Safety protection design of hemodialysis equipment

Hemodialysis therapy is a new treatment for patients with renal failure. At present, hemodialysis therapy is also the most widely used method for treating renal failure at home and abroad. However, because most of its treatment objects are critically ill patients and the treatment process is high-risk, any small fault may cause serious medical accidents, so the safety protection requirements of hemodialysis devices are extremely high. Based on the characteristics of hemodialysis devices, this article analyzes its safety protection requirements from the two aspects of electrical safety and functional safety.

1. Electrical safety requirements

The hemodialysis equipment is mainly composed of power supply components, heaters, motors, temperature sensors, pressure sensors, conductivity sensors and other components. According to the requirements of GB9706.1-1995, the electrical safety content involved is very broad, but there are two main aspects that are likely to cause harm to patients: protection against electric shock and leakage current. This section uses a specific product insulation diagram to describe the two key issues related to patient protection against electric shock and leakage current. Figure 1 Typical insulation of haemodialysis equipment

1. Determination of the type of application part

When the hemodialysis device is performing treatment, the device comes into contact with the blood through the dialysate. According to the conventional design concept of medical electrical devices, the application parts directly used for the heart or in contact with the blood should be designed as CF type. However, the application parts of all hemodialysis devices are B type, which is determined by its special structure. At present, there is no ability to design it as a CF type structure.

According to the definition of applied parts, the parts of the device must be in contact with the patient when the device is functioning. When the dialysis device is in operation, the dialysate exchanges substances with the blood through a semipermeable membrane, and the semipermeable membrane does not play any isolation role. Therefore, the entire dialysate operation part should be regarded as an applied part, which includes the dialysate preparation system, temperature sensor, dialysate pressure sensor, conductivity sensor and heater, etc. Among them, the heater is a protective grounding component, which determines that the hemodialysis device can provide basic protection against electric shock and has a specific protection against leakage current, so the applied part of the hemodialysis device is a Type B applied part.

2. Analysis of electric shock protection between electrical parts

As shown in Figure 1, there are four ways from the external power supply to the patient, through various insulation to reach the application part. The first is from the grid power supply through the intermediate circuit, then through various sensors and dialysate contact; the second is from the grid power supply through the heater and dialysate contact; the third is the battery (the battery can be regarded as a specific grid power supply) through the intermediate circuit across various sensors and dialysate contact; the fourth is that various external uncertain power supplies may pass through the SIP/SOP interface, across the intermediate circuit and sensors and contact the dialysate. The following analyzes the above four ways for points A to G shown in Figure 1.

a) Impact of mains power supply on patients via the intermediate circuit

[page]

As can be seen from Figure 1, the mains power is in contact with the patient through the isolation of Part A and the insulation of Part G with high impedance. Part A represents the primary and secondary of the mains power of the device. Double insulation is required between these two parts, because if this part is broken down, the mains power is directly added to the intermediate circuit and each sensor, which may cause serious danger. In addition, Part G uses semiconductor sensors, which use the characteristics of PN junctions to achieve insulation and high impedance isolation, which plays a certain role in limiting leakage current. However, due to the unreliability of semiconductors and easy breakdown, they cannot be used as high-integrity components. Therefore, GB9706.1-1995 stipulates in Chapter 17 that if the insulation between the application part and other live parts relies on the insulation performance of the semiconductor device junction, one junction must be short-circuited each time to simulate the breakdown of the key junction to check whether the leakage current and patient auxiliary current in a single fault state exceed the allowable value.

b) Effects of mains power supply on the patient via the heater

As can be seen from Figure 1, the mains power directly heats the dialysate through the heater (point B). The insulating filling material of the heating rod is generally magnesium oxide, and the insulation level is required to reach basic insulation, but its filling material can generally achieve double insulation. Therefore, the insulation between the mains power through the heater and the dialysate to the patient is also sufficient.

c) Effects of batteries on patients

As can be seen from Figure 1, the battery is part of the intermediate circuit and is considered a specific power source. The battery is isolated from the application part by the sensor. The analysis of the sensor is shown in a). Usually the leakage current generated by the battery is relatively small, and the laboratory pays more attention to the safety assessment of the battery itself, such as short circuit, overcharge, over discharge, reverse polarity and other fault tests. Because the above faults are very likely to cause the battery to catch fire or even explode.

d) Effects of external voltage on patients

The device transmits signals with external devices through the SIP/SOP interface. This connection constitutes a medical electrical system, and its safety should comply with the requirements of GB9706.15. If the manufacturer does not have a clear statement on the SIP/SOP, considering that the safety factors of the external device are uncontrollable, the worst case is that the external device communicating with the dialysis device has insufficient power isolation strength, and the mains power is directly added to the SIP/SOP interface in a single fault state. Therefore, there should be isolation between the SIP/SOP interface and the intermediate circuit/patient circuit. The reference voltage required for this isolation is the mains voltage. Because this situation will only occur in a single fault, it is sufficient to require basic insulation.

3. Patient leakage current requirements

Because the application part of the device is in direct contact with human blood, the patient leakage current flows through the extracorporeal blood circuit, which can cause serious consequences such as ventricular fibrillation, heart pump failure or tissue necrosis. In the case of a ground fault, the patient leakage current will increase sharply and reach the value of the ground leakage current when the device is normal, so when designing the product, the ground leakage current should be limited as much as possible.

2. Functional safety protection

The device treats patients in an invasive manner. When the safety protection system fails, it may cause life-threatening situations. This requires a safety protection system that is completely independent of the control system. To meet this independent protection system structure, the device must implement a dual-system, dual-CPU structure, and the safety protection sensors must also be independent of the control sensors. The following are the safety protections that the hemodialysis device must have:

1. Over-temperature protection of dialysis fluid and replacement fluid

When the dialysate temperature exceeds 41°C, it will produce a hemolytic reaction to the blood. In order to minimize the risk of overheating, the state stipulates that the dialysis device must have a protection system independent of any temperature control system, that is, in addition to the temperature control sensor, there must also be an independent temperature protection system. Generally, the temperature control range of the temperature control sensor will not exceed 40°C, and the over-temperature alarm of the temperature protection system is 41°C. It is impossible for an over-temperature alarm to occur when the device is working normally, that is, it is impossible to detect an over-temperature alarm when the device is in normal use. In order to test the over-temperature alarm, the temperature control sensor and the protection sensor are generally separated, that is, the temperature control sensor is made to fail, so that the heater is continuously heated. When the dialysate temperature exceeds the set value, its temperature protection system must be triggered to implement the following alarm actions: triggering sound and light alarms and preventing the dialysate from flowing to the dialyzer.

2. Ultrafiltration protection

Ultrafiltration is one of the important indicators of hemodialysis devices. When a large error occurs in the ultrafiltration system, the continuous accumulation of the amount over a long period of time may cause life-threatening consequences for patients. The device must have a protection system that is independent of any ultrafiltration control system to prevent the output of the device from deviating from the set value of the control parameter and causing safety hazards. When the output of the device deviates from the set value of the control parameter, the action of the protection system must trigger an audible and visual alarm.

[page]

3. Blood pressure alarm

If the blood pressure exceeds the set range and lasts longer than the set delay, the hemodialysis device must stop the blood pump, close the venous clamp, and sound and light alarms. The focus of the inspection is the accuracy of the blood pressure alarm and the action it achieves. The venous clamp uses electromagnetic or hydraulic power to block blood flow by clamping the extracorporeal blood circuit tube.

4. Air alarm

Air detection is based on the principle of ultrasound. Ultrasonic waves propagate faster in liquids and solids than in gases. When bubbles in the venous circuit flow through the air detector, the ultrasonic receiving sensor obtains a voltage drop smaller than the normal value, which is processed by the CPU. There are two methods for air detection: one is to detect the presence of bubbles. When bubbles ≥200μl pass through the detector, the detector must act; the other is a liquid level detector. This protection method is to remove bubbles when bubbles pass through the degassing device, but if the degassing device causes the liquid level to drop beyond the detector due to excessive air, it must act. During the detection process, the alarm is mainly tested for its sensitivity to bubble size and speed. When the bubbles are relatively small and the blood flow rate is relatively fast, the air detector often "fails". Therefore, when testing the bubble alarm, the blood pump speed should be adjusted to the fastest, and a single bubble should be measured at the minimum value of the limit.

Air ingress protection actions must include the following: triggering audible and visual alarms, stopping the blood pump, interrupting the flow of any replacement fluid, clamping the venous return line, and minimizing ultrafiltration.

5. Bleeding protection

There are several possible reasons for extracorporeal blood loss. One is that the tube falls off or ruptures, and blood is lost to the outside world. This situation will cause a low venous pressure alarm; one is a coagulation alarm, which may be caused by the blood pump stopping or by the blood mechanism itself; and the most common blood loss is leakage, which is mainly caused by a membrane rupture failure, causing blood to flow into the dialysate.

The protection is realized by alarm due to the result of blood leakage. During detection, blood leakage can be artificially simulated to measure the sensitivity of the blood leakage protection system.

The blood leakage detector consists of a light source and a photoresistor, and is implemented by measuring the light intensity in the waste liquid pipeline. The light beam passes through the waste liquid and shines on the photoresistor. If the waste liquid is mixed with blood, the light transmission is weakened, and the photoelectric effect changes and triggers an alarm. When the blood leakage alarm is triggered, the system should issue an audible and visual alarm, stop the blood pump, and interrupt any replacement fluid flow to reduce ultrafiltration to the minimum value.

References:

1. Wang Peilian et al., GB 9706.2-2003 Medical electrical devices Part 2-16: Safety requirements for hemodialysis, hemodiafiltration and hemofiltration devices, China Standards Press, first edition in February 2004

2. Chen Jiaye et al., YY0054-2003 Hemodialysis, Hemodiafiltration and Hemofiltration Devices, China Standards Press, first edition in September 2003

3. Shen Qingrui, Ye Rengao, Yu Xueqing (eds.), Blood Purification and Kidney Transplantation, People's Medical Publishing House, October 1999

4. Compiled by Zuo Zhongzi and Qiu Yelong, translated by Pang Baozhen and Li Linxue, Dialysis Therapy, Military Medical Science Press, February 2000