Hazard Analysis vs Failure Mode and Effects Analysis (FMEA) for medical devices

Both end up as a spreadsheet of rows about things going wrong. They are not interchangeable. They begin at opposite ends of the same problem, and where you begin decides which harms end up in the file and which ones never appear in it at all.

Written for regulatory and quality engineers at medical device companies.

The difference in one sentence

A Hazard Analysis starts from the harm a person could suffer and works backward to what could cause it. A Failure Mode and Effects Analysis (FMEA) starts from a part or a process step and works forward to the effect of that one thing failing. A Hazard Analysis is a top down analysis. An FMEA is a bottom up analysis.

What a Hazard Analysis starts from

It starts from the harm. A hazard is a potential source of harm, such as electrical energy. A hazardous situation is a circumstance in which a person is exposed to that hazard, such as an exposed conductor during defibrillation. The harm is the injury or the damage to property that follows, such as an electrical burn or an equipment fire. A row is the whole chain, not one sentence about a fault.

Because the analysis begins with harm rather than with a parts list, the hazards have to be enumerated from somewhere. rmForge uses four top level categories: energy; biological and chemical; performance; and information and security. They follow the hazard examples in Annex C of ISO 14971, the International Organization for Standardization (ISO) standard for applying risk management to medical devices. Every row is then tagged with how the device was being used at the time, intended use or reasonably foreseeable misuse, and with whether the device was in a normal condition or a fault condition.

The cause is recorded as a class rather than a part number: design, hardware, software, process, packaging, labeling, or the user, and the route from it to the hazardous situation is written out as up to four steps. The full explanation of how a Hazard Analysis is put together walks through each part of the chain.

What an FMEA starts from

It starts from a thing. A design FMEA starts from components. A process FMEA starts from process steps. A use FMEA starts from user tasks. For each item on the list you ask how that item can fail, what the failure does locally, and what it does at the end of the line.

That is a thorough way to work through a list you already have, and it is also the boundary. The analysis holds the effects of the items you listed, in the failure modes you thought of, one at a time.

Which questions each one answers well

• Hazard Analysis. Have we considered every foreseeable way this device can injure a patient or a user, or damage property? For a given harm, what chain of events reaches it, and which control breaks that chain?
• FMEA. If this particular component fails, what happens downstream? Which failure modes of this process step reach the product, and at which step would we catch them?

What each one can miss

An FMEA can miss a harm that arrives with nothing broken. ISO 14971 asks for both the normal condition, where the device operates as designed with no component failures, and the fault condition, where something has failed. An analysis built out of failure modes has no natural line to write a normal condition harm on. If a device injures someone while working exactly as designed, no failure mode on the list points at it.

An FMEA also inherits the parts list or the process map it was built from. A harm that comes from two ordinary behaviors combining, or from a use that list says nothing about, has no home in it.

A Hazard Analysis has the opposite gap. It names the cause class, not the part. It will tell you that a software cause leads to a hazardous situation and that the harm is severe. It will not tell you which module, which tolerance, or which step on the line to change. Going item by item through the hardware or the process is what an FMEA is for.

Complements, not substitutes

ISO 14971 requires the risk management process. It does not require an FMEA. An FMEA is one technique a manufacturer may choose inside that process, and choosing it does not remove the obligation to show that the foreseeable harms were identified. A file full of failure modes does not by itself show that every foreseeable harm was considered.

The two work best together, and in that order. Work from harm backward first, so the list of harms is not limited by the parts list. Then work from parts and process steps forward, so each control has a specific thing to be built into.

Where the scoring differs

rmForge never multiplies severity by probability. Two probabilities are estimated for each Hazard Analysis row: P1, the chance the hazardous situation arises at all, and P2, the chance harm follows once it has. A fixed table turns those into Po, the probability that harm occurs, and a second fixed table gives the Risk Level from severity and Po. There are four levels: Low, Medium, High, and Unacceptable. The Hazard Analysis has no Risk Priority Number. The Design FMEA and Process FMEA show one, from 1 to 20, read from a fixed table of Risk Level against the Detection score, with nothing multiplied. It only helps set the order rows are worked in, and it never decides whether a risk is acceptable.

Multiplying ordinal scores lets a rare severe harm and a frequent minor one land on the same number, which hides the row a patient would care about most. In the table rmForge ships, a harm rated severity 4 or 5 never lands in Low, so it always calls for a risk control. What counts as acceptable is still for the manufacturer to define in its own risk management plan.

Every Hazard Analysis row carries at least one proposed Risk Control Measure, with its requirement, implementation, and verification, because a control that never becomes a requirement may never be built and cannot be verified.

What rmForge does, and what it does not

rmForge drafts your Risk Analysis, starting with the Hazard Analysis. It reads your Instructions for Use (IFU) and your product requirements and returns the Hazard Analysis as an Excel workbook carrying 32 columns per row, covering hazard identification, risk estimation, risk control, and residual risk.

Today, once the Hazard Analysis is finished, rmForge can build a Design FMEA or a Process FMEA from it, each in its own Excel workbook. Part numbers in the Design FMEA come only from your bill of materials. A Use FMEA is not built yet.

What rmForge delivers is a draft. It requires qualified cross functional review and approval by your own team. rmForge does not determine regulatory compliance, does not guarantee that a submission is accepted, and is not itself a medical device. The manufacturer stays responsible for every risk decision in the file.