ALLPCB
Overview
Hemodialysis is a renal replacement therapy for patients with renal failure and is one of the most widely used treatments worldwide. Because it is used on critically ill patients and involves high procedural risk, even small faults can cause serious medical incidents. Therefore, safety protection requirements for hemodialysis devices are stringent. This article analyzes those requirements from electrical safety and functional safety perspectives.
Electrical Safety Requirements
Typical hemodialysis equipment consists of power supply, heater, motor, temperature sensors, pressure sensors, and conductivity sensors. According to standard GB9706.1-1995, the scope of electrical safety requirements is broad; the primary hazards to patients are electric shock and leakage currents. The following discussion uses a typical device insulation diagram to describe these two key issues.
Figure 1 Typical insulation of hemodialysis equipment
1. Determination of applied-part type
According to conventional medical electrical equipment design, applied parts intended for direct cardiac application or direct contact with blood should be classified as CF type. However, due to the specific structure of hemodialysis systems, applied parts in hemodialysis devices are currently classified as type B; designing them as CF type is not currently feasible.
Applied parts are components that must contact the patient during normal operation. In a dialysis session, dialysate exchanges substances with blood across a semipermeable membrane that does not provide electrical isolation. Therefore, the entire dialysate circulation, including the dialysate preparation system, temperature sensors, dialysate pressure sensors, conductivity sensors, and heater, must be treated as applied parts. The heater is connected to protective earth, which provides basic protection against electric shock and some limitation of leakage current; thus, the applied parts are designated as type B.
2. Analysis of shock protection between electrical parts
From the insulation diagram, there are four potential paths by which mains or other power sources can traverse insulation and reach applied parts: (1) mains through the intermediate circuit and various sensors to the dialysate; (2) mains through the heater to the dialysate; (3) battery (treated as a specific power source) through the intermediate circuit and sensors to the dialysate; and (4) external uncertain power sources via SIP/SOP interfaces crossing the intermediate circuit and sensors to the dialysate. The following analyzes points A through G in the diagram with respect to these four paths.
a) Mains via intermediate circuit
Mains reaches the patient through isolation at point A and high-impedance insulation at point G. Point A represents the primary and secondary of the device mains transformer and is required to provide double insulation; failure here could directly apply mains to the intermediate circuit and sensors, creating a severe hazard. Point G employs semiconductor sensors that use PN-junction characteristics to provide high-impedance isolation and limit leakage current. However, semiconductor devices can fail by junction breakdown and are not highly fault-tolerant components. Therefore, GB9706.1-1995 requires that if insulation between applied parts and other live parts depends on semiconductor junctions, each junction must be shorted in turn to simulate critical-junction breakdown and verify that leakage current and patient auxiliary current under single-fault conditions do not exceed permissible values.
b) Mains via heater
Mains applied to the heater directly heats the dialysate (point B). Heater elements are typically insulated with magnesium oxide filling; insulation is required to meet basic insulation, and the filling materials commonly provide double insulation in practice. Therefore, insulation from mains through the heater to the dialysate is generally adequate.
c) Battery
The battery is part of the intermediate circuit and is treated as a specific power source. The battery is isolated from applied parts by sensors as described above. Leakage currents from batteries are usually small, but laboratory testing focuses on battery-specific safety, such as short circuit, overcharge, overdischarge, and reverse polarity tests, since these faults can cause fire or explosion.
d) External voltages via interfaces
The device may exchange signals with external equipment via SIP/SOP interfaces, forming a medical electrical system. Safety should meet the requirements of the applicable medical electrical system standard (for example, GB9706.15). If the manufacturer provides no explicit statement about SIP/SOP isolation, external equipment safety cannot be assumed. In the worst case, insufficient isolation on the external device could apply mains to the SIP/SOP interface under a single-fault condition. Therefore SIP/SOP interfaces should be isolated from the intermediate and patient circuits; the reference isolation voltage is mains voltage, and because this situation occurs under a single-fault condition, basic insulation is considered sufficient.
3. Patient leakage current requirements
Because applied parts contact the patient's blood directly, patient leakage current can flow through the extracorporeal blood circuit and may cause ventricular fibrillation, cardiac pump failure, or tissue necrosis. Under earth-fault conditions, patient leakage current can increase dramatically. Device designs should minimize earth leakage current to reduce these risks.
Functional Safety Protection
Treatment is invasive. If the safety protection system fails, life-threatening events can occur. Thus, a safety protection system completely independent of the control system is required. To achieve this independence, devices should implement redundant architectures such as dual systems and dual CPUs, and safety sensors must be independent of control sensors. The following protection features are essential.
1. Over-temperature protection for dialysate and replacement fluid
Dialysate temperatures above 41°C can cause hemolysis. To minimize over-temperature risk, regulations require an over-temperature protection system independent of any temperature control system. In practice, temperature control sensors typically limit control to ≤40°C, while the independent protection alarm is set at 41°C. During testing, the control sensor and the protection sensor are separated so that a control-sensor failure leading the heater to continue heating will cause the protection system to trigger. The protection must provide audible and visual alarms and prevent dialysate from flowing to the dialyzer.
2. Ultrafiltration protection
Ultrafiltration control is a critical parameter. If the ultrafiltration system accumulates large errors over time, patient risk increases. The protection system must be independent of any ultrafiltration control system and must trigger audible and visual alarms when the device output deviates from the set control parameters sufficiently to create a safety hazard.
3. Blood pressure alarm
If blood pressure goes outside set limits and remains so beyond the configured delay, the hemodialysis device must stop the blood pump, close the venous clamp, and issue audible and visual alarms. Test focus should include alarm accuracy and the correct execution of these actions. The venous clamp may be actuated electrically or hydraulically and functions by occluding the extracorporeal tubing to stop flow.
4. Air detection and alarm
Air detection is typically based on ultrasound. Ultrasonic waves travel faster in liquids and solids than in gases; when an air bubble passes an air detector, the received ultrasonic signal amplitude drops and the CPU processes the change. Two detection modes are common: bubble detection and liquid-level detection. Bubble detection must trigger when a bubble of ≥200 μL passes the detector. Liquid-level detection triggers if, for example, a degassing device becomes overloaded with air and the liquid level falls below the detector. Testing should examine sensitivity to bubble size and flow speed. When bubbles are small and blood flow is high, detectors can fail to detect them, so tests should use maximum pump speed and measure detection at the minimum bubble volume limit.
On air detection, protective actions must include audible and visual alarms, stopping the blood pump, interrupting any replacement fluid flow, clamping the venous return line, and reducing ultrafiltration to the minimum.
5. Blood-leak detection
External blood loss can result from tube detachment or rupture, causing low venous pressure alarms. Clotting may cause pump stoppage or other alarms. The most dangerous internal leakage is membrane rupture, which allows blood into the dialysate. Blood-leak protection relies on detecting the consequences of leakage; sensitivity can be evaluated by simulating leakage.
Leak detectors commonly use a light source and a photoresistor to measure the transparency of effluent tubing. If blood is present, transmitted light intensity decreases and the photodetector response changes, triggering an alarm. When a blood-leak alarm is activated, the system must provide audible and visual alarms, stop the blood pump, interrupt any replacement fluid flow, and reduce ultrafiltration to the minimum.
