Not only are medical devices expected to function as intended, they must meet ergonomic, safety, FDA and functional requirements. They must be designed to function in adverse environments; sometimes in the operating room; sometimes in an emergency vehicle for example. If a device is patient connected, it is also expected to function within proscribed parameters in the presence of a defibrillation pulse. These parameters differ depending on the type of device. All devices must pass an isolation test designed to ensure that the pulse will not affect the device’s signal input part/signal output part (SIP/SOP) ports; and effective with the Third Edition of IEC 60601-1, they must demonstrate that they absorb less than 10 percent of the defibrillation pulse. ECG monitoring equipment either for hospital (IEC 60601-2-27) or emergency use (IEC 60601-2-25) is additionally subject to performance requirements after a defibrillation pulse is applied.
The verification program to ensure device behavior in response to a defibrillation pulse is straightforward in theory. The procedure is to pulse the device with a defibrillator connected directly across the patient connection and check the result depending on the test performed. However, in practice, the use of a defibrillator is problematic. First, defibrillators monitor the output pulse and can attenuate it if the desired result is obtained before the complete pulse is delivered. Devices must perform when a full defibrillation pulse of 360J is delivered, so this attenuation feature is not optimal. Second, defibrillators have a short life when used as pulse generators, with field reports of <2,000 delivered pulses before defibrillator failure. Test equipment capable of delivering a full 360J pulse at duty cycles of 30 seconds continuous and a lifetime of over 1M cycles are commercially available and use of one of these generators is recommended for verification tests. Test equipment lifespan becomes important for manufacturers who perform life testing to ensure continued compliance over many defibrillation pulses as part of the verification test package for the device. Consistent 360J pulse deivery is an important requirement to consider for any verification package.
Manufacturers of components which will be visible to the defib pulse may also benefit from verification testing for this requirement. If the component is actually used to deliver the pulse, then the verification test also is providing testing for a core requirement of the component. Life testing of the component will be fairly straightforward with a test program of simulation of the product use at full defibrillator output for a number of cycles deemed proper to demonstrate the use of the component over the life of the device it is used in. Defibrillator leads and their connections are components that are good examples of components that would benefit from surge testing, both from a safety aspect (isolation of the pulse) and a performance aspect (pulse delivery). Use of a 360J generator instead of a defibrillator is again recommended for the reasons stated above. Manufacturers can develop a test program for the leads that could focus on the ability to maintain full pulse delivery and isolation over the life of the device; and the availability of these generators would make it possible to test for the life of the device in a relatively short amount of time.
Different Medical Surge Tests All Use the Same Generator
As noted, there are three basic tests that are conducted, using the same 360J power supply as described in IEC 60601, AAMI EC-13, and others. There are two different waveshaping networks described in the tests. The power supply shown in the IEC/AAMI Standards will deliver 360J minimum to the waveshaping network chosen, if the components are within the stated tolerances. Other caveats as noted in the Standards are that the switch S1 must be able to deliver the power, and the inductor L1 must not be allowed to saturate.
Energy Reduction Test
Changes to the Surge Test in the Third Edition of IEC 60601-1 introduce the Energy Reduction test, which has been a part of IEC 60601-2-49 in previous editions. This test verifies that the device under test absorbs a maximum of 10 percent of the delivered defibrillation pulse power and requires either a scope with math functions, an Excel spreadsheet and a digital scope, or a commercially available surge generator that can display the result directly. In practice, two pulses need to be delivered for each test result.
Since any heating of the internal 100 Ω resistor “R 100 Ω” will decrease its resistance, a corresponding increase in the energy dissipated will also occur. This will cause the 90 percent threshold required for compliance to the Standard to be set artificially high, which could cause a marginally passing device to appear to fail the energy reduction test solely because of test equipment error. For example, since a 5 percent tolerance is allowed, a value of “R 100 Ω” between 105–95 ohms is acceptable. If the test with the DUT connected is conducted with “R 100 Ω” = 105Ω (energy captured is 356J; pass/fail point is .9(356)=320J), and the referee pulse is conducted with “R 100 Ω”=95Ω (energy captured is 397J; pass/fail point is .9(397J)=357J), the DUT will appear to fail no matter what the outcome of the test conducted with the DUT attached, solely due to heating of “R 100 Ω”. (See Figure 1)
The energy delivered to the resistor is used as the referee amount to the pulse delivered with the device connected to the generator, and the two results must be within 10% of each other. Please note that the referee pulse must be delivered first, as this will represent the worst case due to resistor heating. Because of this stipulation, it behooves manufacturers to use a very stiff resistance bank to maintain the 10 percent tolerance and not lose it to resistor heating. In addition, an improperly sized resistor will make consistent measurements difficult.
Should the manufacturer wish to perform a large sample of tests to determine efficacy of the protection network of the device, characterization of the generator could be done to determine the duty cycle which will allow sufficient time to keep the 100 Ω resistor in tolerance and, therefore, make results consistent, without the need for a referee pulse delivery for each test. This characterization effort will double the throughput of any verification or production testing undertaken.
The Energy Reduction Test is only applicable to devices judged to the requirements of IEC 60601-1, 3rd Edition. At this writing, there are still markets that recognize approvals of medical devices to the requirement of IEC 60601-1 2nd Edition, and most, if not all, Notified Bodies are still at least maintaining devices approved to this older Standard. If the medical device in question has approvals to IEC 60601-1 2nd Edition, and is going to be phased out before 3rd Edition approvals become mandatory in the area of use of the device, then the Energy Reduction test is not necessary.
Defibrillation Protection (Common-Mode and Differential-Mode)
The defibrillation protection test has continued basically unchanged from IEC 60601-1 2nd Edition, except that Tolerance information is clarified. (See Figure 2) The isolation of the SIP/SOP portion of the device from the patient connections can be judged by using an oscilloscope. As in the Energy Reduction Test above, there are commercial generators with reasonable cycle times that can deliver the pulses and provide the voltage divider network and are ready for connection to an external oscilloscope for pass/fail judgment. The pass/fail point is 1V peak, so automated testing is possible by using a programmable oscilloscope.
A program of tests could be used to verify the life of the isolation network over the anticipated life of the device. In addition, this test could be used for production testing, as the results are quantifiable as noted above. The test is conducted with the device in operating condition, and after the test, the device must recover function within the manufacturer-defined recovery time, and continue to provide isolation. This is a multi-part test, with the test being conducted with and without connection to ground; with the defibrillation pulse delivery reversed; and checking for isolation to the enclosure, the area under the device, and other patient connections. In addition, it is to be conducted in both differential-mode and common-mode configurations. Analysis of the results of the verification testing could focus production line testing on one or a few tests that yield worst-case test results.
IEC 60601-2-25 and -27 Test of Protection Against the Effects of Defibrillation
This test is applicable only to ECG devices and is very strict. The tolerance of the resistor banks has been brought to ±1 percent, and the test pulse is to be applied every 20 seconds. The ECG must return to 80 percent of signal output within 5 seconds of pulse application. Because of the complexities of applying this test, ECG manufacturers should obtain a surge tester specifically designed for this purpose. Like the Defibrillation Protection Test above, it is conducted in both differential-mode and common-mode, with the defibrillation pulse applied in either polarity (but five times each), with and without ground connected, to SIP/SOP and other patient connections, the enclosure and area underneath it. In addition, the test is conducted with the mains connected and disconnected, if the device is designed to be used in both of these modes.
However, by its complexity and strictness, it is a perfect verification test. Because performance is stipulated, a program of tests can show degradation of the device isolation circuit by showing increasing recovery times. This test is not only to prove a safety barrier, but is also a requirement for the operation of the device. Therefore, it is an important test to consider in the validation process.
Conversely, it is relatively simple to perform a worst-case subset of these tests in the production area to ensure correct manufacture and proper component functionality.
Conducting the Surge Test and Documenting Verification Testing
Medical surge testing involves high voltages and should be performed by trained personnel only. The pulses deliver high voltages and high currents and should be considered as hazardous. Although the pulses generated are relatively slow, they still require a high voltage, high accuracy probe to properly capture the pulse for evaluation. This excludes the pulse resulting from the Defibrillation Protection Test, which can be captured using 1:1 BNC oscilloscope cables.
These tests require delivery of consistent 360J pulses. Because the delivery of these pulses is in parallel with an internal resistor, it is important that the generator not be used outside of its rated pulse delivery times. These times are derived from the recovery time of the internal resistor and, if pulses are delivered more quickly than specified, the internal resistor will fall out of tolerance. The resulting pulse could be less powerful than expected. Further, continued use of the tester outside its specified delivery times could damage it.
Any surge tests conducted during the verification portion of the device development should be included in the Design History File for future reference.
The surge test is also useful for production line testing. While this type of test is not designed to prove the design, in many cases the test would be useful in making sure that the product was assembled and functioning correctly.
Surge testing is a valuable tool for verification testing and, with a suitable program, the isolation network can be modeled over the life of the device. Requirements are in flux and the program to be undertaken on older devices will depend on the chances of it being reevaluated to the requirements of IEC 60601-1, 3rd Edition. If that is the case, it would be reasonable to modify the original verification program to include the new surge requirements contained in the 3rd Edition.
If ECG devices are involved, a review of the new requirements to the surge tests in IEC 60601-2-25:2011 and IEC 60601-2-27:2011 should be undertaken, as changes are substantial.
This article was written by Jeff Lind, President, Compliance West, San Diego, CA. For more information, Click Here .