IEC 60601-1 Essential Performance - Is the signal accuracy specification an essential requirement?

[shimonv]

Hi all,
The IEC 60601-1 defines essential performance as:
"performance of a clinical function, other than that related to BASIC SAFETY, where loss or degradation beyond the limits specified by the MANUFACTURER results in an unacceptable RISK

NOTE ESSENTIAL PERFORMANCE is most easily understood by considering whether its absence or degradation would result in an unacceptable RISK."

My system has a signal accuracy specification. Loss or degradation of it could result in unacceptable risk.
My system also as a signal quality indicator that constantly monitors the signals. If the signal accuracy specification is outside the spec it alerts the user and the procedure is suspended.

Question: Is the signal accuracy specification an essential requirement?

Thanks,
Shimon

 

[Benjamin Weber]

The way you describe it, you actually answered the question yourself - Yes. (Maybe you want to re-evaluate this in detail)

The point now is, how to deal with the consequences? How works the signal quality indicator? What can go wrong, during signal quality evaluation? I guess this is done by software? Is the software development 62304 compliant? Usually the probability of software failure should be considered 1 (it will fail for sure). Your system shall be single fault safe, and your software will fail? What other instance do you have? Do you have another hardware supervising the processor, e.g. another independent processor?

Are the alarms 60601-1-8 compliant?

Does your signal output require calibration? If yes, what can go wrong during the calibration process?....

A lot of question can be raised in combination with essential performance.

 

[shimonv]

Hi Benjamin,
So what you are saying is, unless I have bulletproof controls for an important clinical function - it should be listed as essential performance. Correct?

I understand the logic but for the sake of electrical safety the don't challenge the robustness of mitigations, just check that it works in the framework of the standard.
Have you seen a 60601-1 report without essential requirements?

 

[Benjamin Weber]

Ask the other way around: Have I seen Test reports WITH essentiell performance? Rarely.

ME equipment where only 60601-1 applies usually don't have EP. A lot of ME equipment can simply turn off without posing any harm to anybody. And you have be careful to not confuse basic safety and essential performance, as i wrote earlier.

An electrostimulating device's clinical function is the output of an electrical current to the patient. If the output is specified to be maximum 1 mA, a false output of 100 mA means, it is out of specs. But I would not see essential performance here. Why? Because this is a loss of basic safety. The device does something, that it should not. It gives the patient an electrical shock.

But if the output hast to be within a certain range (let's say 1 mA +- 0.2 mA) and an output out of this range (let's say 1.5 mA) leads to an unacceptable risk, like a assumed therapeutic success is mit given and the patient is harmed by this, this would be essential performance (not an electrical shock, this would be loss of basic safety). My example may be Bad with respect to leakage currwnt limits. But i Just want to emphasize the difference between EP and BS.

A lot of particular standards defined EP for those devices. In this case the manufacturer doesn't have much choice.

When you conclude, that your device has a clinical function, that could lead to serious harm to a patient (i.e. unacceptable risk), if this function does not work as it should, you shall make sure, that this does not happen.

If the sensor ist specified to be accurate +-5% and a false sensor output of -6% leads to a wrong or no therapeutic intervention, you have to implement risk control measures, to mitigate this risk. This may be an alarm. But what If the sensor calibration was wrong in the first place? The sensor then seems to give an accurate reading and no alarm is given. You have to implement corresponding risk control measures regarding the calibration process.

There might be a way out: Does the operator have to rely on your sensor output? Or is this just an auxilliary tool and the operator always has to consider other factors?

For example pulse oximeters: A wrong sensor output of a false high oxygen saturation may lead to an unacceptable risk, e.g. patient is not ventilated correctly and suffers from hypoxemia, because the operator thinks the oxygen saturation ist fine. This would be essential performance according to the definition of 60601-1.

But usually pulse oximeter manufacturers say: The operator always has to perform another method for determination of oxygen saturation, e.g. blood gas analysis with an arterial blood sample. So this is not essential performance anymore.

 

[Tidge]

To help teams think about Essential Performance, I offer the following kernels to help them get started:

(1) An Essential Performance statement should succinctly make it obvious both what is the ME device you are manufacturing but also the clinical reason why someone is buying this device.
(2) The Essential Performance statement will be modified to address areas of unacceptable risk that would arise from the use of the device from both elements of (1).

The most useful essential performance statements are short. They are aligned with marketing materials (i.e. don't mislabel/mis-market the device) but typically an EP statement does not parrot the 'sales pitch'. In my experience, 'accuracy statements' don't belong in the EP, unless it is discovered through risk analysis that an inaccuracy is explicitly recognized as leading to an unacceptable risk. It has also been my experience that it is very difficult for teams to resist including 'features' of their device when thinking about Essential Performance. I cannot stress how important it is to avoid this trap.

The most important reasons (in the context of 60601-1 3rd edition) for have a clearly codified Essential Performance is to assist a Testing Laboratory to verify that ME devices still meet their Essential Performance requirements while being subjected to the basic safety tests of 60601-1. An example that is commonly given: under the 2nd edition, a ventilator could be certified to meet 60601-1 as long as it didn't catch on fire when tipped over... even if it stopped working. In the 3rd edition, the non-functioning ventilator (when tipped over) wouldn't meet EP and would not be certified.