Presentation: A Perspective On Medical Device Risk Management

Center for Devices and Radiological Health, U.S. Food and Drug Administration

FDA Home Page | CDRH Home Page | Search | CDRH A-Z Index | Contact CDRH
horizonal rule

Presentation: A PerspectiveOnMedical Device Risk Management - William Midgette

Heart Rhythm Society
Washington, D.C.
September 16, 2005

Two Common Approaches to Analyzing Risk

Bottom-up (inductive, e.g., Failure Mode and Effects Analysis) versus top-down (deductive, e.g. Fault Tree Analysis)
Bottom-up – induce a failure and determine the harm it can cause
Top-down – select an undesired top-level event and identify the faults that can cause it

Fault-Tree Analysis

Requires the selection of an undesired top-level event, e.g, life-saving shock not delivered for an ICD
The analysis should identify all faults that can cause the event
Risk control measures should be included in the analysis

Risk Control Measures

Protective measures, e.g. default operating modes
Information for safety, e.g., warnings in labeling
Many measures require intervention
- The correct response for the circumstances, e.g. a patient-specific response
- Timeliness

Hazardous Situations

Circumstances in which people are exposed to a potential source of harm
Examples of ICD Hazardous Situations
- Life-saving shock not delivered
- Pacing therapy not delivered
Usually require a “system” of risk control measures

Hazardous Situation and Causes

Logic flow chart. Boses marked causes one through four connect to a single OR gate.

Hazardous Situations, Causes, and Control Measures

Logic flow chart. Causes 2, 3 and 4 go into an OR gate, which connects to an AND gate (that also connects to Cntr.Msr. #2, #2, #4 Fails). That AND gate connects to a final OR gate, which is also connected to a different AND gate that connects Cause #1 and Control Measure #1 Fails.

Simplified Example: Part of the Risk Control System for a Hazardous Situation

Logic flow chart. Title reads "Dialysis System - Air Embolism > 0.4mm Enters Blood Stream." Alarm failure and sensor failure flow into an OR gate marked "No Intervention," which connects to a final OR gate. That gate also is connected to an OR gate marked "Incorrect Intervention," which connects to inadequate training and confusing instructions.