At a glance
Where the flow bends
- 01Specification
The plan starts with two goals: keep the patient safe, and make the battery last for years. Changing the battery means surgery.
Requirements come from an analysis of every way the device could hurt a patient, and each one is linked to the test that proves it. A battery life in years becomes a current budget in microamps (millionths of an ampere), and the device’s FDA risk class decides how much evidence is needed.
Requirements derive from the hazard analysis and the device’s essential performance under IEC 60601-1, with traceability from each requirement to its verification evidence for the regulatory submission. Current budgets are set per function at the battery’s end-of-life voltage.
- 02Architecture
One chip listens to the body, treats it, and talks by radio. If anything breaks, it must fall back to a safe mode.
A typical implant chip combines very quiet amplifiers and a converter that turn body signals into numbers, circuits that deliver stimulation, power management, a low-power radio or a coil link through the skin, and safety monitors that force a safe state if something fails.
Architectures favor independent safety paths (watchdogs, charge-balance and current limits in hardware), duty-cycled sensing, and processes with long availability and high-voltage options for stimulation.
- 04Verification
Every rule the chip must follow gets a test that proves it. The results are saved for the people who approve medical devices.
Every requirement is checked by a documented test that can be traced back to it. Firmware, the software built into the device, follows the IEC 62304 development process, and fault cases are tested as deliberately as normal operation.
Coverage is measured against hazards as well as features: fault injection on safety monitors, mixed-signal simulation of front end and stimulator together, and formal records that become part of the design history file.
- 06Design for test
Every chip is tested very carefully before it goes into a device. A failure inside a person is far worse than a broken phone.
Factory tests aim to exercise almost every part of each chip, and extra screening steps remove weak chips, ones that work today but are likely to fail early, before they are built into an implant.
Screens such as burn-in and parametric outlier rejection target early-life failures. Analog front ends and stimulators need dedicated test modes, which must be locked out once the device is in the field.
- 12Signoff
The last checks ask one question: will the chip still work after ten years inside a warm, salty body?
The final checks ask whether the chip will still work after ten or more years at body temperature: how its transistors and wires wear, how much current it leaks, and whether it still works as the battery voltage sags near the end of its life.
Lifetime models at 37 °C for decade-plus missions, leakage and noise at body temperature, high-voltage device reliability for stimulators, and system-level checks of the hermetic package and interconnect lifetime.
- 13GDS & tapeout
Once a device is approved, its chip is frozen. Changing it, or even the factory that makes it, can mean asking for approval again.
For the highest-risk devices, any change to the circuits, components or physical layout, or a move to a different factory, that could affect safety or effectiveness needs FDA approval before it is made. So once a device is approved, its chip is effectively frozen.
Fab, process or mask changes are regulatory events (PMA supplements), so teams pick processes with long availability, plan last-time buys, and keep design data maintainable for a product life that can outlast the process.
Some of the hardest chips to build are tiny ones that live inside people. A pacemaker keeps a heart beating in rhythm. A cochlear implant helps a deaf person hear. These are .
Once the chip is inside a body, nobody can restart it or swap its battery without surgery. A pacemaker battery can last more than ten years.1 For all that time, the chip must sip power and never do anything unsafe.
In the United States, a government agency called the FDA checks these devices. The riskier a device is, the more proof it needs before it can be sold.2
An such as a pacemaker runs for years on a battery that can only be replaced by surgery, so its chip has to use almost no power. Its budget is measured in microamps, millionths of an ampere. A typical pacemaker specification lists a battery holding 2 ampere-hours (Ah) of charge and a control-circuit current of 10 µA.1
The arithmetic is simple:
That is over 20 years. But the control circuits aren’t the only load: a pacemaker spends about half its battery energy stimulating the heart and half on housekeeping such as monitoring and data logging.1 Count both and the same battery lasts roughly half as long, about a decade. Every extra microamp the chip draws shortens the time to the next operation.
Regulation shapes the whole process. The U.S. Food and Drug Administration (FDA) sorts devices into from Class I (lowest risk) to Class III (highest risk), and Class III devices generally need , the strictest review.2 Two international standards also apply: IEC 60601-1 sets general safety requirements for medical electrical equipment, and IEC 62304 sets how medical-device software, including software running inside a device, must be developed and maintained.34
A medical chip is one component of a regulated system, and that changes what “done” means. Requirements are traced back to a hazard analysis (a list of the ways the device could hurt a patient) and to the device’s , the functions whose loss would be dangerous. The verification results that show each requirement is met become part of the regulatory submission, so they are written to be read by a reviewer, not just by the team.
Approval also freezes the design. For devices approved through , any change affecting safety or effectiveness needs FDA approval of a supplement before it is made. The FDA explicitly lists changes in circuits, components and physical layout, and the use of a different manufacturing facility.5 For a chip, even a metal-layer fix changes circuits and layout, and a move to another fab changes the manufacturing facility.
Control circuits alone at 10 µA: 2 Ah lasts 200,000 hours, about 23 years. Pacing is missing.
- A battery that lasts for years. Every bit of power the chip wastes brings the next surgery sooner.
- Safety first. If something goes wrong, the device must switch to a safe mode, never a harmful one.
- Tiny body signals. Heart and nerve signals push about a thousand to a million times more weakly than a phone battery. So the chip must listen very quietly, without adding its own hiss.
- A harsh home. The body is warm and salty, like the sea. So the electronics are sealed in a case the body won’t reject.
- A long life. Patients may need help with a device for decades. So its parts must stay available that long.
Listening to the body. The circuit that picks up the body’s signals is the . The signals are faint: slow waves of brain activity range from about 20 millionths of a volt (µV) to a thousandth of a volt, and the spike from a single nerve cell is around 50 µV. Meanwhile the electrodes themselves can sit at a steady 1–2 V, thousands of times larger, so the amplifier has to block that steady voltage and pass only the changes. One recent open-access design adds only 3.1 µV of its own noise while drawing 3.8 µA.6 Getting low noise at such low current is often the hardest part of an implant chip.
Wireless. Implants talk to equipment outside the body by radio. In the United States the FCC, the radio regulator, sets aside frequencies for them: an implant that first checks the channel is free may transmit anywhere from 401 to 406 MHz.7 The core 402–405 MHz band began as the in 1999, with a maximum transmit power of 25 microwatts.8
Materials. Anything that touches the body needs a evaluation under ISO 10993-1, using a risk-based approach.9 For implants this decides the , the sealed pass-throughs for its wires, and the electrode metals.
Noise at microamp currents. Biosignals sit at low frequencies, where a transistor’s (flicker) noise, which grows as frequency falls, dominates. Flicker noise shrinks as the input transistors get larger, and the design cited above uses large PMOS input transistors, whose noise is one to two orders of magnitude lower than NMOS of the same size. It reports a noise efficiency factor of 2.97, a figure of merit that compares noise against current drawn (lower is better).6 Chopper amplifiers, which move the signal to a higher frequency before amplifying it and back afterward, are the other common design when large input devices cost too much area.6
Temperature corners. Body temperature is narrow, but it is not lab temperature. The Michigan Micro Mote team found that chips tested only at 25 °C behaved differently implanted at 40 °C, and that designing for a wider range mattered for power draw.10 Leakage, bias currents and oscillator frequency should be characterized across the whole range the implant will see.
Software and system safety. Firmware falls under IEC 62304, and the system’s essential performance under IEC 60601-1.43 Hardware safety mechanisms such as current limits, charge balancing and watchdogs are designed so that no firmware fault can produce unsafe stimulation: the limit is enforced by circuits the software can’t override.
Each part answers one design driver. Tap or hover a part, or break the firmware.
The electrode sits at a steady 1.5 V. The 50 µV spikes are 30,000 times smaller: on this scale they vanish. Block the steady part.
- Start from risks. Engineers list everything that could hurt a patient. Then they plan a guard against each one.
- Prove every rule. Each rule the device must follow gets a test. The results are saved for the FDA.
- Age it on purpose. Parts soak in hot salt water to squeeze years of wear into a few months.
- Freeze it, and plan ahead. After approval, changes are slow and costly. So teams plan for spare parts and repairs from the start.
A chip normally goes from a written specification, through design and checking, to a layout sent to the factory. For a medical chip, each of those steps also produces evidence for the regulator.
Test results become public record. For the Argus II retinal implant, the FDA’s public summary lists the tests run on its custom chip: how it powers up and resets, how it receives data, the outputs that drive the electrodes, its control logic, the data it sends back out, and its test interface.11
Aging on purpose. Ten years can’t be tested in real time before launch. Instead implants are run under accelerated conditions in salt water with the maximum electrical load, so months of testing stand in for years of use, and their sealed cases are checked for corrosion, temperature cycling, vibration and moisture inside.11
System standards. The parts of an implant system worn outside the body are tested for electrical safety under IEC 60601-1 and for electromagnetic compatibility (not disturbing, or being disturbed by, other electronics) under IEC 60601-1-2.11
Signoff is lifetime signoff. Signoff, the final round of checks before tapeout, normally asks whether the chip meets timing and power at its corners. Here it also asks whether it will after a decade or more: aging, electromigration (metal atoms slowly pushed along wires by current) and leakage are analyzed at body temperature over the full product life. Stimulator output stages often need high-voltage transistors with their own reliability rules, and charge balance (equal positive and negative charge in each stimulation pulse) must hold across process corners so that electrodes don’t corrode.
Change control. Because circuit, layout and manufacturing-site changes can require a PMA supplement, an ECO (a late engineering change to the netlist or layout) after approval carries regulatory cost as well as mask cost.5 Teams therefore keep frozen tool versions, archived process-kit and library releases, and signoff data that can be regenerated, so a late fix can be reproduced exactly years later.
Obsolescence planning. How long the process will be available, second sources for packaging and assembly, last-time buys (a final bulk purchase before a part is discontinued), and a documented path for supporting devices already implanted all belong in the specification. The Argus II case below shows what happens when the support path ends.
Start from a hazard analysis: every way the device could harm a patient.
The Argus II gave some blind people a simple kind of sight. A camera on a pair of glasses sent pictures to a small computer worn on the belt. The computer turned each picture into a pattern and sent it by radio to an implant on the eye. There, 60 tiny metal contacts gave small electric pulses to the back of the eye.11
More than 350 people got the implant. Then the company stopped making and supporting it. When one user broke his belt computer, he had to collect spare parts from other users and a kind doctor to fix it.12
The Argus II retinal implant was made for people blinded by retinitis pigmentosa, a disease that destroys the light-sensing cells of the retina. The FDA’s public summary describes it in detail.11
- Electronics. A small sealed case on the eye holds the electronics that receive power and drive the electrodes. A coil receives both power and data by radio from a matching coil on the glasses.
- Electrodes. A thin, flexible strip carries 60 platinum electrodes in a 6 × 10 grid, with 55 enabled for use.
- Approval route. Argus II was approved under a , a route for rare conditions that exempts a device from the usual effectiveness requirement but still requires safety and probable benefit.
- Materials. The implanted parts passed biological testing under ISO 10993-1, and the external parts met IEC 60601-1 and IEC 60601-1-2.
The reliability evidence shows how implant signoff extends beyond the die.11
- Electrode arrays stimulating under accelerated aging reached the equivalent of 32 years of use with no significant change in voltage waveform, against a 5-year specification.
- The interconnect between array, coil and package was verified to a design life of at least 5 years in a soak test under accelerated conditions with maximum electrical load.
- A real-time lifetime test simulating the eye’s constant small movements was still running at approval, with at least 5 years of data to be collected.
- Electromagnetic compatibility testing checked that interference could not cause unintended or unsafe stimulation, which is how the system’s essential performance was defined.
The lifecycle lesson came later. Second Sight discontinued Argus II in 2019 and laid off most of its employees in 2020, leaving recipients without repairs or replacements.12 The implant met its reliability targets, but the support chain around it failed. For medical silicon, the plan for decades of support belongs in the requirements alongside power and safety.
Tap a part to read about it, or send an image through the chain.
Sources
Show Hide 12 sources
- Trends in Cardiac Pacemaker BatteriesLithium-iodine batteries last more than 10 years for some models; half of battery energy goes to stimulation; typical 10 µA control-circuit drain and 2 Ah rating.
- Classify Your Medical DeviceClass I lowest risk to Class III greatest risk; 510(k) for non-exempt Class I/II; PMA for Class III.
- IEC 60601-1:2005+AMD1:2012+AMD2:2020 CSV: Medical electrical equipment - Part 1: General requirements for basic safety and essential performanceCatalog page for a paywalled standard, cited only for its title and scope: requirements for basic safety and essential performance generally applicable to medical electrical equipment.
- IEC 62304:2006: Medical device software - Software life cycle processesCatalog page for a paywalled standard, cited only for its title and scope: life cycle requirements for medical device software, standalone or embedded in a device.
- PMA Supplements and AmendmentsChanges to circuits, components, physical layout, or manufacturing facility affecting safety or effectiveness need an approved supplement.
- Power-to-Noise Optimization in the Design of Neural Recording Amplifier Based on Current Scaling, Source Degeneration Resistor, and Current ReuseLFPs 20 µV–1 mV and action potentials around 50 µV; electrode DC offset of 1–2 V removed by AC coupling; PMOS 1/f noise one to two orders lower than NMOS; chopper amplifiers among typical designs; 3.1 µVrms at 3.8 µA from 1.8 V, NEF 2.97.
- 47 CFR § 95.2563: MedRadio frequency bandsMedRadio bands, including 401–406 MHz for medical implant devices.
- Medical Implant Communication ServiceMICS created by the FCC in 1999 in 402–405 MHz with a 25 µW EIRP limit.
- Use of International Standard ISO 10993-1, “Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process”Risk-based biocompatibility evaluation for devices that contact the body, for PMA, HDE, 510(k), and De Novo submissions.
- Lessons from Five Years of Making Michigan Micro MotesChips tested only at 25 °C behaved differently implanted at 40 °C; designing for a wider temperature range matters for power draw.
- Summary of Safety and Probable Benefit: Argus II Retinal Prosthesis System (HDE H110002)Implant architecture (60 electrodes, 55 enabled); ASIC performance tests; accelerated and real-time lifetime tests; package corrosion, vibration, temperature cycling and water vapor; ISO 10993-1, IEC 60601-1 and 60601-1-2 testing; HDE exemption from effectiveness.
- Their Bionic Eyes Are Now Obsolete and UnsupportedOver 350 recipients; approvals in 2011 (EU) and 2013 (US); discontinued in 2019, most staff laid off in 2020; a user rebuilt his broken processor with parts from other users.