Risk management and the FMEA
ISO 14971 and the failure mode and effects analysis. Every way the device could fail, how bad, how likely, what you did about it, and whether that was enough. Written before the first live test, revised after every one.
You are skimming: the title, the first figure, and the short version. Switch to Read in the header for the full page, or Deep to open every deep dive.
The electrical safety page asked “what if one thing breaks” about a resistor. Risk management asks it about everything, in a table, with numbers, and then asks whether what you did about each one was enough. ISO 14971ISO 14971The international standard for medical device risk management that every company follows. Glossary entry is the standard every device company follows; the FMEAFMEAFailure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Glossary entry is its most common tool. Writing one for a wheelchair controller before the first live test is not paperwork. It is the difference between a person and a wall.
The table
One row per failure mode. Columns:
Function the part of the device is supposed to perform. “Detect stop gesture.” Failure mode: the way it fails. “Fails to detect stop.” “Detects stop when none was made.” “Detects stop 2 seconds late.” Effect on the person. “Wheelchair continues into obstacle.” “Chair stops in the middle of a crossing.” Severity of that effect, 1 to 5 (or 1 to 10): 1 is annoyance, 5 is death or permanent injury. Cause: why it happens. “EMG electrode lifted.” “Classifier threshold drifted with fatigue.” Occurrence: how likely, 1 to 5. Detection: how likely it is to be caught before harm, 1 (certain) to 5 (undetectable). Risk priority: the product of the three, or in ISO 14971’s simpler form, severity times occurrence placed on a matrix with an acceptable region. Mitigation: what you did. “Hardware dead-man switch; speed limited to 0.5 m/s in software and by the chair’s profile; impedance check every minute with an audible alarm on electrode lift.” Residual risk: severity and occurrence after mitigation. Is it now in the acceptable region? If not, more mitigation or the design changes.
After mitigation, a failure mode is still severity 5 (could cause serious injury) but occurrence 1 (very unlikely). Is the design acceptable?
Only if the benefit justifies it, in writing. ISO 14971 does not forbid residual risk; it requires that each be reduced as far as practicable, that the overall residual risk be weighed against the device’s benefit, and that the reasoning be documented. A wheelchair controller that gives someone independence carries a residual risk of collision that a commercial joystick also carries; the analysis says why yours is no worse and what you did. Pretending the risk is zero is the unacceptable answer.
Mitigations, in order of strength
Inherent safety by design. Remove the hazard: the device physically cannot deliver more than 25 µA (the resistor); the chair cannot exceed walking speed (the drive profile). Strongest, because it does not depend on anything working.
Protective measures. Detect and act: an impedance alarm, a watchdog that stops the chair if the controller stops sending heartbeats, a kill switch.
Information for safety. Warnings, labels, training. Weakest, because people do not read them. Required anyway.
An FMEA whose mitigations are mostly warnings is a device that is not safe.
When to write it
Before the first test with a person, as a draft, from imagination and from the recall database. After every session, revised with what actually happened: the failure you did not think of, the mitigation that did not work. At the end, as a record. Companies treat it as a living document for the life of the product, updated with every field complaint.
Learning from recalls
The FDA maintains a public database of device recalls with the reason for each. Read ten from your device’s category. Insulin pumps that delivered the wrong dose because of a confusing screen; monitors whose alarms were silenced; stimulators that delivered current when a lead broke. Each one is a failure mode someone did not put in their table. Put them in yours.
Deep dive Use-related risk 3 min
Many failure modes are not the device breaking; they are the device being used wrongly in a way the design invited: a connector that fits two sockets, a button that means stop in one mode and go in another, a caregiver skipping a step because it is not obvious. IEC 62366IEC 62366The standard for usability engineering of medical devices, aimed at preventing use errors. Glossary entry, usability engineering, exists to find these, and the next explainer is about it. In the FMEA, use errors get their own rows, and their mitigations are almost always design changes rather than warnings.
Deep dive Fault tree analysis, the other direction 2 min
FMEA works forward from each component failure to its effect. Fault tree analysis works backward from a top-level harm (“person injured by wheelchair”) through the combinations of events that could cause it, with AND and OR gates. It finds combinations FMEA misses (two individually harmless failures that together are fatal). For a student project, an FMEA plus one fault tree for the worst harm is thorough.
Explain what this page was about to your roommate in three sentences. No jargon they would not know.