---
title: Thermal Safety IEC 60601-1: Temperature Limits for Medical Devices
description: MDR thermal safety using EN 60601-1 temperature limits: applied parts, hot surfaces, heat-balance, and what a test lab actually measures for burns protection.
authors: Tibor Zechmeister, Felix Lenhard
category: Electrical Safety & Systems Engineering
primary_keyword: thermal safety IEC 60601-1 MDR
canonical_url: https://zechmeister-solutions.com/en/blog/thermal-safety-iec-60601-1
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# Thermal Safety IEC 60601-1: Temperature Limits for Medical Devices

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **MDR Annex I §14.5 requires devices to minimise risks from reasonably foreseeable environmental conditions including temperature. For electrical medical devices, the operational interpretation of "thermally safe" is laid out in EN 60601-1:2006+A1+A12+A2+A13:2024, which sets explicit temperature limits for applied parts, accessible parts, and internal components under normal and single-fault conditions. The test lab does not judge design intent. It measures temperatures under defined conditions and compares them to table values.**

**By Tibor Zechmeister and Felix Lenhard.**

## TL;DR
- MDR Annex I §14.5 establishes the general safety requirement to protect against thermal hazards; EN 60601-1 provides the harmonised technical expression.
- The standard distinguishes applied parts (parts that intentionally touch the patient) from accessible parts (parts the operator may touch) and sets different limits.
- Limits depend on contact duration and material type. Metal, glass, and ceramic have lower permissible temperatures than plastic and rubber for the same contact duration.
- Testing uses defined ambient conditions, rated operating conditions, and single-fault simulations. Results are compared against tabulated values.
- Startups commonly fail thermal tests because they test at room temperature instead of the standard's required ambient, or because they forget single-fault scenarios.
- Heat-balance thinking early in design saves months. Retrofitting thermal mitigations after a failed test is expensive and often ugly.

## Why this matters

The first time most founders encounter thermal safety under EN 60601-1 is when they get a failure report from the test lab. The number is usually small and specific: the handle of your device reached 52 degrees Celsius after three hours of continuous operation at 25 degrees ambient. The limit for that surface at that contact duration was lower. Pass/fail is pass/fail.

This matters because thermal failures are expensive to fix. They usually mean the housing is wrong, the thermal path is wrong, the component selection is wrong, or all three. None of those are changes you make in a week. And because thermal behaviour depends on ambient conditions, material thermal conductivity, surface area, and worst-case usage, "it seemed fine on our bench" is never the same answer as "it passes the standard".

This post covers what MDR actually requires, how EN 60601-1 translates that requirement into numbers, what the test lab actually measures, and how to design for thermal safety from the start so the lab is a confirmation, not a discovery.

## What MDR actually says

MDR Annex I §14.5 is part of the general safety and performance requirements on protection against risks posed by devices intended to be used in specific environmental conditions, including temperature. The core obligation is risk minimisation as far as possible while maintaining the benefit-risk ratio. Annex I §14 more broadly requires that devices be designed and manufactured so that they achieve the performance intended and minimise risks to patients, users, and third parties under normal conditions of use. Annex I §17 adds lifetime and wear considerations.

MDR does not publish numerical temperature limits. That is deliberate. The numbers live in the harmonised standards, and the harmonised standard for basic safety and essential performance of medical electrical equipment is EN 60601-1:2006+A1+A12+A2+A13:2024. Use this full reference in your technical file. The shorthand "IEC 60601-1" is fine in conversation; in documents it must be the harmonised EN version with the correct amendment string.

EN 60601-1 Clause 11 covers protection against excessive temperatures and other hazards. The relevant sub-clauses set out temperature limits for:
- Applied parts in normal use (parts in intentional patient contact).
- Accessible parts in normal use (parts the operator can touch).
- Components and internal parts under normal conditions.
- All of the above under single-fault conditions.

The standard distinguishes contact durations (typically, less than 1 minute, between 1 and 10 minutes, and longer than 10 minutes) and materials (metal, glass, ceramic as one category; plastic and rubber as another, with different limits because they feel cooler at the same temperature).

Essential performance under Clause 4 also comes into play. If your device's essential performance depends on temperature (for example, a controlled therapy temperature), the risk of unsafe temperatures is both a basic safety issue and an essential performance issue, and both paths need documented mitigation.

Alongside EN 60601-1, EN ISO 14971:2019+A11:2021 governs the risk management process that identifies thermal hazards in the first place. The standard does not prescribe specific temperatures; it prescribes that you identify, evaluate, and control them.

## A worked example

A Class IIa device: a handheld diagnostic imaging probe with an internal processor and a patient-contact tip. Rated for continuous use. Operator holds the handle during procedures lasting up to 20 minutes. Patient-contact tip is pressed against skin for the duration.

Here is how thermal safety plays out across the design.

**Applied part: the tip.** The tip touches the patient. Contact duration per use exceeds 10 minutes. Under EN 60601-1 Clause 11 the limits for patient contact exceeding 10 minutes are significantly lower than for brief contact. The team designs the thermal path so that heat from the processor is dissipated into the body of the handle, not into the tip. The tip material is selected for low thermal conductivity to further decouple from the handle.

**Accessible part: the handle.** The operator grips the handle for up to 20 minutes. Under Clause 11 the limits for operator-accessible parts in prolonged contact depend on material. Plastic and rubber allow higher numbers than metal because they feel cooler at the same temperature. The team selects a textured plastic housing and models heat dissipation, aiming to stay well below the limit with margin for worst-case conditions.

**Internal parts.** Components inside the housing can run hotter, but they must stay within manufacturer ratings and must not degrade insulation or cause component failures that become single-fault hazards. The processor datasheet specifies a maximum junction temperature; the design maintains a safety margin under worst-case ambient.

**Single-fault conditions.** Clause 11 requires that temperatures remain within safe limits even under single-fault conditions. What if the cooling fan fails? What if the thermal protection circuit fails? The risk analysis under EN ISO 14971 identifies these faults, and the design includes a redundant thermal cut-off: a resettable thermostat that shuts the device down before the tip or handle exceeds the patient-safe limits.

**Test lab reality.** The team ships the device to a test lab. The lab runs the device at its rated ambient (which is higher than typical room temperature, often at the maximum rated ambient of the device, or at a specified test ambient such as 25 degrees plus or minus a tolerance). They let the device run until thermal equilibrium is reached, which for a 20-minute handheld could mean well over an hour of continuous operation. They measure with calibrated thermocouples attached at the specified locations. They simulate single faults per the test schedule. They report numbers. If any number exceeds the tabulated limit by any amount, it is a fail.

The team's first submission shows the handle reaching a temperature a few degrees over the limit in the single-fault scenario. The root cause is that the redundant thermostat trip point was set too close to the operating temperature, so under the worst-case ambient the thermal cut-off did not trigger until the surface had already exceeded the limit. The fix is a different trip point. The cost is a design change, a re-test, and about six weeks of delay.

## The Subtract to Ship playbook

**1. Identify applied parts and accessible parts on day one.** Draw the device. Mark every surface the patient might touch and every surface the operator might touch. For each, state the expected contact duration. This directly drives the limit tables you will need from EN 60601-1 Clause 11.

**2. Build a thermal model before you build a prototype.** A simple spreadsheet model of heat generation, thermal resistance path, and ambient conditions catches most failures before silicon. Worst-case ambient plus worst-case continuous operation plus realistic insulation is the scenario that usually fails.

**3. Design for the rated ambient, not your office.** If you rate the device for 35 degrees Celsius ambient, the test lab will test at 35 degrees Celsius. Twenty-two degrees in your office is not relevant data.

**4. Identify single-fault modes in the risk file.** Under EN ISO 14971, list the components whose failure could cause excessive temperatures: fans, thermal sensors, control firmware, power regulators. For each, specify the mitigation. The mitigation must itself be independent of the fault.

**5. Include a redundant thermal protection.** Most startups use a thermistor for control and a bimetallic or fusible thermal protector as independent back-up. The trip point of the protector must be set below the Clause 11 limit with margin, not at the limit.

**6. Choose materials with thermal behaviour in mind.** A metal handle feels hot at a temperature where a plastic handle feels warm. The limits reflect this. A metal accessible part drives you toward lower internal temperatures and more conservative design. Plastic buys you headroom but brings its own considerations.

**7. Pre-test before the accredited lab.** A pre-test with thermocouples on your own bench, at the maximum rated ambient in an environmental chamber, tells you whether you are close to the limits. Discovering you are two degrees over in a certified lab is twenty thousand euros more expensive than discovering it on your bench.

**8. Document everything for the technical file.** The thermal safety section of your technical file should contain: identified applied and accessible parts, contact durations, applicable limits from Clause 11, design calculations and models, pre-test results, single-fault analysis with mitigations, and the final test report from the accredited lab. This is what a notified body reviewer reads to form an opinion.

Thermal safety is one of the areas where early design effort pays the largest dividends. The standard is strict, the test is deterministic, and the fix-after-fail path is slow and expensive.

## Reality Check

1. Have you identified every applied part and every accessible part, with contact durations?
2. Do you know the specific temperature limits from EN 60601-1 Clause 11 that apply to each of those surfaces?
3. Is your device's maximum rated ambient documented and reflected in design calculations?
4. Have you built at least a simple thermal model and compared it to measured prototype data?
5. Is there independent, redundant thermal protection with a trip point set below the Clause 11 limits?
6. Have single-fault thermal scenarios been analysed under EN ISO 14971 and mitigated?
7. Have you run an in-house pre-test at worst-case ambient before shipping to the accredited lab?
8. Does your technical file contain a complete thermal safety section including Clause 11 limit references and test evidence?

Any "no" is a gap to close before test submission.

## Frequently Asked Questions

**Is there a single temperature limit I can design to?**
No. EN 60601-1 sets different limits for different surface types, contact durations, and materials. You need to look up the correct row for each surface.

**Can I test at room temperature instead of the rated ambient?**
Not for certification. The accredited lab will test at the specified ambient, which is usually tied to your device's rated operating environment. Room temperature pre-testing is useful for internal sanity checking only.

**Do I need a hardware thermal cut-off, or can firmware handle it?**
Firmware can be part of the control strategy, but single-fault analysis usually leads to a hardware-independent protection. A software-only protection is not independent of software faults.

**What if my device runs only briefly, under a minute?**
Shorter contact durations have higher permissible surface temperatures in Clause 11. Document the actual use duration in your intended purpose and risk file, and design to the appropriate limits. The standard assumes worst-case foreseeable use, not best-case marketing claims.

**Does MDR set any thermal numbers itself?**
No. MDR Annex I §14.5 and §14 set the general requirement; the numbers live in EN 60601-1. Using the harmonised standard gives you presumption of conformity with the corresponding GSPR.

**What is the difference between accessible and applied parts for thermal purposes?**
Applied parts are the parts that, by design, come into contact with the patient in normal use. Accessible parts are parts that the operator (or patient, or third party) can touch. Applied parts generally have stricter limits for prolonged contact.

## Related reading
- [MDR electrical safety requirements](/blog/mdr-electrical-safety-requirements) — the broader MDR framing for electrical safety.
- [Basic safety and essential performance under IEC 60601-1](/blog/basic-safety-essential-performance-iec-60601-1) — the conceptual backbone of the standard.
- [Inside the IEC 60601-1 test lab process](/blog/iec-60601-1-test-lab-process) — what actually happens when you ship your device for test.
- [Electrical hazard protection under IEC 60601-1](/blog/electrical-hazard-protection-iec-60601-1) — the other half of Clause 8 and 11.
- [Common IEC 60601-1 test failures](/blog/common-iec-60601-1-test-failures) — patterns we see in startup submissions.

## Sources
1. Regulation (EU) 2017/745 on medical devices, consolidated text. Annex I §14, §14.5, §17.
2. EN 60601-1:2006+A1+A12+A2+A13:2024 — Medical electrical equipment — Part 1: General requirements for basic safety and essential performance.
3. EN ISO 14971:2019+A11:2021 — Medical devices — Application of risk management to medical devices.

---

*This post is part of the [Electrical Safety & Systems Engineering](https://zechmeister-solutions.com/en/blog/category/electrical-safety) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*