Manufacturers, pharmaceutical companies, regulators, standards bodies, certification houses, and hospitals have applied STPA to devices (insulin pumps, defibrillators, radiotherapy systems, surgical robots, diagnostics) and to the safety processes around them.
The Evidence
Where STPA stands with manufacturers, regulators, standards bodies, and hospitals, in six points.
Medtronic, the FDA, Roche, UL, and others, with their published STPA work.
Radixact, Varian, and other named products, and a decade of STPA in radiation oncology.
From a cochlear implant and an analgesia pump to AI/ML-enabled devices.
The Wider Field
Commercial tools for STPA, SAE’s STPA recommended practice, and the medical-device supplement in development.
Device makers, regulators, and hospitals that report using STPA.
Device companies that have taken part in the MIT STAMP Workshop.
Part 1 of 7
Part 2 of 7
Organizations with public STPA work on record.
Medtronic applied STPA in the development of its artificial pancreas, the closed-loop system that automates insulin delivery, and presented the work at the first MIT STAMP Workshop in 2012. Separately, the company set out how to drive STPA adoption across an engineering organization, treating it as a change-management problem: leadership buy-in and early adopters.
A well-documented published example of STPA driving a device toward certification. Working with the Federal University of São Paulo on a low-cost insulin infusion pump, the company’s director is a named co-author on peer-reviewed STPA work that feeds into ISO 14971 risk management. It produced both architectural safeguards and user-procedure requirements for a device headed to market, and the work spans a decade and multiple publications.
Applied STPA to a pharmacovigilance safety-signal management process. The analysis built a hierarchical control structure and defined losses to include patient harm and regulatory non-compliance. Roche has also taken an active part in the STAMP community, including the European STAMP Workshop.
FDA staff extended STPA to catch use-related hazards buried in medical-device user-interface software. The peer-reviewed method added a fuller set of causal-factor categories, found more UI hazards than standard STPA on a radiotherapy system, and yielded safety requirements precise enough to verify formally. The FDA has also commissioned STPA work on in-vitro diagnostics and laboratory data exchange, and reports using the method.
Applied STPA to risk management for interoperable medical systems (2015) with Kansas State University and the FDA. UL and kVA by UL both report using the method.
Builds and operates its own proton therapy system, and evaluated STPA on its Gantry 2 system in 2012. A separate MIT doctoral study of its PROSCAN facility concluded that STPA would be acceptable under both US and European marketing regulations for external-beam radiotherapy devices.
With the Linux Foundation, applied STPA to the open-source OpenAPS artificial pancreas system (2021), a counterpart to Medtronic’s earlier work. The control structure, unsafe control actions, and loss scenarios were produced and published in the open, available for anyone to review and reuse. The team also mapped which Linux kernel subsystems OpenAPS relies on, extending the analysis down to the open-source software stack the device runs on.
With MIT, produced an FDA-commissioned STPA of the U.S. diagnostic laboratory data ecosystem (2023), a socio-technical system spanning technology, operations, and regulation. On the technology side, the analysis showed how gaps in laboratory data standards and in the interfaces between laboratory systems, EHRs, and the devices feeding them let unsafe or misread results reach clinicians. A 2024 report analyzed over-the-counter and point-of-care IVD devices and the data they generate. That analysis found device-to-EHR connectivity effectively unregulated, with proprietary interfaces that do not interoperate and device software updates that change a result’s format so it silently stops reaching the patient record. The report also showed how thin feedback from the field leaves manufacturers and the FDA slow to detect an underperforming device, and its eight recommendations reach device certification, connectivity requirements, and post-market data.
A detailed public worked example of STPA on a device: a next-generation automated external defibrillator, presented in 2024. It walks through hazard selection, control-structure design, unsafe control actions, and causal scenarios, addressing factors like rescuer stress, language barriers, and coordination among multiple bystanders. References SAE’s J3187-5, the in-development medical-device-specific supplement to its STPA Recommended Practice.
Part 3 of 7
Manufacturers’ own commercial products have been through published STPA analysis by the clinical and academic teams that operate them.
A hospital radiation-oncology team ran a complete published STPA of the Radixact treatment-delivery system across the full patient journey. Its Synchrony feature tracks a moving tumor and adapts the beam to follow it.
Accuray’s treatment delivery manual already lists Synchrony’s tracking settings as a residual risk. STPA showed the clinic how that risk could arise in its own workflow. One control action is the radiation therapist providing the patient’s tracking settings when the plan is loaded. STPA’s scenario step asks how that could go wrong, and it found ways that need no component failure.
The analysis ties incorrect settings to a hazard for the dose the tumor receives. Short of that, they mean poor tracking, or a treatment held up by repeated beam holds and rebuilt motion models.
Carried through to actionable mitigations, where earlier radiotherapy analyses stopped at the risk list. The authors estimate an experienced team could do a comparable analysis in 200–250 hours.
The Halcyon, Ethos, and TrueBeam systems have all been analyzed with STPA across at least three published papers, including one built around a single-vendor environment.
STPA has been applied to the RAVEN II open telerobotic surgery platform, with hazard scenarios driven by real robotic-surgery incidents from the FDA MAUDE database.
Microprocessor-controlled prosthetic knees, Össur’s core product line, compared head-to-head under ISO 31000, ISO 14971, and STAMP/STPA (European STAMP Workshop, 2017).
Radiation oncology has its own sustained body of STPA work on named commercial systems. A representative sequence:
Part 4 of 7
Part 5 of 7
STPA embedded as a module inside an established commercial risk-management application.
ZHAW 2017Commercial safety-analysis tooling applied together with STPA.
AnsysPublished STPA Recommended Practice that names medical devices among its applicable domains.
SAEA medical-device-specific STPA supplement, currently in development.
SAEPart 6 of 7
Beyond published analyses, a range of medical-sector organizations have reported that they actively use STAMP/STPA. Source ↗
Part 7 of 7
A broad cross-section of the medical device industry has engaged with the STPA community through the MIT STAMP Workshop. These organizations have taken part without necessarily publishing their work; the breadth indicates where interest sits across the sector. Source ↗
STPA is established practice in medical devices. Manufacturers have applied it to insulin pumps, defibrillators, radiotherapy systems, and surgical robots. Regulators and certification bodies use it in their own work, hospitals run it on the systems they operate, and SAE has written it into published recommended practice. For a team adopting it, STPA feeds directly into ISO 14971 risk management and IEC 62304 software work, satisfying many of their requirements.
