An infusion pump over-delivers, a ventilator alarm never sounds, a monitor resets mid-procedure — the cause is rarely obvious from the outside, and the device itself usually holds the answer.
Start a conversation with our AI Research Concierge, already scoped to device malfunction. Pick a starting point, or describe your situation directly.
Active medical devices fail the way most electromechanical systems fail — through a defect in software, a sensor that has drifted out of calibration, a battery that cannot deliver the current it is asked for, or a mechanical actuator that binds. What makes this category different is the stakes attached to each failure mode and the layers of evidence available to investigate it: onboard event logs, firmware build records, the FDA's MAUDE adverse-event database, and a design history file documenting what the manufacturer knew and when. The forensic question is almost never whether the device malfunctioned — the log usually settles that — it is why, and whether the same defect exists in every unit on the market or only this one.
Active device failures trace to a handful of subsystems. Identifying which one applies determines what data and testing the investigation needs.
Logic errors, race conditions, and state-machine faults producing incorrect dosing, output, or a failure to respond to an alarm condition.
Pressure, flow, or optical sensors drifting out of specification over time or after a shock event, leading to under- or over-delivery.
Cell degradation, charging-circuit faults, or brownout conditions causing unexpected shutdown mid-therapy or mid-procedure.
Alarms that are masked, suppressed by a prior override, or never triggered because the fault fell outside the detection logic.
External RF or electrical fields inducing spurious commands, resets, or display errors in insufficiently shielded circuitry.
Gear-train wear, occlusion-detection failure, or a pump mechanism binding — producing an output error the electronics never see.
Device investigations start with the data the device itself recorded, then move to reproducing the fault under controlled conditions.
A confirmed device malfunction routinely puts several of these in motion at once:
A firmware update, factory reset, or battery swap can overwrite the exact event log that proves what happened. Preserve the device, its accessories, and disposables in the as-found state.
The device's own event log is usually the starting point — most infusion pumps, ventilators, and monitors record programmed settings, alarms, and error codes independent of what a clinician recalls. That log is compared against the labeled instructions for use, the usability engineering file, and, where relevant, hospital biomedical-engineering records. A malfunction and a use error frequently look identical from the outside; they diverge once the internal record is read.
Yes, though the depth of analysis differs. Compiled firmware can be extracted from the device and analyzed through decompilation, behavioral testing, and comparison against known build and version records, which is often sufficient to identify the fault class. Access to source code and design history files, typically obtained through litigation discovery, allows a more precise root-cause finding rather than an inference from external behavior.
It depends on the device and how it was handled afterward. Many devices retain non-volatile event logs, error histories, and usage counters that survive a power cycle, but a factory reset, firmware update, or battery replacement can overwrite or clear them. This is why devices should be secured and imaged as soon as a malfunction is suspected, before routine biomedical servicing touches them.
MAUDE aggregates adverse-event reports for a device model and can show whether a given failure mode is a recognized pattern rather than an isolated incident, which matters for both causation and notice arguments. It is a screening tool, not proof: individual MAUDE reports are unverified narratives, and a pattern in the database still has to be tied to the physical or data evidence in the specific unit at issue.
A design defect is present in every unit built to that specification — a firmware logic error or an underrated component selection, for example. A manufacturing defect is a deviation from the specification in a specific unit or lot — a cold solder joint, a miscalibrated sensor at final test, or a component substitution. The distinction is drawn by comparing the failed unit against the design documentation and against exemplar units built to the same specification, and it usually determines whether the exposure is a single-unit matter or a fleet-wide one.
Technical briefings from our work in this area.
The dangerous device failures announce nothing — a sensor drifting inside its displayed range, an alarm that never triggers, a software state nobody tested. What the design and surveillance records show.
readEvent logs, alarm history, power state and the settings as found are the strongest record of what an infusion pump or ventilator did. Routine ward turnover and biomedical servicing erase most of it within days.
readCalling a device event operator error settles nothing. Usability engineering treats a mistake at the interface as evidence about the design, and the manufacturer's own file records which mistakes were foreseen.
readTell us what happened. We will triage it and connect you with the right expert — usually within one business day.