2. Amendment to IEC 60601-1 – What has A2:2019 changed compared to A1:2012?
As planned, there is a first Committee Draft for Vote (CDV) for Amendment 2 to IEC 60601-1. This is also referred to as IEC 60601-1 A2:2019.
We have summarised the most important points from the 78 changes made, so that you
- can decide whether you have time to read it and wish to invest around 35 euros in it
- know what you need to do to further guarantee conformity of your products and so
- avoid problems with approvals.
Amendment 2 to IEC 60601-1 is also referred to as Version 3.2 of IEC 60601-1.
1. Executive summary of IEC 60601-1 A2:2019
a) Why did IEC 60601-1 need amending?
The changes made by Amendment 2 to IEC 60601-1 were originally planned for version 4.0. However, this fourth version is not planned until 2024. These changes were obviously too pressing. This includes out-of-date references to different standards.
b) What are the important changes?
Important changes include:
- updating out-of-date references to ISO 14971 and IEC 62304 + A1:2015 etc.
- alignment with IEC 60950-1:A2 and its successor IEC 62368-1 (Safety requirements for audio/video, information and communication technology) respectively
- error rectification and clarifications
- changes affecting design and layout:
- use of IEC 60950-compliant power supply units
- use of indicator lights and safety signs
- selection of optocouplers
c) When does Amendment 2 to IEC 60601-1 come into effect?
The final version of amendment 2, that is, IEC 60601-1 A2:2019, should appear in December 2019. We are acting on the assumption of a three-year transition period. However, as Amendment A2 refers to many standards that are not yet harmonised, it could take longer.
d) Who do the changes affect?
The changes in version 3.2 of the standard affect both manufacturers and testers.
The changes carry less weight for testers than for manufacturers: new measuring equipment is not necessary, however some inspection requirements, e.g. regarding temperature measurements or insulation inspections are to be adapted.
2. The differences between A1:2012 and A2:2019
a) Overview: changes made to IEC 60601-1 by Amendment 2
Many sections of version 3.2 of IEC 60601-1 differ from those of its predecessor:
- the standards referred to
- section 7: labelling
- section 8: electrical hazards
- section 9: mechanical hazards
- section 11: thermal hazards
- section 13: hazardous situations and fault conditions
- section 16: ME systems
- annexes with details of the changes
b) Risk management
Amendment 2 replaces all references to the outdated reference to ISO 14971:2007 with an undated reference. For this reason, you must always work with the latest version of ISO 14971.
Amendment 2 to IEC 60601-1 does not change how ISO 14971 is to be applied. But the authors have corrected many hazards and use the terms risk and hazardous situation with more precision.
An example: in Amendment A1 (current version), in the case of batteries the manufacturer should assess the risk posed by incorrect use and then decide whether a warning notice is necessary. However, risk assessment also requires knowledge of damage, its severity and its probability. Without knowledge, this is difficult to assess in the case of batteries and does not correspond to the risk concept for basic safety. According to Amendment A2, the manufacturer should only check whether incorrect use of the battery can lead to a hazardous situation (if they catch fire, overheat, etc.). If so, a warning notice in the operating instructions should point this out.
b) Software and usability
The new amendment to IEC 60601-1 updates the outdated references to IEC 62304 and IEC 62366-1. The reference to the 2007 versions regularly led to conflict during inspections as in the case of older devices, for example, manufacturers were unable to invoke the UOUP argument.
However, standards IEC 62304 + A1:2015 and IEC 62366-1 are in the queue for harmonisation and Amendment A2 will have to take its place behind them.
In the case of PEMS (section 14), there are no changes worth mentioning. Manufacturers no longer need to provide a timeframe in the software development plan.
c) Use of power supply units
A2:2019 of IEC 60601-1 has adopted the means of operator protection (MOOP) from IEC 60950-1. The reason is that for operators of medical devices no higher level of protection is required than that for laptop users.
The requirements are harmonised between the two standards as IT equipment is often used in ME systems. This enables manufacturers to use more economical mains adapters.
IEC 60950-1 is now getting long in the tooth (30 years old) and once the transition period comes to an end on 20 December 2020 (in the EU), it will be replaced by the new standard IEC 62368-1:2018 ‘Audio/video, information and communication technology equipment – Part 1: Safety requirements’. So Amendment A2 was necessary to restore alignment before IEC 60950-1 is withdrawn.
Until 20 December 2020 manufacturers can continue to implement the outdated versions IEC 60950-1:2005, IEC 60950-1:2005/AMD1:2009 and IEC 60950-1:2005/ AMD2:2013 to declare conformity of operator protection.
Consequences for test laboratories and manufacturers
According to this, a test laboratory would continue to accept a component that complies with IEC 60950-1 until 20 December 2020. After that, conformity can only be declared with IEC 62368-1:2018.
For manufacturers of medical devices this means that:
- IEC 60950 devices/components that are still in stock after the deadline may no longer be used, unless the manufacturer of the devices/components confirms that IEC 62368-1 has been complied with without any changes;
- manufacturers must find out from their suppliers in good time whether the devices/components will continue to be available after the deadline. If necessary, they should arrange to find a second supplier in good time;
- existing stock can continue to be used as replacement parts for repairs.
d) Use of safety signs
The standard uses the term ‘safety sign’ more than 70 times. With version 3.2 it introduces the long overdue definition:
Definition: Safety sign
‘sign giving a general safety message, obtained by a combination of a colour and geometric shape and which, by the addition of a graphical symbol, gives a general or particular safety message.’
Source: IEC 60601-1 A2:2019 3.154
The standard differentiates between the following symbols:
- Amber triangle (warning, danger!): ISO 7010-Wnnn (warning)
- Red circle with a line through it (prohibition, you must not!): ISO 7010-Pnnn (prohibition)
- Blue circle (command, you must!): ISO 7010-Mnnn (mandatory)
It differentiates between general and special safety messages:
- general: with an exclamation mark
- special: with a symbol or text
Read more on the subject of symbols here.
When the standard speaks of safety signs, it explicitly means the regulatory signs in Table D.2 in Annex D, which originate from ISO 7010.
Please note: when the standard speaks of safety signs, it explicitly means the regulatory signs in Table D.2 in Annex D, which originate from ISO 7010 and not safety signs that you have devised yourself, as described in section 7.5, or symbols that you have devised yourself for informative labelling of operating elements, for example. Symbols merely replace written information.
A person reading or an open book?
It was often not clear to manufacturers and test laboratories which of the two symbols was to be used. To be on the safe side, today almost all devices have the person reading imprinted on them. In Amendment A2 it is now more clearly formulated that safety sign ISO 7010-M002 (person reading) must only be used when reading the instruction manual is explicitly a risk control measure (RCM).
The conclusion must not be automatically drawn that the reading person is to be used from the fact that all warnings must be set out in the instruction manual. At least, not if the instruction manual is not a risk control measure.
Alternatively, the open book symbol may be used to
- show where the instruction manual is or
- to tell the user that the instruction manual contains information on operation.
e) Indicator lights and alarm indicators: an end to the chaos
The authors finally provide a long overdue explanation on the difference between indicator lights and alarm indicators (in the sense of IEC 60601-1-8).
The Johner Institute has regularly witnessed discussions on how alarm indicators and indicator lights are to be used correctly. Even testing companies had problems telling whether IEC 60601-1-8 also applies to indicator lights and/or technical alarms.
An indicator light is used to signal a dangerous operating status of the device when used as intended, which if ignored can lead to personal injury or property damage.
Indicator lights are used to indicate normal operating statuses, not faults.
An alarm is used to indicate a potential or existing hazardous situation for the patient (and not the operator and the device), which requires the attention of or immediate action on the part of the operator.
An indicator light requests that a person reconsider or interrupt an intentional action. The damage arises immediately and the extent of the damage is considerable.
Death or severe injury possible
(Can be combined with ‘Warning’ safety sign ISO 7010-W001 – yellow triangle with explanation mark)
Poor contact of the neutral electrode on a high-frequency surgical device leads to severe burns in the patient.
X-ray system is active – do not enter the X-ray room!
Mild or moderate injury or property damage possible!
Closer attention is required
An automatic defibrillator is charged and ready to use. Stand back from the patient.
The cutting mode on the high-frequency surgical device is active. Do not touch the instrument tip!
Cutting mode on high-frequency surgical device is active. Avoid short circuits with metallic parts.
Defibrillator is charged. Avoid short circuit between the electrodes.
Ready for use
Device is ready for use and can be used safely.
Operating voltage is switched on. Device is on standby.
This notifies the operator of a danger or hazardous situation that is not obvious (high voltage in parts that can be touched, active source of X-rays, hot surfaces, etc.). However, if ONLY one safety sign is used (which has been possible until now), an operator cannot recognise when the situation is hazardous or when the hazard has passed.
Contrary to indicator lights, alarm signals are to be used in events and circumstances of a more technical and physiological nature which
- exclusively refer to patients and
- in which the reaction time (fault tolerant time interval) is decisive.
Immediate action is required (reaction time is shorter than normal, seconds to minutes)
Cardiac arrest, ventricular fibrillation
Battery on syringe driver flat; ventilator generates a high priority alarm when the breathing tube has come away (hazardous situation) so that the operator stops what they’re doing and acts immediately before the patient suffocates.
Swift action is required (reaction time is normal, several minutes)
High or low blood pressure, high body temperature, brief arrhythmias
The water temperature or set heat is reached
Attention is required
Prompt action is required. (Sufficient time to react, minutes to hours)
Information that enables the user to assess the urgency of their action themselves and so makes the clinical workflow easier.
Often a preliminary stage for medium-level physiological alarms
Poor electrode contact on an ECG; volumetric pump for parenteral nutrition fails
What has changed?
The (previous) Amendment A1 established the following (colour) scheme for indicator lights, the meanings of which for red and yellow were in fact wrong.
Warning – immediate response by the operator is required
Caution – prompt response by the operator is required
Ready for use
Any other colour
Meaning other than that or red, yellow or green
The new Amendment A2 now differentiates between alarm indicator lights and indicator lights and sets out the following scheme which makes more sense.
Abb. 2: Stipulations of IEC 60601-1 A2:2019 on alarm indicator lights and indicator lights (Source: the standard itself)
Whereas the term ‘warning’ in Amendment A1 means ‘immediate response is required’, its meaning in Amendment 2 of IEC 60601-1 is the opposite. There it means: ‘Prevention of a hazardous situation that can result in death or serious injury.’ This may or may not require action.
The standard does not say whether an indicator light must now be fail-safe, that is, first-fault safe. The rule of thumb would be, when the indicator light is combined with a safety sign, it is not necessary to monitor the indicator light.
The standard does not set out any regulations as to whether an indicator light must be used together with a safety sign or just text, or both.
Who it affects
There are probably only a few devices or manufacturers who are affected by this. In the case of alarms, IEC 60601-1-8 is decisive. With this, manufacturers have always achieved conformity. The requirements regarding indicator lights are also often set out in the particular standards.
Amendment 2 of IEC 60601-1 does not change the threshold values for touch current and leakage current. In section 8.4.2 (c) the standard names different components for which the touch current does not need to be measured if certain conditions are met, such as:
- accessible contacts on plug connectors or
- contacts on lamp sockets.
This list has now been extended with
- SIP/SOP connections and
- separate electricity supply outlets that provide components with electricity, for example.
It is not necessary to measure the touch current of these accessible parts either if
- their circuit voltage does not exceed 42.4 VAC or 60 VDC;
- the voltage is measured at a load resistance of 10 kOhm; or
- the SIP/SOP is electrically isolated from the secondary circuit.
Applied parts and accessible parts
A flowchart has been added, which shows guidelines for qualifying protective measures as MOOPs or MOPPs. However, the circumstances have not been changed.
Do 2 MOOPs no longer correspond to 1 MOPP?
The rule of thumb 2 MOOP = 1 MOPP now only applies to a certain extent and under the following conditions:
- for clearances that are equivalent to 2 MOOPs according to IEC 60601-1 or IEC 60950-1, only up to an operating voltage of 707 VDC/500 V RMS
- for clearances that are equivalent to 2 MOOPs according to IEC 62368-1:2018, only up to an operating voltage of 354 VDC./250 V RMS
- in the case of reinforced insulation where creepage distances are equivalent to 2 MOOPs in accordance with IEC 62368-1:2018, 2 MOOPs = 1 MOPP without restrictions.
In case 1 and 2, the assumption 2 MOOPs = 1 MOPP for higher voltages can no longer be made per se. The authors of A2:2019 have added a detailed derivation to the creepage and clearance distances along with the notes on section 18.104.22.168. In this context, different scenarios are shown to which the assumption 2 MOOPs = 1 MOPP applies or does not apply.
Who it affects
This change probably only affects a few devices, however, it should be taken into account above all when using standard power supply units (IEC 60950-1) and in the case of high voltages in secondary circuits.
Read more here on the subject of MOOPs and MOPPs and the associated arithmetic.
f) Insulation components: optocouplers
For the first time, requirements regarding optocouplers as an insulation component have been defined. Optocouplers which comply with standard IEC 60747 automatically meet the requirements of IEC 60601-1 regarding solid insulation and sealing compounds, but not necessarily the requirements regarding creepage and clearance distances for patient protection.
Here, the authors explicitly point out that the creepage and clearance distances under IEC 60601-1 apply.
g) Testing and measuring
Measuring the operating voltage
Amendment 2 to IEC 60601 only clarifies how the operating voltage (decisive for planning the creepage distance) is to be determined.
To measure the operating voltage, all circuits must be earthed. Isolated secondary circuits, which are isolated from earth by means of 1 MOP, are an exception. The operating voltage then corresponds to the measured secondary or primary voltage, whichever is highest.
Protective earth conductors
In version 3.2, information has been added for testers, stating that the protective earth conductor test can only be performed on the power lead supplied or on a power lead specified by the manufacturer. For the manufacturer this means that they must supply or specify the power lead and document it.
The test must also be described in more detail.
h) Components that may pose a threat
Power supply units
Manufacturers who buy a power supply unit in the future, which complies with the new IEC 62638-1, should take into account for which transients and overvoltage categories the power supply unit was designed:
If, for example, you buy a converter for an ambulance, which converts the on-board voltage from 12 or 24 V to 230 VAC, the creepage and clearance distances in such power supply units are often planned without taking transients into account. That means that they are much smaller than in power supply units with an MOOP layout in accordance with IEC 60601-1. Such transient-free power supply units may not be used for ME equipment, as IEC 60601-1 does not have any tables for such power supply units.
If you give plastic parts a metallic coating, for example as an EMC measure, in your risk analysis please also take into account the possibility that coatings may flake and cause a short circuit in a protection measure.
Fuses and overcurrent protection devices
A2:2019 indicates that the rating of such protection devices (switching capacity) should refer to the highest current load or possible short-circuit current. The breaking capacity must be rated in such a way that the fuse breaks safely without damaging the device, causing an arc or generating heat. This is particularly important in the case of inductive loads.
i) Requirements related to mechanical hazards
Manufacturers of devices with pressure vessels or pneumatic or hydraulic systems should read section 9.7.
Otherwise, in section 9 (mechanical hazards), there are no changes worth mentioning from the point of view of the Johner Institute.
j) Lasers and optical radiation
To date, the standard has not mentioned any specific requirements for devices containing light sources (with the exception of lasers) such as light-emitting diodes, which are intended to have a clinical (photobiological) effect. Now it is explicitly mentioned that the manufacturer must check whether IEC 60601-2-57 is applicable.
This particularly affects manufacturers who use devices to treat skin diseases with UV radiation. If the UV radiation exceeds certain emission threshold values, for example, for risk group 3, additional design measures such as emergency stop and key switches will be necessary.
k) Additional requirements for thermal hazards
Temperature threshold values
In Table 23 the standard mentions temperature threshold values for parts of devices (not applied parts) that are likely to be touched by the operator. To date, these parts have not had to fit the definition of accessible parts.
Now the authors explicitly relate these temperature threshold values to all accessible parts. This means that manufacturers not only have to include the obvious points in these temperature considerations, but all points that can be accessed with the test finger.
Here, the standard differentiates between the two hazardous situations:
- parts, which are likely to be touched, but not necessarily, in order to operate the device (touch < 1s as input for the risk analysis)
- parts that must be touched in order to operate the device (also think about servicing here!)
In the first case, version 3.2 of the standard now establishes higher temperature threshold values, which must not be exceeded in the event of a first failure. For example, the temperature of such parts, if they are made of metal, must not exceed 80°C. However, for metallic parts that need to be touched (case 2), a temperature of just 74°C is permitted.
This once again illustrates how important a clear description of the operating scenarios is, as the (operating) elements that are to be touched in accordance with regulations should be identified there.
The requirements regarding the flammability of wiring and plug connectors in fireproof housing were moved down a class from V-1 to V-2 (V-1 is less flammable than V-2).
The description of the flammability classification was changed from FV to V according to the testing standard.
Manufacturers do not have to do anything here. Testers must take into account that the requirements are not as strict.
l) ME systems
Newly introduced with Amendment 2 to IEC 60601-1 is the separation of the requirement for protective earth conductor resistance in an ME system. Manufacturers must consider the following two conditions separately:
- When there is a path along which a fault current between the mains voltage and a part connected to the protective earth conductor is only protected against short circuit by the fuse in the power supply (e.g. circuit breaker), then the protective earth conductor resistance must not exceed 200 m? from this point.
- However, if there is an additional fuse and the fuse rating is less than 13A, the protective earth conductor resistance can be up to 400 m?.
m) EMC planning
An amendment 1 for IEC 60601-1-2 is apparently still on the way. A placeholder has already been included where the standard is referred to.
This means that you should monitor regulatory requirements more closely. You are welcome to use our service, Regulatory Radar.
3. Outlook on version 4.0
For version 4.0 the authors plan to combine the particular horizontal 60601-1-x standards in a single standard. The standard would then cover more than 1,000 pages.
The official reasoning for this is that in this way the standard would be easier to maintain. Different teams work on the particular standards, which has led to the different versions of these standards not being able to be optimally coordinated.
Amendment 2 to IEC 60601-1 is a coherent further development and improvement of the current version. Not only does it update outdated references to other standards, it also provides missing definitions and corrects incorrect or unclear concepts.
However, this version 3.2 contains many small changes, which is why we recommend that you plan a gap analysis for all of your existing products in order to prevent unpleasant surprises. This is particularly the case if you plan to further develop products.
Products that meet the requirements of the current version of the standard do not automatically meet the requirements of Amendment 2 to IEC 60601-1!
From now on, IEC 60601-1 A2:2019 should be the benchmark for the development of new products.
See here how the Johner Institute supports you as a manufacturer or service provider in the development and testing of medical electrical equipment.