Resources

Dose Is Not What You Set. It Is What the Tissue Receives.

Author

VSVikram Sethi
Senior Systems Engineer

Expertise

Product Design and Development

Service

Medical Device Design & Development

Sector

Therapeutic Devices

Topic

Clinical & Therapeutic Devices
Modeling & Simulation
Risk Management

Published

29 June 2026
8 min read

TL;DR

• Every therapeutic device has a settings-to-effect transfer function that runs through the patient. The patient is variable, and the device usually cannot measure the variable that matters.
• Thermal therapies are dosed in cumulative equivalent minutes at 43 °C (CEM43), not in watts or seconds. The published necrosis threshold is roughly CEM43 = 340 minutes for liver and around 240 minutes for brain — and these thresholds are tissue-specific, not universal.
• Tissue impedance is not a constant. In radiofrequency ablation, desiccation and charring near the electrode raise impedance sharply, blocking further energy transfer to deeper tissue and decoupling delivered power from set power.
• Closed-loop control is the correct architecture for most therapy delivery, but it converts a hardware problem into a control-systems and software-safety problem, with corresponding obligations under IEC 62304 and ISO 14971.
• Therapeutic device risk analysis has to treat under-delivery as a hazard. A device that safely does nothing has failed the patient, and regulators increasingly frame it that way.

There is a comfortable fiction in therapeutic device design: that the parameter the clinician sets is the therapy the patient receives. Thirty watts for thirty seconds. Two hundred joules. Ten millilitres per hour. Fifty milliamps.

None of those are doses. They are inputs to a system whose transfer function is a human body, and that transfer function varies by patient, by anatomical site, by contact quality, by perfusion state, and by what happened during the preceding ten seconds of the same treatment.

Designing therapeutic devices well means designing for that variability explicitly, rather than assuming it away and relying on the clinician to compensate.

Thermal Dose Is a Time–Temperature Integral, Not a Power Setting

The most instructive example is thermal therapy, because the dosimetry is well developed and the mismatch between setting and effect is stark.

Tissue damage from heating is a function of both temperature and duration, and the relationship is strongly non-linear. The standard formalism is the cumulative equivalent minutes at 43 °C (CEM43) model, derived from Sapareto and Dewey:

where T is tissue temperature in °C, Δt is the time interval, and R = 0.5 for temperatures above 43 °C and R = 0.25 below 43 °C. The exponential form means a small temperature increase substitutes for a large time increase: every degree above 43 °C roughly halves the time required for equivalent damage.

Critically, the damage threshold is tissue-specific. Published values include approximately CEM43 = 340 minutes for liver necrosis and around CEM43 = 240 minutes for brain. An alternative formulation uses the Arrhenius damage integral, with tissue necrosis conventionally taken at Ω = 1.

The implication for device design is direct: a device that controls power and time is controlling neither of the variables in the dose equation. Temperature is what matters, and temperature depends on tissue thermal conductivity, blood perfusion, contact area, electrode geometry, and the thermal history of the preceding seconds.

Comparative studies illustrate how variable the result is. In a study comparing pulsed field and radiofrequency ablation, standard RF delivery at 30 W for 30 seconds with 17 mL/min irrigation produced peak tissue surface temperature rises of 16.6 ± 7.6 °C. That standard deviation is nearly half the mean. Identical settings, substantially different thermal doses.

Tissue Impedance Changes During Treatment, and It Changes the Therapy

In radiofrequency energy delivery, tissue is part of the electrical circuit. As tissue heats, water is driven off, and the desiccated zone immediately adjacent to the electrode undergoes a sharp rise in electrical impedance. Once charring occurs, impedance can rise steeply enough that current can no longer be driven into deeper tissue.

The result is a self-limiting failure mode with a counterintuitive signature: increasing power reduces the depth of effect, because it accelerates near-field desiccation that then insulates the target. Devices that respond to an incomplete lesion by escalating power make the problem worse.

Engineering responses fall into three categories:

Irrigation. Cooling the electrode–tissue interface keeps near-field temperature below the charring threshold, allowing energy to continue coupling into deeper tissue. Studies of fluid-enhanced ablation show that introducing heated saline into the tissue convects heat outward, producing temperature profiles that remain above the therapeutic threshold at 15 mm from the electrode — where conventional RF without fluid enhancement falls back to near body temperature within 10 mm.

Impedance feedback control. Monitoring impedance in real time and modulating power to hold it within a window. This is now standard on well-designed generators and is a genuine closed-loop control problem.

Alternative energy modalities. Pulsed field ablation, which relies on irreversible electroporation rather than thermal effect, sidesteps the impedance-rise problem — while introducing its own dosimetry uncertainties, since field strength distribution is geometry-dependent and harder to measure than temperature.

The general principle generalises beyond ablation. Any therapy delivered through a tissue interface — transcutaneous electrical stimulation, defibrillation, iontophoresis, ultrasound — has a coupling impedance that varies with contact quality, skin preparation, hydration, and time.

Closed-Loop Control Is Usually Right, and It Moves the Risk

If the delivered dose depends on a variable the device cannot control, the answer is generally to measure a proxy for that variable and close the loop.

This is correct engineering, and it has three consequences that programmes routinely underestimate.

The sensor becomes safety-critical. A control loop is only as good as its measurement. A thermocouple with poor thermal contact, a drifting impedance measurement, or a saturating amplifier will drive the loop confidently in the wrong direction. Sensor fault detection — plausibility checks, redundancy, rate-of-change limits — becomes a primary safety requirement rather than a nicety.

The software becomes higher-classification. Under IEC 62304, software safety classification is determined by the hazard that can result from software failure, after considering hardware risk controls. Control software that can cause over-delivery of energy is Class C in most analyses, which imposes the full documentation set: software architecture, detailed design, unit verification, integration testing, and a formally managed anomaly list.

Independent protection becomes mandatory. A control loop and its own safety limit sharing a processor, a sensor, or a power supply is a common-cause failure waiting to happen. The conventional architecture separates the control function from an independent protective function — a hardware watchdog, an independent temperature cut-out, a separate energy-limiting circuit — so that no single fault both causes and conceals the hazard.

Under-Delivery Is a Hazard, and Risk Files Frequently Miss It

ISO 14971:2019 defines harm as injury or damage to health. Most therapeutic device risk analyses populate readily with over-delivery hazards: burns, perforation, excessive stimulation, overdose. These are visible, attributable, and reportable.

Under-delivery is harder to see and just as real. A patient who receives an incomplete ablation and requires a repeat procedure has been harmed by an additional anaesthetic exposure and an additional procedural risk. A patient whose therapy silently fails has been harmed by the untreated progression of their condition.

A useful discipline is to require, for every therapeutic function, an explicit hazard entry for "therapy not delivered" and "therapy delivered at insufficient intensity," and to demand risk controls for both — typically delivery confirmation, treatment logging, and unambiguous user feedback about whether the therapy actually occurred.

The related design question is what the device does when it cannot deliver safely. Silent degradation is the worst answer. The device should either deliver correctly or stop and say so.

Simulation Earns Its Place Here, With Caveats

Thermal and electrical field problems are among the strongest cases for computational modelling in device development, because the internal state is difficult or impossible to measure directly during treatment and the parameter space is too large to explore experimentally.

Bioheat transfer modelling — from the Pennes formulation onward — allows exploration of electrode geometry, power protocols, and perfusion sensitivity before hardware exists. Population-based modelling, varying tissue properties across physiologically plausible ranges, converts a nominal design into one with characterised margins.

Two caveats matter. First, input quality dominates solver sophistication: tissue thermal conductivity, perfusion rate, and electrical conductivity are the largest uncertainty sources in most bioheat models, and sensitivity analysis should determine where to invest in better data. Second, model credibility must be established proportionate to the decision it supports. ASME V&V 40 provides the framework — a model informing early design exploration requires far less rigour than one supporting a regulatory safety claim, and treating them identically is either wasteful or insufficient.

Where Therapeutic Device Programmes Break Down

Bench validation in tissue phantoms with the wrong properties. Agar phantoms are convenient and thermally unlike perfused tissue. Ex vivo tissue lacks perfusion, which is often the dominant heat sink. Neither predicts in vivo behaviour reliably; both are useful for different questions if their limitations are stated.

Treating the worst case as maximum power. The worst case for over-delivery is maximum power into low-perfusion tissue. The worst case for under-delivery is minimum effective power into high-perfusion tissue with poor contact. Both need testing, and only the first is usually planned.

Alarm design that trains users to ignore alarms. A device that alarms frequently for non-actionable conditions produces alarm fatigue, and the alarm that matters is then missed. Alarm design under IEC 60601-1-8 should be driven by the question of what the user is expected to do, not by what the device is capable of detecting.

No treatment record. Where a therapy is invisible to the naked eye, a device that does not log what it delivered leaves the clinician unable to distinguish therapy failure from disease progression, and leaves the manufacturer unable to investigate a complaint.

Human factors deferred. For a device where the clinician chooses a setting that maps non-obviously to a physiological effect, the interface is part of the dosimetry. IEC 62366-1 use-related risk analysis belongs at design input, not at summative evaluation.

The Framing That Helps

A therapeutic device is a control system whose plant is a patient. The design task is not to deliver a setting; it is to deliver an effect through a variable, partially observable, patient-specific channel — and to know, and tell the user, when it has failed to do so.

Teams that hold that framing tend to instrument their devices better, close their loops earlier, and write risk files that include the failure modes that actually occur.

RhythmRx develops therapeutic and monitoring devices for cardiac applications, including closed-loop delivery architectures, sensor fault management, and computational modelling of tissue interaction.

VSVikram Sethi is a Senior Systems Engineer at RhythmRx, working on closed-loop therapy delivery, sensor fault management and computational modelling of device–tissue interaction.

Sources

1. 1.Sapareto SA, Dewey WC — thermal dose formulation; CEM43 model. Reviewed in Considerations for Thermal Injury Analysis for RF Ablation Devices, PMC.
2. 2.Quantitative comparison of thermal dose models in normal canine brain — CEM43 = 240 min, Arrhenius Ω = 1, T = 57 °C parameters.
3. 3.Thermal Profiles for Focal Pulsed Electric Field Ablation, JACC: Clinical Electrophysiology — RF at 30 W/30 s with 17 mL/min irrigation, peak surface temperature rise 16.6 ± 7.6 °C.
4. 4.Thermal Ablation: A Comparison of Thermal Dose Required for Radiofrequency-, Microwave-, and Laser-Induced Coagulation in an Ex Vivo Bovine Liver Model.
5. 5.IEC 62304; IEC 60601-1; IEC 60601-1-8 (alarm systems); IEC 62366-1:2015+A1:2020; ISO 14971:2019; ASME V&V 40.