Diathermy & Physiotherapy HF Field Drives and Protection
← Back to: Medical Electronics
Diathermy/physiotherapy HF heating systems are engineered around one core goal: deliver a controllable HF field through a matching network while continuously watching power/field proxies and multi-point temperatures, so the device can derate or shut down before mismatch, over-current, or over-heat becomes unsafe. A reliable design separates fast hardware cutoffs from supervisory control rules (CW/pulsed, duty and cooldown windows) to keep output repeatable across coupling drift and accessory aging.
Applicator + matching network
The applicator and matching network decide whether HF energy couples efficiently into the target region and whether load drift turns into safe, bounded stress on the power stage. The design goal is to translate patient-side variability into an equivalent load window that the inverter can tolerate, while exposing clear “mismatch proxies” for protection.
Applicator categories (engineering-only)
- Electrodes (capacitive coupling): contact area and pressure shift the effective impedance quickly.
- Coils (inductive coupling): distance, orientation, and nearby metal shift inductance/Q and detune resonance.
- Antenna heads (directional coupling): poor coupling increases reflected/mismatch proxy and hotspot risk.
Matching network purpose
- Normal operation: maximize repeatability by stabilizing the apparent load seen by the inverter.
- Fault containment: limit voltage/current stress during mismatch so protection can act deterministically.
| Drift / fault trigger | What changes electrically | Useful monitored proxy | Risk if unmanaged |
|---|---|---|---|
| Posture / distance change | resonant detune, Q shift | tank V rise or tank I rise | stress spikes, unstable delivery |
| Contact pressure variation | effective load impedance drift | mismatch proxy rise | power overshoot / undershoot |
| Cable bend / aging | loss increase, impedance drift | mismatch proxy rise | heating inconsistency, extra dissipation |
| Open / short / metal proximity | extreme mismatch, abnormal current/voltage | coil current spike / tank V rise | rapid overstress → mandatory cutoff |
Field / power sensing chain
The sensing chain determines whether closed-loop power control is possible and whether protective shutdown is reliable. A practical approach measures at three layers: input energy (bus V/I), inverter stress (bridge or resonant current/voltage), and a load-side mismatch proxy that warns when coupling is drifting toward unsafe conditions.
What can be measured (layered)
- Supply layer: bus voltage and current for input power proxy and power ceiling limits.
- Inverter layer: bridge current or resonant current/voltage for overstress detection and drift tracking.
- Load layer: mismatch/reflected proxy to detect poor coupling before stress spikes appear.
AFE design keywords (only what matters here)
- Dynamic range: cover normal signals and fault spikes without saturating.
- Bandwidth: capture fast mismatch events and current spikes that require immediate action.
- Rectify / detect: convert HF quantities into stable control-friendly proxies.
- Time alignment: synchronized sampling improves drift diagnosis and threshold confidence.
Fast hardware cutoff is mandatory
Over-current, over-voltage, over-temperature, or extreme mismatch must trigger a dedicated hardware cutoff path (comparator/logic → gate disable), independent of the main control loop.
Thermal sensing & thermal loop
Temperature monitoring must be managed as three separate control/decision loops: the patient contact region, the applicator/cable assembly, and the power-stage thermal mass. Relying on a single temperature point can miss hot spots or trigger false shutdowns. A more robust strategy uses multi-point limits and rate-of-rise (dT/dt) to detect dangerous trends early and to prevent overshoot.
Three loops that must be separated
- Skin / contact temperature: patient safety hard limit; sensitive to placement bias and local hot spots.
- Applicator / cable / head temperature: early indicator of aging, poor contact, connector loss, and abnormal dissipation.
- Heatsink / junction proxy: sustained-output boundary; drives slow derating and cooldown windows.
Why “one temperature” is not enough
- Heatsink-only: skin hot spots can rise fast while the heatsink remains cool → protection reacts too late.
- Skin-only: connector/cable loss can overheat the head while skin temperature stays acceptable → faults go unnoticed.
- Head-only: normal high-power sessions may be misread as a fault → unnecessary shutdowns and poor repeatability.
Robust trigger concept
Use both absolute temperature thresholds and dT/dt thresholds. Rate-of-rise detects fast hot-spot formation or coupling changes early, enabling soft derating before a hard shutdown becomes necessary.
Protection design
Over-heat, over-current, and mismatch hazards must be handled with layered protections by time scale. Fast hardware paths protect devices against instantaneous stress. Supervisory logic prevents repeated overstress under drift or accessory faults. Thermal protections enforce patient and hardware limits using graded derating, shutdown, and cooldown lockout rules.
Layered strategy by response time
- Fast hardware (ms): cycle-by-cycle current limit and immediate tank over-voltage cutoff.
- Supervisory (10–100ms): mismatch proxy and accessory fault checks to derate or stop before stress repeats.
- Thermal (seconds): skin/head/heatsink thresholds with staged derate → stop → cooldown lockout.
| Timing class | Trigger condition | Detection input | Action | Recovery condition |
|---|---|---|---|---|
| Fast | inverter over-current | bridge I / tank I | cycle-by-cycle limit or gate disable | auto when current returns + retry limit |
| Fast | tank over-voltage | tank V | clamp and/or immediate shutdown | manual or timed restart after safe window |
| Supervisory | mismatch proxy above limit | mismatch proxy, tank V/I | derate; stop if persistent | proxy back in range for N samples |
| Supervisory | cable/applicator fault trend | Head/Cable T, dT/dt | derate then stop; lockout if repeating | cooldown + stable dT/dt |
| Thermal | skin temperature limit | Skin T, dT/dt | graded derate → stop → cooldown lockout | Skin T below release threshold for time window |
| Thermal | heatsink/junction proxy limit | Heatsink T (proxy) | sustained derate; stop if overheating continues | cooldown to safe band; retry-limited |
Control & recipes (CW vs pulsed, duty and session limits)
“Recipes” are implemented as device-level output modes with explicit safety boundaries. The control loop must coordinate power commands with thermal limits (Skin/Head/Heatsink + dT/dt), mismatch proxies, and fast hardware protections (over-current/over-voltage) to avoid overshoot, oscillation, and repeated stress.
Engineering view: why pulsed mode can reduce surface overheating risk
- Thermal diffusion time: off-time allows heat to spread, reducing hot-spot overshoot near the contact region.
- Better early warning: dT/dt can be evaluated between bursts; fast rises trigger derate before hard limits are hit.
- Controlled energy delivery: duty ceilings and max-on windows bound accumulated heat when coupling drifts.
Recipe parameters that must be explicit
| Parameter | What it limits | Driven by | Typical action |
|---|---|---|---|
| Ramp limit (dP/dt) | power overshoot during unknown coupling | mismatch proxy + early thermal trend | slow start, step-size cap |
| Duty ceiling | instantaneous heating rate | Skin dT/dt, Head T | reduce on-time, increase off-time |
| Max continuous time | thermal accumulation | Heatsink T (proxy) + trend | force derate or stop after timer |
| Cooldown window | rapid re-entry into limits | release thresholds + minimum time | lockout until stable band reached |
| Mismatch derate curve | device stress under drift/fault | mismatch proxy, tank V/I proxies | derate → stop if persistent |
Non-negotiable boundaries
- Hardware OC/OV always wins: any fast trip immediately disables the power stage.
- Derating must be monotonic: avoid oscillation by adding hold time and hysteresis around thresholds.
- Recovery must be explicit: define “release band + minimum cooldown time” before re-enable.
Reference state machine (implementation-friendly)
- Idle → ready checks pass.
- Ramp → dP/dt-limited approach to target setpoint.
- Run-CW / Run-Pulsed → maintain mode with duty ceiling and timers.
- Derate → reduce power/duty based on mismatch and thermal trends.
- Cooldown → enforce lockout until release band is stable.
- Fault-Lockout → repeated faults or hard trips require explicit recovery rules.
IC role map (with example part numbers)
This section lists the IC categories commonly searched in a BOM for diathermy/physiotherapy HF field drives. Part numbers below are examples to anchor sourcing and comparison. Final selection depends on frequency band, bus voltage, power level, and required protection response time.
How to use this map
- Pick drivers/controllers first to match switching speed, dead-time control, and fast shutdown wiring.
- Then lock sensing + comparators so derating and cutoff thresholds are deterministic under drift.
- Finally select thermal interfaces and power-path protection to prevent repeated stress and unsafe recovery behavior.
| Subsystem | Role | Example part numbers | Why it shows up in this design | Selection notes |
|---|---|---|---|---|
| HF power stage | Half-bridge / high-side-low-side gate driver | TI UCC27714, TI UCC27712, ADI LTC4440, Infineon IRS21867 | Drives the MOSFET half-bridge with controlled dead-time and clean turn-off during faults. | Check dv/dt immunity, dead-time behavior, UVLO thresholds, and the gate-disable pin path. |
| HF power stage | Fast half-bridge driver (for very fast edges) | TI LMG1210, TI LMG1020 | Enables fast switching for higher-frequency or efficiency-oriented HF stages where timing margins are tight. | Verify driver supply, output current, propagation delay matching, and layout sensitivity. |
| HF power stage | PWM / timing controller (modulation, burst, duty limits) | Microchip dsPIC33EP family, ST STM32G4 family | Implements CW vs pulsed modes, duty ceilings, cooldown windows, and supervisory fault policy. | Prioritize timers, fast ADC triggering, comparator routing, and deterministic fault ISR latency. |
| Sensing | Current-sense amplifier (bridge/tank current) | TI INA240, TI INA281, ADI AD8418 | Converts shunt voltage into a clean signal for fast derating, trend detection, and OC supervision. | Check bandwidth, step response, overdrive recovery, and common-mode behavior under switching edges. |
| Sensing | High-speed SAR ADC (fast control and logging) | ADI AD7980, ADI AD4003, TI ADS8860 | Samples fast proxies (bus V/I, envelope detect outputs) for stable supervisory decisions. | Match input drive, sampling rate, latency, and reference stability to the control bandwidth. |
| Sensing | Window / high-speed comparator (fast cutoff) | TI TLV3501, TI LMV7219, ADI LTC6752 | Builds the millisecond-class hardware path for OC/OV and extreme mismatch shutdown. | Confirm propagation delay, input overdrive, and clean logic-level interface to gate-disable. |
| Sensing | RF / envelope detector (mismatch proxy) | ADI AD8361, ADI ADL5513, ADI LTC5507 | Turns HF amplitude/power-like behavior into a low-frequency proxy used for derating and stop decisions. | Use as a proxy (not clinical measurement). Verify dynamic range, response time, and calibration approach. |
| Thermal | Digital temperature sensor (skin/head/heatsink points) | TI TMP117, TI TMP235, Microchip MCP9808 | Provides stable multi-point temperature limits and dT/dt trends for staged derating and lockout. | Focus on placement, thermal coupling, and response time; accuracy alone is not the full story. |
| Thermal | RTD interface (precision thermal points) | Maxim MAX31865, ADI AD7124-4 | Useful where drift and repeatability dominate, or where wiring constraints favor RTD measurement. | Verify excitation strategy, lead compensation, and conversion latency vs control needs. |
| Protection & power path | eFuse / hot-swap (input power path control) | TI TPS25947, TI TPS25982, ADI LTC4365, TI LM5069 | Handles inrush, short events, and controlled shutdown to prevent repeated stress and unsafe brownouts. | Check SOA timing, current limit modes, fault reporting, and restart policy hooks. |
| Protection & power path | Supervisor / reset / watchdog | TI TPS386000, ADI ADM809, Maxim MAX6369, TI TPS3430 | Keeps control deterministic across faults: clean resets, controlled recovery, and bounded retry behavior. | Ensure reset timing, watchdog windowing, and fault pin wiring do not mask true hardware trips. |
Quick BOM search keywords (copy-friendly)
half-bridge gate driver · fast comparator · current-sense amplifier · SAR ADC · envelope detector · temperature sensor · RTD interface · eFuse · hot-swap · supervisor · watchdog
Design checklist (acceptance-ready)
The checklist below is organized into five columns: measurement, control, protection, accessory, and thermal. Each item is written as a pass/fail statement so verification can be performed during bench bring-up and fault injection.
| Measurement | Control | Protection | Accessory | Thermal |
|---|---|---|---|---|
| Frequency band and max power range are defined with a “normal coupling window”. | CW vs pulsed modes have explicit entry/exit conditions (not manual-only behavior). | Hardware OC path exists (comparator → gate disable) and does not depend on firmware timing. | Open/short detection criteria are defined (signal source + decision window). | Skin / Head / Heatsink are treated as three independent thermal loops. |
| bus V/I, bridge/tank I, and mismatch proxy ranges cover fault spikes without saturation. | duty ceiling, max continuous time, and cooldown window are linked to thermal and mismatch signals. | Tank over-voltage has a deterministic action (clamp and/or shutdown) with a defined restart policy. | Cable/connector abnormal loss is detectable via Head/Cable T trend or mismatch proxy trend. | dT/dt thresholds exist as early warning (not a replacement for absolute limits). |
| Sampling alignment is defined: which signals are synchronous and which are supervisory-only. | Derating curve is monotonic and includes minimum hold time or hysteresis to avoid oscillation. | Mismatch proxy over-limit triggers derate first; persistent faults trigger stop and then lockout. | Accessory overheat response is staged: derate → stop → lockout (with recovery criteria). | Release thresholds and cooldown duration are explicit to prevent rapid re-entry into heat limits. |
| “Fast hardware vs software” ownership is documented for every threshold (OC/OV/mismatch/thermal). | Power ramp (dP/dt) limit exists to prevent overshoot when coupling is initially unknown. | Retry count and retry interval are bounded to avoid repeated stress under unstable coupling. | Fault logging captures: last mode, last setpoint, proxy levels, and which layer tripped (fast/supervisory/thermal). | Thermal sensor placement and coupling are reviewed so the “measured point” matches the risk point. |
Minimum deliverables before design sign-off
- Threshold table exists for OC/OV/mismatch/skin/head/heatsink including actions and recovery conditions.
- Fault injection plan covers: open/short, metal proximity trend, forced mismatch proxy, forced thermal rise.
- Derating behavior is repeatable: no oscillation, no uncontrolled restart, no hidden automatic retries.
Request a Quote
FAQs
These FAQs focus on device-level control, sensing, matching, thermal monitoring, and layered protection for HF physiotherapy heating systems.
1) What exactly counts as “diathermy/physiotherapy HF heating” at the device level, and what is out of scope here?
What it is: An HF power stage drives an applicator through matching to produce controlled tissue-region heating. Why it matters: Safety and repeatability depend on bounded electrical stress and bounded contact temperature. Design rule: Define the modality boundary as HF drive + matching + sensing + protection only. Quick verification: Confirm no feature relies on clinical dose guidance.
2) Which HF power stage approach is easier to keep stable across load drift: bridge + resonant tank or efficiency-driven Class-D/E style driving?
What it is: Bridge+tank is tolerant to drift when sense points and limits are well defined; Class-D/E can be efficient but is more sensitive to impedance changes. Why it matters: Load drift can cause current spikes and tank over-voltage. Design rule: Prefer architectures with clear current/voltage limits and fast shutdown wiring. Quick verification: Sweep equivalent load and detune while logging stress proxies.
3) Why does a matching network matter so much, and what field symptoms typically indicate mismatch or coupling drift?
What it is: Matching transforms a drifting applicator/body impedance into an equivalent load the power stage can tolerate. Why it matters: Mismatch raises tank voltage, increases bridge current, and destabilizes control. Design rule: Treat matching as a protection boundary, not only an efficiency block. Quick verification: Force detune and confirm derate triggers before hardware OC/OV trips.
4) What are practical “mismatch proxy” signals when true reflected-power measurement is not available, and how should they be interpreted safely?
What it is: Proxies include tank V rise, bridge/tank current spikes, envelope detector outputs, and stable-bus current changes at fixed command. Why it matters: Proxies can drift, so thresholds must tolerate variation. Design rule: Calibrate a baseline window and use persistence counters plus monotonic derate. Quick verification: Test open/short/metal proximity cases and confirm consistent proxy ordering.
5) Which quantities must be sensed in hardware for fast protection, and which can be handled by firmware without risking device stress?
What it is: Hardware must own inverter over-current and tank over-voltage; firmware can own slower mismatch/thermal policies. Why it matters: Firmware latency or hangs must not allow destructive stress. Design rule: Route critical thresholds to comparators that directly disable gates, independent of software. Quick verification: Inject fast OC/OV events and measure gate-disable response under worst-case CPU load.
6) How should the sensing chain be partitioned for control vs protection (conditioning → ADC vs comparator cutoff path)?
What it is: Use two paths—an ADC path for control/logging and a comparator path for immediate cutoff. Why it matters: A single shared path can saturate or add latency during faults. Design rule: Keep the cutoff path short, deterministic, and referenced to stable thresholds; let the ADC path prioritize dynamic range and calibration. Quick verification: Overdrive signals and confirm comparator trips even if ADC saturates.
7) Why are three separate thermal loops needed (Skin / Head-Cable / Heatsink), and what goes wrong if only one temperature is used?
What it is: Skin protects the contact region, Head/Cable catches accessory losses, and Heatsink bounds sustained device dissipation. Why it matters: One sensor can miss hot spots or trigger false trips. Design rule: Use multi-point sensing with staged thresholds per loop and separate recovery rules. Quick verification: Create localized heating at each risk point and confirm the intended layer triggers first.
8) How can dT/dt be used as an early-warning trigger without causing false trips or oscillation near thresholds?
What it is: dT/dt detects rapid hot-spot formation before absolute limits are exceeded. Why it matters: Noise and placement can create false slope spikes. Design rule: Compute slope over a defined window, add hysteresis/hold time, and require correlation with power or mismatch proxies. Quick verification: Compare slow vs fast thermal ramps and verify dT/dt only accelerates derate, not random stops.
9) What is a clean layered protection policy for over-current, tank over-voltage, mismatch, and thermal events (ms vs 10–100ms vs seconds)?
What it is: Use time-scale layering—ms hardware OC/OV cutoff, 10–100ms supervisory mismatch rules, and seconds thermal derate/lockout. Why it matters: Mixing layers causes unpredictable trips and unsafe retries. Design rule: Define triggers, actions, and recovery per layer with bounded retry counts. Quick verification: Fault-inject each layer separately and confirm deterministic transitions and cooldown enforcement.
10) CW vs pulsed output: what control rules (duty ceiling, max on-time, cooldown window) prevent surface overheating while keeping output repeatable?
What it is: CW is continuous power; pulsed bounds heating rate using duty and enforced off-time. Why it matters: Coupling drift can create local hot spots and overshoot. Design rule: Link duty ceiling to Skin dT/dt, link max on-time to Heatsink trend, and enforce cooldown based on release thresholds. Quick verification: Repeat runs across coupling states and confirm stable derate curves without oscillation.
11) Which IC categories typically dominate the BOM for HF drive, sensing, thermal, and power-path protection—and why are they needed?
What it is: Core categories are gate drivers/controllers, current-sense + ADC/comparators, temperature interfaces, and eFuse/supervisor/watchdog. Why it matters: Each category enforces a specific safety boundary or determinism requirement. Design rule: Choose parts that support fast gate-disable wiring, stable thresholds, and clear fault reporting for recovery rules. Quick verification: Trace every protection decision to a measurable signal and a deterministic actuator path.
12) What bench tests should be run to “accept” a design—especially fault injection for open/short, mismatch drift, abnormal heating, and recovery behavior?
What it is: Acceptance testing validates boundaries, not clinical outcomes. Why it matters: Most failures are drift, accessory faults, or recovery oscillation. Design rule: Test normal coupling, forced detune, open/short, thermal ramps at each sensor point, and firmware hang scenarios while confirming safe cutoff and bounded retries. Quick verification: Record trigger→action→recovery timestamps and confirm they match the written policy.
