The usability failure mode

Recommended protection

Validation

Automatically set alarm limits

IEC 60601-1-8 (section 6.6.2.2) suggests that the alarm limits may be set automatically. The risk is that users might not be aware of risky setting.

Risk-oriented alarm setting

The user should be able to set the risk level, and the system should translate the risk level to sensory values.

Usability testing:

1. Make sure that the users know how to set the risk level.
2. Verify that the risk level translates to proper sensory limits.

The alarm limits are set to extreme values

IEC 60601-1-8 (section 6.6.2.1) warns from setting errors. Extreme values might result in not generating alarm signals in risky situations (hyper sensitivity).

Warn on extreme values

Extreme limits that are likely to result in missed alarms (less than 5% of the population?) should be marked as risky.

The system should warn in cases when the user selects extreme risk levels.

Functional testing:

Verify that the system provides warning about extreme values

The alarm limits are set to near-normal values

Near-normal values might result in excessive false alarms, due to over-sensitivity.

Warn on near-normal values

Moderate limits that might overwhelm the users with false alarms (more than 20% of the population?) should be marked as risky.

The system should warn in cases when the user selects near-normal risk levels.

Functional testing:

Verify that the system provides warning about near-normal values

Setting errors

The user might set an improper alarm condition, resulting in:

• Alarm not actuated when it should (hyper sensitivity)
• Alarm actuated when it should not (over sensitivity resulting in excessive false alarms)

Initial setting

On attaching the alarm system to a new patient, the alarm conditions should be set to standard values.

Usability testing:

1. Attach the system to a new user
2. Make sure that alarm limits are set to default values

Wrong initial setting

The user might select values suited to the wrong population, resulting in either excessive false alarms or unattended risky situations.

Population selection

The manufacturer should provide a means to change the alarm limits according to special department needs. The manufacturer should provide a means to store the department limits and to load the alarm system with these limits.

The default setting should be automatically set following the user selecting from a limited set of limited lists of populations, such as by age (children, elderly, ...), special diseases, special treatment, special supervision needs, etc. The manufacturer should provide a table and a chart showing the risks associated with typical populations. The risk or safety levels should apply to the proper population.

The editing of the department preset values should be protected by a password

חברי הוועדה מתבקשים לתרום בדוגמאות של שינוי סף לאוכלוסיות מיוחדות: גריאטרים, ילדים, יולדות, פגים, טיפול נמרץ?

Usability testing:

Make sure that the users know how to select the proper population

Usability analysis:

Examine the situations of the users selecting the wrong population.

Improper initial setting

Patients parameters are often different from that of the associated population. Applying the same values to all patients belonging to a population might result in improper alarm limits.

Special needs

After setting the standard values for the population, the user should be able to adjust the limits to fit special needs of a specific patient.

Usability testing:

Make sure that the users know how to change the population standard values

Case of power failure

IEC 60601-1-8 (for example, in section 6.5.4.2 g) includes instructions about retaining the alarm settings in case of a power failure. However, the standard does not instruct the manufacturer to backup the alarm settings. The risk is that the users might not know how to restore the patient data after recovering from power failure

Persisting power failure

The alarm system shall save the patient alarm limits as long as it functions.

The system shall notify the user when the alarm limits are erased while a patient is assigned, and automatically reinstall the limits from the backup facility.

Usability testing:

Examine the user behavior in case of power failure.

Recovery failure

The users might not know how to restore the patient data after recovering from power failure, when run out of backup battery.

Recovering after power failure

The alarm limits used for the assigned patient shall be stored in a backup facility, such as Disk On Key.

Usability testing:

Examine the user behavior in case of power failure, when the backup battery is out.