Role & scope of medical isolated power in IEC 60601 systems

In a medical device, the isolated power supply is responsible for much more than converting AC to DC. It must provide patient and operator safety, support electromagnetic compatibility, and keep critical functions available around the clock.

From a safety perspective, the isolated PSU limits the fault energy and voltage that can reach users and patients. It works together with insulation barriers and leakage limits defined by IEC 60601 to ensure that hazardous mains conditions do not propagate into patient circuits. At the same time, it shapes EMI behaviour through its EMI filter and Y-capacitors and therefore sits at the centre of the trade-off between low leakage current and acceptable conducted and radiated emissions.

IEC 60601 distinguishes between Means of Patient Protection (MOPP) and Means of Operator Protection (MOOP). Patient protection is usually more stringent, particularly for BF and CF classified applied parts that touch the body or are electrically connected to the heart. Medical AC/DC supplies and downstream isolated DC/DC converters are therefore advertised with ratings such as 1×MOPP, 2×MOPP or 1×MOOP to signal their insulation strength and leakage capability. Selecting the right combination is a design decision, not only a compliance check at the end.

At system level, a typical topology starts with the AC mains and EMI filter feeding a medical-grade AC/DC stage that provides the primary isolation and leakage control. This isolated PSU then generates one or more DC domains: logic and gateway rails for control and communication, patient interface rails for ECG, SpO₂, EEG, pumps or ventilators, and supply rails for imaging high-voltage PSUs or therapy drivers. Some domains may only require MOOP, while patient interface rails must satisfy the BF or CF protection requirements.

The scope of this section is limited to the role and partitioning of the medical isolated power system. It does not attempt to reproduce IEC 60601 clauses, and it does not detail kV generators, X-ray multipliers or full EMC monitoring schemes. Imaging high-voltage PSUs and EMC or patient safety subsystems are treated as separate functional blocks that receive power and status signals from the isolated PSU.

MOPP/MOOP insulation architecture & partitioning

The insulation architecture in a medical power system converts abstract protection goals into distances, dielectric layers and test voltages. Functional, basic, supplementary and reinforced insulation describe how many independent barriers separate hazardous mains from accessible parts and how robust each barrier needs to be.

Functional insulation only ensures correct circuit operation and does not by itself guarantee safety. Basic insulation provides one layer of protection against electric shock, while supplementary insulation is added so that a single fault still leaves a working barrier. Reinforced insulation is a single insulation system that provides a similar level of protection as basic plus supplementary insulation combined. These concepts are mapped to 1×MOPP, 2×MOPP or 1×MOOP ratings and drive creepage, clearance and dielectric test levels in IEC 60601 and related standards.

Several insulation architectures are commonly used in medical PSUs. One option is a single 2×MOPP AC/DC that provides the full isolation from mains for all downstream DC/DC converters and loads. This concentrates safety responsibility in one certified block and simplifies system analysis, but the AC/DC stage may become larger and more expensive, and leakage current and fault energy must be carefully budgeted when many loads share the same supply.

A second option is to use an AC/DC stage with 1×MOPP and then add additional isolation in patient modules. Each module includes its own DC/DC converter or transformer that provides the remaining insulation to reach the required 2×MOPP for BF or CF applied parts. This approach supports modular patient interfaces and field replaceable units, but the overall insulation path must still be analysed as a chain so that the combination of AC/DC and module-level isolation satisfies the required protection under worst-case conditions.

A third architecture starts with an isolation transformer or IT-class brick to separate the system from the mains and then uses several DC/DC stages inside the system to partition BF and CF domains. In this case, the initial transformer may only meet IT or MOOP requirements, so the downstream converters must provide additional MOPP where patient circuits are involved. Multiple isolation stages and grounding points increase the importance of a clear insulation plan, including where protective earth is referenced and how leakage paths sum across supplies.

Creepage and clearance distances and dielectric test voltages link these insulation concepts to concrete layout rules. For a given mains voltage, pollution degree, material group and overvoltage category, the required distances are read from the relevant insulation tables. The results influence transformer construction, optocoupler or digital isolator selection, PCB spacing and the use of slots or barriers. Exact numerical values must follow the latest IEC insulation standards rather than approximate figures from a design note.

Board layout, slots, potting and environmental conditions can significantly change the effective creepage and clearance. A simple routed slot between primary and secondary often has more impact than a small change in copper spacing. Coatings and potting compounds can in some cases allow shorter distances, but only when the materials and processes are qualified. Pollution degree, altitude and contamination from real use must be considered up front, because they can increase the required insulating distances for a medical device beyond those of a typical IT product.

Leakage current budgeting & monitoring from the PSU side

Leakage current in a medical power system appears in several forms: earth leakage flowing from line and neutral to protective earth, touch leakage through accessible metalwork, and patient leakage through applied parts and sensor interfaces. Earth and touch leakage are strongly influenced by the EMI filter, Y-capacitors and the insulation structure inside the power supply, while patient leakage depends on how patient-facing circuits are referenced and isolated from mains and system earth.

For BF and especially CF patient circuits, acceptable leakage levels are typically in the range of tens of microamps. Exact limits must follow the latest IEC 60601 clauses, but it is essential to treat these limits as design targets from the beginning rather than pass or fail criteria at the end of a project. The required Y-capacitance for EMC and conducted emissions must be reconciled with leakage limits, and the contribution of each supply and filter to the total leakage budget needs to be estimated before hardware is frozen.

In many installations, several medical PSUs share the same outlet strip, UPS or rack, and their leakage currents add up on the protective earth conductor. A supply that operates close to the allowed limit when tested in isolation can push a system over the limit when multiple units are connected in parallel. A practical strategy is to allocate only a fraction of the allowable leakage budget to each individual PSU so that the complete system, with all devices and accessories connected, remains comfortably inside the specified limits.

Continuous leakage monitoring on the PSU side provides visibility into earth and patient leakage behaviour and enables protective actions. A common approach is to insert a small sense resistor in the protective earth path and measure the resulting millivolt-level drop with a differential amplifier or dedicated leakage monitor AFE. The amplified signal is passed through an isolated ADC or ΣΔ modulator so that a system controller can observe the leakage current without violating isolation boundaries or safety separation.

Threshold logic is then added to turn measurements into decisions. A window comparator defines normal, warning and shutdown regions. Moderate deviations can raise an alarm and prompt investigation, while large or sudden increases can trigger an immediate PSU shutdown or inhibit patient connection. The same monitoring channel can be combined with temperature or insulation fault indicators to provide richer diagnostics about insulation degradation and EMI filter behaviour over product life.

The role of this page is limited to the measurement principle, the amplification and isolation chain and the coupling to PSU power-good and shutdown signals. System-level aggregation of alarms, audible and visual indicators and multi-channel safety decisions belongs to the EMC and patient safety subsystem, which collects leakage, ground integrity and other fault information and enforces the overall alarm policy.

Medical front-end & isolated DC/DC building blocks

Medical AC/DC front ends differ from standard industrial or IT supplies in several important ways. The EMI filter must be designed for low leakage as well as low emissions, the insulation structure must meet MOPP or MOOP requirements, and supply status signals must support coordinated power sequencing and patient safety functions. These constraints shape the choice of topology, components and protection features used in the front-end design.

Low-leakage EMI filters rely more heavily on common-mode chokes, careful layout and shielding, because Y-capacitance cannot be increased freely as in many IT supplies. The number and value of Y-capacitors are constrained by earth and patient leakage limits, especially for BF and CF circuits. As a result, the front end is designed from the start with a combined EMC and leakage budget rather than treating interference and leakage as independent problems.

Inrush limiting, fusing and overvoltage or undervoltage detection also require special attention in medical applications. The input stage must handle repeated connection to hospital outlets, UPS systems and generators without nuisance fuse operation, while still providing clear fault protection. NTC thermistors offer a simple inrush limit but lose resistance once heated during continuous operation. Active inrush control based on MOSFETs and resistors adds complexity but provides predictable limiting and lower losses, which is often preferable for equipment that must run 24/7 in critical care environments.

On the isolated side, medical-grade DC/DC converters and point-of-load supplies extend the insulation and leakage performance down to individual rails. These converters are typically rated for specific MOPP or MOOP levels, isolation voltages and maximum leakage currents. Patient-facing modules such as ECG, SpO₂, EEG or infusion pump boards often rely on dedicated DC/DC converters with 2×MOPP or equivalent protection, while logic and gateway rails may only require MOOP insulation when no patient connections are present.

Multiple outputs from a single DC/DC converter can reduce component count and cost but share a common insulation barrier and leakage budget. Using several smaller converters, or separate secondaries in a transformer-based design, makes it easier to partition BF and CF groups and to limit fault propagation between patient channels and system logic. Each rail can then be assigned a clear insulation level, leakage allocation and overcurrent or overvoltage protection strategy that matches its role in the overall medical system.

A complete medical isolated power system therefore combines a front-end AC/DC stage with medical insulation and low-leakage EMI filtering and a tree of isolated DC/DC converters feeding logic, communication, patient interface and therapy domains. The way these stages are combined determines the insulation path from mains to each rail and the distribution of the leakage budget across all parts of the design.

Secondary-side segmentation with eFuse & hot-swap controllers

On the secondary side of a medical isolated power system, eFuse and hot-swap controllers divide a shared DC bus into protected branches. Each branch is limited in the energy it can deliver during a fault so that cable harnesses, connectors and PCB traces remain within safe temperature limits and do not char or ignite under short-circuit or overload conditions. Segmentation also prevents a fault on one branch from collapsing other rails that support safety-critical monitoring or control functions.

A typical architecture starts with a 12 V or 24 V isolated output from the medical AC/DC or DC/DC stage. This bus is then split into multiple rails, each passing through an eFuse or hot-swap controller and its associated MOSFET and current sense element. Logic rails, gateway rails, patient module rails and therapy rails can each receive a dedicated protected path. Patient-facing rails may include two stages of protection, for example a board-level eFuse inside the main chassis and a second device or fuse near the patient module connector or cable entry.

Common functions in medical eFuse and hot-swap controllers include controlled soft-start, programmable current limit and foldback behaviour, protection against exceeding the MOSFET safe operating area and reverse-current or backfeed blocking. Auto-retry counters or programmable latch-off behaviour determine how often a branch may attempt to restart after a fault. For patient rails, strict current limits and latched shutdown after a fault help to avoid repeated heating of connectors and give clinical staff a clear indication that service is required before reconnecting a patient module.

eFuse and hot-swap devices also provide status and control signals. Fault flags, power-good indicators and enable inputs allow the system controller or a dedicated safety sequencer to coordinate the behaviour of all secondary rails. When an overcurrent, undervoltage or thermal event is detected on one branch, the corresponding flags can be used to update the global power-good status, inhibit downstream enables and, if required, force a controlled shutdown of related rails to keep patient and operator risk as low as possible.

The goal of secondary-side segmentation is to map each functional block of the medical system to a clearly defined power branch with tailored limits, retry policies and monitoring. Logic and communication rails can prioritise continuity and graceful degradation, while patient and therapy rails emphasise fault energy limitation, clear isolation boundaries and fast removal of power whenever abnormal behaviour is detected.

Power-good, sequencing & safety interlocks for medical rails

In a medical system with multiple isolated power rails, the order in which rails turn on and off is as important as their steady-state values. A controlled sequence ensures that safety and monitoring functions are available before patient circuits or therapy power are enabled and that data logging and alarms remain active long enough to support safe shutdown. Power-good signals and safety interlocks tie these behaviours together and provide a clear indication of when it is acceptable to connect a patient or deliver therapy.

A typical startup sequence begins with the rails that supply the system management MCU or safety controller. Once this controller is running, rails that power leakage monitors, ground integrity monitors and other safety sensors are enabled. Only after control and monitoring channels are stable does the system bring up patient interface rails and therapy rails. Gateway and external interface rails often start last, because their timing has less impact on patient risk and can follow internal safety-critical domains.

During shutdown or in fault conditions, the sequence is reversed. Patient and therapy rails are removed quickly by disabling their DC/DC converters and eFuses, while logic and communication rails remain powered long enough to record events, stop motors or pumps in a controlled way and close high-voltage modules. This approach reduces the risk of partial operation where protective functions are unavailable but actuators or high-energy circuits remain active.

Power-good information comes from many parts of the medical power system. AC/DC stages export mains present and bulk voltage status. Isolated DC/DC converters assert PG pins when outputs are within tolerance. eFuse and hot-swap controllers contribute fault and channel-good signals. Leakage and ground monitors, temperature sensors, fan monitors and other health indicators add further inputs. These signals can be combined using hardware logic gates or evaluated by a safety-qualified MCU to generate system-level flags such as system OK, OK to connect patient and OK to deliver therapy.

In practice, sequencing and interlock implementation relies on a mix of devices: voltage supervisors and reset ICs for individual rails, window comparators for analog rails and sensor thresholds, digital isolators to move PG and fault signals across insulation barriers, dedicated power sequencers for timing and dependency control and PMBus or similar controllers to configure and monitor intelligent power modules. Together, these blocks enforce the timing rules and safety interlocks defined by the medical system architecture and ensure that patient connection and therapy delivery are always tied to valid power and monitoring conditions.

Application mini-stories: how isolated power looks in real devices

Real medical systems combine medical AC/DC supplies, isolated DC/DC converters, protection and monitoring ICs in ways that depend strongly on the application. A multi-parameter monitor, an infusion pump or ventilator and an imaging cart each reuse the same building blocks but arrange isolation levels, leakage budgets and sequencing rules according to patient risk and operating mode. Short application stories help to translate the abstract power architecture into recognizable product-level structures.

A typical bedside multi-parameter monitor starts from a single 2×MOPP medical AC/DC module such as the RACM100-MA or GCS180-M, which delivers a 12 V or 24 V bus with low leakage current. This bus feeds several isolated DC/DC converters, for example REM6-0505S or MEJ2D0505SC modules, that create BF or CF-rated rails for ECG, SpO₂, NIBP and temperature modules, while MOOP-level converters feed logic, gateway and display rails. Each patient module rail passes through an eFuse or hot-swap device such as TPS25982 or LTC4215 to provide soft-start, current limiting and fault flags. When a patient module is unplugged or shorted, the corresponding eFuse limits surge current, isolates the fault and reports status without collapsing the core logic and safety rails.

Infusion pumps and ventilators often operate from both AC mains and a battery pack. A medical AC/DC unit such as RACM60-K forms the primary 2×MOPP source, while a charger and fuel-gauge combination, for example bq24610 with a bq40z50, manages the battery. Ideal diode or OR-ing controllers like LTC4412 or LTC4359 steer power from AC or battery into an isolated DC/DC tree that supplies motor rails, patient sensor rails and alarm rails. Motor drivers such as DRV8880-class ICs draw from separate rails that can be shut down quickly, while sensor and safety rails remain powered through eFuse-protected branches so that leakage monitors, flow sensors and alarms stay active during supply faults and during transitions between AC and battery operation.

In an imaging cart or ultrasound system, several independent PSUs frequently share the same power strip and protective earth. A main AC inlet and medical AC/DC supply power the host compute and core logic, while additional medical AC/DC or DC/DC modules supply probe interfaces, displays and network modules. Each supply contributes some earth leakage, so star-point grounding and leakage-current monitoring with isolation amplifiers such as AMC1301 or AD7403-based solutions are used to control the total leakage and keep patient paths referenced cleanly. Digital isolators like ISO7842 or ADuM242E carry control, data and power-good signals between the host, probe modules and gateway, allowing multiple PSUs to act as a coordinated medical system without over-stressing leakage limits.

Design checklist & IC role mapping for medical isolated PSUs

A structured checklist helps to turn high-level safety and performance requirements into a consistent medical isolated power design. Each step links directly to IC categories and example devices that can implement the required functions. The goal is to ensure that isolation levels, leakage budgets, power sequencing and monitoring coverage are all defined explicitly before layout and hardware freeze.

The first step is to classify the equipment: BF, CF or B type applied parts, continuous or intermittent operation and supply methods such as AC-only, AC plus battery or multiple PSUs in a rack or cart. Next, all power rails are listed with their voltages, currents and whether they directly or indirectly touch the patient. Rails that serve patient interfaces and therapy channels are marked for higher insulation and stricter protection, while logic, gateway and display rails are typically assigned MOOP-level requirements.

A leakage current budget is then created by starting from IEC 60601 limits and reserving extra margin for multi-PSU systems. The budget is allocated across the medical AC/DC front end, isolated DC/DC converters, cabling and enclosure coupling. In parallel, a MOPP/MOOP insulation architecture is selected, including creepage and clearance targets, pollution degree assumptions and the use of slots, encapsulation or barriers. This architecture drives choices such as whether to adopt a single 2×MOPP AC/DC plus isolated DC/DC modules for patient rails or to use multiple medical AC/DC units for different parts of the system.

Once insulation and leakage goals are set, suitable AC/DC modules, DC/DC converters, eFuse and hot-swap controllers, leakage current monitors, voltage supervisors, sequencers and digital isolators are selected. Power-good and sequencing rules are defined so that safety and monitoring rails rise before patient and therapy rails and remain active long enough during shutdown to capture fault information and control actuators. The checklist concludes with a validation plan that covers dielectric strength testing, leakage measurements, environmental and aging tests and full system safety verification against the intended IEC 60601 clauses.

IC role mapping connects each design step to concrete device types. Medical AC/DC modules such as RACM100-MA, GCS250-M or VMS-100A provide the primary 2×MOPP isolated power, while medical DC/DC modules like REM6-0505S or MEJ2D0505SC extend isolation to patient modules and signal-conditioning boards. eFuse and hot-swap controllers including TPS25940, TPS25982, LTC4368 or MAX17613 segment secondary rails and enforce fault energy limits. Leakage-current monitors based on isolation amplifiers such as AMC1300, AMC3301, Si8920 or sigma-delta modulators like AD7403 translate microamp-level currents in the protective earth path into digital readings for safety MCUs.

Digital isolators such as ISO7842, ISO7762, ADuM242E or Si8642 carry PG, fault and control signals across patient and system domains. Supervisors, sequencers and PMBus controllers, for example TPS386000, LM3881, LTC2937, LTC2977, UCD9090 or UCD90160, supervise multiple rails, enforce startup dependencies and allow configuration and telemetry of intelligent power modules. Together, these devices form a repeatable toolkit that can be reused across many medical products with different power levels and mechanical form factors while still meeting patient safety and EMC requirements.

Recommended topics you might also need

• EMC / Patient Safety Subsystem
• Security & Compliance
• Patient Monitor (Multi-Parameter)
• Ventilator / Anesthesia
• Imaging High-Voltage PSU
• Electrosurgery (ESU)

FAQs about medical isolated power design