Risk management and the FMEA
ISO 14971 and the failure mode and effects analysis. Every way the device could fail, how bad, how likely, what you did about it, and whether that was enough. Written before the first live test, revised after every one.
The electrical safety page asked “what if one thing breaks” about a resistor. Risk management asks it about everything, in a table, with numbers, and then asks whether what you did about each one was enough. ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. Related: FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it.. Glossary entry is the standard every device company follows; the FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows.. Glossary entry is its most common tool. Writing one for a wheelchair controller before the first live test is not paperwork. It is the difference between a person and a wall.
The table
One row per failure mode. Columns:
Function the part of the device is supposed to perform. “Detect stop gesture.” Failure mode: the way it fails. “Fails to detect stop.” “Detects stop when none was made.” “Detects stop 2 seconds late.” Effect on the person. “Wheelchair continues into obstacle.” “Chair stops in the middle of a crossing.” Severity of that effect, 1 to 5 (or 1 to 10): 1 is annoyance, 5 is death or permanent injury. Cause: why it happens. “EMGElectromyography (EMG) Recording the electrical activity of muscles, hundreds of microvolts to millivolts, much larger than EEG. Related: Myoelectric prosthesisMyoelectric prosthesis An artificial limb controlled by EMG from the remaining muscles. , Electroencephalography (EEG)Electroencephalography (EEG) Recording the brain's electrical activity from electrodes on the scalp, a few tens of microvolts of blurred, summed cortical activity. . Glossary entry electrodeElectrode The conductor that turns ion currents in tissue into electron currents in a wire; its chemistry and contact quality set the noise you live with. Related: Silver/silver-chloride (Ag/AgCl)Silver/silver-chloride (Ag/AgCl) The standard electrode material for biopotentials, because its chemistry produces a stable, low-noise, low-drift interface with salty gel. , Electrode impedanceElectrode impedance How hard it is to push current through the skin-electrode contact, typically 5 to 50 kilohms with gel and megohms dry, higher at low frequencies. , Half-cell potentialHalf-cell potential The DC voltage that appears wherever a metal meets an electrolyte; two electrodes with different half-cell potentials produce an offset that can swamp the signal. . Glossary entry lifted.” “ClassifierClassifier An algorithm that assigns each trial a label, such as left hand or right hand, after being trained on labelled examples. Related: Linear discriminant analysis (LDA)Linear discriminant analysis (LDA) A simple, robust classifier that draws a straight boundary between classes; the workhorse of EEG decoding for two decades. , Support vector machine (SVM)Support vector machine (SVM) A classifier that finds the boundary with the widest margin between classes; strong on small datasets. , Cross-validationCross-validation Testing a model on data it never saw during training, repeatedly, so the reported accuracy means something. . Glossary entry threshold drifted with fatigue.” Occurrence: how likely, 1 to 5. Detection: how likely it is to be caught before harm, 1 (certain) to 5 (undetectable). Risk priority: the product of the three, or in ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. Related: FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. . Glossary entry’s simpler form, severity times occurrence placed on a matrix with an acceptable region. Mitigation: what you did. “Hardware dead-man switch; speed limited to 0.5 m/s in software and by the chair’s profile; impedance check every minute with an audible alarm on electrodeElectrode The conductor that turns ion currents in tissue into electron currents in a wire; its chemistry and contact quality set the noise you live with. Related: Silver/silver-chloride (Ag/AgCl)Silver/silver-chloride (Ag/AgCl) The standard electrode material for biopotentials, because its chemistry produces a stable, low-noise, low-drift interface with salty gel. , Electrode impedanceElectrode impedance How hard it is to push current through the skin-electrode contact, typically 5 to 50 kilohms with gel and megohms dry, higher at low frequencies. , Half-cell potentialHalf-cell potential The DC voltage that appears wherever a metal meets an electrolyte; two electrodes with different half-cell potentials produce an offset that can swamp the signal. . Glossary entry lift.” Residual risk: severity and occurrence after mitigation. Is it now in the acceptable region? If not, more mitigation or the design changes.
After mitigation, a failure mode is still severity 5 (could cause serious injury) but occurrence 1 (very unlikely). Is the design acceptable?
Only if the benefit justifies it, in writing. ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. Related: FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. . Glossary entry does not forbid residual risk; it requires that each be reduced as far as practicable, that the overall residual risk be weighed against the device’s benefit, and that the reasoning be documented. A wheelchair controller that gives someone independence carries a residual risk of collision that a commercial joystick also carries; the analysis says why yours is no worse and what you did. Pretending the risk is zero is the unacceptable answer.
Mitigations, in order of strength
Inherent safety by design. Remove the hazard: the device physically cannot deliver more than 25 µA (the resistor); the chair cannot exceed walking speed (the drive profile). Strongest, because it does not depend on anything working.
Protective measures. Detect and act: an impedance alarm, a watchdog that stops the chair if the controller stops sending heartbeats, a kill switch.
Information for safety. Warnings, labels, training. Weakest, because people do not read them. Required anyway.
An FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry whose mitigations are mostly warnings is a device that is not safe.
When to write it
Before the first test with a person, as a draft, from imagination and from the recallRecall A correction or removal of a marketed device; FDA's public database of them is a catalogue of how designs fail people. Glossary entry database. After every session, revised with what actually happened: the failure you did not think of, the mitigation that did not work. At the end, as a record. Companies treat it as a living document for the life of the product, updated with every field complaint.
Learning from recalls
The FDA maintains a public database of device recallsRecall A correction or removal of a marketed device; FDA's public database of them is a catalogue of how designs fail people. Glossary entry with the reason for each. Read ten from your device’s category. Insulin pumps that delivered the wrong dose because of a confusing screen; monitors whose alarms were silenced; stimulators that delivered current when a lead broke. Each one is a failure mode someone did not put in their table. Put them in yours.
Deep dive Use-related risk 3 min
Many failure modes are not the device breaking; they are the device being used wrongly in a way the design invited: a connector that fits two sockets, a button that means stop in one mode and go in another, a caregiver skipping a step because it is not obvious. IEC 62366IEC 62366 The standard for usability engineering of medical devices, aimed at preventing use errors. Related: Human factorsHuman factors Designing so the device fits how people actually behave, especially under stress and fatigue, so that errors are hard to make., Use errorUse error A mistake made while using a device that the design invited, as opposed to random user carelessness.. Glossary entry, usability engineering, exists to find these, and the next explainer is about it. In the FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry, use errorsUse error A mistake made while using a device that the design invited, as opposed to random user carelessness. Related: Human factorsHuman factors Designing so the device fits how people actually behave, especially under stress and fatigue, so that errors are hard to make. . Glossary entry get their own rows, and their mitigations are almost always design changes rather than warnings.
Deep dive Fault tree analysis, the other direction 2 min
FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry works forward from each component failure to its effect. Fault tree analysis works backward from a top-level harm (“person injured by wheelchair”) through the combinations of events that could cause it, with AND and OR gates. It finds combinations FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry misses (two individually harmless failures that together are fatal). For a student project, an FMEAFMEA Failure mode and effects analysis: a table of every way the device could fail, how bad and how likely each is, and what you did about it. Related: ISO 14971ISO 14971 The international standard for medical device risk management that every company follows. . Glossary entry plus one fault tree for the worst harm is thorough.
Explain what this page was about to your roommate in three sentences. No jargon they would not know.
We list every way our device could fail in a table with severity scored 1 to 5, plus how likely it is and how likely we catch it before harm. We fix risks strongest first by removing the hazard by design, such as limiting current to 25 microA or chair speed to half a meter per second, then by adding alarms or a stop switch, and last by adding warnings. We write the table before the first test with a person and we update it after every session because new failures always appear.
Yours does not have to match. Check that the three ideas are there.