies may ISO 17025 calibration, exceptions to the rule should be allowed as long as it is properly documented (e.g. basis for traceability).    

IEC 60601-2-2 Dielectric heating

This article has been transferred from the original MEDTEQ website with minor editorial update.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The mechanism of breakdown at high frequency is different to normal mains frequency dielectric strength tests - it can be thermal, rather than basic ripping apart of electrons from atoms. Also, for mains frequency tests, there tends to be a large margin between the test requirement and what the insulation can really handle, meaning that errors in the test method are not always critical. In contrast, the margin for HF insulation can be slight, and the test method can greatly affect the test result.

HF burns, in part due to insulation failure, continue to be a major area of litigation. Of particular concern is the high fatality rate associated with unintentional internal burns which may go unnoticed.

For those involved in designing or testing HF insulation, it is absolutely critical to have a good understanding of the theory behind HF insulation and what causes breakdown. This article looks into the detail of one of those mechanisms: thermal effects. 

---

Theory

All insulating materials behave like capacitors. With an ac voltage applied, some current will flow. At 230V 50/60Hz, this amount of current is very small, in the order of 20uA between conductors in a 2m length of mains cable. But at 300-400kHz, the current is nearly 10,000 times higher, easily reaching in the order of 10mA at 500Vrms, for just short 10cm of cable.  

All insulating materials will heat up due to the ac electric field. This is called dielectric heating or dipole heating. One way to think of this is to consider the heating to be due to the friction of molecules moving in the electric field. Microwave ovens use this property to heat food, and dielectric heating is used also in industrial applications such as welding plastics. These applications make use of high frequency, usually in the MHz or GHz range.

At 50-60Hz the amount of heating is so small it amounts to a fraction of a fraction of a degree. But again at 300-400kHz the amount of heating can be enough to melt the insulation.

The temperature rise caused by dielectric heating can be estimated from:

dT = 2π V² f ε₀ε_r d t / H D d²      (K or °C)

Although this is a rather complicated looking formulae, it is mostly made up of material specific parameters that can be found with some research (more details on this are provided below). To get some feel for what this means, let's put this in a table where voltage and thickness are varied, for a frequency of 400kHz, showing two common materials, PVC and Teflon:

Predicted insulation temperature rise @ 400kHz

Voltage	PVC Insulation Thickness (mm)
(Vrms)	1	0.8	0.6	0.4	0.2
	Temperature rise (K)
200	0.7	1.1	1.9	4.3	17.3
400	2.8	4.3	7.7	17.3	69.3
600	6.2	9.7	17.3	39.0	156.0
800	11.1	17.3	30.8	69.3	277.3
1000	17.3	27.1	48.1	108.3	433.3
1200	25.0	39.0	69.3	156.0	623.9

 Table #1: Because of a high dissipation factor (d = 0.016), PVC can melt at thicknesses commonly found in insulation. 
For broad HF surgical applications, a thickness of at least 0.8mm is recommended 

Voltage	Teflon Insulation Thickness (mm)
(Vrms)	0.5	0.3	0.1	0.05	0.03
	Temperature rise (K)
200	0.0	0.1	0.5	2.1	5.9
400	0.1	0.2	2.1	8.5	23.7
600	0.2	0.5	4.8	19.2	53.4
800	0.3	0.9	8.5	34.2	94.9
1000	0.5	1.5	13.3	53.4	148.3
1200	0.8	2.1	19.2	76.9	213.5

 Table #2: Teflon has a far lower dissipation factor (less than 0.0002), so even 0.1mm is enough for broad HF surgical applications. 
However, because of Teflon's superior qualities and high cost, insulation thickness is often reduced to around the 0.1mm region

For PVC insulation, these predicted values match well with experimental tests, where a small gauge thermocouple was used as the negative electrode and the temperature monitored during and after the test. For insulation with thickness varying between 0.3mm and 0.5mm, temperatures of over 80°C were recorded at voltages of 900Vrms 300kHz, and increasing the voltage to 1100Vrms resulted in complete breakdown.

---

Practical testing

As the formulae indicates, the temperature rise is a function of voltage squared, and an inverse function of thickness squared. This means for example, if the voltage is doubled, or the thickness is halved, the temperature rise quadruples. Even smaller variations of 10-20% can have a big impact on the test result due the squared relation.

Because insulation thickness varies considerably in normal wiring, it is possible that one sample may pass while another may not. Although IEC 60601-2-2 and IEC 60601-2-18 do not require multiple samples to be tested, good design practice would dictate enough samples to provide confidence, which in turn depends on the margin. For example, if your rated voltage is only 400Vrms, and your thickness is 0.8+/- 0.2mm, then high margin means the test is only a formality. On the other hand, if your rating is 1200Vrms, and the thickess if 0.8+/-0.2mm, perhaps 10 samples would be reasonable.

Test labs need to take care that the applied voltage is accurate and stable, which is not an easy task. Most testing is performed using HF surgical equipment as the source, however, these often do not have a stable output. Also, the measurement of voltage at HF is an area not well understood. In general, passive HV probes (such as 1000:1 probes) should not be used, since at 400kHz these probes operate in a capacitive region in which calibration is no longer valid (see here for more discussion) and large errors are common. Specially selected active probes or custom made dividers which have been validated at 400kHz (or the frequency of interest) are recommended.   

Perhaps the biggest impact to the test result is heat sinking. The above formulae for temperature rise assumes that all the heat produced cannot escape. However, the test methods described in IEC 60601-2-2 and IEC 60601-2-18 do not require the test sample to be thermally insulated. This means, some or most of the heat will be drawn away by the metal conductors on either side of the insulation, by normal convection cooling if the sample is tested in an open environment, or by the liquid if the sample immersed in fluid or wrapped in a saline soaked cloth.  

This heat sinking varies greatly with the test set up. The test in IEC 60601-2-2 (wire wrap test) is perhaps the most severe, but even something as simple as the test orientation (horizontal or vertical) is enough to substantially affect the test result.

Because of these three factors (variations in insulation thickness, applied voltage, heatsinking) bench testing of HF insulation should only be relied on as a back up to design calculations. Test labs should ask the manufacturer for the material properties, and then make a calculation whether the material is thermally stable at the rated voltage and frequency. 

The above formulea is again repeated here, and the following table provides more details on the parameters needed to estimate temperature rise. The temperature rise should be combined with ambient (maybe 35°C for the human body) and then compared to the insulation's temperature limit.

dT = 2π V² f ε₀ε_r d t / H D d²      (K or °C)

Symbol	Parameter	Units	Typical value	Notes
V	Test voltage	Vrms	600 - 1200Vrms	Depends on rating and test standard. Note that ratings with high peak or peak to peak values may still have moderate rms voltages. Under IEC 60601-2-2, a rating of 6000Vp would require a test with 1200Vrms.
f	Test frequency	Hz	300-400kHz	Depends on rating. Monopolar HF surgical equipment is usually less than 400kHz1.
ε0	Free space permittivity	F/m	8.85 x 10-12	Constant
εr	Relative permittivity	unit less	~2	Does not vary much with materials
δ	Dissipation factor	unit less	0.0001 ~ 0.02	Most important factor, varies greatly with material. Use the 1MHz figures (not 1kHz)
t	Test time	s	30s	IEC 60601-2-2 and IEC 60601-2-18 both specify 30s
H	Specific heat	J/gK	0.8 ~ 1	Does not vary much with materials
D	Density	g/cm3	1.4 ~ 2	Does not vary much with materials
d	Insulation thickness	mm	0.1 ~ 1	Based on material specification. Use minimum value

 ¹Dielectric heating also occurs in bipolar applications, but due to the significantly lower voltage, the effect is much less significant.   

IEC 60601-2-2 201.8.8.3 High Frequency Dielectric Strength

Experience indicates there are two main causes for insulation failure at high frequency: thermal and corona. Both of these are influenced by the higher frequency of the test waveform and the effects may not be well appreciated for the test engineer more familiar with mains frequency testing. 

Thermal

In addition to high voltage, electrosurgery devices also operate at a relatively high frequency of around 400kHz. At this frequency, surprisingly high currents can flow in the insulation - roughly 8,000 times higher than those at mains frequency. For example, a 50 cm length of cable immersed in saline solution tested at 1000Vrms/400kHz can easily have over 200mA flowing through the insulation, creating a sizeable 200VA load.

Although this VA load is predominately reactive or apparent power (var), insulators are not perfect and a portion will appear as real power in watts. This is determined by the dissipation factor (δ) of the material. Some materials like PVC have a high factor (δ around 0.01-0.03), which means that 1-3% of the total VA load will appear as heat. In the example above, if the test sample was PVC insulation with δ = 0.02, it means the test would create 4W of heat (200VA x 0.02). That heat can be enough to melt the insulation, causing dielectric breakdown.

The theory is discussed in more detail in this article from the original MEDTEQ website. As the article indicates, key factors are:

• the rms test voltage, with heat is proportional to Vrms squared

• thickness of the insulation, with heat inversely proportional to thickness squared

• material dissipation factor

• the test set up (availability of heatsinks such as liquids, electrodes)

While it is obvious the authors of IEC 60601-2-2 are aware of the thermal effects, the test in the standard seems to be poorly designed considering these factors. First, the standard concentrates on peak voltage and has a fairly weak control of the rms voltage. Secondly it is expected that thickness is not constant, so testing multiple samples may make sense, particularly for thin insulation. And thirdly the heatsink effect of the set up should be carefully considered. 

In critical situations, good manufacturers will opt for low dissipation factor materials such as Teflon, which has δ ~ 0.001 or 0.1%. This ensures safety in spite of the weakness in the standard. Even so, thin insulation in the order of 100µm can still get hot - keeping in mind heat density is a inverse function of thickness squared (1/t²), which means that half thickness is four times as hot.  

Conversely, very thick insulation can be fine even with high dissipation factors. Thick PVC insulation on a wiring to an active electrode can often be an acceptable solution, and concerns over the test set up need not be considered. 

A test developed by MEDTEQ is to enclose the sample in 50µm copper foil (commonly available) with a thermocouple embedded in the foil and connected to a battery operated digital thermometer. The foil is connected to the negative electrode (prevents any damage to the thermometer), with the active electrode connected to the high voltage.  During the test the thermometer may not read accurately due to the high frequency noise. However, immediately after the test voltage is removed, the thermocouple will indicate if any significant heating occurred. For 300V PVC insulation tested at 1000Vrms/400kHz, this test routinely creates temperatures in the order of 80-100°C, demonstrating that the material is not suitable at high frequency. A similar test can be done by coating the foil in black material, and monitoring with an IR camera.

This test has been useful in discriminating between good and bad materials at high frequency. It is a common rookie mistake for those seeking to break in to the active electrode market to reach for materials with high dielectric strength but also high dissipation factors.  

The potential for high temperatures also raises a separate point overlooked by the standard: the potential to burn the patient. It may be that real world situations may mitigate the risk, but it would seem theoretically possible that insulation could pass the test while still reaching temperatures far above those which could burn the patient. This again supports a leaning towards low dissipation materials, verified to have low temperatures at high frequency.  

Corona 

Corona is caused when the local electric field exceeds that necessary to break the oxygen bonds in air, around 3kV/mm. In most tests, the electric field is not evenly distributed and there will be areas of much higher fields typically close to one or both electrodes. For example, electrodes with 2kV separated by 3mm have an average field of just 666V/mm, well below that needed to cause corona. However if one of the electrodes is a sharp point, the voltage drop occurs mostly around that electrode causing gradients around the tip above 3kV//mm. This creates a visible corona around that electrode, typically in the form of a purple glow, and ozone as a by product.

In the context of dielectric strength, corona is not normally considered a failure. Standards including IEC 60601-2-2 indicate that it can be ignored. This makes sense for normal electrical safety testing: firstly, corona is not actually a full breakdown, it is a local effect and an arc bridging both electrodes rarely occurs. Secondly, dielectric strength is intended to test solid insulation, not the air. In particular most dielectric strength tests are many times larger than the rated voltage (e.g. 4000Vrms for 2MOPP @ 240V in IEC 60601-1). This high ratio between the rating/test is not a safety factor but instead an ageing test for solid insulation. In that context, corona is genuinely a side effect, not something that is representative of effects that can be expected at rated voltage.  

Unfortunately this is not true for high frequency insulation. Firstly, the test is not an ageing test which means the ratio between the test voltage and rating is much closer, just 20%. That means that corona could also occur at real voltages used in clinical situations. Secondly, corona can damage the surface of the insulation, literally burning the top layer. In many applications the active electrode insulation needs to be thin, such as catheter or endoscopic applications. If for example the insulation is only 100µm thick, and corona burns off 50µm, the dielectric strength or thermal limits of the remaining material can be exceeded, leading to complete breakdown. Analysis and experience also indicates that the onset of corona for thin insulation is quite low. Finally, there is reference in literature and anecdotal evidence that the onset of corona is lower at high frequency by as much as 30% (i.e. ~2kV/mm). 

From experience, corona is the most common cause of breakdown in actual tests for thin insulation. But the results are not consistent: one sample may survive 30s of corona, while another breaks down. The onset of corona is also dependent on external factors such as temperature and humidity, and the shape of the electrodes. In tests with saline soaked cloth, corona occurs around the edges and boils off the liquid, leading to variable results.

Practical experience suggests that the wire wrap test is the most repeatable. This creates corona at fairly consistent voltage, and consistent visible damage to the surface of the insulation. Breakdown is still variable suggesting that a number of samples are required (e.g. 10 samples). Temperature and humidity should be controlled.

Currently IEC 60601-2-2 states that corona can be ignored, allows tests on a single sample and uses the wire wrap test for certain situations only. In the interests of safety, manufacturers are recommended to consider using the wire wrap test for all active insulation, and to test multiple samples, or consider regular samples from production.     

IEC 60601-1-10 Scope (Physiological closed loop controllers)

The standard IEC 60601-1-10 applies to physiologic closed loop controllers (PCLC): devices that try to control a physiological parameter through feedback. A simple example is an infant incubator where the system controls body temperature using a sensor placed on the infant.

Despite being obviously applicable for many devices, there are bound to be some borderline situations where it is unclear if the standard should apply.

In Annex A of the standard, several examples are given as systems which are not PCLCs. Example #3 is a ventilator, which can control parameters like flow, pressure and volume and breathing rates. The conclusion of the committee was that pressure is not measured “from” the patient, and therefore a  pressure controlled ventilator is not a PCLC.

But it is cited as being a difficult example to analyze, and it is worth to look closer why. The problem is that volume, pressure, flow and breathing rates are all parameters that could be considered physiological. Why then are the PCLC requirements not applicable?    

The key may come down to the part of the system called the “patient transfer element”, which is shown as element “P” in Figure 1 in the standard (refer to the standard for context / definitions):

According to the rationale (Annex A, sub clause 1.1), the “…standard was developed [in part] to address … the difficulty in adequately characterizing the PATIENT TRANSFER ELEMENT”. This suggests the nature of the patient transfer element is important in determining the scope.

In the case of, for example, a blood glucose controlled insulin pump, there is a complex body process between the injection of the insulin through to the final blood glucose level.  The modelling of this process is obviously critical to the overall loop performance, and should be well documented.

Similarly for an infant incubator (in “baby controlled mode”), the output of the control system is heat (power, in Watts), which the infant’s body converts into body temperature (°C).

In these cases, we can clearly see that there is a non-unity transfer element (P ≠ 1) between the equipment’s output (m) and the physiological parameter we are trying to control (y).

In contrast, for a ventilator there is in effect a unity patient transfer element – parameters like airway flow and pressure are both the system output and the parameters used for control, as well as being (potentially) a physiological variable. In this case, m = y, and P = 1. Although the patient influences the system, it acts only as a variable load, and does not form part of the feedback loop.

Another way to look at this is to say that a patient’s physiologic variable just happens to coincide with a non-physiological parameter that used for control. For example, a pacemaker may output a fixed rate of 60bpm, which under normal conditions coincides with the patient’s heart rate, a vital physiological parameter. Nevertheless, the pacemaker does not use the patient’s heart rate for control, and it does not form part of a feedback loop.

So an improved definition may be that PCLC is a system where a physiologic variable is used for feedback, and where there is an identifiable non-unity patient transfer element (m≠y) that forms part of the control loop.

Unfortunately the above interpretation cannot be directly taken from the normative part of the standard. If a system exists where P = 1 (and m = y), nothing could be found in the scope statement, and definitions which would clearly exclude such a system from the standard.

However, the interpretation can be supported by noting that all the examples of PCLCs in standard have non-unity patient transfer elements. Further, it helps to better explain why example #3 in Annex A is not considered a PCLC.  Finally, the title of the standard refers to a “closed loop”, it is logical to expect that the physiologic variable necessarily forms part of the loop. The fact that a loop variable is the same as a physiologic variable is not enough condition to be considered a PCLC.

The standard should remain be an important reference where the patient or environment forms a variable load on the output of a control loop. The ability of control loops to respond to disturbances (e.g. door opening in an infant incubator operating in air controlled mode) is often not well documented in risk management, specifications or general design control. Nevertheless, the fact that a system is susceptible to external disturbances should not be a criteria for determining if the standard IEC 60601-1-10 is applicable.

IEC 60601-1-8 Alarms, Sound level measurement

Material here is transferred from the original MEDTEQ website, last updated 2015-10-27

Many medical devices include alarms, and both collateral and particular standards specify sound level measurements.

But, there is a trap: the beeping sounds from alarms often have strong tones. When a sound is made up of tones, reflections create an interference pattern where the difference between spatial maximum and minimums in the region of interest can be in the order of 10dB.

You can experience this by simply playing a 1kHz tone from your PC (click on the MP3 file right). As you play this file, walk around the room very slowly and note the changes in sound level. The interference pattern is caused by reflected sound from walls and the floor which can either add or subtract with the direct  sound depending on the phase difference at the point in space. If you are careful, you can find places where the sound almost disappears as the reflected waves cancel out the direct wave. For a 1kHz waveform, these peaks and troughs should around 15-20cm apart. As the frequency increases, the space between the peaks and troughs will reduce.

 

You might expect that this problem is eliminated by using the “free field over a reflecting plane as specified in ISO 3744”, referenced in IEC 60601-1-8 and a number of particular standards. But it turns out that the strongest reflection will actually come from the “reflecting plane” - a scientific term meaning the floor - and this reflection alone can cause a large interference pattern. The above graphs are actually simulated using only a single reflecting plane (floor). The graph on the left is the expected variation as a meter is kept at 1m above the floor and moved away from the sound source. The graph on the right is the variation with the sound level meter 1m away, and the height from the floor for both the source and meter is varied. The location of the peaks and valleys will also change with the frequency of the source.

It's also reasonable to expect that the requirement in IEC 60601-1-8 to have at least 4 harmonics within the 1kHz to 4kHz will fix this issue, since the reflection pattern will be different at different frequencies. But the standard allows up to ±15dB between harmonics and the fundamental, which is rather large. The upshot is that one particular harmonic can easily dominate the sound level measurement.

Moreover the test sample, and any supporting device such as a table is not a point source. Simulations show that a rectangular object emitting sound in free space will still create an interference pattern, simply due to the different time that sound from different parts of rectangle reach a certain point in space.

To put it bluntly, trying to measure sound pressure is a mugs game for sounds with strong, discrete tones.

So what is going on? How can we have a fixed requirements when the test method is hopelessly unrepeatable? 

It turns out there is a fundamental error in medical standards that reference ISO 3744. The standard ISO 3744 is intended to estimate the sound power level from the source. It does this by taking many sound pressure measurements (up to 20) around a surface which encloses the noise source against the reflecting plane. These measurements are then integrated to find the power level from the source itself. The spacing of these measurements is such that interference patterns are largely canceled out, so the test environment does not have to be a perfect anechoic chamber, rather the test is intended for use in a broad range of locations. The standard also correctly assumes that sound will not emanate from a single point (i.e. the speaker), but rather that all parts of the enclosure will be involved in the transmission of sound to the outside world; again multiple measurements help to "collect" all the sound power irrespective of the shape of the test item. The reflecting plane(s), while causing an interference pattern, also help to reflect the sound power to the measurement points.

What's the difference between sound power and sound pressure? It's a bit like power and temperature. Think of a 10 ohm resistor in a power supply which has 2Arms flowing through it. We can estimate the power of the resistor quite accurately as 40W. The power emitted is relatively independent of the environment. But the temperature of a part 10cm away from the power resistor is a complex function of many factors, the physical layout, material properties, air flow and so on. We know that increasing the power increases the temperature, but we cannot predict the actual temperature without measuring it. And most importantly, even though we measure the temperature of one part 10cm away, it does not mean that all parts at 10cm have the same temperature.

In the same way, a speaker will emit a fairly constant amount of sound power irrespective of the environment. However, the sound pressure will be complex function depending on the environment, including construction of the medical device itself (in much the same way as the speaker's box also influences sound pressure). A measurement a one point 1m away will not be representative of another point 1m away.   However, by taking many sound pressure measurements around an object, we can use the properties of air and the surface area of the measurement framework to estimate the sound power from the source.  

One reason why we quickly become confused between sound power and pressure is they both use a dB scale. However, the underlying units are the watt (W) and Pascal (Pa). The dB scale simply reflects a wide range over orders of magnitude. Sound power and sound pressure are as different as resistor power and resistor temperature - they are related but definitely not the same thing.  

It appears the IEC 60601 series has originally fallen for the trap of treating sound power and sound pressure as the same thing, and in doing so ignored many of the issues associated with measurement of sound pressure. 

Fortunately, the committee for IEC 60601-1-8 has finally woken up to this, and in the latest amendment 1 issued in 2012 now a number of measurements are required according to Annex F in ISO 3744, with the measurements averaged. Although they missed the final step of converting sound pressure to sound power, the process of averaging in effect acheives a similar purpose. A word of warning though to the unsuspecting; averaging sound pressure is not simply averaging the readings in dB. To get the correct average, the readings should be in pressure, which means first converting to a non-logrithmic representation, averaging, and then convert back to dB. Mathematically it is not necessary to convert to any particular unit of pressure, the main point is that the average should be performed on the "anti-log" representation. For example, three values 72, 70 and 62dB incorrectly averaged in dB gives 68dB, but if averaged in pressure and converted back is 69.75dB, roughly 2dB higher. 

While the 2012 amendment is an improvement, technical issues remain: 

• Annex F is intended for measurements at least 4m away from the source. The calculations of the measurement points in Table F.1 refer to Table F.2, which only has values for 4m and above. Since IEC 60601-1-8 clearly specifies a measurement radius of 1m, it appears to be a technical oversight making the standard impossible to use. Further checking in the standard reveals that Annex F is intended for outdoor noise measurements, where reflections are not expected (e.g. not for indoor). Even ignoring the technical mismatch with Table F.2, it seems possible the measurements under Annex F will not yield repeatable results. 
   
• For the measurement of harmonics, the standard specifies a single point measurement 1m away from the equipment. However, both theoretical analysis and experimental evidence show that harmonics vary greatly with the small changes in the position of the sound level meter. This is because the interference pattern will be different for each frequency (again, even the reflecting floor will produce interference patterns). The requirements for harmonics are relative, so ignoring reflections the exact position of the meter is not critical. To eliminate the effect of reflections, it is recommended the measurements should be made with the meter positioned fairly close to the equipment's speaker, e.g. 5cm away. Experiments with this found the relative harmonics to be consistent when measured close to the equipment, irrespective of the exact position of the meter.
   
• For relative priority (high > medium > low), the measurements rely on Annex F at 1m, which is still influenced by reflections and high uncertainty. Designers often only have a small difference between the sound level of different types of alarms, so errors in the test method can produce false negative results. Since the measurements are relative, it again makes sense to use a single point measurement at a point close to the equipment where the influence of reflections and the interference pattern are negligible.  
   

In general, a formal test for sound level measurement according to ISO 3744 can be expensive yet still give poor quality results. Also, a major point in the whole test is missing; an appropriate criteria. Criteria have been specified for harmonics, pulse characteristics, and relative priority and these are fairly easy to measure with relatively at low cost (noting the technical points above). But the main criteria in the standard for the ISO 3744 sound level measurement is simply to match what is disclosed in the instructions for use. This does not address the original point of the risk control: getting the operator's attention. According to the fundamentals of risk management, we need to judge if a risk control is effective, which in turn will require a judgment on whether the sound level is sufficient. This is certainly difficult and complex subject, but nevertheless, unless a criteria is developed, there seems little point in making expensive and complicated sound level measurements.

So what is the solution? 

One possibility is to formally change the criteria to sound power, rather than sound pressure, with a simple reference to measurements under ISO 3744. There is no need to specify the position or radius of measurement and so, use of Annex F etc, these are all handled in ISO 3744 and are judgments made by test lab.

Experiments could then be performed to develop appropriate ranges for sound power for typical situations, e.g. operator always near the equipment (within 1m); an operator in a quiet medium sized room (e.g. operating theater); noisy medium size room (e.g. general ward) and so on.

Finally, a manufacturer could choose to bypass the ISO 3744 test by estimating sound power from the speaker specifications. Although there is greater uncertainty with this method, it might be more reasonable if the sound level is adjustable. And given that sound power measurements are anyhow fairly rough, this method may yield similar uncertainty to actual measurements. This method also frees the manufacturer to make design or option changes without having to retest the equipment.

For example, a patient monitor may come with various optional modules, and the attachment of the modules will affect the acoustic properties. Under the current standard, a strict interpretation would require all versions to be tested at great expense, and as well any design changes that could affect the acoustic pressure. But if the limits are changed to power, as long as the speaker is not changed we can expect the acoustic power to be similar irrespective of the model or design variations.   

All of this needs some research and experiments before being put into a standard; but one thing is clear, something has to be done to improve the current situation and avoid unreasonable use of limited resources. 

IEC 60601-1-6 Usability Engineering - General comments

No fishing allowed

The most common mistake in applying usability standards is to assume that they are a kind of fishing expedition to find the weak points with the device, through extensive trialling with real users. For example, a touch screen on a medical device with a slow update to a new screen or confusing layout might cause the user to frequently press the wrong keys.   

This fishing expedition view is generally what you will find if you search for information or books on usability engineering or usability testing. It is an extremely good idea, with valuable experienced gained getting out of the design walls and seeing how the device works in the real world.

At the same time it sends a shiver down the spine of many small to medium manufacturers, thinking about the cost and also how to deal with the usability feedback, especially late in the design, or worse for existing products already on the market.  

Fortunately, the fishing expedition view is wrong.

The regulatory view

While valuable, field trials are often vaguely formatted, lack formal specifications, and allow users to provide feedback on any aspect they feel is important. In many cases, the designers are not even sure what issues they are looking for, they are just seeking broad based feedback. This feedback will be analysed, filtered and decisions made as to whether to change the design and specifications. Field trial feedback can be extensive and lead to significant upheaval in the design; meaning the device is far from stable. This lack of definition (specification, pass/fail result), weak records (device configuration, environment) and early stage in the design (relevance to the final marketed product) can make field trials largely irrelevant in the regulatory context. Although manufacturers may feel they must keep the records of field trials, the design changes that occur after the trial often make the results unrepresentative of the final marketed product - in other words, not usable as a regulatory record. The impulse to treat the records as formal comes from the false assumption that prototypes are "medical devices" and hence all design records must be kept.   

In a regulatory context, all standards should be viewed with respect to the medical device - the final product that is actually placed on the market. One of the frequent mistakes in regulation is to view prototypes as medical devices, making them the under scope of regulations. This is not correct - all results in the regulatory file must be representative of the final released medical device, and should be in the form of objective evidence against an approved specification, with a pass result. Under this rule, much of the data taken in the early stages of R&D are simply historic records with no regulatory significance. 

Consider for example the way that an electronics engineer handles the performance test which is intended to go into the regulatory file: the engineer would have gone through all the R&D work, including fishing expeditions, trial and error, debugging and refinement, finally arriving at a point of stability in which they are confident of meeting the performance specifications and the planned tests. In the early stages of development, while many records are created, few of these would meet the quality required for formal regulatory records, and most are irrelevant with respect to the final product due to the cumulative effect of design changes. In contrast, the final tests are performed in a controlled environment, with well defined specifications and test methods, and test records detailing the environment, test sample serial numbers, software revisions, hardware configurations, traceable test equipment, who did the tests and when, as well as the actual test result, and an awareness the result must represent the marketed device. This formal (and rather heavy) test environment is certainly not intended to go fishing to find bugs in the design.

The same concept should be applied to usability engineering - all of the fishing expeditions, field trials and the like should have been done well before embarking on the formal IEC 62366 test. The formal test should only be performed when the design is sufficiently stable and the designers are confident of the result. The specifications for usability should be written in a way that provides a clear pass/fail result, and most importantly the specifications should tie into the risk management file - wherever the file indicates the user is involved in managing the risk, the usability assessment forms the evidence that the risk control is effective. For example, if the risk management file says that a certain type of incorrect set up can lead to serious harm, and the risk control refers to the instructions for use (or easy assembly or labelling), these need to be validated through usability testing.

Time to relax

With this formal view of IEC 62366 in mind, designers of stable products can relax somewhat and set up usability targets focusing on risk controls with specifications that are reasonably expected to be met. If that still feels scary, chances are that the content of the risk management file is illogical - unfortunately another frequent problem is the use of instructions, warnings and cautions in the risk management file to sweep away issues that are actually dealt with in other ways in the real world. A careful review often finds that the user was never really relied on in the first place, and hence a usability assessment would be meaningless. In particular, for medium to high risk situations, there is almost always other means of controlling the risk since it is unrealistic to expect ≥99%  of users will follow instructions, and would require huge numbers of real users to validate the effectiveness. 

If a careful review of the risk management file still finds the user is genuinely the risk control, and the severity of harm is significant, the usability assessment needs to be done carefully with specifications and results that demonstrate the risk is acceptable. But this is expected to be the rare case. 

Legacy products

For products on the market, the approach is very similar, except in this case the objective evidence can be derived from market experience, as opposed to pre-market testing. Specifications are still necessary, reporting and the strong link to risk management remains. But the key point is that it is in principle OK to point to market experience as evidence that a user based risk control is effective.  

The final word

If any management system standard seems scary it is usually due to false assumptions about what the standard actually requires. In general, these standards are specification based (not fishing), flexible and resources can be adjusted to suit the situation. Responsible manufacturers that know their product well and are confident it is safe and effective should never fear these standards. Simply use the requirements in the standard as a checklist, and tick off each item one by one until the file is prepared. If the standard requires a record, make sure the record exists. If a requirement is subjective, document whatever the particular qualified responsible individual feels is appropriate for the situation. Avoid asking third parties for opinions, as they rarely know the product as well as you do. 

IEC 60601-1 Clause 4.5 Alternate solutions

This clause is intended to allow manufacturers to use alternate methods other than those stated in the standard.

In Edition 3.0 of IEC 60601-1, Clause 4.5 was titled "Equivalent Safety" and the criteria stated as "the alternative means [having] equal to or less than the RESIDUAL RISKS that result from applying the requirements of this standard".

In Edition 3.1 the title was changed to "Alternative ... measures or test methods" and the criteria to a "...  measure or test method [that] remains acceptable and is comparable to the RESIDUAL RISK that results from applying the requirements of this standard."

The change was most likely required as standards often use worst case assumptions in order to cover a broad range of situations. The result is that for an individual medical device, the requirement is really massive overkill for the risk. The original version required the alternate solution to reach for the same level of overkill, which made little sense. 

In practice, this works if both the standard solution and the alternate solution have negligible risk. In the real world, risk profiles often have a region of significant risk which then transitions to a region of negligible risk. For example, a metal wire might be required to support 10kg weight. If we consider using wire with 10-30kg capacity there is still some measurable probability of mechanical failure. But if we step out a bit further we find that the probability numbers become so small that it really does not matter whether you use 50kg or 200kg wire. Theoretically, a 200kg rating is safer than 50kg, but either solution can be considered as having negligible risk. 

In that context, the standard works well. 

But there are two more difficult scenarios to consider.

The first is that due to technology, competition, commercial issues or whatever, the manufacturer does not want to meet a particular requirement in a standard. The alternate solution has some non-negligible risk which is higher than the solution in the standard, but deemed acceptable according to their risk management scheme.

Clearly, Clause 4.5 is not intended for this case. Instead, manufacturers should declare that they don't meet the particular requirement (either "Fail" or "N/E" in a test report) and then deal with the issue as is allowed in modern medical device regulation. It is often said that in Europe standards are not mandatory - which is true but there is a catch, you need to document your alternate solution against the relevant essential requirement. The FDA has similar allowance, as has most countries. 

Obviously, manufacturers will push to use 4.5 even when significant risk remains, to make a clean report and avoid the need to highlight an issue to regulators. In such a case, test labs should take care to inspect if the alternate solution really has negligible risk, or just acceptable risk.

The second scenario is when the standard has an error, unreasonable requirement or there is a widespread interpretation such as allowing UL flammability ratings in place of IEC ratings. For completeness it can be convenient to reach for Clause 4.5 as a way to formally fix these issues in the standard. In practice though it can crowd the clause as standards have a lot of issues that need to be quietly fixed by test labs. It is probably best to use a degree of common sense rather than documenting every case.  

Finally it should be noted that it is not just a matter of arguing that a requirement in the standard is unreasonable for a particular medical device. Manufacturers should also consider the alternate solution - for example a manufacturer might argue that IPX2 test in IEC 60601-1-11 for home use equipment is overkill. Even if this is reasonable, it does not mean the manufacturer can ignore the issue altogether. It should be replaced by another test which does reflect the expected environment of use, such as 30s rain test at 1mm/min. 

IEC 60601-1 Clause 4.4 Service Life

It is a common assumption that service life should be derived from the properties and testing of the actual medical device. This view is even supported by ISO TR 14969 (guidance on ISO 13485), which states in Clause 7.1.3 that the "... basis of the defined lifetime of the medical device should be documented" and goes on to suggest items to consider.

Fortuntely this view is wrong, and is an example of the blinkered view that can sometimes occur from different medical fields. For some simple medical devices, it is feasible to consider lifetime as an output of the design process, or the result of consideration of various factors. But that's far from true for complex electronic medical devices such as those often covered by IEC 60601-1.

The correct interpretation (regardless of the type of medical device), is that lifetime is simply something which is decided by the manufacturer, and there is no regulatory requirement to document the basis of the number chosen.

It is a requirement that the lifetime must be declared and documented. IEC 60601-1 Clause 4.4 simply asks that this is stated in risk management file.

And, having declared this lifetime, the manufacturer must then go on to show that risks are acceptable over the life of the device.

For some medical devices, lifetime will be an important factor in many risk related decisions, such as sterility, mechanical wear and tear and materials which degrade over time. 

For other medical devices, lifetime hardly gets a thought in the individual risk controls.

Why?

For electrical devices we are a little different in our approach. These days, modern electrical parts last for much (much) longer than the lifetime of the product. And there are thousands of parts in a single product. Inevitably there will be the odd part here and there that breaks down earlier than others, but on a component basis it very rare and hard to predict.

Secondly, we rarely entrust high risk stuff to a single part. We assume that things fail from time to time, and implement protection systems to prevent any serious harm.

There can be cases where lifetime does play a role, but it is the exception rather than the rule. Even then, it would be rare that the lifetime of a part or risk control drives the overall decision on the medical device lifetime. Us electrical engineers don't push things to the edge like that. The risk management might determine that a particular critical part needs a failure rate of less than 1 in 10,000 over the 5 year lifetime of the device. So, we pick a part with 1 in 1,000,000 in 10 years. It's just a different way of thinking in electronic design.

So the next time an auditor asks you how you derived the lifetime of your incredibly complex X-ray machine based on as risk, quietly direct them the marketing department.

IEC 60601-1 Clause 4.3 Essential Performance

The basic idea behind essential performance is that some things are more important than others. In a world of limited resources, regulations and standards should try to focus on the important stuff rather than cover everything. A device might have literally 1000’s of discrete “performance” specifications, from headline things such as equipment accuracy through to mundane stuff like how many items an alarm log can record. And there can be 100’s of tests proving a device meets specifications in both normal and fault condition: clearly it’s impossible check every specification during or after each one of these tests. We need some kind of filter to say OK, for this particular test, it’s important to check specifications A, B and F, but not C, D, E and G.

Risk seems like a great foundation on which to decide what is really “essential”. But is it a complicated area, and the “essential performance“ approach in IEC 60601-1 is doomed to fail as it oversimplifies it to a single rule: "performance ... where loss or degradation beyond the limits ... results in an unacceptable risk".

A key point is that using acceptable risk as the criteria is, well, misleading. Risk is in fact the gold standard, but in practice it gets messy because of a bunch of assumptions hiding in the background. Unless you are willing to tease out these hidden assumptions, it’s very easy to get lost. For example, most people would assume that the correct operation of an on/off switch does not need to be identified as “essential performance”. Yet if the switch fails, the device then fails to treat, monitor or diagnose as expected, which is a potential source of harm. But your gut is still saying … nah, it doesn’t make sense - how can an on/off switch be considered essential performance? The hidden assumption is that the switch will rarely fail - instinctively we know that modern switches are sufficiently reliable that they are not worth checking, the result of decades of evolution in switch design. And, although there is a potential for harm, the probability is generally low: in most cases the harm is not immediate and there is time to get another device. These two factors combined are the hidden assumptions that - in most cases - means that simple on/off switch is not considered essential performance.

In practice, what is important is highly context driven, you can't derive this purely from the function. Technology A might be susceptible to humidity, technology B to mechanical wear, technology C might be so well established that spot checks are reasonable. Under waterproof testing, function X might be important to check, while under EMC test function Y is far more susceptible.

Which means that simply deriving a list of what is "essential performance" out of context makes absolutely no sense.

In fact, a better term to use might be "susceptible performance", which is decided and documented on a test by test basis, taking into account:

• technology used (degree to which it well established, reliable)

• susceptibility of the technology to the particular test

• the relationship between the test condition and expected normal use (e.g. reasonable, occasional, rare, extreme)

• the severity of harm if the function fails

Note this is still fundamentally risk based: the first three parameters are associated with probability, and the last is severity. That said, it is not practical to analyse the risk in detail for each parameter, specification or test: there are simply too many parameters and most designs have large margins so that there are only a few areas which might be sensitive in a particular test. Instead, we need to assume the designer of the device is sufficiently qualified and experienced to know the potentially weak points in the design, as well as to develop suitable methods including proxies to detect if a problem has occurred. Note also that IEC 60601-1 supports the idea of “susceptible performance” in that Clause 4.3 states that only functions/features likely to be impacted by the test need to be monitored. The mistake is that the initial list of “essential performance” is done independently of the test.

The standard also covers performance under abnormal and fault condition. This is conceptually different to “susceptible performance” as it is typically not expected that devices continue to perform according to specification under abnormal conditions. Rather, manufacturers are expected to include functions or features that minimise the risk associated with out-of-specification use: these could be called “performance RCMs”: risk control measures associated with performance under abnormal conditions. A common example is a home use thermometer, which has a function to blank the temperature display when the battery falls to levels that might impact reliable performance. Higher risk devices may use system monitoring, independent protection, alarms, redundant systems and even back up power. Since these are risk control measures, they can be referenced from the risk management file and assessed independently to “susceptible performance”. Performance RMS can be tricky as it pulls into focus the issue of what is “practical”: many conditions are easy to detect, but many others are not; those that are not detected may need to be written up as risk/benefit if the risk is significant.

Returning to “susceptible performance”, there are a few complications to consider:  

First is that "susceptible performance" presumes that, in the absence of any particular test condition, general performance has already been established. For example, a bench test in a base condition like 23°C, 60% RH, no special stress conditions (water ingress, electrical/magnetic, mechanical etc.). Currently in IEC 60601-1 there is no general clause which establishes what could be called "basic performance" prior to starting any stress tests like waterproof, defib, EMC and so on. Even now, this is a structural oversight in the standard, since it allows the test to focus on parameters that are likely to be affected by the test, which only makes sense if the other parameters have already been confirmed.

Second is that third party test labs are often involved and the CB scheme has set rules that test labs need to cover everything. As such there is reasonable reluctance to consider true performance for fear of exposing manufacturers to even higher costs and test labs thrown into testing they are not qualified to perform. This needs to be addressed before embedding too much performance in IEC 60601-1. Either we need to get rid of test labs (not a good idea), or structure the standards that allows test labs to separate out those generic tests they are competent to perform from specialised tests, as well as practical ways in which to handle those specialised aspects when then cross over into generic testing (such as an IPX1 test).

Third is that for well established technology (such as diagnostic ECGs, dialysis, infusion pumps) it is in the interests of society to establish standards for performance. As devices become popular, more manufacturers will get involved; standardisation helps users be sure of a minimum level of performance and protects against poor quality imitations. This driver can range from very high risk devices through to mundane low risk devices. But the nature of standards is such that it is very difficult to be comprehensive: for example, monitoring ECG have well established standards with many performance tests, but many common features like ST segment analysis are not covered by IEC 60601-2-27. The danger here is using defined terms like “essential performance” when a performance standard exists can mislead people to think that the standard covers all critical performance, when in fact it only covers those aspects that have been around long enough to warrant standardisation.

Finally, IEC 60601-1 has special requirements for PEMS for which applicability can be critically dependent on what is defined as essential performance. These requirements can be seen as special design controls, similar to what would be expected for Class IIb devices in Europe. They are not appropriate for lower risk devices, and again using the criteria of “essential performance” to decide when they are applicable creates more confusion.

Taking these into account, it is recommended to revert a general term "performance", and then consider five sub-types:

Basic performance: performance according manufacturer specifications, labelling, public claims, risk controls or can be reasonably inferred from the intended purpose of the medical device. Irrespective of whether there are requirements in standards, the manufacturer should have evidence of meeting this basic performance.

Standardised performance: requirements and tests for performance for well established medical devices published in the form of a national or international standard. 

Susceptible performance: subset of basic and/or standardised performance to be monitored during a particular test, decided on a test by test basis, taking into account the technology, nature of test, severity if a function fails and other factors as appropriate, with the decisions and rationale documented or referenced in the report associated with the test.

Critical performance: subset of basic and/or standardised performance performance which if fails, can lead to significant direct or indirect harm with high probability; this includes functions which provide or extract energy, liquids, radiation or gases to the patient in a potentially harmful way; devices which monitor vital signs with the purpose of providing alarms for emergency intervention, and other devices with similar risk profile (Class IIb devices in Europe can be used as a guide). Aspects of critical performance are subject to additional design controls as specified in Clause 14 of IEC 60601-1  

Performance RCMs: risk controls measures associated with performance under abnormal conditions, which may include prevention by inherent design (such as physical design), prevention of direct action (blanking display, shut off output), indication, alarms, redundancy as appropriate.

Standards should then be structured in a way that allows third party laboratories to be involved without necessarily taking responsibility for performance evaluation that is outside the laboratories competence.

IEC 60601-1 Clause 4.2 - Risk Management

The ability to apply flexibility in certain places of a standard makes a lot of sense, and the risk management file is the perfect place to keep the records justifying the decisions.

Yet, if you find risk management confusing in real application, you are not alone. The reason is not because you lack skills or experience – instead embedding risk management in IEC 60601-1 is a fundamental mistake for three reasons.

First is simple logistics. The correct flow is that the risk management file (RMF) studies the issue, and proposes a solution. That solution then forms a technical specification which can be evaluated as part of a product standards like IEC 60601-1, particularly those places where the standard allows or requires analysis. When the verification tests are successful, a report is issued. The RMF can be completed and the residual risk judged as acceptable. This forms a kind of mini V-model:

Embedding risk management in a product standard creates a circular reference which can never solved - the RMF cannot be signed off until the product report is signed off, the product report cannot be signed off until the RMF is signed off. This is more than just a technicality – it debases and devalues the risk management by forcing manufacturers to sign off early, especially when test labs are involved.

Which leads us to our second problem: Third party test laboratories are valuable resource for dealing with key risks such as basic electrical safety and EMC. But they are ill equipped to deal with subjective subjects, and ISO 14971 is whopper in the world of subjectivity: everyone has their own opinion. The V-model above isolates the product standard (and third party test labs) from the messy world of risk management.

Which brings us to our third problem – the reason why risk management is so messy. Here we find that ISO 14971 that has its own set of problems. First, there are in practice too many risks (hazardous situations) to document in a risk management file: the complexity of a medical device design, production process, shipping, installation, service, interfaces between the device and the patient, operator and the environment contain tens of thousands situations that have genuine risk controls. ISO 14971 fails to provide a filter for isolating out those situations worth documenting.

Secondly is the rather slight problem that we can’t measure risk. Using risk as the parameter on which decisions are made is like trying to control the temperature of your living room using a thermometer with an accuracy of ±1000°C. Our inability to measure risk with any meaningful accuracy leads to a host of other problems to long to list here.

Yet In the real world we efficiently handle tens of thousands of decisions in the development and production processes that involve risk - it’s only the relatively rare case that we get it wrong.

The answer may lie in “risk minimum theory”, which is planned to be detailed further on this site at a later date. This theory provides a filter function to extract only the risks (hazardous situations) worth investigating and documenting in the risk management file, also provides a way to make risk related decisions without measuring risk. 

In the mean time, we need to deal with ISO 14971. This article recommends:

• Don’t panic – everybody is confused!
  

• Follow the minimum requirements in the standard. Even if you don’t agree or it does not make sense, make sure every document or record that is required exists, and that traceability (linking) is complete. Use a checklist showing each discrete requirement in ISO 14971 and point to where the your records exist for that requirement. Keep in mind that the auditors and test engineers didn’t write the standard, but they have to check implementation, so following the standard - even if blindly - helps everyone.
  

• Watch carefully for the places where the standard says a record is needed, and where verification is needed. There is a difference – a “record” can be as simple as a tick in a box or a number in a table, without justification. “Verification” means keeping objective evidence. Verification is only required in selected places, which may be a deliberate decision by the authors to try and limit overkill.
  

• Develop your own criteria for filtering what goes in in the file. The risk minimum theory concludes that that risk controls which are clearly safe, standard practice, and easy for a qualified independent person to understand by inspection do not need to be in the file. Risk controls that are complex, need investigation to know the parameters, borderline safety or balanced against other risks should be documented.
  

• As an exception to the above, keep a special list of requirements in product standards like IEC 60601-1 that specifically refer to risk management, including a formal judgement if they are applicable (or N/A), and a pointer to the actual place in the risk management file where the item it handled. Again this helps everyone – manufacturer, auditors and test engineers
  

• Be aware that there are three zones in safety: the green and red zones, where there is objective evidence that something is either safe or unsafe, and a grey zone in between where there is no hard evidence either way. In the real world, 99% of risk controls put us in the green zone; but there are still 10-100 that inevitably fall in the grey zone.
  

• If you are in this grey zone, watch out for the forces that influence poor risk management decisions: conflicts of interest, complexity, new technology, competition, cost, management pressure and so on. Don’t put a lot of faith in numbers for probability, severity, risk or criteria, be aware of camouflage - a warning in a manual magically reducing the risk by 2 orders of magnitude, masking the real risk control. Dig deeper, find the real risk control, and then decide if it is reasonable.

IEC 60601-1 and accessories

These days many medical applications are a system comprising of a main unit and accessories or detachable parts.

Under medical device regulations, it is allowed for each part of a system to be treated as an individual medical device. Despite some concerns, regulations do not require any contract or agreement between the different manufacturers making up parts of the system. 

Instead, they rely on risk management, which is appropriate given wide range of situations and regulatory issues. For example, labelling, instructions, sterilisation and bio-compatibility are reasonably under the responsibility of the accessory manufacturer. Electrical isolation from mains parts, EMC emissions and immunity are normally under the responsibility of the main unit manufacturer. In some cases there are shared system specifications (such as system accuracy shared between main unit and sensor), in other cases there are assumptions based on reasonable expectations or industry norms (such as IBP sensor insulation). In the end the analysis should resolve itself into interface specifications which allocate some or all of the system requirements to either the main unit or the accessory. 

There is a valid concern that by keeping the analysis by each manufacturer independent, critical issues could fall through the cracks. Each manufacturer could assume the other will handle a particular requirement. And sometimes system requirements are difficult to separate. 

Even so, the alternative is unthinkable: a system only approach only works if there are agreements and constant exchange of information between the different manufacturers in a system.  This would create an unwieldy network of agreements between tens of thousands of manufacturers throughout the world, difficult to implement, virtually impossible to maintain. While regulators surely recognise the concern, the alternative is far worse. Thus it remains in the flexible domain of risk management to deal with practical implementation. 

IEC 60601-1 makes a mess of the situation, again highlighting the lack of hands on regulatory experience in those involved with developing the standard.

The definition of "ME equipment" in Clause 3.63 has a "Note 1" which states that accessories necessary for normal use are considered part of the ME equipment. The standard also has many requirements for accessories, such as labelling, sterilisation and mechanical tests. This implies a system only approach to testing. 

Yet the standard trips up in Clause 3.55, by defining a "manufacturer" as the "person with responsibility for ... [the] ME equipment".

Both of these definitions cannot be true, unless again we have an impossible network of agreements between all the manufacturers of the different parts of the overall system.

Clause 3.135 also defines a "Type Test" as a "test on a representative sample of the equipment with the objective of determining if the equipment, as designed and manufactured, can meet the requirements of this standard". 

Again, this definition can only be met if the manufacturer of the accessory is contractually involved, since only the accessory manufacturer can ensure that a type test is representative of regular production, including the potential for future design changes.  

What's the solution?

An intermediate approach is to first recognise that the reference to accessories in Clause 3.63 is only a "note", and as the preamble to all IEC standards indicates, "notes" written in smaller type are only "informative". In other words, the note is not a mandatory part of the standard. 

Secondly, it is possible that the writers of the standard never intended the note to mean the standard must cover accessories from other manufacturers. Rather, the intention was probably to highlight (note) that in order to run the various tests in the standard accessories would be needed to establish normal condition. The note is a clumsy way of avoiding that manufacturer insists the tests are done without any regard to the accessories.

A longer term solution would be to add a new clause in the standard (e.g. 4.12) which requires an analysis of accessories from other manufacturers to:

• Allocate system requirements to either the main unit or accessory, either in part or in full

• Document a rationale behind the selection of representative accessories to establish normal condition during tests on the main unit

• Document a rationale to identify accessories in the instructions for use: either directly by manufacturer and type, or indirectly by specification

The following is an example analysis for a patient monitor with a temperature monitoring function (for illustration only):

View fullsize

This analysis should be included in or referenced from the risk management file.

The analysis might appear onerous, but the ability to stream line type testing will save time in the long run, and allow common sense apply. In the current approach, decisions about accessories are made on the run, and can result in both over and under testing.

Manufacturers are also reluctant to mention accessories in the operation manual, partly due to the logistics of keeping the manual up to date, and partly due to a fear of being seen to be responsible for the accessories listed. This fear often extends to the design documentation including the risk analysis, with virtually no mention accessories in the files. The above approach helps to address the fear while at the same time highlighting that accessories can't be simply ignored. A rationale for the requirements, representative selection and documentation to the user is both reasonable and practical.   

The recommendations above cover a simple system of an main unit designed by manufacturer "X" working a sensor designed by manufacturer "Y". There exists another more complicated scenario, where part of the electronics necessary to work with the accessory provided by manufacturer Y is installed inside the main unit from manufacturer X. A common example is an OEM SpO2 module installed inside a patient monitor. Technically, manufacturer X takes responsibility for this "interface module" as it falls under their device label. In such a case, a formal agreement between X and Y is unavoidable. Once this agreement is in place, the same risk analysis for the three points above should apply.

In this special case, a type test also needs some consideration. In general it is not practical for manufacturer of the main unit to support testing for the module, as it usually requires the release of a large amount of information much of which would be confidential. Instead, the laboratory should look for test reports from manufacturer B for the interface module, essentially as a "component certification" similar to an recognised power supply. Another option would be for the report to report to exclude requirements on the presumption that these will be handled by the module/accessory manufacturer, as per the inter-company agreement. The module manufacturer would then have their internal reports to cover the excluded clauses. In case of product certification and CB scheme, some exclusions may not be allowed, in which case the module is best covered by a CB certificate to allow simple acceptance by the laboratory responsible for the main device. 

Finally, there is a bigger role that standard can play to help avoid gaps in responsibility - the development of standards for well established accessories which define clearly which manufacturer should cover which requirements. Such standards already exist at the national level, for example ANSI/AAMI BP 22 for IBP sensors. A generic standard could also be developed which handles accessories not covered by a particular standard, which highlights risk analysis and declaration of assumptions made. 

It's time that the IEC 60601 series was better aligned with modern regulations and reality: accessories are a separate medical device.    

IEC 60601-1 Amendment 1 Update Summary

Overview

Amendment 1 to IEC 60601-1:2005 was released in July 2012 and is now becomming main stream for most regulations. This article, originally published in 2013 summarises the changes

The basic statistics are:

• 118 pages (English)
• 67 pages of normative text
• ~260 changes
• 21 new requirements
• 63 modifications to requirements or tests
• 47 cases where risk management was deleted or made optional
• 19 corrections to requirements or test methods
• Remainder were reference updates, notes, editorial points or clarifications
• USD$310 for amendment only
• USD $810 for the consolidated edition (3.1)

This document covers some of the highlights, including an in-depth look at essential performance. A pdf version of this analysis is avaliable, which also includes a complete list of the changes on which the analysis is made.

Highlights

Risk management has been tuned up and toned down: the general Clause 4.2 tries to makes it clear that for IEC 60601-1, the use of ISO 14971 is really about the specific technical issues, such as providing technical criteria for a specific test or justifying an alternate solution. Full assessment of ISO 14971 is not required, and post market area is specifically excluded. The standard also clearly states that an audit is not required to determine compliance.

Within the standard, the number of references to risk management have been reduced, with some cases of simply reverting back to the original 2^nd edition requirements.  In other places, the terminology used in risk management references has been corrected or made consistent. 

Essential performance has quietly undergone some massive changes, but to understand the impact of the changes you need to look at several aspects together, and some lengthy discussion is warranted.

First, the standard requires that performance limits must be declared. In the past a manufacturer might just say “blood pump speed” is essential performance, but under Ed 3.1 a specification is also required e.g. “blood pump speed, range 50-600mL/min, accuracy ±10% or ±10mL of setting, averaged  over 2 minutes, with arterial pressure ±150mmHg, venous pressure -100~+400mmHg, fluid temperature 30-45°C”.

Next, the manufacturer should consider separately essential performance in abnormal or fault conditions. For example under a hardware fault condition a blood pump may not be expected to provide flow with 10% accuracy, but it should still confidently stop the blood flow and generate a high priority alarm. Care is needed, as the definition of a single fault condition includes abnormal conditions, and many of these conditions occur at higher frequency than faults and therefore and require a special response. User errors, low batteries, power failure, use outside of specified ranges are all examples where special responses and risk controls may be required that are different to genuine fault condition. For example, even a low risk diagnostic device is expected to stop displaying measurements if the measurement is outside of the rated range or battery is too low for accurate measurement. Such risk controls are now also considered “essential performance”.

Essential performance must also be declared in the technical description. This is major change since it forces the manufacturer to declare essential performance in the commercial world, especially visible since most manufacturers incorporate the technical description in the operation manual. Until now, some manufacturers have declared there is no essential performance, to avoid requirements such as PEMS. But writing “this equipment has no essential performance” would raise the obvious question … what good then is the equipment?

Finally many of the tests which previously used basic safety or general risk now refer specifically to essential performance in the test criteria. In edition 3.0 of the general standard, the only test clause which specifically mentioned essential performance was the defibrillator proof tests. Now, essential performance is mentioned in the compliance criteria many times in Clauses 9, 11 and 15. These are stress tests including mechanical tests, spillage, sterilization and cleaning.  The good news is that the standard makes it clear that functional tests are only applied if necessary. So if engineering judgment says that a particular test is unlikely to impact performance, there is no need to actually test performance.

While essential performance is dramatically improved there are still two areas the standard is weak on. First, there is no general clause which requires a base line of essential performance to be established. Typically, performance is first verified in detail under fairly narrow reference conditions (e.g. nominal mains supply, room 23±2°C, 40-60%RH, no particular stress conditions). Once this base line is established, performance is then re-considered under a range of stress conditions representing normal use (±10% supply voltage, room temperature 10-40°C, high/low humidity, IP tests, mechanical tests, cleaning test, and so on). Since there are many stress tests, we normally use engineering judgment to select which items of performance, if any, need to be re-checked, and also the extent of testing. But this selective approach relies on performance having been first established in the base-line reference condition, something which is currently missing from the general standard.

The second problem is the reference to essential performance in PEMS (Clause 14). Many low risk devices now have particular standards with essential performance. And since essential performance is used as a criteria for stress tests, the “no essential performance” approach is no longer reasonable. But the application of complex design controls for lower risk devices is also unreasonable, and conflicts with modern regulations. Under note 2, the committee implies that Clause 14 needs only to be applied to risk controls. A further useful clarification would be to refer to risk controls that respond to abnormal conditions. For example, in a low risk device, the low battery function might be subject to Clause 14, but the main measurement function should be excluded, even if considered “essential performance”. It would be great if the committee could work out a way to ensure consistent and reasonable application for this Clause.

Moving away from essential performance to other (more briefly discussed) highlights are:

• Equipment marking requirements: contact information, serial number and date of manufacture are now required on the labeling, aligning with EU requirements. The serial number is of special note, since the method of marking method is often different to the main label, and may not be as durable.
   
• Accessories are also required to marked with the same details (contact information, serial number, date of manufacturer). This also fits with EU requirements, provided that the accessory is placed on the market as a separate medical device. This may yield an effective differentiation between an “accessory” and a “detachable part”. The new requirement implies that accessories are detachable parts which are placed on the market (sold) separately, whereas detachable parts are always sold with the main equipment.
   
• Both the instructions for use and the technical description must have a unique identifier (e.g. revision number, date of issue)
   
• For defibrillator tests, any unused connectors must not allow access to defibrillator energy (effectively requires isolation between different parts, or special connectors which prevent access to the pins when not in use)
   
• Mechanical tests for instability and mobile equipment (rough handling test) are modified (market feedback that found the tests to be impractical)
   
• The previous 15W/900J exemption of secondary circuits from fire enclosure/fault testing has been expanded to 100VA/6000J if some special criteria are met. Since the criteria are easy to meet, it will greatly expand the areas of the equipment that does not need a fire enclosure or flame proof wiring; welcome news considering the huge environmental impact of flame retardants.
   
• For PEMS, selected references to IEC 62304 are now mandatory (Clauses 4.3, 5, 7, 8 and 9)

For a complete (unchecked) list of changes, including a brief description and a catergory of the type of change, please refer to the pdf version.  

For comments and discussion, please contact peter.selvey@medteq.jp.