Design controls and the design history file
What the FDA requires of every device developer: user needs, requirements, design, verification, validation, and the record of all of it. Write a mock design history file for your project and you will sound like a third-year employee.
On this page14 min
Every medical device company in the world runs the same process, because the FDA’s quality system regulation (and its international twin, ISO 13485ISO 13485 The quality management standard for medical device companies; the reason everything is written down. Glossary entry) requires it. Design controlsDesign controls FDA's required process for developing a medical device: user needs, requirements, design, verification, validation, and the records of all of it. Related: Design history file (DHF)Design history file (DHF) The complete record of how a device was designed, showing every requirement traced to a test; writing a mock one teaches more than any lecture., RequirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz.", VerificationVerification Testing that the device meets its requirements; did you build what you specified., ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing.. Glossary entry is that process: a chain from what the user needs to what the device must do to what was built to the proof that it works, with every link written down. The written record is the design history fileDesign history file (DHF) The complete record of how a device was designed, showing every requirement traced to a test; writing a mock one teaches more than any lecture. Related: Design controlsDesign controls FDA's required process for developing a medical device: user needs, requirements, design, verification, validation, and the records of all of it.. Glossary entry. Almost no undergraduate has produced one. Produce a mock one for your Phase 5 project and you will have done the thing every device engineer does every day.
The chain
User needs. What the person needs, in their terms. From the need statementNeed statement One sentence, "a way to [do X] for [whom] that [outcome]," with no solution in it. Related: Needs findingNeeds finding Observing clinical work to catch the moments that are slow, awkward, or unsafe, before proposing any solution. . Glossary entry and the interviews. “The user must be able to send a pre-set urgent message without caregiver help.”
Design inputs (requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry). Testable statements of what the device must do to meet the needs. “The urgent-message selection shall complete within 10 seconds of the user’s initiating gesture in 95 percent of attempts.” “Input-referred noise shall be below 2 µV RMS from 0.5 to 40 Hz.” Each requirement traces back to a need and forward to a test. If you cannot write the test, it is not a requirement yet.
Design outputs. The device itself, described: schematics, code, drawings, the bill of materials, labelling, the user guide. What you built.
VerificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry. Testing that the outputs meet the inputs: did you build what you specified? Your characterizationCharacterization Measuring what your instrument actually does, such as its noise floor, bandwidth, and rejection, instead of assuming the datasheet. Related: Noise floorNoise floor What your instrument records when the input is shorted or connected to a perfectly quiet source; everything smaller than this is invisible to you. , PhantomPhantom A physical stand-in for tissue, such as saline gelatin with embedded wires, used to test an instrument against known signals. , Common-mode rejection ratio (CMRR)Common-mode rejection ratio (CMRR) How much better an amplifier responds to a difference between its inputs than to a signal shared by both, in decibels; 100 dB means 100,000 times. . Glossary entry report from Phase 2 is a verificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry document. “Measured noise 1.1 µV RMS: requirement met.”
ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry. Testing that the device meets the user needs in real or simulated use: did you specify the right thing? The person with ALSAmyotrophic lateral sclerosis (ALS) A progressive disease of motor neurons that removes movement and eventually speech while leaving thought intact; the population many BCIs are built for. Related: Locked-in syndromeLocked-in syndrome Full awareness with almost no voluntary movement, sometimes only the eyes; communication depends entirely on assistive technology. , Augmentative and alternative communication (AAC)Augmentative and alternative communication (AAC) Any tool that helps someone who cannot speak communicate, from picture boards to eye-gaze spellers to BCIs. . Glossary entry sending the urgent message in their bedroom, timed, is validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry. VerificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry can pass while validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry fails, when the requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry were wrong.
Design review. Formal points where people who did not build it look at everything above and sign.
Design transfer. Moving from prototype to production, with the documents that let someone else make it.
Design changes. Every change after the first review, with why, and what re-testing it triggered.
Your amplifier passes every requirement in the spec. The user cannot use the device because the electrodes take twenty minutes to apply and their caregiver has ten. Which step failed?
ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry, and before that, user needs and design inputs. The device does what it was specified to do (verificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry passed). It does not meet the need (validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry failed), because the requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry never included setup time. This is the most common way devices fail in the field and the reason validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry is a separate step done with real users.
Traceability
The heart of the file is a matrix: each user need, the requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry that address it, the design outputs that implement them, the verificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry tests that prove them, and the validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry evidence. A reviewer, or the FDA, picks any row and follows it end to end. Build the matrix as a spreadsheet from day one; retrofitting it is the misery every startup goes through.
Your mock DHF
For the Phase 5 project, one document with these sections: user needs (from your interviews), design inputs (ten to twenty testable requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry), design outputs (links to your schematics, code, and drawings), risk management (the FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry from the next explainer), verificationVerification Testing that the device meets its requirements; did you build what you specified. Related: ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry (your characterizationCharacterization Measuring what your instrument actually does, such as its noise floor, bandwidth, and rejection, instead of assuming the datasheet. Related: Noise floorNoise floor What your instrument records when the input is shorted or connected to a perfectly quiet source; everything smaller than this is invisible to you. , PhantomPhantom A physical stand-in for tissue, such as saline gelatin with embedded wires, used to test an instrument against known signals. , Common-mode rejection ratio (CMRR)Common-mode rejection ratio (CMRR) How much better an amplifier responds to a difference between its inputs than to a signal shared by both, in decibels; 100 dB means 100,000 times. . Glossary entry and bench tests, with pass/fail against each requirement), validationValidation Testing that the device meets the user's need in real use; did you specify the right thing. Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry (your sessions with the person, with measurements), a design review record (a friend and a mentor read it and signed), and a change log. Twenty pages. It is the most impressive thing a student can bring to a device-company interview, because it shows you know what the job is.
Deep dive Why the regulation exists 2 min
The design controlsDesign controls FDA's required process for developing a medical device: user needs, requirements, design, verification, validation, and the records of all of it. Related: Design history file (DHF)Design history file (DHF) The complete record of how a device was designed, showing every requirement traced to a test; writing a mock one teaches more than any lecture. , RequirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." , VerificationVerification Testing that the device meets its requirements; did you build what you specified. , ValidationValidation Testing that the device meets the user's need in real use; did you specify the right thing. . Glossary entry requirement dates from 1996 and followed a decade of recallsRecall A correction or removal of a marketed device; FDA's public database of them is a catalogue of how designs fail people. Glossary entry traced to design rather than manufacturing: infusion pumps with confusing interfaces, radiation therapy machines with software errors, the Therac-25 deaths. The regulation’s premise is that a device designed without a documented, reviewed process will fail in ways nobody anticipated, and that the fix is process, not genius. It is a good premise, and the recallRecall A correction or removal of a marketed device; FDA's public database of them is a catalogue of how designs fail people. Glossary entry database is the evidence.
Deep dive Software as a device 3 min
If your decoderDecoder The algorithm that maps neural signals to intended actions, such as a classifier or a Kalman filter. Related: ClassifierClassifier An algorithm that assigns each trial a label, such as left hand or right hand, after being trained on labelled examples. , Kalman filterKalman filter An estimator that blends a prediction from a motion model with a noisy measurement, weighting each by how much it trusts it; the decoder behind most intracortical cursor control. , Brain-computer interface (BCI)Brain-computer interface (BCI) A system that turns measured brain activity into control of something outside the body, from a cursor to a wheelchair to a speech synthesizer. . Glossary entry runs on a laptop, the software is the device or part of it, and IEC 62304 governs its lifecycle: requirementsRequirements Testable statements of what the device must do, such as "input-referred noise below 1 microvolt RMS from 0.5 to 40 Hz." Related: VerificationVerification Testing that the device meets its requirements; did you build what you specified. . Glossary entry, architecture, unit and integration testing, version control, and a record of every known bug and whether it was fixed. Machine-learning models add the question of how a model that was trained on data is verified; the FDA’s guidance on this is evolving and worth reading once. A Git repository with tests and tagged releases is most of the way to compliance for a student project.
Explain what this page was about to your roommate in three sentences. No jargon they would not know.
We start from what the person must do, such as sending an urgent message within 10 seconds in 95 percent of tries, and we write each need into testable device requirements such as keeping input noise below 2 microvolts from 0.5 to 40 hertz. We then check the built device against the requirements on the bench and check it against the needs with the person in the bedroom, since passing the bench test still fails if setup takes 20 minutes and the helper has 10. We link every need to its requirement, build record, bench test, and bedroom test in one table so any row can be followed end to end.
Yours does not have to match. Check that the three ideas are there.