Detection Is Not a Device Property: A Sensing-Envelope and Responder-Conditioned Framework for Risk-Control Verification in Life-Sustaining Medical Devices

I. Introduction

A risk file is a ledger of credits. ISO 14971 requires the manufacturer to identify hazards, estimate and evaluate the associated risks, implement risk control measures, and then evaluate the residual risk that remains after those measures are in place [3]. The arithmetic of that last step is where the ledger is settled: a hazardous situation is assigned some probability of occurrence, a risk control is credited with reducing it, and the reduced figure is compared against the manufacturer's acceptability criteria. Two of the most common credits in the ledger of a life-sustaining device are detection — the device will notice the fault and annunciate it — and safe state — the device will withdraw to a defined condition in which it cannot do harm.

Both credits contain an unstated dependency on the world outside the device. The detection credit assumes the fault produces a signal the device's transducers can actually see. The safe-state credit assumes that ceasing to act is harmless, which for a device that is sustaining a physiologic function it is not: a stopped ventilator on a ventilator-dependent patient is a hazard, not a mitigation, unless a responder arrives in time. Neither dependency is a property of the device. Both are properties of the device in a context, and neither is forced onto the page by any artifact in the standard risk-management workflow.

Two July 2026 FDA actions make the omission concrete. On July 2, 2026, the FDA classified as Class I an Insulet Medical Device Correction covering Omnipod 5, Omnipod DASH, and Omnipod Eros pods in which a small tear can develop in the cannula just above the skin, between the pod and the point of entry into the body, allowing insulin to leak outside the patient. The scope is approximately seven million pods, with twenty-four reports of serious adverse events involving hospitalization and diabetic ketoacidosis (DKA) and no deaths; a separate and earlier Insulet correction for internal tubing tears in the same platform, classified Class I on April 29, 2026, had accumulated 476 serious injuries [1]. The FDA's user communication is unusually direct about what the device cannot do: the issue "may happen without triggering any alert," and users are told, in bold, not to rely only on pod alerts to know if something is wrong. The alternative cues the agency offers are wetness on the skin or adhesive and the smell of insulin [1].

On July 15, 2026, the FDA published an Early Alert covering ResMed Astral 100 and 150 portable life-support ventilators built prior to October 2024, plus spare main boards distributed as service parts. A supercapacitor may leak over time; the leakage may damage circuitry on the main printed-circuit-board assembly (PCBA); and the damage "can result in the ventilator inadvertently entering a fail-safe state." If this occurs during therapy, therapy stops, a maximum-volume high-priority alarm sounds, and alternative means of ventilation must be provided. Five serious injuries and no deaths were reported as of June 23, 2026, and the correction is rationed: PCBA availability is "significantly constrained," so ResMed is triaging patients into clinical risk tiers and correcting the highest-risk users first [2].

The conventional reading treats these as unrelated — one a manufacturing escape in a disposable fluid path, the other a component wear-out on a durable board. We read them as one defect class. In the first, a detection credit was taken on a fault that lies outside the device's sensing envelope: the pod's fault architecture is built around occlusion, which raises back-pressure, and a tear is the mirror image of an occlusion — the path is more open, not less, so the pressure signature moves in the direction the detector reads as healthy. In the second, a safe-state credit was taken on a state that withholds a life-sustaining function, so its harmlessness is a claim about the caregiver, not about the ventilator. Neither risk file was required to state the assumption it depended on, and therefore neither was required to verify it.

This paper contributes:

• A five-tier observation-channel taxonomy (Table I) that classifies every credited detection by the physical channel that carries the fault signature, and assigns each tier a ceiling on the risk-control credit that may lawfully be taken, together with the verification evidence required to reach that ceiling.
• A detectability factorization (1) that decomposes the probability of detecting a failure mode into physical-manifestation, transduction, and decision-threshold terms, exposing which term is the binding constraint and hence which design change can move it.
• A safe-state classification distinguishing benign safe states from life-withholding safe states, and a responder-conditioned residual harm relation (2) that makes the external responder an explicit, quantified parameter of the risk file rather than an implicit assumption, together with an inversion (3) that yields the responder availability a stated residual-risk target requires.
• A six-step audit method, the Detection–Responder Contract, producing a matrix suitable for design review, notified-body assessment, and post-market corrective-action review under 21 CFR Part 820.
• A worked example on both 2026 field actions, yielding eight derived requirements and a bound showing that a one-sided detection architecture caps creditable detection of an open-path fault near zero regardless of alarm-system conformance to IEC 60601-1-8 [4].

Section II reviews background and related work. Section III presents the framework. Section IV applies it. Section V discusses limitations and threats to validity. Section VI concludes.

II. Background and Related Work

A. Risk Management Standards and the Detectability Question

ISO 14971:2019 requires that risk control options be selected in a defined order of priority — inherently safe design, protective measures including alarms, and information for safety — and that the effectiveness of each implemented control be verified [3]. It does not, however, prescribe how the effectiveness of a detection-based protective measure is to be bounded when the fault of interest may not manifest in any quantity the device measures. The standard's companion guidance treats detectability as an input to risk estimation rather than as a claim requiring its own evidence.

The critique is not new in principle. Nolan and McDermott survey the use and limitations of failure mode and effects analysis in medical-device risk management and identify the detection rating as among the most problematic elements: it is assigned subjectively, it is treated as commensurate with severity and occurrence in the risk-priority-number product, and the method is structurally limited to single-fault conditions and silent on normal-condition hazards [24]. Their critique addresses the rating of detectability. Our concern is one level earlier: whether the fault is observable at all through the channels the device possesses, which is a question about physics and instrumentation rather than about scoring discipline.

Two device-specific standards constrain the annunciation side. IEC 60601-1-8 governs alarm systems, assigning alarm priorities and requiring that alarm conditions be annunciated with prescribed auditory and visual characteristics [4]. IEC 60601-2-24 sets particular requirements for infusion pumps, including occlusion alarm behavior [6]. ISO 80601-2-72 sets particular requirements for home-healthcare ventilators for ventilator-dependent patients [5]. Each standard is exacting about what happens after an alarm condition is declared. None of them constrains the antecedent: whether the alarm condition can be declared at all for a given physical fault. A device may be fully conformant to IEC 60601-1-8 and still be blind to the failure mode that harms its user, because conformance is evaluated against the alarm conditions the manufacturer has defined.

B. Fault Detection in Insulin Delivery

The limits of pressure-based occlusion detection in insulin pumps are well documented. Freckmann et al. measured occlusion detection time at two basal rates and found detection latency strongly dependent on delivery rate, with low basal rates producing long delays before an alarm threshold is crossed [12]. This is a Tier-2 limitation in the taxonomy of Section III: the fault is physically manifest and transducible, but the decision threshold is slow relative to the harm. The literature has responded with richer instrumentation and better estimators. Blanco et al. developed a real-time force-based algorithm for infusion-failure detection, reporting a bagging classifier with 96% accuracy, 94% sensitivity, and 98% specificity against traditional occlusion alarm pressure thresholds in preclinical work [11].

A second thread moves detection off the device entirely and onto the physiologic feedback loop. Howsmon et al. demonstrated real-time detection of infusion-site failures inside a closed-loop artificial pancreas, achieving 88.0% sensitivity at 0.22 false positives per day under zone model predictive control, against 73.3% sensitivity in a sensor-augmented pump arm [13]. Meneghetti et al. developed unsupervised methods to detect pump malfunction from continuous-glucose-monitor and insulin-delivery traces [14], and later machine-learning anomaly-detection algorithms to alert sensor-augmented-pump users to infusion-site failures [15]. Turksoy et al. addressed the reciprocal problem — detecting faults in the glucose sensor itself — with a real-time model-based method [16].

This body of work is precisely the evidence base for a Tier-3 credit in our taxonomy: detection derived from a physiologic surrogate rather than from the device's own fluid path. It is also, critically, evidence that such a credit is bounded well below unity and is conditional on the closed loop being active. Klonoff et al. characterized the time course from an insulin-pump occlusion to moderate and severe hyperglycemia and ketonemia, establishing that the physiologic tolerance window is measured in hours rather than minutes but is not indefinite [17]. Registry-scale work by Kalscheuer et al. across 46,966 adults with type 1 diabetes quantifies DKA event rates and risk factors, giving a population baseline against which a delivery-interruption hazard must be evaluated [18]. Orbell et al. analyzed severe insulin-pump-related adverse events and their potential root causes [19], and Gao et al. performed a hazard analysis of Class I recalls of infusion pumps, establishing that detection and alarm deficiencies recur across the device class rather than being idiosyncratic to one manufacturer [20].

C. Safe States That Are Not Safe

Outside medicine, the recognition that a fail-safe state can itself be hazardous drove the fail-operational architectures now standard in automated driving and brake-by-wire. Sinha analyzed a fail-operational brake-by-wire architecture from an ISO 26262 perspective, motivated explicitly by the fact that de-energizing a by-wire brake is not a safe state [22]. Fu et al. formally verified a fail-operational safety concept for automated driving [23]. The common premise is that when the function being performed is the safety function, ceasing to perform it cannot be the mitigation.

Medicine has the same premise and less of the architecture. Life-support ventilation is the paradigm case: the device is performing a physiologic function the patient cannot perform, and the fail-safe state returns that burden to a patient who by definition cannot carry it. The empirical literature on home ventilator failure is thin but consistent. Srinivasan et al. documented the frequency, causes, and outcomes of home ventilator failure [27]; Chatwin et al. analyzed home support and ventilator malfunction across 1,211 ventilator-dependent patients, characterizing both the malfunction rate and the support infrastructure that must absorb it [28]. Both establish that the responder — family caregiver, home-care provider, or clinician — is the actual mitigation, and that the responder's availability is variable, unverified by the manufacturer, and in the home setting frequently a single fatigued person.

The alarm literature completes the picture, because the responder is reached through an alarm. Cho et al. documented alarm fatigue and the perceived obstacles to alarm management among intensive-care nurses [25] — in a setting with far denser staffing than the home. An alarm system that is conformant, loud, and correctly prioritized still yields a responder-availability term strictly less than one, and the standards do not require the manufacturer to estimate it.

D. Wear-Out, Diagnostic Coverage, and the Missing Prognostic

The Astral failure mechanism is a wear-out, and wear-out is the failure class the reliability literature is best equipped to bound. Wang and Blaabjerg surveyed capacitor reliability for DC-link applications, including electrolytic wear-out mechanisms and their operating-condition dependence [29]. Rigamonti et al. developed particle-filter-based prognostics for an electrolytic capacitor operating under variable conditions, demonstrating that remaining-useful-life estimation is tractable in situ [30]. Zhao et al. surveyed condition-monitoring techniques for capacitors in DC-link applications [21]. Ayadi et al. measured the impact of thermal cycling on supercapacitor performance during calendar ageing, showing that ageing rate is a strong function of thermal history — which for a portable ventilator carried between hospital, vehicle, and home is exactly the uncontrolled variable [26].

The point is not that ResMed should have foreseen this specific leak. It is that the analytical tools to convert a wear-out mechanism into a bounded exposure interval — the medical-device analogue of a proof-test interval — are mature and were not applied. The process-safety community formalized this decades ago: Jin and Rausand analyzed the reliability of safety-instrumented systems subject to partial testing and common-cause failures, making the test interval an explicit design parameter [31]. Alemzadeh et al. analyzed safety-critical computer failures in medical devices from regulatory databases and found recurring classes of failure that were, in retrospect, analytically foreseeable [8]. Avizienis et al. supply the vocabulary that unifies all of it: a fault becomes an error becomes a failure only through activation and propagation, and detection is a property of the propagation path, not of the fault [10].

E. What Is Missing

No published framework, to our knowledge, requires a medical-device risk file to state (i) which physical channel carries a given fault's signature and whether the device instruments that channel, or (ii) whether the safe state credited for a hazard withholds a life-sustaining function and, if so, what responder availability the residual-risk claim assumes. Section III supplies both.

III. Approach: The Detection–Responder Contract

A. Observation Channels and Crediting Ceilings

Let f be a failure mode of a life-sustaining device and h the hazardous situation it produces. A credited detection d for f is delivered over an observation channel: the physical pathway along which the fault's signature travels to something that can declare an alarm condition. We define five tiers.

C0 — Direct measurement of the regulated quantity. The device measures the quantity it is controlling at the point of delivery: for an infusion device, the mass of drug actually entering the patient; for a ventilator, the volume actually entering the lung. C0 is the only tier for which a near-unity detection credit is defensible, because the fault cannot occur without moving the measured quantity.

C1 — Surrogate internal measurement. The device measures a proxy inside its own boundary: line pressure, motor force, plunger position, valve current. C1 credits are directional: a surrogate detects only the faults that move it in the direction the detector interrogates. This is the tier at which the Omnipod cannula tear escapes.

C2 — Internal state and self-test. The device tests its own hardware and software: memory tests, watchdogs, board-level integrity checks. C2 detects faults of the device, not faults of the therapy delivery.

C3 — Derived physiologic surrogate. Detection is inferred from the patient's response, as in continuous-glucose-monitor-based infusion-failure detection [13]–[15]. C3 credits are bounded by published algorithm sensitivity, are conditional on the surrogate sensor being present and trusted, and carry a latency set by physiology.

C4 — Unaided human sensory channel. Detection depends on the user smelling, seeing, or feeling the fault. C4 has no requirement, no verification, and no availability guarantee during sleep, and under ISO 14971's priority ordering it is information for safety, the weakest control class [3].

Table I gives the tiers with their verification evidence and crediting ceilings. The ceilings are normative proposals, not measured constants; their purpose is to force the manufacturer either to supply tier-appropriate evidence or to accept the lower credit.

B. Detectability Factorization

For a failure mode f detected over channel c, the probability that the device declares the correct alarm condition before the harm threshold is reached factorizes as

where P_man is the probability that f produces a signature on channel c at all — a question of physics; P_trans is the probability that the transducer and signal chain reproduce that signature with sufficient fidelity — a question of instrumentation; and P_dec is the probability that the decision logic crosses its threshold within the physiologic tolerance time T_tol — a question of algorithm and threshold placement. The factorization is deliberately multiplicative and deliberately ordered, because it identifies the binding constraint and hence the only design change that can help. If P_man ≈ 0, no amount of algorithm work, alarm-priority escalation, or IEC 60601-1-8 conformance moves D: the fault is outside the sensing envelope, and the remedy is a new channel, not a better threshold. If P_man is high but P_dec is low, the remedy is threshold and estimator work of the kind Blanco et al. and Freckmann et al. describe [11], [12].

Fig. 1 renders the envelope: the set of failure modes that physically manifest on some channel, the transducible subset the device instruments, and the subset whose signature crosses a declared threshold in time. Faults outside the innermost region are undetectable by construction, and a risk file that credits detection for them is not conservative but incorrect.

C. Safe-State Classification and Responder Conditioning

Let σ be the safe state a device enters on fault detection. We classify σ as:

Benign. Entering σ removes the hazard and imposes no new one; the patient is no worse off than before therapy began. An infusion pump that stops delivering a non-life-sustaining drug is typically benign.

Life-withholding. Entering σ suspends a function the patient depends on for physiologic viability. A life-support ventilator entering a fail-safe state is life-withholding, and so is a closed-loop insulin system suspending basal delivery in a patient with no endogenous production over a long enough interval.

For life-withholding safe states, the residual harm is not a property of the device. Let P_e be the probability of entering σ over the exposure interval of interest, T_tol the physiologic tolerance time for the withheld function, and A_r(T_tol) the probability that a competent responder perceives the alarm, obtains the alternative means, and restores the function within T_tol. Then the residual probability of harm is

and inverting against an acceptability target P_H,tgt yields the responder availability the risk file is implicitly claiming:

Relation (3) is the working instrument of the framework. It converts an unstated assumption into a number the manufacturer must either substantiate with human-factors and infrastructure evidence or disclaim. If (3) demands a responder availability above what the alarm and home-support literature supports [25], [27], [28], the risk file has two honest options: reduce P_e by design — bound the wear-out, add redundancy, make the state fail-operational rather than fail-safe — or restrict the intended use to settings where A_r can be assured. The composite human-error literature, including integrated THERP and HEART treatments [32], supplies the estimation machinery for A_r; the point is that it must be applied rather than assumed.

T_tol is the parameter that separates the two cases in Section IV. For a ventilator-dependent patient, T_tol is on the order of minutes and may be shorter than the time to retrieve and connect a resuscitation bag from another room. For interrupted subcutaneous insulin delivery, T_tol is on the order of hours before moderate ketonemia [17] — which is why an insulin-delivery interruption can lawfully be treated as detection-deferrable while a ventilation interruption cannot.

D. The Six-Step Method

Step 1 — Enumerate credited controls. For every hazardous situation in the ISO 14971 risk file, list each implemented risk control and the credit taken for it in the residual-risk evaluation [3].

Step 2 — Assign observation channels. For each detection-based control, assign the tier from Table I. Where a control is claimed to work over multiple channels, decompose it: each channel is credited separately and the channels are combined only if their failure modes are demonstrably independent.

Step 3 — Evaluate (1) per failure mode. For each failure mode the control is credited against, evaluate the three factors of (1), and in particular test P_man for directionality: does the fault move the surrogate toward or away from the healthy reading? Two-sided fault injection is the required evidence, and its absence is itself a finding.

Step 4 — Classify safe states. Mark each safe state benign or life-withholding. Any life-withholding safe state entered as a reaction to a device fault — as distinct from a clinically commanded stop — is escalated to a hazardous situation in its own right and returned to Step 1.

Step 5 — Condition on the responder. For every life-withholding safe state, evaluate (2) and invert (3). Record T_tol, the assumed A_r, and the evidence for it. An unsubstantiated A_r is treated as a gap, not as unity.

Step 6 — Derive requirements and verification. Where a ceiling in Table I, a factor in (1), or the inversion in (3) is unmet, write a derived requirement with an explicit verification method, and route it into design controls and, post-market, into corrective and preventive action.

IV. Worked Example

We apply the method to both July 2026 field actions. All inputs are drawn from public regulatory record and open literature; numerical values marked illustrative are used to show the arithmetic and are not attributed to the manufacturers.

A. Case A — Omnipod Cannula Tear (FDA Class I, July 2, 2026)

Steps 1–2. The hazardous situation is under-delivery of insulin leading to hyperglycemia and DKA. The credited controls, as inferable from the platform's documented behavior and the FDA communication, are: (a) an occlusion alarm on the fluid path — Tier C1; (b) automated-mode glucose-trend logic that can raise an Automated Delivery Restriction alert — Tier C3; and (c) user observation of wetness and insulin odor — Tier C4 [1].

Step 3. For control (a), the failure mode is an open-path leak. Occlusion detection interrogates the pressure channel in the rising direction; a tear lowers path impedance, so the pressure signature moves toward the healthy reading. Hence P_man ≈ 0 for this failure mode on this channel, and by (1) the detection credit is approximately zero irrespective of P_trans and P_dec. This is the analytical statement of the FDA's plain-language instruction not to rely on pod alerts [1]. Note that the platform's own occlusion path is additionally rate-limited: Freckmann et al. showed detection latency at low basal rates extends well beyond what a rising-glucose trajectory tolerates [12], so even the faults the channel can see are credited generously.

For control (c), Table I assigns a credit of zero in the residual-risk arithmetic. Odor and wetness are not annunciated, not verified, and unavailable during sleep — and DKA arising from an overnight interruption is precisely the scenario the registry literature identifies as consequential [18].

Control (b) is the only channel with a defensible non-zero credit, and it is Tier C3: bounded by algorithm sensitivity, conditional on the closed loop being active, and latency-limited by physiology. The published operating points give the honest ceiling. Howsmon et al. report 88.0% sensitivity at 0.22 false positives per day under zone model predictive control and 73.3% in the sensor-augmented-pump arm [13]; unsupervised and machine-learning approaches report comparable ranges [14], [15]. Under (1), taking P_man ≈ 1 (a real leak does move glucose), P_trans ≈ 0.95 for CGM availability and trust, and P_dec ≈ 0.88 at the published operating point, D ≈ 0.84 for users in automated mode — and identically the C4 case, zero, for Omnipod DASH and Eros users who have no closed loop at all. The recall population includes all three product lines [1].

Steps 4–5. The safe state here is benign in the ISO 14971 sense: pod deactivation removes the leak. T_tol is hours [17], so the interruption is detection-deferrable and (2)–(3) are not binding. The binding constraint is entirely on the detection side.

Step 6. Derived requirements DR-1 through DR-4 in Table II.

B. Case B — ResMed Astral Fail-Safe Entry (FDA Early Alert, July 15, 2026)

Steps 1–2. Two hazardous situations must be separated. H1 is corrupted ventilation caused by PCBA damage. H2 is cessation of ventilation caused by the device's own fault reaction. The credited control for H1 is the safety-monitoring subsystem that detects the corruption and commands the fail-safe state — Tier C2, and by all appearances it worked: the FDA record describes inadvertent entry into the fail-safe state, not undetected corrupted therapy [2]. The control for H2 is the high-priority alarm plus the instruction that alternative means of ventilation must be provided [2], [4].

Step 3. The C2 credit for H1 is defensible on this evidence. The instructive finding is elsewhere: the initiating mechanism is supercapacitor electrolyte leakage, a wear-out, and wear-out is bounded by lifetime and exposure analysis rather than by detection. The reliability literature makes this tractable — condition monitoring for DC-link capacitors [21], particle-filter prognostics for electrolytic capacitors under variable operating conditions [30], and calendar-ageing measurements showing strong thermal-cycling dependence [26], the last directly applicable to a portable ventilator whose thermal history spans hospital, vehicle, and home. The absence of a bounded replacement or inspection interval — the medical analogue of a proof-test interval [31] — is a finding independent of the alarm system.

Step 4. The fail-safe state is life-withholding. Therapy stops; the device "is no longer able to deliver therapy"; alternative means must be provided [2]. By Step 4 this state is escalated to hazardous situation H2 and returned to Step 1 — which is exactly the loop most risk files do not close, because "enter safe state" reads as a terminal node.

Step 5. Evaluate (2). T_tol for a ventilator-dependent patient is on the order of minutes. A_r(T_tol) is the probability that a caregiver hears the alarm, recognizes it, retrieves the alternative means, and restores ventilation within that window. Home-ventilation studies establish that malfunction is not rare and that the support infrastructure absorbing it is variable [27], [28]; alarm-response research establishes that even professionally staffed environments exhibit degraded response under alarm burden [25]. Suppose, illustratively, an acceptability target P_H,tgt = 10⁻⁶ per patient-year for death or serious injury from unmitigated cessation, and an entry probability P_e = 10⁻³ per patient-year over the affected build population. Then (3) requires A_r,req ≥ 1 − 10⁻³ = 0.999. A claim that a single home caregiver, potentially asleep, restores ventilation within minutes on 999 occasions out of 1,000 is not supportable on the published evidence — and no such claim was ever required to be written down. The five reported serious injuries [2] are the empirical shadow of that shortfall.

The Astral's platform history sharpens the point. In August 2016 the Australian TGA recorded a Class I recall of the Astral 100 and 150 in which "an internal electrical issue has led to ventilation ceasing without either the low battery alarm or the critically low battery alarm being activated," with degraded internal battery packs replaced fleet-wide [7]. In March 2024, Germany's BfArM published a further urgent field safety notice for the same models concerning a degraded component in the power path [9]. Three power-subsystem field actions in a decade on one life-support platform is the signature of an unbounded wear-out class, not of three independent escapes — and the corrective-action effectiveness obligation under 21 CFR Part 820 attaches to the class, not to each instance.

Step 6. Derived requirements DR-5 through DR-8 in Table II. DR-8 addresses a fact from the Early Alert that is a risk control in its own right: the correction is rationed by PCBA availability, with patients triaged into clinical risk tiers [2]. A triage scheme is a risk control measure under ISO 14971 and inherits the standard's verification obligation, but it is being executed post-market, under supply constraint, without the design-control evidence a pre-market control would require.

C. Derived Requirements

V. Discussion

A. Limitations

The crediting ceilings in Table I are normative proposals rather than empirically derived constants. They are calibrated to the qualitative structure of the evidence available at each tier — a C0 channel can be characterized exhaustively on a bench, a C4 channel cannot be characterized at all — but a manufacturer with stronger evidence should be free to argue past them, and the framework's value lies in requiring that argument to be made explicitly rather than in the specific numbers.

The factorization in (1) assumes the three terms are independent. They are not entirely: threshold placement is chosen with knowledge of transducer noise, so P_trans and P_dec are coupled. The factorization remains useful as a diagnostic — it identifies which term is binding — but should not be used to compose a precise numerical detection probability from independently estimated parts.

Relation (2) treats responder availability as a scalar. In reality A_r is a distribution over caregivers, times of day, and clinical settings, and is strongly bimodal between attended institutional use and unattended home use. A more faithful treatment would evaluate (2) separately per use environment and take the worst case admitted by the intended-use statement. We chose the scalar form because the framework's purpose is to force the parameter onto the page; refining its distribution is straightforward once it exists.

B. Threats to Validity

Construct validity. We infer the Omnipod's detection architecture from the device class's documented behavior, from the FDA's own statements about what does and does not trigger an alert, and from the published occlusion-detection literature [1], [12]. We have no access to Insulet's risk file, and it is possible that the file already contains the analysis we describe as absent. Our claim is therefore about what the standards require to be written and verified, not a finding about a specific manufacturer's internal documentation.

Internal validity. The illustrative arithmetic in Section IV-B uses assumed values for P_H,tgt and P_e. Different assumptions yield different required responder availabilities. The qualitative conclusion — that (3) demands an A_r close to unity for any plausible acceptability target when T_tol is minutes — is robust across the plausible range, because P_e for a fleet-wide wear-out mechanism with five reported serious injuries is many orders of magnitude above any acceptable harm target.

External validity. Both cases are single-manufacturer field actions in two device classes. The recurrence evidence for the pattern is stronger in infusion than in ventilation: Gao et al. found detection and alarm deficiencies across Class I infusion-pump recalls generally [20], and Alemzadeh et al. found recurring analytically foreseeable failure classes across medical-device regulatory databases [8]. We do not claim the framework generalizes beyond life-sustaining devices where a tolerance time is well defined.

C. Where the Standards Lens Stops

The framework is a lens on what must be written and verified. It does not resolve three questions that sit outside it.

First, whether a device should be marketed for unattended home use at all when (3) demands a responder availability the home setting cannot supply is a regulatory and clinical-policy judgment, not an engineering one. The framework can show that the assumption is unsupported; it cannot decide what to do about it.

Second, the framework treats the alternative means of ventilation as an external given. In practice its availability, its condition, and the caregiver's training on it are part of the same system, and a complete treatment would model them jointly.

Third, supply-constrained remediation — the rationing described in the Astral Early Alert [2] — raises an allocation question the risk-management standards do not address. ISO 14971 governs the risk of the device; it is silent on the risk of the queue.

VI. Conclusion and Future Work

Two FDA field actions thirteen days apart in July 2026 expose the same structural omission from opposite sides. In the Omnipod cannula-tear recall, a detection credit was taken for a fault that lies outside the device's sensing envelope, because the fluid-path surrogate is interrogated in only one direction and an open-path leak moves it the other way; the regulator's own remedy was to tell users to smell for insulin. In the ResMed Astral Early Alert, a safe-state credit was taken for a state that stops life-support ventilation, making its safety a claim about a caregiver rather than about the ventilator, on a platform with three power-subsystem field actions in a decade. Neither assumption was required by any artifact in the standard workflow to be stated, quantified, or verified.

The Detection–Responder Contract makes both computable. Table I forces every credited detection onto a named physical channel with a tier-appropriate evidence burden; (1) identifies which factor binds and therefore which design change can move it; and (2)–(3) convert the previously invisible responder assumption into a number a reviewer can challenge. The eight derived requirements of Table II are the concrete output for these two cases, and the most consequential of them are the cheapest: two-sided fault injection, and a single mandatory field in the risk file classifying every safe state as benign or life-withholding.

Future work should proceed in three directions. First, an empirical calibration of the Table I ceilings against a corpus of Class I recalls, extending the recall-analysis method of Gao et al. [20] with the channel taxonomy as the coding scheme, would replace the proposed ceilings with measured ones. Second, the responder term A_r deserves a proper human-reliability treatment for the home-care setting, building on the integrated THERP and HEART machinery [32] and on the home-ventilation infrastructure data [27], [28]. Third, and most directly actionable, the fail-operational architectures developed for automotive by-wire systems [22], [23] have an unexploited analogue in life-support devices: a ventilator that degrades to a reduced but continuing mode on detected board corruption, rather than latching out of therapy, converts a life-withholding safe state into a benign one and removes the responder from the critical path entirely.