Originally Published MDDI March 2005

Regulatory Outlook

IEC 60601-1, 2005: A Revolutionary Standard, Part 2

The third edition of the standard has significant technical changes that must be carefully examined and fully understood to achieve compliance.

Mike W. Schmidt
Strategic Device Compliance Services

The third edition of IEC 60601-1 is filled with new and revised requirements. Particularly, manufacturers who had been operating using the second edition of the standard will find the most significant changes in four sections of the revision. These sections are general requirements (clause 4), electrical safety (clause 8), mechanical safety (clauses 9 and 15), and thermal and fire safety (clause 11).

A previous article reviewed the history of the IEC 60601-1 standard and its use as a tool for demonstrating compliance with regulatory requirements.¹ That article discussed the philosophy behind the standard. This article examines specific changes in the third edition of the standard, scheduled for publication in 2005. The expansion of the third edition ensures that the standard covers all aspects of safety.

It is critical that those who will use the standard become familiar with the details. Although it would be impractical to give a detailed account of each technical change, this article looks at some of the most significant changes and how they may affect product design.

Clause 4: General Requirements

The most important change in the third edition's general requirements is that manufacturers must apply risk management (in accordance with ISO 14971) to the device being certified to the third edition of 60601-1.² This requirement, found in clause 4.2, combines—for the first time—the need to comply with both a product and a process standard.

Most manufacturers already have some form of risk management process in place that is at least loosely based on ISO 14971. Hence, some may question why this new requirement is significant. In short, the requirement is important because compliance with this clause is more onerous than it may seem. It is not a matter of simply showing that a risk management process is in place and that the product went through that process. Rather, the risk management file will become part of the submission of a device for certification to IEC 60601-1, 3rd ed.

Clause 4 specifically requires the device to be evaluated using risk management to determine whether there are additional hazards not addressed in 60601-1, especially those that are associated with characteristics considered essential performance. Essential performance refers to those characteristics of a device's operation that can directly affect the safety of the patient, the user, or others. Clause 4 also requires the expected service life to be established, and it requires that parts of the equipment be evaluated to determine whether they are likely to touch the patient. In addition, the clause provides a clear description of how certification bodies are to decide whether a manufacturer's risk management process has been adequately applied to the device.

Compliance with the general requirement to apply risk management is determined by verifying the following:

• The manufacturer has applied a risk management process compliant with ISO 14971 to the equipment.
• The manufacturer has established the acceptable level of risk, and all residual risks (not only those addressed in 60601-1) have been reduced to an acceptable level.
• All data and analyses required by 60601-1 have been included in the risk management file.

It is critical to remember that the certifiers are not authorized to evaluate the quality of the risk analysis. They are not to second-guess a manufacturer's determination of risk levels—they are only to ensure that the required tasks have been performed. If a manufacturer has a quality system in place that has been certified by a third party, and if the risk management process is covered by that certification, the certification body need not reaudit the system for compliance with ISO 14971.

References to risk management and requirements to include information in the risk management file are wide-spread in the third edition. At last count, the new standard uses the word hazard 337 times; risk, 631 times; and risk management, more than 230 times. In fact, more than 80 clauses specifically require information to be placed into the risk management file.

Clause 8: Electrical Safety

In the second edition of IEC 60601-1, protection from electric shock could be achieved by isolating hazardous voltages from individuals. More often than not, one or more layers of insulating material achieved this isolation. The tests that these types of insulation must pass (dielectric withstand and, where appropriate, creepage and clearance) were the same for protecting both patients and users of the equipment. In the third edition, basic and double/reinforced insulations have been replaced by one or two “means of [patient and operator] protection.” The requirements that the insulation must meet depend on who is being protected.

For “means of patient protection,” the third edition sets essentially the same requirements as the second edition. “One means of patient protection” in the third edition is equal to the second edition's “basic insulation.” The third edition's “two means of patient protection” is equal to “double/reinforced insulation” in the second edition. This means that insulation designed to comply with the second edition requirements will, generally, meet those of the third edition.

The third edition's requirements for “means of operator protection” are identical to the insulation requirements from IEC 60950.³ These requirements are less severe and, in many cases, will enable system components made for information technology (IT) equipment to be used. IT equipment that may be used includes power supplies, transformers, and personal computers. This change can significantly reduce cost, because meeting the second edition's requirements that all insulation provide the same level of protection for both the patient and operator has often required custom-designed rather than off-the-shelf IT components. But how does one determine whether to implement means of patient protection or means of operator protection?

In essence, the critical determining factor is whether a given portion of the equipment will touch the patient. If so, then means of patient protection will be required. Patient contact falls into two types: applied parts, which are parts that must contact the patient for the device to work as intended, and parts that need not contact the patient but are likely to do so during normal use. Parts that fall into the latter category must be treated as applied parts. According to the third edition, it is a manufacturer's responsibility to determine into which of these categories parts of the equipment fall.

The difference between these two types of patient contact can be illustrated by examining a typical electrocardiograph (ECG). Obviously, the electrodes of an ECG are applied parts. Most certification bodies have also considered the individual leads that attach to the electrodes to be applied parts. Typically, it would be impossible for the electrodes to attach to the patient without the leads also contacting the patient. However, the decisions about whether the lead cable is an applied part have been inconsistent.

The third edition provides diagrams that show some types of medical electrical equipment (such as the ECG example) and explains how to determine which are applied parts. It also illustrates those that need to be treated as applied parts. Following this guidance, the lead cable will typically fall into the category of parts that are not applied parts but that need to be treated as such. The evaluation to determine which parts of the equipment are likely to contact the patient must be placed in the risk management file along with the results of that evaluation.

Clauses 9 and 15: Mechanical Safety

In the second edition of IEC 60601-1, mechanical hazards are not addressed in detail. In that version of the standard, the mechanical requirements address the strength of the equipment where it will support the patient. The standard also includes guidelines for the parts of the equipment that have enough mass to create a hazard if they fall, or where failure of the enclosure could expose a hazard, such as sharp or rough edges that could cause abrasions or cuts. However, the level of detail in the mechanical requirements of the second edition is, in most cases, minimal.

By contrast, the mechanical requirements of the third edition contain considerable detail and address a far broader range of specific hazards. One of the most notable additions to the mechanical requirements deals with pinching and shearing caused by moving parts. The third edition draws on standard anthropometric data (statistical averages of human body dimensions) to set maximum and minimum spacing. To ensure that moving parts do not cause injury, the spacing must be maintained. The dimensions are intended either to prevent parts of the body from fitting between two moving parts or to ensure that the openings remain wide enough to prevent injury.

To prevent exposure of hazardous electrical or mechanical components, the third edition also adds new requirements and tests. These should be familiar to manufacturers who have certified products to UL 544 or even UL 2601-1.^4,5 The standard now requires the molding stress relief test. It requires that thermoplastic components of an enclosure be exposed to elevated temperatures (70ºC minimum) for seven hours and then allowed to cool. After cooling, any deformation that occurs must not enable access to any hazards or reduce electrical creepage and clearance distances below allowable limits.

The clauses addressing the mechanical strength of parts that support patients or potentially hazardous masses still set requirements for safety factors (the ratio between intended load and failure point for mechanical structures). However, the second edition offered only two options: 4¥ for parts with safety systems (backup support systems) whose strength does not degrade with wear, and 8¥ for parts that are likely to degrade and do not include a safety system. The third edition includes these options as well as a set of new ones. To understand the new options, it is important to first understand the basis of the second edition's structural requirements.

The 4¥/8¥ safety factor requirements in the second edition presumed that the complex shapes of equipment parts made it difficult to understand the mechanical properties of such parts. Therefore, the standard set conservative minimum safety factors. However, today's mechanical engineering technology and tools such as computer-assisted design enable, in most cases, a thorough understanding of the structural characteristics of equipment parts. For this reason, the third edition requires the traditional 4¥/8¥ safety factors for parts whose mechanical properties and loading characteristics are not thoroughly understood. However, the standard applies a lowered set of safety factors when such properties are understood. When the structural and loading characteristics of the part are fully understood, the 4¥/8¥ safety factors are reduced to 2.5¥ and 5¥. And, of course, documentation showing that these parameters are fully understood must be placed in the risk management file.

In addition to enabling certain reduced safety factors, the third edition permits increased flexibility in verifying mechanical strength. While the second edition offers only static loading, the new document allows dynamic loading that reflects actual use and durability testing as an alternative. Although such testing is typically a more-complex and time-consuming process, many manufacturers may already use these techniques in their reliability test programs. Under the third edition, such testing may be considered adequate to demonstrate sufficient structural safety. Documentation of the analyses that determined the parameters of such tests, and the results, must be placed in the risk management file.

Another area of mechanical safety that was not addressed in the second edition is that of noise and vibration. A requirement in the third edition states that “ME [medical electrical] equipment shall be designed so that human exposure to noise, vibration, and acoustic energy shall not result in an unacceptable risk.” It adds that alarm signals are exempt from the limitations on noise levels but that alarms must comply with the requirements of the collateral standard for alarms, IEC 60601-1-8.⁶ Clause 9 of the third edition sets requirements that noise levels (associated with operation) must not exceed 85 dbA if they are continuous and 140 dbA if they are impulse. When noises generated are neither continuous nor impulse, the 85 dbA value is increased by 3 dbA each time the duration is halved. For example, noise must not exceed 88 dbA for 12 hours, 91 for 6 hours, etc. This means that the duration of an impulse can be no more than 42 seconds.

Although hazards from vibration have been addressed in the third edition, current conflicts in scientific and clinical opinion limit the scope of these requirements to hand-transmitted vibration. The limit for such vibration is 2.5 m/sec2 for vibration that will have a duty cycle of 8 hours over a 24-hour period. For shorter periods, the dbA limit is inversely proportional to the square root of the ratio between 8 hours and the shorter period t. So, the dbA limit is expressed as

This means that for a 2-hour exposure, the limit would be 1.25 m/sec2.

Clause 11: Thermal and Fire Safety

The second edition of 60601-1 contains requirements about the temperature of components and surfaces that can be touched by users or patients. However, it does not specifically address the flammability of materials used. The third edition addresses both of these issues.

The new standard provides guidance similar to the second edition with regard to the temperature of components and surfaces that can be touched. But it does so in a way that is easier to understand. In addition, components and materials that cannot be touched are required to remain within the rated operating temperatures or below the ignition temperature of the material if it has no rating. These limits are listed in Table 20 of Clause 11.

Temperature limits for parts likely to be touched by the patient (i.e., applied parts) are set out in Table 22. The most interesting change is that the maximum temperatures vary based on both the materials involved and the duration of contact. In the second edition, the temperature limit of applied parts was set based on the worst-case scenario of thermal conductivity and time combined. As a result, the second edition set a limit of 41ºC for all applied parts that are not intended to supply heat. However, when the third edition takes these factors into account, the result is a range of temperatures from a high of 60ºC to a low of 43ºC. Most notably, the new standard allows 43ºC in many circumstances where the second edition allows no higher than 41ºC. However, the third edition requires notification in both labeling and instructions if the applied part exceeds 41ºC. Determination of contact time must be documented in the risk management file.

The change to allow 43ºC was one of the most controversial changes in the new standard. The rationale for the requirement explains that, while 41ºC is an appropriate limit for equipment parts that will be in continuous contact with some patients, 43ºC is reasonable for many types of equipment. Also, the 41ºC limit could prove costly to meet. To use the increased limit, manufacturers must evaluate certain important characteristics of the patients that the equipment would be used to treat. The evaluations must show that the higher limit would not pose an unreasonable risk to the patients. Again, these analyses must be included in the risk management file.

Table 21 of the third edition sets temperatures limits for the parts that can be touched by people other than the patient. The second edition of 60601-1 included limits for such temperatures in Table Xa. They were included with general materials temperature limits, making them difficult to find. In addition, the description of such parts was confusing, and the limits were frequently misapplied. In contrast, the format of Table 21 in the third edition is identical to Table 20 (applied parts). The table sets a range of limits based on the thermal properties of the material and the likely duration of contact. The limits for these parts is a maximum of 86ºC for materials such as wood, where contact is 1 minute or less, and a minimum of 48ºC for all materials where contact will be 10 minutes or more. Contact duration must be evaluated and documented in the risk management file.

Conclusion

The third edition of IEC 60601-1 represents a major step forward in medical device standardization. Requiring the use of ISO 14971 for risk management ensures that manufacturers can meet the implied requirement of the second edition to look for hazards beyond those addressed in the standard. It also ensures that this can be done using a consistent process. The same applies for cases in which designers want to address a hazard using techniques that differ from those identified in the standard. In general, the flexibility specifically allowed in most of the requirements in the third edition should help to create new devices efficiently and at a reasonable and competitive cost. However, the standard has changed radically. It is crucial that design teams begin to become familiar with the document.

References

1. Mike W Schmidt, “IEC 60601-1, 2005: A Revolutionary Standard, Part 1,” Medical Device & Diagnostic Industry 27, no. 2 (2005): 50–56.
2. ISO 14971:2000, “Medical Devices—Application of Risk Management to Medical Devices” (Geneva: International Organization for Standardization, 2000).
3. IEC 60950-1, “Information Technology Equipment—Safety—Part 1: General Requirements” (Geneva: International Electrotechnical Commission, 2001).
4. UL 544, “Medical and Dental Equipment” (Northbrook, IL: Underwriters Laboratories, 1999).
5. UL 2601-1, “Medical Electric Equipment, Part 1: General Requirements” (Northbrook, IL: Underwriters Laboratories, 1997).
6. IEC 60601-1-8, “Collateral Standard: Alarms Systems—General Requirements, Tests, and Guidance for Alarm Systems in Medical Electrical Equipment and Medical Electrical Systems” (Geneva: International Electrotechnical Commission, 2003).

Copyright ©2005 Medical Device & Diagnostic Industry