Heart-Pump Controller HMI Approval: Preserve Alarm Recovery and Backup Handoff

Approve a heart-pump controller HMI sample only when it preserves the full alarm-recovery and backup-handoff workflow, not merely when the artwork, key continuity and display window look correct. The FDA's August 26 early alert says purge-cassette recognition failures can produce two named alarms; users are instructed first to reinsert the purge disc and, if the alarm remains, change to a backup controller. That makes the sourcing decision specific: freeze the visible alarm identity, permitted operator action, acknowledgement path, display visibility, physical-key availability, cleaning exposure, connector revision and mounted handoff test in one controlled sample record. The front panel supports that workflow; it does not create or validate the controller's clinical safety logic.

Why the August 26 alert changes the HMI approval question

The FDA describes the controller as the primary user control interface for the catheter. It controls performance, monitors alarms and provides position information. The alert itself concerns purge-cassette recognition within the purge pressure sensor assembly, not a membrane switch or graphic overlay. That distinction must remain explicit.

The sourcing consequence comes from the recovery sequence. The source identifies one alarm during setup and another during active support. In both cases, the stated first action is to reinsert the purge disc. If the alarm does not clear, the stated next action is to switch to a backup controller. A panel that merely looks like the approved artwork does not prove that the operator can recognize which state is active, find the allowed control, see whether the action was acknowledged or transfer to the backup unit without confusion.

For a replacement, second-source or revised front interface, the buyer should therefore approve a controlled state-and-action map. The map should connect what the controller detects to what the display shows, what the operator is permitted to do, what physical key remains available, what feedback confirms the action and what condition starts the backup handoff.

Separate alarm recognition from operator controls

Do not combine the sensing event, software decision and panel behavior into one vague line such as `alarm works`. They belong to different owners and need different evidence.

The purge flag and purge pressure sensor assembly recognize the hardware condition. Controller electronics and software determine the alarm state and clinical workflow. The display presents the named alarm and instructions. A membrane HMI may provide fixed keys, indicator windows, printed legends, a flex tail and a connector that help the operator navigate or acknowledge the state. These layers interact, but they are not interchangeable.

This separation prevents two approval errors. First, a continuity report can show that a key closes electrically while saying nothing about whether software accepts that key in the active alarm state. Second, a controller functional test can pass while the physical sample still has a poor display window, ambiguous legend, obstructed key or connector revision that differs from the approved assembly.

Use a requirement identifier for each layer. For example, the controller owner may control alarm identity and permitted action, while the panel drawing controls the key zone, circuit contact, tail exit and connector pin. The mounted test then ties both records together without transferring system responsibility to the component supplier.

Map each alarm into visible recovery states

A useful approval table follows the operator from detection to recovery. It should not contain invented button functions. Populate each action from the device manufacturer's controlled instructions, risk file and software specification.

The table should name who owns every blank. Unknown is an acceptable interim status; assumed is not. If the buyer cannot supply controlled alarm wording or state logic, the panel supplier can still quote known physical construction, but the sample must not be approved as a complete recovery interface.

Test cleaning, restart and backup handoff on the mounted sample

The FDA alert also states that improper cleaning can damage plastic components including the purge flag and points users to mild detergent in the instructions for use. That fact does not establish which overlay, adhesive or cleaning process is suitable for a new front panel. It does show why a buyer should separate external HMI cleaning evidence from internal controller cleaning instructions.

For the external interface, specify the actual agent, concentration, cloth or wipe, dwell time, frequency, temperature, edge exposure and drying method. Then inspect legend readability, window clarity, key response, edge lift, surface change and adhesive landing on the mounted enclosure. Do not claim that a wipe test on a loose overlay validates the internal purge assembly.

Run the mounted sample through three distinct scenarios:

1. **Recognized alarm and accepted first action.** Present the approved alarm state, confirm that the full text is readable, perform only the permitted input and record both the physical key response and controller acknowledgement.

2. **Persistent alarm and backup preparation.** Keep the defined fault state active, confirm that the escalation instruction remains visible and execute the device owner's controlled preparation and transfer steps. The panel report records interface visibility and input evidence, not clinical success.

3. **Restart or rollback after an interface mismatch.** If the new panel revision produces an unexpected input, stop the test, identify the panel, connector and controller revisions, reinstall the known-good interface and confirm the approved recovery state. Quarantine the unverified sample rather than widening its approval range.

A bench continuity check remains useful as incoming inspection. It is not a substitute for these mounted state transitions.

Define the component supplier boundary before quotation

A medical membrane-interface supplier can manufacture the graphic overlay, spacer, circuit, tactile structure, display window, tail and connector to controlled documents. The supplier can provide artwork proofs, dimensional checks, contact or resistance results, material declarations requested by the drawing and traceable samples. Cleaning compatibility can be evaluated only against the conditions and acceptance criteria supplied by the buyer.

The medical device manufacturer and system owner retain responsibility for purge-cassette recognition, alarm priority and wording, allowed actions, controller software, catheter control, backup-unit exchange, clinical workflow, risk management and system validation. The panel supplier does not determine whether therapy should continue, stop or transfer.

Put this boundary into the sample plan and purchase record. It keeps a component report from being read as proof of device safety. It also makes quotation gaps visible: the supplier needs the physical and electrical interface definition, while the system owner must supply the controlled alarm and handoff behavior used in mounted approval.

Drawing and sample package for a controller HMI

Send one controlled package for the intended panel revision. It should contain enough information to quote the physical interface and to plan the mounted checks without exposing patient data or confidential system geometry. Include:

1. front artwork with revision, exact legends, color targets, display-window outline and indicator locations;

2. alarm and state matrix with approved wording, priority, permitted operator action, acknowledgement feedback and the owner of each requirement;

3. physical-key allocation showing which keys are enabled, disabled or reserved in every relevant state;

4. contact or matrix map tied to each key and indicator circuit;

5. front and rear outline, enclosure cutout, adhesive landing, display datum and allowed edge clearance;

6. tail exit, finished length, bend-free zone, routing direction and a rear-view orientation reference;

7. connector maker and part number, pitch, contact count, keying, mating orientation and an unambiguous pin-side view;

8. external cleaning agent, concentration, wipe method, dwell, frequency, temperature and mounted acceptance criteria;

9. sample quantity and the recognized-alarm, persistent-alarm, backup-handoff and rollback scenarios to be run by the system owner;

10. panel, controller and software revision identifiers, sample lot traceability, intended annual quantity and the exact approval range.

The three panel assemblies in the cover are generic product references for display windows, fixed keys, tails and connectors. They are not parts from the controller named in the FDA alert and do not reproduce its alarm logic. Use the medical device HMI design and manufacturing page to organize the physical panel, display window, termination and cleaning requirements. Then send the controlled state map, drawings and mounted sample plan through Request a Quote. The resulting quotation should say what the component supplier will build and measure, and leave system safety decisions with the device owner.