IEC 60601-1-2: Is EMC immunity testing required for a device without essential performance?

[dloeckx]

We are developing a device to automate a currently manually performed clinical diagnostic tests. This test is not time critical, and a wrong outcome (either false positive or false negative) wouldn't lead to unacceptable risk. Because of this, and as a consequence of our risk analysis, we haven't defined any essential performance for the device.

Question 1: Does this mean there is no need to perform EMC immunity testing?
Question 2: Should we test (mitigations for) basic safety that might be influenced (with low probability) by EMC immunity testing? What would such criteria look like?

For reference: IEC 60601-1-2 Annex I only lists functional criteria, whereas §8.1 explicitly mentions basic safety and essential performance to determine the pass/fail criteria.

 

[Peter Selvey]

For question 1:
EMI testing is intended to represent the "normal environment" so common sense says performance (normal functionality) should be OK in this environment. To put another way, if in the normal environment, a diagnostic device is always wrong 100% of the time, and somehow the risk management determines that is acceptable, then the device must be useless and cannot be a medical device, since it doesn't actually do anything of diagnostic value.

Which is obviously not the case, so something has gone wrong in the analysis.

There are a few potential causes here:
(1) the criteria used for risk acceptability is off base, or the overall scheme of allocating probability and severity is malfunctioning
(2) only "direct harm" is being considered, which it no longer the case. IEC 60601 series switched to cover both direct and indirect harm in the 3rd edition, which includes false diagnosis
(3) the "no essential performance" (no EP) route is deliberately being used because it makes IEC 60601 series testing simpler especially when test labs are involved. It's partly a problem with the standard in that several tests/requirements are overkill so the "no EP" helps out on that side (e.g. PEMS)
(4) malfunction due to EM noise is already considered low probability without testing, and hence the risk is acceptable; usually the response to EM noise is difficult to predict but in some cases it could be a reasonable assumption

Quite a few manufacturers claim "no EP" to keep it simple but still check for performance/function in EMI testing anyway "just in case", so they are taking option (3) to avoid some of the crazy still in the main standard but aware for EMI testing it still makes sense.

Another point to consider is that just because EP is identified, it doesn't automatically mean it needs to be verified in each test that refers to EP. For each test, the engineers can decide a reasonable approach which can range from nothing to spot checks or full blown performance testing. For EMI testing, special software can be used to detect if EMI is causing any issues.

For example consider a system that normally makes a diagnostic interpretation from a variable signal coming from a sensor. It might be difficult to simulate that during EMI and other testing. However, this can often be replaced with a static signal and special software that watches for a static level and alarms if the deviation exceeds allowable limits. It's not difficult to do, so really no excuse not to do it.

For question 2:
Most low risk devices don't have much in the way of "active electronic systems" involved in basic safety so EMI wouldn't apply. Basic safety is more by solid barriers, fuses, materials, spacings etc that are unaffected by EMI. However it can happen, for example a sensor that detects an open access door, feeds into the CPU that turns off the motor/laser/heater etc

 

[Benjamin Weber]

I had long discussions with EMC labs on exactly the same question: No EMC relevant risks with respect to immunity testing. Why doing immunity testing at all and using irrelevant pass/fail criteria (e.g. display ist allowed to turn off but shall recover within 5 seconds)?

The answers from the EMC labs were: 60601-1-2 unfortunately does not explicitly allow risk management argumentation to not perform immunity testing. So pleased make some easy pass/fail criteria and just do the tests. (Well who can blame them for wanting to do more tests to earn money ;-) )

But in my oppinion, RM can so such an evaluation to skip immunity testing. But as mentioned above: You really have to have a very good argumentation!!!

 

[dloeckx]

Dear Peter and Benjamin, thank you very much for your answers!

EMI testing is intended to represent the "normal environment" so common sense says performance (normal functionality) should be OK in this environment.

First of all, this clarifies to me that the immunity testing is supposed to represent the 'normal' environment, which obviously makes sense but I didn't realise it yet.

However, I am confused between performance and essential performance, with the latter defined in IEC 60601-1 as performance necessary to achieve freedom from unacceptable RISK. This goes beyond normal performance in my view. And the way I read IEC 60601-1-2, we have to proof that the device will keep essential performance under immunity testing, without any mentioning of normal performance. Or to paraphrase: common sense says normal performance should be ok under immunity testing, yet the standard only says essential performance should not be impaired. Do I see this correctly?

I had long discussions with EMC labs on exactly the same question ... You really have to have a very good argumentation!!!

So we at least are going to try. However, whom should we discuss with: the EMC lab or our notified body?

 

[Peter Selvey]

I think the original driver behind essential performance was to try and narrow (filter) things down that need to be tested after (and during) the various "stress" tests in the standard, such as EMC, water ingress, drop tests, defib protection, cleaning etc etc. Having decided that performance should be included as a matter or safety (which is correct), they panicked and threw in a rather simplistic risk based assessment.

Not surprisingly, it doesn't work in practice.

The first problem is that there is no test that establishes "baseline performance", in advance of the individual tests. Obviously, not every test is going to affect every aspect of performance, for example, in a waterproof test, a realistic criteria might be to check that no water gets inside on the PCB rather than a full blown performance test. Great idea. But this assumes that a baseline performance test is OK prior to the waterproof test. Of which there is no baseline performance test in IEC 60601-1. So, bang, out of the blocks the standard is already last in the race for common sense.

Once baseline performance is established we can then consider each test on a case by case basis, depending on (a) how likely the test condition is to occur (b) whether the test is likely to affect the particular performance aspect, and (c) how critical that performance aspect is. Plus we can add in a range of options for criteria; you don't always need a full blown performance tests, spot checks, dummy software, simple inspections etc can be used as appropriate. It's not rocket science and not that difficult. But .... it's also highly specific to the individual test and the technology use in the individual implementation. Hence, a general list of "essential performance" that is agnostic to the test/implementation never made sense. By now the standard is 10 laps behind in the race of common sense. And it's 17 years old! Come on guys.

For EMI testing, the standard says it is intended to represent the normal environment, so (a) is 100% likely. So the decision whether to monitor depends on (b) how likely the EM source will affect the function and (c) how critical it is. Again, this is not a broad decision. EMI testing involves radio frequency via air, radio frequency via mains and signal cables, ESD, magnetic fields and so on. These are very different so what makes sense to monitor in one test might not for another. Again, a single list of "essential performance" really makes no sense.

Consider a low risk device that uses a sensor that is easily damaged by ESD. Is it OK to claim "no essential performance", avoid ESD testing, claim the risk is acceptable and put the device on the market? No. Absolutely not. It doesn't matter how low risk it is, it's fundamentally wrong.

On the other hand, if it's a low risk device where the nature of the technology is clearly immune to ESD testing, well, yeah, go ahead, skip the test.

The problem (which is now 17 years old ...) is that "essential performance" as defined in IEC 60601-1 can't tell the difference between these two scenarios.

 

[Tidge]

[QUOTE="Benjamin Weber, post: 682453, member: 317253"But in my opinion, RM can so such an evaluation to skip immunity testing. But as mentioned above: You really have to have a very good argumentation!!![/QUOTE]

60601-1 should allow risk management to allow for non-compliance with (not precisely the same thing as "skipping") certain parts of the standard (as well as collaterals and any particular), but this is a very difficult path to follow with NRTLs.

My understanding of (where necessary) considering Essential Performance in 60601-1 testing is the same as @Peter Selvey described.

 

[Benjamin Weber]

I just had a look into the current edition (2014+A1:2020). And I think the main problem is the inconsistency between the definition of (a) "essential performance" and (b) "EM disturbance" and the requirement of subclause 8.1 regarding pass/fail criteria for immunity testing:

"Before IMMUNITY testing begins, the MANUFACTURER shall determine specific, detailed IMMUNITY pass/fail criteria, based on applicable p"art two standards or RISK MANAGEMENT, for BASIC SAFETY and ESSENTIAL PERFORMANCE with regard to EM DISTURBANCES. The MANUFACTURER shall also determine how the ME EQUIPMENT or ME SYSTEM will be monitored during the tests to check for compliance with the specific pass/fail criteria. These pass/fail criteria and this monitoring specification should be included in the test plan and shall be included in the test report and the RISK MANAGEMENT FILE."

and

"IMMUNITY pass/fail criteria may specify degradations that are acceptable because they do not result in unacceptable RISK."

Here clearly BS and EP and "unacceptable risk" are referenced. From this, one could conclude that there may be no degradation that could result in an unacceptable risk (be it BS or EP). If so, immunity testing would not be needed.

The point is, that the term "EM disturbance" is defined as follows:

"any electromagnetic phenomenon that could degrade the performance of a device, equipment or system"

Here "performance of a device" is much broader, than BS, EP or "unacceptable risk". From this definition, one could now conclude, that immunity testing shall be performed with regard the "general performance" (i.e. not related to risks). Of course a manufacturer should be interested in developing a device, that just operates "as promised to the customer" in terms of marketing claims, general product quality etc. But from a safety and risk point of view, these performces characteristics may be absolutely irrelevant.

To make a long story short: In my oppinion the manufacturer should be allowed to evaluate the immunity related performances with resspect to unaacceptable risk. And in case that all degradations during immunity testing are acceptable, immunity testing should not be required.

Example: Think of a device that is used to perform balance analysis of patients. The patients stands on a platform equiped with load cells and analyses the force distribution along the sensors over time. There is no essential performance, the results are just used in combination with other diagnostics and always interpreted by a professional.
Of course there might be EM disturbances of the sensors, the processing system and the display. But the risk might be acceptable, if the sensors show wrong values or the values are processed wrongly. There are no electrical or other hazards hazards, that could arise from EM disturbances.
From a safety point of view, immunity testing does not make sense, from a quality point view is makes sense.

 

[Peter Selvey]

I think the implicit assumption in the example of the balance is that for the most part the balance works OK in the real world. Which is not unrealistic: using normal design practices, common sense, feedback during the design phase, desire to sell the device without heaps of complaints, all of this would make most devices fairly robust against EM noise and other environmental stresses like temperatures, humidity, liquids, mechanical etc, even without formal testing.

Plus, although the EM fields used in testing are meant to represent the "normal" environment, of course the real world is a lot more random so the probability of any individual location have a particular type of noise (amplitude, modulation, direction etc) is fairly low. The same may be true for other "normal condition" stress testing, like water ingress, mechanical, temperature, humidity and so on. We might test a device to see if it performs properly at max temp in the IFU, but how often do people really use a device in a 40°C room?

So there are probability factors built in both due to the "natural" robustness of the design and also the real world parameters being narrower than test parameters in standards. What we are really saying is that even without formal testing, we don't expect any problems in the real world. For a low risk device, in the occasional case where problems do occur, it's not a big worry. So it is acceptable (low probability, low severity). As a rough guide, even a low risk device should perform according to specification at least 99% of the time.

While often reasonable, it's important to keep these hidden probably factors in mind.

Consider a technology that is highly susceptible to environmental stresses, and special design techniques are needed to defend against stresses (for example, a sensor highly susceptible to ESD, has special design to divert ESD away). Even if it is a low risk device, testing to verify these special techniques are effective is reasonable. The claim of no essential performance would not make sense.

Or consider a case where the testing parameters are representative of the real world. For example, a device that is designed to be used in the shower with the patient, and will actually be frequently used in a shower in the real world. Again, even if it a low risk device, a claim of "no essential performance" in waterproof testing designed to simulate use in a shower would not make sense.

Finally, there may be cases where a lazy, inexperienced or cheap designer doesn't apply normal techniques to minimise trouble due to EM noise or other stresses, so the resulting device frequently fails in the real world. Again, that would be not acceptable, irrespective of how low risk the device is.

So, to summarise, in practice a claim of "no essential performance" is reasonable only if it's plausible to assume the device will have a fairly low probability of failure even without testing. Which is often the case, and if so, go for it!

 

[Tidge]

So, to summarise, in practice a claim of "no essential performance" is reasonable only if it's plausible to assume the device will have a fairly low probability of failure even without testing. Which is often the case, and if so, go for it!

When I was asked to explain what the essential performance statement should be for a medical device, my advice was always: "Start with a one sentence medical reason for why this thing should even be near a patient." If there is no such reason, don't bother marketing it as a medical device.

 

[Benjamin Weber]

I am really sorry, but I have to disagree here regarding the definition of "essential performance"! IEC 60601-1 defines EP in cl. 3.27 quite clearly:

"performance of a clinical function, other than that related to BASIC SAFETY, where loss or degradation beyond the limits specified by the MANUFACTURER results in an unacceptable RISK

NOTE: ESSENTIAL PERFORMANCE is most easily understood by considering whether its absence or degradation would result in an unacceptable RISK."

In my understanding, what Tidge wrote is not in line with this definition! There are many medical devices without EP which of course have the full justification to be a medical device and should not be "banned" from being near a patient! Many devices will have a clinical function (demonstrated via clinical evaluation) where the loss or degradation will not result in an unacceptable risk. I would also assume, that in many devices the complete loss of the clinical function will result in a safe state, e.g. the device just doesn't work at all.
Think about a blood pressure device for homecare, that just does not turn on any more due to EM disturbances (to stick to the original topic)! What happens in these cases? And is the resulting risk unacceptable? Nobody is harmed, it is just an inconvenience and of a course a reason for the patient to be unsatisfied. And even if the measurements are inaccurate: These devices are not intended for being the only source for additoinaly therapeutic decisions. this always be done by a healthcare professional on the basis of several other diagnostic indicators. Of course this might be completely different for blood pressure monitoring in the clinic.