Explore the extensive testing policies one manufacturer uses to ensure the safest and most effective products reach the medical market.
In today�s health-conscious culture, medical equipment is everywhere�on TV, in the movies, on the news, at schools, and at the workplace. While you may be seeing and hearing how it is used, have you ever considered the meticulous testing that goes into developing medical equipment?
All medical devices have a very specific and very thorough set of testing requirements imposed by the U.S. Food and Drug Administration (FDA), the European Community, and other regulatory bodies. This testing is rigorous for two main reasons:
� In many cases, medical equipment connects directly to a patient so it must be safe.
� Physicians use information acquired by medical devices to diagnose and treat patients.
GE Healthcare Diagnostic Cardiology develops products that acquire electrocardiograms (ECGs). ECGs, graphic representations of the electrical activity of the heart�s continuous beating, are acquired by attaching electrodes and cables to a patient and recording the internal electrical function of the patient�s heart.
Test Early, Test Often
Medical devices go through many stages of product testing before they are available to customers. Design verification can be broadly defined as any process that establishes conformance of a design output to a design input. A more practical definition is confirmation by objective evidence through testing, clinical trials, and design reviews to ensure that design outputs meet design inputs.
A traceability matrix links requirements to verification procedures and results. Validation follows verification and ensures that the product meets the customer�s needs.
Verification and validation activities are repetitive, comprehensive, and well planned and documented. Outputs are tested against design specifications.
A complete product verification/validation cycle can include several revisions of software. As issues are found, they are logged to a defect tracking database, classified, and reviewed.
Cross-functional teams analyze product hazards, make decisions concerning product safety risks, and recommend courses of action to mitigate product risks. All of these activities are recorded in a suite of documentation that becomes part of the design history file (Figure 1).
Hardware Verification
GE Healthcare Diagnostic Cardiology�s design for medical devices and hardware development must comply with numerous standards. Safety and electromagnetic compatibility (EMC) are two areas of focus during medical device hardware verification, but many other areas are key to product evaluation, including functional and performance testing, simulations, visual inspection, comparison against past proven designs, failure modes and effect analysis, and worst-case/fault-tree analysis. All of the verification tests must be applied to all possible product variations, and the features defined in the device�s intended use statements must be actively exercised.
IEC 60601-1
IEC 60601-1 is the international parent standard that addresses many safety risks associated with electrical medical equipment, such as electric shock, fire, and mechanical hazards. It forms the basis for standards in many other countries including UL 60601-1 for the United States, CAN/CSA C22.2 No. 601.1 for Canada, and EN 60601-1 for the European Union.
Collateral and particular standards are published in addition to the parent standard. They contain additional safety and performance requirements. Design, use, and maintenance of medical electrocardiograph devices adhere to the following IEC safety standards:
� Parent Standard
IEC 60601-1: General Requirements for Safety
� Collateral Standards
IEC 60601-1-1: Safety Requirements for Medical Electrical Systems
IEC 60601-1-2: Electromagnetic Compatibility�Requirements and Tests
IEC 60601-1-4: Programmable Electrical Medical Systems
� Particular Standard
IEC 60601-2-25: Particular Requirements for the Safety of Electrocardiographs
Safety Requirements in IEC 60601-1
GE Healthcare�s newest electrocardiograph system, the MAC 5500 Resting Electrocardiogram (ECG) Analysis System, contains the electrocardiograph, an acquisition module and cable, a patient lead wire set, and electrodes (Figure 2). The type of protection against electrical shock for the MAC 5500 system is classified by IEC 60601-1 as Class I because the equipment relies on the protective earth ground.
One of the most critical considerations of IEC 60601-1 is prevention of electric shock to the patient or user. As a result, it defines maximum allowable leakage currents.
The patient lead wire set is an applied part since it comes into direct physical contact with the patient during normal equipment operation. More specifically, the applied part is defined as type BF (type BF isolates the patient from any live voltage in the equipment). The equipment leakage limits that apply to the system are presented in Table 1.
Using the Insulation Diagram Defined by IEC 60601-1
Under IEC 60601-1, it is necessary to make an insulation diagram to ensure protection against any single fault condition that could lead to patient injury. In addition, it will help to develop criteria for selecting proper components. Some examples of events that cause single fault conditions are interruption of protective grounding or one supply conductor, external voltages on data ports, and failure of an electrical component.
Figure 3, as illustrated for the MAC 5500, shows the insulation requirements including creepage (over-surface spacing), clearance (through-air spacing), protective impedance, protective grounding, and dielectric strength levels. The left block represents the electrocardiograph, the right block the patient acquisition unit. The arrow indicates connection to the patient via lead wires.
Figure 3. System Insulation Diagram
Figure 3 helps identify critical components such as insulating transformers, fuses, product enclosures, and opto-isolators that bridge insulation barriers. All of these critical components are required to be UL recognized.
Testing must take place to verify the following safety requirements:
� Leakages as defined in Table 1.
� Creepage and clearance distances as defined in Figure 3.
� Dielectric strength requirements as inferred from Figure 3.
� Proper choice of components that are critical to patient safety.
EMC Requirements Defined in IEC 60601-1-2
One of the relevant standards for medical device development is clause 36 of IEC 60601-1, which covers EMC and refers to IEC 60601-1-2. EMC compatibility is a safety concern for medical equipment. Medical equipment cannot be a source of EMI to other equipment, and it must operate normally in its environment that may contain EMI. Significant EMC emissions testing and immunity testing are performed on electrocardiographs (Table 2).
Software Verification
While the development of hardware for medical devices is subject to published standards for clear-cut pass/fail testing, the verification of medical software is more complicated to measure. International requirements defined in IEC 60601-1-4, FDA requirements, and country-specific requirements dictate the design controls that must be in place for medical software development. Software developers must interpret and apply these controls to their process.
The software element of a medical device is subject to traceability requirements: The software�s actual performance must meet the corresponding design-input document�s requirements.
For the most part, software verification testing is a manual process. Software developers maintain spreadsheets that link verification test results to the associated requirements and show adherence to internal quality policy. These results become part of the device�s design history file.
Software development and debugging tools are used to improve the quality of the software. Among other things, these tools identify memory leaks and inefficient processes and perform array boundary checks. For example, GE Healthcare Diagnostic Cardiology�s software developers use a configuration control application to ensure that all versions of product software are archived in case a past version of a product needs to be recreated.
System Validation
After the software and hardware designs pass verification activities, validation of the integrated systems begins. FDA Guidelines 21 CFR 820.3(z) and (aa) and 820.30(f) and (g) define medical device software validation as �confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended use, and that the particular requirements implemented through software can be consistently fulfilled.�
This is a difficult challenge because a company that develops software cannot test forever, and the developers, validation team, and marketing product managers must jointly decide how much testing is enough based on the collected evidence of the validation results.
The system validation of a product begins with the same set of product requirements that the hardware and software developers use. Validation engineers write detailed validation procedures and tests for every product requirement. These procedures contain numerous replicate process runs to demonstrate reproducibility and accurately provide a measure of variability among the test runs.
The conditions for repetitive testing also must include upper and lower specification limits, which allow for testing outside the standard operating procedure. These tests, called fault or worst-case conditions, represent the greatest risk of product failure.
To ensure that a medical device complies with the governing rules and regulations of medical device software validation, validation engineers constantly add, update, and develop more detailed and quality-driven validation procedures to increase the probability of finding errors.
GE Healthcare Diagnostic Cardiology�s validation engineers use commercial automated testing software for writing and updating the validation procedures and tests. This software allows the team to maintain a consistent level of testing across products by automating some elements of the testing process. Benefits include continuity throughout product validation, thoroughness, enhanced accuracy and efficiency of testing, improved communications of requirement changes, metric tools, and extensive documentation generation tools that produce accurate results and traceability documents.
Besides automated testing, the validation engineers incorporate a mix of other methodologies depending on the application, risk, and size of the project. All or combinations of these methods may be used, depending on the scope of the project. Refer to Table 3 for brief descriptions.
Conclusion
At GE Healthcare Diagnostic Cardiology, the goal of testing is to quickly comply with new standards and regulations to meet or exceed what is required. This often involves implementing and adhering to new requirements proactively. As with any type of product testing, the verification and validation testing of medical devices provides better products, longer product life, and satisfied customers.
About the Author
Gary Powalisz is an electronic engineer involved in noninvasive cardiology at GE Healthcare. Mr. Powalisz has worked at GE Healthcare/Marquette Medical Systems for 20 years, participating in the development and support of many medical devices including the gas analysis system on the International Space Station. He earned a degree in electrical engineering from Marquette University and is Six Sigma greenbelt certified. GE Healthcare, Diagnostic Cardiology Division, W126 N449 Flint Rd., Menomonee Falls, WI 53051
December 2005