Capability example

An energy-delivery device, and the safety case built with it.

A therapy device inherited mid-programme, with a risk file that did not trace. Rebuilt so every control landed on a verification result.

All capability examples

Sector

Therapeutic devices

Device type

Active energy-delivery device, Class C

Services involved

Design and development, quality and regulatory

Duration

16 months, inherited design to submission

The challenge

A risk file assembled after the fact.

The device worked. The documentation did not describe why it was safe. A previous vendor had written the hazard analysis at the end of development as a submission deliverable, so controls referenced design intent rather than evidence, and several referenced test reports that had been superseded. A notified body would have found the gap in a morning. The client needed a safety case that stood up without redesigning a device that was already performing.

What we did

Traced every control to a result, or removed it.

We rebuilt the hazard analysis from the intended use and the energy delivered, not from the existing document. Each hazardous situation was carried to a control, each control to a specific verification protocol, and each protocol to a dated result on the current design revision. Where a control had no evidence we either generated it or deleted the claim. That produced a shorter risk file than the one we inherited, which is usually the sign it is now true.

What it took

The thermal model disagreed with the tissue.

Predicted and measured temperature diverged by enough to matter at the upper end of the delivery range. The model was not wrong so much as measured in the wrong place: the thermocouple sat where the design team could reach it, not where the tissue was hottest. Relocating the sensor changed the control strategy, the alarm thresholds and two of the verification protocols. It also meant the safety claim finally described the device rather than the fixture.

The outcome

What came out of it.

41 risk controls, each traced to a dated verification result on the released design revision.
Submission accepted with 0 deficiency questions raised against the safety case.
Alarm and shutdown behaviour verified at the upper and lower bounds of the delivery range.
A risk file that shrank rather than grew, because unsupported controls were removed rather than restated.