Single Fault Condition IEC 60601 Clause 8.7.1 shorting Cr/Cl in Patient Applied Part

[TonKuijper]

Hello experts,
(sorry for my long first entry)

My question is about ME EQUIPMENT, Class IIa, type CF.
That means a SINGLE FAULT CONDITION PATIENT LEAKAGE CURRENT of max.50uA.

I went through loads of information on the internet and always see examples that have to do with mains voltages of 230V on the PATIENT APPLIED PART against real ground.

The instrument under test is in a plastic housing with no touchable metal parts.
The system consists of a network interface on a PC cart connected by a cable tot an amplifier near the patient.
The network interface is powered by a 24V DC adapter and the amplifier has an internal DC/DC converter from 24V to 5V. Both the adapter and the DC/DC converter are isolated and Certified for IEC 60601-1, 3rd edition type CF.
The 5V is linear regulated inside the amplifier to +2.05V and -1.25V (total 3.3V).

My problem with the Test House:
The SINGLE FAULT CONDITION (SFC) PATIENT LEAKAGE CURRENT exceeds the maximum value of 50 uA when they short the Clearance/Creepage at the secondary (floating) side.
This is according to clause 8.7.1 in the test report.

The electrode inputs are protected with series resistors (size 0603) to limit single fault currents to approx. 10uA (max. allowed is 50uA) in case the electrode shorts to the power supply of max. 2.05V due to a worst case (full short to VCC) active component failure.
These resistors are on the amplifier PCB and all floating circuits have an adequate creepage/clearance distance to the 24V input of the DC/DC converter.
Data communication is with an IEC 60601-1 type CF certified digital isolator.

The limiting resistors have a normal (small) distance to the other (floating) circuitry on the PCB.
Is this distance the creepage/clearance that must be shorted in the SFC test?

I understand from the IEC 60601-1 that a SFC condition can also be TWO SFC’s if the first is not detectable. The limiting resistor is bypassed by a capacitor to lower the impedance and can fail shorting without being noticed. One must assume that later an active component can fail while the limiting resistor is a short.

Is this shorting in the test something normal for this clause 8.1.7 SFC test?
Or is it only needed for the DC/DC converter isolation (already done by the manufacturer for the certification).

 

[Peter Selvey]

My first instinct is this looks too complex to handle via a this kind of forum, it might need access to the actual design documents, function, specifications, circuit diagrams, PCB layout etc

I can say in general though any typical device with electrodes such as an ECG would probably fail a strict reading of the standard. In these circuits, the creepage/clearance are usually too small so they can be shorted as "normal condition" under Clause 8.1 (a). Eventually you would be able to find a path that exceeds 10µA. On top of that you also have the sleeping fault theory that if fault is undetected, you can add another fault. Putting those two together it should be child's play to find a non-conformity.

But, most labs don't inspect ECG and similar circuits strictly according to the rules.

Mostly this is done without thinking, i.e. the lab just doesn't think to apply the rules at that level. But it does make sense.

These requirements were built around high risk scenarios, i.e. a reasonable prospect of patient death if an insulation or part were to fail.

In reality the CF limits are not really that critical to warrant a strict interpretation of the standard.

For DC, the limits of 10µA and 50µA are based on tissue necrosis, which is not high severity harm. Also, these limits are based on 1mm² contact area, and very long duration (hours). If the contact area is large e.g. 1cm² you would need 100x (e.g. 1mA/5mA), and still long duration.

For AC, the limits are based on direct contact with the heart again through a small 1mm² contact area, which is extremely rare. Most CF rated equipment does not actually contact the heart in this way. For currents outside the body, you need about 40mAac in order to get any significant risk of stopping heart or breathing. There is a risk of burns though I²R heating, but again the limit of 10mArms in the standard is very conservative and based on a small contact area.

Chances are, your application has a larger contact area, might be short term, no where near the heart etc, so 10µA and 50µA are already way overkill. So, strict interpretation about component faults, creepage and clearances, MOPP etc is going to be a massive overkill.

The question you need to ask the lab: have they applied the same interpretation to all ECGs and similar devices?

 

[TonKuijper]

Thank you Peter for your comprehensive answer!

You clearly are a person understanding electrical safety with practical experience.
Of course I fully agree with you that the risk is not that high.

Problem is that this (large) testlab has established an interpretation at the top level and test engineers cannot deviate from that.
Their interpretation is that table 12 should be applied to patient applied part circuitry while I am sure it is intended only for isolation between mains supply and patient applied part.
The IEC 60601-1 is not clearly stating that table 12 is for mains isolation. You can indirectly find this via appendix for explosive environment where they state that you should check table 12 between "mains connector" and patient applied part.

We use a CF certified mains adapter to make 24V for the network interface (connected to PC) and the amplifier.
Inside that amplifier is a DC/DC converter to 5V followed by a linear regulator to 3.3V that powers the circuitry (+2.05V and -1.25V against 0V ref).
Applying table 12 to the circuits at max. 2.05V makes design impossible.

General problem is that the standards often have errors and are unclear.
Far too much multi-interpretable.
In the new IEC 60601-2-26 are even test circuits which refer to a certain switch number that cannot be found in the corresponding test schematic.

We now have to switch to another testlab that thinks more normal.

As an example of how ridiculous testlabs can be:
The test engineers told me that they have to use their labs interpretation but are sure our competitors will not have such demands from their testlabs.

 

[Benjamin Weber]

Table 12 is definitiely not just for mains isolation. If this was true, there would be no minimum required CD/AC for patient protection in secondary circuits!

The problem with answers like "the standard is to tough, in your specific application the limits can be much higher" is: If a certain maximum allowed value is exceeded, the tester has to evaluate the result as "failed". Only if your risk management can really show, why other limits are applicable to your decice, the tester can deviate (see. cl. 4.5 regarding "alternative risk control measures").

Regarding the shorting of CD/AC: This is usually only possible for CD/AC which is specified as one single MOPP (see cl. 8.1 b)). In most cases I have seen, the CD/AC are specified as two MOPP (reinforced insulation). So there is no single MOPP to bridge. Good example I have seen is a ADUM4160-isolator from Analog Devices in combination with a PCB having broad grooves (e.g. >8mm for 2 MOPP@250Vrms) between the patient side and the supply side. In this situation there is no single CD/AC to bridge on the PCB and the isolator comes with the relevant compliance documentation for reinforced insulation for 250Vrms.

As Peter already said, it is hard to say where the SFC-short was applied by the test lab. But they should be able to tell you exactly, how they performed the test.

 

[TonKuijper]

Table 12 is definitiely not just for mains isolation. If this was true, there would be no minimum required CD/AC for patient protection in secondary circuits!

The problem with answers like "the standard is to tough, in your specific application the limits can be much higher" is: If a certain maximum allowed value is exceeded, the tester has to evaluate the result as "failed". Only if your risk management can really show, why other limits are applicable to your decice, the tester can deviate (see. cl. 4.5 regarding "alternative risk control measures").

Regarding the shorting of CD/AC: This is usually only possible for CD/AC which is specified as one single MOPP (see cl. 8.1 b)). In most cases I have seen, the CD/AC are specified as two MOPP (reinforced insulation). So there is no single MOPP to bridge. Good example I have seen is a ADUM4160-isolator from Analog Devices in combination with a PCB having broad grooves (e.g. >8mm for 2 MOPP@250Vrms) between the patient side and the supply side. In this situation there is no single CD/AC to bridge on the PCB and the isolator comes with the relevant compliance documentation for reinforced insulation for 250Vrms.

As Peter already said, it is hard to say where the SFC-short was applied by the test lab. But they should be able to tell you exactly, how they performed the test.

Thanks Benjamin!
I will look into the clauses you refer to and find out what the testers did.

 

[Peter Selvey]

Just to clarify: the situation appears to be application of creepage/clearance within a circuit, rather than the normal application between two isolated circuits or two isolated parts. For isolation between circuits (such as where you would use an ADUM4160) is usually no problem to comply with distances in the standard.

However, for application within a circuit it is a very different matter. These are normally considered functional, but in some cases simple SMD parts like diodes, resistors, capacitors may be involved in keeping the currents below the 10 and 50µA limits.

For example, in most ECGs there is a resistor in the right leg drive, typically around 470kΩ which is there to prevent potential currents in the order of a few mA if there was a fault in one of the other electrodes, such as shorting one of the ESD diodes at the op-amp input. As explained before these currents can cause tissue necrosis if the application site is small and the duration is long.

Technically, strictly, based on the definitions of the standard, both the ESD diode (or similar parts) and the 470kΩ resistor each represent an MOPP as both protect against currents exceeding the limits. Hence they should comply with Clause 8 and in particular 8.8 and 8.9. However, it would be impractical to apply the test values in those clauses, and they don't make sense as (a) they are based on issues associated with mains circuits and (b) because the severity of harm is not so high.

To see this more clearly, consider that in the base standard for insulation co-ordination IEC 60664-1, the recommended value for 2MOP at 10V on a printed circuit is just 0.08mm, a value which is so small it is no problem for designers to meet.

But the limit in IEC 60601-1 for the same voltage is 3.4mm, some 42 times larger than is really needed. Why? It seems that the authors in IEC 60601-1 have applies all sorts of worst case assumptions which we often do when dealing with high severity harm such as death. But they don't make sense here.

Same with using a 500Vdc test for a part that is normally stressed at a few volts. It not just a little overkill, it is a massive overkill and out of place for the hazardous situation.

Because there is such a big difference between reasonable and the requirements in the standard, most test engineers don't even think about trying to apply this within a circuit, and so it just get ignored.

That is actually going to the other extreme - the manufacturer and the test labs should identify any parts which are put there deliberately to minimize currents in fault condition, such as the 470kΩ resistor in the ECG example. They should be in the critical component list, and where appropriate check for use within specifications. It just needs to have 8.8, 8.9 quietly ignored.

 

[william guo]

About 2 years ago, I got an informative feedback from IEC WG14 about this topic, which stated that" It is recommended to regard protective impedances provided by resistors and/or capacitors and/or other electronic components inside the APPLIED PART circuit as MOP. These kind of components should be checked in NORMAL CONDITION and under fault tests for PATIENT AUXILIARY CURRENT and PATIENT LEAKAGE CURRENT. However, it is recommended that these components should not be subject of dielectric strength test, CREEPAGEDISTANCE and AIR CLEARANCE requirements."

 

[Peter Selvey]

That's a great confirmation of common sense William!

But it would be nice if they put it in the standard. This kind of stuff is not rocket science and they are charging a fortune for IEC and ISO standards these days despite being full of these kind of errors, and having a big impact on the cost of development of medical devices. I feel like there needs to be some kind of exposé into the standard development process, along the lines of IOC, FIFA etc

 

[Ulrich Batzer]

About 2 years ago, I got an informative feedback from IEC WG14 about this topic, which stated that" It is recommended to regard protective impedances provided by resistors and/or capacitors and/or other electronic components inside the APPLIED PART circuit as MOP. These kind of components should be checked in NORMAL CONDITION and under fault tests for PATIENT AUXILIARY CURRENT and PATIENT LEAKAGE CURRENT. However, it is recommended that these components should not be subject of dielectric strength test, CREEPAGEDISTANCE and AIR CLEARANCE requirements."

Dear William, I would love to have that information more officially. Which WG14 did you contact? Can you maybe share your contact? Thank you!