您的当前位置：首页 AAMI IEC 62366;1_1503 2015

AAMI IEC 62366;1_1503 2015

来源：欧得旅游网

ANSI/AAMI/IEC 62366-1:2015

Medical devices – Part 1: Application of

usability engineering to medical devices

It is most important that the objectives and potential uses of an AAMI product standard or recommended practice are clearly understood. The objectives of AAMI's technical development program derive from AAMI's overall mission: the advancement of medical instrumentation. Essential to such advancement are (1) a continued increase in the safe and effective application of current technologies to patient care, and (2) the encouragement of new technologies. It is AAMI's view that standards and recommended practices can contribute significantly to the advancement of medical instrumentation, provided that they are drafted with attention to these objectives and provided that arbitrary and restrictive uses are avoided.

A voluntary standard for a medical device recommends to the manufacturer the information that should be provided with or on the product, basic safety and performance criteria that should be considered in qualifying the device for clinical use, and the measurement techniques that can be used to determine whether the device conforms with the safety and performance criteria and/or to compare the performance characteristics of different products. Some standards emphasize the information that should be provided with the device, including performance characteristics, instructions for use, warnings and precautions, and other data considered important in ensuring the safe and effective use of the device in the clinical environment. Recommending the disclosure of performance characteristics often necessitates the development of specialized test methods to facilitate uniformity in reporting; reaching consensus on these tests can represent a considerable part of committee work. When a drafting committee determines that clinical concerns warrant the establishment of minimum safety and performance criteria, referee tests must be provided and the reasons for establishing the criteria must be documented in the rationale.

A recommended practice provides guidelines for the use, care, and/or processing of a medical device or system. A recommended practice does not address device performance per se, but rather procedures and practices that will help ensure that a device is used safely and effectively and that its performance will be maintained.

Although a device standard is primarily directed to the manufacturer, it may also be of value to the potential purchaser or user of the device as a frame of reference for device evaluation. Similarly, even though a recommended practice is usually oriented towards healthcare professionals, it may be useful to the manufacturer in better understanding the environment in which a medical device will be used. Also, some recommended practices, while not addressing device performance criteria, provide guidelines to industrial personnel on such subjects as sterilization processing, methods of collecting data to establish safety and efficacy, human engineering, and other processing or evaluation techniques; such guidelines may be useful to health care professionals in understanding industrial practices.

In determining whether an AAMI standard or recommended practice is relevant to the specific needs of a potential user of the document, several important concepts must be recognized:

All AAMI standards and recommended practices are voluntary (unless, of course, they are adopted by government regulatory or procurement authorities). The application of a standard or recommended practice is solely within the discretion and professional judgment of the user of the document.

Each AAMI standard or recommended practice reflects the collective expertise of a committee of health care professionals and industrial representatives, whose work has been reviewed nationally (and sometimes internationally). As such, the consensus recommendations embodied in a standard or recommended practice are intended to respond to clinical needs and, ultimately, to help ensure patient safety. A standard or recommended practice is limited, however, in the sense that it responds generally to perceived risks and conditions that may not always be relevant to specific situations. A standard or recommended practice is an important reference in responsible decision-making, but it should never replace responsible decision-making.

Despite periodic review and revision (at least once every five years), a standard or recommended practice is necessarily a static document applied to a dynamic technology. Therefore, a standards user must carefully review the reasons why the document was initially developed and the specific rationale for each of its provisions. This review will reveal whether the document remains relevant to the specific needs of the user.

Particular care should be taken in applying a product standard to existing devices and equipment, and in applying a recommended practice to current procedures and practices. While observed or potential risks with existing equipment typically form the basis for the safety and performance criteria defined in a standard, professional judgment must be used in applying these criteria to existing equipment. No single source of information will serve to identify a particular product as \"unsafe\". A voluntary standard can be used as one resource, but the ultimate decision as to product safety and efficacy must take into account the specifics of its utilization and, of course, cost-benefit considerations. Similarly, a recommended practice should be analyzed in the context of the specific needs and resources of the individual institution or firm. Again, the rationale accompanying each AAMI standard and recommended practice is an excellent guide to the reasoning and data underlying its provision.

In summary, a standard or recommended practice is truly useful only when it is used in conjunction with other sources of information and policy guidance and in the context of professional experience and judgment.

INTERPRETATIONS OF AAMI STANDARDS AND RECOMMENDED PRACTICES

Requests for interpretations of AAMI standards and recommended practices must be made in writing, to the AAMI Vice President, Standards Policy and Programs. An official interpretation must be approved by letter ballot of the originating committee and subsequently reviewed and approved by the AAMI Standards Board. The interpretation will become official and representation of the Association only upon exhaustion of any appeals and upon publication of notice of interpretation in the \"Standards Monitor\" section of the AAMI News. The Association for the Advancement of Medical Instrumentation disclaims responsibility for any characterization or explanation of a standard or recommended practice which has not been developed and communicated in accordance with this procedure and which is not published, by appropriate notice, as an official interpretation in the AAMI News.

ANSI/AAMI/IEC 62366-1:2015

(Partial revision of ANSI/AAMI/IEC 62366:2007(R)2013)

Medical devices – Part 1: Application of usability engineering to medical devices

Approved 6 February 2015 by

Association for the Advancement of Medical Instrumentation Approved 23 February 2015 by

American National Standards Institute

Abstract:

This document specifies a process for a manufacturer to analyze, specify, develop and evaluate the usability of a medical device as it relates to safety. This usability engineering (human factors engineering) process permits the manufacturer to assess and mitigates risks associated with correct use and use errors, i.e., normal use. It can be used to identify but does not assess or mitigate risks associated with abnormal use.

human factors engineering, ergonomics, human factors, usability

Keywords:

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.

Published by

Association for the Advancement of Medical Instrumentation 4301 N Fairfax Drive, Suite 301 Arlington, VA 22203-1633 www.aami.org

Publication, reproduction, photocopying, storage, or transmission, electronically or otherwise, of all or any part of this document without the prior written permission of the Association for the Advancement of Medical Instrumentation is strictly prohibited by law. It is illegal under federal law (17 U.S.C. § 101, et seq.) to make copies of all or any part of this document (whether internally or externally) without the prior written permission of the Association for the Advancement of Medical Instrumentation. Violators risk legal action, including civil and criminal penalties, and damages of $100,000 per offense. For permission regarding the use of all or any part of this document, contact AAMI at 4301 N. Fairfax Drive, Suite 301, Arlington, VA 22203-1633. Phone: (703) 525-40; Fax: (703) 525-1067.

Printed in the United States of America ISBN 1-57020-584-1

Page

Glossary of equivalent standards ........................................................................................................ iv Committee representation ................................................................................................................... v Background of ANSI/AAMI adoption of IEC 62366-1:2015 ................................................................... vii Foreword .......................................................................................................................................... viii Introduction......................................................................................................................................... x 1 2 3 4

Scope ......................................................................................................................................... 1 Normative references .................................................................................................................. 1 Terms and definitions .................................................................................................................. 1 Principles .................................................................................................................................... 6 4.1 4.2 4.3 5

5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 5.9 5.10

General requirements ........................................................................................................ 6 USABILITY ENGINEERING FILE ................................................................................................. 7 Tailoring of the USABILITY ENGINEERING effort ....................................................................... 7 Prepare USE SPECIFICATION.................................................................................................. 7 Identify USER INTERFACE characteristics related to SAFETY and potential USE ERRORS ............. 8 Identify known or foreseeable HAZARDS and HAZARDOUS SITUATIONS ...................................... 8 .......................................................... 8 Identify and describe HAZARD-RELATED USE SCENARIOS

Select the HAZARD-RELATED USE SCENARIOS for SUMMATIVE EVALUATION ................................... 9 Establish USER INTERFACE SPECIFICATION .............................................................................. 9 Establish USER INTERFACE EVALUATION plan .......................................................................... 9 Perform USER INTERFACE design, implementation and FORMATIVE EVALUATION ...................... 11 Perform SUMMATIVE EVALUATION of the USABILITY of the USER INTERFACE ............................... 11 USER INTERFACE OF UNKNOWN PROVENANCE ......................................................................... 12

USABILITY ENGINEERING PROCESS ................................................................................................... 7

Annex A (informative) General guidance and rationale ...................................................................... 13 Annex B (informative) Examples of possible HAZARDOUS SITUATIONS related to USABILITY ...................... 29 Annex C (normative) Evaluation of a USER INTERFACE OF UNKNOWN PROVENANCE (UOUP) ....................... 32 Annex D (informative) Types of MEDICAL DEVICE use, with examples ................................................... 34 Annex E (informative) Reference to the essential principles .............................................................. 36 Bibliography ...................................................................................................................................... 37 Index of defined terms ....................................................................................................................... 39

International Standards adopted in the United States may include normative references to other International Standards. For each International Standard that has been adopted by AAMI (and ANSI), the table below gives the corresponding U.S. designation and level of equivalency to the International Standard. NOTE: Documents are sorted by international designation. The code in the US column, “(R)20xx” indicates the year the document was officially reaffirmed by AAMI. E.g., ANSI/AAMI/ISO 10993-4:2002/(R)2009 indicates that 10993-4, originally approved and published in 2002, was reaffirmed without change in 2009.

Other normatively referenced International Standards may be under consideration for U.S. adoption by AAMI; therefore, this list should not be considered exhaustive. www.aami.org/standards/glossary.pdf

Association for the Advancement of Medical Instrumentation

Human Factors Engineering Committee

The adoption of IEC 62366-1 as an American National Standard was initiated by the AAMI Human Factors Engineering Committee (HE). AAMI HE functions as a U.S. sub-Technical Advisory Group to the relevant work in the International Electrotechnical Commission (IEC). U.S. representatives from AAMI HE played a very active part in developing the IEC standard.

At the time this document was published, the AAMI Human Factors Engineering Committee had the following members:

Cochairs: Mary Beth Privitera, University of Cincinnati

Janine A. Purcell, MS, Philips Electronics North America

Members: Tor Alden, BS MS, HS Design Inc

Araya Amsalu, PhD, Hill-Rom Holdings Nancy Bayer, Smiths Medical Prashant Bhadri, CareFusion

Sherri Biondi, PhD, Genentech Inc Peter Boge, Novo Nordisk

Richard Botney, MD, Oregon Health & Science University Bill Buresh, Draeger Medical Systems Inc

Ken Catchpole, Cedars-Sinai Medical Hospital Ron Charnock, Kwikpoint/Gaia LLC Ella Cozmi, Hospira Worldwide Inc Conor Curtin, Fresenius Medical Care

John M DeFoggi, DBA, Business Process & Technology Management LLC (BPTM) Serge Dubeau, Worrell Inc Ronak Dunung, Cook Inc

Kathi Durdon, Welch Allyn Inc

Evan T. Edwards, BSME MSSE, Kaleo Inc.

Rollin J. Fairbanks, MD MS, MedStar Washington Hospital Center Valerie Fenster, Amgen Inc

Kristi Flury, Boston Scientific Corporation

Daryle Jean Gardner-Bonneau, PhD, Bonneau and Associates Rosemary Gonzales, Combination Product Partners Dan Haberstich, Johnson & Johnson R. Sean Hagen, BlackHagen Design Inc Diane Hayman, Spacelabs Medical Inc Wayne Ho, Healthcare Human Factors Dean A. Hooper, HE Consulting

Shannon M. Hoste, Stryker Instruments Division Edmond W. Israelski, PhD CHFP, Abbvie Carolynn Johnson, PhD, Daedalus Korey R. Johnson, MS, GFK

Mike Kasamanian, Human Factors Consulting Services Inc Ronald D. Kaye, FDA/CDRH

James Kershner, Eli Lilly & Company

Merrick F. Kossack, MS BS, Intuitive Surgical Inc Michael Lau, PhD, Insight Product Development Lee Leichter, P/L Biomedical

Melissa R. Lemke, MS, Agilis Consulting Group LLC

Svetlana Lowry, PhD, National Institute of Standards & Technology Jennifer Martin, PhD, The University of Nottingham Marsha McArthur, Integrated Medical Systems Cindy A. Miller, PhD, GE Healthcare Jeffrey C. Morang, MS, Ximedica

Mark Moyer, ASQ Biomedical Division William H. Muto, PhD, Abbott Laboratories

Dan Nathan-Roberts, University of Wisconsin (Madison)

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.Robert A. North, PhD, Human Centered Strategies Shawn O'Connell, MS, RN, B Braun of America Inc Joseph Pri-Paz, MSc, Laniado Hospital

Robert G. Radwin, PhD, University of Wisconsin Michael Rakauskas, Baxter Healthcare Corporation Tim Reeves, PhD CHFP, Human Factors MD Inc

Arathi Sethumadhavan, PhD, Medtronic Inc WHQ Campus Adam R. Shames, Core Human Factors Inc Mani Shanmugham, CR Bard Vijender Singh, Intertek Debora Stapleton, Covidien Molly F. Story, PhD, Sanofi

Robert C. Sugarman, PhD, RCS Performance Systems Inc Matt B. Weinger, MS MD, Vanderbilt University Medical Center Tracy Weldon, Halyard Health

Steven A. White, NxStage Medical Inc Michael E. Wiklund, PE CHFP, UL LLC

Stephen Wilcox, PhD, Design Science Consulting

Alternates:

Keith B. Anderson, BSEE, Smiths Medical

Eric D. Bergman, PhD, Fresenius Medical Care

Barry Berson, Human Factors Consulting Services Inc Paul A. Blowers, Abbvie

Joseph Cafazzo, Healthcare Human Factors Joe Cesa, BA, Halyard Health

Shannon Clark, Intuitive Surgical Inc Elise Edson, Covidien

Amy Gallenberg, GE Healthcare Stuart J. Garvin, Eli Lilly & Company Kimberley Gibson, Johnson & Johnson

Kristen Hastings, Boston Scientific Corporation

David H. Hoffmeister, Baxter Healthcare Corporation Cynthia Ann Lepak, RN, Welch Allyn Inc Natalia Mazaeva, Sanofi Wenhong Neoh, Cook Inc Jane Lea Smith, GFK

Kathy K. Smith, MSc, Human Factors MD Inc

Joan M. Spear, MBA RM CMPR, B Braun of America Inc Gerard Torenvliet, Medtronic Inc WHQ Campus Tom Varricchione, Ximedica

Sara Waxberg, Philips Electronics North America Julia Yeh, Amgen Inc

NOTE—Participation by federal agency representatives in the development of this document does not constitute endorsement by the federal government or any of its agencies. vi © 2015 Association for the Advancement of Medical Instrumentation ■ ANSI/AAMI/IEC 62366-1:2015

As indicated in the foreword to the main body of this document (page viii), the International Electrotechnical Commission (IEC) is a worldwide federation of national standards bodies. The United States is one of the IEC members that took an active role in the development of this standard, which was developed by IEC Technical Committee 62, Electrical equipment in medical practice, Subcommittee 62A, Common aspects of electrical equipment used in medical devices, to specify a process for a manufacturer to analyze, specify, develop and evaluate the usability of a medical device as it relates to safety.

U.S. participation in IEC/SC62A is organized through the U.S. Technical Advisory Group to IEC/SC62A, administered by the Association for the Advancement of Medical Instrumentation. Experts from the United States made a considerable contribution to this standard.

ANSI/AAMI/IEC 62366-1 was approved by the American National Standards Institute (ANSI) on 23 February 2015. AAMI and ANSI procedures require that standards be reviewed every five years and, if necessary, revised to reflect technological advances that may have occurred since publication.

AAMI (and ANSI) have adopted other IEC standards. See the Glossary of Equivalent Standards for a list of IEC standards adopted by AAMI, which gives the corresponding U.S. designation and the level of equivalency with the ISO standard.

As used within the context of this document, “shall” indicates requirements strictly to be followed to conform to the recommended practice. “Should” indicates that among several possibilities, one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action should be avoided but is not prohibited. “May” is used to indicate that a course of action is permissible within the limits of the recommended practice. “Can” is used as a statement of possibility and capability. Finally, “must” is used only to describe “unavoidable” situations, including those mandated by government regulation.

The concepts incorporated in this standard should not be considered inflexible or static. This standard, like any other, must be reviewed and updated periodically to assimilate progressive technological developments. To remain relevant, it must be modified as technological advances are made and as new data come to light.

Suggestions for improving this standard are invited. Comments and suggested revisions should be sent to Standards Department, AAMI, 4301 N. Fairfax Dr, Suite 301, Arlington, VA 22203-1633.

1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization

comprising all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmental and non-governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an

international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees. 3) IEC Publications have the form of recommendations for international use and are accepted by IEC

National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user. 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC

Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter. 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide

conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent certification bodies. 6) All users should ensure that they have the latest edition of this publication.

7) No liability shall attach to IEC or its directors, employees, servants or agents including individual

experts and members of its technical committees and IEC National Committees for any personal injury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications. 8) Attention is drawn to the Normative references cited in this publication. Use of the referenced

publications is indispensable for the correct application of this publication. 9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the

subject of patent rights. IEC shall not be held responsible for identifying any or all such patent rights. International Standard IEC 62366-1 has been prepared by a joint working group of subcommittee 62A: Common aspects of electrical medical equipment used in medical practice, of IEC technical committee 62: Electrical medical equipment in medical practice, and ISO technical committee 210: Quality management and corresponding general aspects for MEDICAL DEVICES. It is published as double logo standard.

This first edition of IEC 62366-1, together with the first edition of IEC 62366-2, cancels and replaces the first edition of IEC 62366 published in 2007 and its Amendment 1 (2014).

Part 1 has been updated to include contemporary concepts of USABILITY ENGINEERING, while also streamlining the process. It strengthens links to ISO 14971:2007 and the related methods of RISK MANAGEMENT as applied to SAFETY related aspects of medical device user interfaces. Part 2 contains tutorial information to assist manufactures in complying with Part 1, as well as offering more detailed descriptions of USABILITY ENGINEERING methods that can be applied more generally to MEDICAL DEVICES that go beyond safety-related aspects of MEDICAL DEVICE USER INTERFACES. The text of this standard is based on the following documents:

Report on voting 62A/988/RVD

Full information on the voting for the approval of this standard can be found in the report on voting indicated in the above table. In ISO, the standard has been approved by 26 P-members out of 26 having cast a vote.

This publication has been drafted in accordance with the ISO/IEC Directives, Part 2. In this International Standard, the following print types are used: – – – –

Requirements and definitions: roman type. Means to assess compliance: italic type.

Informative material appearing outside of tables, such as notes, examples and references: in smaller type. Normative text of tables is also in a smaller type TERMS DEFINED IN CLAUSE 3 OR AS NOTED: SMALL CAPITALS.

The requirements are followed by means to assess compliance.

In this standard, the conjunctive “or” is used as an “inclusive or” so a statement is true if any combination of the conditions is true.

The verbal forms used in this standard conform to usage described in Annex H of the ISO/IEC Directives, Part 2. For the purposes of this standard, the auxiliary verb: – – –

“shall” means that compliance with a requirement or a test is mandatory for compliance with this standard;

“should” means that compliance with a requirement or a test is recommended but is not mandatory for compliance with this standard;

“may” is used to describe a permissible way to achieve compliance with a requirement or test.

Clauses and subclauses for which a rationale is provided in informative Annex A are marked with an asterisk (*).

A list of all parts of the IEC 62366 series, published under the general title Medical devices, can be found on the IEC website.

The committee has decided that the contents of this publication will remain unchanged until the stability date indicated on the IEC web site under \"http://webstore.iec.ch\" in the data related to the specific publication. At this date, the publication will be – – – –

reconfirmed, withdrawn,

replaced by a revised edition, or amended.

NOTE The attention of National Committees and Member Bodies is drawn to the fact that equipment manufacturers and testing organizations may need a transitional period following publication of a new, amended or revised IEC or ISO publication in which to make products in accordance with the new requirements and to equip themselves for conducting new or revised tests. It is the recommendation of the committee that the content of this publication be adopted for mandatory implementation nationally not earlier than 3 years from the date of publication.

Medical practice is increasingly using MEDICAL DEVICES for observation and treatment of PATIENTS. USE ERRORS caused by inadequate MEDICAL DEVICE USABILITY have become an increasing cause for concern. Many of the MEDICAL DEVICES developed without applying a USABILITY ENGINEERING (HUMAN FACTORS ENGINEERING) PROCESS are non-intuitive, difficult to learn and difficult to use. As healthcare evolves, less skilled USERS including PATIENTS themselves are now using MEDICAL DEVICES and MEDICAL DEVICES are becoming more complicated. The design of the USER INTERFACE to achieve adequate USABILITY requires a different PROCESS and skill set than that of the technical implementation of the USER INTERFACE.

The USABILITY ENGINEERING PROCESS is intended to identify and minimize USE ERRORS and thereby reduce use-associated RISKS. Some, but not all, forms of incorrect use are suited to control by the MANUFACTURER. The USABILITY ENGINEERING PROCESS is related to the RISK MANAGEMENT PROCESS as indicated in Figure A.4. This International Standard describes a USABILITY ENGINEERING PROCESS to provide acceptable RISK related to USABILITY of a MEDICAL DEVICE. It is intended to be useful not only for MANUFACTURERS of MEDICAL DEVICES, but also for technical committees responsible for the preparation of particular MEDICAL DEVICE standards. This International Standard strictly focuses on applying the USABILITY ENGINEERING PROCESS to optimize MEDICAL DEVICE USABILITY as it relates to SAFETY. The companion technical report (IEC 62366-21) is comprehensive and has a broader focus. It focuses not only on USABILITY as it relates to SAFETY, but also on how USABILITY relates to attributes such as TASK accuracy, completeness and EFFICIENCY, and USER satisfaction.

NOTE SAFETY is freedom from unacceptable RISK. Unacceptable RISK can arise from USE ERROR, which can lead to exposure to direct physical HAZARDS or loss or degradation of clinical functionality.

MANUFACTURERS can choose to implement a USABILITY ENGINEERING program focused narrowly on SAFETY or more broadly on SAFETY and other attributes, such as those cited above. A broader focus might also be useful to address specific USABILITY ENGINEERING expectations, such as the need to confirm that USERS can successfully perform non-SAFETY-related TASKS. A MANUFACTURER might also implement a broader program to realize the commercial benefits of a MEDICAL DEVICE that not only is safe to use but also offers superior USABILITY.

1 IEC 62366-2, Medical devices – Part 2: Guidance on the application of usability engineering to medical devices (in

preparation).

General testing procedures for medical electrical equipment

1 * Scope

This part of IEC 62366 specifies a PROCESS for a MANUFACTURER to analyze, specify, develop and evaluate the USABILITY of a MEDICAL DEVICE as it relates to SAFETY. This USABILITY ENGINEERING (HUMAN FACTORSENGINEERING) PROCESS permits the MANUFACTURER to assess and mitigate RISKS associated with CORRECTUSE and USE ERRORS, i.e., NORMAL USE. It can be used to identify but does not assess or mitigate RISKS associated with ABNORMAL USE.

NOTE 1 SAFETY is freedom from unacceptable RISK. Unacceptable RISK can arise from USE ERROR, which can lead to exposure to direct physical HAZARDS or loss or degradation of clinical functionality.

NOTE 2 Guidance on the application of USABILITY ENGINEERING to MEDICAL DEVICES is available in IEC 62366-22, which addresses not only SAFETY but also aspects of USABILITY not related to SAFETY. If the USABILITY ENGINEERING PROCESS detailed in this International Standard has been complied with, then the USABILITY of a MEDICAL DEVICE as it relates to SAFETY is presumed to be acceptable, unless there isOBJECTIVE EVIDENCE to the contrary.

NOTE 3 Such OBJECTIVE EVIDENCE can subsequently originate from POST-PRODUCTION surveillance.

2 Normative references

The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

NOTE 1 The way in which these referenced documents are cited in normative requirements determines the extent (in whole or in part) to which they apply.

NOTE 2 Informative references are listed in the bibliography beginning on page 37.

ISO 14971:2007, Medical devices – Application of risk management to medical devices

3 Terms and definitions

For the purpose of this document, the terms and definitions given in ISO 14971:2007 and the following apply.

NOTE An index of defined terms is found beginning on page 39.

3.1

*ABNORMAL USE

conscious, intentional act or intentional omission of an act that is counter to or violates NORMAL USE and is also beyond any further reasonable means of USER INTERFACE-related RISK CONTROL by the MANUFACTURER EXAMPLES Reckless use or sabotage or intentional disregard of information for SAFETY are such acts. Note 1 to entry See also 4.1.3.

Note 2 to entry: An intended but erroneous action that is not ABNORMAL USE is considered a type of USEERROR.

2 IEC 62366-2, Medical devices – Part 2: Guidance on the application of usability engineering to medical devices (in

preparation).

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.Note 3 to entry: ABNORMAL USE does not relieve the MANUFACTURER from considering non-USER INTERFACE-related means of RISK CONTROL.

Note 4 to entry: Figure 1 shows the relationships of the types of use.

IEC

NOTE Figure D.1 contains additional detail

Figure 1 – Relationship of the types of use

3.2

ACCOMPANYING DOCUMENTATION

materials accompanying a MEDICAL DEVICE and containing information for the USER or those accountable for the installation, use and maintenance of the MEDICAL DEVICE, particularly regarding safe use

Note 1 to entry: The ACCOMPANYING DOCUMENTATION can consist of the instructions for use, technical description, installation manual, quick reference guide, etc.

Note 2 to entry: ACCOMPANYING DOCUMENTATION is not necessarily a written or printed document but could involve auditory, visual, or tactile materials and multiple media types.

Note 3 to entry: MEDICAL DEVICES that can be used safely without instructions for use are exempted from having instructions for use by some authorities with jurisdiction.

[SOURCE: ISO 14971:2007, 2.1, modified – The term has been changed to refer to ‘documentation’ rather than ‘document’, and in the definition ‘document’ has been replaced by ‘material’, ‘OPERATOR’ has been deleted and notes to entry have been added.] 3.3

CORRECT USE

NORMAL USE without USE ERROR

Note 1 to entry: Deviation from instructions for use is only considered USE ERROR if it leads to a MEDICAL DEVICE response that is different than intended by the MANUFACTURER or expected by the USER. Note 2 to entry: Figure 1 shows the relationships of the types of use.

3.4

EFFECTIVENESS

accuracy and completeness with which USERS achieve specified goals

Note 1 to entry: This is a different concept than 'clinical effectiveness'.

[SOURCE: ISO 9241-11:1998, 3.2, modified – Added the note to entry.] 3.5

*EFFICIENCY

resources expended in relation to EFFECTIVENESS

[SOURCE: ISO 9241-11:1988, 3.3, modified – the term \"EFFECTIVENESS\" has replaced the original phrase, which here constitutes the definition of 3.4 EFFECTIVENESS.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.3.6

EXPECTED SERVICE LIFE

time period specified by the MANUFACTURER during which the MEDICAL DEVICE is expected to remain safe for use (i.e. maintain basic SAFETY and essential performance)

Note 1 to entry: Maintenance can be necessary during the EXPECTED SERVICE LIFE.

[SOURCE: IEC 60601-1:2005 and IEC 60601-1:2005/AMD1:2012, 3.28, modified – In the definition, ‘ME EQUIPMENT and ME SYSTEM’ have been replaced with ‘MEDICAL DEVICE’.] 3.7

FORMATIVE EVALUATION

conducted with the intent to explore USER INTERFACE design strengths,

weaknesses, and unanticipated USE ERRORS

Note 1 to entry: FORMATIVE EVALUATION is generally performed iteratively throughout the design and development PROCESS, but prior to SUMMATIVE EVALUATION, to guide USER INTERFACE design as necessary.

USER INTERFACE EVALUATION

3.8

HAZARD-RELATED USE SCENARIO

USE SCENARIO that could lead to a HAZARDOUS SITUATION or HARM

Note 1 to entry: A HAZARD-RELATED USE SCENARIO can often be linked to a potential USE ERROR.

Note 2 to entry: A HAZARD-RELATED USE SCENARIO is not related to a failure of the MEDICAL DEVICE, unless the MEDICAL DEVICE failure was caused by a USE ERROR.

3.9

* NORMAL USE

operation, including routine inspection and adjustments by any USER, and stand-by, according to the instructions for use or in accordance with generally accepted practice for those MEDICAL DEVICES provided without instructions for use

Note 1 to entry: NORMAL USE should not be confused with INTENDED USE. While both include the concept of use as intended by the MANUFACTURER, INTENDED USE focuses on the medical purpose while NORMAL USE incorporates not only the medical purpose, but maintenance, transport, etc. as well. Note 2 to entry: USE ERROR can occur in NORMAL USE.

Note 3 to entry: MEDICAL DEVICES that can be used safely without instructions for use are exempted from having instructions for use by some authorities with jurisdiction.

Note 4 to entry: Figure 1 shows the relationships of the types of use.

[SOURCE: IEC 60601-1:2005, 3.71, modified – Notes 2, 3 and 4 to entry have been added, and in the definition ‘OPERATOR’ has been replaced with ‘USER’ and the entire phrase after \"instructions for use\" has been added.]

3.10 * PATIENT

living being (person) undergoing a medical, surgical or dental PROCEDURE

Note 1 to entry: A PATIENT can be a USER.

[SOURCE: IEC 60601-1:2005 and IEC 60601-1:2005/AMD1:2012, 3.76, modified – The phrase ‘or animal’ has been deleted from the definition and \"USER\" has been substituted for \"operator\" in the note to entry.] 3.11

* PRIMARY OPERATING FUNCTION

function that involves USER interaction that is related to the SAFETY of the MEDICAL DEVICE

Note 1 to entry: Often a PRIMARY OPERATING FUNCTION is interacted with by a series of TASKS that can be broken down into a series of USER interactions.

Note 2 to entry: The concept of SAFETY includes loss or degradation of performance resulting in an unacceptable RISK to the PATIENT, including USE ERROR that prevents the USER from effectively using the MEDICAL DEVICE to achieve its intended medical purpose. In IEC 60601-1, this is referred to as ‘essential performance’. .

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.3.12

entity accountable for the use and maintenance of a MEDICAL DEVICE or combination of MEDICAL DEVICES

Note 1 to entry: The accountable entity can be, for example, a hospital, an individual clinician or a lay person. In home use applications, the PATIENT, USER and RESPONSIBLE ORGANIZATION can be one and the same person. Note 2 to entry: Education and training are included in \"use.\"

RESPONSIBLE ORGANIZATION

[SOURCE: IEC 60601-1:2005, 3.101, modified – The reference in the definition to ‘an ME EQUIPMENT or ME SYSTEM’ has been replaced with ‘a MEDICAL DEVICE OR COMBINATION OF MEDICAL DEVICES’ and 'operator' has been replaced by 'USER' in the note to entry.] 3.13

SUMMATIVE EVALUATION

USER INTERFACE EVALUATION conducted at the end of the USER INTERFACE development with the intent to obtain OBJECTIVE EVIDENCE that the USER INTERFACE can be used safely

Note 1 to entry: SUMMATIVE EVALUATION relates to validating the safe use of the USER INTERFACE.

3.14

TASK

one or more USER interactions with a MEDICAL DEVICE to achieve a desired result

Note 1 to entry: A TASK description should include the allocation of activities and operational steps between the USER and the MEDICAL DEVICE.

Note 2 to entry: TASKS should not be described solely in terms of the functions or features provided by the MEDICAL DEVICE.

3.15

UOUP

USER INTERFACE OF UNKNOWN PROVENANCE

USER INTERFACE or part of a USER INTERFACE of a MEDICAL DEVICE previously developed for which adequate RECORDS of the USABILITY ENGINEERING PROCESS of this standard are not available

Note 1 to entry: This note applies to the French version only.

3.16

*USABILITY

characteristic of the USER INTERFACE that facilitates use and thereby establishes EFFECTIVENESS, EFFICIENCY and USER satisfaction in the intended USE ENVIRONMENT

Note 1 to entry: All aspects of USABILITY, including EFFECTIVENESS, EFFICIENCY and USER satisfaction, can either increase or decrease SAFETY.

3.17

*USABILITY ENGINEERING

HUMAN FACTORS ENGINEERING

application of knowledge about human behaviour, abilities, limitations, and other characteristics to the design of MEDICAL DEVICES (including software), systems and TASKS to achieve adequate USABILITY

Note 1 to entry: Achieving adequate USABILITY can result in acceptable RISK related to use.

3.18

*USABILITY ENGINEERING FILE

set of RECORDS and other documents that are produced by the USABILITY ENGINEERING PROCESS 3.19

USABILITY TEST

method for exploring or evaluating a USER INTERFACE with intended USERS within a specified intended USE

ENVIRONMENT

3.20

USE ENVIRONMENT

actual conditions and setting in which USERS interact with the MEDICAL DEVICE

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.Note 1 to entry: The conditions of use or attributes of the USE ENVIRONMENT can include hygienic requirements, frequency of use, location, lighting, noise, temperature, mobility, and degree of internationalization.

3.21

* USE ERROR

USER action or lack of USER action while using the MEDICAL DEVICE that leads to a different result than that intended by the MANUFACTURER or expected by the USER

Note 1 to entry: USE ERROR includes the inability of the USER to complete a TASK.

Note 2 to entry: USE ERRORS can result from a mismatch between the characteristics of the USER, USER INTERFACE, TASK, or USE ENVIRONMENT.

Note 3 to entry: USERS might be aware or unaware that a USE ERROR has occurred.

Note 4 to entry: An unexpected physiological response of the PATIENT is not by itself considered USE ERROR.

Note 5 to entry: A malfunction of a MEDICAL DEVICE that causes an unexpected result is not considered a USE ERROR. Note 6 to entry: Figure 1 shows the relationships of the types of use.

3.22

* USE SCENARIO

specific sequence of TASKS performed by a specific USER in a specific USE ENVIRONMENT and any resulting response of the MEDICAL DEVICE 3.23

* USE SPECIFICATION

APPLICATION SPECIFICATION

summary of the important characteristics related to the context of use of the MEDICAL DEVICE

Note 1 to entry: The intended medical indication, PATIENT population, part of the body or type of tissue interacted with, USER PROFILE, USE ENVIRONMENT, and operating principle are typical elements of the USE SPECIFICATION.

Note 2 to entry: The summary of the MEDICAL DEVICE USE SPECIFICATION is referred to by some authorities having jurisdiction as the ‘statement of intended use’.

Note 3 to entry: The USE SPECIFICATION is an input to determining the INTENDED USE of ISO 14971:2007.

3.24 * USER

person interacting with (i.e. operating or handling) the MEDICAL DEVICE

Note 1 to entry: There can be more than one USER of a MEDICAL DEVICE.

Note 2 to entry: Common USERS include clinicians, PATIENTS, cleaners, maintenance and service personnel.

3.25

USER GROUP

subset of intended USERS who are differentiated from other intended USERS by factors that are likely to influence USABILITY, such as age, culture, expertise or type of interaction with a MEDICAL DEVICE 3.26

* USER INTERFACE

means by which the USER and the MEDICAL DEVICE interact

Note 1 to entry: ACCOMPANYING DOCUMENTATION is considered part of the MEDICAL DEVICE AND ITS USER INTERFACE. Note 2 to entry: USER INTERFACE includes all the elements of the MEDICAL DEVICE with which the USER interacts including the physical aspects of the MEDICAL DEVICE as well as visual, auditory, tactile displays and is not limited to a software interface.

Note 3 to entry: For the purposes of this standard, a system of MEDICAL DEVICES can be treated as a single USER INTERFACE.

3.27

USER INTERFACE EVALUATION

PROCESS by which the MANUFACTURER explores or assesses the USER interactions with the USER INTERFACE

Note 1 to entry: A USER INTERFACE EVALUATION may consist of one or more of the following techniques, amongst others, USABILITY TESTS, expert reviews, heuristic analyses, design audits or a cognitive walk through.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.Note 2 to entry: USER INTERFACE EVALUATION is frequently performed iteratively throughout the design and development PROCESS (this is FORMATIVE EVALUATION).

Note 3 to entry: USER INTERFACE EVALUATION is a part of the activities involved in verifying and validating the overall MEDICAL DEVICE design (this is SUMMATIVE EVALUATION).

3.28

*USER INTERFACE SPECIFICATION

collection of specifications that comprehensively and prospectively describe the USER INTERFACE of a

MEDICAL DEVICE

3.29

USER PROFILE

summary of the mental, physical and demographic traits of an intended USER GROUP, as well as any special characteristics, such as occupational skills, job requirements and working conditions, which can have a bearing on design decisions

4 Principles

4.1 4.1.1

General requirements

*USABILITY ENGINEERING PROCESS

The MANUFACTURER shall establish, document, implement and maintain a USABILITY ENGINEERING PROCESS, as defined in Clause 5, to provide SAFETY for the PATIENT, USER and others. The PROCESS shall address USER interactions with the MEDICAL DEVICE according to the ACCOMPANYING DOCUMENTATION, including, but not limited to: – – ––––

* transport; * storage; installation;operation;

maintenance and repair; anddisposal.

USABILITY ENGINEERING activities for a MEDICAL DEVICE shall be planned, carried out, and documented by personnel competent on the basis of appropriate education, training, skills or experience.

Where a documented product realization PROCESS exists, such as that described in Clause 7 of ISO 13485:2003 [11], it shall incorporate the appropriate parts of or reference the USABILITY ENGINEERINGPROCESS.

NOTE 1 Subclause 6.2 of ISO 13485:2003 contains additional information relating to personnel competence.

A depiction of the interrelationship between the RISK MANAGEMENT PROCESS of ISO 14971:2007 and the USABILITY ENGINEERING PROCESS described in this standard is shown in Figure A.4.

The activities described in Clause 5, as shown Figure A.4, are described in a logical order, but they may be carried out in a flexible order as appropriate.

Consider compliance with this subclause to exist when the requirements of this International Standard have been fulfilled. 4.1.2

*RISK CONTROL AS IT RELATES TO USER INTERFACE DESIGN

To reduce use-related RISK, the MANUFACTURER shall use one or more of the following options, in the priority listed (as required by ISO 14971:2007, 6.2): a)inherent SAFETY by design;

b)protective measures in the MEDICAL DEVICE itself or in the manufacturing PROCESS;

c)information for SAFETY.

NOTE Information for SAFETY can also be required by product standards and other sources.

Information for SAFETY as it relates to USABILITY

When, in accordance with the priorities of 4.1.2, information for SAFETY is used as a RISK CONTROL measure, the MANUFACTURER shall subject this information to the USABILITY ENGINEERING PROCESS to determine that the information –––

is perceivable by,is understandable to, and

supports CORRECT USE of the MEDICAL DEVICE by

USERS of the intended USER PROFILES in the context of the intended USE ENVIRONMENT.

NOTE 1 The relationship between USER perception, cognition and action is shown in Figure A.1. NOTE 2 Examples of information for SAFETY are found in IEC 62366-2.

Conscious disregard of such information for SAFETY by the USER is considered to be an intentional act or intentional omission of an act that is counter to or violates NORMAL USE and is also beyond any further reasonable means of USER INTERFACE-related RISK CONTROL by the MANUFACTURER (i.e. ABNORMAL USE). Compliance is checked by inspection of the information for SAFETY and the USABILITY ENGINEERING FILE. 4.2

* USABILITY ENGINEERING FILE

The results of the USABILITY ENGINEERING PROCESS shall be stored in the USABILITY ENGINEERING FILE. The RECORDS and other documents that form the USABILITY ENGINEERING FILE may form part of other documents and files.

EXAMPLE 1 MANUFACTURER’S product design file. EXAMPLE 2 RISK MANAGEMENT FILE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 4.3

Tailoring of the USABILITY ENGINEERING effort

The level of effort and the choice of methods and tools used to perform the USABILITY ENGINEERING PROCESS may vary based on: a)b)c)

the size and COMPLEXITY of the USER INTERFACE;

the SEVERITY of the HARM associated with the use of the MEDICAL DEVICE;the extent or complexity of the USE SPECIFICATION;

d)the presence of USER INTERFACE OF UNKNOWN PROVENANCE; and

e)the extent of the modification to an existing MEDICAL DEVICE USER INTERFACE that had been subjected to

the USABILITY ENGINEERING PROCESS.Compliance is checked by inspection of the USABILITY ENGINEERING FILE.

5 * USABILITY ENGINEERING PROCESS

5.1

* Prepare USE SPECIFICATION

The MANUFACTURER shall prepare a USE SPECIFICATION. The USE SPECIFICATION shall include: –

* intended medical indication;

NOTE 1 This can include conditions(s) or disease(s) to be screened, monitored, treated, diagnosed, or prevented.

––

intended PATIENT population;

NOTE 2 This can include age group, weight range, health, or condition.

intended part of the body or type of tissue applied to or interacted with;

* intended USER PROFILE; * USE ENVIRONMENT; and * operating principle.

NOTE 3 The summary of the MEDICAL DEVICE USE SPECIFICATION is referred to by some authorities having jurisdiction as the ‘statement of intended use’.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.2

* Identify USER INTERFACE characteristics related to SAFETY and potential USE ERRORS

The MANUFACTURER shall identify USER INTERFACE characteristics that could be related to SAFETY as part of a RISK ANALYSIS performed according to ISO 14971:2007, 4.2. This identification may also be performed using the tools and techniques from the USABILITY ENGINEERING PROCESS. This identification shall include consideration of the PRIMARY OPERATING FUNCTIONS that are provided in applicable particular MEDICAL DEVICE SAFETY standards.

NOTE 1 ISO 14971:2007, C.2.29 to C.2.34 provides a list of questions that can be used to identify USER INTERFACE characteristics that could impact SAFETY. The list of questions is not exhaustive.

Based on the identified USER INTERFACE characteristics and USE SPECIFICATION, the MANUFACTURER shall identify the USE ERRORS that could occur and are related to the USER INTERFACE. This identification may be accomplished by conducting a TASK analysis. [27][28][29]

NOTE 2 TASK analysis is described in IEC 62366-2.

The results of this identification of characteristics related to SAFETY shall be stored in the USABILITYENGINEERING FILE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.3

* Identify known or foreseeable HAZARDS and HAZARDOUS SITUATIONS

The MANUFACTURER shall identify known or foreseeable HAZARDS and HAZARDOUS SITUATIONS, which could affect PATIENTS, USERS or others, related to use of the MEDICAL DEVICE. This identification shall be conducted as part of a RISK ANALYSIS performed according to ISO 14971:2007, 4.3 and the first paragraph of ISO 14971:2007, 4.4.

NOTE 1 Annex B contains examples of possible HAZARDS and HAZARDOUS SITUATIONS related to USABILITY.

During the identification of HAZARDS and HAZARDOUS SITUATIONS, the following shall be considered: –––

USE SPECIFICATION, including USER PROFILE(S) (see 5.1);

information on HAZARDS and HAZARDOUS SITUATIONS known for existing USER INTERFACES of DEVICES of a similar type, if available; andidentified USE ERRORS (see 5.2).

MEDICAL

The results of this identification of HAZARDS and HAZARDOUS SITUATIONS shall be stored in the USABILITYENGINEERING FILE.

NOTE 2 During the identification of HAZARDS or HAZARDOUS SITUATIONS, ABNORMAL USE conditions can be identified.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.4

* Identify and describe HAZARD-RELATED USE SCENARIOS

The MANUFACTURER shall identify and describe the reasonably foreseeable HAZARD-RELATED USE SCENARIOS associated with the identified HAZARDS and HAZARDOUS SITUATIONS. The description of each identified HAZARD-RELATED USE SCENARIO shall include all TASKS and their sequences as well as the SEVERITY of the associated HARM.

NOTE Annex B contains examples of specifying sequences of USER actions that could result in HAZARDS being exposed to USERS.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE.

* Select the HAZARD-RELATED USE SCENARIOS for SUMMATIVE EVALUATION

shall select the HAZARD-RELATED USE SCENARIOS to be included in the SUMMATIVE

MANUFACTURER EVALUATION.

The MANUFACTURER shall select either: ––

all HAZARD-RELATED USE SCENARIOS; or

the subset of the HAZARD-RELATED USE SCENARIOS based on the SEVERITY of the potential HARM that couldbe caused by USE ERROR (e.g. for which medical intervention would be needed).

The choice of the scheme used to select the HAZARD-RELATED USE SCENARIOS may additionally depend on other circumstances specific to the MEDICAL DEVICE and the MANUFACTURER.

NOTE Examples of selection schemes are given in Annex A, 5.5, and IEC 62366-2.

A summary of any selection scheme, the rationale for its use and the results of applying it shall be stored in the USABILITY ENGINEERING FILE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.6

* Establish USER INTERFACE SPECIFICATION

The MANUFACTURER shall establish and maintain a USER INTERFACE SPECIFICATION. The USER INTERFACE SPECIFICATION shall consider: –––

the USE SPECIFICATION (see 5.1);

the known or foreseeable USE ERRORS associated with the MEDICAL DEVICE (see 5.2); andthe HAZARD-RELATED USE SCENARIOS (see 5.4).

The USER INTERFACE SPECIFICATION shall include: –

testable technical requirements relevant to the USER INTERFACE, including the requirements for thoseparts of the USER INTERFACE associated with the selected RISK CONTROL measures;

NOTE Technical requirements for the USER INTERFACE can include display color, character size, or placement of the controls.

––

an indication as to whether ACCOMPANYING DOCUMENTATION is required; andan indication as to whether MEDICAL DEVICE-specific training is required.

The USER INTERFACE SPECIFICATION shall be stored in the USABILITY ENGINEERING FILE. The USER INTERFACESPECIFICATION may be integrated into other specifications.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.7 5.7.1

* Establish USER INTERFACE EVALUATION plan General

The MANUFACTURER shall establish and maintain a USER INTERFACE EVALUATION plan for the USER INTERFACESPECIFICATION.

The USER INTERFACE EVALUATION plan shall a)

document the objective and identify the method of any planned FORMATIVE EVALUATIONS and SUMMATIVEEVALUATIONS;

NOTE 1 Examples of FORMATIVE EVALUATION and SUMMATIVE EVALUATION methods are given in IEC 62366-2.

b)if USABILITY TESTS are employed,

–

document the involvement of the representative intended USERS and USER PROFILE to which theybelong.

EXAMPLE 1 In a FORMATIVE EVALUATION, clinical personnel from the MANUFACTURER are used for a nurse-USER GROUP.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.EXAMPLE 2 In a SUMMATIVE EVALUATION, a panel of practicing intensive care nurses are used for a critical care nursing USER PROFILE.

Multiple USER PROFILES may be combined into a USER GROUP for the purposes of a USABILITY TEST;

–document the test environment and other conditions of use, based on the USE SPECIFICATION;

NOTE 2 These are the specific conditions of use which could affect the USER’S TASKS performance.

EXAMPLE 3 Conditions of use could include location-specific conditions such as lighting, noise and activitylevels.

EXAMPLE 4 Conditions of use could include personnel-specific conditions such as use of the MEDICAL DEVICEwhile wearing personal protective equipment (e.g. surgical gloves and safety goggles).

EXAMPLE 5 Conditions of use could include social conditions such as stress levels and working in teams.

––

specify whether ACCOMPANYING DOCUMENTATION is provided during the test;

specify whether MEDICAL DEVICE-specific training is provided prior to the test and the minimumelapsed time between the training and the beginning of the test.

USER INTERFACE EVALUATION methods may be quantitative or qualitative. USER INTERFACE EVALUATION may be performed in a variety of locations, such as, in a laboratory setting, in a simulated USE ENVIRONMENT or in the actual USE ENVIRONMENT.

NOTE 3 See 4.3 for scaling of the USABILITY ENGINEERING effort.

The USER INTERFACE EVALUATION plan may be integrated into other plans.

The USER INTERFACE EVALUATION plan shall be stored in the USABILITY ENGINEERING FILE. Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.7.2

*FORMATIVE EVALUATION planning

The USER INTERFACE evaluation plan for FORMATIVE EVALUATION shall address: a)

the evaluation methods being used;

NOTE 1 Objectives for a FORMATIVE EVALUATION can include exploring the extent to which the elements of theUSER INTERFACE are recognizable, understandable and operable by the USER.

b)c)

which part of the USER INTERFACE is being evaluated; and

when in the USABILITY ENGINEERING PROCESS to perform each of the USER INTERFACE EVALUATIONS.

NOTE 2 The MANUFACTURER can find it helpful to apply focus and effort to the FORMATIVE EVALUATION early on,because the information derived from this is a valuable input to the design PROCESS.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.7.3

*SUMMATIVE EVALUATION planning

For each selected HAZARD-RELATED USE SCENARIO (see 5.5), the USER INTERFACE EVALUATION plan for SUMMATIVE EVALUATION shall specify: a)

the evaluation method being used and a rationale that the method produces OBJECTIVE EVIDENCE;

NOTE 1 The SUMMATIVE EVALUATION of the information for SAFETY can require different methods than for otherparts of the USER INTERFACE.

b)c)

which part of the USER INTERFACE is being evaluated;

where applicable, the criteria for determining whether the information for SAFETY is perceivable,understandable and supports CORRECT USE of the MEDICAL DEVICE (4.1.3);

NOTE 2 The SUMMATIVE EVALUATION of the information for SAFETY is typically completed prior to initiating theSUMMATIVE EVALUATION of the remainder of the USER INTERFACE. It is usually a separate USABILITY TEST withdifferent USERS.

d) * the availability of the ACCOMPANYING DOCUMENTATION and provision of training during the SUMMATIVE

EVALUATION; and

NOTE 3 A SUMMATIVE EVALUATION can include training as part of the protocol, as appropriate, to simulate realistic use. An appropriate wait time might be needed between the training and the rest of the SUMMATIVE EVALUATION to allow for representative learning decay.

––

the test environment and conditions of use and a rationale for how they are adequatelyrepresentative of the actual conditions of use; and

the method of collecting data during the USABILITY TEST for the subsequent analysis of observed USEERRORS.

The SUMMATIVE EVALUATION may be performed in a single evaluation or multiple evaluations.

NOTE 4 The planning for SUMMATIVE EVALUATION will likely not be finalized until after the FORMATIVE EVALUATION has been completed.

NOTE 5 Guidance on the evaluation of the adequacy of RISK CONTROL measures can be found in ISO 14971:2007, Clause D.4.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. 5.8 The

* Perform USER INTERFACE design, implementation and FORMATIVE EVALUATION

MANUFACTURER shall design and implement the USER INTERFACE, including the ACCOMPANYING

DOCUMENTATION if needed, and training capability, if needed, as described in the USER INTERFACESPECIFICATION.

The MANUFACTURER shall utilize, as appropriate, USABILITY ENGINEERING methods and techniques, including FORMATIVE EVALUATION to accomplish this design and implementation. The results of the utilized FORMATIVEEVALUATION shall be stored in the USABILITY ENGINEERING FILE. Where new USE ERRORS, HAZARDS, HAZARDOUSSITUATIONS or HAZARD-RELATED USE SCENARIOS are discovered during this step, the MANUFACTURER shall repeat the steps of Clause 5 as appropriate.

NOTE 1 ISO 14971:2007, Subclause 6.6 requires that design changes resulting from the USABILITY ENGINEERING PROCESS be reviewed to determine if other HAZARDS or HAZARDOUS SITUATIONS have been generated.

If training on the specific MEDICAL DEVICE is required for the safe use of the MEDICAL DEVICE by the intended USER, the MANUFACTURER shall design and implement a training capability for the EXPECTED SERVICE LIFE of the MEDICAL DEVICE by doing at least one of the following: ––––

provide the materials necessary for training;

ensure that the materials necessary for training are available;make the training available; or

make training available to the RESPONSIBLE ORGANIZATION that enables it to train its USERS.

NOTE 2 The training capability is intended to enable the RESPONSIBLE ORGANIZATION to provide training to their USERS for the EXPECTED SERVICE LIFE of the MEDICAL DEVICE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE, including for evidence of the FORMATIVE EVALUATION, if performed, and the existence of the training strategy, if required. 5.9

* Perform SUMMATIVE EVALUATION of the USABILITY of the USER INTERFACE

Upon completion of the design and implementation of the USER INTERFACE, the MANUFACTURER shall perform a SUMMATIVE EVALUATION of each HAZARD-RELATED USE SCENARIO selected in 5.5 on the final or production equivalent USER INTERFACE according to the USER INTERFACE EVALUATION plan. For SUMMATIVE EVALUATION, the MANUFACTURER may use data obtained from the SUMMATIVE EVALUATIONS of products with an equivalent USER INTERFACE together with a technical rationale for how this data is applicable. The results shall be stored in the USABILITY ENGINEERING FILE.

The data from the SUMMATIVE EVALUATION shall be analyzed to identify the potential consequences of all USEERRORS that occurred. If the consequences can be linked to a HAZARDOUS SITUATION, the root cause of each USE ERROR shall be determined. The root causes should be determined based on observations of USER performance and subjective comments from the USER related to that performance. If new USE ERRORS, HAZARDS, during this data analysis: –

HAZARDOUS SITUATIONS

or HAZARD-RELATED USE SCENARIOS are discovered

if yes, then the MANUFACTURER shall repeat the activities of Clause 5 as appropriate;

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.–

if not, the MANUFACTURER shall determine whether further improvement of the USER INTERFACE design asit relates to SAFETY is necessary and practicable.

1)if yes, then the MANUFACTURER shall re-enter the USABILITY ENGINEERING PROCESS at 5.6;2)if not, then the MANUFACTURER shall:

NOTE 1 There can be RISK CONTROLS that are not USER INTERFACE-related that are practicable solutions toreduce USER INTERFACE-related RISK.

i)document why improvement is not practicable;

NOTE 2 Guidance for how to determine that further RISK reduction in the USER INTERFACE is notpracticable is found in ISO 14971:2007, 6.2.

ii)

identify the data from the USABILITY ENGINEERING PROCESS needed to determine the RESIDUALRISK related to use; and

iii)evaluate the RESIDUAL RISK according to ISO 14971:2007, 6.4.

NOTE 3 ISO 14971:2007, Subclause 6.6 requires that design changes resulting from the USABILITY ENGINEERING PROCESS be reviewed to determine non-USER INTERFACE related HAZARDS or HAZARDOUS SITUATIONS have been generated.

NOTE 4 ISO 14971:2007, Clause 7 requires that all RESIDUAL RISK be considered when evaluating the overall RESIDUAL RISK of the MEDICAL DEVICE, including the RESIDUAL RISK associated with USABILITY of the MEDICAL DEVICE.

If the USABILITY ENGINEERING PROCESS detailed in this International Standard has been complied with, then the USABILITY of a MEDICAL DEVICE as it relates to SAFETY is presumed to be acceptable, unless there isOBJECTIVE EVIDENCE to the contrary.

NOTE 5 Such OBJECTIVE EVIDENCE can subsequently originate from POST-PRODUCTION surveillance.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE and by application of the requirements of ISO 14971:2007, 6.4. 5.10

USER INTERFACE OF UNKNOWN PROVENANCE

Instead of all the requirements of 5.1 through 5.9, UOUP may be evaluated according to Annex C. Compliance is checked by application of Annex C.

General guidance and rationale

A.1 General guidance

This annex provides a rationale for some requirements of this document and is intended for those who are familiar with the subject of this document but who have not participated in its development. An understanding of the rationales underlying these requirements is considered to be essential for their proper application. Furthermore, as clinical practice and technology change, it is believed that a rationale will facilitate any revision of this document necessitated by those developments.

A.2 Rationale for requirements in particular clauses and subclauses

Clause 1 – Scope

This International Standard focuses on USABILITY as it relates to SAFETY of the USER INTERFACE of a MEDICALDEVICE in development. ‘Usability’, in general, includes attributes such as USER satisfaction and aesthetics of the MEDICAL DEVICE that are not directly related the SAFETY of a MEDICAL DEVICE and, as a result, are not considered by this standard.

This International Standard uses the concept of USE ERROR. The term was chosen over the more commonly used terms of “user error” or “human error” because not all errors associated with the use of a MEDICALDEVICE are the result of oversight or carelessness on the part of the USER of the MEDICAL DEVICE. Much more commonly, USE ERRORS are the direct result of poor USER INTERFACE design. [44]

Some USER INTERFACE designs contribute to USE ERROR because they employ non-intuitive, counter-intuitive or hard-to-learn displays or controls. The consequences of such design flaws often only become apparent when the USER is using the MEDICAL DEVICE in an emergency or stressful situation, is fatigued, or uses the MEDICAL DEVICE only rarely.

The scope of this International Standard applies when a MEDICAL DEVICE is used according to the instructions for use, i.e. NORMAL USE and CORRECT USE. The USER can make a USE ERROR while attempting to use a MEDICAL DEVICE in accordance with its instructions for use. Since a USE ERROR can occur in NORMALUSE, this standard introduces the new concept and term, CORRECT USE, to describe the situation where the USER follows the instructions for use without committing a USE ERROR. Annex D provides additional information about the types of MEDICAL DEVICE use with examples.

While the USABILITY ENGINEERING PROCESS can be used to identify ABNORMAL USE, this International Standard does not require the USABILITY ENGINEERING PROCESS to be used to assess or mitigate RISKS associated with ABNORMAL USE.

The scope of this International Standard does not apply to clinical decision-making relating to the use of a MEDICAL DEVICE. The decision to use a MEDICAL DEVICE in the context of a particular clinical PROCEDURE requires the RESIDUAL RISKS to be balanced against the anticipated benefits of the PROCEDURE. Such judgments should take into account the INTENDED USE, performance, and RISKS associated with the MEDICALDEVICE, as well as the RISKS and benefits associated with the clinical PROCEDURE or the circumstances of use. Some of these judgments can be made only by a qualified medical practitioner with knowledge of the state of health of an individual PATIENT or the PATIENT’S own opinion.

This part of IEC 62366 is a standard that strictly focuses on applying the USABILITY ENGINEERING PROCESS to optimize MEDICAL DEVICE USABILITY as it relates to SAFETY. The companion technical report (IEC 62366-2) is comprehensive and has a broader focus. It focuses not only on USABILITY as it relates to SAFETY, but also on how USABILITY relates to attributes such as TASK accuracy, completeness and EFFICIENCY, and USER satisfaction.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.useful to address specific USABILITY ENGINEERING expectations, such as the need to confirm that USERS can successfully perform non-SAFETY-related TASKS. A MANUFACTURER might also implement a broader program to realize the commercial benefits of a MEDICAL DEVICE that not only is safe to use but also offers superior USABILITY.

Definition 3.1 – ABNORMAL USE

ABNORMAL USE includes the following subcategories: – – –

exceptional violation (e.g. using the MEDICAL DEVICE as a hammer);

conscious disregard for the contraindications (i.e. disregarding information for SAFETY informing the USER of the error and its associated RISK that has been evaluated according to 4.1.3, 5.7.2 and 5.7.3); reckless use (i.e. unconcerned with danger such as USERS making their own RISK benefit decision); and

EXAMPLE 1 Using a MEDICAL DEVICE after removing its protective guards.

EXAMPLE 2 Ignoring the output limit while not taking into account the RISK/benefit to PATIENT.

– sabotage.

The definition of ABNORMAL USE enables identification of such, as described in Clause 1 of this standard. Within the context of a USABILITY TEST, USER action or inaction when using a MEDICAL DEVICE should be considered to be ABNORMAL USE if a post-test interview establishes that the USER understood appropriate use and made a conscious decision to act (or not act) in opposition. If the post-test interview finds the USER was not aware of appropriate use, the ACCOMPANYING DOCUMENTATION or the training is likely inadequate.

Definition 3.5 – EFFICIENCY

EFFICIENCY is included in the definition of USABILITY, and is itself defined as EFFECTIVENESS in relation to resources expended. EFFICIENCY is always desirable, and it is sometimes, though not always, important for SAFETY. Lack of EFFICIENCY can contribute to RISKS or increase existing RISKS, while efficient MEDICAL DEVICES can mitigate certain kinds of RISKS.

With respect to MEDICAL DEVICES, some of the instances in which EFFICIENCY is most related to SAFETY are those in which TASK performance time has important consequences for the PATIENT. One example of a MEDICAL DEVICE for which performance EFFICIENCY is important for SAFETY is an automatic external defibrillator (AED). These MEDICAL DEVICES are used in a context in which every second counts in saving someone’s life. An AED that cannot be used efficiently decreases the survival probability of the PATIENT. Similarly, PATIENTS undergoing invasive surgery are exposed to RISKS of infection and anaesthesia during these PROCEDURES. Minimizing the time vital organs are exposed and the time the PATIENT is anaesthetized are important for SAFETY. Therefore, MEDICAL DEVICES used during surgery – surgical tools need to be as efficient as possible so as not to contribute further to the existing RISKS of infection and anaesthesia. Definition 3.9 – NORMAL USE

NORMAL USE is differentiated from CORRECT USE because a USE ERROR can occur while attempting to use a MEDICAL DEVICE in accordance with its instructions for use.

NORMAL USE encompasses all foreseeable USER actions when a USER is operating a MEDICAL DEVICE according to the MANUFACTURER’S INTENDED USE for that MEDICAL DEVICE. It specifically excludes ABNORMAL USE. See also Figure B.1. NORMAL USE is simply what is expected from a USER under normal conditions of use, which includes actions that are either correct or in error, but not contrary to the design intentions of the MANUFACTURER.

There are MEDICAL DEVICES that can be used safely without instructions for use, e.g. forceps, scalpel. For such MEDICAL DEVICES, NORMAL USE is established by use in accordance with generally accepted practice. Definition 3.10 – PATIENT

The definition in IEC 60601-1 includes animals. To harmonize with the ISO 13485 definition of MEDICAL DEVICE, animals were removed from the definition of PATIENT.

For the purposes of this International Standard, a PRIMARY OPERATING FUNCTION is a function that is directly related to the SAFETY of the MEDICAL DEVICE.

Examples of a PRIMARY OPERATING FUNCTION that directly relate to SAFETY can include: – – – – – – – –

setting alarm–related USER controls;

setting of X-ray exposure parameters (e.g. kVp, mA); setting of infusion parameters (e.g. flow rate);

adjustment of gas flow rates and anaesthetic vaporizer concentration;

components of a MEDICAL DEVICE that the USER has to assemble to use the MEDICAL DEVICE;

MEDICAL DEVICE controls that the USER has to understand in order to use the MEDICAL DEVICE;

series of display screens that the USER has to navigate through; and

MEDICAL DEVICE operating PROCEDURES that the USER has to learn in order to use the MEDICAL DEVICE.

Definition 3.16 – USABILITY

USABILITY is created by characteristics of the USER INTERFACE that facilitate use, i.e. to make it easier for the USER to perceive information presented by the USER INTERFACE, to understand and to make decisions based on that information, and to interact with the MEDICAL DEVICE to achieve specified goals in the intended USE ENVIRONMENTS. Many of these factors can influence SAFETY to various extents.

The time needed to become acquainted with the MEDICAL DEVICE and its operation is called ‘learnability’ (ISO 9241-11:1998, Table B.2) which can affect SAFETY. Freedom from discomfort and positive attitude towards the use of the MEDICAL DEVICE is called ‘satisfaction’ (ISO 9241-11:1998, definition 3.4).

NOTE How easy it is to remember the operational details of a MEDICAL DEVICE can be thought of as ‘memorizability’. [32] Memorizability becomes important when a particular MEDICAL DEVICE or function is infrequently used by the USER.

Definition 3.17 – USABILITY ENGINEERING or HUMAN FACTORS ENGINEERING

Some people use the terms ‘human factors engineering’ and ‘usability engineering’ interchangeably while others draw a distinction between them. Those who draw a distinction refer to the development and application of knowledge about people and USER INTERFACE design as ‘human factors engineering’ (and sometimes just human factors), and refer to USER INTERFACE EVALUATION – principally by means of setting acceptance criteria and conducting USABILITY TESTS – as ‘usability engineering’.

Regardless of terminology, effective application of the USABILITY ENGINEERING PROCESS (or the same PROCESS by another name) improves USABILITY. Conversely, ineffective application of the USABILITY ENGINEERING PROCESS, or the lack of USABILITY ENGINEERING altogether, can reduce USABILITY. The central concept is that USABILITY does not normally arise just from the well-intentioned application of common sense in design. Rather, USABILITY is the desirable end-product of applying USABILITY ENGINEERING from the beginning and throughout the MEDICAL DEVICE design PROCESS.

For the purposes of this standard, USABILITY ENGINEERING (UE) and HUMAN FACTORS ENGINEERING (HFE) are treated as synonymous.

Definition 3.18 – USABILITY ENGINEERING FILE

The USABILITY ENGINEERING FILE can be part of the RISK MANAGEMENT FILE. There is no requirement for the USABILITY ENGINEERING FILE to be independently stored from the RISK MANAGEMENT FILE. The USABILITY ENGINEERING FILE need not physically contain all the RECORDS and other documents produced by USABILITY ENGINEERING activities. However, it should contain at least references or pointers to all required documentation.

Definition 3.21 – USE ERROR

USE ERRORS often can be an indication of USER INTERFACE design flaws. A USE ERROR is an action (or inaction) of a USER while the USER is interacting with the MEDICAL DEVICE. The interaction between the USER

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.and a MEDICAL DEVICE can be modelled as part of a USE SCENARIO as shown in Figure A.1. While interacting with the MEDICAL DEVICE the USER perceives information (e.g. reading information from a display), cognitively transforms this information (e.g. interprets the display reading) and finally decides to perform an action (e.g. pressing a button at the USER INTERFACE). The MEDICAL DEVICE in turn receives the input from the USER, operates on it, and produces an output.

Figure A.1 shows two possible ways in which a USE ERROR can lead into a HAZARDOUS SITUATION.

– HAZARDOUS SITUATION (A) CAUSED BY A RESPONSE OF THIS MEDICAL DEVICE: THE USE ERROR represents an

erroneous input to the MEDICAL DEVICE, which in turn produces an output that leads directly to HAZARDOUS SITUATION (A). –

HAZARDOUS

SITUATION (B) CAUSED BY USER ACTION OR LACK OF ACTION (ON THE PATIENT OR WITH A

DIFFERENT MEDICAL DEVICE) BASED ON INFORMATION OBTAINED FROM THE MEDICAL DEVICE: The USE ERROR

occurs within the USE ENVIRONMENT but not at the MEDICAL DEVICE HAZARDOUS SITUATION (B).

USER INTERFACE that leads to

By the definition of this standard, a USE ERROR occurs at the “action” stage of this interaction cycle. This implies that errors that occur in the stage of perception (e.g. misreading a display) or at the stage of cognition (e.g. misinterpreting a number) are not considered USE ERRORS. Errors in perception and errors in cognition are rather considered contributing factors to or causes of USE ERRORS. A USE ERROR (an erroneous action or lack of action) can be caused by a misreading or by a misinterpretation of the MEDICAL DEVICE output, but the USE ERROR manifests itself only when an erroneous action or lack of action takes place.

EXAMPLE 1 The USER misreads the display of a CT imaging system, confuses left and right and starts treatment of the PATIENT on the wrong side.

EXAMPLE 2 The USER (and PATIENT) misreads the display of a glucose meter and concludes that the blood sugar level is too high when in fact it is too low. Instead of consuming sugar, the PATIENT uses an insulin pen that leads to a coma.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.HAZARDOUS SITUATIONAPerceptionOutputError in perceptionUSER INTERFACECognitionUSERError in cognition ProcessingMEDICAL DEVICEActionInputUSE ERRORActionUSE ERRORBHAZARDOUS SITUATIONIEC

Key

A HAZARDOUS SITUATION caused by a response of this MEDICAL DEVICE.

B HAZARDOUS SITUATION caused by USER action or lack of action on the PATIENT or with a different MEDICAL DEVICE based on information obtained from this MEDICAL DEVICE.

Where, perception is taken to mean perception or lack of perception, cognition is taken to mean cognition or lack of cognition and action is taken to mean action or lack of action. The lighter shaded error boxes are locations where errors can occur. Adapted from [36].

Figure A.1 – Model of USER-MEDICAL DEVICE interaction

Reducing USE ERRORS that can cause HAZARDOUS SITUATIONS is the focus of the USABILITY ENGINEERING PROCESS described in this standard. However, a USE ERROR does not always cause a HAZARDOUS SITUATION or lead to HARM. Therefore, a USE ERROR is not a RISK and does not have a SEVERITY.

During the usage of a MEDICAL DEVICE, not every occurrence of a USE ERROR causes a HAZARDOUS SITUATION and not every occurrence of a USE ERROR leads to HARM. The same type of USE ERROR could lead to HARM in one situation, while it is harmless in another. For example, the misreading of a glucose meter display resulting in 141 mg/dl instead of 140 mg/dl might not cause a problem, while the misreading of the same display of 240 mg/dl instead of 140 mg/dl would lead to HARM. However it is important to understand that a USE ERROR is subject to this USABILITY ENGINEERING PROCESS if it has the potential to cause a HAZARDOUS SITUATION.

A USE SCENARIO is a description of a USER interacting with the MEDICAL DEVICE to achieve a certain result under specific conditions of use. USE SCENARIOS can be written in many different forms ranging from story-like narratives, to simple lists of USER TASKS or steps in a TASK. The purpose of a USE SCENARIO is to illustrate how the functions of a MEDICAL DEVICE are used by USERS while they are trying to achieve a result. Figure A.2 shows in a schematic the way in which a USE SCENARIO ties together TASKS of a USER and functions of a MEDICAL DEVICE.

EXAMPLE 1 The USER accidentally dials in a wrong dose into an infusion pump system (USE ERROR), which in turn causes the infusion pump to deliver an overdose to the PATIENT (hazardous output).

EXAMPLE 2 The USER presses an incorrect button (USE ERROR), and gets a message on the display (wrong output), which leads to a HAZARDOUS SITUATION.

USE SCENARIOS can cover a wide range of situations, including CORRECT USE, USE SCENARIOS in which the USER successfully achieves a desired result, and NORMAL USE with USE ERROR, USE SCENARIOS, which illustrates how a USE ERROR could lead to an undesired result. When a USE SCENARIO leads to a HAZARDOUS SITUATION, the USE SCENARIO is called a HAZARD-RELATED USE SCENARIO. Figure A.3 shows in a schematic way in which a USE SCENARIO ties together TASKS of a USER and functions of a MEDICAL DEVICE within a HAZARD-RELATED USE SCENARIO.

Realistic examples of HAZARD-RELATED USE SCENARIOS are provided in Table B.2.

TimeUSE SCENARIOUSER conducts TASK 1USER conducts TASK 2USER conducts TASK 3Intended resultinteracts withinteracts withinteracts withleads toUSER INTERFACEMEDICAL DEVICEExpected responseIEC

Figure A.2 – Relationship of TASKS and functions within a USE SCENARIO

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.TimeHAZARD-RELATED USE SCENARIOUSER conducts TASK 1USER conducts TASK 2USE ERROR occurs in TASK 3HAZARDOUS SITUATIONinteracts withinteracts witherroneously interacts withleads toUSER INTERFACEMEDICAL DEVICEUnexpected responseLEC

Figure A.3 – Relationship of TASKS and functions and USE ERROR

within a HAZARD-RELATED USE SCENARIO

Definition 3.23 – USE SPECIFICATION

The USE SPECIFICATION was formerly known as the ‘application specification’ in the previous version of this standard. See also rationale for 5.1. Definition 3.24 – USER

USER is the commonly used term in the USABILITY ENGINEERING profession for all and any humans that might handle, operate or interact with a MEDICAL DEVICE. There can be a wide diversity of such individuals for any particular MEDICAL DEVICE including: installers, engineers, technicians, clinicians, PATIENTS, care givers, cleaners, sales, marketing, etc. A USER interacts with a MEDICAL DEVICE through its USER INTERFACE. A USER is distinct from the entity called RESPONSIBLE ORGANIZATION. USERS can be members of the RESPONSIBLE ORGANIZATION.

For the purposes of this International Standard, we need a term and definition that encompasses all of the persons who operate or handle MEDICAL DEVICES. Other standards have used the verb interact instead of operate or handle. The PATIENT interacts with a MEDICAL DEVICE by virtue of being the individual receiving treatment, being monitored or being diagnosed. This interaction can be independent of operating or handling the MEDICAL DEVICE. However, there are situations when the PATIENT is the USER, for example, a home glucose monitor.

In many situations the person operating or handling the MEDICAL DEVICE is performing TASKS unrelated to treating, monitoring or diagnosing the PATIENT, for example, installing, cleaning, moving, maintaining. Some USERS, who might include medical professionals (e.g., physicians, nurses, technicians, therapists) and laypersons (e.g., PATIENTS and caregivers), are sometimes called operators. Other USERS might include assemblers, installers, transporters, and maintainers.

USERS can interact with a MEDICAL DEVICE in a clinical setting (e.g., physician’s office, outpatient clinic, hospital, ambulance or laboratory) or non-clinical setting (e.g., home, office or outdoor setting). Definition 3.26 – USER INTERFACE

The USER INTERFACE includes all means of interaction between the MEDICAL DEVICE and the USER including both hardware and software interfaces. This includes, but is not limited to: – – – –

elements that require manual manipulation; cables and tubing connections; accessories; handles;

force required to move the weight; work surface height;

dimensions that affect reach requirements; markings and ACCOMPANYING DOCUMENTATION; video displays; push buttons; touch screens;

auditory, vibratory, tactile, and visual signals to inform USERS; voice recognition; keyboard and mouse; and haptic controls.

Definition 3.28 – USER INTERFACE SPECIFICATION

The USER INTERFACE SPECIFICATION is a collection of design requirements that are specific to the MEDICAL DEVICE and describe the technical characteristics of its USER INTERFACE. The USER INTERFACE SPECIFICATION, in particular, includes design requirements for those elements of the USER INTERFACE that are related to safe use including those that are RISK CONTROLS. The USER INTERFACE SPECIFICATION should provide enough detail and should be written in a way that allows hardware and software engineers to implement the USER INTERFACE consistent with design controls principles. Examples of USER INTERFACE design requirements are: – –

The display shall be visible at a distance of 1 m to three people standing side-by-side, with all able to read the text.

The MEDICAL DEVICE shall be capable of producing an auditory ALARM SIGNAL with a sound pressure level adjustable over the range of 45 dBA to 80 dBA when measured at 1 m from the front of the MEDICAL DEVICE.

The stylus shall activate software controls on the display when viewed at a horizontal angle of ± 50º from the central axis of the display and a vertical angle of ± 30º from the central axis of the display.

–

USER INTERFACE SPECIFICATION should be established early enough in the USABILITY ENGINEERING PROCESS to provide the necessary design inputs to the engineering team that is implementing the MEDICAL DEVICE. However when employing an iterative design methodology, the USER INTERFACE SPECIFICATION might need to be updated and refined as new insights about the prospective USER INTERFACE are gained through FORMATIVE EVALUATIONS. Finally when matured, the USER INTERFACE SPECIFICATION contains a comprehensive set of design specifications describing the technical characteristics of the final USER INTERFACE.

The

In the previous version of this standard, the ‘USABILITY specification’ contained this material and the USER INTERFACE SPECIFICATION was part of the USABILITY SPECIFICATION. The latter contained testable USER INTERFACE requirements as well as USE SCENARIOS. This standard handles those two conceptual components as separate items: the USER INTERFACE SPECIFICATION (5.6) and the USE SCENARIOS with a focus on those related to HAZARDOUS SITUATIONS (5.4). Subclause 4.1.1 – USABILITY ENGINEERING PROCESS (transport)

During transportation, design-induced USE ERRORS can lead to damage of a MEDICAL DEVICE by, for example, improper use of carrying handles while it is being transported. Another example of design-induced USE ERROR is packing the MEDICAL DEVICE in an improper position prior to shipping that leads to damage while in transit. (storage)

Similarly, USE ERRORS due to improper configuration during storage of a MEDICAL DEVICE can cause damage. For example, a design can lead a USER to stack a MEDICAL DEVICE in a way that causes damage. Design-

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.induced USE ERRORS could also lead a USER to store a MEDICAL DEVICE in an inappropriate condition, such as leaving a door open or leaving a MEDICAL DEVICE upside down while in storage thereby causing damage. Subclause 4.1.2 – RISK CONTROL as it relates to USER INTERFACE DESIGN

If practicable, the MEDICAL DEVICE should be designed to be inherently safe. If this is not practicable, then protective measures such as barriers or actively informing the USER are appropriate. The least preferred protective measure is information for SAFETY such as a written warning or contraindication. The MANUFACTURER should document the rationale for the option chosen in the USABILITY ENGINEERING FILE. Subclause 4.2 – USABILITY ENGINEERING FILE

The standard uses the term USABILITY ENGINEERING FILE to signify where the MANUFACTURER has located all of the RECORDS and other documents applicable to USABILITY ENGINEERING. This facilitates the USABILITY ENGINEERING PROCESS and enables more efficient auditing to this standard. Traceability is necessary to demonstrate that the USABILITY ENGINEERING PROCESS has been applied.

The RECORDS and other documents that make up the USABILITY ENGINEERING FILE can form part of other documents and files required, for example, the RISK MANAGEMENT FILE. The USABILITY ENGINEERING FILE need not physically contain all the RECORDS and other documents; however, it should contain at least references or pointers to all required documentation. Clause 5 – USABILITY ENGINEERING PROCESS

The purpose of the USABILITY ENGINEERING PROCESS, as described in this standard, is to provide SAFETY for the PATIENT, USER and others related to USABILITY. To achieve this purpose, the USABILITY ENGINEERING PROCESS mitigates RISK caused by USABILITY problems associated with CORRECT USE and USE ERRORS, i.e., NORMAL USE. Success is demonstrated by evaluating the USABILITY of the USER INTERFACE to acceptance criteria established in the USER INTERFACE SPECIFICATION. Therefore, in determining these acceptance criteria, the MANUFACTURER considers factors (e.g., the state of technology, experience with similar MEDICAL DEVICES, POST-PRODUCTION surveillance reports) needed to establish that when meeting these criteria, the RESIDUAL RISKS related to USABILITY are controlled to acceptable levels. The MANUFACTURER can apply the acceptance criteria determined according ISO 14971:2007, 3.4 d).

A comprehensive RISK MANAGEMENT PROCESS, such as that defined in ISO 14971, requires that a MANUFACTURER establish, document and maintain a PROCESS for identifying HAZARDS and HAZARDOUS SITUATIONS associated with a MEDICAL DEVICE, estimating and evaluating the associated RISKS, controlling those RISKS, and monitoring how effective those controls are throughout the LIFE-CYCLE. Such a PROCESS includes the following elements: – – – –

RISK ANALYSIS; RISK EVALUATION; RISK CONTROL; and

production and POST-PRODUCTION information.

When applying a comprehensive RISK MANAGEMENT PROCESS to the USER INTERFACE, estimating the RISK for each USE ERROR can be problematic, particularly because no validated techniques are known to exist to predict, in advance, the likelihood of a person committing a USE ERROR. However, this international standard provides a PROCESS that a MANUFACTURER can use to analyze, specify, design and evaluate the USABILITY of a MEDICAL DEVICE. Implementing this PROCESS permits the MANUFACTURER to deal with the unpredictability of a USER and minimize USE ERROR. This PROCESS helps the MANUFACTURER accomplish these objectives by:

a) discovering HAZARDS and HAZARDOUS SITUATIONS related to the USER INTERFACE;

b) designing and implementing measures to control the RISKS related to the USER INTERFACE; and c) evaluating the RISK CONTROL measures.

Other benefits of the USABILITY ENGINEERING PROCESS can include improved customer satisfaction, but these aspects are beyond the scope of this standard.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.Figure A.4 provides an overview of relationship and interactions between the RISK MANAGEMENT PROCESS in ISO 14971 and the USABILITY ENGINEERING PROCESS of this standard. RISK MANAGEMENT is a decision-making PROCESS for determining acceptable RISK whereas USABILITY ENGINEERING is a design and development PROCESS for the USER INTERFACE to reduce the possibility of USE ERRORS that could result in RISKS associated with USABILITY.

When the MANUFACTURER is identifying the characteristics related to SAFETY of the MEDICAL DEVICE in accordance with the requirements of ISO 14971:2007, 4.2, the USABILITY ENGINEERING PROCESS can provide the detail necessary (5.2) to accomplish this step for the USER INTERFACE of the MEDICAL DEVICE.

Further, when the MANUFACTURER is compiling a list of known or foreseeable HAZARDS and HAZARDOUS SITUATIONS associated with the MEDICAL DEVICE in accordance with the requirements of ISO 14971:2007, 4.3, the USABILITY ENGINEERING PROCESS provides a list of items that are required to be considered (5.3) in order to accomplish this step for the USER INTERFACE of the MEDICAL DEVICE.

ISO 14971 requires that RISKS associated with each of the identified HAZARDOUS SITUATIONS be estimated (ISO 14971:2007, 4.4), and evaluated (ISO 14971:2007, Clause 5). If a RISK is not acceptable using the MANUFACTURER'S RISK acceptability criterion, the MANUFACTURER is required to identify RISK CONTROL measure(s) that are appropriate for reducing the RISK(S) to an acceptable level (ISO 14971:2007, 6.2). The MANUFACTURER is then required to implement the identified RISK CONTROL measures and verify that they are effective in reducing the RISK to an acceptable level (ISO 14971:2007, 6.3).

The USABILITY ENGINEERING PROCESS requires that all known or foreseeable HAZARD-RELATED USE SCENARIOS (5.4) are addressed prior to selecting those HAZARD-RELATED USE SCENARIOS (5.5), which are then used in preparing the USER INTERFACE EVALUATION plan. In this standard, RISK CONTROL options related to use are identified during the development of the USER INTERFACE SPECIFICATION with testable requirements (5.6). Both the FORMATIVE EVALUATION and the SUMMATIVE EVALUATION of the implemented USER INTERFACE are planned in the USER INTERFACE EVALUATION plan (5.7). FORMATIVE EVALUATION is carried out during USER INTERFACE design and implementation (5.8) to explore the USER INTERFACE, identify the need for improvement or to confirm adequacy of the USER INTERFACE.

The implemented USER INTERFACE is subject to SUMMATIVE EVALUATION against testable requirements in the USER INTERFACE EVALUATION plan. These steps achieve the same objective as 4.4 through 6.3 of ISO 14971:2007.

Even when the USER INTERFACE meets the USER INTERFACE SPECIFICATION, the MANUFACTURER should perform an evaluation to determine if new HAZARDS or HAZARDOUS SITUATIONS have been generated in the MEDICAL DEVICE, as required in ISO 14971:2007, 6.6. If that USER INTERFACE does not meet the USER INTERFACE SPECIFICATION, the MANUFACTURER should perform a RESIDUAL RISK EVALUATION as required in 6.4 of ISO 14971:2007.

(decision making process)

USABILITY ENGINEERING IEC 62366-1

(design and development process)

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.A, B, C, D, E represent information flow between the two PROCESSES. The heavy solid lines (B, D and E) represent information flow required by this standard. New problems identified should be interpreted to mean new HAZARDS, HAZARDOUS SITUATIONS or HAZARD-RELATED USE SCENARIOS discovered or implemented RISK CONTROL is ineffective. a New problems identified should be interpreted to mean new USE ERRORS, HAZARDS, HAZARDOUS SITUATIONS, or

HAZARD-RELATED USE SCENARIOS have been identified. Key

A USE SPECIFICATION is an input to ISO 14971:2007, 4.2

B Identified USER INTERFACE characteristics related to SAFETY (see 5.2) C Identified foreseeable HAZARD and HAZARDOUS SITUATIONS (see 5.3).

D Identified sequences of events leading to HAZARDOUS SITUATIONS from ISO 14971:2007, 4.4 are an input to

determining HAZARD-RELATED USE SCENARIOS (see 5.4). E Evaluate RESIDUAL RISK

Figure A.4 – The relationship between the RISK MANAGEMENT PROCESS (ISO 14971:2007)

and the USABILITY ENGINEERING PROCESS (IEC 62366-1)

Subclause 5.1 – Prepare USE SPECIFICATION

The USABILITY ENGINEERING PROCESS as described in this standard begins by identifying the most important characteristics related to the use of the MEDICAL DEVICE. These characteristics are defined by the MANUFACTURER and are based on factors such as intended medical indication, intended PATIENT population and operating principle and are fundamental to the function of the MEDICAL DEVICE. This information is documented in the MEDICAL DEVICE USE SPECIFICATION. These attributes are fundamental design inputs for identifying the known and foreseeable HAZARDS and HAZARDOUS SITUATIONS related to the USER INTERFACE. The MEDICAL DEVICE USE SPECIFICATION is the foundation for defining the USER INTERFACE SPECIFICATION. The list of characteristics associated with the USE SPECIFICATION is a subset of the INTENDED USE as specified in ISO 14971.

(intended medical indication)

The intended medical indication can be very broad or quite narrow. It is important for the MANUFACTURER to clearly specify and indicate in the ACCOMPANYING DOCUMENTATION the intended medical indication. The USER needs to understand the intended medical indication in order to determine whether a given MEDICAL DEVICE is appropriate for the PATIENT at hand.

Some MEDICAL DEVICES are intended for very broad medical indications.

EXAMPLE 1 Safety syringe: indicated for intramuscular and subcutaneous injection of medication into a PATIENT. EXAMPLE 2 Multiparameter PATIENT monitor: indicated whenever there is a need for monitoring the physiological parameters of a PATIENT.

Other MEDICAL DEVICES are intended for very narrow medical indications.

EXAMPLE 3 Septostomy catheter: indicated catheterization for angiography of cardiovascular vessels and/or chambers.

EXAMPLE 4 Spinal fluid manometer: indicated for the measurement of the pressure of the cerebrospinal fluid during a lumbar puncture PROCEDURE.

(intended USER PROFILE)

It is important to design a MEDICAL DEVICE tailored to the intended USER(S). Factors that should be considered when developing a USER PROFILE include age, gender, linguistic and cultural background, level of education and professional competence. Potential disabilities of intended USERS should be taken into account. For example, a MEDICAL DEVICE for use by diabetics should consider that they often have poor visual acuity and have a poor sense of touch. (USE ENVIRONMENT)

The intended conditions of use or attributes of the USE ENVIRONMENT are important considerations for the use of the particular MEDICAL DEVICE in question. This can include such aspects as: –

sterile or non-sterile,

single use or reusable (needing reprocessing between uses), hospital use or home use,

ambulance use, in hospital transport or wall mounted, general ward or operating theatre use, ambient lighting or noise levels; and

USER’S personal protective equipment.

(operating principle)

The operating principle for a MEDICAL DEVICE includes descriptions of: –

physical methods used to accomplish its INTENDED USE; and

EXAMPLE 1 EXAMPLE 2 EXAMPLE 3

A scalpel using highly focused laser energy. A scalpel using sharpened stainless steel blade. A scalpel using high-energy HF electromagnetic fields.

– mechanisms by which it works.

EXAMPLE 4 An intravenous infusion pump delivers medication through an intravenous line connected to a PATIENT catheter by a peristaltic mechanism employing rollers and mechanical fingers that squeeze and push fluid through plastic tubing.

EXAMPLE 5 An intravenous infusion pump delivers medication through an intravenous line connected to a

PATIENT catheter by a volumetric pump that has plungers connected to a diaphragm on a cassette mechanism connected to PATIENT tubing that draws fluid from an IV bag by creating a vacuum within the cassette mechanism.

Subclause 5.2 – Identify USER INTERFACE characteristics related to SAFETY and potential USE ERRORS The characteristics related to SAFETY include those related to the USE SPECIFICATION and how the MEDICAL DEVICE is to be used (see ISO 14971:2007, C.2.1) including:

a) whether the MEDICAL DEVICE is intended to be routinely cleaned and disinfected or cleaned and

sterilized (see ISO 14971:2007, C.2.9); b) whether the MEDICAL DEVICE is interpretative (see ISO 14971:2007, C.2.12);

c) whether use of the MEDICAL DEVICE requires special training (see ISO 14971:2007, C.2.26) or other

information for SAFETY is provided in general (see ISO 14971:2007, C.2.27); and d) whether successful application of the MEDICAL DEVICE depends on human factors in general (see

ISO 14971:2007, [C.2.29). This includes whether USE ERROR can be caused by the USER INTERFACE including:

– – – –

connection TASKS, displays, action menus,

or by the USE ENVIRONMENT.

To identify USER INTERFACE characteristics that could be related to SAFETY it can be helpful to break down top level functions into TASKS for the USER and functions for the MEDICAL DEVICE. One possible method for this is functional analysis. This list of TASK activities and corresponding MEDICAL DEVICE functions provides input to identification of both technical requirements to the MEDICAL DEVICE including its USER INTERFACE SPECIFICATION and to further analysis of USABILITY such as TASK analysis. Both these identified results can constitute or help identify further characteristics related to SAFETY.

Subclause 5.3 – Identify known or foreseeable HAZARDS and HAZARDOUS SITUATIONS

The MANUFACTURER is required to compile a list of anticipated HAZARDS and HAZARDOUS SITUATIONS associated with the use of a MEDICAL DEVICE as part of the RISK MANAGEMENT PROCESS as specified in ISO 14971. A HAZARD cannot result in HARM unless a PATIENT, USER or a third party is truly exposed to it (i.e. a HAZARDOUS SITUATION occurs). Figure E.1 from ISO 14971:2007 illustrates the concept of exposure and other aspects. Figure A.1 demonstrates the linkage between the concept of a USE ERROR as a cause for a resulting HAZARDOUS SITUATION and HARM (exposure to a HAZARD).

In identifying HAZARD-RELATED USE SCENARIOS, the MANUFACTURER should investigate not only specific TASKS that the MANUFACTURER intends the USER to perform, but also other TASKS and actions that the MANUFACTURER does not intend the USER to perform but are reasonably foreseeable. Subclause 5.5 – Select the HAZARD-RELATED USE SCENARIOS for SUMMATIVE EVALUATION

MEDICAL DEVICES can have only a few or a very large number of HAZARD-RELATED USE SCENARIOS and especially in the latter case, it is important for MANUFACTURERS to focus their attention and resources on the USER INTERFACE elements that could have the most impact on USERS’ interactions with the MEDICAL DEVICE. This requires that MANUFACTURERS develop a scheme to make this determination in order to select the HAZARD-RELATED USE SCENARIOS (i.e. which USE SCENARIOS to include in the SUMMATIVE EVALUATION).

Selection of the HAZARD-RELATED USE SCENARIOS can be based on the SEVERITY of the potential consequences of the associated HAZARDS. It can be needed in this way to focus on HAZARDS rather than RISKS because the probability of occurrence of encountering a HAZARD, which is one component of RISK, can be very difficult to estimate, especially for a novel MEDICAL DEVICE for which no POST-PRODUCTION data are available.

Another basis for selection of the HAZARD-RELATED USE SCENARIOS is the RISK of the occurrence of HARM to the PATIENT or USER. These values can also be difficult to determine, as they are based on assumptions closely related to probability of occurrence and without data, can be difficult to justify. Finally, and only in the presence of data that provides a justification, should RISK values based on the combination of SEVERITY and probability of occurrence of the HAZARD be used as the basis for prioritization of HAZARD-RELATED USE SCENARIOS. Values for these probabilities or probability of occurrence can be derived from POST-PRODUCTION data on current or previous versions of the same MEDICAL DEVICE or on the level of certainty that the RISK CONTROL measures are effective, which should also be justified with data.

A more controversial approach to HAZARD-RELATED USE SCENARIO prioritization takes the effects of time into consideration. For example, IEC 60601-1-8:2006 and IEC 60601-1-8:2006/AMD1:2012, Table 1, uses this approach. A similar approach could be taken for prioritizing TASKS for inclusion in USABILITY TESTING. This approach is similar to an estimation of RISK based on analysis of the sequence of events leading to HARM, by estimating components of probability using e.g. fault tree analysis. Subclause 5.6 – Establish USER INTERFACE SPECIFICATION

Based on the information collected in the preceding PROCESS steps, the USER INTERFACE SPECIFICATION contains the detailed and testable design requirements for the USER INTERFACE to ensure that the MEDICAL DEVICE that RISKS caused by USABILITY problems are acceptable. These requirements are MEDICAL DEVICE-function specific as they are based on the USE SPECIFICATION as well as the identified USE ERRORS and the HAZARD-RELATED USE SCENARIOS.

Subclause 5.7 – Establish USER INTERFACE EVALUATION plan

The MANUFACTURER should apply one or more methods for the USER INTERFACE EVALUATION. Findings based on any single method can be insufficient (e.g. simulated use might not be adequate to explore some HAZARD-RELATED USE SCENARIOS). This might require supplemental USER INTERFACE EVALUATION under conditions of actual use.

Subclause 5.7.2 – FORMATIVE EVALUATION planning

(criteria for determining when no further iterations are needed)

FORMATIVE EVALUATION of USABILITY including USABILITY TESTS typically does not have formal acceptance criteria. The purpose of these evaluations is to iterate the design of the USER INTERFACE to achieve a specified quality level and to increase the likelihood that the final SUMMATIVE EVALUATION of the USABILITY of the USER INTERFACE can be conducted successfully. The decision to stop iterating the USER INTERFACE design is based on the quality level being measured during the later stages of FORMATIVE EVALUATIONS. No further iterations are required when the quality level has been achieved that gives the MANUFACTURER the confidence that the final acceptance criteria will be met when the SUMMATIVE EVALUATION is conducted at the end of the iterative design cycle.

d) (availability of the ACCOMPANYING DOCUMENTATION and provision of training)

ACCOMPANYING DOCUMENTATION is part of the MEDICAL DEVICE USER INTERFACE and should be available to the USER during the SUMMATIVE EVALUATION, as appropriate to simulate realistic use. SUMMATIVE EVALUATION is intended to simulate actual use with intended USERS. Its purpose is to evaluate the USABILITY of USER INTERFACE as it relates to the successful completion of the TASKS associated with HAZARD-RELATED USE SCENARIOS. For SUMMATIVE EVALUATION to be a realistic simulation of actual use, both the actual ACCOMPANYING DOCUMENTATION needs to be available to the USER and the USER needs to have received the expected training.

If USER training is a RISK CONTROL measure and is expected prior to use, that training needs to be received and an appropriate elapsed time to accommodate for learning decay needs to occur. Since in this case the training is a RISK CONTROL measure, the SUMMATIVE EVALUATION cannot evaluate its ‘effectiveness as a RISK CONTROL measure’ if the training has not been delivered in a realistic manner. Similarly, the ‘effectiveness as a RISK CONTROL measure’ of the ACCOMPANYING DOCUMENTATION cannot be assessed if the ACCOMPANYING DOCUMENTATION is not available to the USER in a realistic manner.

NOTE Effectiveness as a RISK CONTROL measure’ relates to ISO 14971:2007, 6.3, and not to the defined term, EFFECTIVENESS.

e) (USABILITY TEST)

SUMMATIVE EVALUATION of USABILITY has formal acceptance criteria. Documenting the criteria for determining whether the USER has successfully completed the TASKS associated with the HAZARD-RELATED USE SCENARIOS is required. These criteria correspond to the criteria for RISK acceptability as required in ISO 14971:2007, 3.4 d). Furthermore, these criteria need to be consistent with the MANUFACTURER’S policy for setting RISK acceptability criteria as required in ISO 14971:2007, 3.2. One possible way to express these criteria is that no USE ERROR that leads to HARM occurs. Another way is no USE ERROR leads to unacceptable RISK of HARM. Although USERS might not commit a USE ERROR while performing a TASK, they might have difficulty performing the TASK. A use difficulty could become a USE ERROR, which could lead to HARM. Use difficulties can appear in USABILITY TESTING, for example, as a USER hesitating, “exploring” the USER INTERFACE, unexpectedly referring to the ACCOMPANYING DOCUMENTATION before taking the correct action or commenting during the post-test interview that something was hard to do. Difficulties can result from USER confusion and might indicate USER INTERFACE features that have an increased potential to cause USE ERROR for different USERS or under different conditions of use. Sample use difficulties are listed below. – – – – –

USER browses through many MEDICAL DEVICE display screens before finding the one enabling her to view a PATIENT monitor’s alarm limits.

USER comments that the graduation marks on a pre-filled, glass syringe are difficult to read because the marks are thin lines with low contrast against the background surface.

USER struggles to open a package containing a sterile MEDICAL DEVICE, pulling on a tab with great force. Suddenly, the package tears open, almost causing the contents to spill out.

USER repeatedly presses a fluid tube into an air detector in an attempt to keep it in place.

USER comments that the display on an infusion pump has glare and is hard to read. Consequently, the USER struggles to identify the correct infusion rate but finally succeeds in setting the rate.

Subclause 5.8 – Perform USER INTERFACE design, implementation and FORMATIVE EVALUATION

The design of the USER INTERFACE should be focused on the USER'S needs and requirements. A multidisciplinary team approach to USER INTERFACE design is required. This team can include actual USERS, engineers, USER-interface specialists, cognitive psychologists, multimedia programmers, USABILITY engineers, marketing and training personnel. The MANUFACTURER should conduct iterative USER INTERFACE design and development. USABILITY ENGINEERING, including FORMATIVE EVALUATION, should begin early and continue iteratively throughout the MEDICAL DEVICE design and development PROCESS. Subclause 5.9 – Perform SUMMATIVE EVALUATION of the USABILITY of the USER INTERFACE

The final phase of the USABILITY ENGINEERING PROCESS is the SUMMATIVE EVALUATION of the USABILITY of the selected HAZARD-RELATED USE SCENARIOS. SUMMATIVE EVALUATION is a part of the activities involved in

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.verifying and validating the overall MEDICAL DEVICE design. It can be thought of as the validation of the use-related SAFETY aspects of the USER INTERFACE.

NOTE The concept of SAFETY includes loss or degradation of performance resulting in an unacceptable RISK to the PATIENT, including USE ERROR that prevents the USER from effectively using the MEDICAL DEVICE to achieve its intended medical purpose. In IEC 60601-1 this is referred to as ‘essential performance’.

In the case of a design modification, the SUMMATIVE EVALUATION can be performed by looking at data obtained from previous SUMMATIVE EVALUATIONS for the parts that have not changed. This is the same PROCESS that is used for any POST-PRODUCTION design modification.

EXAMPLE 1 Data from a prefilled pen injector SUMMATIVE EVALUATION of the same pen injector with a new drug, but for same intended USER GROUPS, USER PROFILES and USE ENVIRONMENTS, where only the aspects related to the new drug are tested.

EXAMPLE 2 Data from a prefilled pen injector SUMMATIVE EVALUATION of the same prefilled pen, with an added USER GROUP or added USE ENVIRONMENT, where only the added USER GROUP or added USE ENVIRONMENT is tested.

EXAMPLE 3 Data from the SUMMATIVE EVALUATION of a previous version of a prefilled pen injector, where only the modified display components are tested.

Individuals that were directly responsible for the USER INTERFACE design should not conduct the SUMMATIVE EVALUATION.

Nearly every SUMMATIVE EVALUATION finds USE ERRORS by the USERS during the USABILITY TEST. When this occurs, the MANUFACTURER needs to analyze those data to identify the root cause of each such finding. Both observations of USER performance and subjective comments from the USER related to that performance should be used to help identify the root cause.

The same USE ERROR or other difficulty can be possible in multiple USE SCENARIOS. One purpose of this analysis of observed USE ERRORS is to identify the specific HAZARD-RELATED USE SCENARIO related to the observed USE ERROR and to determine whether other USE SCENARIOS could also be impacted. This is important since not every HAZARD-RELATED USE SCENARIO has associated HARM of the same SEVERITY. The observed USE ERROR or other difficulty could occur in a different USE SCENARIO with greater SEVERITY. After analysing the results of the SUMMATIVE EVALUATION, the MANUFACTURER can discover that some of the RISK CONTROL measures in the USER INTERFACE are not effective (e.g. the criteria documented in the USER INTERFACE EVALUATION plan were not met). When this occurs, the SUMMATIVE EVALUATION becomes, in effect, a FORMATIVE EVALUATION and the MANUFACTURER returns to step 5.6 in the USABILITY ENGINEERING PROCESS. It also is possible to discover new HAZARDS or HAZARDOUS SITUATIONS during a SUMMATIVE EVALUATION or even a new HAZARD-RELATED USE SCENARIO. When this occurs the MANUFACTURER returns to step 5.3 in the USABILITY ENGINEERING PROCESS since new HAZARDS or HAZARDOUS SITUATIONS have been identified. Subclause C.2.1 – USE SPECIFICATION

The USE SPECIFICATION is the essential source used to identify the most important characteristics related to the use of a MEDICAL DEVICE. When evaluating a USER INTERFACE including UOUP, the ACCOMPANYING DOCUMENTATION can provide a valuable source for retrospectively establishing the USE SPECIFICATION. Furthermore, the USE SPECIFICATION needs to be consistent with the ACCOMPANYING DOCUMENTATION. Therefore, it is best practice to carefully review the ACCOMPANYING DOCUMENTATION. Elements of the USE SPECIFICATION which cannot be derived (determined) from the ACCOMPANYING DOCUMENTATION need to be established using other sources.

Subclause C.2.2 – Review of POST-PRODUCTION information

Available POST-PRODUCTION information is reviewed to identify known problems with the MEDICAL DEVICE with UOUP that might have been caused by USABILITY problems in the USER INTERFACE. Because the POST-PRODUCTION information can be incomplete (e.g., due to under-reporting of adverse events and customer complaints) and the root cause of the problem can be difficult to identify, the MANUFACTURER should analyze the SEVERITY of the potential HARM associated with the identified problem rather than the number of event reports, customer complaints or product recalls.

To analyze all RISKS of a MEDICAL DEVICE caused by USE ERROR(S) or poor USABILITY, the MANUFACTURER needs to consider carefully the full range of USE SCENARIOS and associated factors that could lead to HARM, including those that prevent the USER from effectively using the MEDICAL DEVICE to achieve its intended medical purpose. To analyze successfully those factors, it is important to understand the meanings of the terms as shown in Table B.1 and their relationship.

Table B.1 – Glossary of relevant RISK MANAGEMENT terms

Term

HARM

Annex B (informative)

Meaning from ISO 14971:2007

physical injury or damage to the health of people, or damage to property or the environment

potential source of HARM

circumstance in which people, property, or the environment are exposed to one or more HAZARD(S)

combination of the probability of occurrence of HARM and the SEVERITY of that HARM

freedom from unacceptable RISK

measure of the possible consequences of a HAZARD

HAZARD

HAZARDOUS SITUATION

RISK

SAFETY SEVERITY

Table B.2 provides representative examples of possible HAZARDS, associated HAZARD-RELATED USE SCENARIO description, and the resulting HARM. Furthermore, Table B.2 suggests possible USER INTERFACE RISK CONTROL measures or mitigation strategies.

Table B.2 – Examples of HARM due to RISK caused by USE ERROR(S)

or poor USABILITY (1 of 3)

HAZARD Radiation energy

HAZARD-RELATED USE SCENARIO

description

HARM Burn

USER INTERFACE RISK CONTROL measure

Physician accidentally activates unguarded fire control. Energy source operates. Energy source is directed at bystander.

Hinged cover placed over fire control

Protective measure (guard)

Needle-stick prevention mechanism

Protective measure (guard)

Sharp point of needle

(infected needle)

Skin puncture After inserting intravenous

(infection) catheter, Physician places used unprotected needle onto hospital bed sheet.

Physician forgets to remove needle. Orderly changes bed sheets.

Unprotected needle lying on hospital bed.

Orderly suffers needle stick injury.

HAZARD

Falling on hard floor

HAZARD-RELATED USE SCENARIO

description

HARM Fractured hip

USER INTERFACE RISK CONTROL measure

Hospital bed guardrail locking

mechanism difficult to engage. Nurse fails to recognize that the guardrail is not fully engaged.

Guardrail not correctly engaged. PATIENT rolls onto side, pressing

against guardrail. Guardrail drops and PATIENT falls to floor.

Easy to use guardrail

mechanism. Conspicuous indication of not being engaged. Two-step mechanism to unlock guardrail.

Inherent SAFETY by design

Incorrect output

Nurse inadvertently misconnects tubing of intravenous medication source to neuraxial access port. The two different delivery routes use the same Luer connector. The nurse did not check the tubing connections from medication source to access port. Tubing of intravenous medication source misconnected to neuraxial access port.

Intravenous medication is delivered to PATIENT’S spinal nerve column.

Permanent paralysis

Use of application-specific small-bore connectors that are mechanically incompatible.

Inherent SAFETY by design Additional training to assure proper fluid pathway prior to starting delivery. Information for SAFETY (training)

Incorrect output

The previous valid value of acceptable oxygen concentration in inspired gas mixture remains on the display, but the monitor requires recalibration. The failure to properly calibrate is not clearly indicated. The anaesthetist fails to check the monitor calibration. The anaesthetist believes that the oxygen supply is operating properly. Miscalibrated gas monitor displays a hazardous, incorrect value of oxygen concentration.

The anaesthetist delivers a hypoxic mixture to the PATIENT.

Hypoxic brain injury

Add a ‘monitor calibration needed’ ALARM CONDITION. Back-up oxygen supply failure ALARM CONDITION. Protective measure (ALARM CONDITION)

Incorrect output of drug (morphine)

A high volume of morphine is being administered to PATIENT in a high-stress emergency care situation under low ambient lighting. Emergency physician needs to change the dose and cannot clearly read the display of the infusion pump. The emergency physician incorrectly inputs the concentration of the morphine infusion rate. Using an infusion pump that is difficult to read in this environment of use. Infusion pump delivers over-dose of morphine.

Respiratory arrest Include a backlight on the display.

Inherent SAFETY by design Implement software message on the infusion pump that

informs the USER of the out of limit concentration or dose values that requires confirmation step. Protective measure

HAZARD

Incorrect output of drug (insulin)

HAZARD-RELATED USE SCENARIO

description a

HARM Coma

USER INTERFACE RISK CONTROL measure

PATIENT (USER) has poor vision. Unit of measure labels are not clear on glucometer. Poor ambient lighting in PATIENT’S home.

PATIENT selects display of blood glucose in incorrect units and

misreads current blood glucose level. Using a glucose meter that is difficult to read by a PATIENT.

PATIENT administers excessive amount of insulin.

Include a backlight on the display.

USER-adjustable display character size

Inherent SAFETY by design Implement software message that entered units of blood glucose measurement is not compatible with designated country of use that requires confirmation step. Protective measure

The USE SCENARIO description includes the sequence of events, at least one of which is a USE ERROR, and contributory factors that lead from a HAZARD through a HAZARDOUS SITUATION to HARM. Underlined portions of the description indicate the USE ERROR. Italic portions of the description indicate the HAZARDOUS SITUATION.

Evaluation of a USER INTERFACE OF UNKNOWN PROVENANCE (UOUP)

C.1 General

This annex was created in recognition of the fact that many MANUFACTURERS will be interested in applying the tools defined in this standard to USER INTERFACES or parts of USER INTERFACES that have already been commercialized prior to the publication of this edition of this standard. Such USER INTERFACES or parts of USER INTERFACES were not developed using the PROCESSES of IEC 62366-1 and as a result are of unknown provenance with respect to these PROCESSES. Since this standard focuses on USABILITY ENGINEERING as part of the product development PROCESS, it was determined that an appropriately scaled (as described in 4.3) and alternative PROCESS should be developed to cover these USER INTERFACES or parts of USER INTERFACES of unknown provenance.

The following represents such a PROCESS that relies wherever possible on existing documentation that was created during the development of a legacy USER INTERFACE or part of a USER INTERFACE. It also attempts to allow the PROCESS to be applied utilizing organizational resources as efficiently as possible. When completed, it will result in the creation of a USABILITY ENGINEERING FILE and assure that the RISK MANAGEMENTFILE Identifies RISKS caused by USABILITY problems of the USER INTERFACE.

The PROCESS of this annex can be applied to UOUP for A USER INTERFACE or part of a USER INTERFACE for which adequate RECORDS of the development using the USABILITY ENGINEERING PROCESS of IEC 62366-1:— are not available. However, if any modifications are made to the USER INTERFACE or its parts, only the unchanged parts of the USER INTERFACE remain UOUP and the changed parts of the USER INTERFACE are subject to 5.1 to 5.8.

EXAMPLE 1 For an unchanged legacy USER INTERFACE that was designed and developed prior to the publication of IEC 62366-1:—, the USER INTERFACE is evaluated using this annex for determining conformance to this standard. EXAMPLE 2 A USER INTERFACE, without adequate RECORDS of development to IEC 62366-1:— is subsequently modified. The modified parts are evaluated using 5.1 to 5.8 for determining conformance to this standard. The unmodified parts of the USER INTERFACE are evaluated using this annex for determining conformance to this standard. EXAMPLE 3 A USER INTERFACE that was designed and developed prior to the publication of IEC 62366-1:— is subsequently modified by adding a new software feature. The USER INTERFACE of the added software feature and all parts of the USER INTERFACE that are affected by the added software feature are evaluated using 5.1 to 5.8 for determining conformance to this standard. The unmodified parts of the original USER INTERFACE are evaluated using this annex for determining conformance to this standard.

EXAMPLE 4 An existing USER INTERFACE is changed to rely on a general purpose component for which no adequate RECORDS of the development using IEC 62366-1:— exist. Changes to the existing USER INTERFACE ARE needed to integrate the general purpose component into the MEDICAL DEVICE. The necessary changes of the USER INTERFACE caused by integrating the general purpose component are evaluated using 5.1 to 5.8 for determining conformance to this standard. The unmodified parts of the original USER INTERFACE are evaluated using this annex for determining conformance to this standard.

C.2 USABILITY ENGINEERING PROCESS for USER INTERFACE OF UNKNOWN

PROVENANCE

C.2.1

*USE SPECIFICATION

The MANUFACTURER shall establish a USE SPECIFICATION as required in 5.1. The MANUFACTURER shall store this USE SPECIFICATION in the USABILITY ENGINEERING FILE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. C.2.2

*Review of POST-PRODUCTION information

The MANUFACTURER of the MEDICAL DEVICE with UOUP shall review available POST-PRODUCTION information including complaints and field reports for incidents or near incidents.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.All identified cases of USE ERROR that could result in a HAZARDOUS SITUATION or those cases where field information suggests HAZARDS or HAZARDOUS SITUATIONS that could have been caused by inadequate USABILITY shall be stored in the USABILITY ENGINEERING FILE and addressed in C.2.3 and C.2.4. Compliance is checked by inspection of the USABILITY ENGINEERING FILE. C.2.3

HAZARDS and HAZARDOUS SITUATIONS related to USABILITY

The MANUFACTURER shall review the RISK ANALYSIS of the MEDICAL DEVICE with UOUP and ensure that the HAZARDS and HAZARDOUS SITUATIONS associated with USABILITY have been identified and documented. Compliance is checked by inspection of the USABILITY ENGINEERING FILE. C.2.4

RISK CONTROL

The MANUFACTURER shall verify and document that adequate RISK CONTROL measures have been implemented for all identified HAZARDS AND HAZARDOUS SITUATIONS identified in C.2.3 and that all RISKS are reduced to an acceptable LEVEL as indicated by the RISK ASSESSMENT.

If the MANUFACTURER determines that changes to any part of the USER INTERFACE are required to reduce RISK to an acceptable LEVEL, those changes shall not be considered UOUP and shall be subject to the requirements of 5.1 through 5.8.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE. C.2.5

RESIDUAL RISK EVALUATION

Based on any new information identified in performing steps C.2.3 and C.2.4, the MANUFACTURER shall re-evaluate the overall RESIDUAL RISK according to ISO 14971:2007, 6.4, and document the result in either the USABILITY ENGINEERING FILE OR THE RISK MANAGEMENT FILE.

Compliance is checked by inspection of the USABILITY ENGINEERING FILE OR THE RISK MANAGEMENT FILE.

Types of MEDICAL DEVICE use, with examples

For the purposes of this standard, MEDICAL DEVICE use can be broadly categorized into actions that are foreseeable and those that are not foreseeable. Clearly, those USER actions or inactions that are not foreseeable cannot be dealt with by this or any other standard. This International Standard describes a PROCESS that deals those USER actions or inactions that can be foreseen.

In Figure D.1, the relationship of the different types of MEDICAL DEVICE use is shown along with some examples of their causes.

Use that falls within NORMAL USE can be a response that is intended by the MANUFACTURER and expected by the USER, i.e. CORRECT USE. Alternately, the use could result from a USE ERROR or could result from conduct that is beyond any additional means of RISK CONTROL by the MANUFACTURER, i.e., ABNORMAL USE. This does not necessary mean that ABNORMAL USE results is a poor outcome for the PATIENT. Often the clinical judgement of the USER indicates that such use is in the best interest of the PATIENT.

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www. NORMAL USE CORRECT USE • Use without USE ERROR USE ERROR USE ERROR caused by perception error • Failure (e.g. inability) to see visual information (e.g. display is partly covered or light reflections on display) • Failure (e.g. inability) ) to hear auditory information (e.g. due to ambient noise or information overload) USE ERROR caused by cognition error • Memory Failures:o Inability to recall knowledge which was gained beforeo Omitting (e.g. forgetting) a planned step • Rule-based Failures:o Misapplication of appropriate generally accepted ruleo Inability to recall knowledge which was gained before • Knowledge-based Failures:o Improvisation under unusual circumstanceso Misinterpretation of information due to incorrect mental model USE ERROR caused by action error • Failure (e.g. inability) to reach control (e.g. components too far apart) • Contact with wrong component (e.g. components too close together) • Inappropriate force applied to component (e.g. force required does not match actual conditions of use) • Failure (e.g. inability) to activate control (e.g. force required not matched to characteristics of the intended USERS) ABNORMAL USE • • • • Exceptional violation (e.g. using a MEDICAL DEVICE as a hammer) Reckless use (e.g. using a MEDICAL DEVICE after removing its protective guards)Sabotage (e.g. hacking the software of a software-controlled MEDICAL DEVICE)Conscious disregard for the contraindications (e.g. use on a PATIENT that has a pacemaker)IECFigure D.1 – Interrelationships between the different

types of MEDICAL DEVICE use, with examples

Reference to the essential principles

This standard has been prepared to support the essential principles of SAFETY and performance of MEDICAL DEVICES according to ISO/TR 16142.

Compliance with this document provides one means of demonstrating conformance with the specific essential principles of ISO/TR 16142. Other means are possible. Table E.1 maps the clauses and subclauses of this document with the essential principles of ISO/TR 16142:2006.

Table E.1 – Correspondence between this document and the essential principles

Clause/subclause of this

document All 5.11 4.1.4

Corresponding essential principle A.1, A.2, A.3, A.9.2, A.10.2, A.12.8 A.6 A.13

[1]

IEC 60601-1:20053), Medical electrical equipment – Part 1: General requirements for basic safety and essential performance IEC 60601-1:2005/AMD1:2012

IEC 60601-1-6:20104), Medical electrical equipment – Part 1-6: General requirements for basic safety and essential performance – Collateral standard: Usability IEC 60601-1-6:2010/Amd1:2013

IEC 60601-1-8:20065), Medical electrical equipment – Part 1-8: General requirements for basic safety and essential performance – Collateral standard: General requirements, tests and guidance for alarm systems in medical electrical equipment and medical electrical systems IEC 60601-1-8:2006/AMD1:2012

IEC 60601-1-11:—6), Medical electrical equipment – Part 1-11: General requirements for basic safety and essential performance – Collateral standard: Requirements for medical electrical equipment and medical electrical systems used in the home healthcare environment

IEC TR 61258:2008, Guidelines for the development and use of medical electrical equipment educational materials

ISO/IEC Guide 63:2012, Guide to the development and inclusion of safety aspects in International Standards for medical devices

ISO 7010:2011, Graphical symbols – Safety colours and safety signs – Registered safety signs ISO 9000:2005, Quality management systems – Fundamentals and vocabulary ISO 9001:2008, Quality management systems – Requirements

ISO 9241-11:1998, Ergonomic requirements for office work with visual display terminals (VDTs) – Part 11: Guidance on usability

ISO 13485:2003, Medical devices – Quality management systems – Requirements for regulatory purposes

ISO/TR 16142:2006, Medical devices – Guidance on the selection of standards in support of recognized essential principles of safety and performance of medical devices

ANSI/AAMI HE 48:1993, Human factors engineering guidelines and preferred practices for the design of medical devices

ANSI/AAMI HE 74:2001, Human factors design process for medical devices

ANSI/AAMI HE 75:2009, Human factors engineering – Design of medical devices EN 1041:2008, Information supplied by the manufacturer of medical devices Amendment 1:2013

[2]

[3]

[4]

[5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16]

[17] GHTF SG2N31R8:2003, Global Harmonization Task Force (GHTF), Study Group 2 (SG2), Medical

[18] [19] [20]

Device Post Market Vigilance and Surveillance: Proposal for Reporting of Use Errors with Medical Devices by their Manufacturer or Authorized Representative

BEYER, H., HOLTZBLATT, K., Contextual Design: defining customer-centred systems. Morgan Kaufmann Publishers Inc, San Francisco CA, 1998

BROWN, D. The challenges of user-based design in a medical device market. In D. Wixon and Ramey (Eds.), Field Methods Casebook for Software Design. New York: Wiley, 1996, pp. 157-176. CALLAN, J. R., KELLY, R. T., QUINN, M. L., GWYNNE, J. W. III, MOORE, R. A., MUCKLER, F.A., KASUMOVIC, J., SAUNDERS, W.M., LEPAGE, R.P., CHIN, E., SCHOENFELD, I., and SERIG, D.I. (1995). Human factors evaluation of remote afterloading brachytherapy. (NUREG/CR-6125, Volumes 1-3) Washington, D. C.: U. S. Nuclear Regulatory Commission.

3) There exists a consolidated edition 3.1(2012) including IEC 60601-1:2005 and Amendment 1:2012. 4) There exists a consolidated edition 3.1(2013) including IEC 60601-1-6:2010 and Amendment 1:2013. 5) There exists a consolidated edition 2.1(2012) including IEC 60601-1-8:2006 and Amendment 1:2012. 6) Edition 2, to be published.

[23] [24]

[25] [26]

[27] [28] [29] [30] [31] [32]

[33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43]

[44] [45] [46]

COOKE, N. J. Varieties of knowledge elicitation techniques. Int'l J Human-Computer Studies. 1994:41, pp. 801-849

DRURY, C. G., PRABHU, P., and GRAMOPADHYE, A. (). Task analysis of aircraft inspection activities: Methods and findings. Proceedings of the Human Factors Society 34th Annual Meeting. Santa Monica, CA: Human Factors and Ergonomics Society. 1990, pp. 1181-1185.

DUMAS, J. and REDISH, J., A Practical Guide to Usability Testing (Revised Edition), Exeter, UK, Intellect, 1999.

ELLIS, S. R., BEGAULT, D. R., and WENZEL, E. M.. Virtual environments as human-computer interfaces. In M. G. Helander, T. K. Landauer, and P. V. PRABHU (Eds.), Handbook of human-computer interaction. Amsterdam: Elsevier. 1997, pp. 163-201

FLEISHMAN, E. A., and QUAINTANCE, M. K. Taxonomies of human performance: The description of human tasks. Orlando: Academic Press, 1984

GUNDRY JW, COMESS KA, Derook FA, JORGENSON D, BRADY GH. Comparison of naïve sixth-grade children with trained professionals in the use of an automated external defibrillator. Circulation. 2000 Nov 14;102(20):E166.

KIRWAN, B. and AINSWORTH, L. K. A Guide to Task Analysis. London, UK: Taylor & Francis, 1992. HOLTZBLATT, K., and JONES, S. Contextual inquiry: Principles and practice. In D. Schuler and A. Namioka (Eds.), Participatory Design: Principles and Practice. Hillsdale, NJ: Erlbaum(1993).

JONASSEN, D. L., HANNUM, W. H., and TESSMER, M. Handbook of Task Analysis Procedures. Westport: Greenwood Publishing Group, 19

KLEIN, G. A., ORASANU, J., CALDERWOOD, R., and ZSAMBOK, C. E. Decision Making in Action: Models and Methods. Norwood, New Jersey: Ablex Publishing Corp, 1993

LAUGHERY, K. R. Sr., and LAUGHERY, K. R. Jr. Analytic techniques for function analysis. In G. Salvendy (Ed.), Handbook of Human Factors. New York: Wiley, 1987, pp. 330-3.

LOEB, R., WEINGER, M. B., and ENGLUND, C. E. Ergonomics of the anesthesia workspace. Ehrenwerth, J. and Eisenkraft J. B., editors. Anesthesia Medical device: Principles and Applications. Mosby Year Book, Malvern, PA. 1993 pp. 385-404.

MEISTER, D. Behavioral Analysis and Measurement Methods. New York: John Wiley & Sons,1985. NIELSEN J, Usability Engineering. San Diego: Academic Press, Inc, 1993

REASON, J. Human Error. Cambridge, England: Cambridge University Press, 1990.

REDMILL, F. and RAJAN, J. Human Factors in Safety-Critical Systems. Oxford: Butterworth-Heinemann, 1997.

ROUSE, W. B. Designing for human error: Concepts for error tolerant systems. In H. R. Booher (Ed.), MANPRINT: An approach to system integration. New York: Van Nostrand Reinhold, 1990.

RUBIN, J., Handbook of Usability Testing: How to Plan, Design, and Conduct Effective Tests, New York, NY, Wiley, 1994.

SCHULER, D. and NAMIOKA, A. Participatory Design: Principles and Practices. HILLSDALE, NJ: Lawrence Erlbaum Associates, 1993

SHARIT, J. Allocation of functions. In G. Salvendy (Ed.), Handbook of Human Factors and

Ergonomics, 2 edition, New York: Wiley, 1997, pp. 301-339.

SINCLAIR, M. A. Subjective assessment. In J. R. Wilson and E. N. Corlett (Eds.), Evaluation of human work. London: Taylor & Francis. 1990, pp. 58-88.

WIENER, E. L., and NAGEL, D. C. (Eds.) Human factors in aviation. San Diego: Academic Press 1988

WEINGER, M. B., HERNDON, O. W., and GABA, D. M. The effect of electronic record keeping and transesophageal echocardiography on task distribution, workload, and vigilance during cardiac anesthesia. Anesthesiology 1997, 87:144-155.

WEINGER, M., WIKLUND, M. and GARDNER-BONNEAU, D. A Handbook of Human Factors in Medical Device Design, Boca Raton, FL, CRC Press, 2011

WIKLUND, M., KENDLER, J., and STROCHLIC, Usability testing of Medical devices, Boca Raton, FL, CRC Press, 2010

ZHANG, J., PATEL, V. L., JOHNSON, T. R., CHUNG, P., and TURLEY, J. P. Evaluating and predicting patient safety for medical devices with integral information technology. In Advances in Patient Safety (vol. 2), Washington, DC: AHRQ. 2005, p. 323.

ABNORMAL USE .................................................................................................................... 3.1 ACCOMPANYING DOCUMENTATION .......................................................................................... 3.2 CORRECT USE ....................................................................................................................... 3.3 EFFECTIVENESS ................................................................................................................... 3.4 EFFICIENCY ......................................................................................................................... 3.5 EXPECTED SERVICE LIFE ......................................................................................................... 3.6 FORMATIVE EVALUATION ........................................................................................................ 3.7 HARM ....................................................................................................... ISO 14971:2007, 2.2 HAZARD ................................................................................................... ISO 14971:2007, 2.3 HAZARD-RELATED USE SCENARIO ............................................................................................ 3.8 HAZARDOUS SITUATION .............................................................................. ISO 14971:2007, 2.4 HUMAN FACTORS ENGINEERING ........................................................................................... 3.17 INTENDED USE .......................................................................................... ISO 14971:2007, 2.5 LIFE-CYCLE ................................................................................................ ISO 14971:2007, 2.7 MANUFACTURER ........................................................................................ ISO 14971:2007, 2.8 MEDICAL DEVICE ....................................................................................... ISO 14971:2007, 2.9 NORMAL USE ....................................................................................................................... 3.9 OBJECTIVE EVIDENCE .............................................................................. ISO 14971:2007, 2.10 PATIENT ............................................................................................................................ 3.10 POST-PRODUCTION .................................................................................. ISO 14971:2007, 2.11 PRIMARY OPERATING FUNCTION ........................................................................................... 3.11 PROCEDURE ............................................................................................ ISO 14971:2007, 2.12 PROCESS ............................................................................................... ISO 14971:2007, 2.13 RECORD ................................................................................................. ISO 14971:2007, 2.14 RESIDUAL RISK ....................................................................................... ISO 14971:2007, 2.15 RESPONSIBLE ORGANIZATION .............................................................................................. 3.12 RISK ...................................................................................................... ISO 14971:2007, 2.16 RISK ANALYSIS ........................................................................................ ISO 14971:2007, 2.17 RISK ASSESSMENT .................................................................................. ISO 14971:2007, 2.18 RISK CONTROL ........................................................................................ ISO 14971:2007, 2.19 RISK EVALUATION .................................................................................... ISO 14971:2007, 2.21 RISK MANAGEMENT .................................................................................. ISO 14971:2007, 2.22 RISK MANAGEMENT FILE ........................................................................... ISO 14971:2007, 2.23 SAFETY .................................................................................................. ISO 14971:2007, 2.24 SEVERITY ................................................................................................ ISO 14971:2007, 2.25 SUMMATIVE EVALUATION ..................................................................................................... 3.13 TASK .................................................................................................................................. 3.14 UOUP (USER INTERFACE OF UNKNOWN PROVENANCE) ............................................................. 3.15 USABILITY .......................................................................................................................... 3.16

Copyrighted material licensed to Rachel Kunzweiler on 2016-01-26 for licensee's use only. No further reproduction or networking is permitted. Distributed by Thomson Reuters (Scientific) LLC, www.USABILITY ENGINEERING ..................................................................................................... 3.17 USABILITY ENGINEERING FILE .............................................................................................. 3.18 USABILITY TEST ................................................................................................................. 3.19 USE ENVIRONMENT ............................................................................................................. 3.20 USE ERROR ....................................................................................................................... 3.21 USE SCENARIO .................................................................................................................... 3.22 USE SPECIFICATION ............................................................................................................ 3.23 USER ................................................................................................................................ 3.24 USER GROUP ...................................................................................................................... 3.25 USER INTERFACE ................................................................................................................ 3.26 USER INTERFACE EVALUATION ............................................................................................. 3.27 USER INTERFACE OF UNKNOWN PROVENANCE (UOUP) ............................................................. 3.15 USER INTERFACE SPECIFICATION ......................................................................................... 3.28 USER PROFILE ................................................................................................................... 3.29

因篇幅问题不能全部显示，请点此查看更多更全内容

查看全文