The easiest way to show that medical devices are safe and effective is to test them to FDA Recognized Standards. In Europe, medical devices must meet the Essential Requirements of the Medical Devices Directive (MDD). Compliance to European Harmonized Standards is necessary to meet MDD requirements. IEC 60601-1-2 is a recognized and harmonized standard used for testing the electromagnetic compatibility (EMC) of medical devices.
The 33-page standard was first introduced in 1993. A 2001 second edition expanded the standard, and a 2004 amendment included the “Guidance in the Identification of Essential Performance.“ This requires identifying the minimum baseline or “essential performance“ of a device when determining whether it has properly passed electromagnetic immunity testing.
Testing to the standard involves performing a risk analysis of a device and gaining an understanding of its fault modes. A systematic approach can simplify EMC immunity testing.
Overview of EMC immunity testing
The immunity portion of EMC testing quantifies electrical medical equipment's ability to withstand electromagnetic disturbances. Equipment examples might include lung ventilators, cardiac defibrillators, and ultrasonic physiotherapy devices. IEC 60601-1-2 uses the IEC 61000 series of tests which includes: Electrostatic Discharge, Radiated Radio Frequency, Electrical Fast Transients, Surge, Conducted Radio Frequency, Magnetic Field, and Voltage Dips, and Interrupts & Variations.
In general, the limits for electromagnetic disturbance found in each test represent the range found in the general medical-use environment. Test modifications or more stringent requirements may be necessary for testing specific medical equipment. For example, equipment that monitors physiological parameters may require different timing in the application of standard-recommended tests. And life-support equipment, for instance, requires more stringent testing than other products. The IEC 60601-2-X series of standards addresses specific classes of medical equipment and typically calls out additional testing specific to that class of device.
The key component for immunity testing comes from IEC 60601-1-2, clause 3.201.2: “The essential performance of equipment and systems shall be identified by a risk analysis. If this risk analysis is not performed, all functions of the equipment or system shall be considered essential performance for the purpose of immunity testing.“
In addition, clause 36.202.1 j lists compliance criteria. Degradations not allowed include false alarms, component failures, changes in programmable parameters, reset to factory defaults, and noise on a waveform. These must be analyzed and included in EMC test protocols.
A unique part of the standard is what constitutes a passing test. The burden of interpreting test results falls on device manufacturers. They identify which device functions are essential to performance and ensure that risks due to EMC are acceptable.
Determining essential performance involves the following steps:
Perform a risk analysis using the FDA recognized standard ISO 14971:2000/Amed.1:2003.
Review the analysis to determine which hazards could be affected by electromagnetic disturbances. Not all hazards are affected by EMC testing.
Identify device functions critical to performance.
Determine operating modes necessary to detect the EMC effects.
Identify appropriate tests or additional scans necessary to prove that EMC does not increase risk of operating the device. Special tests or test fixtures may be necessary.
Reviewing a risk analysis
A typical risk analysis contains descriptions of hazards, potential causes of hazards, mitigation of causes, and pre and post-mitigation analysis. Additional data may be included such as risk analysis priority numbers which can assist determining whether the fault mitigations are appropriate.
A risk analysis is used to generate an appropriate EMC test protocol like this one:
For each hazard, decide if an electronic or software problem can cause the hazard or affect the mitigation for the hazard. This requires a simple Yes/No response for each hazard.
Analyze the fault modes for the electronics that may be affected by EMC. This requires knowledge of the fault analysis for the electronics or software involved.
Determine if normal operation has sufficient ability to detect the fault. If not, additional operating modes must be tested.
Decide if the fault can be detected. Add tests that detect faults as needed.
Determine test criteria and levels of acceptance.
Generating a test protocol
Consider a test protocol from a risk analysis for a hypothetical medical device. It has a single hazard with two failure causes. A real device would probably have many more hazards. The device pumps fluids to a patient. The hazard is that air could be delivered to the patient through a leak in the fluid path or a poor connection. A first step is to determine if an EMC event can cause a fault or affect its mitigation. An air sensor has been added to warn of leaks and the sensor could be susceptible to EMC. The connection to the patient is not affected by EMC, so it does not require consideration in the analysis.
After identifying the air sensor as potentially affected by EMC, it's necessary to analyze its failure modes. This will determine whether failures can be detected during normal operation or whether additional tests will be required.
Here, it's helpful to understand how the air sensor works. The sensor produces an analog output that is low for fluid and high for air. A single threshold is set so that when the signal is above the threshold, the sensor indicates the presence of air. When the signal is below the threshold, the sensor indicates the presence of fluid. Also, the sensor is sampled once per second. A noise filter works as a simple strike counter. At least two of the last three samples must be above the threshold to signal the presence of air, and two out of three must be below it to signal fluid.
The first failure mode has the sensor stuck detecting fluid. EMC can suppress the sensor signal so it remains below the threshold even when air is present. The second failure has the sensor is stuck detecting air. Again, EMC can increase sensor output level so it goes above the threshold even when fluid is present. For intermittent failures, EMC can affect the sensor when the event lasts longer than two seconds.
Normal pumping is AC-powered with no battery backup, so the equipment needs testing only while on AC. Likewise, the device typically delivers fluid to patients at single-flow rates, so tests should simulate those conditions.
Applying two of the EMC immunity tests may help show more exactly how to perform tests and monitor the air senor. Electrostatic discharge (ESD) testing is one immunity test. IEC 61000-4-2 describes it as:
±2, ±4 and ±6kV contact discharge to device
±2, ±4 and ±6kV air discharge to device
Horizontal and vertical coupling planes
Allows 10 hits at each level
Allows a discharge between hits
Assess performance after every hit
Exemption for properly labeled connectors
The sensor's filter should eliminate ESD events. The likelihood of the sensor's reporting fluid when air is present is just as likely as vice versa. Thus, the test is considered a pass if no false alarms occur on the air sensor while the fluid-pumping device is in normal operating mode.
Another immunity test examines radiated RF. IEC 61000-4-3 describes this test as:
Apply radio frequencies in the range of 80 to 2500 MHz with a 1% step size
3 V/m (life support 10 V/m)
Amplitude modulation 80% at either kHz with Ž 1 sec dwell, or 2 Hz with Ž 3 sec dwell for physiological parameter monitoring.
The device's response time must be faster than the dwell times. The test is applied during several different device orientations.
The amplitude modulation of the air-sensor signal can be 1 kHz but the dwell time must be three seconds during normal operating mode due to the three-second-filter window. This allows generating alarms when radiated RF is causing the normal fluid signal to read air. However, the dwell time does not allow detecting whether or not radiated RF is suppressing the signal. To reduce dwell time and better understand the effects of radiated RF, adding additional signal monitoring to the air sensor during testing could have significant benefits.
Therefore, the following test can be added:
Sample the air sensor signal during radiated RF testing.
Test in two different modes: when air is present and when fluid is present at the sensor.
The output of the air signal can vary up to 50% of the noise margin between air and fluid levels.
The passing criteria for this test has been set to 50% of the noise margin because at this level of variance, it was determined that there is not a significant increase to the risk of a false or missed alarm. With this test in place, it is possible to bypass the noise filter and return to a one second dwell time which can cut significant test time. It is also possible to see the exact RF frequencies where there may be problems with the air sensor.
For example, assume the air sensor is sampled with a 12 bit analog-to-digital (A/D) device and has a nominal fluid reading of 800 A/D counts and an air reading of 3,000 A/D counts. The air sensor can thus be allowed to deviate by a value of 1100 A/D counts [50% (3,000 - 800)] during the test. The test can be repeated for air present at the sensor and for each orientation of the device. Additional monitoring of the signal is easily accomplished if it is included in the device's design. Thus, it's important to consider EMC testing early in the design process.