PCB Failure Risk in Medical Electronics
Quality & Inspection Standards
PRODUCTS CENTER
Get Custom Quote
PRODUCTS CENTER
PCB Failure Risk in Medical Electronics
A multilayer PCB inside a patient monitor is classified as a Class II medical device. Its failure can delay treatment—not kill. But if the same board design is used in an infusion pump, the failure consequence shifts from delay to overdose. ISO 14971 requires that this difference be quantified, not assumed. A single via barrel crack, a single BGA corner ball open, a single conformal coating pinhole over a high‑voltage trace—each is a single‑point failure that must be identified, assessed, and mitigated before the board is patient‑connected. This page defines the three failure chains that produce the highest residual risk in medical electronics, and the design rules that reduce them to an acceptable level.
Engineering Decision Map
- Quick Assessment: Your Design vs. Medical Failure Risk
- First Risk: Single‑Point Failure Detection
- Second Risk: Leakage Current and Isolation Breakdown
- Third Risk: Solder Joint Fatigue Under Sustained Body Temperature
- Risk Verification Test Requirements
- Medical Failure Risk Mitigation Gates
- Risk Assessment Review Notes
1. Quick Assessment: Your Design vs. Medical Failure Risk
A commercial PCB that passes functional test can carry three residual failure risks that only become apparent when the board is evaluated per ISO 14971. Use this table to identify which failure chains apply to your design.
| Risk Category | Commercial (ISO 9001) | Medical (ISO 14971 + IEC 60601) | Detection Gap |
|---|---|---|---|
| Single‑point failure analysis | Not required | Required; every single‑point failure must be identified and mitigated | Not addressed in commercial design |
| Leakage current after humidity | Not tested | ≤ 10 µA NC / 50 µA SFC after 48 h at 37 °C, 95% RH | No test performed |
| Solder joint life at sustained 37 °C | Not evaluated | Must survive 10‑year equivalent under body temperature | Thermal cycling alone does not replicate implant environment |
The three risks below are presented in order of residual risk severity—the combination of probability and patient harm—as observed in medical device failure investigations.
2. First Risk: Single‑Point Failure Detection
Is this your problem? If your board has any component, via, or trace whose failure causes a hazardous condition—loss of therapy, delivery of incorrect therapy, or loss of alarm—without a second independent means of protection, yes. ISO 14971 requires that every single‑point failure be identified, its probability estimated, and its risk mitigated or accepted with documented justification.
The failure chain for a single‑point failure in a medical PCB is not just the electrical open or short. It is the sequence from the physical failure to the patient harm. A via barrel crack in a defibrillator charging circuit does not just stop the charge—it can leave the capacitor charged at full energy with no discharge path, creating an electrocution hazard when the device is removed. A solder joint open in an infusion pump motor driver does not just stop the pump—it can leave the motor energized in an unknown state, causing free‑flow of medication. Each of these chains must be traced from the physical failure to the clinical consequence.
Design rules that reduce this risk:
- Identify every single‑point failure in the patient‑connected circuit. This includes vias, traces, solder joints, and component internal connections. A high‑speed PCB design often uses differential pairs with one via per line—if one via fails, the pair becomes a single‑ended line with degraded signal integrity. If that signal controls a therapy delivery function, the via is a single‑point failure that needs a redundant parallel via.
- Apply redundant vias to all safety‑critical nets. A redundant via is not a design luxury—it is a risk control measure that reduces the probability of a single‑point open by several orders of magnitude. The two vias must be on opposite sides of the BGA pad or at different locations along the trace so that a single drill wander or plating void cannot affect both.
- Perform fault injection testing. Physically disconnect one via or one solder joint in a redundant pair and verify that the circuit continues to function within specification. This test proves that the redundancy is effective—not just present on the schematic. Document the results in the risk management file per ISO 14971.
3. Second Risk: Leakage Current and Isolation Breakdown
Is this your problem? If your board has any patient‑connected conductor operating above 5 V, yes. The risk is not just the working voltage—it is the combination of that voltage, the surface condition of the board after assembly, and the humidity inside the device enclosure after prolonged patient contact.
The failure chain is measurable and progressive. Ionic residues from assembly remain on the board surface. When the device is worn against the skin, body heat and perspiration create a 37 °C, 95% RH microclimate inside the enclosure. The residues dissolve into a conductive film. The leakage current—initially 2–3 µA, well within the 10 µA normal limit—rises to 40–60 µA within 48 hours as the film spreads and the ionic concentration increases at the conductor edges where the electric field is highest. The board is still electrically functional. The patient feels nothing. But the leakage current now exceeds the IEC 60601‑1 single‑fault limit, and the device is a safety hazard that no production test detects because production testing is performed on dry boards at room temperature.
Design rules that reduce this risk:
- Tighten ionic cleanliness to ≤ 0.50 µg/cm² NaCl equivalent for patient‑connected circuits. The commercial limit of 1.56 µg/cm² is not sufficient for body‑worn devices. Verify by ROSE testing per IPC‑TM‑650 2.3.25 and confirm halide species by ion chromatography on every assembly lot.
- Design creepage distances for the worst‑case surface condition. A 5.0 mm creepage path designed for dry conditions degrades to approximately 2.0 mm effective path under condensation. If the board cannot accommodate the full derated creepage, use an isolation slot or a qualified conformal coating as the second MOPP. The coating must be pinhole‑free—verify under UV at 365 nm on every board.
- Perform leakage current testing after 48 hours at 37 °C and 95% RH. Test with the device powered and all patient‑connected circuits active. The measurement must include both normal condition and single‑fault condition (one MOPP defeated). Any reading above 10 µA NC or 50 µA SFC is a failure, regardless of whether the board passes functional test.
4. Third Risk: Solder Joint Fatigue Under Sustained Body Temperature
Is this your problem? If your device is implantable or body‑worn for more than 5 years, yes. The failure mechanism is not the high‑cycle thermal fatigue that commercial qualification tests for—it is low‑cycle creep‑fatigue interaction at sustained 37 °C combined with the narrow thermal swings from room temperature to body temperature that occur during battery changes, patient showers, or MRI exposure.
A BGA solder joint under a processor in an implantable neurostimulator experiences roughly one thermal cycle per battery charge—perhaps 500 cycles over 10 years. That is far fewer than the 1000+ cycles used in commercial qualification. But each cycle occurs at a sustained baseline temperature of 37 °C, where the solder creeps faster, the intermetallic layer grows thicker, and the stress relaxation at the joint interface is incomplete between cycles. A joint that passes 1000 thermal shock cycles at −40 °C to +125 °C can fail after 300 cycles at 20 °C to 60 °C when the baseline is 37 °C—because the creep damage accumulated during the dwell at 37 °C does not recover during the cooler portion of the cycle.
Design rules that reduce this risk:
- Use ENEPIG surface finish with gold thickness ≤ 0.05 µm for all BGA pads. The palladium barrier prevents nickel corrosion, and the thin gold prevents AuSn₄ embrittlement. ENIG is not acceptable—the phosphorus‑rich nickel interface created by black pad is a brittle fracture path that activates under low‑cycle fatigue conditions earlier than under thermal shock.
- Increase BGA pad diameter by 15% over standard design rules for corner balls. The corner balls experience the highest shear strain during the room‑to‑body temperature transitions. The larger pad distributes the strain across a larger solder volume, reducing the strain concentration at the package‑side interface where cracks initiate.
- Perform HTOL at 85 °C for 1000 hours on assembled boards, followed by cross‑section of corner BGA balls. The acceleration factor for creep at 85 °C relative to 37 °C is approximately 40–60×. A joint that shows no intermetallic cracks or Kirkendall voids after 1000 hours at 85 °C has demonstrated resistance to the dominant implant failure mechanism. Thermal shock testing alone is not sufficient evidence of long‑term reliability.
5. Risk Verification Test Requirements
Each risk control measure must be verified by a test that directly demonstrates its effectiveness. The tests below are the minimum set for a medical PCB that carries a hazardous failure consequence.
| Risk Control | Verification Test | Minimum Acceptance Criterion | If Failed |
|---|---|---|---|
| Redundant vias | Fault injection: disconnect one via in each redundant pair | Circuit continues to function within specification; no signal degradation beyond design margin | Add second redundant via at a different physical location; re‑test |
| Leakage current control | Leakage current measurement after 48 h at 37 °C, 95% RH | ≤ 10 µA NC; ≤ 50 µA SFC | Tighten ionic cleanliness; verify flux inertness; re‑clean and re‑test |
| Solder joint creep resistance | HTOL at 85 °C for 1000 h; cross‑section corner BGA balls at 500× | No intermetallic cracks; no Kirkendall void chains; no pad cratering | Increase pad diameter; switch to ENEPIG; re‑test |
| Conformal coating integrity (MOPP) | Dielectric strength at rated MOPP voltage after 48 h at 37 °C, 95% RH | No breakdown; no pinholes under UV inspection | Re‑coat; if pinholes persist, change coating material or application method |
Medical Failure Risk Mitigation Gates
- Identify every single‑point failure in the patient‑connected circuit and document in the risk management file per ISO 14971. Apply redundant vias or traces to all safety‑critical nets.
- Verify each redundant element by fault injection testing. Disconnect one via or trace and confirm the circuit remains functional within specification.
- Tighten ionic cleanliness to ≤ 0.50 µg/cm² NaCl equivalent; confirm halides below detection limit by ion chromatography on every assembly lot.
- Design creepage distances for worst‑case condensation; use isolation slots or qualified conformal coating for the second MOPP. Inspect coating under 365 nm UV on every board.
- Use ENEPIG (Au ≤ 0.05 µm) for all BGA pads; increase corner ball pad diameter by 15%.
- Perform HTOL at 85 °C for 1000 h on assembled boards; cross‑section corner BGA balls at 500×. No cracks, no void chains, no pad cratering permitted.
- Perform leakage current testing after 48 h at 37 °C, 95% RH with the device powered. ≤ 10 µA NC, ≤ 50 µA SFC.
Risk Assessment Review Notes
Q: Our FMEA shows that a via barrel crack has a very low probability. Can we accept the risk without adding a redundant via?
The probability of a via barrel crack in a well‑plated via is low—but the detectability is zero. A barrel crack does not produce an electrical signature until it opens completely, and the open may be intermittent and temperature‑dependent. A failure with zero detectability cannot be accepted based on probability alone, because you have no way to screen for it in production. ISO 14971 requires that risk control measures be applied in order of priority: inherent safety by design (redundancy), protective measures (alarms, current limiting), and information (labeling). If redundancy is feasible—and an additional via is always feasible unless the board is at the routing density limit—it must be applied before lower‑priority controls are considered.
Q: Our leakage current test passes at room temperature but fails after humidity conditioning. Is the board safe if we add a warning label about moisture exposure?
A warning label is the lowest‑priority risk control in the ISO 14971 hierarchy. If the leakage current can be controlled by cleaning the board more thoroughly or by applying a conformal coating, those measures must be implemented before relying on a label. A label does not prevent the failure—it only warns the user. For a body‑worn device, moisture exposure is inherent to the intended use and cannot be avoided by the user. The design must control the leakage current, not warn the patient that it might occur.
Q: We use SAC305 solder and pass 1000 thermal shock cycles. Is HTOL still required for an implantable device?
Yes. Thermal shock testing validates resistance to rapid temperature changes. An implant sees essentially one thermal transient—the initial warm‑up from room temperature to 37 °C—and then spends its entire life at a sustained elevated temperature. The dominant damage mechanism shifts from thermal fatigue (driven by cyclic strain) to creep (driven by static stress and time at temperature). HTOL at 85 °C for 1000 hours provides the acceleration needed to replicate 10+ years of creep damage. A board that passes thermal shock but has not been evaluated for creep carries an unquantified residual risk that is not acceptable for an implantable device.
Q: How do we document the risk acceptance when a single‑point failure cannot be eliminated?
Per ISO 14971, risk that cannot be further reduced must be evaluated against the benefits of the device. This evaluation must be documented in the risk management file, signed by a cross‑functional team that includes clinical, engineering, and quality representatives, and reviewed with the notified body if the device is Class II or above. The documentation must include: the specific failure mode, the residual probability and severity, the rationale for why further risk reduction is not practicable, and a benefit‑risk analysis that shows the clinical benefit outweighs the residual risk. This is not a checkbox exercise—it is the primary evidence a notified body reviews during a technical documentation audit.
Related Engineering Pages
Creepage, hipot, leakage current, and IEC 60601 MOPP requirements for patient‑connected devices. High Reliability PCB Assembly for Medical →
Flux validation, coating qualification, and solder joint Class 3 acceptance for medical assembly. Long‑Life PCB Reliability Design →
Creep, aging, and ALT for implantable and sealed‑box PCBs with 10‑15 year service.
Need a medical PCB failure risk assessment, FMEA review, or ISO 14971 compliance analysis?
Request Engineering Review →References: ISO 14971 (Risk Management for Medical Devices); IEC 60601‑1 (Medical Electrical Equipment Safety); IPC‑6012E §3.3, §3.6; IPC‑TM‑650 2.3.25 (ROSE), 2.3.28 (Ion Chromatography); IPC‑4556 (ENEPIG); JEDEC JESD22‑A108 (HTOL). Courtesy of IPC and IEC.
Get Custom Quote
PRODUCTS CENTER
World-class PCB & PCBA manufacturer focused on high-frequency and high-reliability boards for defense, aerospace, automotive and industrial electronics.
You can unsubscribe at any time with a single click.
Copyright © 2025 UltroNiu Electronics Group All Rights reserved.