accelerated tests to estimate the service life of active implantable medical devices ..... into three phases: highly accelerated life testing (HALT), design validation ...
Paper No.
09464
2009
ACCELERATED TESTING OF ACTIVE IMPLANTABLE MEDICAL DEVICES Eric Guyer PhD PE Lawrence Eiselstein, PhD PE Paul Verghese PhD Exponent Failure Analysis Associates 149 Commonwealth Drive Menlo Park, CA 94025
ABSTRACT Although the intention of most in vitro accelerated tests performed on implantable medical devices is to exacerbate particular failure modes and evaluate the reliability of a device rapidly, these tests often do not yield the same type of failures, if any failures occur at all, as observed in service (i.e., in vivo). Unfortunately, a definitive correlation between in vitro accelerated life testing and in vivo experience can occur only after a device has been implanted in a human. Therefore, developing an appropriate suite of accelerated tests to estimate the service life of active implantable medical devices in vivo requires careful evaluation of the mechanical, environmental, and electrical conditions under which the devices typically operate. In this presentation, we discuss some of the considerations that must be taken into account, including the use of “abuse” tests intended to identify potential in vivo failure modes before accelerated tests are designed.
Copyright ©2009 by NACE International. Requests for permission to publish this manuscript in any form, in part or in whole must be in writing to NACE International, Copyright Division, 1440 South creek Drive, Houston, Texas 777084. The material presented and the views expressed in this paper are solely those of the author(s) and are not necessarily endorsed by the Association. Printed in the U.S.A.
1
INTRODUCTION Accelerated life testing is the process by which a product is forced to fail more quickly than it would have under normal use conditions. Forcing the product to fail more quickly reduces test time required to determine device life when in service. This is of critical importance in designing an active implantable medical device (AIMD) since these devices are expected to operate trouble free in a corrosive aqueous environment in some cases, for over thirty years.
The corrosivity of the in vivo environment is
primarily affected by the dissolved oxygen and salt content of the body, i.e. an oxygenated, 0.9 wt% NaCl solution. Obviously, testing with an acceleration factor of 50 or higher is desired. Operating electronics in salt laden environments has always been challenging. However, many currently available accelerated test methods do not accurately predict the extended lifetime exposure conditions devices really see. Conceptually, accelerated life testing is a wonderful idea, but there are many concerns and issues with its successful implementation. The intent of this presentation is to provide an overview of the various challenges associated with accelerated life testing of AIMDs and strategies on how to address those challenges. An implantable medical device (AIMD) is any medical device that relies on any source of power (e.g. electrical) other than that generated by the human body or gravity to perform its’ function. A device that merely transmits heat, light, pressure or vibration into the body is not automatically considered active [1]. Examples of devices that are both AIMDs and non AIMDs are given in FIGURE1. Examples of AIMDs include: pacemakers, implantable defibrillators, auditory brainstem implants, neuro-stimulators for nerves, diaphragm and bladder, cochlear devices, implantable active drug administration, artificial retinal implants, etc.
2
FIGURE1
Examples of medical devices some of which are active (cochlear implant) and some of which are not (MRI and stent).
RISKS ASSOCIATED WITH AIMDs The failure rates associated with AIMDs are currently around 1% but the goal is less than 0.1% over the life of the device [2]. The benefits associated with AIMDs abound, however, there are also a number of risks and challenges associated with the devices including: •
Difficult to confirm device output in-vivo
•
Challenging to perform maintenance without surgery
•
In-vivo failure mechanisms might not be identified through in-vitro accelerated life testing o New devices, materials and designs can elicit new failure modes. For instance, new advanced designs require the use of conformal coatings such as parylene or polyimide and inorganic films such as silica or silicon nitride to replace the hermetically sealed metal cans previously used, which separate the electronics from the in-vivo environment. These thin coatings must not leach toxic elements or compounds into the body and prevent the saline environment from affecting the electrical performance over decades of service life. For instance, as an example of where there are unanticipated differences between in vivo and in vitro testing, test data indicates silica coatings are more rapidly dissolved in vivo than in vitro in 0.9 wt% saline compared with material that had been implanted in an animal [3].
3
o In-vivo loads (mechanical) and chemistry are generally poorly characterized and little relevant or pertinent data can be found in the technical literature that can be used in designing accelerated life tests. •
Pre-clinical animal testing does not always yield same results as clinical trial in humans
•
Clinical trials for medical devices are quite small compared to drug trials and therefore do not help find infrequent failure modes. In addition, clinical trials are not accelerated life tests and only characterized the failure rate over a year or so, and therefore will not pick up failures that are a result of wear type failure mechanisms such as corrosion-fatigue.
In-vitro accelerated testing attempts to address some of these concerns. These risks place more pressure on device manufacturers to perform adequate reliability testing and product design. Design choices can mitigate some of the issues associated with maintenance and calibration; however, understanding unknown in-vivo failure mechanisms will always be difficult and the only way to attempt to gain) this understanding is through the appropriate choice of accelerated tests. The problem with accelerated testing is that one can never be certain if test conditions are adequately representing service conditions in the body. We note the following quote from Nelson [4], “Few accelerated tests simulate actual use…engineers have always had to make this leap of faith from test to field performance” Indeed, challenges with designing, gathering and interpreting results from accelerated tests are plentiful, however it is a necessary and useful process that can be successful with proper care and must not be overlooked or omitted because of these challenges. Generally, the goals of accelerated testing are to: •
Ensure a device functions with the required reliability as designed for it’s expected life
•
Assure that design changes improve reliability
•
Screen device material alloy types and processing conditions to weed out those that are likely to fail during short term in-vivo human exposure
4
Accelerated life testing requirements include: •
Possible failure mechanisms (modes) must be known
•
The degree to which the test is accelerated must be known through testing or specific, well accepted, acceleration models must be available
•
The life acceleration variables must be limited to preclude failures that may not be seen in service
•
Results must be interpreted properly
Examples of Medical Device Failures that Might have been Prevented by Appropriate Accelerated Life Testing In Henry Petroski’s book on engineering failures he states “ … the concept of failure – mechanical and structural failure … is central to understanding engineering, for engineering design has as its first and foremost objective the obviation of failure. …the lessons learned from…disasters can do more to advance engineering knowledge than all the successful machines and structures in the world [5].” The medical device industry has historically provided a rich field of study, as approximately 163,800 reports of death, serious injury, or device malfunction were reported to the FDA from 1994 through 1997 [6]. With well over 100,000 medical devices in over 1,700 separate categories (FDA 1997), more “lessons” are bound to occur [7]. Medical device failures, like failures of any engineered structure, generally fall into one of three categories: 1) design defect; 2) manufacturing defect; or 3) misuse or abuse. However, sometimes a combination of factors in each of the above categories is necessary to cause a failure. Two examples of medical device failure that might have been prevented by appropriate accelerated life testing are: 1. Swelling of silicone ball in heart valve
5
2. Environmental stress cracking (ESC) of polyurethane In the first example, Dr. Charles Hufnagel came up with the idea of mechanical heart valve based on a caged ball [8]. He used a Plexiglas cage containing a ball occluder and implanted it in the descending thoracic aorta in a patient in September 1952 [9]. The first implant of a mitral valve in its natural position took place in 1960 when the Starr-Edwards valve was put to clinical use. This valve used a stainless steel cage (later changed to Haynes Stellite 21, an ASTM F75Co-Cr-Mo alloy) that contained a silicon ball. Accelerated life testing included fatigue testing at 100 Hz (an acceleration factor of about 110 time actual if loading frequency were the only factor to consider) to simulate 43 years of life. Problems developed with the Starr-Edwards valve (and the similar design SmeloffCutter valve) that involved swelling, cracking and wear of the ball, which caused some ball related deaths [10-12]. This was sometimes termed “ball variance” and was found only in the first generation of valves used until 1965. Almost all cases were discovered within the first 8 years of implant; however, some late reports of ball variance have shown that severe variance can exist up to 20 years after implantation. This variance problem resulted in the valve being withdrawn from the market until the problem was fixed. This failure mode was a result of diffusion of body fluids, especially lipids, into the material. Modifying the processing of the silicone rubber to improve its post curing characteristics solved the problem. If the accelerated life testing had been done in a test solution containing lipids and run for a sufficient period of time, it is possible this failure mode would have been detected and, through design changes, avoided. The second example involves the use of polyether polyurethane (PU) for pacemaker leads. PU was first used as insulation in pacemaker leads in 1977. Prior to 1977 silicone had been used but silicone was weaker which required thicker walls to prevent tearing during insertion. In addition, silicone had much higher coefficient of friction than PU. These two factors made it difficult to place two leads in one vein as was sometimes
6
required. PU with its higher strength and lower coefficient of friction made such placements much easier. After two years evaluation in rats, PU (Pellethane) insulated pacing leads were placed on the market in 1980. In 1981 lead failures were observed. Ultimately three failure modes were identified from the in vivo exposures in patients [13]. The first mode was environmental stress cracking (ESC) see Figure 2. ESC had been found as early as 5-months exposure in-vivo. This failure mode had not been found during in vitro accelerated life testing and could not be duplicated in vitro, but was duplicated in animal testing. It turned out that this cracking required both a critical residual strain in the insulation and a mammalian environment. It is interesting to note that this form of cracking could not be accelerated by temperature as the residual strains in the insulation would relax at high temperatures and not allow enough time above the critical strain. An ALT was ultimately found that placed highly strained leads subcutis in rabbits [13]. By early 1983 a second failure mode was discovered. This failure mode was an autooxidative degradation of the PU and not ESC. In this case the cracks were found to originate on the inner surface of the insulation. This failure mode also had not been found during pre-market in vitro HALT or ALT testing. The failure was discovered to have been a result of the foreign body response that releases hydrogen peroxide related compounds and hydroxyl radical and super oxide anion radical near the lead. The oxygen free radicals could not penetrate the insulation due to their high reactivity, however it was found that the hydrogen peroxide would permeate even faster than water through the insulation. The interaction of the hydrogen peroxide with the silver/MP35N composite wire used for the conductor of the lead would catalyze the auto-oxidative degradation of the polyether portion of the insulation inner surface. This failure mode was called metal ion oxidation and converted (after the fact) into an ALT in which the test solution contained 3% hydrogen peroxide The third failure mode was found to be associated with stresses imposed on the lead as a result of the method used for lead placement, for instance all of these lead failures were associated with leads inserted between the first rib and clavicle prior to vein entry,
7
i.e. the subclavian stick method. No leads implanted via the cephalic vein route experienced this failure mode. This failure mode was not discovered in the pre-clinical animal studies since, canines have no clavicles. If the biomechanics of lead flexing in humans with leads implanted via the subclavian stick method had been considered, appropriate accelerated in vitro fatigue life testing may have discovered this failure mode. .
FIGURE 2: Shallow cracks in surface of explanted polyurethane lead. The cracking severity is higher on the left-hand side from ligature stress [13]. Image reproduced with permission of K. Stokes.
EXAMPLE OF DISCREPANCY BETWEEN IN-VIVO AND IN-VITRO CONDITIONS FOR AIMDS The biostability of a micro-photodiode array for subretinal implantation was investigated in both phosphate buffered saline (PBS) and in-vivo by Hämmerle et al. [14]. An SiO2 layer, approximately 500nm thick, was deposited on an IC to protect it from in-vivo corrosion. The silica layer was deposited via low pressure chemical vapor deposition (LPCVD) using tetra-ethyl-ortho-silicate (TEOS) as the silica source. . This study found
8
that the SiO2 passivation on integrated circuits (IC) completely dissolved in-vivo within approximately 6-12 months whereas the same passivation layers exhibited little damage in PBS for up to 21 months. This corresponds ton an approximate dissolution rate of 1000 to 500nm/year (0.5to1.0 μm/year).After the passivation was degraded, corrosion of the underlying IC was noted. Both rabbit and mini-pig animal models were used for the study and no significant differences were noted between the animals with respect to corrosion of the IC.
The specific mechanism responsible for this degradation was not investigated fully but likely has to do with either to the immunological response or other biological activity. It is noted that during the immunological response, phagocytes create a highly corrosive and oxidative environment with low pH levels and hydrogen peroxide (H2O2) and oxygen free radicals, such as super oxide anion (•–O2) and hydroxyl radical (•OH) [15]. Generally SiO2 dissolution rates are very low in acidic environments and thus it is unlikely that pH contributes to this marked difference in behavior between PBS and the body. It is possible that radicals influence dissolution; however, this has not been studied systematically in the literature to the best of our knowledge. The exact mechanism remains unclear but this example illustrates the marked difference in behavior between in-vitro and in-vivo conditions. This suggests that either an appropriate in-vitro test must be developed or that animal testing be carried out long enough to accurately determine in-vivo dissolution rates over the expected life of the implant..
TYPES OF RELIABILITY TESTING There are many types of reliability testing done to assure that a product has the specified reliability over the life of the product. Broadly, reliability testing is broken up into three phases: highly accelerated life testing (HALT), design validation testing (DVT) and highly accelerated stress screen (HASS).
9
The first phase is generally some sort of abusive testing is done during the early design stage in order to quickly identify design weaknesses and perform corrective re-design. This testing is generally called highly accelerated life testing (HALT). HALT testing generally uses stresses (stresses in the broadest sense) much beyond what is expected in service in order to force failures. Failure modes and effects analysis (FMEA) are sometimes done prior to HALT testing to help identify and select the appropriate stressors and their magnitudes to be used in HALT testing. Once failures have been initiated the designer can decide if the product should be redesigned to avoid the failure observed. If the stresses to induce failure are significantly higher than service induced stresses the designer may decide that the design does not need to be modified. HALT testing is performed until a reasonably robust design is achieved. After the initial HALT testing and necessary redesign is completed, the designer switches to design verification testing (DVT). This is sometimes also called verification and validation (V&V) testing. The purpose of DVT testing is to confirm that the device design meets product specification and the reliability goal over the life of the product. Typically DVT is composed of additional HALT testing and accelerated life testing (ALT). The additional HALT testing is used to determine the acceleration factor to be used in the ALTs. The HASS (and highly accelerated stress audit HASA) tests are preformed after the device is being manufactured and are used for manufacturing quality assurance. This report focus on the DVT testing (ALT and associated HALT testing) since this is critical in getting a medical device right the first time.
ABUSE TESTING (HALT): DETERMINING POSSIBLE FAILURE MODES Highly accelerated life tests (HALT) or abuse tests are typically employed in two stages:
Initial HALT testing to:
10
Develop robust product ready for accelerated life testing
Subject device to high stresses to indentify weaknesses quickly
Once weaknesses are identified, produce is redesigned (iterative process)
Final HALT testing to:
Estimate in-vivo stresses/scenarios
Provides guidance for appropriate stresses (maximum allowable) for accelerated tests
Should be performed on mature design
Typically the best use of HALT tests is in the two stage fashion, as described above, where in the first stage, HALT testing is used to identify weaknesses and then redesign the device accordingly in an iterative process. In the second stage HALT tests then help identify relevant testing stresses, stress levels and testing scenarios that are reflective of service conditions. There are a number of stress variables that can be used for HALT testing. More often than not, devices are subjected to high temperatures in saline. This is definitely useful in some situations, however, for AIMDs typically testing should be more rigorous and the interplay between mechanical, electrical and chemical stresses should be evaluated. We now discuss and provide examples for the various types of tests that should be considered.
Test Variables Reliability testing of active devices involves controlling the thermal, mechanical, chemical, and electrical conditions of the test. The conditions are generally applied in two ways: steady state and cycled. The magnitude of the stresses applied is increased compared to the expected service conditions, and the frequency and/or duty cycle of application can also be increased. From the standpoint of evaluating the survival characteristics of the device under test, the severity of testing is controlled by the stress magnitude and the rate of application.
11
Temperature is used to accelerate thermally activated processes, such as diffusion and chemical reactions, and to create internal mechanical stresses. Temperature gradients can be used to generate internal stresses due to non-zero coefficients of thermal expansion of the device materials. In addition, active devices contain many materials with dissimilar thermal expansion coefficients allowing internal stresses to be altered by changes in temperature. Even though the end use environment of implanted devices will obviously be isothermal in vivo conditions, testing in aggressive thermal environments serves to (1) exacerbate the effects of thermomechanical stresses (for example, cracking and interfacial debonding) that can arise during product shipping and storage, and (2) accelerate corrosion rates due to increased thermal energy from imposed higher temperatures. Examples of tests where temperature is used as a stress to evaluate reliability are aging in elevated temperature saline to evaluate corrosion resistance in a commonly used in vitro chemistry, and temperature cycling to assess reliability against cracking and debonding of packaging materials (corrosion protection layers, electrical feedthroughs, and hermetic seals, for instance). Mechanical stress is used to probe resistance to device failures due to deformation or cracking. Mechanical stresses are imposed statically (or quasi-statically), such as in lead pull tests, or dynamically, such as in vibration, mechanical shock, and fatigue tests. Manipulation of the chemical environment serves to elevate the potential for chemical attack of the device under test as compared to service conditions. Of primary concern for active implantable devices are electrochemical processes that degrade device life, for example, dissolution of passivation layers and development of current leakage pathways due to electrochemical migration. A simple example of a specific elevated chemical stress is increased humidity. However, for implanted devices greater complexity is needed to evaluate device reliability due to in vivo chemistries. Commonly used methods include in vitro testing in phosphate buffered saline and long-term animal studies, however neither of these elevates the severity of the chemical environment to be experienced by the device in service. The complex biochemistry of the human body’s response to foreign objects limits our ability to recreate in vivo chemistry on the
12
lab bench. However, from the standpoint of survivability of the implanted device, this complexity can be somewhat reduced by developing bench top chemistries that result in the same failure mechanisms as those observed in long-term in vivo testing of the device. Electrical stresses can be used to exaggerate degradation mechanisms in energized devices. This includes failures in the circuit, for example capacitor dielectric breakdown, transistor failures, or electromigration in metal lines, as well as failures at input/output ports, such as current leakage between adjacent pins due to electrochemical migration or corrosion of lead electrodes due to charge imbalance. From an analysis standpoint, elevating one stress at a time may be desirable, but at a cost of ignoring synergistic effects. For this reason, stresses are often combined, such as temperature-humidity-bias testing where thermal, chemical, and electrical stresses are juxtaposed.
Accelerated Life Testing Following abuse testing, the second category of testing is accelerated life testing. In contrast to abuse tests, where the goal is to impose sufficiently elevated stresses to rapidly force failure, accelerated life tests attempt to impose more realistic stresses on a product in an accelerated manner that will allow a manufacturer to estimate the expected service life of a product. Design and interpretation of these tests are much more difficult than the first category since the short-term accelerated life testing results will be extrapolated to full service life. A typical example of accelerated life testing is mechanical fatigue testing that is conducted at the same mechanical loads that are expected in service, but at significantly higher loading frequencies in order to achieve failure in a shorter period of time. This may be generalized as an accelerated test where the rate at which the stress is applied is increased while the stress levels are maintained at normal usage levels. In another approach, the loading frequency may be maintained at normal usage
13
conditions, but larger magnitude loads may be imposed. Here, the stress level is increased while the application rate is maintained at normal usage levels. In either case, if failures are observed and if the failure mechanisms are the same as those observed (or expected) under normal usage conditions, than accelerated life data may be used to extrapolate normal usage lifetimes. Unfortunately, a definitive correlation between in vitro accelerated life testing and in vivo experience can only occur after a device has been implanted in a human. Bench top accelerated test conditions that can simulate the physiological environment resulting from device implantation and long-term residency in vivo are not well established. A complete representation of the in vivo conditions experienced by the implanted device would necessarily include the thermal, mechanical, chemical, and electrical environments. Accelerated life test conditions should be guided by the specific failure mechanisms that were elicited from the abuse tests. Abuse tests that did not result in device failures are not expected to represent conditions under which device failure would occur in service. The prior section discussed abusive testing to force various failure modes. These tests are also necessary in order to determine what “stressing” variables can be reduced in order to establish the acceleration factor for doing accelerated life tests, i.e. in order to perform accelerated life tests, the end point needs to be a well-defined failure mode in a finite period of time. The results of abuse testing should allow one to find a combination of extreme environmental conditions that may elicit such a failure mode. Once these conditions are achieved, accelerated life testing will reduce these stresses in several increments, which should increase failure times. This information can then be extrapolated to full service life using an appropriate acceleration model. There are a number of models that may be employed and the choice of model depends on the failure mechanism. For example, for a failure mechanism owing to some sort of kinetic process such as a chemical reaction, diffusion, or corrosion, an Arrhenius or Eyring model should be chosen. If the failure mechanism is due to fatigue, a model like
14
the modified Coffin-Manson model, an S/N curve, or a Goodman diagram should be used. A summary of some of the various models available is provided here:
Arrhenius model
Predicts failure acceleration due to temperature increase
Used successfully for failure mechanisms that depend on chemical reactions, diffusion or corrosion processes
Eyring model
Can be used to model acceleration when many stresses are involved
Also used successfully for failure mechanisms that depend on chemical reactions, diffusion or corrosion processes
Can be used to model degradation data as well as failure data
Modified Coffin-Manson (Norris-Landzberg) model
Model for thermal fatigue failure
Relates acceleration factor to stress amplitude (thermally or mechanically induced) and frequency of cycles
S/N and Goodman diagram
High cycle fatigue analysis
Acceleration primarily through increasing loading frequency
CONCLUSIONS
Numerous benefits and risks are associated with AIMDs
It is important to understand the various modes of degradation that can occur over a long-time in vivo
15
Accelerated life testing is critical for assessing reliability
Abuse or HAST testing is required to:
Identification potential failure modes
Identify the ranges of stresses that can be used in ALTs
Accelerated life testing
Quantitative determination of device life
Test selection depends on failure modes
Should be coupled with animal testing and possibly cell culture testing, possibly in a stressed condition (e.g. mechanical or electrical stress)
All ALT should be followed by clinical trials but these trials are unlikely to identify any long-term or low probability failure modes.
REFERENCES 1. EU Active Implantable Medical Devices Directive, 90/385/EEC 2. “Medical Device Reliability”, NIST, Materials Science and Engineering Laboratory, http://www.boulder.nist.gov/div853/MRD_Groups/MRD_Projects/NIST_MSEL_Medical_ Device_Reliability.pdf 2008 3. Rojahn, M., Encapsulation of a retina implant, in Electrical Engineering and Information Technology. 2003, University of Stuttgart: Stuttgart, Germany. 4. Nelson, W., Accelerated Testing: Statistical Models, Test Plans and Data Analysis. 1990: John Wiley & Sons, New York.
16
5. Petroski, Henry, To Engineer Is Human, Vintage Books of Random House, Inc., New York, 1992 6. GAO, Medical Devices: FDA Can Improve Oversight of Tracking and Recall Systems. 1998, General Accounting Office: Washington, D.C. 7. Eiselstein, L.E. and B. James. Medical Device Failures - Can We Learn from Our Mistakes? In Proceedings from the Materials and Processes for Medical Devices Conference, August 25-27, 2004. 2004. St. Paul, Minnesota: ASM International. 8. Nair, K., C.V. Muraleedharan, and G.S. Bhuvaneshwar, Developments in mechanical heart valve prosthesis. Sadhana, 2003. 28(Parts 3&4): p. 575-587 9. Matthews, A.M., The Development of Starr-Edwards Heart Valve. Texas Heart Institute Journal, 1998. 25: p. 282-293 10. McMillin, C.R., Mechanical Breakdown in the Biological Environment, in Biomaterials Science: An Introduction to Materials in Medicine, B.D. Ratner, et al., Editors. 1996, Academic Press: San Diego, CA. 11. Mazzucco, A., et al., Ball fracture with the 6120-model Starr-Edwards mitral valve prosthesis occurring late after implantation. J Heart Valve Dis, 1993. 2(2): p. 245-7. 12. Grunkemeier, G.L. and A. Starr, Late ball variance with the Model 1000 StarrEdwards aortic valve prosthesis. Risk analysis and strategy of operative management. J Thorac Cardiovasc Surg, 1986. 91(6): p. 918-23. 13. Stokes, K., Polyurethane pacemaker leads, in Clinical evaluation of medical devices: principles and case studies, K.M. Becker and J.J. Whyte, Editors. 1998, Humana Press Inc: Totowa, NJ.
17
14. Hammerle, H., et al., Biostability of micro-photodiode arrays for subretinal implantation, Biomaterials, 23, p. 797-804, 2002. 15. Anderson, J. A. 1988. Inflammatory responses to implants. ASAIO. 34:101–107.
18
