IEC 60601-1:2005 Essential Performance

Recently I wrote a detailed article on essential performance, using a home use thermometer as a case study. The basic thesis was that the definition of essential performance in IEC 60601-1:2005 uses the wrong threshold (acceptable risk) to determine what is "essential". This threshold is so low that it inadvertently picks up just about every function and feature of the device, which is clearly not the intent of the IEC committee.

For the IEC 60601-1 series, the selection of essential performance impacts Clause 14 (PEMS), EMC testing and some special cases such as environmental tests in IEC 60601-1-11.

As such, the selection of essential performance has a significant impact in the amount of work needed to "upgrade" or comply with IEC 60601-1:2005. If the threshold is too low, it can result in an enormous amount of work, or re-work in the case of existing medical devices. Hence a clear and workable definition is critical to avoid excessive work, and consistent expectations.

I provided a copy of this article to a prominent committee member for review, who promptly denounced the conclusion in somewhat impolite terms, although he admitted that there remains considerable confusion over the concept. The member stated that there was already a documented conclusion by another committee member that home use thermometers have no essential performance.

It seems that for the time being, we need to follow the intention of the committee and not worry too much about about the definition itself. Distilling various sources of information, both written and anecdotal, it appears their intention was to highlight critical performance, the failure of which requires special or unusual risk control measures. and this could be one way to identify essential performance. Another possibility is to pay close attention to performance related functions or features that: 

  • exchange energy with the patient in a potentially hazardous way
  • monitor vital physiological parameters, the nature of which variations in which may cause immediate danger to the patient
  • use ionizing radiation for diagnostic or therapeutic purpose 
  • administer or extract body fluids or medicines in a potentially hazardous way
  • monitor, control or influence the performance of other high risk therapeutic or administration devices

 

These characteristics are those associated with devices that make them Class IIb in Europe, and seems to be a good guide to identify characteristics which the IEC committee considers to be "essential performance". The failure of these functions or features often require special protection such as independent monitoring circuits.

You might still ask why the IEC committee has got itself into such a mess over essential performance?

One reason may be that there are three distinct purposes in which performance is considered in standards, each with different drivers that bring different types of performance into focus. The committee seems to be trying to use a single definition to fit all three different purposes, tying itself in a knot. But more on that later.

Another reason is that the committee may still be getting used to the concepts of direct and indirect harm, and as a result, undervaluing the risk associated with indirect harm. The scope of the 2nd edition of IEC 60601-1, by virtue of the definition of a safety hazard, covered only direct harm. With the adoption ISO 14971 terminology in the 3rd edition, the concept of safety was greatly expanded and was no longer restricted to direct harm. Modern medical device regulation, based on ISO 14971, is blind to the position of the medical device in the sequence of events a leading harm. It is only required that the medical device is somehow involved, and if so risk is estimated based on the overall probability and severity of harm.

This rather large change between the 2nd and 3rd edition has not been given a lot of focus, and many people working with the 3rd edition continue to assume that the standard applies only to direct harm.

The conclusion that a home use thermometer has no essential performance is easy to justify if we are considering only direct harm. There is little possibility for a device powered by 3V coin cell battery to cause any serious direct injury. But there remains significant risks of indirect harm if the device fails to perform according to specification - to argue otherwise brings into question whether there is any real clinical benefit for the device. Since Europe has published a detailed harmonised standard on performance of home use thermometers (EN 12470-3:2000), it is difficult to conclude that this performance is not critical at some level. The standard EN 12470-3 even includes a requirement that the thermometer performs a self test before use, to check if there are any faults in the measurement circuit, highlighting the importance of the measurement function despite being a low risk medical device.

ISO 14971 seals the case, since it requires a manufacturer to base the criteria for acceptable risk on international standards and regulations (see Clause 3.2). When this requirement is dovetailed with the definition of essential performance, it means that there is no choice but to consider a function or feature "essential" once a performance related requirement is written into either an international standard or a standard used in regulations. The existence of many performance standards for low risk devices published by EN, ISO, JIS (Japan), GB (China), AAMI/ANSI (US) clearly sets a threshold of risk associated with "essential performance" far lower than the IEC committee was expecting.

There are other examples of the IEC's inclination towards direct rather than indirect harm. In March 2009 the IECEE held a meeting to discuss how the CB scheme and test laboratories might handle the 3rd edition, and in particular the concepts of risk and risk management. One of the presentations provided an example of a hospital bed as being a device that has significant residual risk, while using a pulse oximeter as an example of a device that might have no residual risk.

In the context of direct harm, this conclusion is easy to see. But if we include indirect harm, the choice of a pulse oximeter could not be more wrong. While hospital beds are Class I devices in Europe, the most common application of pulse oximetry falls in to Class IIb, a much higher risk category. This higher risk is evident when we consider the purpose of the device is to monitor critical physiological parameters where urgent response may be required. Like any non-invasive measurement, pulse oximetry also has inherent and widely acknowledged residual risk associated with measurement accuracy, something which has been the subject of many clinical studies. The FDA has 10 times more event reports for pulse oximetery than hospital beds, and the pulse oximetry reports are of far higher severity, including multiple cases of death. To use pulse oximetry as an example of a device with "no residual risk" clearly indicates the IEC may still be struggling to understand risk in a broader context.

Another interesting case study for indirect harm is the recent order from the FDA to Baxter to recall all of its Colleague series of infusion pumps, citing a number of on going problems. A key issue was a range of normal and abnormal conditions resulting in underinfusion. In many cases, the pump just stopped working without an alarm. The IEC standard for infusion pumps (IEC 60601-2-24) has strong requirements for overinfusion, including even periodic self checks of protection systems, but extremely weak requirements when it comes to underinfusion. Again this appears to be a case where direct harm is given priority over indirect harm: overinfusion represents a direct harm where the device actively pumps dangerous drugs into the patient, to an engineer this naturally appears to be of higher risk than the indirect harm associated with a pump stopping.

Also, when we consider failure to perform we have an instinctive reaction that says it is unreasonable to expect a pump manufacturer to guarantee infusion. But this is an example of a common mistake in the risk management process where the cart is placed before the horse - as engineers we worry about the practicality of the solution and allow that to influence our decisions, when our first action should simply be to measure the risk. A careful study of the risk in this situation would quickly find what the FDA has already likely concluded: underinfusion is a far more serious risk than overinfusion. There is a wide range of potential causes underinfusion with far higher probability than for overinfusion. Anything from a simple blown diode in the power supply through to a worn out cog can result in underinfusion. 

So, what does this have to do with essential performance? It is intended to show that IEC work remains focused on direct hazards, and this may influence the confusion behind essential performance. .

As mentioned above, there are three distinct purposes under which performance can be considered, and each of these has a different focus on "performance". The first is general basic bench or clinical tests to prove the performance meets the manufacturer's claims or minimum requirements. Although the IEC only has relatively few performance standards, especially for lower risk devices, as mentioned before there are already a large number of performance standards published by EN, ISO, JIS, GB (China), AAMI/ANSI (US).

Secondly, there is also a need to consider performance during or after stress tests representing normal use or the normal environment, such as ageing, vibration, thermal shock, waterproofing, EMC, defibrillation and so on. Again, IEC standards tend to be weak on this point (having a very narrow focus on EMC and defibrillator proof testing), wheras EN, ISO, JIS, GB, AAMI/ANSI standards often have much more detailed stress tests after which performance should be evaluated.

Finally, there may be justification for special controls for higher risk devices, such as Clause 14 (PEMS).

This suggests that three terms may be required to handle performance: 

  • general performance: minimum performance necessary to acheive the intended purpose. Although this can be derived from risk, it is rarely done in practice and may be best to leave risk out. Particular standards will typically include requirements for general performance, but only when the technology is sufficiently stable to allow development of such requirements. All parties should understand that the absense of a requirement for general performance in a particular standard in no way absolves the manufacturer to consider performance in the context of medical device in regulation.  
     
  • stress test performance: these are particular aspects of performance that should to be considered during or after stress tests representing normal conditions (EMC, waterproofing, vibration, shock, humidity, power supply regulation and the like). The selection of performance to consider during stress tests is heavily dependent on the type of test, or specifically the probability that the function or feature will be affected by the test being performed. It may also include the probability of the condition which the test is intended to represent. Thus selection of performance is well suited to a specialised risk management process. But, it has to be recognised that performance considered will be unique for each stress test, and a general list cannot be compiled. As with general performance, if the technology is stable particular standards may identify specific stress tests along with performance to be considered during or after the test, but again the absense of a test or criteria should not absolve the manufacturer of considering other stress tests. Generally applicable standards like EMC may use a special risk management process which takes into account the probabilities above.
     
  • critical performance: higher risk functions that require special controls. Particular standards may include special requirements associated with high risk functions (such as the need for and detection of failure in protection systems). Management system requirements such as special design controls (Clause 14, PEMS) may also be applied. European classification (Class IIb or higher) can be used as an alternative or conjunct to risk management to identify functions or features that are "critical". 

These three terms have different drivers and result in different lists of "performance", and therefore each should be considered separately. The elimination of the term "essential" would help to ease the confusion, and a return to a more simple title of "basic safety and performance" for IEC standards would allowing all three types of performance to be covered where necessary.

As mentioned above, the best way to identify critical functions or features would be to follow Europe (and GHTF) system of device classification: Class I and IIa devices such as a home use thermometer would free of "critical performance", while only the features of Class IIb that make them Class IIb would be considered "critical performance". The use of such classification is also recommended in IEC 62304, which also suffers from similar problems in the definitions for software classification: based on the definition, a home use thermometer is Class C, clearly not the intended of the standard.

Although it is unlikely that the IEC committee will adopt this thinking anytime soon, for those working with IEC 60601-1 series, the above analysis may at least serve to understand the confusion around "essential performance".

Comments and opinions to pselvey@medteq.jp are welcome.