Closed-loop systems in medical devices

Medical devices are increasingly based on closed-loop systems. “Closed-loop systems” are also mentioned in the Medical Device Regulation (MDR).

In this article you will learn what closed-loop systems are, where they are used in medicine, and what regulatory requirements they need to meet. The article also reveals how you can save several hundred euros buying the standard IEC 60601-1-10.

1. Goals of closed-loop systems

Closed-loop systems aim to keep a control variable at a defined value (reference variable, output variable) although a disturbance variable is acting on the system.

For example, the temperature of a room (control variable) should be kept at a certain level (reference variable) although the ambient temperature either heats or cools the room (disturbance variable).

The particular feature of a closed control loop in medical devices is the measurement of a physiological variable, which is then used to adapt the supply of energy or materials (by means of an actuator) to control or keep the physiological variable (control variable) at a target level.

The Canadian authorities define closed-loop systems as follows:

However, this definition is not precise:

• It must be clear that a closed-loop system cannot only recognize and treat a disease. Instead, control must be based on detection.
• In a “real” closed-loop system, the cycle of measuring – adjust – measuring would run through several times. This does not seem to be a mandatory requirement in this definition.

The FDA provides a better definition (further below in chapter 4.b). First, however, let’s return to the function of a control loop.

2. Functioning of closed-loop systems

a) Introduction

Closed-loop systems use the controlled variable (actual value; in the example above, the actual room temperature) to determine its difference from the reference variable. A controller attempts to minimize this difference. To do this, it can influence a control device (also known as an actuator) via a control variable. In the case of our heating system, the controller sends a command to the valve. This changes the valve opening (control variable) and, thus, the amount of hot water in the radiator inlet.

b) Types of controllers

Different types of controllers can be selected depending on the requirements in terms of the quality of the regulation and depending on the technical and financial options.

Two-point and multi-point controllers

Two-point controllers are some of the most primitive controllers. A two-point controller operates by toggling between two states: on and off. Two-stage controllers can be used to regulate the filling level of vessels, for example. If a certain filling level (the control variable) is exceeded or drops below a given level, a pump switches on or off, providing a simple and binary control mechanism.

A multi-point controller can have multiple discrete setpoints or operating levels. It allows for more flexibility in controlling a system by activating different actions or adjustments at distinct setpoints.

P-controller

With a P-controller (proportional controller), the regulating variable changes in proportion to the system deviation. In a heating system, the valve opening would get larger and therefore proportionally bigger the lower the room temperature is compared to the target temperature (within certain limits).

I-controller

I-controllers (integral controller) do not (only) consider the system deviation, they also consider the integral. In other words, the longer the system deviation is in place for, the more action is taken, and the regulating variable is regulated accordingly. This makes I-controllers slower but more precise controllers.

Other controllers

Control engineers distinguish between many other types of controllers such as the D-controller and combinations of these controllers such as PI, PD, and PID controllers. You can find an overview of a controllers here.

Examples of closed-loop systems

a) Technology, ecology, economy

There are numerous examples of closed-loop systems, for example in technology, ecology, and the economy:

• Cruise control in cars
• Automatic watering of flower boxes
• Level of wildlife population regulated by hunting and nurture
• Adjustment of interest rates to control inflation

In the last case in particular the challenges that the controller needs to face in the case of significant and unforeseeable disturbance variables become apparent, particularly when the disturbance variables themselves are affected by the control variable.

b) Medicine

The human body is a highly complex control system that regulates a large number of physiological parameters such as body temperature, heart rate, breathing, blood sugar level, pH, or pupil size in the eyes.

In contrast to the simple example of heating, the body has to control many control variables at the same time. These control variables are dependent of one another and also need to satisfy constantly changing reference variables.

For example, if a person is ill the body increases the reference variable of temperature (fever) or increases the target value for breathing and heart rate if they are exercising.

c) Medical technology

Medical technology uses closed-loop systems in many ways: 

• Automatic anesthetic systems
• Systems to stabilize the hemodynamics (the blood pressure)
• Neurostimulators
• Infusion pumps for muscle relaxants
• Pacemakers

A distinction can be made between three main types:

1. Internal control loops
   Internal control loops are characterized by there being no externally visible control variable. For example, a control loops controls a ventilator to ensure that the temperature within the device does not exceed a maximum.
2. External “technological” control loops
   In this type, the control loop controls an external behavior of the medical device, typically on an applied part.
   Examples include controlling the rotation speed of a bone drill or the current on an HF surgical unit, which the device controls depending on the patient’s electrical impedance.
3. External “physiological” control loops
   This type of control loops controls physiological parameters. Here are some examples: The dose of an anesthetic depending on the depth of anesthesia, the ultrafiltration rate of a dialysis machine depending on the quantity of blood, or the dose of insulin in an (implantable) insulin pump depending on the patient’s blood sugar (example) (only available in German).

4. Regulatory requirements for closed-loop systems

a) MDR requirements

Fundamental requirements

Neither the MDD nor the MDR address closed-loop systems within the scope of the or general safety and performance requirements. The requirements not to jeopardize patients’ safety and only to accept reasonable risks (based on the benefits) apply to all medical devices.

The following requirement set out in the MDR is particularly relevant for closed-loop systems:

Diagnostic products and products with a measurement function are designed and manufactured in such a way that suitable scientific and technical methods are used to ensure sufficient accuracy, precision and stability for the intended use of the product. The manufacturer specifies the accuracy limits.

MDR Annex I 15.1

Closed-loop systems are all based on measurements, so many of them also have measurement functions in the sense of the MDR.

The specifications for “devices that incorporate electronic programmable systems and products in the form of software” are also relevant:

Devices that incorporate electronic programmable systems, including software, or software that are devices in themselves, shall be designed to ensure repeatability, reliability and performance in line with their intended use. In the event of a single fault condition, appropriate means shall be adopted to eliminate or reduce as far as possible consequent risks or impairment of performance.

MDR Annex I 17.1

Proving the repeatability and reliability is a challenge for some manufacturers of closed-loop systems. This is discussed further down in this article.

Classification MDR Rule 22

The MDR only addresses closed-loop systems a single time, namely in Annex VIII with the classification rules. Rule 22 states:

Active therapeutic devices with an integrated or incorporated diagnostic function which significantly determines the patient management by the device, such as closed loop systems or automated external defibrillators, are classified as class III.

MDR Annex VIII Rule 22

This sentence needs a few notes:

1. Inappropriate classification
   This rule makes many medical devices such as dialysis machines and ventilators class III devices. It is doubtful that this was really the Commission’s intention. This classification would be absurd.
2. Misunderstanding of what a closed-loop system is?
   Automatic External Defibrillators (AEDs) are not necessarily closed-loop systems even if they are “automatic.” AEDs automatically determine the patient’s ECG signal and decide whether and in what form defibrillation is used. There is, however, no feedback loop unless the ECG signal was the result of a previous (obviously unsuccessful) attempt.
   From the text, you also do not necessarily have to conclude that the legislator includes AEDs in the class of closed-loop systems. There is, however, some room for discussion regarding what a closed-loop system is. Using pacemakers as an example would have made more sense (article on this).
3. Not all closed-loop systems are meant
   The Commission probably does not want to classify all closed-loop systems as class III. We assume it is much more likely that it “only” wants to include the closed-loop systems that we referred to as “external physiological control loops” above. From this we can conclude that a diagnostic function needs to be built in (and probably part of the control loop).
4. Integrated versus incorporated
   The difference between an integrated and an incorporated function is not immediately obvious even when reading the English text (“incorporated or integrated”).

b) FDA requirements of closed-loop systems

Almost two years after drafting a guidance document specifically for medical devices on closed-loop systems, the FDA has published the final version of this guidance document.

Scope of application

However, this guidance document only relates to “Physiological Closed-Loop Controlled” (PCLC) medical devices. These are medical devices that meet all of the following requirements:

• The products use sensors that measure physiological parameters.
• They use actuators and algorithms that control physiological parameters based on physiological measurements.
• The control is achieved by the supply or withdrawal of energy or materials (e.g., medications, liquids, gases).

Manufacturers need to take this guidance document into consideration in two cases:

1. Approvals of medical devices PMN/510(k), De Novo, PMA, and HDE
2. Associated Q-submission meetings with the FDA

The FDA indicates that additional requirements must be taken into account for active implants such as neurostimulators in particular. The guidance document does not attempt to provide recommendations on the use of machine learning.

Definition

The FDA defines PCLC products as follows:

Examples

Furthermore, the FDA cites specific examples of devices or functions that can be considered PCLC technology:

• Anesthesia gas machines that automatically titrate the fraction of inspired anesthetic agent in response to an end-tidal gas measurement or rate of infused anesthetic drug
• Mechanical ventilator that automatically adjusts the settings (e.g., proportion of oxygen inhaled) in response to a measurement of the patient’s oxygen saturation
• Automatic insulin delivery systems that control insulin delivery based on inputs from a blood glucose value
• New: Hypo- and hyperthermia systems that automatically adjust temperature in response to the temperature measured on the patient’s body

The FDA also recommends that manufacturers use pre-submission meetings or inquiries if unsure whether their clinical function is a PCLC system. For example, the authority provides more detailed feedback on clinical study design.

The FDA also references IEC 60601-1-10 Ed. 1.2:2020, which provides further examples of PCLC systems in Appendix A.

Most important requirements

The FDA recommends that manufacturers describe the technical components and specifications of their PCLC device as described in IEC 60601-1-10:2020 (e.g., Section 8.2.2 “Device specifications”).

The FDA formulates the requirements of PCLC devices in Chapters V to VII.

Chapter V.A.

In risk management (Chapter V.A.), the guideline lists several hazards and risks that manufacturers should take into account (non-exhaustive list):

• Patient-related hazards
  A patient’s response to the energy or substance being delivered or removed is a critical factor to consider in the design. This response may differ between patients and within an individual patient. For example, disturbances from other therapies must be taken into consideration. Accordingly, the following aspects should be considered in the risk analysis:
  • Intended patient population (variability of physiological response between patients)
  • Contraindications for the use of PCLC technology
  • Environment where the device is intended to be used
  • Identification of differences between the current care according to accepted practice guidelines and the method to be used by the PCLC device
• Userelated hazards
  In addition to everyday use errors, the FDA emphasizes hazards resulting from users becoming overconfident in the system, losing their capabilities, or becoming overwhelmed with the technology.
• Device-related hazards
  Manufacturers should identify and clearly describe the uncertainties in their system design and the foreseeable functional disturbances in the clinical environment and workflow, such as
  • signal noise, noise artefacts
  • insufficient sensor accuracy or drift or failure
  • latency and delay times
  • communication failures between device components and failures within an integrated clinical environment
  • cybersecurity threats and vulnerabilities

The guidance now also includes elements of an Integrated Clinical Environment as described in the ASTM standard F-2761: “Medical Devices and Medical Systems – Essential safety requirements for equipment comprising the patient-centric integrated clinical environment (ICE) – Part 1: General requirements and conceptual model.“

This is particularly important when treating patients by creating a comprehensive medical system into which other distributed systems are integrated.

Chapter V.B.

In Chapter V.B. on the design of devices, the FDA provides recommendations for the design of the various components. It regularly refers to the requirements of IEC 60601-1-10, some of which are relatively “high-level,” such as the following:

“Control algorithms for all modes should be designed to meet their performance specifications during reasonably foreseeable disturbances.”

The FDA’s guidance on designing and selecting components is more helpful. Examples are

• the linearity and latency of sensors,
• the accuracy and physical limits of actuator performance, and
• the physical limitations of the actuator (e.g., the energy that can be supplied) and fallback modes in the event of errors.

Data logging and using alarms are also among the authority’s recommendations.

Chapter V.C.

Chapter V.C. contains a comprehensive list of aspects that should be validated or verified. The chapter also describes when verification or validation is necessary. Verification, for example, concerns all tests regarding the specification. An example of this is the inspection of a sensor that must meet the requirements of the PCLC system. Validation, on the other hand, focuses on aspects such as the specified design meets user needs and intended uses. The list in this section, therefore, also serves as a checklist for the scope of the specifications to be drawn up.

Chapter VI.

In this chapter, the document again addresses non-clinical testing, which is an integral part of verification and validation (V&V) activities. This chapter emphasizes the need for additional tests for PCLC systems due to their unique characteristics, which must be considered in medical device testing.

Manufacturers are recommended to consider a systematic method for developing failure and uncertainty scenarios for stress testing of the PCLC system to ensure that they are tested under clinically relevant worst-case conditions.

• Animal testing
  Manufacturers planning animal studies to test under worst-case conditions factors that cannot be evaluated through analysis should consider the aspects listed in the section when planning the study.
• Use of mathematical and computational models
  Since testing in all clinically relevant scenarios may not be feasible using animal studies and/or clinical investigations, the FDA recommends using mathematical and computational models as a supplement. Evaluation of a PCLC system using a patient model may be an alternative or complement to animal testing and/or clinical investigations. Computer models used for design or validation must be reviewed for their predictive ability. The FDA refers to the corresponding guidance documents and the best practices described in ASME V&V 40.

Chapter VII

The seventh chapter contains little that is new. It is obvious that the FDA’s guidance on human factors and usability engineering must be observed. The document mentions many specific hazards, such as the “automation bias” in previous sections.

Chapter VIII

The FDA recommends that the documentation is structured in accordance with Chapter 5.1, “Instructions for use,” and Chapter 5.2, “Technical description” in IEC 60601-1-10 and describes which other aspects manufacturers must define, for example,

• components such as sensors and actuators with respective performance specifications
• alarms
• mode of operation
• controlled physiological parameters
• requirements for use
• existing or necessary fallbacks
• operation of the device

c) IEC 60601-1-10

Overview

IEC 60601-1-10 is entitled “Requirements for the development of physiologic closed-loop controllers.” It applies to medical electrical equipment and is a supplementary standard to the basic standard, IEC 60601-1.

In a comparable manner to the FDA, the IEC 60601-1-10 defines a PCLC in a rather more technical manner using the parameters of a control system. Both definitions are similar in principle, albeit not worded the same.

As for the FDA guidance document (see below), the scope is restricted to medical devices that control physiological parameters.

IEC 60601-1-10 is a collateral standard. It includes fundamental principles, concepts, and terms. This means that standard does not set out any requirements for a certain type of medical device. These special determinations can be found in the part 2 standards.

IEC 60601-1-10 formulates requirements in Chapters 4 to 8.

Chapter 4: General requirements

The compact fourth chapter lists specific parameters and hazards that manufacturers need to take into account in risk management. This includes latency times, the different reactions of different patients to the control, and the impact of the elements of the control loop such as the sensors.

Chapter 6: Output value

This chapter sets requirements to the accuracy of controls and instruments and protection against hazardous outputs. This relates to the

• usability of the user interface,
• existence (if a fallback is necessary) and conformity of the alarms (with a reference to IEC 60601-1-8),
• obligation to carry out logging (without going into detail about data protection aspects), and
• use of distributed PCLCS (that the standard explicitly permits).

Chapter 7: PEMS

Chapter seven of the standard simply references Chapter 14 of IEC 60601-1.

Chapter 8: Development requirements

Chapter eight sets requirements for what manufacturers need to specify and which risk-minimizing measures they need to take into consideration. For example, they need to determine how the product should behave during normal operation and in the worst case for the regulating variable, the measured variable, and the patient transfer element.

If necessary, manufacturers should limit the range of the variables, e.g., the maximum quantity of heat that can be supplied to a patient.

The chapter also sets out which disturbances and therefore hazards manufacturers need to analyze and control.

Finally, the standard requires the verification and validation of the control loops and gives methods for this.

IEC 60601-1-10 was harmonized under the MDD and the AIMDD. Harmonization under the MDR has not yet been achieved.

d) Other standards

Other standards such as ISO 80601-2-13 for anesthesia machines or IEC 60601-2-20 for infant incubators address specific device types and set requirements that ultimately focus on the control loops.

There are part 2 standards that specifically consider IEC 60601-1-10 not to be applicable. This generally relates to devices that work with controls but have no physiological parameters, such as CT x-ray machines (IEC 60601-2-44) or lithotripsy devices (IEC 60601-2-36).

Some standards, such as DIN EN 60601-2-12 and the current version DIN EN ISO 80601-2-12:2012-02 for ventilators address specific device types. However, ventilators are mostly not considered as closed control loops:

“ventilators are not considered a physiologic closed-loop closed control system …”

ISO 80601-2-12, 201.1.1

5. Typical challenges of closed-loop systems

a) Development of closed-loop algorithms

Control technology is an extensive scientific discipline to which whole study programs and teaching positions are dedicated. Typical challenges faced by developers include the following:

• A control loop should be stable: the system must return to the reference level even in the event of significant disturbances.
• Control loops must provide sufficient performance: the supply of a medication (insulin, anesthetic, electrolytes) must reach the target levels in seconds rather than minutes.
• The control loop must reach the target levels sufficiently accurately: A pH of 7.42 is OK. A pH of 7.7 means the death of the patient.

b) Verification of closed-loop systems

Formal evidence of the safety of simply control loops can also be provided. Evidence can sometimes be difficult in the case of highly complex control loops that are dependent on one another, and occasionally even impossible as is the case for deterministic and chaotic systems. However, manufacturers must provide evidence of the safety, repeatability, reliability, and performance (specifically required) of the products and therefore the control loops.

The approaches that can be used to provide this evidence include:

• Model-based testing: A requirement for this, however, is that you have a reliable model of the controlled system (e.g., the patient).
• Limitation of the regulating variables (in some cases even mechanically)
• Plausibility checks of the regulating variables and intervention by system components outside of the control loop (→ functionally safe architecture)
• Testing of possible combinations in particular of the disturbances and their progression over time. However, this “brute force variant” only works where there is a finite number of combinations of inputs to be tested.

c) Human factors

The authors feel that there is a particular risk related to the operation. The operator must be able to understand the status of the PCLC system in accordance with their mental model. The mental model is the operator’s expectation of how the PCLC system works and is structured. If the operator understands how a PCLC system works, they can then solve problems that may occur when using the PCLC system and respond appropriately.

They talk about the following challenges:

• Lack of transparency (for the user)
• Automation bias (blind trust on the part of the user)
• Users lose the ability to make decisions of the previous quality (“skill degradation”)

6. Conclusion and outlook

Many medical treatments are too complex or too time-critical to be carried out in an entirely error-free manner by users. Closed-loop systems can take on these tasks in full or in part.

The use of these closed control loops will evidently increase in the future. Machine learning will contribute to this too. It helps to develop new models of the body and take them into account in these control loops.

The requirements for the people who develop these systems are just as high as for the people who verify and validate these closed-loop systems.

Rule 22 of the MDR shows that the European legislators are only just thinking about the topic, as is the FDA. The definitions and requirements set out by the legislator for closed-loop systems need to be specified in greater detail. It is unlikely to be long before the first interpretation aids appear.

The FDA already has this in the form of a guidance document. The requirements set out there are broadly consistent with the requirements set out in IEC 60601-1-10. The FDA guidance document references IEC 60601-1-10 in several places, but manufacturers should still take both documents into account.

Thanks to Dr. MW for the valuable suggestions.

---

Change history

• 2023-10-27: Chapter 4.b) completely revised due to new FDA guidance
• 2022-03-14: Article fundamentally revised and chapters on IEC 60601-1-10 and the FDA guidance document added