Pressura eSTAR Readiness Review

Contents

1 Readiness decision and management actions

2 Device and configuration assessment

3 Findings register and assessment method

4 Technical domain assessments

5 Detailed findings and closure criteria

6 Evidence coverage and traceability

7 Sponsor response plan and review questions

8 Source register public context and limitations

Navigation uses PDF bookmarks and linked chapter names. Evidence references such as D07.03 identify numbered sections in the companion source book. Finding IDs M01 to M06 and m01 to m03 are identical across both reports.

1 Readiness decision and management actions

The PTC-200 case has a defined adult professional use, a controlled device and accessory configuration, risk controls, formal software records and several favorable test results. The readiness problem is concentrated in release verification, two adverse system observations, usability performance, reuse validation and the breadth of the accuracy claim. A complete looking set of report titles does not overcome these evidence conflicts.

Six Major and three Minor findings are supported by specified source sections. The Major findings require evidence or design and labeling decisions before package release. The Minor findings correct traceability and reporting defects; resolving them alone would not change the readiness conclusion. The same finding IDs, severity, evidence and closure rules appear in both reports.

Evidence that remains useful

2 Device and configuration assessment

Device identity and clinical function

The Pressura Digital Tourniquet Controller PTC-200 is a reusable, nonsterile, single channel pneumatic pressure controller proposed for temporary control of limb blood flow during adult surgical procedures. Example Clinical Systems Inc is the fictional manufacturer. This demonstration configuration is hardware B with released firmware 3.2. There are no alternate controller models, software options or connected accessories in the package.

The trained healthcare professional selects pressure and monitors application duration for the particular procedure. The device does not select a patient specific pressure, determine limb occlusion pressure, measure blood flow or recommend treatment duration. Numerical engineering limits in this source book describe the invented device. They are not clinical instructions for use on a patient.

The pump supplies air through the H-200 hose to a permitted cuff. The controller compares measured pneumatic pressure with the selected setpoint and operates inlet and exhaust valves to regulate pressure. The independent cutoff switch provides an additional hardware limit. Pressure display, audible and visual alarms, a procedure timer and battery indication support the user's monitoring tasks. None substitutes for the professional's observation of the patient and procedure.

Submitted configuration and physical interfaces

The controller enclosure measures 230 by 180 by 160 mm and has a mass of 2.8 kg. It accepts 100 to 240 V AC at 50/60 Hz and includes a rechargeable backup battery. The pneumatic channel comprises an integral pump, controlled inlet and exhaust valves, an internal pressure transducer and an independent cutoff switch. One processor performs sensing, control, display, alarms and timer functions. The controlled hardware baseline is B.

The user accessible interfaces are the mains inlet, pneumatic port, front panel display, pressure selection controls, start and stop controls, alarm acknowledgement and timer controls. There is no user accessible data or firmware port. Authorized service can open the enclosure and use an internal programming connector with a controlled service fixture. This service path is a separate lifecycle boundary described in D13.

The supplied hose H-200 Rev B is the only permitted hose. The proposed cuff family is C-200 M, C-200 L and C-200 XL, each Rev A. These are single patient, single use, nonsterile cuffs supplied under the same fictional manufacturer's configuration control. M, L and XL are accessory configurations of the one controller, not additional controller variants. The cuff family has common patient contact materials and processing; its pneumatic loads differ and require configuration coverage in the bench evidence.

Design limits and labeled claims

The submitted design baseline defines the numerical limits below. These values allow the reader to judge the invented results against an explicit criterion. A result inside the pressure range is not, by itself, proof that regulation accuracy, alarm behavior, usability and reuse claims are all supported. Each claim has its own evidence and configuration boundary.

The proposed accuracy statement is within plus or minus 5 mmHg after 10 seconds stabilization over the full labeled operating range. It is stated for all three permitted cuffs and mains or battery operation. The source package does not restrict this claim to room temperature, full battery or a reduced cuff family. The timer accuracy claim applies over a 120 minute timer interval. Neither the timer interval nor the pressure range prescribes a clinical treatment setting.

Users patients and component contact

The proposed patient population is adults aged 18 years and older undergoing surgery. The intended users are trained surgeons, circulating nurses and other licensed perioperative healthcare professionals in operating rooms and ambulatory surgical centers. Home operation, self use, use by untrained people, pediatric or neonatal use and automatic limb occlusion pressure determination are outside the proposed scope.

The cuff's outer woven polyester and edge binding directly contact intact skin for no more than 120 minutes per procedure in this invented use definition. The silicone bladder is enclosed by the textile; seam thread and hook and loop fastener are described in the material declaration. The controller and hose do not contact the patient. This contact map supports a specific biological evaluation scope rather than an empty applicability statement. D10 documents its reasoning and remaining access to full test reports.

The controller and hose are reused between patients; the cuffs are discarded after one patient's use. No device component is claimed sterile or intended to enter the sterile surgical field. The controller exterior is cleaned and disinfected between patients under the proposed IFU. The case does not authorize sterilization, immersion or cuff reprocessing. Those boundaries are part of the evaluation, not options left for the reader to guess.

Version and evidence configuration map

The released baseline is firmware 3.2 on hardware B. The formal software verification report executed firmware 3.1 on hardware B. Change CHG-032 alters input debounce and battery estimate filtering. The provided change record describes implementation but contains no approved impact assessment, regression selection or evidence bridge. Later system and usability observations on 3.2 do not identify which 3.1 software requirements remain covered after this change.

System bench report PT-PTC-2026-01 Rev B, human factors report HF-PTC-2026-01 Rev A and electrical and EMC report ES-PTC-2026-220 Rev A identify firmware 3.2 on hardware B. The declaration index references ES Rev B, which is absent. Software revision coverage and the electrical document revision pointer are separate issues: the first affects release assurance; the second concerns retrieval and accuracy of the assembled evidence.

3 Findings register and assessment method

Major means a failure, unresolved assurance issue or evidence gap that can materially affect the proposed safety or performance argument. Minor means a reporting, instruction or traceability defect requiring correction without a separately demonstrated fundamental failure. These are Panabistics editorial ratings for this demonstration, not FDA deficiency categories, a probability score or a prediction of clearance.

The six Major findings are separate closure units. Shared test planning can address their dependencies, but none is counted again merely because the same defect appears in labeling, risk management or another report. The three Minor findings remain visible in the same register. Scope boundaries are not counted as deficiencies.

The assessment checks each substantive claim against its stated criterion, tested configuration and source record. It distinguishes an executed pass, an executed failure, an uncovered claim and an incomplete report. It also checks release versions, user scope, component contact and reuse paths. An inventory entry or report conclusion alone is not accepted as evidence of the underlying result.

Findings are anchored to the specified package facts. The case illustrates passing evidence, adverse observations, uncovered claims and reporting defects. Multiple references to the same problem remain one finding. The invented status of the comparator is a demonstration boundary rather than a counted deficiency.

How the observed results change the assessment

Open chart at full size

Figure 1. Numeric observations from D07, D08 and D09. The XL results and alarm information interruption exceed their stated criteria. The timer meets its limit, so its finding concerns the summary calculation. Three assisted battery task completions require human factors adjudication. All data are authored fiction; the figure adds no tested configurations or inferred measurements.

4 Technical domain assessments

Device definition and clinical configuration

The expanded package defines the device well enough to judge the internal evidence. It does not establish actual market authorization.

Evidence reviewed: D01.01, D01.02, D01.03, D01.04, D01.05, D01.06.

What the reader can identify

The reviewed object is one PTC-200 controller on HW B and firmware 3.2, one controlled hose and a three size single use cuff family. This matters because a generic controller description would conceal the load configuration that fails in M02. Cuff XL is within the marketed accessory family, so its low pressure result cannot be set aside as an unapproved accessory. The smaller cuffs' passing results remain useful evidence; they do not cover the larger pneumatic load without a justified comparison.

The architecture identifies both active regulation and an independent cutoff. Their functions answer different questions. Normal regulation accuracy concerns sustained pressure control; a cutoff concerns pressure limitation under a specified condition. A passed cutoff test does not rescue a failed pressure accuracy test. Likewise, a pressure trace remaining within limits during an electromagnetic disturbance does not establish availability of essential alarm information. The device profile and risk controls must be read together to avoid declaring a whole domain adequate from one favorable observation.

A defined professional use setting

The clinical scope excludes home, self use, untrained operation and pediatric use. The report therefore does not call for a home user study or invent a pediatric gap. The proposed professional group is broader than the enrolled nurses and technologists in D09. The sponsor should explain whether the surgeons' tasks and training are adequately represented by those participants. That coverage question is part of the human factors response to M04; it is not counted again as a separate finding.

The reusable controller is outside patient contact and the cuffs contact intact skin for the stated exposure duration. Biological evaluation follows that defined interface. Cleaning evaluation follows the separately defined controller and hose reuse path. Combining those boundaries into a single generic biocompatibility paragraph would miss the actual unsupported cleaning claim. The sample instead distinguishes the biological rationale in D10 from the process validation mismatch in D11.

Configuration control determines what a pass means

The release evidence is not uniform. Formal software verification covers 3.1; bench, EMC and human factors records identify 3.2. The changed debounce and battery estimate functions relate directly to alarms and battery response. These facts make the release bridge a substantive assurance issue, not a typographical version correction. The response needs an approved impact analysis and evidence tied to the released build.

The case does not infer undocumented pump capacities, battery chemistry, circuit isolation details or material test methods. Those details would be necessary at different levels of an actual device file. For this demonstration, conclusions attach to the supplied engineering limits and executed record summaries. An inventory of missing real submission artifacts is maintained separately from the counted fictional findings so that the report does not exaggerate its assessment depth.

Software release evidence and architecture review

The design description is coherent, but formal verification is limited to 3.1 and has no controlled bridge to submitted 3.2.

Evidence reviewed: D04.03, D05.01, D05.02, D05.03, D05.04, D05.05, D06.01, D06.02, D06.03, D06.04.

What the evidence establishes

The architecture identifies a single on-controller processor, pressure input, regulation outputs, alarm/display functions, timer and supervisor. The quantitative specification makes the intended behavior explicit, including the pressure band, alarm offsets and persistence, independent cutoff and battery warning. The twenty-one formal checks are reported passing on firmware 3.1. These positive elements allow a reviewer to understand the intended functional chain rather than infer it from document titles. They do not establish the released configuration's formal coverage. D06 identifies its executed build clearly, which is useful evidence even though the version differs from the submitted baseline.

The architecture also distinguishes the independent cutoff from ordinary regulation and the display from the control path. That distinction matters when interpreting the bench and immunity records. A separate cutoff can protect a maximum boundary while a permitted cuff fails the tighter regulation claim. Pressure regulation can continue while the display loses alarm information. A review that treats all these functions as a single software PASS would miss the device-specific consequences of the actual observations.

Why the release determination remains open

CHG-032 changes debounce and battery-estimate filtering. Both have meaningful interface or warning connections, so an impact assessment must identify which requirements, risks and prior checks are affected. The record contains no approved analysis and no 3.2 formal regression or bridge. M01 addresses that absence; it is not a conclusion that any version-number change inherently requires wholesale repetition of all tests. The available data cannot support either an automatic carryover of every 3.1 result or an arbitrary universal retest requirement.

The change record does not establish causation for the low-battery use failures or the immunity display interruption. Those observations have their own conditions and acceptance questions. A common interface component may make joint investigation efficient, but the sponsor still needs separate evidence answering release applicability, unassisted user response and electromagnetic alarm availability. Combining them under one presumed firmware bug would obscure rather than resolve the findings.

Closure and retained boundaries

The response should identify the exact build, controlled changes and affected evidence. It should explain retained results, justify the regression selection and provide the new executed results needed for the released configuration. The reviewer can then trace each functional requirement and related risk control to a disposition. The system tests remain part of that chain, including the XL failure; a bridge cannot omit a contradictory result because it was generated outside the formal software report.

The final release decision must agree across risk, labeling, architecture and comparison records. Passing nominal tests are retained as positive evidence, while open anomalies remain visible. The service programming boundary and software inventory supply useful context but do not themselves close formal verification. No actual source-code audit, certification or clinical safety determination has been performed in this fictional review. Its defensible conclusion is narrower and concrete: the supplied release-evidence decision is incomplete, and M01 remains open until that controlled decision is supported.

Pressure regulation performance and claim coverage review

Nominal M/L results pass, but a defined XL leak challenge fails and the broad operating-range accuracy claim lacks representative evidence.

Evidence reviewed: D05.02, D07.01, D07.02, D07.03, D07.04, D07.05.

Nominal evidence and denominator

The M/L subset comprises thirty-six runs on three units with two cuff sizes, three setpoints and two power conditions. Three stable observations per run produce 108 readings. All are within plus or minus 5 mmHg at 23 degrees C. This is substantive positive evidence for those tested configurations. The denominator describes bench observations, not patients or a clinical success rate, and it should remain separate from the additional XL condition. Reporting the exact structure prevents an aggregate pass count from concealing which accessories and power states were actually represented.

The protocol defines ten seconds of stabilization and a five-mmHg regulation band. It also defines independent pressure-limiting and alarm functions. Those criteria must be evaluated independently. A reading outside the regulation band is not rescued by remaining below the independent cutoff, and a deviation smaller than the alarm offset is not evidence that the accuracy requirement was satisfied. The source now supplies the numerical limits, so the review can examine performance rather than merely request unspecified numbers.

XL result and summary integrity

At 350 mmHg with the controlled 30 mL/min leak, the XL readings are 341, 342 and 340 mmHg against 345 to 355. None passes. The observation denominator is three stable readings in one challenge run on U03. The evidence therefore supports a specific nonconformance; it does not support a claim that every XL cuff or every procedure fails. M02 is Major because a permitted configuration fails the source's own performance criterion and the all-configurations-PASS summary suppresses that result.

No root cause or approved disposition accompanies the row. The reviewer should request investigation of the defined configuration, measurement setup and response behavior without deciding the cause in advance. A corrected summary alone is necessary but insufficient for closure. The sponsor must establish the effect on permitted use and claims, justify its corrective decision and provide confirmation evidence. Any proposed configuration restriction has to be controlled in the device baseline, instructions and submission comparison rather than silently assumed by the report author.

Operating envelope distinction and closure

M06 concerns a different question: what evidence supports the full 10 to 40 degrees C accuracy claim and the relevant battery-state envelope? Nominal 23-degree data and full-charge battery starts do not answer that question. The three duration runs of 68, 66 and 64 minutes meet the stated sixty-minute claim at nominal conditions, but runtime is not a measurement of regulation accuracy at environmental or power extremes. Even if the XL issue were resolved, the broader coverage rationale would remain absent.

The response should provide a justified operating-envelope plan with representative configurations, power states and environmental challenges. The reviewer should accept supported bounding arguments rather than demand an indiscriminate full-factorial matrix, but each exclusion needs an engineering basis. Revised claims are another controlled design option requiring consistent labeling and risk decisions. Closure of M02 requires resolution of an actual failing row; closure of M06 requires representative support for the claimed range. Keeping these questions separate preserves both the positive nominal results and the distinct work needed for a credible final conclusion.

Electrical electromagnetic and alarm availability review

Nine immunity sequences meet their criteria; IMM-07 loses essential alarm information for six seconds against an explicit two-second limit.

Evidence reviewed: D04.02, D04.03, D05.01, D08.01, D08.02, D08.03, D08.04, D08.05.

Functional channels and criterion

D08 identifies firmware 3.2 on HW B and separates pressure regulation, alarm-information availability and recovery. Its ten-sequence register is sufficiently specific to expose an internal contradiction. Nine sequences meet the stated functional criteria. IMM-07 records a six-second display blank during an electrostatic disturbance while regulation continues. The active alarm information is unavailable for longer than the protocol's two-second limit. These are different observations; continued regulation does not satisfy the alarm-information criterion.

The source's two-second limit applies to each event, so it cannot be replaced by a mean across ten sequences. Nor can a spontaneous return of the display erase a duration exceedance. The six-second observation exceeds the criterion by four seconds. M03 follows directly from that comparison and the absence of a deviation assessment. It does not depend on an invented IEC test level, a presumed patient injury or a claim that every function stopped.

Interpretation of the PASS summary

The report's overall PASS statement is unsupported by its own sequence log. The reviewer should require the summary and deviation record to acknowledge the event before considering any final disposition. An explanation that the pressure-control path remained active is relevant to consequence assessment, but it cannot by itself justify ignoring the separate information-loss requirement. The sponsor needs an investigation that connects the actual display state, active alarm context, capture timing and final configuration.

No root cause is established. The event might prompt examination of the display path or control-state handling, but the review cannot select a mechanism from the software change description alone. Retesting without a documented explanation also risks repeating a favorable observation without demonstrating that the original condition is understood. A meaningful response preserves the original evidence, records the technical assessment and links any modification to confirmation evidence.

Report identity and closure limits

Only ES-PTC-2026-220 Rev A is supplied. D14's reference to Rev B is a separate revision-pointer issue, m03, which should be corrected without pretending a different report already resolves IMM-07. A final response can update both records, but the reviewer must verify two distinct matters: the functional event has an adequate disposition and the declaration actually points to the supplied final evidence. One cannot substitute for the other.

The fictional report includes electrical and post-sequence functional observations without asserting conformity to a named standard. A real device would require the actual standards applicability, test levels, editions and laboratory record. Those broader decisions remain outside this authored example. The review nevertheless has a strong internal basis for M03 because the source itself supplies both the alarm-information limit and the observed exceedance. Close the finding only when controlled evidence establishes the final configuration's compliance with the retained functional criterion and the risk/release records reflect that disposition.

Risk control traceability and quantitative reporting review

Risk decisions must retain observed failures, while the timer error is corrected as a documentary statistic with passing tests preserved.

Evidence reviewed: D04.01, D04.02, D04.03, D04.04, D05.02, D07.03, D07.05, D07.06, D08.03.

Control mapping and residual acceptance

The risk register identifies specific pressure, alarm, timing, fault, battery-response and contamination scenarios. It gives the reviewer a useful device-centered map of why the evidence matters. The record avoids numerical clinical probabilities that the fictional dossier cannot support. Its draft residual-risk position is still not an independent acceptance decision: it has not reconciled the XL under-pressure result, the alarm-information interruption or the low-battery use failures. The report should therefore describe the acceptance position as open rather than copy it as a completed assurance.

Each control needs evidence for its actual function. The cutoff at 400 mmHg is not proof of plus or minus 5 mmHg regulation. A transducer-fault challenge is not a complete electronics-fault matrix. A displayed battery warning is not the same as an unassisted user recognizing and acting on it. These distinctions allow the review to preserve supported checks while identifying the precise evidence that remains absent or contradictory. They also prevent multiple findings from being artificially generated for every link in one unresolved chain.

Timer arithmetic and classification

The timer observations are +0.4, minus 0.8 and +1.2 seconds at 120 minutes for three units. Taking absolute values gives 0.4, 0.8 and 1.2. Their mean is 0.8 and their maximum is 1.2 seconds. All three values are within the plus or minus 2-second acceptance limit. The submitted summary's use of 0.8 as the maximum is therefore incorrect, but the tested requirement still passes. Minor m02 is a reporting-integrity issue with a clear correction path, not a newly invented timer malfunction.

The corrected source should retain the signed observations, the absolute-value calculation, the denominator and the passing dispositions. Rounding or relabeling must not obscure which statistic was calculated. A reviewer can close the arithmetic point without demanding new tests if the underlying observations and reference method remain valid. This is a different closure from an actual failing regulation row or a functional interruption, which require technical disposition as well as corrected reporting.

Coordinated evidence response

The control map should become the index for the final response. For each affected control, identify its model, hardware, firmware, accessory condition, executed result and decision. M01 governs release-version coverage; M02 resolves the XL nonconformance; M03 resolves alarm availability under the recorded disturbance; M06 establishes support for the claimed operating envelope. Clinical findings M04 and M05 address unassisted battery response and matching reuse evidence. Cross-references should make those dependencies visible without assuming a shared root cause or counting one observation repeatedly.

The final review must also distinguish technical changes from documentary corrections. New firmware or an interface redesign may change the evidence needed for prior results. A corrected timer maximum may leave the tested device unchanged. A revised accessory or operating claim must be controlled consistently across labeling, risk and comparison records. No claim of actual FDA acceptance, certification or demonstrated clinical safety follows from completion of this fictional exercise. The purpose is an auditable explanation of what the authored evidence supports, what it contradicts and what response would permit a reasoned readiness reassessment.

Clinical purpose users and workflow

The expanded dossier defines an adult professional-use tourniquet system and a concrete local interaction sequence. Its clinical scope is coherent, while human factors generalization remains bounded by the enrolled roles and the observed low-battery failures.

Evidence reviewed: D02.01, D02.02, D02.03, D03.01, D09.01, D09.03, D09.04, D04.02, D08.02, D08.03.

A defined use rather than a generic controller description

D02 now identifies the purpose as temporary control of limb blood flow during adult surgery, with a trained professional selecting pressure and duration. That specificity explains why maintenance of pressure, recognition of an impending power interruption and access to alarm information matter. The controller is not a treatment-selection algorithm. Its 100 to 350 mmHg engineering range and 120-minute timer/contact characterization must not be restated as universally appropriate clinical settings. No pediatric, neonatal, home-use, automatic limb occlusion pressure or remote-monitoring indication is implied.

The one-channel controller, H-200 hose and three named cuff sizes create an auditable configuration boundary. A named accessory family allows the reviewer to ask whether a particular tested cuff supports the proposed claim instead of leaving compatibility as an undefined instruction. That improvement does not resolve the XL result in M02: permission to use a cuff and evidence that it meets a specified pressure criterion are separate propositions. The adult indication likewise does not establish clinical safety or actual substantial equivalence to a real cleared device.

Workflow links the technical evidence to the user task

The sequence moves from configuration confirmation and circuit connection to selecting the prescribed setpoint, monitoring pressure and timer information, responding to alarms and managing low battery. Those transitions explain the dependencies among labeling, software behavior, bench evidence and human factors. A display blanking event during otherwise continuing pressure regulation matters because the operator uses that display to recognize and interpret the alarm state; stable pressure does not independently satisfy an alarm-information criterion.

The low-battery transition is particularly important. An operator who interprets a warning as evidence of charging may continue the procedure without restoring mains power or planning an interruption. This is an information-and-response failure, not proof that the battery immediately failed or that regulation was already inaccurate. D02's workflow supports the significance of M04 while preserving the distinctions between M01 formal release coverage, M03 unavailable alarm information and m01 missing charging instructions. The report should retain those links without counting the same observation repeatedly.

What the participant population supports

Fifteen nurses and surgical technologists evaluated the interface; no surgeons participated. The result therefore supports observations in that cohort and setting. It cannot establish coverage of every professional role merely because each is trained. The sponsor should map who makes a clinical selection, who prepares the circuit, who monitors the controller and who responds to each alarm, then justify the user grouping. This is a bounded interpretation question within the expanded case, rather than a newly counted deficiency or an invented rule requiring a fixed number from every profession.

The five task groups with independent completion by all participants remain favorable evidence. They neither cancel the sixth group's failures nor imply that other possible errors were excluded. A defensible final clinical-use statement will preserve the actual tested configuration, adult population and professional environment, present the unresolved critical-task result honestly, and avoid turning a simulated usability record into a claim of observed clinical outcomes.

Labeling claims and operator information

The proposed IFU now gives precise model, accessory, user and engineering limits. The review must reconcile those claims with the bench and reuse evidence, and close the specific missing charging cross-reference without inventing a battery defect.

Evidence reviewed: D03.01, D03.02, D03.03, D03.04, D03.05, D07.01, D07.03, D07.04, D09.04, D09.05, D11.01, D11.02, D11.03.

Claims have measurable scope

The regulation statement is no longer an isolated plus-or-minus figure. It identifies a 10-second stabilization period, permitted M/L/XL cuffs, a 100 to 350 mmHg setpoint range and an operating environment of 10 to 40 degrees C. That scope enables a meaningful comparison with the executed bench protocol. The passing M and L observations at room temperature are relevant, but the XL result outside 345 to 355 mmHg at the 350 mmHg setpoint is an actual criterion failure in the authored evidence, and the untested operating corners are a distinct claim-coverage gap. These are M02 and M06, respectively.

The alarm thresholds and persistence times also have operational meaning. High pressure requires setpoint plus 20 mmHg for 2 seconds, while low pressure requires setpoint minus 20 mmHg for 5 seconds. The independent 400 mmHg cutoff is a separate protective limit. A report should not merge them into one generic alarm specification or suggest that satisfying a cutoff proves regulation accuracy. The label's engineering limits remain fictional device specifications, not treatment recommendations for a reader.

Charging information is a concrete limited omission

Section 9 directs the operator to section 12 for recharging before return to service, yet the submitted IFU has no section 12 or equivalent insert. This is observable document incompleteness, rather than a speculation that all battery instructions are inadequate. m01 asks for the missing controlled information and alignment with the actual charging state and readiness display. It does not create an unsupported charging duration, minimum runtime result or fault in the charging electronics.

M04 remains a separate issue because it arises from three observed independent critical-task failures during the active low-battery scenario. Adding a missing charging page does not demonstrate that the warning icon is understood. Conversely, a redesigned icon does not complete the return-to-service instructions. The two corrections may share an interface and labeling review, but their closure evidence differs: an accessible, verified instruction for m01 and risk-based correction plus independent use evidence for M04.

The proposed reuse instruction is part of the product claim

The IFU specifies a 0.5 percent sodium hypochlorite wipe with 3 minutes wet contact between patients and a five-year life based on 100 processing cycles per year. These are concrete conditions against which evidence can be checked. The supplied study used 0.1 percent for 1 minute across 100 cycles. Its favorable appearance/function checks cannot be silently transferred to a different concentration, longer contact or 500-cycle life. The label-to-study mismatch and absent effectiveness evidence are assessed together in M05; arithmetic ratios do not establish process equivalence.

The final information set should preserve a single system boundary. The reusable controller remains nonsterile and outside the sterile field; the cuffs remain single patient and single use. No cleaning instruction should be broadened into permission to reprocess those cuffs. A controlled revision should reconcile the intended process, risk controls and supportable service-life statement with actual evidence. The reviewer need not prescribe a chemical or a sterilization method to identify why the present evidence does not support the present claim.

Human factors critical task analysis

The task-level record shows 12 of 15 independent low-battery completions and three prompted completions. Treating all fifteen as successful masks an unresolved serious-harm-related interaction risk; other task results remain positive.

Evidence reviewed: D02.03, D04.02, D04.03, D05.03, D05.04, D09.01, D09.02, D09.03, D09.04, D09.05.

Use the critical task denominator and outcome rule

D09 defines independent success before describing the results: the participant must complete the critical task without a prompt that supplies the meaning of the display or the next action. Under that rule, low-battery independent success is 12/15, and task-solving assistance is 3/15, or 20 percent. Reporting 15/15 completion after facilitation answers whether the scenario could eventually be finished, not whether the evaluated interface supported independent use. The sponsor's summary therefore conflicts with its own protocol and worksheet.

The 90 participant-task opportunities are the product of fifteen participants and six task groups. They are not ninety independent trials of the battery warning. Even an accurately reported 87/90 independent completion rate would obscure where the critical failures occurred. The relevant denominator for the interaction is fifteen, with the three failures retained. This arithmetic establishes the extent of the observed issue; it does not set an allowable clinical error rate or justify accepting a residual risk simply because most attempts succeeded.

The observation supports a specific root cause question

N04, N09 and T03 all mistook the low-battery icon for a charging indicator and continued without acknowledgement or mains connection. The shared interpretation points to the relationship among graphic, battery state and instruction. It does not show that users were physically incapable of connecting mains: all three did so after the facilitator explained the warning and directed the response. The correction should address the information users need at that transition, with evidence rather than a presumption that more generic training would solve it.

The warning is presented at an estimated 15 minutes of remaining operation. That value is not a guarantee that a procedure can safely continue for fifteen minutes, and the usability record does not measure the battery's true remaining capacity. Its significance is that an operator may fail to arrange a controlled power response before an interruption. D04's hazard/control traceability and D05's battery indication and filtering description should be reconciled with those observations. The software change record's absent release bridge remains M01; human factors on 3.2 does not substitute for formal software verification.

Closure requires more than a corrected table

First, the sponsor must correct the outcome table to distinguish independent and prompted completion and preserve the original observations. Second, it must analyze the confusion, define a controlled corrective approach and update the relevant interface, labeling and risk controls. Third, independent evaluation must demonstrate the effectiveness of that approach in a representative critical-task scenario without task-solving prompts. A revised narrative alone would repair the misclassification but would not establish that the unresolved use problem was controlled.

The submitted cohort contains no surgeons. A role/task rationale is therefore needed to define the users represented by the revised evaluation, without automatically multiplying participant groups or imposing an invented sample-size rule. That rationale should identify which intended professionals actually perform the battery transition and why the chosen grouping covers the relevant interactions. It should also preserve study configuration and training conditions so that an unrecorded change does not become the apparent explanation for a better result.

The first five task groups retain their independent 15/15 outcomes and their bounded observation of no serious-harm-related use errors. M04 does not recast the entire study as uniformly failed, assert an actual injury or equate all assistance with identical risk. It identifies three specific critical-task failures, the reporting error that conceals them and the missing corrective evidence needed before the warning can support a readiness conclusion.

Patient contact biological evidence and reusable controller processing

The cuff contact map and biological summaries provide an adequate summary-level rationale for the fictional use. Reusable-controller processing is a separate unresolved Major issue because the labeled process and lifetime do not match the executed compatibility study and no effectiveness study is supplied.

Evidence reviewed: D02.02, D03.05, D04.02, D10.01, D10.02, D10.03, D10.04, D11.01, D11.02, D11.03, D11.04.

A component specific biological conclusion is possible

D10 identifies direct intact-skin exposure at the cuff textile and binding for no more than 120 minutes per procedure, with a material and processing rationale covering M, L and XL. The enclosed silicone bladder, fastening and seams are considered within the finished construction. The controller and hose are explicitly non-contacting in the intended arrangement. This is sufficient to make an actual scope determination for the sample rather than leaving an empty biocompatibility heading or asserting that every electronic controller is automatically exempt from biological evaluation.

The sponsor supplies final finished cuff cytotoxicity, sensitization and irritation summaries reporting their criteria met. Their positive interpretation is limited to the defined articles, contact use and size-family rationale. Full methods and raw records are absent, so independent audit of the endpoint results is not possible. Obtaining the full reports for normal submission assembly is appropriate; inventing a failed endpoint, prescribing additional tests without a supported reason or claiming conformity to a named standard edition would exceed this record. No additional counted biological finding is warranted within the chosen summary scope.

Biological coverage does not establish processing performance

Cuffs are single patient and single use, whereas the non-contacting controller is reused between patients. These facts create different evidence questions. The cuff evaluation addresses patient-contact materials in the defined finished article. Controller processing must address the intended between-patient procedure and the effects of repeated exposure on the reusable device. A favorable cuff endpoint summary cannot demonstrate removal of contamination from an enclosure, and a favorable enclosure appearance check cannot demonstrate the biological suitability of cuff contact surfaces.

RV-PTC-2026-01 executed 0.1 percent sodium hypochlorite for 1 minute over 100 cycles and reports appearance/function acceptance. IFU Rev C calls for 0.5 percent for 3 minutes and claims five years at 100 cycles annually, which is 500 cycles. The differences concern concentration, time and cumulative exposure; they cannot be collapsed into one presumed equivalent chemical dose. The record contains no approved bridge or demonstrated accelerated model covering those changes.

Interpret the passing study without extending it

The existing study's passing checks are not discarded. They support the narrower statement that the measured exterior and functional outcomes met the study criteria after the executed exposure. They do not demonstrate that the more concentrated, longer-contact labeled process is compatible over the claimed life. No cleaning effectiveness study is supplied, so there is also no measured soil-removal or disinfection-efficacy conclusion to transfer. A global statement of suitable repeated clinical reuse therefore exceeds the evidence even though no observed device damage is reported.

M05 combines these related process and lifetime coverage problems around a single reusable-controller claim. Its Major priority derives from reliance on a between-patient process linked to cross-patient contamination and continued device function, not from a documented infection or a newly invented sterilization requirement. A replacement chemical is not prescribed. The sponsor must choose and control its intended process and supportable life, then supply relevant effectiveness and compatibility evidence or a justified bridge that actually addresses the changed variables and endpoints.

Closure should reconcile the IFU, contact map, risk controls, method and resulting claim in one traceable disposition. It must keep the controller, hose and single use cuffs within their stated boundaries. A label-only reduction, an unsupported life extrapolation or an unqualified reference to a passing report is insufficient when the underlying procedure is still unresolved. The final conclusion should say what process was demonstrated, on which configuration and over which exposure, while retaining the accurate positive findings from the cuff biological assessment.

Comparator rationale and evidence dependent comparison

The comparison identifies genuine similarities within the authored dossier and two specific differences, but supports no actual predicate or substantial-equivalence determination. The teaching boundary is separate from the counted evidence findings.

Evidence reviewed: D12.01, D12.02, D12.03, D12.04, D09.03, D09.04, D09.05.

What the comparison does support

D12.01-D12.02 give the reviewer a bounded comparison rather than a bare predicate name. Both fictional devices are described as one-channel, mains-and-battery pneumatic controllers for temporary adult limb blood-flow control in professional surgical settings. The PTC-200 configuration is unambiguous: hardware B, firmware 3.2, hose H-200 Rev B and C-200 M/L/XL Rev A cuffs. This is useful positive evidence of how the comparison was scoped. The three cuff sizes must be represented in the technical assessment, but they are not three additional controller models.

The table is appropriately selective about what is unknown. It gives the comparator's 100-to-350 mmHg setpoint range without inventing its selection increment, cutoff threshold, battery capacity or alarm timing. An analogous control concept can identify which subject tests matter; it cannot supply their results. The subject's numeric criteria therefore remain sourced to its own design, protocol and labeling records. The review neither prescribes clinical pressure settings nor treats the engineering setpoint range as evidence of clinical appropriateness in every adult procedure.

Differences that require actual subject evidence

The revised battery display is a meaningful difference because it changes the information that supports a user's response to low remaining operation. D09.03-D09.05 record prompted completion for three of fifteen participants on that task; they cannot be dismissed because the comparator also has a battery. The proper link is between the changed interface, the task observation, the risk control and its eventual demonstrated correction. M04 addresses that specific evidence. The comparison adds no separate duplicate finding.

The different cuff supplier similarly connects to material and pneumatic evidence. D10 supplies a contact map and biological evaluation summaries for finished cuffs with shared contact materials and processing across M/L/XL; that positive rationale is retained. D07 supplies the size-specific pressure evidence, including the XL measurements below their acceptance band. A favorable biological summary cannot cure a pneumatic result, and an adverse pressure result does not establish a biological failure. Keeping those paths separate makes the response proportionate and prevents indiscriminate requests for extra tests.

The formal software version problem is also independent of the comparator narrative. D12.03 explicitly declines to borrow support from a common architecture for the 3.2 release when formal verification used 3.1. System bench work on 3.2 remains evidence for its executed tasks and conditions. It is not equivalent to a complete documented bridge for the changed software. The comparison conclusion must remain conditional on closure of the actual evidence questions, not on changing a table cell from different to similar.

Scope boundary and proportionate conclusion

FDA's 510(k) Program guidance is a public framework for comparison decisions, not a clearance of this example. Because TPR-90 and the subject are expressly fictional, legal marketing status, actual predicate labeling and genuine clearance records cannot be verified. This prevents a real substantial-equivalence conclusion. It is disclosed as a demonstration boundary rather than counted as a tenth deficiency caused by the exercise's invented identity. No product code, device class or true clearance number is assigned to make the report appear complete.

For a real submission, replacing this boundary would require verification of an appropriate actual comparator and a fresh comparison using reliable evidence. Closing the six Major findings in this fictional dossier would improve the teaching package; it would not create a real predicate or confer FDA authorization. That distinction should appear in the executive scope as well as the comprehensive report, so a reader does not mistake a detailed table for a completed regulatory decision.

What a defensible response would contain

The response should retain the existing intended-use comparison and revise only those conclusions affected by corrected subject evidence. It should identify the final release, the revised battery-display rationale, cuff-family coverage and the actual source sections supporting each assertion. For a changed specification or label limitation, the comparison should show what changed and why the remaining difference is supported. Review of the response should check both directions: every claimed resolution has source evidence, and every important altered result is reflected in the comparison.

Acceptance at this stage means that the comparison narrative accurately states the remaining strengths and limits of the supplied dossier. It does not mean agreement that the product is safe, clinically equivalent or cleared. This bounded disposition preserves the useful comparator analysis while preventing a generic equivalence sentence from neutralizing documented engineering, usability and reuse issues.

Standalone architecture component inventory and internal service security

Security is evaluated at the actual service boundary. No internet feature is invented, no blanket security exemption is asserted, and the supplied procedural controls are distinguished from unperformed technical validation.

Evidence reviewed: D13.01, D13.02, D13.03, D13.04.

Connectivity decision based on positive architecture facts

D13.01 establishes the relevant boundary through specific interfaces. Clinical users have mains and pneumatic connections, without radios, network hardware, USB, removable media, an application or remote operation. Authorized service uses an internal connector after opening the enclosure. That is materially different from a network update function. A keyword match on software or update would therefore be an unreliable basis for asserting internet connectivity or imposing an invented connected-device test package.

The internal connector still creates a service access question. The important assets are the image, stored configuration, calibration and availability of control and alarm information. The assessment appropriately asks who can use service equipment, how the intended package is selected and how the output configuration is verified. It does not assume that physical access is harmless. Nor does it claim that a fixture described as offline proves that every related tool or workflow can never connect to the internet.

What the inventory and controls establish

D13.02 makes the software composition legible using five explicitly fictional component entries. Their purposes cover the application, loader, hardware abstraction, support routines and configuration check. The absence of a communications processor or server is consistent with the declared architecture. The inventory is useful to configuration reasoning, but it is not an independently generated binary inventory or a claim that real third-party components have been searched for vulnerabilities. A configuration integrity routine also does not establish cryptographic authentication.

D13.03 describes a plausible controlled service sequence: remove the controller from clinical use, record identity, select the controlled package, use the designated fixture, compare output identity independently and perform return-to-service checks. Those are supplied procedural instructions, not observed service execution or security test results. The reviewer can credit the existence and alignment of the procedure while retaining that evidence limit. No signatures, successful penetration tests, complete image-authentication behavior or actual vulnerability-free state should be inferred.

The threat reasoning is proportionate to the authored system. Wrong-package selection, accidental configuration changes and unauthorized physical connector use are considered with their corresponding procedural controls. The review does not invent a remote network threat route simply to resemble a connected-device template. It likewise avoids declaring the controls technically sufficient against every attacker, because the records needed to support that broader conclusion are not part of the sample.

Public scope and separation from observed failures

FDA's current February 2026 cybersecurity guidance page distinguishes recommendations for devices with cybersecurity risk and discussion of statutory cyber devices. FDA's public FAQ describes the statutory definition using software, ability to connect to the internet and relevant vulnerable technological characteristics. Against the declared no-connectivity design, the review records no demonstrated internet capability. It stops short of a binding statutory conclusion and identifies confirmation of the actual device and related service architecture as a real-project prerequisite.

The assessment must also avoid converting every software-related event into a security failure. The formal 3.1-to-3.2 verification gap, low-battery task failures and IMM-07 alarm interruption have specific evidence and separate findings. None is shown to result from exploitation or unauthorized service. Calling them cyber events would add an unsupported causal story and duplicate the response workload. Conversely, a favorable no-network rationale cannot close M01, M03 or M04; those findings concern the evidence for the intended clinical configuration.

Bounded disposition and changes that reopen scope

No additional security deficiency is raised on the supplied teaching record. The disposition recognizes an explicit interface rationale and supplied service-control description while declaring that comprehensive technical security validation was not performed. This is a completed bounded assessment, not an empty not-applicable checkbox. It demonstrates why a cybersecurity chapter can contain meaningful reasoning without claiming a network, demanding nonexistent wireless data or treating the presence of embedded software as conclusive statutory evidence.

For a real project, the release package, service tool and related authorized configurations would need evidence appropriate to their actual implementation. Adding connected accessories, radios, network bridges or remote updates would reopen this scope decision; so would changing the programming path or loader. The report should preserve the current assumptions beside that trigger, making the future decision auditable without prescribing a particular cryptographic design, standard edition, vulnerability tool or replacement service architecture that has not been evaluated.

Submission assembly declarations and cross document readiness

All fourteen source records are indexed and assigned evidence roles. Presence is separated from adequacy, the specific Rev B-to-Rev A mismatch is actionable, and actual eSTAR execution and administrative acceptance remain outside the demonstration.

Evidence reviewed: D14.01, D14.02, D14.03, D14.04, D14.05, D08.01, D08.03, D08.04, D08.05.

Presence purpose and configuration are different checks

D14.01-D14.02 establish fourteen identified records with stable IDs, codes and revisions. This is useful assembly evidence: the reviewer can distinguish the release description from executed verification and locate each domain without inferring content from a filename alone. The inventory preserves formal software testing on 3.1 while listing the device release as 3.2, and identifies bench, human factors and electrical records on 3.2 hardware B. It therefore exposes the central configuration mismatch instead of smoothing it away.

Correct mapping matters as much as counting documents. D04 is the risk-control source, D07 the system bench source and D13 the service-security rationale. A risk summary does not become an SBOM because it mentions software; a performance report does not become labeling simply because it tests a label claim. Sources can support multiple domains, but the report should retain their actual purpose and content. This improves the traceability promised by the service and prevents false missing-evidence statements in section summaries.

A concrete minor discrepancy with independent closure

D14.03 cites a specific inconsistent pointer: the declaration says ES-PTC-2026-220 Rev B, while the supplied report D08.01 and inventory D14.02 identify Rev A. The report does not need a speculative standards violation to explain why that is a defect. A reviewer cannot know whether the declaration intends the available report or a missing replacement. m03 asks the author to reconcile the identity, supply the intended controlled evidence and update linked references.

The distinction from M03 is essential. Rev A contains an actual six-second interruption against a two-second alarm-information criterion. Correcting a pointer to Rev A does not address that observed nonconformance. Supplying a genuine revised report could change the evidence position, but its contents and changes would require review; a new revision label is not itself closure. The Minor classification concerns traceable assembly rather than a second count of the alarm event. The response register should keep both closure decisions visible.

Real eSTAR and standards boundaries

FDA describes eSTAR as a structured interactive submission form. The present fourteen-document worksheet is not that form and has not been opened, populated, submitted or technically screened as an actual application. The current FDA program page also identifies current template resources and human factors content updates. Those facts justify verifying the appropriate current form during a real assembly; they do not prove that this illustrative package has met its field logic, attachment checks or administrative obligations.

Standards claims need equal restraint. The fictional declaration supplies a report pointer, not an actual declaration of conformity or evidence of a particular recognized edition. No IEC or ISO edition, test level, certification or legal-conformity conclusion is filled in to make the chapter look complete. An actual sponsor would need to establish its standards basis separately. The missing real-world status is disclosed as a teaching boundary and is not used to multiply the nine source-based findings.

Readiness priorities and response records

The PTC-200 assembly remains not ready on the supplied evidence, with six Major and three Minor findings open. Release priorities are to establish the final hardware, firmware and permitted cuff configuration; resolve the XL pressure result and alarm-information interruption; address the low-battery interaction; and substantiate the retained operating-range and reusable-controller claims. Engineering and interface decisions determine which evidence can be retained and which needs revision or new execution. Passing nominal regulation, timer and limited biological evidence remain useful within their stated boundaries, but none supplies the missing release-wide assurance.

Each response record needs an identifiable corrected source and a supported disposition for its particular question. Completing charging instructions under m01, correcting the timer maximum to 1.2 seconds under m02 and reconciling the electrical report pointer under m03 are distinct documentary closures. They do not close the Major findings. The final configuration, claims, risk-control links and comparison rationale must agree with the evidence accepted for release; a revised index or favorable summary cannot substitute for that chain.

5 Detailed findings and closure criteria

M01 Released firmware 3 2 lacks formal verification coverage

Rating: Major. Source sections: D04.03, D05.04, D05.05, D06.01, D06.02, D06.03, D07.01.

Observed evidence

SV-PTC-2026-01 Rev A reports 21 of 21 defined formal checks passing on 3.1 HW B. The submitted baseline and bench record identify 3.2 HW B. CHG-032 changes input debounce and battery-estimate filtering, but no approved impact analysis, 3.2 formal regression or evidence bridge is supplied.

Assessment criterion

A controlled release determination must identify which prior results remain applicable, assess changed functions and risks, and provide the required new evidence for the submitted build.

Why this matters

Pressure control, alarms, timing and user response depend on firmware. Passing 3.2 system observations are relevant but do not establish unit and integration coverage of changed paths. The evidence gap limits reliance on the final risk-control and comparison conclusions.

Required response

Identify the exact 3.2 build and changes; map affected requirements, architecture, risks and anomalies; justify retained 3.1 results and the regression selection; execute and document any required new verification. Reconcile the release baseline across connected records.

Closure evidence

Close when the controlled evidence chain supports the released functions, explains retained results and documents the residual-issue and release disposition. A renamed report or repeated PASS assertion does not close the gap.

Independent acceptance check

Reviewer checks build identities, change-impact rationale, requirement-risk-test links, regression results and agreement among the final records.

Dependencies and linked findings

Coordinate with M02, M03, M04 and M06 evidence; do not presume a single causal defect or erase contrary observations.

Limits of the conclusion

The 3.1 checks did not fail; no universal full retest is prescribed, and the version difference alone does not prove an unsafe device.

Accountable response owner: Software engineering with quality and risk-management review.

M02 XL cuff under pressure result fails its acceptance criterion

Rating: Major. Source sections: D04.02, D04.03, D05.02, D07.01, D07.02, D07.03.

Observed evidence

One U03 XL challenge on 3.2 HW B at 350 mmHg with a controlled 30 mL/min leak records 341, 342 and 340 mmHg after stabilization. Acceptance is 345 to 355 mmHg. Zero of three observations pass; signed errors are minus 9, minus 8 and minus 10 mmHg. The report nevertheless states all configurations passed.

Assessment criterion

Each permitted configuration must receive a disposition consistent with its recorded result. A failed criterion needs a controlled investigation and supported resolution before an all-pass or full-performance conclusion is used.

Why this matters

The observed condition contradicts the plus or minus 5 mmHg regulation claim for a permitted cuff configuration. It concerns actual source data, not merely absent detail. A pressure deviation inside an alarm offset still fails the tighter regulation criterion.

Required response

Preserve the original readings and capture conditions; investigate the device, accessory, fixture and measurement factors; correct the summary; establish the effect on claims and permitted configuration scope; provide corrective and confirmation evidence supported by the investigation.

Closure evidence

Close when the specific nonconformance has an approved technical disposition, final claims and configuration records agree, and confirmation evidence supports the retained criterion. Removing the row or averaging it with M/L passes is insufficient.

Independent acceptance check

Reviewer recalculates each deviation, checks the investigation and configuration identity, and follows the corrective decision to the executed confirmation results.

Dependencies and linked findings

Coordinate released-build applicability under M01 and operating-envelope support under M06; their closure does not automatically resolve this failing condition.

Limits of the conclusion

This is three readings in one run, not three failing units, a clinical failure rate, proof every XL use fails or an identified root cause.

Accountable response owner: Systems and pneumatic engineering with verification and quality.

M03 EMC alarm information interruption exceeds the protocol limit

Rating: Major. Source sections: D04.02, D04.03, D05.01, D08.01, D08.02, D08.03, D08.04.

Observed evidence

IMM-07 in the 3.2 HW B report records six seconds of display blanking during an electrostatic disturbance. Pressure regulation continues, but active alarm information is unavailable. The protocol permits no loss longer than two seconds. Nine other sequences meet their criteria; the summary says PASS and the deviation log provides no assessment.

Assessment criterion

The overall report must reflect each stated functional criterion, and an exceeded essential-information limit needs a documented technical and risk disposition.

Why this matters

The event exceeds the supplied limit by four seconds. Continued regulation and subsequent display recovery do not establish that the alarm-information requirement was met. An unqualified PASS obscures the function that actually failed.

Required response

Preserve event captures, timing and configuration; investigate the information-loss mechanism without presuming a cause; assess the alarm context and consequence; document corrective action or a substantiated controlled criterion decision; provide confirmation evidence for the final configuration and correct the report.

Closure evidence

Close when the event, investigation, final functional criterion and executed confirmation agree, and the release/risk records adopt the supported disposition. Repeating a favorable sequence without addressing the original observation is insufficient.

Independent acceptance check

Reviewer compares the six-second capture with the two-second rule, checks the deviation assessment and final configuration, and verifies the corrected sequence and summary dispositions.

Dependencies and linked findings

Coordinate changes with M01 release evidence. Correct D14's report-revision pointer separately under m03; an index correction cannot close the functional nonconformance.

Limits of the conclusion

No actual standard level or certification is claimed, no patient injury is recorded, and the event does not show that pressure regulation stopped.

Accountable response owner: Electrical/EMC engineering with software, risk management and quality.

M04 Low battery critical task failures are counted as successful use

Rating: Major. Source sections: D02.03, D04.02, D04.03, D05.03, D09.01, D09.02, D09.03, D09.04, D09.05.

Observed evidence

HF-PTC-2026-01 Rev A evaluated 15 participants on firmware 3.2 HW B. In T06, N04, N09 and T03 mistook the low-battery icon for charging and continued without acknowledgement or mains connection. They completed only after task-solving prompts. Independent success is 12/15; assisted completion is 3/15, or 20 percent. The sponsor nevertheless reports 15/15 success, contrary to its independence rule.

Assessment criterion

The validation conclusion must preserve independent versus prompted outcomes and resolve observed critical-task failures against the defined users, interface and risk controls.

Why this matters

An unrecognized low-battery warning can prevent a planned power response during a procedure. Continued pressure regulation immediately after the warning does not control that interruption risk. Successful performance in the other five groups cannot cancel T06 failures.

Required response

Correct the task table; analyze the common icon interpretation; define controlled interface, information or other justified corrective measures; update linked requirements and risk controls; then independently evaluate the corrected low-battery interaction without task-solving assistance.

Closure evidence

Provide traceable root-cause and corrective records, configuration identity, user-group rationale, independent task outcomes and a justified residual-risk disposition addressing the three original observations.

Independent acceptance check

Check original and corrected participant-level denominators, assistance classification, tested release and whether the repeated task supplies its own solution through facilitation.

Dependencies and linked findings

Coordinate D05 battery indication and CHG-032 release assessment. Complete charging information under m01 separately; adding that section does not itself close M04.

Limits of the conclusion

No patient injury, failed battery-duration test or universal failure of all users is inferred. No automatic requirement for fifteen participants per profession is imposed.

Accountable response owner: Human factors lead with software, labeling and risk management owners.

M05 Labeled cleaning process and reuse life lack matching validation

Rating: Major. Source sections: D02.02, D03.05, D04.02, D10.01, D10.04, D11.01, D11.02, D11.03, D11.04.

Observed evidence

IFU Rev C specifies a 0.5 percent sodium hypochlorite wipe with 3 minutes wet contact. Its five-year life at 100 processing cycles annually represents 500 cycles. RV-PTC-2026-01 Rev A instead used 0.1 percent for 1 minute over 100 cycles, with passing appearance/function checks. No cleaning effectiveness study or bridge to the labeled process and life is supplied.

Assessment criterion

The marketed between-patient process and cumulative reuse claim need matching effectiveness and compatibility evidence, or a documented, scientifically supported bridge addressing the actual differences and endpoints.

Why this matters

The relied-upon process is linked to cross-patient contamination control and continued reusable-controller function. Passing a less concentrated, shorter, 100-cycle compatibility exposure cannot establish the different process or 500-cycle life. Multiplying concentration, time and cycle ratios is not an equivalence demonstration.

Required response

Control the intended process and life claim; supply relevant effectiveness and repeated-exposure evidence or a justified bridge; reconcile the method, IFU, device boundary and risk-control traceability.

Closure evidence

The final claim must identify a supported process, controller configuration and lifetime, with clear distinction between cleaning/processing effectiveness and appearance/function compatibility endpoints.

Independent acceptance check

Compare final IFU concentration, wet time and cycle basis with executed methods and results; examine every claimed bridge and resulting release disposition.

Dependencies and linked findings

Preserve D10's single use cuff boundary and the distinction between cuff biological evidence and reusable-controller processing. Account for connected components without broadening the claim beyond their intended handling.

Limits of the conclusion

No observed infection, enclosure damage or pressure-control failure is asserted. No replacement chemical, cuff reuse, sterilization cycle or specific external efficacy standard is prescribed.

Accountable response owner: Reprocessing validation lead with labeling, materials, engineering and risk management owners.

M06 Full operating range accuracy claim exceeds bench evidence

Rating: Major. Source sections: D05.02, D07.01, D07.02, D07.03, D07.04.

Observed evidence

The accuracy claim covers operation from 10 to 40 degrees C. The supplied nominal regulation subset is recorded at 23 degrees C on mains and initially full batteries; no 10- or 40-degree accuracy run or aged/near-depleted battery accuracy evidence is supplied. Three full-charge duration runs of 68, 66 and 64 minutes address a different endpoint.

Assessment criterion

The claimed accuracy envelope needs representative executed evidence or a controlled engineering rationale connecting selected conditions, accessory configurations and power states to the complete claim.

Why this matters

Nominal performance cannot establish accuracy at untested corners simply because it passes at ambient temperature. Battery duration also cannot substitute for pressure regulation evidence across relevant battery states. The gap remains even if the separate XL failing run is resolved.

Required response

Define a risk-based coverage plan for the operating envelope, justified bounding configurations and power conditions; provide the corresponding protocol, results and dispositions. Where evidence cannot support a claim, evaluate a controlled claim restriction with consistent design, risk and labeling changes.

Closure evidence

Close when the retained operating-range accuracy claim is supported by a traceable coverage argument and the necessary executed evidence, with exceptions resolved and final records aligned.

Independent acceptance check

Reviewer checks condition and configuration coverage, rationale for exclusions, measured results, acceptance rules and consistency with the final claims.

Dependencies and linked findings

M02 addresses an actual XL nonconformance; M01 establishes released-build applicability. Neither supplies the missing operating-envelope rationale by itself.

Limits of the conclusion

No untested corner is declared to have failed. No indiscriminate full-factorial test matrix, clinical treatment setting or automatic battery lifetime result is prescribed.

Accountable response owner: Systems verification and engineering with labeling, risk management and quality.

m01 Referenced charging instructions are absent

Rating: Minor. Source sections: D03.03, D03.04, D09.01, D09.04, D09.05.

Observed evidence

IFU-PTC-200 Rev C section 9 directs the operator to recharge according to section 12 before returning the controller to service. The submitted file contains no section 12 or equivalent controlled insert. Charging steps, charging-state explanation and readiness indication are therefore not supplied at the referenced location. The same IFU revision accompanied the human factors configuration.

Assessment criterion

A user must be able to follow the IFU's controlled cross-reference to establish the intended charged and ready state, with instructions matching the actual power interface and indications.

Why this matters

This is a specific document-completion issue. The current record does not demonstrate a charging-circuit defect or failure of the at-least-60-minute battery claim. It also does not resolve the separate observed confusion between low battery and charging, which remains Major M04.

Required response

Supply the missing section or correct the reference to an accessible controlled instruction. Define sponsor-established steps, status interpretation, readiness checks and precautions, and reconcile them with the evaluated device interface.

Closure evidence

Provide the revised IFU and controlled location, with verification that the charging information is present, consistent with the baseline and available in the delivered instruction set.

Independent acceptance check

Follow the reference as a reader, inspect all linked pages and compare stated charging/ready states with controlled device information. Check that no unsupported charging duration or runtime result was added.

Dependencies and linked findings

Coordinate wording and indications with M04's interface correction. Preserve a separate closure record so that document completion is not mistaken for independent validation of the low-battery critical task.

Limits of the conclusion

No charging performance failure, battery injury or validated remedy for M04 is inferred from the missing section alone.

Accountable response owner: Labeling owner with power-system and human factors reviewers.

m02 Timer summary misstates maximum absolute error

Rating: Minor. Source sections: D05.02, D07.06.

Observed evidence

At 120 minutes, U01, U02 and U03 show signed timer errors +0.4, minus 0.8 and +1.2 seconds. The absolute values are 0.4, 0.8 and 1.2 seconds. Mean absolute error is 2.4/3 = 0.8 seconds; maximum absolute error is 1.2 seconds. The submitted summary incorrectly labels 0.8 seconds as the maximum.

Assessment criterion

The reported statistic must agree with its source observations, calculation method, units and denominator. Signed error, mean absolute error and maximum absolute error must be distinguished.

Why this matters

The incorrect maximum understates the largest observed deviation and weakens the calculation trail. All three absolute errors nevertheless meet the plus or minus 2-second requirement, so the discrepancy does not demonstrate a failed timer criterion and does not justify changing the passing results.

Required response

Correct the summary to mean absolute error 0.8 seconds and maximum absolute error 1.2 seconds; retain the signed observations; identify the corrected document revision and check connected tables or claims for the same error.

Closure evidence

Close when the corrected controlled record and any repeated statistics consistently reproduce the three observations and the two correct aggregate values, with the 3/3 passing disposition preserved.

Independent acceptance check

Reviewer takes absolute values, recomputes the sum and mean, identifies the largest value and confirms all three against the unchanged two-second limit.

Dependencies and linked findings

Keep the reporting correction separate from M02's actual regulation failure and M06's evidence-coverage gap. No technical device change is established by this arithmetic correction.

Limits of the conclusion

No additional timer failure, clinical timing error or requirement for new execution is inferred if the underlying observations and reference method remain valid.

Accountable response owner: Verification report author and independent quality reviewer.

m03 Electrical evidence declaration points to an absent revision

Rating: Minor. Source sections: D14.02, D14.03, D08.01, D08.05.

Observed evidence

The declaration in D14.03 identifies ES-PTC-2026-220 Rev B. The controlled index in D14.02 and the supplied report identity in D08.01 instead identify Rev A, executed on firmware 3.2 hardware B. D08.05 confirms that only Rev A is supplied. No contents of an additional Rev B report are established.

Assessment criterion

The declaration, inventory and attachment references should identify the same intended controlled evidence, or explain and supply the revised record actually being relied upon. This is an evidence-identity expectation for this sample, not a finding of nonconformity to an unreviewed standard edition.

Why this matters

The conflicting revision prevents the reviewer from knowing which report supports the declaration. It is classified Minor because the available report is identifiable; the substantive alarm-information criterion exceedance is addressed separately in M03.

Required response

Reconcile the intended revision. Correct the declaration to Rev A when it is the intended source, or supply the intended Rev B with its change history and an explanation of affected conclusions. Update all related assembly references.

Closure evidence

Provide a reconciled declaration and index with matching report code, revision, tested firmware and hardware. Any replacement report must be reviewed for its actual changes and its disposition of relevant anomalies before reliance.

Independent acceptance check

Independently compare declaration, index, attachment identity and revised-report history; retain the original source trail.

Dependencies and linked findings

Coordinate with M03 while retaining separate closure decisions; correcting the reference does not resolve IMM-07.

Limits of the conclusion

No fabricated Rev B, certificate, standard conformity, failed unreported test or FDA acceptance is inferred.

Accountable response owner: Regulatory affairs and document control, supported by electrical engineering.

6 Evidence coverage and traceability

The following matrices connect claims, configurations, controls and submission topics. They are reviewer cross checks, not copies of a completed eSTAR form. A row marked supported remains limited to the tested conditions; it is not a whole domain clearance conclusion.

Claim to evidence matrix

Risk control and assurance map

Configuration coverage matrix

Submission topic coverage matrix

Coverage means the topic was examined in the supplied authored records. It does not mean every eSTAR question is populated, every test is adequate or a real submission would pass technical screening. D14 identifies the assembly boundary. The review makes no eSTAR completeness or submission acceptance claim.

7 Sponsor response plan and review questions

All nine findings remain open. No sponsor response or retest has been executed for this demonstration. The following plan defines the evidence and decisions needed for a future closure review.

1 Freeze the remediation baseline

Identify final HW, FW, cuffs, use claims and cleaning instructions. Keep a signed decision log of retained and narrowed claims.

Owner: Regulatory lead with engineering and quality. Acceptance deliverable: Approved configuration and affected document list.

2 Resolve technical causes

Assess firmware change; investigate XL result and alarm interruption; analyze battery task failures and reuse mismatch. Document hypotheses and evidence, not a premature pass.

Owner: Software, systems and human factors leads. Acceptance deliverable: Root cause and change assessments with risk updates.

3 Approve evidence plans

Select tests, boundary configurations and HF retest scope from the actual changes. Define acceptance before execution and identify dependencies.

Owner: Verification lead with quality. Acceptance deliverable: Controlled protocols and rationale.

4 Execute and adjudicate

Run on final baseline, retain failures and deviations, link raw records and evaluate results against acceptance. A summary marked pass is insufficient.

Owner: Test owners and independent reviewer. Acceptance deliverable: Executed reports with deviation disposition.

5 Reconcile labeling and assembly

Update claims, charging and cleaning instructions, risk links and revision index. Reconcile m01 to m03 and all linked sections.

Owner: Regulatory and document control. Acceptance deliverable: Consistent controlled package.

6 Make the readiness decision

Evaluate every closure rule and remaining limitation. Obtain actual device specific classification, predicate and standards determinations outside this fictional demonstration.

Owner: Accountable submission owner. Acceptance deliverable: Evidence backed release decision; no automatic readiness upgrade.

Questions for the sponsor review meeting

Closure adjudication

An action plan is not closure. Each finding needs a controlled response, updated evidence and an independent check of the stated closure criterion.

A new firmware number is not evidence of corrected behavior. Record build identity and the impact on every reused test and usability result.

A narrowed claim is a design and labeling decision with consequences. Update the device profile, risk analysis, comparison, validation scope and all affected instructions together.

A pass summary cannot override an out of limit observation or assisted completion. Retain the original result, investigate it and identify the superseding evidence.

Closing one issue does not close a linked issue automatically. Firmware regression does not establish cleaning support; correcting the timer statistic does not establish operating range accuracy.

The final readiness decision must cite the accepted closure records and unresolved limitations. A finding count alone cannot express the remaining evidence risk.

8 Source register public context and limitations

The source book presents each record with stable numbered sections. A section citation is reproducible within this sample and distinguishes the observation from the reviewer judgment. Full laboratory reports, actual signatures and device history records do not exist for this fictional product. The invented records must not be substituted for genuine evidence in a client submission.

Public FDA context

Official FDA pages were reviewed on October 14 2026 for the limited scope described below. A landing page review is not a full guidance clause analysis. Recommendations in this sample are based primarily on the device specifications and acceptance criteria in the authored package. Current device specific obligations require review of the full applicable sources for a real device.

R1 eSTAR Program

Open the official FDA source

FDA describes eSTAR as an interactive structured submission form and provides current template, attachment and submission information. The page notes incorporation of May 2026 human factors content effective August 1, 2026.

Public program-page context only. No template was executed, no fictional application was transmitted, and no technical-screening acceptance or real-device eligibility is established.

R2 Content of Premarket Submissions for Device Software Functions

Open the official FDA source

The June 2023 final-guidance landing page identifies recommendations for documentation supporting review of device software functions.

Scope and status checked on the FDA page; no claim of a complete guidance audit, assigned documentation level, IEC conformity or validated PTC-200 release follows.

R3 Recommended Content and Format of Non Clinical Bench Performance Testing Information in Premarket Submissions

Open the official FDA source

The December 2019 final-guidance page concerns bench test summaries, protocols and complete reports. Its scope expressly excludes software verification and validation, human factors, biocompatibility, reprocessing and sterilization validation.

Used to separate evidence domains, not as universal authority for every finding or as proof that any particular fictional protocol is sufficient.

R4 Content of Human Factors Information in Medical Device Marketing Submissions

Open the official FDA source

The May 2026 final-guidance page presents a risk-based framework for human factors information in marketing submissions and describes it as a companion to the human factors engineering guidance.

Public scope context only; no device-specific submission category or acceptance of the invented participant study is assigned from this landing page.

R5 Reprocessing Medical Devices in Health Care Settings Validation Methods and Labeling

Open the official FDA source

The FDA page identifies recommendations for formulation and scientific validation of reusable-device reprocessing instructions and associated submission labeling content.

Does not select a chemical, require sterilization for this nonsterile controller, establish a disinfection endpoint, or validate the fictional process.

R6 Use of International Standard ISO 10993 1 Biological evaluation of medical devices Part 1 Evaluation and testing within a risk management process

Open the official FDA source

The September 2023 FDA guidance page describes risk-based biological evaluation for body-contacting devices, including consideration of whether testing is needed and intact-skin materials.

No licensed standard text, recognized edition or actual laboratory report was audited. This context does not create extra testing needs beyond the authored contact and material rationale.

R7 The 510 k Program Evaluating Substantial Equivalence in Premarket Notifications 510 k

Open the official FDA source

The July 2014 final-guidance page identifies a framework for the critical decision points in FDA's substantial-equivalence review.

No real predicate record, clearance, classification or regulatory determination for either fictional device was verified. No substantial-equivalence conclusion is claimed.

R8 Cybersecurity in Medical Devices Quality Management System Considerations and Content of Premarket Submissions

Open the official FDA source

The February 2026 final-guidance page addresses cybersecurity-risk design, labeling and submission documentation, including statutory cyber-device considerations; it supersedes June 2025 guidance.

Landing-page scope and status, not a complete technical security assessment or binding legal application to this invented device.

R9 Cybersecurity in Medical Devices Frequently Asked Questions FAQs

Open the official FDA source

Question 2 describes the statutory cyber-device definition using software, ability to connect to the internet and relevant vulnerable technological characteristics. This supports documenting actual interfaces rather than treating every software device as internet-connected.

The FAQ is a public explanation; this review makes no binding statutory exemption or compliance determination and does not independently verify the real service architecture.