软件风险分析报告(最后).doc

Software risk management File Doc. MC0188F-SW-RMFSoftware Risk Management File In MC0188F1. Risk Management Summary1.1 Software FaultsHazardRisk reduction(Before actionRisk reduction actionRisk reduction(after action )Acceptable Level of RiskThe device may not carry our auto power off process after operation for a long time (more than 25 mins). 使用过程中，有可能会出现码率25分钟后不自动关机现象S4P4RThe IC is equipped with dual automatic timing function. If there are any errors in one of the timing functions, the remaining timing function will work properly for auto power off process.IC内部设有双重自动计时功能，如果其中一个计时功能出错，另一个计时功能还在正常工作，可正确计时关机S1P1AACCDuring use, operation faults may cause buttons out of order or in error.在使用过程中，因操作失误有可能会出现按键无功能或出错现象S3P4RThe IC is equipped with automatic error correction function and every button with operation delay function. If operation fault is caused by continuous/ multiple pressing buttons, the system will justify as invalid input for operation fault during delay time.IC内部设有自动纠错程序，每一个按键设有操作延时功能，如操作失误连续按或多次按时，在延时时间内错误操作无效S1P1AACCWhen the device encounters power failure during use, it may not work properly after start again.在使用过程中，如遇供电异常，可能会造成再次开机无法工作S4P5RThe hardware circuit is quipped with large capacity voltage storage device, which can let IC stop working until delayed to safe time. Please refer to EMC test report (Ref. GZ10071005-1).在硬件电路上设有大容量电压贮存器，可让IC延迟到安全时间内停止工作，可见EMC测试报告。编号：S1P1AACCWhen changing program, the output intensity may not returned to zero level.在使用过程中，模式转换时，有可能会出现输出强度不归零情况S2 P2RThe IC has the reset process on intensity level during program changed and synchronous processor to program change. When the program is changed, the intensity level will return to zero. In the case for the intensity is not returned to 00, the total output voltage will not cause any injury to patient at highest intensity and the value of square root of maximum output is not exceeded 10V.IC内部设有模式转换输出强度检测归零处理，且设有与模式转换同步处理器，当模式发生转换时的同时，输出强度就归零，另就是输出不归零，共输出电压在最高档对人体不会造成伤害。最强档输出的平方根值未超过10V。S1P1AACCWhen holding down the intensity increase or decrease button, the intensity level may be adjusted disorderly. 在使用过程中，按强度“+”或“-”键时，强度出现降低或增加，可能出现强度加减功能错乱S2P2RThe IC is equipped with verification function on button signal and the intensity interval for each level is 1V only, which will not cause patient injury. Please refer to EMC test report (Ref. GZ10071005-1). IC内部设有按键信号检测纠错功能，另本产品强度“+“或”-“每档仅间隔1V，对人体不会造成伤害。可见EMC测试报告。编号：S1P1AACCDuring use, there may be no EMS output or feeling to patient but normal operation showed on LCD display.在使用过程中，LCD显示功能正常，但是输出端使用者有可能感觉无EMS输出S3P3RThe IC has the synchronous detection processor between LCD display and EMS output signal which can minimize this hazard. However, there is another possible cause: the patient skin is too dry causing high resistance for EMS transition. This cause is mentioned in user manual and cannot be solved by dampen the skin of treatment area in order to reduce skin resistance.IC内部设有LCD显示与EMS信号输出同步检测处理器，出现LCD 有输出显示，但是无输出，IC出错的机会是无，另有可能是使用者的皮肤太干燥，电阻值过大造成，此况有在说明书中指出，在使用前，须在接触位皮肤喷少量水份或导电液。S1P1AACCWhen simultaneous use for all 4 electrodes to body & soles, the intensity of EMS output may be reduced due to high workload.在使用时，身体与脚底四个导电片同时使用时，输出强度因负载被拖弱S3P3RThe bands for sole massager and body massager are completely independent channels. Also, the hardware applied is high-power components which will not reduce the EMS output during simultaneous use for all 4 electrodes.本产品身体与脚底是两个完全独立的通道，且硬件使用的为大功率元器件，使用时产品不会出现因为四个导电片同时用时而拖弱输出强度，有可能是使用者的皮肤太干燥，两极间的电阻值过大造成，此况有在说明书中指出，在使用前，须在接触位皮肤喷少量水份或导电液。S1P1AACC1.2 Environmental ConditionsHazardRisk reduction(Before action )Risk reduction actionRisk reduction(after action )Acceptable Level of RiskStrong external EM wave interference may cause failure or error for button function.因为外界强电磁波信号干扰，按键功能有可能出现失灵或出错，S3P4RThe IC is equipped with anti-interference process and the external hardware with anti-interference circuit, which can block or reduce signal interference. Please refer to EMC test report (REF. NO. GZ10071005-1)IC内部设有抗干扰处理程序，且外部硬件另有增加抗干扰电路，可屏蔽或减少干扰信号，见EMC测试报告。S1P1AACCExternal interference to IC may disable the auto power off function after 25 minute operation.使用过程中，因为外界干扰IC，25分钟后有可能不会自动关机S4P4RThe IC is equipped with dual automatic timing function. If there are any errors in one of the timing functions, the remaining timing function will work properly for auto power off process.IC内部设有双重自动计时功能，如果其中一个计时功能出错，另一个计时功能还在正常工作，可正确计时关机S1P1AACCExtreme environment temperature and humidity may cause instable functioning or other conditions使用过程中，因为环境的影响造成功能不稳定或其它情况S4P4RThe high & low environment temperature/ humidity tests are conducted during product design and after production. The operating temperature and humidity is 0C 50C, 80% RH listed in user manual. Please find further detail in user manual.产品设计时与生产后有做高低温测试，另说明书中有规定使用环境温度为0-50度，相对湿度：80%；详见说明书。S1P1AACC1.3 Classification of Hazard Severity LevelCodeDefinition DisastrousS4Potential risk for multiple deaths or serious injuries FatalS3Potential risk for death or serious injuryModerateS2Moderate injuryMildS1Mild injury or no injury1.4 Classification of Hazard PossibilityLevelCodeProbability (Number of Events/ Year/ Unit of Product)OftenP610-1 10-2SometimesP510-2 10-3OccasionalP410-3 10-4SeldomP310-4 10-5ImpossibleP210-5 10-6IncredibleP1 10-6Note: Probability is number of events or predictable events per year per unit of product.1.5 Guideline for Risk EvaluationProbabilitySeverityS4: DisastrousS3: FatalS2: ModerateS1: MildP6: OftenUUUUP5: SometimesUUURP4: OccasionalUURRP3: SeldomURRAP2: ImpossibleURAAP1: IncredibleAAAAKey: A Acceptable Risk; R “As Low As Reasonably Practicable” Risk; U Unacceptable Risk even before Risk/ Profit analysis2: Risk Management Plan风险管理计划2.1:Deisgn Input设计输入;2.1.1 ;Product No.产品代码:MC0188F2.1.2 Reason for designing/developing the product:Electronic Nerve Stimulation is a non-invasive, safe nerve stimulation intended to reduce pain. The Electrical Stimulator uses proven neuromuscular electrical stimulation therapy to send micro current pulses through the soles of users feet. This type of electrical stimulation is clinically proven to be safe and effective and can be carried out in the comfort of users own home. The Electrical Stimulator improves muscle functions by stimulating nerves increasing the flow of blood helping to reduce pain, swelling, tired and aching legs.2.1.3:Expected Use 预期用途:This Electrical Stimulator is intended to be used as a muscle stimulator to relieve (muscle) pain, increase blood circulation, relax stiff muscles, reduce swollen feet, ankles and relieve fatigue. The massaging effect is achieved by electronic stimulation of the nerves through electrode pads placed on the skin or through the foot plates. Various massage regions and treatment programs can be selected.2.1.4 Required function of the product l Massage function to foot and body脚底和身体按摩功能.l With 7 control buttons 有7个控制按键.l Operation data is displayed on LCD. LCD上面显示工作信息.l 4: Operation time is displayed on LCD. LCD上面显示工作时间.l 5: Output intensity to body and foot is displayed on LCD. LCD上面显示身体或脚底输出强度.l 6: The massage program is displayed on LCD. LCD上面显示工作模式.2.1.5 Safety requirements: l Operated by C size batteries or DC 4.5V adaptor and large LCD display can show operation data clearly and easily. 使用C型电池供电,或使用DC4.5V火牛供电.LCD显示面积大,易于看清楚工作信息.l The button will be effective only after prolonged pressing for 3 seconds. 长按住”开机”键约3秒,按键才有效.l Anti-slipping design of plastic case. 胶壳有防滑措施.2.1.6 Applicable law and rule requirement: l EN 980: Graphical symbols for use in the labeling of medical devicesl EN 1041:Information supplied by the manufacturer with medical devicesl EN 60601-1: Medical electrical equipment Part 1: General requirements for safety(IEC:60601-1:1998)l EN 60601-1-2: Medical electrical equipment Part 1-2: General requirements for safety Collateral standard Electromagnetic compatibility Requirements and test (IEC 60601-1-2:2001)l EN 60601-2-10:2001l EN 60601-1-6: 2006 l IEC 60601-1-4: 2000 2.1.7 Development cycle：Five monthNoTaskIn-Charge PersonDate (YYYY/MM/DD)1Product Development AssignmentFang Ziran/Fang Hongwei/Tan Dongliang2010-5-112Design Input ReviewFang Ziran/Fang Hongwei/Tan Dongliang2010-5-123Examine And Approve The Product Development AssignmentFang Ziran2010-8-14Compilation PlanFang Ziran/Fang Hongwei/Tan Dongliang2010-8-55Examination And Approval PlanFang Ziran2010-8-76Electron Design (Electronic Circuit Schematic Diagram, PCB Plate And LCD )Fang Hongwei /Tan Dongliang2010-8-127Compilation Of Software Flow ChartTan Dongliang2010-8-158Main ProgramTan Dongliang2010-8-189Measurement SubprogramTan Dongliang2010-8-2110Test Measurement SubprogramTan Dongliang2010-8-2511Test Compensation SubprogramTan Dongliang2010-8-2812EMS OUTPUT Compensation SubprogramTan Dongliang2010-9-113Subprogram Of Key FunctionTan Dongliang2010-9-514Test The Key SubprogramTan Dongliang2010-9-1015Emulation Of Whole SoftwareTan Dongliang20109-1216LCD Display InformationTan Dongliang2010-9-1517EMS Intensity ControlTan Dongliang2010-9-1918Modify PCBFang Hongwei2010-9-2219Body EMS Intensity ControlTan Dongliang2010-9-2520Sole EMS Intensity ControlTan Dongliang2010-9-2821Sole EMS Intensity ChangeTan Dongliang2010-10-1822Modify The Key FunctionTan Dongliang2010-10-2023Complete Machine Test By Engineering DepartmentFang Hongwei2010-11-124Modify LCD Display InformationTan Dong;iang2010-11-3025Manufacture SampleFang Hongwei2010-5-1126Evaluation Of Project EngineeringFang Ziran /Fang Hongwei /Tan Dongliang2010-5-1227Trial-Production Of Small AmountProduction Division2010-8-12.2 Design outputSpecification of key elements:2.2.1. Integrated Circuit (IC)Mode：MC0188F ICParameterRatingUnitSupply voltage to Ground Potential-0.0 to 5.5VApplied Input/Output Voltage-0.3 to VDD+0.3VAmbient Operating Temperature-10 to +85CStorage Temperature-55 to 150CESD tolerancehuman body model:3KV3. Risk Management Process3.1 Operation Mechanism: Replace with new batteries or Plug in DC adaptor, Prolonged pressing On/Off button for 3 sec, LCD display will show operation data, Adjust the EMS output intensity to body or foot, LCD display will show the corresponding EMS output intensity. The effective operation time is 25 minutes only with EMS output. Choose 10 operation programs by pressing P+/P- buttons 操作原理:更换新电池或插好火牛,长按住”开机”键约3秒,松开按键,开机.LCD上面显示信息.调节身体或脚底EMS输出强度,LCD上面有相应的EMS输出强度显示.只要有EMS输出,有效工作时间是25分钟.按模式键,可以选择10种工作模式.流程图Flowchart 开始 Start按键扫描和按键处理Button Scan & Process身体EMS强度调节输出 Adjusting EMS output intensity to body脚底EMS强度调节输出Adjusting EMS output intensity to foot工作模式选择功能Selection function on Massage ProgramLCD显示相应的数据Corresponding data shown on LCD display结束End风险 Identify Hazard按键扫描出错Fault on button scan身体EMS输出强度出错 Fault on EMS output intensity to body脚底EMS输出强度出错Fault on EMS output intensity to foot选择工作模式出错Fault on massage program selectionLCD显示信息出错Fault on data shown on LCD displayHazardRisk reduction(Before action )Risk reduction actionRisk reduction(after action )ALOR按键扫描出错Fault on button scanS4P5RThe IC is equipped with automatic error correction function and every button with operation delay function. If operation fault is caused by continuous/ multiple pressing buttons, the system will justify as invalid input for operation fault during delay time.IC内部设有自动纠错程序，每一个按键设有操作延时功能，如操作失误连续按或多次按时，在延时时间内错误操作无效S1P1AACC身体EMS输出强度出错Fault on EMS output intensity to body or soleS3P4RThe IC is equipped with verification function on button signal and the intensity interval for each level is 1V only, which will not cause patient injury and meet EN60601-1-1 standard. Please refer to EMC test report (REF. NO. GZ10071005-1)IC内部设有按键信号检测纠错功能，另本产品强度“+“或”-“每档仅间隔1V，对人体不会造成伤害。可见EMC测试报告。编号：S1P1AACC选择工作模式出错Fault on massage program selectionS4P4RThe IC has the reset process on intensity level during program changed and synchronous processor to program change. When the program is changed, the intensity level will return to zero. In the case for the intensity is not returned to 00, the total output voltage will not cause any injury to patient at highest intensity and the value of square root of maximum output is not exceeded 10V. Meet EN60601-1-1 standard.IC内部设有模式转换输出强度检测归零处理，且设有与模式转换同步处理器，当模式发生转换时的同时，输出强度就归零，另就是输出不归零，共输出电压在最高档对人体不会造成伤害。最强档输出的平方根值未超过10V。S1P1AACCFault on data shown on LCD displayLCD显示信息与EMS输出出错S3P4RThe IC has the synchronous detection processor between LCD display and EMS output signal which can minimize this hazard. However, there is another possible cause: the patient skin is too dry causing high resistance for EMS transition. This cause is mentioned in user manual and cannot be solved by dampen the skin of treatment area in order to reduce skin resistance.IC内部设有LCD显示与EMS信号输出同步检测处理器，出现LCD 有输出显示，但是无输出，IC出错的机会是无，另有可能是使用者的皮肤太干燥，电阻值过大造成，此况有在说明书中指出，在使用前，须在接触位皮肤喷少量水份或导电液。S1P1AACC3.2 EMS Output Mechanism and Flowchart (EMS输出原理和流程图):When pressing the output intensity adjustment buttons to body or foot, there will be EMS output and the change of EMS output intensity will not exceed more than 1 V for 1 intensity interval. 只要按了身体或脚底EMS输出强度调节键,就有EMS输出.并且每调节1级,EMS输出强度变化量是小于或等于1V.Flowchart 流程图;EMS调节按键EMS adjustment buttonsEMS身体强度控制Control on EMS intensity to bodyEMS脚底强度控制 Control on EMS intensity to foot身体EMS输出EMS output to body脚底EMS输出EMS output to footLCD显示EMS输出强度 EMS output intensity is shown on LCD DisplayHazardRisk reduction(Before action )Risk reduction actionRisk reduction(after action )ALOREMS输出强度控制Control on EMS output intensityS2P5RThe IC is equipped with verification function on button signal and the intensity interval for each level is 1V only, which will not cause patient injury and meet EN60601-1-1 standard. Please refer to EMC test report (REF. NO. GZ10071005-1). 调节身体或脚底EMS输出强度,强度变化量是每调节1级,变化小于或等于1V,符合医疗认证测试标准.S1P1AACC4. Software Vertification: EMS Output Voltage, Waveform 软件设计验证: (EMS电压输出，与波形验证) 4.1. Normal Operation Condition 正常工作条件l a）Envirionmental Temperature 环境温度：050；l b）Relative Humidity 相对湿度：80%；l c）Atmospheric Pressure 大气压力：86kPa106kPa；l d) Input Volutage for Adaptor equipped: AC230V 50Hz 配火牛，火牛输入电压范围：AC230V 50Hz.4.2 Requirements for Main Unit 主机要求4.2.1 Basic Specification for Adaptor 火牛的基本参数：l Input Voltage 输入电压范围：AC230V 50Hz.l Input Curent 输入电流是：0.1A.l Output Voltage 输出电压是：d.c 4.5V.l Output Curent输出电流是：100mA。l Output Power 输出功率是：0.45W.4.2.2 Basic Specification for Batteries 电池的基本参数：l Operated by 3 pcs C Size batteries 使用3节电池。l Voltage: 4.5 V (3 x 1.5 V)4.2.3 Basic Parameter of EMS EMS基本参数：l Maximum EMS output voltage to foot 脚底EMS输出最大电压：50V5V。l Maximum EMS output voltage to body 身体EMS输出最大电压：50V5V。l Maximum EMS output current EMS输出最大电流是：8mA.l Maximum EMS output power to foot 脚底EMS输出的最大功率是：0.2W.l Maximum EMS output power to body 身体EMS输出的最大功率是：0.25W4.2.4 Frequency Generation of EMS Output EMS输出频率范围：l Frequency Generation of EMS output to foot 脚底部分输出频率范围：6Hz 80Hz.l Frequency Generation of EMS output to body 身体部分输出频率范围：13Hz 80Hz.4.2.5 EMS Output Voltage (EMS输出电压)：l Output Voltage to foot (Single Wave): 50V 5V (Testing Condition: Load Resistance = 1K, Connected onto the electrode silicon area to foot) 脚底输出电压(单波): 50V5V。（测试条件：负载电阻：1K,连接在脚底导电胶上面） l Output Voltage to body (Single Wave): 50V 5V (Testing Condition: Load Resistance = 1K, Connected onto the electrode gel pad to body) 身体输出电压（单波）： 50V5V. （测试条件：负载电阻：1K，连接在身体连电极片上面）4.2.6 User Interface 人机对话：l Using LCD Display to show operation condition & data (LCD Visible Area: 55 x 80 mm) 使用LCD显示工作状态，工作信息。(段显LCD，可视区：55 x 80mm)l Total 7 Control Buttons 一共有7个控制按键。l Press On/Off button to start, Adjust output intensity for “Band 1” or “Band 2”, Total 40 adjustable intensity levels, Press “P+” or “P-“ buttons to select 10 different massage programs. 按开机键开机，调节“Ban0”输出或”Ban1”输出强度，一共有40级强度可以调节，按“P+”键或“P-”键，选择10种不同的工作方式。l Effective Operation Time: 25 min. The device will be automatically off after time up. 有效工作时间是：25分钟，时间到了，就自动关机。（没有任何输出，LCD没有显示，背光源熄灭）4.3 Output Frequency for Massage Program 工作模式的频率：4.3.1 Band 1 Sole Massager (during 1 k load) Mode 1: Pulse rate 6Hz with 1 second in left side, right side off time 1 second then Pulse rate 6Hz with 1 second in right side, left side off time 1 second. A cycle repeating.Mode 2: Pulse rate 12Hz- 80Hz with 12 seconds and off time in 1 sec. A cycle repeating.Mode 3: Pulse rate 7 Hz with 30 seconds and off time in 1 sec. A cycle repeating.Mode 4: Pulse rate 7Hz- 25Hz with 8 seconds and off time in 1 sec. A cycle repeating.Mode 5: Pulse rate 12Hz- 80Hz with 11 seconds and off time in 1 sec. A cycle repeating.Mode 6: Pulse rate 12Hz with 12 seconds and off time in 1 sec. A cycle repeating.Mode 7: Pulse rate 11Hz- 80Hz with 15 seconds and off time in 1 sec. A cycle repeating.Mode 8: Pulse rate 12Hz- 80Hz w