Eff cient M ethods for Approaching Functional Safety to Hardware System s of M edical Devices

Eff cient M ethods for Approaching Functional Safety to Hardware System s of M edical Devices

KIM Gi-young1, WANG Da-wei1, PARK Ho-joon2,
JANG Joong-soon1
1.Department of Industrial Engineering, A jou University, Suwon Gyeonggi-do 443-749, South Korea；2.Medical Device Evaluation Engineering Center, Korea Testing Laboratory, Guro-gu Seoul 152-718, South Korea

A medical device is an instrument that includes components, parts, or accessories to diagnose or treat patients.Since the complexity of medical devices has increased in recent years, functional safety and basic safety are required to ensure the overall device safety.Functional safety is part of the overall safety that relates to the equipment under control（EUC）and to the EUC control system that depends on the correct functionality of the electrical/electronic/programmable electronic（E/E/PE）safety-related systems.This study proposes approach methods to functional safety of medical devices for which it is important to correctly identify the safety functions and the safety integrity level（SIL）.The relationship between the functional safety and essential performance is identi fi ed focusing on the safety function.The essential performance of E/E/PE systems is de fi ned as the safety function of the functional safety.The target SIL of the essential performance is determ ined according to the potential risk levels, based on the classi fi cation rules of medical devices.This approach is applied to the pulse oximeter as a case study.The target SIL for the functionality of the power-failure alarm condition is determined to be SIL1.The target SILs of other functions are determ ined as SIL2.

functional safety；medical device；essential performance；classi fi cation rule；safety function；pulse oximeter

0 INTRODUCTION

A medical device is generally used in patients, and its use may be associated to potential injuries.Since the risk of use of a medical device may be associated w ith a severe outcome, it can result in patient injuries.It is important for medical devices to achieve the required safety by reducing potential risks.Risk management for medical equipment should be carried out in accordance to the ISO 14971 standard.This standard presents the process and framework applied to the risk management of medical devices[1].The process includes identifying hazards associated w ith medical devices, estimating and evaluating risks, controlling the risks, and monitoring the effectiveness of the applied controls.

As part of the risk management activities, the safety of medical devices has to be evaluated according to the IEC 60601 standard.This standard deals w ith the requirements that ensure the basic safety and essential performance of medical electrical equipment and systems.The IEC 60601 standard is divided into the IEC 60601-1 and the IEC 60601-2/ISO 80601-2 series.The IEC 60601-1 standard includes the general requirements that should be applied to medical devices[2].It covers the basic safety requirements of medical electrical equipment, and serves to ensure that no single electrical, mechanical, or functional failure poses an unacceptable risk to patients and operators.The IEC 60601-2/ISO 80601-2 series account for the basic safety and essential performance requirements in accordance to the features of each medical device.

A lthough risk management and safety assessment have been carried out for im proving medical device safety, an increased number of failures of medical devices have occurred due to the increase in their operation hours.The probability of failures is raised ow ing to the degradation of hardware components as a result of cumulative loading after continuous use[3].These failures perm it the patient to be exposed to intolerable risks.The methods that treat the reliability and safety of medical devices over time should be applied to the design and development phases.As one of the alternative approaches, functional safety has recently been required to beenforced to improve the safety of medical devices.

Functional safety is required for equipment under control（EUC）, where the control systems depend on electrical/electronic/programmable electronic（E/E/PE）safety-related systems[4].These control systems can be de fi ned as being a part of the overall safety system.Kim et al[5]emphasized that the key concept of functional safety is consisted of safety functions and safety integrity.A safety function is a specific function implemented to m itigate or elim inate the risks to acceptable levels.Safety integrity is the probability that the required safety function is successfully performed by E/E/PE safety-related systems.When a selected safety function is operated w ith the required safety integrity, functional safety of the designated system is implemented according to the required level.

Prior research studies on functional safety have been mainly conducted using software available in the medical device field.The IEC 62304 standard includes the software development process to achieve functional safety of medical devices[6].Studies on the quality of the medical device software that was developed according to the IEC 62304 standard have already been conducted[7–8].Investigators have sought to develop schemes for the traceability of medical software to ensure the safety and the quality[9-10].When medical software is developed, the application of the IEC 61508 standard is inappropriate in the medical device sector[11].MDevSPICE-Adept process is thus utilized to evaluate the software safety of medical device[12].

Several studies have been conducted to implement functional safety to medical devices at the system level.Risk analysis is conducted to enhance the safety for the wearable walking assistant robots[13].The effect of risk reduction is compared between traditional and functional safety methods.Even though healthcare systems are in place, safety veri fi cation has not been carried out suf fi ciently in the development and integration phases.In order to solve the problem, functional safety must be applied in the fi elds of medical information and devices[14].

A lthough several studies related to functional safety of medical devices have been performed, previous research studies have been associated w ith lim itations.These research studies have mainly focused on the software development process of the medical devices.Conceptual studies have been partially conducted for functional safety.The needs for functional safety in the medical fi eld have only been emphasized in the published research studies.The specific scheme for the approach of functional safety is not provided in previous studies.Application targets and scopes of functional safety do not re fl ect the characteristics of the medical device sector.The subject of the functional safety is the E/E/PE system involved in safety functions.Nevertheless, previous studies are associated with errors in that the systems other than the E/E/PE systems are considered as the boundary of functional safety.The safety integrity level（SIL）has been determ ined not for the safety functions but for the E/E/PE systems.To solve this problem, studies related to the approach of functional safety have to be executed for medical devices.

The purpose of this study is to present a method to determ ine the safety functions and SIL of functional safety based on the characteristics of the safety aspects for the medical device sector.The scope and subjects are defined in order to implement the functional safety of medical devices.Functional safety analysis is performed based on the relationship of safety functions, and on the essential performance specified in the standards related to the medical device safety.The SIL of the essential performance is determ ined according to the potential risk levels, based on the classi fi cation rules of medical devices.As a case study, the approach is applied to the pulse oximeter.

1 ESSENTIAL PERFORM ANCE OF M EDICAL DEV ICES AND APPL ICAT ION SCOPES OF FUNCTIONAL SAFETY

Risk management in accordance to the ISO 14971 standard is the highest level of activity performed to achieve the safety of medical devices.The assessment of the basic safety and essential performance is a fraction of risk management activities for medical devices.The requirements for satisfying the basic safety of medical devices are speci fi ed in the general standard IEC 60601-1, and the standard series IEC 60601-2/ISO 80601-2.The IEC 60601-1 deals w ith the general requirements that should be applied to the medical devices.The IEC 60601-2/ISO 80601-2 series present the requirements of basic safety and essential performance re fl ecting the characteristics of each medical device.Figure 1 show s the hierarchical structure of standards related to the safety of medical devices.

Figure 1 Hierarchical structure of m edical device safety standards

Basic safety means freedom from an unacceptable risk directly caused by physical hazards, when the medical equipment is used under normal and single-fault conditions[1].Essential performance is the collective capability of a clinical function related to the safety.It is not included to the range of basic safety.Essential performance is easily understood by considering whether its absence or degradation would result in an unacceptable risk[15].The essential performance of each medical device used in the market has been selected based on the hazard analysis and risk assessment by medical device experts.The essential performance of several medical devices that are extensively used and potentially have a high potential risk is speci fi ed in the particular standard series IEC 60601-2/ISO 80601-2.Essential performance has relevance to functional safety.Therefore, an additional theoretical study should be conducted to investigate the two concepts.

Essential performance is analogous to functional safety[16].Nevertheless, essential performance should be distinguished from functional safety[17].Essential performance is thought to correlate signi fi cantly w ith functional safety from the risk point of view.The application targets of these two concepts are the same as the safetyrelated areas that can be caused by the intolerable risk.Therefore, essential performance must be considered in the determination of the application scope of functional safety for medical devices.As shown in Figure 2, essential performance of medical devices is de fi ned as the safety function of functional safety.In accordance to the functional safety concept, the safety function is the important feature that must be executed to reduce or prevent the risk, based on the hazard analysis and risk assessment.If the safety function of functional safety is inappropriately executed, the intolerable risk results in harm and injuries to the patients.The essential performance of the medical device is also one of the safety-related factors.If essential performance is not properly executed, harm can be incurred when a hazardous situation occurs.Therefore, the essential performance can be regarded to be equally important to the safety function, and is one of the most signi fi cant elements of functional safety.

Figure 2 Relationship of the key elements of functional safety and essential performance

Essential performance of medical devices is grouped into two categories：functions w ith E/E/PE systems, and functions w ithout E/E/PE systems.The safety functions are categorized into two types：One is only executed to enhance safety, and the other is conducted to achieve better performance and safety simultaneously.Figure 3 shows the relevance between safety functions and essential performance.Among the variety of essential performance of medical devices, the essential performance using the E/E/PE system is only included in the safety function of functional safety.In contrast, the essential performance in cases where the E/E/PE system is not used is excluded from the application boundary of functional safety.For example, essential performance such as the energy output function of electrical surgical instruments, is included in the boundary of functional safety.However, essential performance, such as maintaining the sterilized electrode that does not use the E/E/PE system, has no relevance to the safety function of functional safety.

Figure 3 Relationship of safety functions and essential performance

If the essential performance is not specified in the particular standards it should be determ ined based on the ISO 14971 standard.The essential performance of a medical device is defined by the risk management activities.The essential performance should be checked depending on whether the E/E/PE systems are used or not.When the E/E/PE system is used for the implementation of the essential performance, it can be considered that it constitutes the safety functions of functional safety.If the E/E/PE system is not used, the essential performance is not included in the application boundary（Figure 4）.

Figu re 4 Flow d iagram ind icative of the selection o f sa fety functions considering essential perform ance.E/E/PE：Electrical/electronic/programmable electronic.

2 SAFETY INTEGRITY LEVEL OF ESSENTIAL PERFORMANCE

Safety integrity is a probability that an E/E/PE safetyrelated system properly performs the safety functions under speci fi ed conditions, and w ithin a stated period of time.SIL is the measure for evaluating at which degree of reliability the safety-related function operates, as it is implemented in EUC[18].As shown in Table 1, SIL is the discrete level corresponding to the range of safety integrity values in the IEC 61508 standard, which is the typical standard of functional safety.Speci fi cally, SIL4 is the highest level of safety integrity, and SIL1 is the lowest level[4].The higher the SIL is required, the lower the probability that the specified safety functions of the safetyrelated system w ill fail to operate.

Table 1 Safety integrity levels based on mode of operations

The mode of operations has to be determined for establishing the target SIL.The mode of operations is the way of operating safety functions, according to the demand rate.It is divided into three types：low-demand mode, high-demand mode, and continuous mode[19].If the demand rate of safety functions is no greater than one per year, the speci fi ed safety functions are considered to be in a low-demand mode.The parameter for the target SIL is selected as the average probability of a dangerous failure on demand of the safety function（PFDavg）, in the lowdemand mode.If the demand rate of safety functions is greater than one per year, the speci fi ed safety functions are regarded to exist in the high-demand more or in the continuous mode.The parameter for the target SIL is selected as the average frequency of a dangerous failure of the safety function（PFH）, in the highdemand more or in the continuous mode.When the demand rate is unknown, PFH is used as the parameter to determine the target SIL.

Information on app lication areas of functional safety should be fully taken into account to conduct the risk assessment and determine the target SIL of the selected safety functions of functional safety.A lthough the same safety function is implemented, the SIL has different targets, depending on the application sector[20].SIL determination should be performed by taking into account the characteristics of the medical devices sector.Medical devices are classi fi ed in accordance to the potential risk levels.As shown in Table 2, the recommended target SIL is decided according to the detailed classi fi cation scheme.

Table 2 Recommended SIL based on medical devices classif cation

The medical devices are classi fi ed into three classes in the United States：class Ⅰ, class Ⅱ, and class Ⅲ[21].In Europe, the medical devices are classi fi ed into four classes：class Ⅰ, classⅡ a, class Ⅱ b, and class Ⅲ[22].In South Korea, the regulation enacted by the Korean M inistry of Food and Drug Safety classifies medical devices into four classes, as in Europe：class 1, class 2, class 3, and class 4[23].In every country, the classi fi cation regulations of medical devices have a sim ilarity in that, when the risk of a medical device is high, the number assigned to each class is increased.The item list of medical devices belonging to each class is sim ilar among the United States, European Union, and South Korea.

Based on the classification performed in South Korea, tongue depressors and manual exam tables are typical class 1 medical devices.Class 1 medical devices have a low risk and a simple structure.A lmost all class 1 medical devices do not carry out functions of measurement, diagnosis, or energy radiation.They do not commonly use the E/E/PE systems to operate safety functions.Therefore, class 1 medical devices are excluded from the boundary of functional safety.

The medical devices that are primarily used for diagnostic purposes are included into the class 2 boundary.Diagnostic X-ray equipment and diagnostic ultrasound are included into class 2 medical devices.Failures of class 2 medical devices enable the patient to be directly or indirectly exposed to harm.For example, excessive doses of radiation or ultrasound result in causing harm and direct damage to the tissue.The diagnostic functions cannot be executed ow ing to the decrease of image quality.A misdiagnosis can result due to the poor image quality of the diagnostic medical devices.The patient is exposed to a potentially hazardous situation.In this case, risk reduction activities are required.SIL1 should be established for safety functions in order to reduce potential risk and to enhance safetyof class 2 medical devices.

Class 3 mainly consists of medical devices used to treat the patient or the disease.Electro–surgical systems and surgical laser are contained in class 3.Medical devices for treatment require higher electrical or mechanical energy than diagnostic medical devices of class 2.They transfer the energy to patients through the applied parts that directly contact the body.Therefore, the severity of the risk applied to the person is higher than class 2 medical devices.SIL2 should be established for safety functions to reduce the potential risk and to enhance the safety of class 3 medical devices.

Class 4 medical devices are inserted and implanted into the body to work sem i-permanently, and are associated w ith the heart and blood vessels.Among a variety of class 4 medical devices, cardiopulmonary bypass devices, pacemakers and intra-aortic balloon pumps are operated by the E/E/PE systems.These medical devices have a high risk in regard to infections and biological portability.The risks associated w ith functional safety issues also lead to fatal harm and may threaten the life of the patients.Therefore, the safety functions of medical devices that belong to class 4 should be targeted as SIL3.

The SIL determ ination based on the classification of medical devices is not complete.The m inimum guidelines are presented to de fi ne the target SIL of essential performance that is included in the functional safety boundary.The effect of malfunctions or failures of essential performance should be con fi rmed.SIL1 is allocated to the safety functions whose failures result in m inor injuries.When the failures of the safety functions give rise to serious injuries in a few people or to curable injuries in many people, the safety function’s target is considered to be SIL2.SIL3 is targeted to the safety function for which the malfunction causes serious injuries to many people or death to a few people due to failures.The death of many people is rarely caused by the failures of the medical devices[24].Therefore, SIL1, SIL2, or SIL3, are usually enough to establish the target of safety functions of medical devices.

Functional safety of the medical device is implemented for hardware systems by using determined safety functions and SILs.Information for the target hardware system is collected.The requirements for implementing safety functions and SILs are speci fi ed at the system level.The requirements are divided into two groups；hardware safety integrity requirements and systematic safety integrity requirements.These requirements are allocated to the subsystem level.

3 CASE STUDY

This research conducted a case study to de fi ne the safety functions of functional safety and to establish the target SIL of the safety functions.The pulse oximeter was selected as the target medical device for the case study.A pulse oximeter is the medical device used to measure blood oxygen saturation, that is, the percentage of the amount of hemoglobin bound to oxygen w ith respect to the total amount of hemoglobin[25].Oxygen is an essential element for metabolism in human beings.If the blood oxygen concentration decreases, people can experience an increase in their heart rate, headaches, and nausea, in m ild cases.When the symptoms are severe, convulsions, morbus ceruleus, and unconsciousness can occur.Finally, cardiac arrest or brain death may occur due to a severe decrease of blood oxygen concentration.Therefore, the pulse oximeter has to operate properly in order to prevent additional damages in patients.

In accordance to the specified process of this research, the related standards o f the pu lse oxim eter have to be checked to define the safety functions of functional safety.The essential performance is confirmed to select the safety functions of the functional safety for the pulse oximeter.The essential performance of the pulse oximeter is specified by the paticular standard ISO 80601-2-61[26].The groups of essential performance include the accuracy of measurement, detection of error/alarms, and prevention of incorrect output.Since all essential performances of the pulse oximeter use the E/E/PE system, it is considered as a device w ith safety functions of functional safety.The accuracy of SpO2and heart rate is included in the safety functions related to the measurement accuracy.The measured data have to be quickly updated to disp lay the current measurement, and must be renewed w ithin time intervals of 30 s or less.This function is related to the prevention function of incorrect outputs.Error detection enables the users to know that the optical sensor is disconnected from the extension cable, or that the power supply is converted from an external power into an internal power.In regard to the alarm functions, the IEC 60601-1-8 standard, commonly applied to medical devices, speci fi es the priority of alarms considering the risk level[27].Every essential performance of the pulse oximeter is included in the scope of functional safety.Therefore, the relationship between safety functions of functional safety and essential performance of the pulse oximeter is shown in Figure 5.

Figu re 5 C lassification of safety functions and per form ancerelated functions

The essential performance related to the accuracy of measurement and prevention of incorrect outputs constitutes fundamental functions that are continuously perform ed.Therefore, the mode of operations is selected to be in continuous mode.In regard to the essential performance related to the detection of error, alarms are only activated to ensure the safety of the pulse oximeter.These functions have relatively lower demand rate compared to the primary functions.A ll of the essential performance operates more than at least once per year.The operating mode is determ ined to be in a high-demand mode or in a continuous mode of operations for the essential performance.PFH is selected as the quantitative parameter for the target SIL.

The pulse oximeter is a class 2 medical device based on item classi fi cation regulations.SIL1 should basically be assigned to the essential performance of the pulse oximeter in accordance to SIL determ ination rules, as shown in Table 2.Additional risk assessment is performed by considering the characteristics of the essential performance.The functions that m easure the pulse rate and blood oxygen levels are closely related to human life support.If these functions do not operate properly, this may lead to serious patient injuries.The probability of patient deaths due to the malfunction of the pulse oximeter is very low.A lthough the alarms of the pulse oximeter are not operated normally, hospital staff visually con fi rms the symptoms and takes action on patients in order to avoid incidents that may lead to death.

The assigned SILs are modified by the results of risk managem ent.The function for the pow er-failure alarm condition is considered to be SIL1.Even though the speci fi ed essential performance is out of the order state, the hazardous situation does not occur immediately in this case.This essential performance has a low probability of causing harm to patients.Therefore, the target of the power-failure alarm condition is established to be SIL1.In contrast, SIL2 is assigned to other functions, such as the SpO2accuracy, pulse rate accuracy, protection against hazardous output, detection of probe and probe cable extender fault, and alarms condition priority.

When fi ve types of essential performance are in failure occurrence situations, this can directly result in serious injuries for the patients, such as convulsions and morbus ceruleus.Therefore, the target for this essential performance is selected to be SIL 2, as shown in Table 3.

4 CONCLUSION

This study has p resented the app roach m ethod o f functional safety for medical devices.The analysis comparing the concept of safety function and the essential performance has been performed to approach functional safety.Essential performance of the medical device is sim ilar to the safety function of functional safety.Therefore, the lists on the essential performance should be considered to define safety functions of functional safety.Essential performance based on E/E/PE systems is selected to de fi ne the safety function of functional safety.Information on the essential performance that is presented in particular standards perm its designers and developers to efficiently define safety functions of functionalsafety.When essential performance of medical devices is used for selection of the safety function, the cost and time can be reduced, and the validity and adequacy can be ensured.

Table 3 Target safety integrity levels for essential perform ance of the pu lse oximeter

SIL is determ ined in accordance to the characteristics of the medical devices sector.Medical devices are classi fi ed according to the potential risk level.Information on classification regulation and risk management of medical devices is used to determ ine the target SIL of essential performance.SIL1, SIL2, or SIL3 are universally applicable for the target of safety functions of medical devices.SIL3 is allocated to a high-risk essential performance of medical devices and SIL1 is targeted to a low-risk essential performance.

The case study is carried out for the pulse oximeter by using the presented approach methods.The ISO 80601-2-37 is a particular standard for the pulse oximeter and presents six types of essential performance.All the essential performance of the pulse oximeter is based on an E/E/PE system.Therefore, all essential performance is included in the boundary of functional safety.Among the essential performances, SIL1 is allocated to a power-failure alarm condition.Other essential performance targets are determ ined to be SIL2.

[REFERENCES]

[1]International Organization for Standardization,ISO 14971 Medical devices-Application of risk management to medical devices, 2007[S].

[2]International Electrotechnical Commission,IEC 60601-1, Medical electrical equipment-Part 1：General requirements for basic safety and essential performance,2005[S].

[3]Ohring M.Reliability and failure of electronic materials and devices[M].Academ ic Press,1998.

[4]International Electrotechnical Commission,IEC 61508-1,Functional safety of Electric/Electronic/Programmable Electronic safetyrelated systems- Part 1：General requirements, 2010[S].

[5]Kim GY,Ko BG,Chan SI,et al.Assessment Procedure of Safety Integrity Level（SIL）Based on Flow chart[J].J App l Re, 2010,10（2）：107-122.

[6]International Electrotechnical Commission,IEC 62304 Medical device software–Software life cycle processes, 2006[S].

[7]Huhn M,Zechner A.Arguing for software quality in an IEC 62304 compliant development process[C].Proceeding ISoLA'10 Proceedings of the 4th international conference on Leveraging applications of formal methods, verification, and validation-Volume Part II,2010：296-311.

[8]Burton J,McCaffery F,Richardson I.A risk management capability model for use in medical device companies[C].Proceedings of the 2006 international workshop on Software quality,2006：3-8.

[9]Regan G,McCaffery F,M cDaid K,et al.Medical device standards' requirements for traceability during the software development lifecycle and imp lementation of a traceability assessment model[J].Comp Stand Inter,2013,36（1）：3-9.

[10]McCaffery F,Casey V,Sivakumar MS,et al.Medical device software traceability[C].In：Software and Systems Traceability,London：Springer,2012：321-339.

[11]Jordan P.Standard IEC 62304-M edical device software-Software lifecycle processes[C].In：Software for Medical Devices 2006,The Institution of Engineering and Technology Sem inar,IET,2006：41-47.

[12]M cHugh M,M cCaffery F,Casey V.How amendments to the medical device directive affect the development of medical device software[C].European Systems and Software Process Improvement and Innovation Conference, EuroSPI,2011.

[13]Nabeshima C,Kawamoto H,Sankai Y.Typical risks and protective measures of wearable walking assistant robots[C].In System Integration（SII）,2011 IEEE/SICE International Symposium on,2011：914-919.

[14]Chadwick L,Fallon EF,van der Putten WJ,et al.Functional safety of health information technology[J].Health Inform J,2012, 18（1）：36-49.

[15]Schm idt M.Essential Performance in Medical Equipment[J].MDDI,2007,29（8）：92-99.

[16]Pinheiro P.Functional Safety Today's Medical Developments Magazine[EB/OL].http://www.onlinetmd.com/TMD-0911-functional-safety.aspx#.VQDt7k39mUk.

[17]Silberberg JL.FDA/CDRH Experience w ith EMC Problem Reports,Standards,and Guidance,Center for Devices and Radiological Health,US Food and D rug Adm inistration, 2010[S].

[18]International Electrotechnical Comm ission.IEC 61508-4, Functional safety of Electric/Electronic/Programmable Electronic safety-related systems-Part 4：Definitions and abbreviations, 2010[S].

[19]Jin H,Lundteigen MA,Rausand M.Reliability performance of safety instrumented system s：A common approach for both low-and high-demand mode of operation[J].Reliab Eng Syst Safe,2011,96（3）：365-373.

[20]Smith DJ,Simpson KGL.Safety Critical Systems Handbook：A STRAIGHTFOWARD GUIDE TO FUNCTIONAL SAFETY, IEC 61508（2010 EDITION）AND RELATED STANDARDS, INCLUDING PROCESS IEC 61511 AND MACHINERY IEC62061 AND ISO 13849[M].The Netherlands：Elsevier,2010.

[21]US Departm ent of Health and Hum an Services,Food and Drug Adm inistration,Center for Devices and Radiological Health,Center for Biologics Evaluation and Research.The 510（k）Program：Evaluating Substantial Equivalence in Premarket Noti fi cations, Food and Drug Administration[S].2011：1-42.

[22]EUROPEAN COMM ISSION DG HEALTH AND CONSUMER.MEDICAL DEVICES：Guidance Document-Classification of Medical Devices,2010[S].

[23]Department of Medical Equipment Policy.Regulations on The M edical Device Classification,M inistry of Food and Drug Safety,2015[S].

[24]Marszal EM.Tolerable risk guidelines[J].Isa T,2001,40：391-399.

[25]Runcim an WB,Webb RK,Barker L,et al.The Australian Incident Monitoring Study.The pulse oximeter：applications and limitations-an analysis of 2000 incident reports[J].Anaesth Intensive Care,1993,21（5）543-550.

[26]International Organization for Standardization,ISO 80601-2-61, Medical electrical equipment-Part 2-61：Particular requirements for basic safety and essential performance of pulse oximeter equipment[S].

[27]International Electrotechnical Comm ission,IEC 60601-1-8 Medical electrical equipment-Part 1-8：General requirements for basic safety and essential performance-Collateral Standard：General requirements, tests and guidance for alarm systems in medical electrical equipment and medical electrical systems, 2006[S].

R197.39 [Document code]A

10.3969/j.issn.1674-1633.2015.12.008

1674-1633（2015）12-0027-07

Received：2015-06-15 Revised：2015-08-11

JANG Joong-soon, Professor.

E-mail：jsjang@ajou.ac.kr