Jherrod ThomasThe Lion of Functional Safety™

July 16, 2026 · 14 min read

ISO 80601-2-72 / IEC 60601-1ISO 14971IEC 60601-1-8 / 60601-1-11

When the Safe State Was a Stopped Ventilator: The ResMed Astral Supercapacitor Early Alert Through an ISO 80601-2-72 and ISO 14971 Lens

On most machines, "enter the fail-safe state" is the happy ending of the safety analysis. On a life-support ventilator strapped to a patient who cannot breathe on their own, the fail-safe state is a stopped ventilator and a very loud noise. Whether that counts as safe depends entirely on who is standing next to the bed — which means it is not a property of the device at all. This week's FDA Early Alert on the ResMed Astral is a case study in what happens when a wear-out failure mode nobody bounded starts triggering that state by accident, at fleet scale, faster than the spare boards exist to fix it.

The failure mechanism here is almost quaint: an electrolytic component leaks and corrodes the board it sits on. Electronics engineers have been designing around leaking capacitors since before ISO 14971 existed. The reason this one earns a post is what sits downstream of the corrosion — a protective subsystem that interprets the damage as a reason to latch the ventilator out of therapy — and what sits upstream of it in the product's own history, because this is not the first time the Astral's power subsystem has taken ventilation away from a dependent patient.

1. The public record

The Astral 100 and Astral 150 are portable life-support ventilators providing continuous or intermittent ventilatory support, invasive and non-invasive, for patients weighing more than 5 kg — in hospitals, in homes, and in transit between the two. On July 15, 2026 the FDA published an Early Alert covering Astral 100 and 150 units built prior to October 2024 (serial numbers below 22241890149) plus spare main boards distributed as service parts. (FDA Early Alert, July 15, 2026.)

The defect, in ResMed's words: in a subset of these ventilators, "a component, called a supercapacitor, may leak over time. The leakage may damage specific circuitry on the printed circuit board assembly (PCBA). This can result in the ventilator inadvertently entering a fail-safe state." If that happens during therapy, therapy stops, a maximum-volume high-priority alarm sounds, and the interface may show a Safety System Fault red screen; pressing Vent Stop yields System Fault 140. If it happens in standby, the alarm sounds, the screen may display nothing at all, and therapy will not start when commanded. In both cases, "the ventilator is no longer able to deliver therapy. Alternative means of ventilation must be provided." (FDA Early Alert.)

As of June 23, 2026, ResMed had reported five serious injuries and no deaths associated with the issue. The company sent affected customers a field safety notice on June 25, and the correction — replacing the main board — is gated by a hard constraint the Early Alert states plainly: "the availability of PCBAs is significantly constrained, and it is not possible to immediately correct all affected ventilators." ResMed is therefore running a phased strategy that triages patients into clinical risk tiers (Tier 1 through Tier 3, per an appendix in the provider letter) and corrects the highest-risk users first, folding inspections into routine service under Tech Note 1063720. The supply squeeze reaches new production too: providers are told to "prioritize alternative ventilator options" for new patients. (FDA Early Alert; HME News, July 15, 2026; ResMed field safety notice portal.)

Now the history, because it matters. In August 2016, the Australian TGA recorded a Class I recall of the Astral 100 and 150 after reports in which "an internal electrical issue has led to ventilation ceasing without either the low battery alarm or the critically low battery alarm being activated" — only the last-ditch total-power-failure alarm fired. Degraded internal battery packs were to be replaced fleet-wide by December 2016. (TGA recall RC-2016-RN-01074-1 via ICIJ International Medical Devices Database.) In March 2024, Germany's BfArM published another Urgent Field Safety Notice for the Astral 100 and 150 (reference 08339/24) concerning a degraded component in the power path. (BfArM, March 25, 2024.) The 2026 supercapacitor action makes at least the third field action in a decade in which an aging energy-storage component on this platform ends with a ventilator that will not ventilate.

One detail deserves emphasis before the standards discussion: in every one of these events, the alarm layer largely did its job. In 2016 the total-power-failure alarm "activated as intended." In 2026 the machine stops and screams at maximum volume. The patients who were seriously injured were not failed by a silent device. They were failed by the assumption that a loud, stopped ventilator is a managed situation.

2. The standards lens

ISO 80601-2-72 — the particular standard for exactly this device. ISO 80601-2-72 covers ventilators for ventilator-dependent patients in the home healthcare environment — the Astral's core use case. Its essential-performance construction is instructive: the device must either continue to provide ventilation at the set parameters, or detect the failure and generate an alarm condition so that responsibility transfers to the operator. The Astral's fail-safe behavior is a textbook implementation of the second branch. And that is precisely the problem worth staring at: the standard's stop-and-alarm branch is only as safe as the transfer it triggers. In an ICU, the transfer lands on a respiratory therapist ten steps away. In a home at 3 a.m., it lands on whoever hears the alarm, however trained they are, with whatever backup device the DME provider actually delivered. The standard knows this — it is why 80601-2-72 and IEC 60601-1-11 (home healthcare environment collateral) lean so hard on alarm audibility, instructions for alternative ventilation, and carer training. But none of that machinery changes the arithmetic that for a Tier 1 patient, "therapy stops + alarm" is not a safe state. It is a handoff with a deadline measured in minutes.

IEC 60601-1 Clause 4.4 — expected service life, and the wear-out fault that is not a random fault. Supercapacitor electrolyte leakage is not an act of God. It is a time-and-temperature wear-out mechanism, characterized in every supercap datasheet as an endurance rating, and its onset is a function of years in service. IEC 60601-1 requires the manufacturer to state an expected service life and to demonstrate that basic safety and essential performance hold throughout it. A component whose known aging mechanism is "leak corrosive electrolyte onto the board" — mounted on the same PCBA as the circuitry that arbitrates whether the ventilator may run — is a component-aging analysis question, and the analysis has to close one of two ways: either the endurance rating, derated for the real thermal environment, exceeds the service life with margin, or the design isolates the consequence (placement, barriers, conformal coating) so the leak cannot propagate into a safety-relevant function. Units built before October 2024 failing in the field in 2026 tells you the fleet is aging into the failure now, and the affected-serial-number cutoff tells you ResMed can date when the exposure was designed out. The escape was not the leak. The escape was believing the leak's consequence was bounded.

ISO 14971 — the risk file for the protective subsystem itself. The fail-safe latch is a risk control. ISO 14971 requires the risk analysis to ask whether the risk control measure introduces new hazards — and a protective function that can be triggered by unrelated hardware damage is a new hazard on a life-support device, because its false activation is clinically indistinguishable from the failure it protects against: therapy stops either way. The row that appears to be missing is the one where the initiating event is corrosion-induced malfunction of the safety supervisor's own inputs, hazardous situation loss of ventilation in an unattended home setting, and P1 explicitly modeled as increasing with fleet age rather than constant. Clause 10 (post-production) sharpens the point: this platform generated a Class I power-subsystem recall in 2016 with the specific lesson that energy-storage components degrade and take ventilation with them. That is exactly the field signal Clause 10 exists to feed back into the hazard analysis of the next board revision.

IEC 60601-1-8 — an alarm that tells you nothing in standby. In the standby scenario the maximum-volume alarm fires while "a user interface message may not be displayed." An alarm with no annunciated condition forces the carer to diagnose a screaming, blank ventilator under stress — and the FDA letter's mitigation is, in effect, train the carers harder. Alarm philosophy for home-use life support should assume the responder is not a clinician; an audible alarm whose visual channel can be absent in one of the two entry paths is a conformance corner worth re-testing, not a footnote.

The correction as a resilience problem. The phased, tiered correction is rational triage — and it is also an admission that field maintainability was never treated as a safety attribute. When a fleet-wide wear-out fault arrives on a life-support platform, time-to-correct is bounded by spare-board supply. A risk file that credits "we will replace affected PCBAs" as the long-term control implicitly assumed board availability that did not survive contact with reality; patients in Tiers 2 and 3 are now running on borrowed probability while the parts queue drains.

3. A worked snippet — the FMEA rows for the board that decides

Design-FMEA excerpt for the Astral-class main PCBA, AIAG-VDA style: Severity, Occurrence, Detection on 1–10 scales, Action Priority per the standard lookup. O ratings reflect an aging fleet, which is the honest way to rate a wear-out mode.

| ID | Element / Function | Failure mode | Failure effect (system level) | S | Failure cause | O | Prevention / detection controls | D | AP | |---|---|---|---|---|---|---|---|---|---| | FM-AST-01 | Supercapacitor (alarm/RTC hold-up) — store energy across power events | Electrolyte leakage after multi-year service | Corrosive residue migrates to adjacent safety-supervisor circuitry | 9 | Endurance rating consumed; thermal derating insufficient for 24/7 duty | 6 | Endurance test at component level only; no board-level aging test, no in-service leakage detection | 8 | High | | FM-AST-02 | Safety-supervisor input network — arbitrate run/fail-safe | Corrupted input reads as internal fault (false positive) | Ventilator latches fail-safe: therapy stops, max-volume alarm; System Fault 140 | 10 | FM-AST-01 residue bridging / leakage currents | 6 | None during operation; fault is annunciated only as it occurs | 9 | High | | FM-AST-03 | Standby-state annunciation — display fault condition to user | Alarm asserts with no UI message | Carer cannot identify cause; therapy will not start when commanded | 8 | Fault occurs while display pipeline unpowered/not latched | 4 | Alarm logic verification per 60601-1-8 (audible path only) | 6 | Medium |

The chain FM-AST-01 → FM-AST-02 is the recall. Note where the 9s and 10s sit: not on the leak, but on the decision the leak corrupts. The component-level control (an endurance rating on a datasheet) was never a control on the system-level effect, because nothing in service ever measured the supercapacitor again after it left incoming inspection.

TOP: Ventilator-dependent patient loses ventilation, home setting
        │
        └── AND
             ├── G1  Astral enters fail-safe, therapy stops
             │       └── B1  Supercap leak corrodes PCBA →
             │                supervisor latches Fault 140
             │                (wear-out; P grows with fleet age)
             │
             └── G2  Handoff to environment fails
                     └── OR
                          ├── B2  No backup vent / resuscitator
                          │        on site
                          ├── B3  Carer absent, asleep, or cannot
                          │        diagnose blank-screen alarm
                          └── B4  Correction deferred — patient in
                                   Tier 2/3 of PCBA supply queue

The device analysis historically ends at G1 and calls it safe. The injuries happen in G2 — and every basic event in G2 is outside the manufacturer's design authority but squarely inside its risk file, because ISO 14971 scopes foreseeable use environment, not the parts we ship.

4. Derived requirements (excerpt)

Five requirements this failure implies, with the trace that should carry them. Numeric bands are illustrative of the class of limit, not ResMed's internal figures.

None of these are exotic. RQ-AST-01 is layout discipline. RQ-AST-02 is a derating memo. The expensive one is RQ-AST-05 — and it is the one currently being written the hard way, one tier at a time.

5. What the headline really tells us

"Ventilator maker warns a component may leak" sounds like a parts bulletin. The record says something sharper: a life-support platform's power subsystem has now produced field actions in 2016, 2024, and 2026, each ending in the same clinical event — a dependent patient and a machine that stopped. The missing artifact is not a better supercapacitor. It is the analysis that treats entry into the fail-safe state as a hazardous event in its own right, rates its probability as a function of fleet age, and refuses to let the word "safe" in fail-safe do the work that only a backup ventilator, a trained carer, and an available spare board can actually do. A fail-safe state you cannot exit, on a device whose patients cannot wait, backed by a spares pipeline that cannot keep up, is three separate engineering findings. The alarm working as designed is not the defense. It is the evidence that the design's last line was always someone else's hands.

Sources

Field Notes — Jherrod Thomas, The Lion of Functional Safety™. Written from the public record; no proprietary ResMed information is used or implied. Numeric requirement bands are illustrative of the class of limit, not the manufacturer's internal specifications.