When an infusion pump delivers the wrong dose or a ventilator runs at a setting nobody intended, the first explanation offered is usually operator error. It is efficient, and it closes the file quickly. It is also a conclusion that current device standards do not allow anyone to reach casually. Usability engineering treats a mistake made at the interface as a signal about the design as much as about the person, and the manufacturer is expected to have recorded which mistakes it anticipated. That record, rather than the recollection of a clinician working a night shift, is usually where the question is actually settled.
Use error is a defined term, not a verdict
IEC 62366-1, the usability engineering standard for medical devices, supplies vocabulary that a dispute otherwise lacks. It separates correct use, use error — an act or omission producing a different result than the manufacturer intended or the user expected — and abnormal use, meaning a deliberate violation of reasonable use that lies outside what design can control. Use error is deliberately neutral. It describes an outcome, not a failing.
The phrase operator error collapses all three, and the collapse does the argumentative work. Whether an event sits in the second category or the third frequently decides the matter.
The use specification describes who was expected to do this
Every usability engineering file begins with a use specification: the intended indication, patient population, intended user profile, the environment of use, and the operating principle. It is the manufacturer's own statement of the conditions the device was designed to survive.
If the clinician, the setting and the task fall inside that specification, the design was meant to accommodate them, including their fatigue, their interruptions and their varying levels of familiarity. If they fall outside it, the argument shifts to labeling, training and institutional practice.
Foreseeable misuse belongs in the risk file
ISO 14971 requires hazard identification to consider reasonably foreseeable misuse, not intended use alone. Misuse is therefore not an escape hatch; it is a category the manufacturer was obliged to think about in advance and to document.
The same standard sets a hierarchy of risk control: inherently safe design first, protective measures such as guards, interlocks and alarms second, and information for safety — labeling, warnings, training — last and weakest. A hazard controlled only by a sentence in the instructions for use invites the question of whether a design change or a protective measure was practicable, and what the file says about why it was not adopted.
Formative and summative evaluation
The usability process runs from hazard-related use scenarios through formative evaluation during development to summative validation with representative users under representative conditions. Each stage leaves records.
The productive question in discovery is rarely whether that testing happened. It is what the testing found. An error observed during summative evaluation, analysed and accepted as residual risk is a very different posture from an error the process never contemplated, and the two lead to different arguments about notice and adequacy.
Interface features that generate predictable errors
Certain patterns recur across active devices: decimal and unit entry that permits an order-of-magnitude slip, defaults carried over between patients, visually similar screens serving different modes, soft keys whose function changes with context, and confirmation steps performed so often they become automatic.
Reconstructing the keystroke sequence required to produce the setting actually recorded is often more informative than any recollection. Where a plausible error path is short, unremarkable and unguarded, that is a design observation rather than a character observation.
Where the facility's configuration sits
Many pumps, ventilators and monitors are configurable by the purchasing institution: care-area profiles, dose-error-reduction libraries, soft and hard limits, alarm defaults and which parameters a user may override. These are protective measures whose settings are chosen locally.
That splits responsibility in a way both sides tend to underplay. Configuration records, library versions and the profile loaded on the unit establish which limits existed to be crossed.
Training, staffing and the environment of use
Manufacturer in-service records, competency assessments and the presence or absence of a designated super-user speak to whether the information-for-safety control was actually delivered. Ambient noise, lighting, alarm burden and interruption rate speak to whether the use environment matched the specification.
What the record is expected to contain
Under the quality system requirement — historically 21 CFR Part 820 and now expressed through ISO 13485 following the QMSR transition — design and development records, complaint files and corrective and preventive action records are all mandatory and all discoverable.
The usability engineering file, the use specification, hazard-related use scenarios, formative and summative reports, complaints describing similar difficulty, and reports made under the medical device reporting requirement at 21 CFR Part 803 together show what the manufacturer knew about how its device was being used before this event.
Where these opinions are challenged
Predictably: that the reconstructed error path was inferred rather than demonstrated, that the exemplar unit was configured differently from the one in use, that the users observed in testing did not represent the actual user population, and that the environment recreated for analysis was quieter and calmer than the one in which the event occurred.
Work that identifies the use specification, tests against the configuration actually loaded, and distinguishes what the file anticipated from what it did not survives that scrutiny. An assertion that the interface was confusing, offered without the file, does not.
This article is general technical orientation, not a failure analysis, an engineering opinion, or advice on any specific matter. Determining the cause of a particular incident requires hands-on examination by a credentialed expert.