Hazard Analysis basics under ISO 14971

A Hazard Analysis (HA) is a systematic identification of foreseeable hazards, hazardous situations, and harms associated with a medical device, with an estimate of risk for each. It is the foundational artifact of an ISO 14971 risk management file and is required by FDA and Notified Bodies.

A Hazard Analysis enumerates hazards starting from the patient or user harm and traces back to the device. A Failure Mode and Effects Analysis (FMEA) starts from component or process failure modes and traces forward to effects. Both are valuable; ISO 14971 requires the HA, not the FMEA. HA is a top-down analysis while FMEA is bottom-up analysis. Today, rmForge builds the Hazard Analysis first. A Design FMEA or Process FMEA can then be built from the finished Hazard Analysis.

A hazard is a potential source of harm (for example, electrical energy). A hazardous situation is a circumstance in which the user or patient is exposed to the hazard (for example, an exposed conductor during defibrillation). A harm is the physical injury or damage to property (for example, electrical burn or an equipment fire).

A Normal Condition is the device operating as designed without component failures. A Fault Condition is a single-component failure or single-fault state that the safety analysis must consider. ISO 14971 requires both to be evaluated. rmForge enforces a strict N versus F separation: every row is one or the other, never both.

It reads your inputs and builds a list of hazards in four categories: Energy; Biological and Chemical; Performance; and Information and Security. For each row it writes the foreseeable sequence of events and the hazardous situation, and assigns severity and probability from fixed scales. Risk Level is then looked up from a four-level table, not judged by the language model. Every row gets at least one proposed Risk Control Measure.

Typical Class II devices produce 30 to 120 hazard rows. Class I devices may produce fewer; Class III implantables can exceed 200. rmForge does not pad rows to hit a quota; the count is driven by what your IFU and design inputs imply.

Po is the combined probability of occurrence, computed by looking up p1 (probability the hazardous situation arises) and p2 (probability the situation leads to harm) on a combined-probability table. Po is a categorical band, not a numeric score.

Risk Level is the risk category rmForge gives each hazard row. It comes from a fixed lookup table of Severity against Po, the probability that harm occurs. The two are never multiplied. There are four levels: Low, Medium, High, and Unacceptable. The Risk Region tab of your workbook shows the table and what each level calls for. ISO 14971, the International Organization for Standardization (ISO) standard for medical device risk management, requires the manufacturer to set its own criteria for risk acceptability. rmForge's table is a default starting point, so check it against your risk management plan.

rmForge's Hazard Analysis does not calculate a Risk Priority Number (RPN), and rmForge never multiplies Severity by probability. Po, the probability that harm occurs, comes from a fixed lookup table that combines two chances: that the hazardous situation happens, and that it then leads to harm. Risk Level comes from a second fixed table of Severity against Po. It has four levels: Low, Medium, High, and Unacceptable. A table can still put a rare, severe harm and a frequent, minor harm in the same level. In rmForge's table, a harm rated Severity 4 or 5 never lands in Low, so it always calls for a risk control. rmForge also proposes at least one Risk Control Measure for every Hazard Analysis row, at any level, for your team to review. A Design FMEA or Process FMEA does show an RPN, from 1 to 20. It is read from a fixed table of Risk Level against the Detection score, with nothing multiplied. It only helps set the order rows are worked in, and it never decides whether a risk is acceptable.

Intended use hazards arise during the use described in the IFU. Non-intended use hazards arise from reasonably foreseeable misuse. ISO 14971 requires both. rmForge categorizes every row's use classification accordingly.

Low, Medium, High, and Unacceptable. rmForge looks up the level in a fixed table of Severity (1 to 5) against Po, the probability that harm occurs (1 to 5). Po comes from a second lookup table. Nothing is multiplied. The Risk Region tab of your workbook shows both tables and rmForge's default definitions. Low: reduce the risk as far as possible and document the rationale. Medium: a risk control is required, with a benefit-risk analysis if the residual risk stays Medium. High: a risk control and a benefit-risk analysis are both required. Unacceptable: reduce the risk to High or below and escalate to management. rmForge proposes at least one Risk Control Measure for every row, including Low rows. Your team completes the benefit-risk analysis and any escalation.

Yes, for medical electrical (ME) equipment per IEC 60601-1. The Essential Performance (EP) agent activates when the wizard identifies the device as ME and performs a structured preparation and assessment sequence aligned with IEC 60601-1.

rmForge works from what your Instructions for Use, your other documents and your answers to the setup questions say. The more they say, the more specific the rows.

No. rmForge needs at least the Wizard questions answered, which are adapted from ISO TR 24971.

rmForge models the sequence as up to four steps from initiating cause to a hazardous situation and then a harm. The cause is one of Design, Hardware, Software, Process, Packaging, Labeling, User. The sequence is captured in the HA row.

Four top-level categories: Energy; Biological and Chemical; Performance; and Information and Security. They follow the hazard examples in Annex C of ISO 14971, the International Organization for Standardization (ISO) standard for medical device risk management.

A requirement (design input), implementation (design output), and verification (design verification and validation including process validation as appropriate) of a design or its processes that reduces the probability of occurrence, the severity, or both. rmForge proposes specific RCMs per row; ISO 14971 requires that the RCM rationale be traceable.

After applying a risk control, the residual risk may correspond to a different harm than the original (for example, a fail-safe reverts the device to a lower-energy mode). The revised harm column captures the harm after the risk control is applied.

No. rmForge generates the Hazard Analysis workbook and the customer acknowledgment form, plus any Design FMEA or Process FMEA workbook built from the finished Hazard Analysis.

rmForge rules are documented internally. They trace to ISO 14971, the International Organization for Standardization (ISO) standard for medical device risk management, to related ISO and International Electrotechnical Commission (IEC) consensus standards, and to U.S. Food and Drug Administration (FDA) guidance and regulations. The rule set is kept under version control.