How is a mains-connected medical device made safe against electrocuting me?

Question

I am in physical therapy now. Some of the devices are connected to wall power, and used for muscle electrostimulation. The patient information states that no single malfunction can connect me to 230V, and any malfunction that would allow a second one to do so, would prevent device from turning on, or sound an alarm.

This all feels nice and dandy, but I have a bit hard time to believe that. Can it really be achieved? What methods are used to do it?

Sadly, there's a strict policy disallowing anything with a camera in the facility, and I can't remember the names of the devices. But I don't expect schematics etc, just a general answer to put my mind at ease when I'm there, connected to electricity.

Answer 1

There are a massive amount of regulations covering patient-attached medical equipment. IEC 60601 is the generally accepted standard for medical electrical and electronic equipment, required for the commercialization of this type of equipment in many countries. Leakage currents must be controlled, single-point failures shouldn't cause an usafe condition, and these are tested. Primary to secondary insulation and isolation are specified and tested as well. So equipment meeting the common standards is pretty safe.

Now, if you buy a TENS unit from AliExpress or Amazon you're on your own.

Answer 2

1. The transformer

Isolation is very easy using magnetic coupling. Consider the GM Magnecharge EV charging system. The entire paddle was lined with plastic. The inside of the slot was entirely lined with plastic. There were no metal surfaces at all. Yet, it could charge the car at 7kW or 50kW.

So this type of magnetic isolation is very easy. Simply have a "primary winding" around an iron core attached to AC mains, and at the other end of the core, a "secondary winding" at a much lower voltage. Power gets between them as magnetic flux which has no voltage at all. And as demonstrated by the EV1 charge paddle, it doesn't even need to be continuous iron! So a seventh insulation gap could be added.

The winding wires have insulation individually (mostly to insulate them from each other to keep the winding from shorting). Then the entire winding is wrapped or put in a plastic cage. Then the iron core itself is dipped in enamel. Just within this transformer, six insulations would have to fail:

• primary winding wire insulation
• primary wrapping or cage
• transformer enamel at primary
• tranformer enamel at secondary
• secondary wrapping or cage
• secondary winding wire insulation

Granted, an extreme electrical spike could blow a hole through all three in one place, but it would have to do that twice in two different places. It will get stopped at the iron core, because.....

2. Earthing the iron core allows fault detection

Before hazardous voltage can reach the secondary winding, it must reach the iron core. An additional safety layer can be added by earthing the iron core. That is, tying it to the earth/ground pin on the 3-wire electrical supply - the wire that is yellow w/green stripe.

That wire is bonded to the actual earth, but it's also bonded to supply neutral. This means the blowout from primary winding to iron core will cause some "live" 230V current to leak onto the ground wire and back to source. In sufficient volume (Dead short) this will trip the circuit breaker. Remember the secondary hasn't been affected yet.

But European installations have a feature called "RCD". Current should go out the 230V live wire (brown) and return on the neutral (blue) and these currents should be identical. The RCD compares the two currents and if they are not identical, it trips, disconnecting live and neutral. The detection threshold is 30mA on any random European home, 6mA on the more sensitive per-circuit RCDs used in America, and I presume a hospital uses this more sensitive level. It is VERY difficult to die from 6mA of leakage for a few milliseconds, which is all it takes for SNAP! Even dying at 30mA would be hard. These are not lethal currents.

The fairly dumb way that Europe provides earthing to homes provides some vulnerability, but mainly for people who are outdoors with their bare feet on the ground and holding a machine plugged into mains, like a hedge clipper or an EV.(it's a vexation for EV charging). Not so much a problem for a person inside a home, and definitely not a problem in a medical facility where the earthing is going to be first rate.

3. No limit to the number of transformers.

You can simply repeat transformers over and over, for as much isolation as you choose to pay for. After the first transformer, all the transformers are low-voltage on both sides, so no conceivable failure could hurt you.

You can also just buy an isolation transformer, that plugs into the wall and has a normal socket on the side. So you can add more isolation transformers at home.

Small amounts of power can also have opto-isolation, think "LED shining on solar panel".

4. Or, just run it on batteries.

And lastly, the equipment which actually energizes you can be run on batteries. Now it is fully isolated from AC mains.

Answer 3

This is a supplementary answer: others have covered the physics admirably, but you may wonder whether the manufacturer has done all they should.

There is an international standard ISO 14971:2019 Medical devices — Application of risk management to medical devices. Manufacturers need approval from the appropriate government agency (FDA in the US, TDA in Australia, whoever looks after CE marks in the EU...). I have worked on devices intended for all three markets, and I can assure you the regulators insist on evidence that risks have been managed in accordance with ISO 14971. This requires that risks that might harm someone be identified, classified by severity and likelihood, and a decision made as to acceptability: killing patients, hospital staff, or visitors is not acceptable. Risks that are not acceptable must be mitigated, and a later analysis must show whether they are acceptable. The regulator will review the records to determine whether they are convinced that the risks have been managed properly. In some countries the regulators have draconian powers.

Here is part of what happens in a risk analysis. A group of engineers is assembled, people who had nothing to do with the design. The design team present on the problem, and their solution/design. The outsiders them brainstorm things that might go wrong: if the first transformer fails, and the second one does too, and the Moon is in Sagittarius, we might electrocute the patient; if this seven segment display, an operator might set the wrong input and fry the patient. The design team records all the failure scenarios (the meeting doesn't try to solve problems), and uses them as input to analysis.