A device can work exactly as designed and still hurt someone, because the person using it made a mistake the design invited. Usability engineering is the discipline that looks for those mistakes before the device is built. The IEC standard on the subject is IEC 62366-1. Its scope, as the IEC describes it, is a process for a manufacturer to analyse, specify, develop and evaluate the usability of a medical device as it relates to safety.
Start with the users, the place and the interface
The US FDA guidance on this topic asks for three things to be described before any analysis: the users, the use environments and the user interface. For users, that means who they are, what they can do, what they know and how much training they will have. Environments range from a hospital to a home to an emergency scene. The user interface is wider than a screen. The FDA counts displays, controls, alarms, the logic of operation, packaging, labels and instructions for use, and training.
Different user groups may need to be treated as separate groups. The FDA gives examples: children and adults, or professionals and lay users. This description is the usability counterpart of the intended use statement.
Find the critical tasks, then test early
The FDA defines a critical task as a user task that, if done wrongly or not done, would or could cause serious harm to the patient or user. Harm includes compromised medical care. The guidance says to sort the tasks by the severity of harm that a use error could cause, using the risk analysis. The tasks where an error would or could cause serious harm are the critical tasks.
Several methods can feed this list. The guidance names failure mode and effects analysis, fault tree analysis, task analysis, heuristic evaluation and expert review. It also names contextual inquiry, which means observing users in an actual use environment, and interviews. It adds a source that is easy to forget: known use-related problems with similar devices.
The FDA defines a formative evaluation as an evaluation of the user interface to explore its strengths, weaknesses and unanticipated use errors. It is run while the interface is still in development. The guidance says it can reveal hazards and use errors nobody had foreseen, and can even identify new critical tasks. It can also check whether a risk control works, and it can inform training and labelling.
Control the hazard in the right order
When a use-related hazard is found, the FDA guidance points to the risk control options listed in ISO 14971, in order of preference. It gives examples of each:
| Order | Control option | FDA's examples |
|---|---|---|
| 1 | Inherent safety by design | A connector that cannot join the wrong part; removing a feature that can be chosen by mistake. |
| 2 | Protective measures | An interlock, or a low battery alert. |
| 3 | Information for safety | A warning in the manual, or training. |
Labels and training come last for reasons the guidance states plainly. They rely on the user to remember or look up the information, the labelling may not be at hand during use, and what people learn in training can fade. Even so, unless a design change removes the possibility of the error completely, the labelling and any training should still address the hazard.
Validate the final design
At the end of development comes human factors validation testing. The FDA describes it as testing at the end of development to find use errors that would or could cause serious harm, and to assess the effectiveness of risk controls. It is one part of design validation. The FDA points out that this is sometimes called summative testing, but that some definitions of summative testing leave out parts of what the guidance asks for.
The guidance sets four design conditions for the test:
- The participants represent the intended users.
- All critical tasks are performed.
- The user interface is the final design.
- The test conditions are realistic enough to represent actual use.
On numbers, the FDA guidance says that in general the minimum number of participants should be 15, and that the minimum could be higher for specific device types. Where a device has more than one distinct user population, it asks for at least 15 participants from each. Pediatric and adult users count as distinct populations. So do professional and lay users.
The FDA guidance says the labelling used in the test should represent the final design. If the test shows use errors on critical tasks, it says that in a premarket submission a claim that you fixed the problem by changing the instructions or other labelling is not acceptable unless you provide further test data showing the change worked.
No design is error-proof. The guidance says residual risk will remain, and that it must be analysed to see whether it can be reduced further. Results showing that serious use errors persist are not acceptable in a premarket submission unless the submission shows that further reduction is not possible or practical and that the benefits outweigh the residual risks.
Common mistakes
- Blaming the user. The point of the process is to find the design feature that made the error likely.
- Starting at the end. A validation test is a final check. It is a poor way to discover problems.
- Choosing participants for convenience. For validation testing the FDA guidance says employees should not be participants, except in rare cases.
- Fixing a failure with a warning. Information is the weakest control, and a changed label needs its own evidence.
- Testing a draft interface. The validation test needs the final design and the final labelling.
One more point on scope. IEC 62366-1 can identify the risks of abnormal use, but it does not assess or mitigate them. In its guidance, the FDA treats the terms "human factors engineering" and "usability engineering" as interchangeable.
Sources: IEC, webstore page for IEC 62366-1:2015+AMD1:2020 CSV (edition 1.1, published 17 June 2020: title, scope and edition details); US FDA guidance, Applying Human Factors and Usability Engineering to Medical Devices (originally issued 3 February 2016, current version dated August 2026), sections on definitions, users, environments and interface, preliminary analyses, formative evaluation, risk control options and human factors validation testing. The standard itself is sold by the IEC and is not reproduced here. This article is a general guide, not a regulatory determination for any device.