Until very recently, it was possible to supply medical devices, equipment or systems to

Transcription

1 COVER DISCUSSION Risk Management and the EMC Standard for Medical Devices, Equipment and Systems IEC Editions 3 and 4 Keith Armstrong CherryClough Consultants Ltd. Introduction Until very recently, it was possible to supply medical devices, equipment or systems to the European Union (EU) as compliant with one of the three medical directives [1-3], when all that had been done for electromagnetic compatibility (EMC) was to comply with EN by passing certain standardized emissions and immunity tests - plus providing certain specified information in the user manual, and adding appropriate warnings on the equipment. The emissions and immunity tests listed in EN were identical to those in the original IEC version, IEC , which were in turn identical to the tests that can be used to provide compliance with the EU's EMC directive 2004/108/EC [4]. The EMC directive is specifically not a safety directive, when each of the three Medical directives are safety directives. As far as the author is aware, all medical manufacturers placing products on the EU's single market applied IEC/EN and assumed that declaring compliance with one of the three medical directives automatically provided compliance with the EMC directive. This situation has begun to change in June 2012, and over the next few years will become very different. Firstly, Edition 3 of the base medical electrical safety standard, IEC [5], made it necessary to use statistics-based Risk Management (RM) safety engineering techniques according to ISO [6] to help ensure that medical devices, equipment and systems were safe enough. Secondly, all of IEC 's "collateral" and "particular" standards had to be upgraded to employ RM safety engineering techniques according to ISO Thirdly, from 1 st June 2012 complying with any of the EU's three medical directives requires complying with IEC Edition 3 plus its upgraded "collateral" and "particular" standards. The USA will follow these requirements in IEC 's collateral standard on EMC, IEC , was published at Edition 3 in 2007 [7] and applied RM requirements to EMC for the first time. Unfortunately, these new RM requirements were not very obvious, and no effective guidance was provided. The author joined IEC MT23, the "maintenance team" on IEC , in early 2007, and so had no influence on its Edition 3. I was invited to join to help ensure that Edition 4 of IEC provided clear requirements and good guidance on the RM of EMC (RMEMC), which I hope we have achieved. Simply passing a few EMC emissions and immunity tests is now insufficient for complying with any of the three medical directives, and when IEC Edition 4 is published (probably in

2 2013) and replaces Edition 3 for compliance with the EU's medical directives (probably in 2015), it will no longer automatically provide compliance with the EMC directive. Some Background on RM: IEC and ISO Complex electronic equipment and systems (including programmable electronic equipment and systems) are now commonplace in our daily lives in applications where errors, malfunctions or faults can increase safety risks (e.g. automobiles, aircraft, railways, control of industrial machinery and processes, modern nuclear power plants, etc.). Unfortunately, they are so complex that their hardware, software, and EMC can never be proven to be safe enough by thorough testing - because such testing would take decades. The only way to obtain sufficient confidence that complex electronic equipment or systems are safe enough for their various applications is to use a variety of safety-engineering tools in design, design verification and final validation. These first became standardized in 2000 when IEC 61508, the basic IEC standard on functional safety, was published. It is now at Edition 2:2010 [8-14]. This standard requires the use of an audited RM process to ensure that functional safety risks will remain tolerable over the whole of the anticipated lifecycle. (In some countries the phrase "acceptable risks" is used instead of "tolerable risks", but they are considered to be equivalent.) As a basic IEC standard, product standards committees are required to follow 61508's basic principles in creating their own functional safety standards, and here is a list of the product standards that have done exactly that: IEC (Safety instrumented systems for the process industry sector, also ANSI/ISA S84) IEC (Safety of machinery) EN (Railway applications - Software for railway control and protection) EN (Railway applications - Safety related electronic systems for signalling) IEC (Nuclear power plant control systems) EUROCAE ED-12B (European airborne flight safety systems) RTCA DO-178B (North American avionics software) RTCA DO-254 (North American avionics hardware) IEC (Medical device software) EN (Fixed gas detection systems) Defence Standard Issue 2 (Accident consequence) ISO (Automobile functional safety) The original, 2000 edition of IEC was rather vague about how to do RMEMC, but this was corrected in Edition 2:2012 by its listing of the IEC's basic RMEMC publication, IEC TS Edition 2:2008 [15], as one of its Normative References. Compliance with IEC now requires compliance with IEC TS Edition 2:2008, and it is important to note that this cannot be done solely by EMC testing. But now we come to a difficulty that will be discussed in more detail in later sections of this article. The IEC medical standards body (SC 62A) refused to apply IEC to the very many medical standards they were responsible for. They still had to show that they were achieving equivalent RM in their medical standards, so they - out of all the committees in IEC - were permitted to use ISO instead of IEC ISO is based on the same fundamental principles as IEC 61508, but was not written to be one of the "family" of functional safety standards derived from IEC It only includes requirements and does not include any of the guidance on assessing tolerable risks; designing, verifying and assessing hardware and software, etc., that makes IEC so very useful (and so large!). ISO only mentions electromagnetic interference (EMI) briefly as one of the environmental effects, along with temperature, shock, vibration, humidity, etc., that must be taken into account during an RM process. No guidance is given, nor any RMEMC references. Although the use of ISO instead of IEC may have made life easier for the many IEC standards committees under SC 62A, in the author's opinion it has created significant confusion that makes it much more difficult and costly for manufacturers of medical devices, equipment or systems to comply with RM standards. These difficulties will be discussed later in this article. IEC Edition 3: 2007 (1) Legal compliance in the EU and USA As mentioned earlier, Edition 3 of IEC added the general requirement to employ RM, so all of its "collateral" and "particular" standards have had to be modified to include the same requirement - including IEC , its collateral EMC safety standard, which added RMEMC at Edition 3. EN Edition 3:2006 (identical to IEC Edition 3: 2005) and EN Edition 3:2007 (a modified version of IEC Edition 3:2007) both became mandatory for EU

3 compliance to all three medical device directives on 1 June In the USA, both of these Edition 3s have been modified with some US differences and deviations, and are called ANSI/AAMI ES :2005 and ANSI/AAMI Edition 3 respectively. Both these ANSI/AAMI standards can already be used for FDA 510(k) and PMA submissions in the USA, but their use will become mandatory after 30 June 2013 [16-17]. (Note that IEC edition 3 is permitted as an alternative to its ANSI/AAMI version.) (2)The RMEMC requirements in IEC Edition 3:2007 The "Foreword" to IEC Edition 3 states: "The principle (sic) technical changes are in Clause 4, which now recognizes that there is a general requirement for a risk management process in IEC :2005". Unfortunately, this is not obvious in the text of Clause 4, because the RM requirements arise in the definition of the term "Essential Performance" in IEC Edition 3. The only other references to RM in IEC are in the informative annexes, which mention ISO The IEC's basic standard on RMEMC is IEC TS :2000 "Electromagnetic compatibility (EMC) - Part 1-2: General - Methodology for the achievement of the functional safety of electrical and electronic equipment with regard to electromagnetic phenomena". This is listed as a normative reference in IEC Edition 2:2010, and so is now mandatory for functional safety compliance even though it is still a TS. It will soon (2012 or 2013) be published as a CD intended to become a full international standard. IEC Edition 3 contains no guidance on how to actually do RMEMC, other than mentioning IEC TS : 2000 in its normative text and listing it in its Bibliography. Although IEC TS is not listed as a Normative Reference, there are no other IEC or ISO publications on RMEMC, and in 2008 it was replaced by IEC TS Edition 2. The assumption is that applying IEC TS will be sufficient - but here is where the difficulties mentioned earlier start to arise -IEC TS is written in "IEC 61508's language", which does not correspond at all with ISO 14971's language, making it very difficult to apply IEC to medical RMEMC. Luckily the IET's 2008 Guide on EMC for Functional Safety (= RMEMC) is available [18], written by an IET Working Group chaired by the author and based on IEEE EMC symposium papers I have been presenting since 2001 based on my work on [15] as a member of IEC MT15 (which is responsible for IEC TS ) since [18] is a very practical guide to complying with IEC TS Edition 2:2008 and is written in "standards neutral" ordinary English engineering language, so it can easily be used with any RM standard (e.g. IEC 61508, ISO 14971, ISO 26262, etc.) or none. IEC Edition 4 CDV (1) Introduction to Edition 4 IEC Edition 4 has been published as a Committee Draft for Voting(CDV). At the time of writing it has passed its voting stage and so will soon (late 2012, early 2013) be published as a Final Draft International Standard (FDIS). Following this, there should only be minor editorial changes before it is published as a full International Standard (IS), probably in 2013 or Once published as an IS, it will probably replace IEC Edition 3 for EU and USA legal compliance within a period of two to four years. Edition 4 contains detailed RMEMC requirements (which are mandatory) plus a useful amount of guidance on doing RMEMC, so Edition 4's guidance could now be applied to help comply with its Edition 3. Also, the guidance in Edition 4 is based on [18], which it lists as an Informative Annex for more (and more practical) advice on how to comply. (2) IEC Edition 4 CDV covers EMC for safety, but not EMC performance Edition 4 is entirely - and only - about what we might call "EMC for Safety". It describes how to do RMEMC and it includes EMC immunity tests that look similar to those in its previous Editions, but in fact are different because all of their PASS performance criteria are simply that basic safety and essential performance (as specified in IEC Edition 3) are both maintained during and after the immunity tests. Basic safety and essential performance can be achieved even at the expense of functional performance. For example, it doesn't matter at all if the medical device, equipment or system stops working completely - as long as it remains safe enough according to the level of risk that has been specified by its manufacturer. This is quite different to the immunity tests in all the Editions of IEC up to and including Edition 3, which all required normal functionality to be maintained with greater or lesser degrees of degradation according to the type of test - just like testing for compliance with the EMC Directive (which specifically excludes

4 safety issues from its scope). This is why, when a manufacturer uses Edition 4 of IEC for sales in Europe, he will have to comply with the (non-safety) EMC directive as a separate exercise to complying with the relevant (safety) medical directive.(the "EMC performance" tests that medical manufacturers will be familiar with from previous Editions of IEC are retained in Edition 4, but in an "Informative Annex"which has no relevance for safety compliance but could be used for complying with the EMC directive.) Edition 4 CDV's EMC tests only cover a few common EM disturbances. So all reasonably foreseeable EM disturbances are required to be considered by the RMEMC process, and must be taken into account in the EMC design. This is especially a concern where the medical device, equipment or system could be required to operate in close proximity to radio transmitters or active High Frequency (HF) surgery equipment. This must be taken into account in design verification/validation, for example by applying the appropriate immunity tests from the IEC series at least at the maximum possible levels that can occur over the expected service life in the use environment(s) or by other methods (e.g. design review), if appropriate. A problem here is that there is as yet no IEC series test for the close-field immunity to RF transmitters because IEC only addresses far-field exposure. However, at least one automobile manufacturer has developed a suitable closefield test method and is already mandating its use by their electronic sub-assembly suppliers [19]. Many EMC test laboratories are already equipped to perform this test, and I understand that it is being developed by both ISO and IEC to add to their standards catalogues. Basic safety and essential performance must be maintained throughout the expected service life in the EM environment(s) of intended use, so all ageing and wear issues must be taken into account in the Risk Assessment (RA) and must also be taken into account in the EMC design and its verification/validation. For this reason I recommend simulating the worst case environmental conditions over the life on an example of the medical equipment (e.g. using HALT test methods), and then redoing the EMC tests on the "aged" unit. The RM process should take into account the effects on emissions and immunity of reasonably foreseeable: Faults EM disturbances, including the actual modulation frequencies that can occur in the use environment(s) Physical and climatic phenomena Use and misuse and reasonably foreseeable simultaneous combinations of the above four issues. Although these are not mandatory requirements in IEC Edition 4 CDV, I recommend these be treated as if they are, because they are mandatory requirements in the basic publication on RMEMC - IEC TS Edition 2:2008. Edition 4 CDV's Annex F gives additional guidance on RM of EMC, and refers to IEC TS and the IET's 2008 Guide on it. However, Edition 4 CDV is not a 100% complete application of the basic publication IEC TS , so I recommend taking full account of all the NOTES in its normative text and all of the informative text in its Annex F, plus fully applying IEC Edition 2:2008 or the IET's 2008 Guide on it. EMC Test Laboratories can't Do RMEMC To comply with the RM requirements in IEC Edition 3 and all of its collateral and particular standards, a manufacturer documents what he has done about all aspects of the RM of his medical device, equipment or system - over its expected service life - in a RM file. Compliance with legal requirements in the EU and USA depends on the favorable assessment of this file by a safety assessor, such as a medical device Notified Body (in the EU) or the FDA (in the USA). The RMEMC requirements in IEC Editions 3 and 4 include the results of EMC emissions and immunity tests and also contain descriptions by the manufacturer of how they have taken care of the other RMEMC requirements in those standards. It is important to understand that these non-testing RMEMC activities cannot be performed or documented by an EMC test laboratory. An EMC test laboratory could - if requested by a manufacturer- check that the RMEMC requirements other than testing have been addressed, but cannot actually perform those activities or verify or validate their compliance. Dealing with the Skills Shortage in RMEMC No practical amount of EMC immunity testing, at any test levels, can prove that complex electronic equipment or systems are safe enough (see Chapter 0 in [18], or [20]), but there are very few engineers worldwide who are skilled enough in RMEMC to achieve it correctly, and too few independent safety assessors who are

5 skilled enough to assess and understand what they do. To help deal with this skills shortage, the IET's 2008 Guide will soon (in late 2012 or early 2013) be updated with a new section describing appropriate hardware and software design techniques which will achieve the required RMEMC for the safety-related functions of the equipment and systems without requiring designers or safety assessors to be experts in RMEMC. These techniques will be based upon the hardware and software techniques and measures listed and described in IEC and so will already be very familiar to the designers and assessors in the IEC community. They will not require safety verification/ validation by EMC testing or any other EMC techniques. I will publish an article about these techniques in SAFETY & EMC Magazine, when they have been published by the IET. However, EMC immunity testing will still be needed to prove the availability of the normal functions of the equipment and systems, so that users aren't tempted to defeat the safety functions because an equipment or system "fails to a safe state" too often, due to EMI. These can use the normal EMC immunity test standards we have become used to, because they seem to provide sufficiently reliable operation most of the time. [1] European Commission. 93/42/EEC: The Medical Device Directive[EB/OL]. [ ] policies/european-standards/harmonised-standards/medicaldevices/index_en.htm. [2] European Commission. 90/385/EEC : The Active Implantable Medical Devices Directive [EB/OL]. [ ]. eu/enterprise/policies/european-standards/harmonised-standards/ implantable-medical-devices/index_en.htm. [3] European Commission. 98/79/EEC: The In-Vitro Diagnostics Directive [EB/OL]. [ ] policies/european-standards/harmonised-standards/iv-diagnosticmedical-devices/index_en.htm. [4] European Commission.2004/108/EC: The EMC Directive[EB/OL]. [ ] index_en.htm. [5] IEC :2005 Medical electrical equipment - Part 1: General requirements for basic safety and essential performance[s].edition [6] ISO 14971:2007 Medical devices - Application of risk management to medical devices[s].edition [7] IEC :2007 Medical electrical equipment - Part 1-2: [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] General requirements for basic safety and essential performance - Collateral standard: Electromagnetic compatibility - Requirements and tests[s].edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 1: General requirements[s]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems[s]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 3: Software requirements[s]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 4: Definitions and abbreviations[s]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 5: Examples of methods for the determination of safety integrity levels[s]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 6: Guidelines on the application of IEC and IEC [S]. Edition IEC Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 7: Overview of techniques and measures[s]. Edition IEC TS :2008 EMC - Part 1-2: General - Methodology for the achievement of functional safety of electrical and electronic systems including equipment with regard to electromagnetic phenomena[s]. Edition U.S. Food and Drug Administration. Recognized Consensus Standards[EB/OL]. ( ) [ ] accessdata.fda.gov/scripts/cdrh/cfdocs/cfstandards/detail. cfm?id= U.S. Food and Drug Administration. Recognition List[EB/OL].( ) [ ] cfdocs/cfstandards/detail.cfm?standard identification_no= IET. The IET s 2008 Guide on EMC for Functional Safety. [EB/ OL]. ( ) [ ] Ford Motor Company. EMC-CS Electromagnetic Compatibility Specification for Electrical/Electronic Components and Subsystems[S] Keith Armstrong. Why EMC Immunity Testing is Inadequate for Functional Safety[C]// Daniel Hoolihan IEEE International EMC Symposium. Santa Clara, 2004: