At a glance
Where the flow bends
- 01Specification
The spec starts with patient safety and a battery that must last for years, because replacing it means surgery.
Requirements come from a risk analysis and are traced to tests. Battery-life targets in years turn into current budgets in microamps, and the FDA device class decides how much evidence is needed.
Requirements derive from hazard analysis and the device’s essential performance under IEC 60601-1, with traceability from each requirement to verification evidence for the regulatory submission. Current budgets are set per function at end-of-life battery voltage.
- 02Architecture
The chip combines delicate circuits that listen to the body, circuits that deliver therapy, and a low-power radio, all built to fail safe.
A typical implant ASIC combines an analog front end and ADC for biosignals, stimulation drivers, power management, a low-power radio or inductive link, and safety monitors that force a safe state on faults.
Architectures favor independent safety paths (watchdogs, charge-balance and current limits in hardware), duty-cycled sensing, and process choices with long availability and high-voltage options for stimulation.
- 04Verification
Every requirement must have a test that proves it, and the proof is kept for regulators.
Verification is requirements-based, documented, and traceable. Firmware follows the IEC 62304 software life cycle, and fault cases are tested as deliberately as normal operation.
Coverage is measured against hazards as well as features: fault injection on safety monitors, mixed-signal simulation of front end and stimulator, and formal records that become part of the design history file.
- 06Design for test
Every chip is tested very thoroughly before it goes into a device, because a failure inside a patient is far more serious than a returned gadget.
Test programs aim for very high fault coverage and add screening steps to remove weak parts before they are implanted.
Screens such as burn-in and parametric outlier rejection target early-life failures. Analog front ends and stimulators need dedicated test modes, which must be locked out in the field.
- 12Signoff
Final checks ask whether the chip will still work after ten or more years inside a warm, salty body.
Signoff covers reliability over the product life at body temperature: aging, electromigration, leakage, and behavior at the battery’s end-of-life voltage.
Lifetime models at 37 °C for decade-plus missions, leakage and noise at body temperature, high-voltage device reliability for stimulators, and system-level checks of hermetic package and interconnect lifetime.
- 13GDS & tapeout
Once a device is approved, its chip is effectively frozen. Changing it, or even the factory that makes it, can require new approval.
For devices approved through PMA, changes to circuits, components, physical layout, or manufacturing facility that affect safety or effectiveness need FDA approval of a supplement first.
Fab, process, or mask changes are regulatory events, so teams pick processes with long availability, plan last-time buys, and keep design data maintainable for a product life that can exceed the life of the process.
Some of the most demanding chips in the world are tiny ones inside people: pacemakers that keep a heart in rhythm, neurostimulators that calm nerves, and cochlear implants that let people hear. These are .
Once a chip is inside a body, nobody can reboot it or swap its battery without surgery. A pacemaker battery made with lithium and iodine lasts about ten years.1 The chip has to sip power for that whole time and never do anything unsafe.
Safety is checked by regulators. In the United States, the FDA sorts devices into classes by risk, and the riskiest devices need the strictest approval before they can be sold.2
Implant chips run on microamps. A typical pacemaker specification lists a 2 Ah battery and a control-circuit current drain of 10 µA.1 That control current alone would take about 200,000 hours, over 20 years, to drain the battery. But a pacemaker spends about half of its battery energy stimulating the heart and half on housekeeping such as monitoring and data logging.1 Count both and the same battery lasts roughly half as long, about a decade.
Regulation shapes the flow. The FDA’s run from Class I (lowest risk) to Class III (highest risk), and Class III devices generally require .2 IEC 60601-1 sets general requirements for basic safety and essential performance of medical electrical equipment, and IEC 62304 sets life cycle requirements for medical device software, including software embedded in a device.34
A medical ASIC is one component of a regulated system, and that changes what “done” means. Requirements trace to a hazard analysis and to the device’s , and verification evidence becomes part of the submission.
Approval also freezes the design. For PMA devices, any change affecting safety or effectiveness needs FDA approval of a supplement before it is made. The FDA explicitly lists changes in circuits, components, and physical layout, and the use of a different manufacturing facility.5
- Battery life in years. Every extra microamp shortens the time before the next surgery.
- Safety first. If something goes wrong, the device must fall back to a safe state, never a harmful one.
- Tiny body signals. Heart and nerve signals are millionths to thousandths of a volt, so the listening circuits must be extremely quiet.
- A harsh home. The body is warm and salty, so the electronics are sealed in cases made from materials the body tolerates.
- Long life on the market. Devices and their support must last for decades, and the chips inside them must stay available that long.
Analog front ends. Neural local field potentials range from about 20 µV to 1 mV, and action potentials are around 50 µV. Electrodes can also present a DC offset of 1–2 V, so the amplifiers are AC-coupled. One recent open-access design reaches 3.1 µVrms input-referred noise while drawing 3.8 µA from 1.8 V.6 The often dominates the implant’s design effort.
Wireless. In the United States, the FCC’s MedRadio rules set aside spectrum for implant radios. Implant devices with frequency monitoring may transmit anywhere in 401–406 MHz.7 The core 402–405 MHz band began as the in 1999, with a maximum transmit power of 25 µW EIRP.8
Materials. Devices that contact the body need a evaluation under ISO 10993-1, using a risk-based approach.9 For implants this drives the , feedthroughs, and electrode materials.
Noise at µA currents. Biosignals sit at low frequencies where 1/f noise dominates. The design cited above uses large-area PMOS input devices, whose 1/f noise is one to two orders of magnitude lower than NMOS of the same size, and reports a noise efficiency factor of 2.97.6 Chopper stabilization is the common alternative when the area cost of large input devices is too high.
Temperature corners. Body temperature is narrow but not lab temperature. The Michigan Micro Mote team found that chips tested only at 25 °C behaved differently implanted at 40 °C, and that designing for a wider range mattered for power draw.10 Leakage, bias currents, and oscillator frequency should be characterized across the full implant range.
Software and system safety. Firmware falls under IEC 62304, and the system’s essential performance under IEC 60601-1.43 Hardware safety mechanisms such as current limits, charge balancing, and watchdogs are designed so that a firmware fault cannot produce unsafe stimulation.
- Start from risks. Engineers list everything that could hurt a patient and design protections for each one.
- Prove every requirement. Each requirement gets a test, and the results are filed for regulators.
- Age the device on purpose. Parts are soaked in warm salt water and stressed to simulate years of use in weeks or months.
- Freeze and support it. After approval, changes are slow and costly, so teams plan for spare parts and long-term support from the start.
Verification evidence. ASIC test results appear in regulatory documents. For the Argus II retinal implant, the FDA summary lists ASIC performance testing of power supply and reset behavior, receiver characteristics, electrode driver outputs, system control, back telemetry, and the test interface.11
Reliability testing. Implants are aged under accelerated conditions in saline with electrical load, and packages are checked for corrosion, temperature cycling, vibration, and internal water vapor.11
System standards. External parts of an implant system are tested for electrical safety under IEC 60601-1 and for electromagnetic compatibility under IEC 60601-1-2.11
Signoff is lifetime signoff. Aging, electromigration, and leakage are analyzed at body temperature over the full product life. Stimulator output stages often need high-voltage devices with their own reliability rules, and charge balance must hold across process corners so electrodes do not corrode.
Change control. Because circuit, layout, and manufacturing-site changes can require a PMA supplement, ECOs after approval carry regulatory cost as well as mask cost.5 Teams keep frozen tool versions, archived PDK and library releases, and regenerable signoff data so a late fix can be reproduced exactly.
Obsolescence planning. Process longevity, second sources for packaging and assembly, last-time buys, and a documented path for supporting fielded devices belong in the spec. The Argus II case below shows what happens when the support path ends.
The Argus II gave some blind people a basic kind of vision. A camera on a pair of glasses sent images to a small processor worn on the belt. That processor turned the images into patterns and sent them wirelessly to an implant on the eye, where 60 tiny electrodes stimulated the retina.11
It was approved in Europe in 2011 and in the United States in 2013, and more than 350 people received it. The company later stopped making and supporting the implant. When one user’s belt processor broke, he had to gather spare parts from other patients to get it working again.12
The FDA’s public summary describes the implant in detail.11
- Electronics. A small hermetic package holds the electronics that receive power and drive stimulation. A coil receives power and exchanges data with a coil on the glasses over a radio-frequency link.
- Electrodes. A thin-film array carries 60 platinum electrodes in a 6 × 10 grid, with 55 enabled for use.
- Pathway. Argus II was approved under a , which exempts a device from the effectiveness requirement but still requires safety and probable benefit.
- Materials. Implanted parts passed biological testing under ISO 10993-1, and the external system met IEC 60601-1 and IEC 60601-1-2.
The reliability evidence shows how implant signoff extends beyond the die.11
- Electrode arrays stimulating under accelerated aging reached the equivalent of 32 years of use with no significant change in voltage waveform, against a 5-year specification.
- The interconnect between array, coil, and package was verified to a design life of at least 5 years in vitro under active soak with maximum electrical load.
- A real-time dynamic lifetime test simulating eye micro-motion was still running at approval, with at least 5 years of data to be collected.
- EMC testing checked that interference could not cause unintended or unsafe stimulation, which is how the system’s essential performance was defined.
The lifecycle lesson came later. Second Sight discontinued Argus II in 2019 and laid off most employees in 2020, leaving recipients without repairs or upgrades.12 The implant met its reliability targets, but the support chain around it failed. For medical silicon, the plan for decades of support belongs in the requirements alongside power and safety.
Sources
- Trends in Cardiac Pacemaker BatteriesLithium-iodine batteries last about 10 years; half of battery energy goes to stimulation; typical 10 µA control-circuit drain and 2 Ah rating.
- Classify Your Medical DeviceClass I, II, III by risk; 510(k) for non-exempt Class I/II; PMA for Class III.
- IEC 60601-1:2005+AMD1:2012+AMD2:2020 CSV: Medical electrical equipment - Part 1: General requirements for basic safety and essential performanceBasic safety and essential performance requirements for medical electrical equipment.
- IEC 62304:2006: Medical device software - Software life cycle processesLife cycle requirements for medical device software, standalone or embedded.
- PMA Supplements and AmendmentsChanges to circuits, components, physical layout, or manufacturing facility affecting safety or effectiveness need an approved supplement.
- Power-to-Noise Optimization in the Design of Neural Recording Amplifier Based on Current Scaling, Source Degeneration Resistor, and Current ReuseNeural signal amplitudes, electrode DC offset of 1–2 V, 1/f noise, a 3.1 µVrms amplifier at 3.8 µA.
- 47 CFR § 95.2563: MedRadio frequency bandsMedRadio bands, including 401–406 MHz for medical implant devices.
- Medical Implant Communication ServiceMICS created by the FCC in 1999 in 402–405 MHz with a 25 µW EIRP limit.
- Use of International Standard ISO 10993-1, “Biological evaluation of medical devices - Part 1: Evaluation and testing within a risk management process”Risk-based biocompatibility evaluation for devices that contact the body, for PMA, HDE, 510(k), and De Novo submissions.
- Lessons from Five Years of Making Michigan Micro MotesChips tested at 25 °C behaved differently when implanted at 40 °C; IR harvesting for in-body use.
- Summary of Safety and Probable Benefit: Argus II Retinal Prosthesis System (HDE H110002)Implant architecture, ASIC performance tests, accelerated lifetime, biocompatibility, IEC 60601-1 testing, HDE rules.
- Their Bionic Eyes Are Now Obsolete and UnsupportedOver 350 Argus users; approvals in 2011 (EU) and 2013 (US); product discontinued and support ended.