Design Out the Wrong Action Before Teaching Around It
This chapter examines what should happen after a medical-device team identifies a critical-task hazard. The practical judgment is whether a proposed mitigation changes the interaction itself, detects danger before it becomes harm, or mainly asks the user to remember more. That distinction matters because an interface change, a protective mechanism, a warning, and a training session act at different points in the error pathway.
The FDA’s preferred order puts inherent safety by design first, protective measures next, and information for safety—such as labeling and training—after those options. This is not a claim that instructions never work. It is a recognition that controls built into the device can reduce dependence on attention, memory, and perfect timing. Formative evaluation then tests whether the chosen control works for realistic users before the design is treated as ready for final validation.
Control the hazard where it begins
A useful way to compare mitigations is to ask where each one intervenes. Does it make the wrong action impossible? Does it make a dangerous condition visible? Or does it explain the danger and rely on the user to respond correctly? All three can have a place, but they do not provide the same kind of protection.
The strongest option in the FDA hierarchy is inherent safety by design. The interface is changed so that a hazardous action is removed, constrained, or made less likely. A connector can be designed so that the wrong component cannot be attached. A feature that can be mistakenly selected can be removed. A control, label, or display can be made easier to detect and read. A device function that is especially prone to user error can be automated instead of left entirely to manual performance.
These examples work because they alter the conditions under which the user acts. They do not require the person to recognize the error pathway in advance. If two components cannot be connected incorrectly, the user does not need to remember a warning about their similarity. If a dangerous choice is not presented, the user cannot select it by mistake. If an important state is more visible, the user has a better chance of noticing it before acting.
Design controls still need to match the hazard. A physical constraint can prevent one wrong connection while creating a new problem if it is difficult to use or encourages a different workaround. Automation can remove a manual step while creating a new need to understand the device’s state or respond to an alert. A more visible display element can compete with another important element if the hierarchy is poorly designed. “Design it out” is therefore a direction of preference, not a reason to stop examining the complete interaction.
The second option is a protective measure in the device or manufacturing process. Physical guards, interlocks, warning screens, and alerts can block progress, signal an unsafe condition, or reduce the severity of what happens next.