Tagged medical-devices
19 pieces
- · 11 min read
If You Cannot Rebuild It, It Is A Source
A three-layer record holds an append-only source layer, a governed derived layer, and a revisable current-state layer with history. The rule between them is that the derived layer must be regenerable from the source. When it cannot be, it has silently become a source that no governing document describes, so nothing controls changes to it.
- · 10 min read
Temperature Zero Is Not Deterministic
Event sourcing assumes you can replay the source and get the same derived state. A model call in the derivation breaks that assumption, because the lowest temperature setting reduces variation without eliminating it, and providers document this. A model-derived layer cannot be regenerated by replay, so the output and the model version have to be stored as part of the record.
- · 7 min read
You Can Be 90 Percent in the Green Zone and Measuring Nothing
A model that predicts close to the population mean can place most of its points in a clinical error grid's acceptable zones and post a respectable error percentage, while explaining less variance than the mean itself. Check the variance explained against a mean baseline, under a subject-disjoint split, before believing any accuracy figure from a physiological model.
- · 11 min read
Model Retirement Is A Regulatory Event
Hosted model providers retire models on published schedules, and some deployment types upgrade automatically. For software whose behaviour has been validated, a model changing on a vendor's timetable is a change-control event, not maintenance. Version pinning becomes a regulatory requirement, and the deployment type you choose is a compliance decision.
- · 10 min read
Measure Precision Before You Set a Threshold
Photograph the same sample five times without touching anything and the derived value will differ across the five images. If your decision threshold is narrower than that spread, the decision is a coin toss with a number attached. Precision has to be measured before any cut-off is designed, using the repeatability and reproducibility vocabulary the clinical precision standards already provide, and where precision will not support a decision the honest output is a flag rather than a call.
- · 10 min read
Your Camera Is Lying About Brightness
A camera's response to light is deliberately nonlinear, so the pixel value in a JPEG is not proportional to the light that produced it. Any intensity measurement taken before that encoding is undone is measuring the camera as much as the sample. Fixing it means linearising the response, normalising against an in-frame reference rather than trusting the illumination, and choosing a background subtraction method knowingly, because two standard methods give different corrected values on the same image.
- · 10 min read
Where Your Inference Actually Runs
Data residency for model inference is frequently not selectable in the way teams assume. Cross-region routing can place inference outside an intended boundary, and some global endpoints explicitly exclude residency guarantees. This has to be established in writing before an architecture depends on it, and the design has to survive the answer changing.
- · 7 min read
Cadence Lock: When Your Heart-Rate Monitor Starts Counting Your Steps
Optical heart-rate algorithms separate the cardiac signal from motion by picking the dominant periodic component. When step frequency converges on heart rate, which happens routinely in field sports, the algorithm can lock onto cadence and report steps per minute as beats per minute. It is confident, stable and wrong, and nothing on the display indicates it. The validation protocol has to contain the condition where the two frequencies meet.
- · 10 min read
Prove It By Construction, Not By Testing: Partitioning Away A Failure Class
On a tightly coupled memory architecture, two real-time paths that share a memory bank can collide, and the symptom you see is a buffer underrun. You can chase that symptom with soak tests and priority tuning indefinitely. Partitioning the memory and the direct-memory-access ownership so the two paths never reach the same bank removes the collision instead. A collision that cannot happen needs no stress test for its symptom.
- · 10 min read
Every Risk Control Is Verified Twice
The governing international standard for medical device risk management requires each risk control to be verified twice: once that it was implemented, and once that it is effective. Those are two different tests. A plan that writes only the first has done half the work, and effectiveness is the harder half.
- · 10 min read
Put The Acceptance Risk In The Smallest Milestone
When final acceptance happens on hardware you will never physically touch, that stage is the one you control least. On a fixed-price engagement, weighting milestones by effort puts your largest payment behind your weakest position. Weight them by controllability instead: the big work sits in the middle, where you own the bench, and the remote-acceptance stage is deliberately the smallest.
- · 10 min read
Give The Blocking Tests A Release Of Their Own
When a specification carries a large blocking acceptance-test suite and a global safety gate, scoping the first release by feature value means every later release renegotiates the gate, and the blocking tests belong to no release. Building the gate as a component, shipped as its own release, gives everything after it something to be scoped against.
- · 9 min read
The Most Important Screen Is A Database Decision
In a regulated product, which system holds the official copy of each piece of data sets the compliance posture, the monthly cost, and whether later integrations are additions or rebuilds. It is not a screen and it is the first decision. Decide it per datum, not once for the whole product.
- · 9 min read
The Device Decides The Form Factor
No mobile browser on one major platform exposes the interface a web page needs to reach a Bluetooth peripheral. If a connected device is anywhere on the roadmap, the product cannot be browser-only, and that constraint is set by the platform rather than by preference. Establish capability constraints like this before design, not during it.
- · 5 min read
IEC 62304: Verification Scales With Risk Class
Class A is no possible injury, Class B non-serious injury, Class C death or serious injury. Verification obligations rise with the class: more rigorous unit, integration and system testing, documented procedures, and traceability from software requirements through tests to risk controls under ISO 14971.
- · 7 min read
Therac-25: When the Untested Assumption Is a Safety Architecture
The Therac-25 removed the hardware interlocks its reused code assumed and gave the job to software. A race condition reachable by fast operator edits, plus a one byte counter overflowing to zero, bypassed a safety check. Six overdoses, three deaths, and a cause the investigators located in the system rather than in a line.
- · 7 min read
Tracker or Model: The Wearable Fork
Two wearables can look identical and be different products. One computes a quantity the sensing can actually resolve; the other infers a quantity it cannot, and covers the gap with a model. The fork is decided when the sensing is chosen, months before there is data, and it determines what you are allowed to claim.
- · 7 min read
What a Regulator Asks About Your Biosignal Front End That Your Bench Never Did
Your bench asks whether the signal looks right. A reviewer asks what the system does when it is wrong, across every unit you will ship, in conditions you did not choose. Those are different questions, and the second one is answered in the analog front end months before there is software to test.
- · 7 min read
Change the Model, Restart the Submission
In most software, retraining is a Tuesday. In a regulated device it can be a regulatory event, and the cost is not the retraining but the clearance cycle it can trigger. That asymmetry should change your architecture, not just your paperwork, because the decisions that determine how often you must retrain are made long before the first submission.