A Preclinical Human–Machine Reliability and Operational Safety Assessment Framework for a Rehabilitation Massage Robot Prototype

Abstract

With the increasing use of massage robots as direct-contact rehabilitation devices, their evaluation must address both equipment failures and use-related risks. This study presents a prototype-stage assessment framework for a seated knee-adjustment bionic massage robot that integrates failure mode, effects, and criticality analysis (FMECA), task analysis, and fuzzy analytic hierarchy process (FAHP) weighting based on a fuzzy complementary judgment matrix. FMECA identified 28 failure modes across the actuation, sensing, and drive-control subsystems. Simulated-use testing involving 15 operators and 15 healthy adults acting as simulated patients comprised 19 observable subtasks and recorded 66 use errors across 285 subtask opportunities. The normalized scores for the actuation, sensing, drive-control, and operational-safety indicators were 0.796, 0.691, 0.808, and 0.768, respectively. Interval-based aggregation yielded Q = 0.848 (“Very Good”), whereas direct weighting of the same normalized inputs yielded ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ = 0.767, within the “Good” interval. Across $\mathsf{\eta }$ ∈ [0, 1], Q ranged from 0.753 to 0.902. A same-panel expert assessment yielded 0.904 and the same grade, although this comparison did not constitute independent validation. Inaccurate pressure-sensor output had the highest risk priority number of 32, while confusion between left- and right-side pressure readings was the most frequent use error, with 11 occurrences. The framework supports prototype-stage risk identification and prioritization but does not establish clinical efficacy, certified safety, or long-term reliability.

1. Introduction

As the global population ages and the burden of chronic musculoskeletal diseases increases, the demand for rehabilitation services continues to grow accordingly [1,2]. According to a systematic analysis published in the 2019 Global Burden of Disease Study, more than 2.41 billion people worldwide could benefit from rehabilitation services to recover from health impairments, with musculoskeletal diseases being one of the primary sources of rehabilitation demand [1]. Furthermore, the growing burden of osteoarthritis is particularly striking [2]. The 2021 Global Burden of Disease Study estimated that the burden of osteoarthritis continued to rise between 1990 and 2020 and is projected to increase significantly by 2050 [2]. Against this backdrop, the question of how to provide accessible and consistent rehabilitation interventions through medical devices and rehabilitation robots has become increasingly important in the fields of rehabilitation medicine, medical device engineering, and human–machine interaction safety.

Massage and tuina therapy are important non-pharmacological interventions in the management of musculoskeletal pain and dysfunction [3,4]. Clinical studies have shown that massage therapy can improve function and symptoms in patients with chronic low back pain [5] and has demonstrated certain efficacy and safety in individuals with knee osteoarthritis [4,6]. However, traditional manual massage relies heavily on the therapist’s experience and clinical judgment and is influenced by their physical condition [7,8]. There can be considerable variation among practitioners in the magnitude of force applied, the direction of force, contact points, and duration of treatment, and these variations may affect the consistency and reproducibility of the therapeutic process [8,9]. For techniques that require simultaneous acupoint localization and directional force application while the patient is standing or sitting—such as the “Seated Knee Adjustment Method”—the dependence on the practitioner is even more pronounced [10]. Converting the key movements, biomechanical parameters, and operational procedures of massage techniques into a robotic system that is controllable, recordable, and evaluable holds clear clinical and engineering significance [7,9].

Massage robots offer a new technological pathway for standardizing tuina techniques [9,11]. In recent years, related research has evolved from simple mechanical actuation mechanisms to complex systems integrating sensor feedback, visual recognition, Internet of Things (IoT) connectivity, and human–machine interaction [7,9,12]. For example, preliminary research on the EMMA electronic massage system indicates that automated massage devices can achieve a certain level of acceptability and feasibility in real-world service scenarios [13]; research on IoT-based medical massage robots also suggests that remote connectivity, system failure handling, and data exchange are becoming integral components of massage robot design [14]. The work of these researchers demonstrates that massage robots are evolving from simple motion-replication devices into human–machine interactive medical robot systems capable of therapeutic interaction, perceptual feedback, and operational decision-making [7,9,11].

This transformation has also significantly heightened the importance of reliability and operational safety assessments [15,16]. Unlike general rehabilitation assistive devices, massage robots require continuous contact with patients’ soft tissues or acupoint areas and apply controlled external forces through their actuators [7,15]. Loose actuator connections, misalignment of the massage head, pressure sensor drift, control system hysteresis, or communication anomalies can all cause the actual therapeutic dose to deviate from the preset range. These deviations may alter the mechanical treatment dose, including force magnitude, force direction, contact location, and treatment duration. Safety research in the field of physical human–robot interaction has also pointed out that when a robot comes into direct contact with the human body, safety depends not only on the mechanical structure itself, but also on factors such as speed, force, mass, control response, and contact detection [15,17,18]. The various potential factors associated with massage robots are further intertwined with therapeutic techniques, changes in patient posture, and operator interface decisions, forming a risk chain that is more complex than that of ordinary electromechanical devices [15,16,19].

Medical device risk management and usability engineering standards also emphasize that safety assessments should not focus solely on component failures but should also cover intended use, use scenarios, reasonably foreseeable misuse, and human-related risks [20,21]. ISO 14971 requires the systematic identification of hazards, risk estimation and evaluation, and the implementation of risk controls throughout the entire life cycle of a medical device [20]. IEC 62366-1 further integrates usability engineering into the medical device safety process, emphasizing the impact of user interfaces, task flows, and use errors on safety [21]. IEC 80601-2-78 specifies particular requirements for the basic safety and essential performance of medical robots that physically interact with patients with impairments [22]. Its scope covers rehabilitation, assessment, compensation, and alleviation related to patients’ movement functions [22]. Although existing standards provide a fundamental principled basis for the preclinical safety assessment of massage robots, they do not directly offer a quantitative evaluation pathway applicable to early-stage prototypes, scenarios with limited failure data, and situations where human–machine interaction is deeply intertwined [16,23].

Existing research on massage robots primarily focuses on mechanical design, control strategies, sensor feedback, or preliminary application feasibility; however, reliability evaluations of the overall system—including the actuation, sensing, and drive-control subsystems, as well as operator task flows—remain relatively insufficient [9,11,16]. Traditional reliability evaluations often rely on long-term operational data or large-sample failure statistics, whereas early-stage medical rehabilitation prototypes typically have not yet accumulated sufficient operational failure data or real-world clinical usage data [11,16].

Furthermore, while expert scoring alone can be used for preliminary assessments, it struggles to adequately capture uncertainty and the relative importance of different indicators; while FMECA alone can identify component failure modes, it tends to overlook user errors in task phases such as operator readings, parameter settings, patient positioning, and treatment start/stop procedures [19,23,24]. The fuzzy analytic hierarchy process (FAHP) can address multi-criteria weighting issues under conditions of uncertainty [24]; FMECA can be used to systematically identify failure modes and their severity [25]; and task analysis is suitable for decomposing human–machine interaction processes and capturing use errors [26]. The contribution of this integration is to place the normalized equipment-risk inputs derived from FMECA and the operational-safety input derived from task analysis within a common FAHP-weighted assessment structure. This enables equipment failures and observed use errors to be considered together at the prototype stage while preserving the subsystem scores and individual risk rankings.

This study integrates FAHP, FMECA, and task analysis to assess the reliability and operational safety of a seated knee-adjustment bionic massage robot prototype. FMECA characterizes subsystem failure risks, whereas task analysis identifies and quantifies use errors. Indicator weights are derived using FAHP based on a fuzzy complementary judgment matrix. The normalized risk inputs are subsequently combined through interval-based grade aggregation to obtain a composite score. The case study examines risk priorities and indicator scores, with a descriptive comparison between the composite score and ratings from the same expert panel.

2. Materials and Methods

2.1. Study Design, Evaluation Boundary, and Study Object

This study focuses on a seated knee-adjustment bionic massage robot prototype, which is a type of direct-contact rehabilitation massage robot. During treatment, this type of device requires continuous contact with the patient’s knee soft tissues or acupoint areas and applies external forces with specific directional and amplitude requirements through its actuation subsystem. Therefore, its safety depends not only on the reliability of the mechanical structure, sensing subsystems, and drive-control subsystem, but is also influenced by the operator’s task execution, the information presented via the human-machine interface, and changes in the patient’s posture.

To avoid overinterpretation of the evaluation results at the prototype stage, this paper first clarifies the scope of the study. The evaluation in this paper primarily covers two aspects: the device itself and the usage process. The device itself comprises the actuation subsystem, sensing subsystems, and a drive-control subsystem, which correspond to functions such as leg fixation, massage head positioning, pressure and rotational motion output, pressure and angle feedback, power supply, motion control, and interface display, respectively; the usage process includes tasks performed by the operator during the treatment workflow, such as determining the patient’s position, sensor attachment, massage head alignment, treatment start/stop, and reading data from the interface.

It should be noted that the evaluation results presented in this paper primarily reflect evidence of human-machine system reliability and operational safety during the prototype stage prior to clinical application. They do not include long-term treatment outcomes in actual patients, disease improvement effects, multicenter clinical safety data, or failure rates throughout the full life cycle of a commercialized product. Subsequent comprehensive evaluation scores should be understood as interim evaluation results based on the current prototype, the current metric system, and the current testing conditions; they should not be equated with clinical efficacy validation or post-market safety verification.

2.2. Task Workflow and Robotic Decomposition of the Seated Knee Adjustment Technique

The seated knee adjustment technique is the target treatment procedure simulated by the prototype in this study. In traditional practice, the physician sits facing the patient, holds the patient’s legs with both hands, and places both thumbs on the inner and outer knee-eye acupoints; the patient slowly stands up and sits back down in response to verbal cues, while the physician simultaneously applies upward and backward pressure with both thumbs as the patient’s posture changes dynamically [10]. The key to this therapeutic technique lies not merely in performing the pressing motions, but in maintaining coordination between knee positioning, changes in the patient’s posture, the directional application of force, and the practitioner’s rhythm [10].

When applying this therapeutic technique to robotic output, from the perspective of robotic implementation, the technique can be broken down into a series of sequential tasks, including patient positioning, leg stabilization, localization of the knee-eye acupoints, attachment of angle sensors, alignment of the massage head, monitoring of the standing or sitting process, synchronized force application, reading of pressure and angle data, and control of treatment start and stop. These tasks encompass both the movements of the device itself and the interaction between the operator and the human-machine interface. If positioning errors, force application deviations, or other issues occur at any stage, they may alter the actual therapeutic dose or increase operational risks.

Therefore, this paper does not view the massage robot merely as a mechanical actuator but defines it as a human-machine system comprising the device itself, the operator, changes in the patient’s posture, and the human-machine interface. This task decomposition provides a procedural basis for subsequent operational safety analysis and task error logging.

To replicate the therapeutic movements of the aforementioned seated knee adjustment method, the robot must meet three categories of functional requirements. The actuator subsystem must secure the patient’s leg, position the massage head in space, and perform multi-degree-of-freedom massage movements; the sensing subsystem must collect real-time data on the massage head’s applied force and the knee joint angle to provide feedback for closed-loop control; and the drive-control subsystem must coordinate the various moving components according to the treatment protocol and provide readable information to the operator via the human-machine interface. These functions collectively define the scope and boundaries of the subsequent reliability evaluation, as shown in Figure 1.

Figure 1. Functional decomposition of the seated knee-adjustment bionic massage robot. The system comprises the actuation, sensing, and drive-control subsystems, together with their principal functional components.

2.3. Massage Robot System Architecture

2.3.1. Mechanical Actuation and Patient-Contact Structure

The actuation subsystem of the seated knee-adjustment bionic massage robot prototype is shown in Figure 2. It primarily consists of a base, leg supports, a lifting mechanism, a massage mechanism, a rotation mechanism, and a massage head. The base maintains the stability of the entire device and reduces the risk of displacement caused by changes in the center of gravity or external disturbances during treatment. The leg support consists of an L-shaped bracket and a slide rail bracket, which secure the patient’s lower leg and adjust the relative position between the knee and the massage head according to the patient’s body type.

Figure 2. Mechanical structure of the seated knee-adjustment bionic massage robot: 1, L-shaped leg support; 2, rotation mechanism; 3, massage head; 4, pressure sensor; 5, massage mechanism; 6, lifting mechanism; 7, base; 8, power interface; and 9, serial display.

The lifting mechanism comprises a lifting actuator and a lifting arm, designed to replicate the vertical translational freedom of a therapist’s arm; a parallelogram linkage mechanism enhances motion stability and maintains a stable position once the massage mechanism reaches the target height. The bionic massage actuator in the massage assembly uses a short-stroke actuator to replicate pressing motions through forward and backward movements; the rotational mechanism uses a motor to drive the bionic massage actuator’s rotation, simulating the freedom of thumb rotation.

Therefore, the reliability of the actuation subsystem is primarily reflected in aspects such as support stability, leg fixation reliability, positioning accuracy of the target knee area, transmission continuity, and the safety of the massage head connection. These are key risk sources that must be identified in the subsequent FMECA analysis.

2.3.2. Force and Knee-Angle Sensing

The sensing subsystem provides mechanical and postural feedback during treatment. Since the pressure applied in the seated knee adjustment method must match the changes in the patient’s knee angle as they stand up and sit down, the system uses an angle sensor to monitor knee posture and combines this with pressure sensors at the massage head to measure the actual applied force, thereby supporting closed-loop feedback control and dynamic force adjustment.

The embedded pressure sensor used for closed-loop force control has a measurement range of 0–100 N. It communicates with the STM32 microprocessor through an intelligent pressure transmitter using the RS485–Modbus protocol. The IM948 10-axis attitude sensor transmits knee-angle measurements wirelessly to the microprocessor via Bluetooth. The reliability of the sensing subsystem is primarily reflected in the accuracy of pressure measurement and the stability of angle measurement. If sensor drift occurs or data reads are abnormal, it may lead to inaccuracies in the closed-loop control inputs, affecting the operator’s assessment of the treatment status.

2.3.3. Power Supply, Motion Control, and User Interface

The drive-control subsystem provides the robot with power supply, motion control, and human–machine interaction capabilities. The power supply module consists of a 220 V AC power source, a power adapter, a 12 V to 5 V voltage regulator circuit, and a 5 V to 3.3 V voltage regulator circuit. The push-rod module comprises an STM32 controller, a TB6600 two-phase stepper-motor driver, and a short-stroke linear actuator with a rated maximum axial thrust of 150 N and a mechanical stroke of 0–50 mm. During the programmed treatment sequence, the controller issued pulse commands to the stepper-motor driver according to a predefined relationship between knee angle and target force. Pressure and knee-angle data were monitored in real-time through the embedded pressure sensor and IM948 angle sensor. The user interface provided a Stop command that was designed to terminate stepper-motor operation, and the main power switch provided an additional means of supervised manual shutdown. The 0–50 mm stroke constrains linear travel but does not impose a defined upper limit on knee-contact force after contact has occurred.

Normal-operation force tracking was characterized using a separate FSR film sensor with a measurement range of 0–150 N and a maximum linearity error of 5% of full scale. The target force curve was derived from 100 clinician-force recordings. During three programmed standing–sitting cycles, the measured knee-contact force ranged from 0 to 62 N. The mean measured force was 33.213 ± 11.259 N compared with 33.378 ± 12.288 N for the target input, and the two force profiles were strongly correlated (r = 0.966, p < 0.01). These results characterize force tracking during the programmed sequence under normal operating conditions.

The pressure sensor formed part of the primary feedback loop, and the interface Stop command acted through the same control chain. The prototype did not incorporate an independently verified hardware force-limiting channel separate from the primary sensor and controller. Pressure- and angle-feedback loss were not deliberately induced during the force test; consequently, signal-loss detection latency, actuator stopping time, and peak contact force under fault conditions were not measured. The normal-operation range of 0–62 N therefore does not demonstrate that contact force remains below the embedded sensor’s 100 N range during a fault. Feedback loss, mechanical jamming and failure of the motor driver to stop were treated as residual fault paths in the FMECA.

From a reliability perspective, failures in the three subsystems—the actuator subsystem, sensing subsystem, and drive-control subsystem—can jointly affect patient safety through treatment dosage and operator decision-making. When the mechanical output of the actuation subsystem is inaccurate, insufficient pressure may reduce treatment effectiveness, while excessive pressure may increase the risk of compression to sensitive structures such as the joint capsule, synovial membrane, or popliteal nerve. Drift in sensor output can compromise the accuracy of closed-loop force control feedback, causing the force application rhythm and amplitude to deviate from the preset range. Hysteresis, false triggering, or communication anomalies in the control system may disrupt the temporal coordination between the robot’s movements and changes in the patient’s posture, increasing the risk of treatment interruptions and use errors.

Based on the functions of the aforementioned modules and their collaborative operation, this study further established a schematic diagram of the robot’s operating principles, as shown in Figure 3, which serves as the basis for subsequent reliability analysis.

Figure 3. Working principle and signal flow of the seated knee-adjustment bionic massage robot. Pressure and knee-angle signals are transmitted to the main controller, which coordinates the lifting, massage-head translation, and rotational actuation pathways. Colors distinguish the actuation, sensing, and drive-control subsystems.

2.3.4. Prototype Construction and Assembly

The physical prototype integrated a parallelogram lifting mechanism, two motor-driven massage assemblies and adjustable lower-leg supports. Each massage assembly comprised a short-stroke actuator, sensor support, force sensor, massage-head bracket, and massage head. The assemblies were mounted on the platform supported by the lifting arm and connected to the rotation motors through push-rod clamps. Threaded connections secured the massage heads to their brackets.

The massage-head bodies and push-rod clamps were specified in AISI 304 stainless steel. Each massage head incorporated a soft silicone tip that formed the contact surface with the participant’s knee. The paired assemblies reproduced the two-thumb contact arrangement of the seated knee-adjustment technique.

Each L-shaped leg support could slide manually along its guide and was secured at the selected position using a hand screw. The guides were connected to the base by pins, with rubber spacers between the guides and base. Hook-and-loop straps held the lower legs within the curved support grooves. Figure 4 shows the assembled prototype and its position relative to the seated participant and operator during simulated operation.

Figure 4. Physical prototype of the seated knee-adjustment bionic massage robot during simulated operation. The photograph shows the assembled robot positioned in front of a seated participant, with the operator alongside the device.

2.4. Reliability Assessment Framework and Indicator System

Early massage robot prototypes typically lack long-term operational records and large-scale failure statistics, making it difficult to directly apply reliability assessments based entirely on probability statistics [11,16]. To support assessment under limited data availability, the framework integrates expert judgments, equipment failure risks, and use-error information within a common indicator hierarchy. Hierarchical decomposition structures the assessment and supports comparisons of indicator importance [27,28]. Within this framework, FAHP is used specifically to determine indicator weights from expert pairwise judgments.

Indicator weighting uses a fuzzy complementary preference relation to represent graded judgments of relative importance [29]. Each entry ${\mathrm{c}}_{\mathrm{i}\mathrm{j}}$ expresses the degree of preference for indicator i over indicator $j$ on a 0.1–0.9 scale. The relation satisfies ${\mathrm{c}}_{\mathrm{i}\mathrm{j}}+{\mathrm{c}}_{\mathrm{j}\mathrm{i}}=1$ and ${\mathrm{c}}_{\mathrm{i}\mathrm{i}}=0.5$, with 0.5 denoting equal importance. The fuzzy component lies in this degree-valued representation of pairwise preferences.

This formulation follows an FAHP approach based on a fuzzy complementary judgment matrix [30,31]. Expert judgments are aggregated into the group matrix C, from which indicator weights are calculated directly using Equation (9) [31].

The normalized risk inputs are subsequently combined through interval-based grade aggregation. Each normalized input is assigned to one of five predefined evaluation grades and represented by a corresponding binary indicator vector. The resulting grade matrix is then combined with the FAHP-derived weights and grade-score vector to obtain the composite score.

The evaluation object in this study is not merely the robotic mechanical body itself, but rather the human-machine system formed during the prototype stage of the “Seated Knee-Adjustment Method” bionic massage robot prototype prior to clinical application. This system includes the device itself, the operator, changes in the patient’s posture, and the human-machine interface. Since the massage robot requires continuous contact with the patient’s knee soft tissues or acupoint areas and applies controlled external forces via its actuation subsystem, its safety depends not only on the reliability of the mechanical, sensing, and drive-control subsystems, but also on the operator’s ability to correctly perform tasks such as patient immobilization, sensor attachment, massage head positioning, treatment start/stop, and interface readings. Therefore, this study incorporates both equipment failure risks and user error risks into the same evaluation model.

The evaluation results reflect only the reliability and operational safety of the human-machine system based on the current prototype, the current set of metrics, and the current test conditions; they are not equivalent to clinical efficacy validation, long-term durability validation, post-market safety evaluation, or large-scale patient risk assessment.

Construction of the Evaluation Indicator System

Based on the robot’s structural composition, treatment process, and human–machine interaction characteristics, this study established the following set of evaluation indicators:

$$A=\left\{A_1,A_2,A_3,A_4\right\}$$

This set includes four first-level indicators: A1 represents the actuation subsystem, A2 represents the sensing subsystem, A3 represents the drive-control subsystem, and A4 represents operational safety. The first three correspond to the main engineering subsystems of the device itself and reflect functional risks associated with leg support and stabilization, massage head positioning and force application, pressure and angle feedback, and motion drive and interface control, respectively. Operational safety addresses human factors and task-process risks during use, reflecting potential user errors in steps such as patient immobilization, sensor installation, massage head alignment, treatment start/stop, and data retrieval.

The focus of this study is on the reliability of the human-robot system, not merely the reliability of the device itself; therefore, operational safety is treated as an evaluation indicator on par with the device’s subsystems. In massage robots, both equipment failures and user errors can affect patient contact safety through abnormal force application and deviations in treatment dosage. At the evaluation level, operational safety, together with the actuation subsystem, sensing subsystems, and drive-control subsystems, constitutes a first-level dimension of system reliability.

To ensure that the indicators correspond to the system structure, the relationship between the first-level indicators and the evaluation objects is as follows: the actuation subsystem primarily covers mechanical components such as the base, leg supports, lifting mechanism, massage mechanism, rotating mechanism, and massage heads; sensing subsystems primarily cover pressure sensors, angle sensors, and their communication links; the drive-control subsystem primarily covers power supply, drivers, motors, controllers, serial port display interfaces, and control safety functions such as emergency stop or start/stop; operational safety primarily covers the key tasks performed by the operator in accordance with the seated knee adjustment procedure. Software control, human-machine interfaces, and emergency stop or start/stop mechanisms are evaluated within the drive-control subsystem and operational safety dimensions, respectively.

2.5. FAHP Weight Determination Based on a Fuzzy Complementary Judgment Matrix

Indicator weights, representing the relative importance assigned to the evaluation indicators, were calculated using FAHP based on a fuzzy complementary judgment matrix. Experts conducted pairwise comparisons of indicators at the same level based on system functional importance, potential failure consequences, patient exposure risk, and usage process risk. This study invited 10 experts to participate in the weighting assessment, including 5 clinicians and 5 medical device design researchers. The same experts also provided the five-grade indicator ratings reported in Section 3.4. The assessment results were expressed using a 0.1–0.9 scale to indicate relative importance, and a fuzzy complementary judgment matrix was constructed [31]. The meanings of the scale are shown in Table 1.

Table 1. Interpretation of the 0.1–0.9 fuzzy complementary comparison scale.

Scale Value ${\mathbf{c}}_{\mathbf{i}\mathbf{j}}$	Interpretation
0.1	Indicator i is extremely less important than indicator j.
0.2	Indicator i is much less important than indicator j.
0.3	Indicator i is clearly less important than indicator j.
0.4	Indicator i is slightly less important than indicator j.
0.5	Indicators i and j are equally important.
0.6	Indicator i is slightly more important than indicator j.
0.7	Indicator i is clearly more important than indicator j.
0.8	Indicator i is much more important than indicator j.
0.9	Indicator i is extremely more important than indicator j.

The panel was purposively assembled to provide complementary clinical and engineering perspectives relevant to the prototype. The clinicians were familiar with the seated knee-adjustment procedure and its patient-contact risks, whereas the medical-device design researchers were familiar with the robot’s mechanical, sensing and control architecture. Before scoring, all experts received written definitions of the four first-level indicators, instructions for completing the pairwise comparisons and the 0.1–0.9 scale shown in Table 1. Each expert then independently completed the six unique pairwise comparisons among the four indicators.

Suppose there are n indicators at the same level; the results of pairwise comparisons form the following fuzzy complementary judgment matrix [31]:

$$\mathrm{C}={\left({\mathrm{c}}_{\mathrm{i}\mathrm{j}}\right)}_{\mathrm{n}\times \mathrm{n}}=\left[\begin{array}{cccc}{\mathrm{c}}_{11}& {\mathrm{c}}_{12}& \dots & {\mathrm{c}}_{1\mathrm{n}}\\ {\mathrm{c}}_{21}& {\mathrm{c}}_{22}& \dots & {\mathrm{c}}_{2\mathrm{n}}\\ ⋮& ⋮& & ⋮\\ {\mathrm{c}}_{\mathrm{n}1}& {\mathrm{c}}_{\mathrm{n}2}& \dots & {\mathrm{c}}_{\mathrm{n}\mathrm{n}}\end{array}\right],$$

(1)

where ${\mathrm{c}}_{\mathrm{i}\mathrm{j}}$ represents the importance of the i th indicator relative to the j th indicator. Furthermore, the fuzzy complementary judgment matrix needs to satisfy:

$${\mathrm{c}}_{\mathrm{i}\mathrm{j}}+{\mathrm{c}}_{\mathrm{j}\mathrm{i}}=1,\hspace{1em}{\mathrm{c}}_{\mathrm{i}\mathrm{i}}=0.5$$

(2)

Each expert provided pairwise judgments on a 0.1–0.9 fuzzy complementary scale. For expert k, the entries satisfied $c_{ij}^{\left(k\right)}+c_{ji}^{\left(k\right)}=1$, with diagonal entries fixed at 0.5. The ten experts were weighted equally, and their judgments were aggregated by arithmetic averaging:

$${\mathrm{c}}_{\mathrm{i}\mathrm{j}}={\displaystyle \frac{1}{\mathrm{m}}}{\displaystyle \sum _{\mathrm{k}=1}^{\mathrm{m}}}{\mathrm{c}}_{\mathrm{i}\mathrm{j}}^{\left(\mathrm{k}\right)},\hspace{1em}\mathrm{m}=10.$$

(3)

The resulting group matrix retained the additive reciprocal structure of the individual judgments:

$${\mathrm{c}}_{\mathrm{i}\mathrm{j}}+{\mathrm{c}}_{\mathrm{j}\mathrm{i}}={\displaystyle \frac{1}{\mathrm{m}}}{\displaystyle \sum _{\mathrm{k}=1}^{\mathrm{m}}}\left({\mathrm{c}}_{\mathrm{i}\mathrm{j}}^{\left(\mathrm{k}\right)}+{\mathrm{c}}_{\mathrm{j}\mathrm{i}}^{\left(\mathrm{k}\right)}\right)=1.$$

(4)

Arithmetic averaging therefore preserves additive reciprocity under equal expert weighting [29]. This property differs from multiplicative reciprocity in conventional ratio-scale AHP, for which geometric averaging preserves the reciprocal structure. Applying geometric averaging separately to the forward and reverse entries of an additive reciprocal matrix does not generally preserve their unit sum.

First, sum the elements in each row of the fuzzy complementary judgment matrix, as shown in Equation (5).

$${\mathrm{r}}_{\mathrm{i}}={\displaystyle \sum _{\mathrm{k}=1}^{\mathrm{n}}}{\mathrm{c}}_{\mathrm{i}\mathrm{k}},\hspace{1em}\mathrm{i}=1, 2,\dots ,\mathrm{n},$$

(5)

where ${\mathrm{r}}_{\mathrm{i}}$ is the sum of the elements in the i th row of the matrix, ${\mathrm{c}}_{\mathrm{i}\mathrm{k}}$ is the element in the i th row and k th column of the judgment matrix, and n is the number of indicators.

Next, the original fuzzy complementary judgment matrix is converted to a fuzzy consistency matrix using Equation (6) [31]:

$${\mathrm{f}}_{\mathrm{i}\mathrm{j}}={\displaystyle \frac{{\mathrm{r}}_{\mathrm{i}}-{\mathrm{r}}_{\mathrm{j}}}{2(\mathrm{n}-1)}}+0.5,$$

(6)

where ${\mathrm{f}}_{\mathrm{i}\mathrm{j}}$ is the element in the $\mathrm{i}$ th row and $\mathrm{j}$ th column of the fuzzy consistency matrix F. The fuzzy complementary judgment matrix is based on a scale of 0.1 to 0.9, which differs from the 1 to 9 ratio judgment matrix used in traditional AHP; therefore, this study does not use the traditional AHP consistency ratio (CR) [28,31]. The matrix deviation index $\Delta$ was defined as the mean absolute difference between corresponding upper-triangular entries of C and F:

$$\Delta ={\displaystyle \frac{2}{\mathrm{n}(\mathrm{n}-1)}}\sum _{\mathrm{i}<\mathrm{j}}\left|{\mathrm{c}}_{\mathrm{i}\mathrm{j}}-{\mathrm{f}}_{\mathrm{i}\mathrm{j}}\right|$$

(7)

This index quantifies the change introduced by the matrix transformation. It does not measure sensitivity to perturbations or agreement among experts. Expert judgments were neither excluded nor adjusted on the basis of ∆.

For future applications retaining the same four indicators and elicitation scale, we propose a review trigger of Δ_review = 0.10 This value corresponds numerically to one increment on the original rating scale. A matrix-level mean deviation reaching or exceeding this value would prompt reassessment of the pairwise judgments through the procedure described below.

The review trigger applies to the mean deviation across the six unique upper-triangular comparisons between C and the reference matrix F constructed using Equation (6). Because an average can conceal larger deviations in individual comparisons, the corresponding absolute differences are also examined:

$$d_{ij}=\left|c_{ij}-f_{ij}\right|,\hspace{1em}i<j.$$

(8)

Here, $d_{ij}$ denotes the absolute difference between the corresponding entries of C and F. These differences identify where deviations are concentrated; a matrix-level mean below 0.10 does not establish that every individual deviation is below 0.10.

If $\Delta \ge {\Delta }_{\mathrm{r}\mathrm{e}\mathrm{v}\mathrm{i}\mathrm{e}\mathrm{w}}$, all six comparisons would be re-elicited independently from each member of the original expert panel. The indicator definitions, comparison instructions and supporting information originally provided would first be reconfirmed, and the same rating protocol would be used. Experts would receive neither target scores nor reference-matrix values and would not be instructed to make their judgments converge. The matrices C and F, the deviation index and the indicator weights would then be recalculated. If ∆ remained at or above the trigger, the unresolved deviation would be reported alongside sensitivity analyses of the resulting weights and assessment outputs.

Finally, the weights of each indicator are calculated according to Equation (9) [31]:

$${\mathsf{\omega }}_{\mathrm{i}}={\displaystyle \frac{{\displaystyle {\sum }_{\mathrm{j}=1}^{\mathrm{n}}}{\mathrm{c}}_{\mathrm{i}\mathrm{j}} + \mathrm{n}/2 -1}{\mathrm{n}(\mathrm{n}-1)}},\hspace{1em}\mathrm{i}=1, 2,\dots ,\mathrm{n},$$

(9)

where ${\mathsf{\omega }}_{\mathrm{i}}$ is the weight of the $\mathrm{i}$ th indicator and ${\displaystyle {\sum }_{\mathrm{i}=1}^{\mathrm{n}}}{\mathsf{\omega }}_{\mathrm{i}}=$1.

Indicator weights were calculated directly from C using Equation (9). The transformed matrix F served as a reference for calculating the matrix deviation index $\Delta$. Sensitivity to changes in the group judgments was assessed separately by deterministic perturbation analysis.

The resulting first-level weight vector was used in the interval-based grade aggregation described in Section 2.8.

Inter-expert concordance was assessed using Kendall’s coefficient of concordance W. An individual priority vector was calculated for each expert from the pairwise judgments using Equation (9). Kendall’s W was then calculated from the resulting rankings of the four first-level indicators. Average ranks were assigned to tied weights. Statistical significance was evaluated using the chi-square approximation for Kendall’s W.

The influence of individual experts on the group weights was examined using leave-one-expert-out analysis. Each expert was omitted in turn, after which the group judgment matrix and weight vector were recalculated using the original aggregation and weighting procedures.

2.6. FMECA and Equipment-Risk Normalization

2.6.1. Quantification and Normalization of Equipment Risks

The reliability evaluation of massage robots must reflect both the risk of equipment failure and the risk associated with operator use. For the equipment itself, this study employed FMECA to identify critical failure modes in the actuation subsystem, sensing subsystems, and drive-control subsystems, and quantified the relative risk of each failure mode using the Risk Priority Number (RPN) [25,32]. Each subsystem is analyzed in terms of component function, potential failure modes, failure causes, failure effects, severity, probability of occurrence, detectability, and Risk Priority Number [25,32].

The Risk Priority Number (RPN) is calculated using the following formula [25,33]:

$$\mathrm{R}\mathrm{P}{\mathrm{N}}_{\mathrm{i}}={\mathrm{S}}_{\mathrm{i}}\times {\mathrm{O}}_{\mathrm{i}}\times {\mathrm{D}}_{\mathrm{i}},$$

(10)

where ${\mathrm{S}}_{\mathrm{i}}$ is the severity rating of the i th failure mode, ${\mathrm{O}}_{\mathrm{i}}$ is its occurrence rating, and ${\mathrm{D}}_{\mathrm{i}}$ is its detectability rating. This study employed a 4-level severity scale, a 5-level probability of occurrence scale, and a 4-level detectability scale; therefore, the theoretical maximum RPN for a single failure mode is:

$$\mathrm{R}\mathrm{P}{\mathrm{N}}_{\mathrm{m}\mathrm{a}\mathrm{x}}=4\times 5\times 4=80$$

(11)

Here, the maximum value is determined by the scoring scales preset in this study, rather than the value of 1000 used in traditional 10-point FMEA [23,33]. The severity is defined based on the patient contact risk associated with direct-contact massage robots, taking into account consequences such as component failure, abnormal force application, positioning deviations, and operator misjudgment. For example, inaccurate pressure sensor output, detachment of the massage head, abnormal motor output, actuator jamming, or incorrect angle feedback may all compromise patient safety through deviations in the therapeutic dose.

Because severity, occurrence, and detectability were represented by ordinal rating scales, the resulting RPN was treated as a relative risk-priority index rather than as a continuous measure of absolute risk. Numerical differences between RPN values should not be interpreted as proportional differences in clinical risk. In addition, identical RPN values may arise from different combinations of severity, occurrence, and detectability; therefore, each RPN was interpreted together with its component ratings and stated failure effect.

To incorporate risks from different sources into a single evaluation framework and maintain consistency in the evaluation approach, this paper converted the RPN values of multiple failure modes within a subsystem into positive reliability scores. Using only the average RPN may lead to an underestimation of the impact of a single high-risk failure mode on the safety of direct-contact devices; therefore, this paper considered both the average risk of the subsystem and its highest-risk item. Let subsystem Aj contain ${\mathrm{m}}_{\mathrm{j}}$ failure modes, with the set of failure modes denoted as ${\mathrm{I}}_{\mathrm{j}}$. Then, the average normalized risk of this subsystem is:

$${\overline{\mathrm{r}}}_{\mathrm{j}}={\displaystyle \frac{1}{{\mathrm{m}}_{\mathrm{j}}}}\sum _{\mathrm{i}\in {\mathrm{I}}_{\mathrm{j}}}{\displaystyle \frac{\mathrm{R}\mathrm{P}{\mathrm{N}}_{\mathrm{i}}}{80}}$$

(12)

The maximum normalized risk of this subsystem is:

$${\mathrm{r}}_{\mathrm{j},\mathrm{m}\mathrm{a}\mathrm{x}}=\underset{\mathrm{i}\in \mathrm{j}}{\max }\left({\displaystyle \frac{\mathrm{R}\mathrm{P}{\mathrm{N}}_{\mathrm{i}}}{80}}\right)$$

(13)

The reliability score of the subsystem is defined as:

$$x_j=1-\left[\eta r_j+\left(1-\eta \right)r_{j,\mathrm{m}\mathrm{a}\mathrm{x}}\right],\hspace{1em}j=1, 2, 3,$$

(14)

where $x_j$∈ [0, 1] is the normalized risk-derived input for subsystem $j$, $r_j$ is its normalized mean risk, and $r_{j,\mathrm{m}\mathrm{a}\mathrm{x}}$ is its maximum normalized risk. A larger value of $x_j$ indicates a lower estimated failure risk under the proposed scoring framework. The parameter $\eta$ ∈ [0, 1] controls the relative contributions of the mean-risk and maximum-risk terms. In this study, $\eta$ = 0.5 was used so that the overall risk level of the subsystem and its highest-risk failure mode contributed equally to the calculation. The individual RPN values were retained separately for failure-mode ranking and the identification of components requiring priority improvement.

Sensitivity to $\eta$ was evaluated over its full admissible range from 0 to 1 in increments of 0.1. At each value of $\eta$, the equipment-risk inputs $x_1$, $x_2$ and $x_3$ were recalculated from the unrounded mean and maximum normalized risks using Equation (14). The operational-safety input $x_4$ and the FAHP weight vector W were held constant. The grade-derived score Q and continuous comparator ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ were then recalculated. Because Q is obtained after interval assignment, it may change discontinuously when an input crosses a grade boundary, whereas ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ varies continuously with $\eta$.

2.6.2. FMECA Analysis Objects and Evaluation Criteria

FMECA consists of Failure Mode and Effects Analysis (FMEA) and Criticality Analysis (CA) [25,32]. FMEA is used to identify potential failure modes in a system and their impact on functionality, therapeutic efficacy, and patient safety, and to pinpoint vulnerabilities for subsequent improvements [25,32]. CA further assesses the level of risk based on dimensions such as failure severity, probability of occurrence, and detectability [25,33]. This study employed RPN as the criticality analysis metric to compare failure priorities across different subsystems.

Based on the system architecture, the massage robot is divided into three engineering subsystems: the actuation subsystem, sensing subsystem, and drive-control subsystem. The actuation subsystem includes components such as the base, leg supports, height-adjustment mechanism, massage mechanism, rotation mechanism, and massage heads, and primarily affects patient stabilization, massage head positioning, and mechanical output. The sensing subsystem includes pressure sensors, angle sensors, and their communication links, primarily affecting force control feedback, angle monitoring, and interface readings. The drive-control subsystem comprises the power supply, controller, drivers, motors, and display interface, primarily influencing motion execution, treatment start/stop, and control link stability. Given that this device exhibits typical mechatronic and human-machine contact characteristics, the impact of failures is not limited to component functional failures but may also be transmitted to the treatment process through force application, feedback, or control links. Therefore, this study established FMECA tables for each of the three subsystems and conducted analyses based on dimensions such as failure modes, failure causes, failure effects, severity, probability of occurrence, detectability, and RPN.

Failure mode severity (S) indicates the extent to which a failure mode affects device functionality, treatment efficacy, and patient safety; the grading is shown in Table 2; probability of occurrence (O) indicates the likelihood of a failure occurring during use; the grading is shown in Table 3; detectability (D) indicates the difficulty of identifying or detecting a failure before it causes an impact; a higher value indicates greater difficulty in detection; the grading is shown in Table 4 [25,32]. Scoring was performed according to the definitions provided in Table 2, Table 3 and Table 4 in this section, and the Risk Priority Number (RPN) was calculated. A higher RPN indicates that the failure mode requires higher priority for control under the current scoring system [25,33]. The RPN is used for risk prioritization and subsystem normalization calculations; it does not represent actual clinical incidence rates and cannot replace long-term operational failure statistics [23,33].

Table 2. The classification of failure severity (S).

Category	Rating Level	Definition
Class I (Catastrophic)	4	Severe device failure or direct patient-contact hazard that may cause patient injury.
Class II (Serious)	3	Moderate damage to critical components, resulting in partial functional loss, abnormal operation, or inability to complete the intended procedure.
Class III (Moderate)	2	Functional abnormality or partial loss that may affect treatment delivery or positioning accuracy.
Class IV (Minor)	1	No impact or only minor impact, such as slightly increased noise without functional loss.

Table 3. The classification of failure occurrence probability (O). At the prototype stage, the probability bands were used as structured reference ranges for expert elicitation; they do not represent observed failure frequencies.

Grade	Rating Score	Definition	Occurrence Probability
A	5	Frequent	O ≥ 20%
B	4	Occasional	10% ≤ O < 20%
C	3	Sporadic	5% ≤ O < 10%
D	2	Rare	1% ≤ O < 5%
E	1	Extremely Rare	O < 1%

Table 4. The classification of failure detection difficulty (D).

Detection Level	Rating Score	Detectability of Failure Mode
High Detectability	1	Can be completely detected
Moderate Detectability	2	Relatively easy to detect
Low Detectability	3	Detection methods are complex, making it relatively difficult to detect
Very Low Detectability	4	Detection is very difficult or even impossible

FMECA judgments were elicited separately from the FAHP weighting exercise. The research team first prepared a draft FMECA worksheet by decomposing the physical prototype into components and tracing the intended function of each component through the actuation, sensing and drive-control pathways. The same ten-member multidisciplinary panel then reviewed the proposed failure modes, causes and effects with reference to the prototype configuration and operating sequence. Severity, occurrence and detectability were assessed separately according to the definitions in Table 2, Table 3 and Table 4. Differences in the proposed ratings were resolved through discussion with reference to these definitions, after which one panel-level rating was recorded for each failure mode.

Because cumulative operating exposure and field-failure counts were unavailable at the prototype stage, the occurrence ratings were not calculated from observed incidence. The panel assigned the ordinal occurrence categories using the available design and prototype evidence, including component functions and specifications, identified failure mechanisms, and observations made during prototype assembly and functional operation, together with relevant clinical and medical-device design experience. The probability bands in Table 3 therefore served as structured reference ranges for expert elicitation and relative risk prioritization rather than as estimates of failure rates in clinical or commercial use.

2.7. Operational-Safety Test and Use-Error Assessment

2.7.1. Participants and Test Setup

Equipment reliability alone cannot fully address the safety risks associated with the actual use of massage robots [21,23]. To assess operator errors during typical treatment procedures, this study conducted usability testing based on task analysis [21,26,34]. Fifteen lay adults were recruited as operators to represent the intended users of the massage robot. A separate group of 15 healthy adults participated as simulated patients. Operators were required to have normal or corrected-to-normal vision, and simulated patients were able to complete the required positioning and standing–sitting movements. None of the 30 participants was a member of the separate expert panel, which comprised five clinicians and five medical device design researchers.

Before testing, the research team introduced the robot’s operating principles and demonstrated the complete task sequence. Instruction covered device startup, lower-leg fixation, angle-sensor attachment, massage-head positioning, interface readings and treatment initiation and termination. Operators then practised the procedure with guidance from the research team. Formal testing began one hour after practice.

Each session involved one operator and one simulated patient. The operator performed the device-related tasks, while the simulated patient cooperated with positioning and completed three standing–sitting cycles after the treatment sequence was activated. The simulated patient did not operate the device controls.

Before each session, the simulated patient was briefed on the required seated position, cooperation with lower-leg fixation and the three standing–sitting cycles. Simulated patients did not receive device-operation training because they did not operate the controls. A total of 15 formal test sessions were conducted, with one operator and one simulated patient participating in each session.

Simulated patients were primarily used to assist with procedures such as lower limb positioning, leg immobilization, angle sensor attachment, and massage head alignment; they were not used to evaluate disease improvement, pain relief, or treatment efficacy. Before participation, all participants received written information regarding the study procedures, foreseeable risks, and their right to withdraw. Written informed consent was obtained from all participants before the simulated-use testing.

The simulated patient was seated facing the robot, with both lower legs positioned within the curved grooves of the leg supports. The operator secured the lower legs using hook-and-loop straps, adjusted the supports relative to the massage heads and locked them using the hand screws. This arrangement allowed the distance between the knees and massage assemblies to be adjusted before operation.

The IM948 angle sensor was strapped to the designated test leg, 10 cm above the knee. Identifying the sensor’s correct orientation before attachment was an explicit task in the test sequence. The operator adjusted the lifting mechanism to knee height, then used the rotation and translation mechanisms to align the massage heads with the knee-eye acupoints. The soft silicone tips formed the contact surfaces between the massage heads and the target knee regions.

During the treatment sequence, the operator read the pressure values from both massage heads and the displayed knee angle. The operator then terminated the sequence and switched off the robot.

2.7.2. Test Tasks

In accordance with the robotic seated knee-adjustment protocol, each operator completed eight sequential task groups comprising 19 observable subtasks: device startup, patient leg immobilization, angle-sensor attachment, lifting-mechanism adjustment, push-rod rotation, push-rod advancement or retraction, treatment initiation and data retrieval, and treatment termination. The expected action for each observable subtask was defined before testing and was used to determine whether a use error had occurred [26,35]. The complete task sequence and expected actions are presented in Table 5.

Table 5. Simulated-use task sequence and expected actions.

Task Sequence	Expected Action
1. Connect the power supply and start the massage robot	1.1. Locate the power cable.
1. Connect the power supply and start the massage robot	1.2. Connect the power cable to the power supply and the massage robot.
1. Connect the power supply and start the massage robot	1.3. Locate the power switch and turn it on to start the massage robot.
2. Secure the patient’s legs	2.1. Assist the patient in placing both legs in the leg supports, ensuring that the lower legs fit the curved grooves of the supports.
2. Secure the patient’s legs	2.2. Secure the patient’s lower legs using the hook-and-loop straps.
2. Secure the patient’s legs	2.3. Move the leg supports to the appropriate position and lock them in place.
3. Attach the angle sensor	3.1. Determine the correct orientation of the angle sensor.
3. Attach the angle sensor	3.2. Attach the angle sensor 10 cm above the knee of the designated test leg.
4. Adjust the lifting mechanism	4.1. Locate the lifting-control buttons on the control interface.
4. Adjust the lifting mechanism	4.2. Raise or lower the lifting mechanism until it reaches the height of the knee.
5. Control the rotation of the push rod	5.1. Locate the push-rod rotation buttons on the control interface.
5. Control the rotation of the push rod	5.2. Rotate the joint motor upward or downward until the massage head reaches the height of the knee-eye acupoints.
6. Advance or retract the push rod	6.1. Locate the push-rod advancement and retraction buttons on the control interface.
6. Advance or retract the push rod	6.2. Advance or retract the push rod until the massage head is aligned with the knee-eye acupoints.
7. Start treatment and read the data	7.1. Locate and press the Start Treatment button on the control interface.
7. Start treatment and read the data	7.2. Read the pressure values of the massage heads on both sides from the control interface.
7. Start treatment and read the data	7.3. Read the knee-joint angle from the control interface.
8. End treatment and turn off the robot	8.1. Locate and press the End Treatment button on the control interface.
8. End treatment and turn off the robot	8.2. Press the power switch to turn off the massage robot.

The test team comprised one moderator and two recorders. At the start of each session, the moderator explained the test instructions and then presented the tasks sequentially. The recorders documented task completion, use errors, requests for assistance, verbal comments and test completion time through direct observation.

The analysis included one binary outcome for each of the 19 subtasks per operator, yielding 285 operator–subtask records across the 15 operators. The three standing–sitting cycles formed part of the treatment sequence and were not counted as separate usability trials. Use errors were identified by comparing observed actions with the expected actions specified in Table 5. As detailed in Section 2.7.3, a subtask was coded as 1 if one or more use errors occurred and as 0 otherwise.

After each session, the team collated the observed operational difficulties, near misses and use errors. Follow-up interviews explored participants’ explanations of these events, perceived risks and suggestions for improvement. Observational records provided the basis for quantifying use errors, while the interview responses informed the subsequent analysis of their potential contributing factors.

In terms of risk sources, Tasks 1 and 8 primarily correspond to risks associated with treatment start/stop and power supply control; Tasks 2 and 3 involve patient immobilization and sensor attachment, which directly affect subsequent positioning and feedback data; Tasks 4 through 6 correspond to adjustments of the massage mechanism’s spatial position, determining whether the massage head can be aligned with the target knee-eye area; and Task 7 is closely related to treatment process monitoring and interface readings. The aforementioned tasks collectively constitute the evaluation criteria for the operational safety indicator $A_4$.

2.7.3. Frequency-Based Quantification and Consequence Assessment of Use Errors

To ensure a clear upper limit for normalization calculations, this study used the occurrence of task errors rather than the total number of error events as the unit for quantifying operational safety. For each operator, a binary record was kept for each observable subtask. If one or more use errors occurred during a given subtask, the subtask was recorded as 1; otherwise, it was recorded as 0. Because the task workflow contained 19 observable subtasks and 15 operators participated in the test, the maximum number of observable subtask opportunities was 15 × 19 = 285. A use error is defined as a behavior by the operator during a specified task that deviates from the expected operation and may result in delays in the treatment process, deviations in treatment dosage, inadequate patient immobilization, incorrect sensor installation, misreading of interface data, or errors in starting or stopping treatment [19,21]. After the test, descriptive statistics and root cause analysis are performed on specific error event types to identify areas for improvement in the interface, structure, or process [26,35].

Operational safety was characterized using two complementary outputs: the frequency of error-positive subtask records and the potential consequences associated with each observed error type. Let ${\mathrm{e}}_{\mathrm{t}}$ denote the number of operators for whom one or more use errors were recorded in the t-th observable subtask, where t = 1, 2, …, T. The total number of error-positive operator–subtask records was calculated as:

$$E_{\mathrm{obs}}={\displaystyle \sum _{t=1}^T}{e}_t.$$

(15)

For $\mathrm{N}$ operators completing T observable subtasks, the maximum number of operator–subtask records was:

$$E_{\mathrm{m}\mathrm{a}\mathrm{x}}=NT$$

(16)

The frequency-based operational-safety input was calculated as:

$$x_4=1-{\displaystyle \frac{E_{\mathrm{obs}}}{E_{\mathrm{m}\mathrm{a}\mathrm{x}}}}.$$

(17)

Here, ${\mathrm{x}}_4$ ϵ [0, 1], with higher values indicating a lower proportion of error-positive operator–subtask records. Each error-positive record contributes one observation to the frequency calculation; this common observation unit does not imply that all use errors have equivalent safety consequences. Potential consequences were assessed separately for each observed error type using the classification criteria described below. An error type was classified as having a direct patient-safety implication when its stated consequence included excessive force, misinterpretation of the therapeutic dose or delayed treatment termination. Errors whose stated consequences primarily involved workflow delay, fixation efficiency or positioning accuracy were classified as operational-performance risks. This qualitative classification was considered together with observed frequency when prioritizing risk controls and design improvements; it did not alter the calculation of ${\mathrm{x}}_4$.

2.8. Graded Evaluation Matrix, Comprehensive Evaluation, and Model Outputs

After normalizing the risks of equipment failure and operator error, the four Level 1 indicators each received a positive reliability score of ${\mathrm{x}}_1,{\mathrm{x}}_2,{\mathrm{x}}_3,{\mathrm{x}}_4$. Specifically, the ${\mathrm{x}}_1,{\mathrm{x}}_2,{\mathrm{x}}_3$ scores were derived from the normalized results of the FMECA for the actuation subsystem, sensing subsystems, and drive-control subsystem, while the ${\mathrm{x}}_4$ score was derived from the normalized results of the task analysis for operator error.

To ensure semantic consistency across different indicators, this study adopted a five-level evaluation set {Very Good, Good, Fair, Poor, Very Poor}, i.e., V = {V1, V2, V3, V4, V5}. The evaluation grade score vector is:

$$\mathrm{P}={\left(1.0, 0.8, 0.6, 0.4, 0.2\right)}^{\mathrm{T}}$$

(18)

Table 6 maps each normalized input to one of five predefined grade intervals. Each row of the grade matrix $\mathrm{M}$ contains one entry equal to 1 for the assigned grade and four entries equal to 0. The assignment is exclusive, with no partial membership across adjacent grades. Weighted aggregation gives $\mathrm{B}=\mathrm{W}\mathrm{M}$, and the composite score is calculated as $\mathrm{Q}=\mathrm{B}\mathrm{P}$. Inputs within the same interval therefore receive an identical grade representation. The normalized inputs and risk rankings are reported alongside the composite score to retain information beyond the assigned grades.

Table 6. Interval-based mapping of normalized inputs to evaluation grades.

Normalized Score Interval	Evaluation Grade	Grade Evaluation Vector
0.8 < V ≤ 1.0	Very Good	(1, 0, 0, 0, 0)
0.6 < V ≤ 0.8	Good	(0, 1, 0, 0, 0)
0.4 < V ≤ 0.6	Fair	(0, 0, 1, 0, 0)
0.2 < V ≤ 0.4	Poor	(0, 0, 0, 1, 0)
0 ≤ V ≤ 0.2	Very Poor	(0, 0, 0, 0, 1)

The equal-width intervals and associated grade scores define a descriptive assessment scale that has not been calibrated against independent measures of reliability, safety, or performance. The effect of discretization is quantified using a secondary continuous weighted score calculated from the same normalized inputs and indicator weights.

According to Table 6, the normalized score ${\mathrm{x}}_{\mathrm{j}}$ for each primary indicator is converted to the corresponding grade evaluation vector ${\mathrm{m}}_{\mathrm{j}}$, and a grade evaluation matrix is constructed:

$$\mathrm{M}=\left[\begin{array}{c}{\mathrm{m}}_1\\ {\mathrm{m}}_2\\ {\mathrm{m}}_3\\ {\mathrm{m}}_4\end{array}\right]$$

(19)

Let the weight vector for the primary indicators be:

$$\mathrm{W}=\left({\mathsf{\omega }}_1,{\mathsf{\omega }}_2,{\mathsf{\omega }}_3,{\mathsf{\omega }}_4\right)$$

(20)

Then, the comprehensive evaluation vector is:

$$\mathrm{B}=\mathrm{W}\mathrm{M},$$

(21)

Here, $\mathrm{B}=\left({\mathrm{b}}_1,{\mathrm{b}}_2,{\mathrm{b}}_3,{\mathrm{b}}_4,{\mathrm{b}}_5\right)$ represents the system’s aggregated distribution across the five predefined evaluation grades. The grade-derived composite score is defined as:

$$\mathrm{Q}=\mathrm{B}\mathrm{P}$$

(22)

Under the five-grade scoring system established in this study, the theoretical range of Q is [0.2, 1.0]. The symbol Q denotes the grade-derived composite score, whereas S denotes failure-mode severity in the FMECA. According to Table 6, when Q > 0.8, the evaluation grade is “Very Good”; when 0.6 < Q ≤ 0.8, it is “Good”; and the remaining grades follow the intervals defined in Table 6.

A continuous weighted score was calculated as a secondary comparator to examine the numerical effect of grade assignment:

$$S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}={\displaystyle \sum _{i=1}^4}{\omega }_i{x}_i.$$

(23)

Both $Q$ and $S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ were calculated using the same unrounded inputs and FAHP weights. The grade-derived score $Q$ remains the specified assessment summary, while $S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ retains numerical differences within the grade intervals. The comparator is reported numerically and is not assigned a separate overall grade.

Boundary effects were examined analytically by increasing each normalized input $x_i$ from 0.799 to 0.801, one indicator at a time. All remaining inputs and all indicator weights were held constant. Here, $\delta Q_i$ and $\delta S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t},i}$ denote the resulting finite changes in the overall grade-derived and continuous scores, respectively. The subscript $i$ identifies the input varied in the comparison.

Crossing the 0.8 boundary changes the assigned grade score from 0.8 to 1.0, whereas the normalized input increases by 0.002. The corresponding score changes are therefore:

$$\delta Q_i=Q{\mid }_{x_i=0.801}- Q{\mid }_{x_i=0.799} =0.2{\omega }_i$$

(24)

$$\delta S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t},i}={\left.S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}\right|}_{x_i=0.801}-{\left.S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}\right|}_{x_i=0.799}=0.002{\omega }_i$$

(25)

These expressions describe the specified boundary crossing for each indicator and do not represent observed changes or estimates of measurement uncertainty.

Model Outputs and Boundaries of Interpretation

In addition to Q, the framework reports the first-level indicator weights, normalized subsystem inputs, RPN rankings of equipment failure modes, rankings of observed use errors, the aggregated grade vector, the assigned evaluation grade and the principal sources of risk. The grade-derived score Q summarizes the current prototype under the specified weighting and grade-coding procedures; it is not an estimate of the probability of reliable operation. The subsystem inputs and risk rankings identify the areas requiring priority control or redesign.

The overall process of the reliability evaluation model for the massage robot system is shown in Figure 5.

Figure 5. Integrated framework for prototype-stage engineering and use-related risk evaluation. FMECA provides normalized inputs for the three equipment subsystems, task analysis provides the operational-safety input, and FAHP provides the first-level indicator weights. These inputs are combined through the interval-based grade matrix to obtain the grade-derived composite score and risk-prioritization outputs.

The data sources and formation mechanisms for equipment failure risks and operational risks differ significantly. The reason this study was able to incorporate both into a unified model is that both types of risk are ultimately normalized to represent their degree of positive contribution to the reliability of the human-machine system and expressed within a unified evaluation rating space. This does not imply that equipment failure and use errors share the same mechanisms; rather, it provides a reproducible computational interface for integrating multi-source risks during the early prototype stage.

The design logic of this method aligns with the basic process of “hazard identification, risk estimation, risk evaluation, and risk control” in medical device risk management and usability engineering [20,21]. As this study is still in the prototype and preclinical evaluation stages, the model results should be interpreted in conjunction with subsequent long-term operational data, real-world patient usage data, and independent expert validation [11,16,34].

3. Results

3.1. FMECA Results

3.1.1. Actuation Subsystem

A total of 12 failure modes were identified for the actuator subsystem, with RPN values ranging from 6 to 20. The failure mode with the highest risk is “massage head detachment,” which has an RPN of 20. Although this failure mode has a low detection difficulty score, its severity is classified as Class I because once the massage head detaches, the rigid structure may come into direct contact with the patient, posing a clear safety risk related to patient contact. Deformation and fracture of the coupler in the rotating structure, as well as deformation and wear of the push-rod latch, all have an RPN of 18, indicating that the structures related to rotational transmission and massage head positioning are the second-highest risk sources within the actuator subsystem.

The risk distribution of the actuation subsystem indicates that its primary vulnerabilities lie not in the simple fracture of support components, but rather in components related to massage head connection, transmission reliability, and positioning accuracy. For a seated knee-adjustment robot, these components directly affect the positioning of the knee joint area and the direction of massage force output; therefore, subsequent designs should prioritize strengthening the massage head’s anti-detachment structure, improving the fatigue reliability of rotating transmission components, and enhancing the stability of push-rod connections.

The FMECA results for the massage robot’s actuation subsystem are shown in Table 7.

Table 7. FMEA-based RPN analysis of the actuation subsystem.

No.	Component	Function	Failure Mode	Failure Cause	Failure Effect	Severity (S)	Occurrence (O)	Detectability (D)	RPN
1	Base	Support	Fracture	Fatigue	The massage robot cannot be used	Class II	E	2	6
2	L-shaped leg support	Secure the patient’s leg	Jamming between the support and the slide rail, making it difficult to open	Foreign matter or rust	The patient’s leg cannot be secured	Class II	D	1	6
3	Screws	Secure the components	Corrosion	Long-term oxidation	Components detach, and the massage robot cannot be used	Class II	D	2	12
4	Lifting mechanism	Control the upward and downward movement of the massage mechanism to accommodate different patient knee heights	Linkage deformation or fracture	Fatigue	The massage mechanism cannot be accurately positioned at the knee-eye acupoints	Class II	D	2	12
5	Massage mechanism	Perform massage movements	Gear fracture	Excessive force or fatigue	The massage force cannot be correctly delivered, affecting the treatment effect	Class III	D	4	16
5	Massage mechanism	Perform massage movements	Excessive bearing clearance	Wear	The movement stability of the massage mechanism is affected	Class III	E	4	8
5	Massage mechanism	Perform massage movements	Lead-screw deformation, fracture or jamming	Fatigue, wear or excessive loading	Push-rod advancement or retraction is impaired. Jamming after contact may delay retraction and prolong unintended pressure on the knee.	Class III	D	3	12
5	Massage mechanism	Perform massage movements	Massage head detachment	Prolonged loading	The rigid structure directly contacts the patient, posing a safety risk to the patient	Class I	A	1	20
6	Rotating mechanism	Control the rotation of the massage mechanism to align it with the patient’s knee-eye acupoints	Coupling deformation or fracture	Excessive force or fatigue	The massage head cannot be accurately positioned at the knee-eye acupoints, affecting the treatment effect	Class II	D	3	18
6	Rotating mechanism	Control the rotation of the massage mechanism to align it with the patient’s knee-eye acupoints	Wave generator becomes out of round	Long-term use	The stability of rotational positioning is affected	Class II	E	4	12
6	Rotating mechanism	Control the rotation of the massage mechanism to align it with the patient’s knee-eye acupoints	Flexspline rupture	Excessive force or fatigue	The output of the rotating mechanism is affected	Class II	E	4	12
6	Rotating mechanism	Control the rotation of the massage mechanism to align it with the patient’s knee-eye acupoints	Push-rod latch deformation or wear	Prolonged excessive loading	The positioning of the massage head and the stability of force transmission are reduced	Class II	D	3	18

According to the normalization procedure defined in Section 2.6.1, the mean RPN of the actuation subsystem was 12.67 and its maximum RPN was 20. With η = 0.5, the positive reliability input was calculated as follows:

$$\begin{array}{ll}{\mathrm{x}}_1& =1-\left[0.5\left({\displaystyle \frac{12.67}{80}}\right)+0.5\left({\displaystyle \frac{20}{80}}\right)\right]\\ & =0.7958\approx 0.796.\end{array}$$

(26)

These results indicate that the overall risk of the actuation subsystem is at an acceptable level but still requires optimization. Since the highest-risk items involve patient safety through direct contact, subsequent evaluations and design improvements should not rely solely on the average risk assessment; priority should also be given to high-RPN failures, such as the detachment of the massage head.

3.1.2. Sensing Subsystem

A total of five failure modes were identified for the sensing subsystem, with RPN values ranging from 9 to 32. The failure mode with the highest risk is inaccurate pressure sensor output, with an RPN of 32—the highest value among all device failure modes—making it the engineering risk that requires the highest priority for control in the current prototype. This failure is classified as Severity Class I with a detection difficulty of 4, indicating that it may not only affect massage force feedback, but is also difficult to detect in a timely manner before output deviations occur. For direct-contact massage robot devices that require continuous monitoring of the massage head’s force, inaccurate pressure feedback may cause the actual therapeutic dose to deviate from the preset range, potentially affecting treatment efficacy or patient safety.

In addition to the pressure sensor, the RPN for failed signal transmission is 18, and the RPN for inaccurate angle sensor output is 16. These failures are all related to the feedback loop, indicating that the risks associated with the sensing subsystem are concentrated in the accuracy of force feedback, the stability of angle measurement, and the reliability of wireless communication. Compared to the actuation subsystem, failures in the sensing subsystem are more likely to influence the operator’s judgment and control system inputs through erroneous data; therefore, they should be prioritized for calibration during the iterative development of massage robot prototypes.

The FMECA results for the massage robot’s sensing subsystem are shown in Table 8.

Table 8. FMEA-based RPN analysis of the sensing subsystem.

No.	Component	Function	Failure Mode	Failure Cause	Failure Effect	Severity (S)	Occurrence (O)	Detectability (D)	RPN
1	Pressure sensor	Measure the output pressure of the massage head	Inaccurate output	Sensor aging after long-term use	The feedback on the massage robot’s output force is inaccurate, which may cause harm to the patient	Class I	D	4	32
2	Intelligent pressure transmitter	Transmit the pressure signal	RS485–Modbus communication failure	Poor contact or short circuit	Pressure feedback becomes unavailable, and closed-loop force control can no longer be maintained.	Class II	D	2	12
3	Angle sensor	Measure the patient’s knee-joint angle	Inaccurate output	Sensor drift	The angle-sensor measurement is inaccurate, affecting the output massage force and thus the treatment effect	Class III	D	4	16
4	Wireless transmission module	Transmit the angle signal	Reduced Bluetooth communication capability	Module performance degradation	Angle feedback becomes unavailable, and synchronization of push-rod movement with knee motion can no longer be maintained.	Class II	E	3	9
4	Wireless transmission module	Transmit the angle signal	Signal cannot be transmitted normally	Multiple devices are operating, causing signal interference	Angle feedback becomes unavailable, and synchronization of push-rod movement with knee motion can no longer be maintained.	Class II	D	3	18

The mean RPN of the sensing subsystem was 17.40 and its maximum RPN was 32. With η = 0.5, the positive reliability input was calculated as follows:

$$\begin{array}{ll}{\mathrm{x}}_2& =1-\left[0.5\left({\displaystyle \frac{17.40}{80}}\right)+0.5\left({\displaystyle \frac{32}{80}}\right)\right]\\ & =0.69125\approx 0.691\end{array}$$

(27)

This result is lower than that of the actuation subsystem and the drive-control subsystem, indicating that the sensing subsystem is the subsystem within the current massage robot prototype that requires the highest priority for improvement. Future efforts should focus on strengthening pressure sensor calibration, drift monitoring, alerts for abnormal readings, and designs to enhance communication immunity to interference.

3.1.3. Drive-Control Subsystem

The drive-control subsystem identified a total of 11 failure modes, with RPN values ranging from 6 to 18. The highest RPN value was 18, corresponding to abnormal voltage in either the main-control power supply unit or the node drive-module power supply unit, no power output from the stepper motor, and failure of the brushless DC motor to start or maintain the intended speed. These faults primarily affect the system’s power supply, linear actuator movement, and rotational positioning, and may result in the interruption of treatment movements, the massage head failing to reach its target position, or the inability to deliver massage force.

Compared to the sensing subsystem, the drive-control subsystem has a lower maximum RPN, but its risks exhibit significant cascading effects. Anomalies in the power supply or drive module may cause multiple actuators to fail simultaneously; failures in the display, main control unit, or motor control may affect the operator’s ability to control the treatment process. Therefore, improvements to the drive-control subsystem should focus on power supply stability, drive status monitoring, motor fault protection, and start/stop status indicators.

The FMECA results for the massage robot’s drive-control subsystem are shown in Table 9.

Table 9. FMECA-based RPN analysis of the drive-control subsystem.

No.	Component	Function	Failure Mode	Failure Cause	Failure Effect	Severity (S)	Occurrence (O)	Detectability (D)	RPN
1	Power adapter	Supply power to the entire system	Unable to supply power	Failure of the built-in charging board in the power supply	The massage robot cannot operate	Class II	E	2	6
2	Main-control power supply unit	Manage the voltage inputs of the components in the main-control system	Abnormal component voltage	Voltage-regulator circuit failure	The massage robot cannot operate	Class II	D	3	18
3	Node drive-module power supply unit	Manage the voltage inputs of each module	Abnormal component voltage	Voltage-regulator circuit failure	The massage robot cannot operate	Class II	D	3	18
4	Display	Control the movement of the massage robot	No display	Display short circuit	The massage robot cannot be controlled and cannot operate	Class II	D	2	12
5	Main control unit	Control the normal operation of the robot	No response after startup	Occasional system startup failure	The massage robot fails to start	Class II	D	2	12
6	TB6600 driver	Control the movement of the stepper motor	Unable to control or stop motor movement	Driver failure, degraded service life or control-signal fault	Motor actuation may be lost or may continue after a stop command. Continued push-rod advancement may increase knee-contact force beyond the intended operating range.	Class II	E	3	9
7	Stepper motor	Control push-rod movement	Motor step loss	Poor contact	The output force of the massage robot is inaccurate, affecting the treatment effect	Class III	E	4	8
7	Stepper motor	Control push-rod movement	No power output from the motor	Encoder failure or poor contact; motor aging	The massage robot has no massage force output	Class II	D	3	18
8	EPOS4 controller	Control the movement of the joint motor	Unable to control motor movement	Insufficient service life under long-term use	The joint-angle motor cannot rotate, and the massage head cannot be accurately positioned at the knee-eye acupoints	Class II	E	3	9
9	Brushless DC motor	Control the rotation of the bionic massage push rod	Encoder failure	Poor contact or short circuit	The massage head cannot be accurately positioned at the knee-eye acupoints	Class II	E	4	12
9	Brushless DC motor	Control the rotation of the bionic massage push rod	Motor does not start or operates at a low speed	Poor contact or motor aging	The massage head cannot be accurately positioned at the knee-eye acupoints	Class II	D	3	18

The mean RPN of the drive-control subsystem was 12.73, and its maximum RPN was 18. With η = 0.5, the normalized risk-derived input was calculated as follows:

$$\begin{gathered} {\mathrm{x}}_3=1-\left(0.5{\displaystyle \frac{12.7273}{80}}+0.5{\displaystyle \frac{18}{80}}\right) \\ =0.80795\approx 0.808. \end{gathered}$$

(28)

This score is higher than that of the actuation subsystem and sensing subsystems, indicating that the drive-control subsystem has a relatively low overall risk under the current scoring system. However, since the highest-risk items involve the power supply and motor output, it is still necessary to incorporate anomaly monitoring and fault protection logic in subsequent prototypes.

3.1.4. Subsystem Risk Summary and Ranking of Critical Failure Modes

This study further summarizes the average RPN, maximum RPN, and normalized reliability inputs for the three device subsystems; the results are shown in Table 10. The values of ${\mathrm{x}}_1$, ${\mathrm{x}}_2$, and ${\mathrm{x}}_3$ in this table serve as inputs for the device body section of the rating matrix.

Table 10. Summary of subsystem risk-derived inputs.

Subsystem	Number of Failure Modes	Mean RPN	Maximum RPN	Normalized Mean Risk (${\overline{\mathbf{r}}}_{\mathbf{j}}$)	Maximum Normalized Risk (${\mathbf{r}}_{\mathbf{j},\mathbf{m}\mathbf{a}\mathbf{x}}$)	Reliability Input (${\mathbf{x}}_{\mathbf{j}}$)
Actuation Subsystem	12	12.67	20	0.158	0.250	0.796
Sensing Subsystem	5	17.40	32	0.218	0.400	0.691
Drive-Control Subsystem	11	12.73	18	0.159	0.225	0.808

At the subsystem level, the sensing subsystem has the highest average and maximum RPN values, indicating that the device risk in the current prototype is primarily concentrated in the feedback measurement and data transmission links. The average risk of the actuator subsystem is lower than that of the sensing subsystem, but there are high-risk items related to patient safety, such as detachment of the massage head. The overall risk of the drive-control subsystem is relatively low, but failures related to the power supply and motor output could still lead to treatment interruption or positioning failure.

Table 11 lists the key failure modes with the highest RPN rankings; this ranking is used to help determine priorities for design improvements.

Table 11. Critical failure modes ranked by risk priority number.

Rank	Subsystem	Failure Mode	Main Effect	RPN
1	Sensing Subsystem	Inaccurate pressure sensor output	Output-force feedback error, which may affect patient safety	32
2	Actuation Subsystem	Massage head detachment	The rigid structure directly contacts the patient, posing a safety risk	20
3	Actuation Subsystem	Coupling deformation or fracture	Deviation in massage-head positioning, affecting the treatment effect	18
3	Actuation Subsystem	Push-rod latch deformation or wear	Reduced stability of massage-head positioning and force transmission	18
3	Sensing Subsystem	Signal cannot be transmitted normally	Interruption or delay of angle feedback	18
3	Drive-Control Subsystem	Abnormal voltage in the main-control power supply unit	The massage robot cannot operate	18
3	Drive-Control Subsystem	Abnormal power supply to the node drive module	Abnormal power supply to multiple modules; the robot cannot operate	18
3	Drive-Control Subsystem	No power output from the stepper motor	No massage force output	18
3	Drive-Control Subsystem	Brushless DC motor does not start or operates at a low speed	Insufficient rotational motion, affecting massage-head positioning	18
10	Actuation Subsystem	Gear fracture	Abnormal massage-force output, affecting the treatment effect	16
10	Sensing Subsystem	Inaccurate angle sensor output	Angle-measurement error, affecting output-force adjustment	16

The RPN ranking was used to support within-study prioritization. It was interpreted jointly with the severity class, occurrence rating, detectability rating, and failure effect of each failure mode rather than as a standalone measure of risk acceptability.

In summary, the primary engineering risk of the current massage robot prototype is not a single mechanical failure, but rather the risk of therapeutic dose deviation resulting from a combination of feedback inaccuracies, detachment of contact components, abnormal transmission and positioning, and interruption of drive output. The results indicate that subsequent prototype iterations should prioritize addressing four categories of issues: pressure sensor calibration and anomaly alerts, anti-detachment structures for the massage head, reliability of the rotary transmission, and status monitoring of the power supply and drive modules.

The FMECA results primarily reflect engineering risk assessments at the prototype stage based on structural functions and failure consequences, rather than long-term clinical failure rates. Since RPN scores still incorporate elements of expert or researcher judgment, subsequent studies should combine long-term operational records, real-world usage data, and independent reviewer verification to further validate the robustness of the key risk prioritization.

3.2. Operational-Safety Results

3.2.1. Use Errors During the Test Tasks

During simulated-use testing, 66 use errors were recorded across 285 observable subtask opportunities involving 15 operators. Table 12 summarizes the error types, occurrence counts and corresponding potential risks. Errors were concentrated in interface-data reading, control-button identification and lower-leg fixation. After each session, participants were interviewed about the observed operational difficulties, near misses and use errors. Their responses informed the subsequent analysis of potential contributing factors.

Table 12. Frequencies and potential consequences of use errors observed during simulated-use testing. Error types were classified as having direct patient-safety implications when their documented consequences included excessive force, misinterpretation of the therapeutic dose or delayed treatment termination. Errors primarily affecting workflow, fixation or positioning were classified as operational-performance risks. This classification was used for risk prioritization and did not rescale the observed error frequencies.

Task No.	Type of Use Error	Number of Occurrences	Potential Risk/Harm
1	Unable to locate the power switch	7	Delayed device startup; the operator cannot clearly determine the device status
2	The legs are not correctly placed in the supports	6	Insufficient restraint of the patient’s lower limbs, affecting massage-head alignment and the treatment effect
2	The Velcro straps are inconvenient to fasten	8	Reduced securing efficiency, possibly causing loose fixation or repeated adjustments and affecting the treatment effect
2	The supports are difficult to move or fail to lock	6	Reduced stability of the patient’s posture, affecting the treatment posture and treatment effect
3	The angle sensor is attached in the reverse orientation	5	Incorrect angle feedback affects the operator’s judgment of the patient’s posture and may cause excessive output force and harm to the patient
5	Confusion between the push-rod rotation buttons	9	Incorrect massage-head rotation direction causes an alignment deviation and prolongs the treatment time
6	Confusion between the push-rod advancement and retraction buttons	5	A forward or backward positional deviation of the massage head affects the contact position and prolongs the treatment time
7	Confusion between the pressure values of the left and right massage heads	11	Misreading of massage-force feedback may cause a misjudgment of the therapeutic dose and harm to the patient
7 and 8	Unable to locate the Start Treatment and End Treatment buttons	9	Delayed treatment start or termination may affect response efficiency in an emergency and cause harm to the patient

Task 7—reading pressure values and knee angle data after treatment began—was the stage with the highest number of errors. Some participants were unable to correctly distinguish between left and right pressure data on the interface, primarily because the data display positions did not align with the operators’ intuition and lacked clear textual labels. If this issue occurred during actual treatment, operators might incorrectly adjust the output force of the massage heads on both sides, leading to therapeutic dose deviations or patient discomfort. Errors in Tasks 5 and 8 were primarily related to unclear button semantics and the inconspicuous placement of the start/stop buttons; errors in Task 2 indicated that the leg brace fixation method still requires optimization. Consequently, the interface information architecture, labeling of key buttons, the left-right correspondence of pressure data, and the leg fixation structure are key areas for future ergonomics and safety improvements.

Among these, “confusion between left and right pressure values” occurred 11 times, making it the most common type of error. This error occurred directly during the treatment monitoring phase, indicating that the current interface still lacks sufficient spatial mapping, textual labeling, or visual differentiation for left and right pressure values. Confusion regarding the rotary push-button and difficulty locating the Start/End treatment buttons each occurred 9 times, suggesting that the semantics, grouping, and visual hierarchy of control buttons require further optimization. Difficulty securing the Velcro fasteners occurred 8 times, indicating that operational safety risks stem not only from the interface, but also from the ergonomic fit of the patient restraint system.

The total number of error-positive operator–subtask records was:

$$E_{\mathrm{obs}}={\displaystyle \sum _{t=1}^{19}}{e}_t=66.$$

(29)

With 15 operators each completing 19 observable subtasks, the maximum number of operator–subtask records was:

$${\mathrm{E}}_{\mathrm{m}\mathrm{a}\mathrm{x}}=15\times 19=285$$

(30)

The frequency-based operational-safety input was therefore:

$$x_4=1-{\displaystyle \frac{E_{\mathrm{obs}}}{E_{\mathrm{m}\mathrm{a}\mathrm{x}}}}=1-{\displaystyle \frac{66}{285}}=0.76842.$$

(31)

Applying the criteria defined in Section 2.7.3, three out of the nine observed error types were classified as having direct patient-safety implications: reversed attachment of the angle sensor (n = 5), confusion between the left- and right-side pressure readings (n = 11), and difficulty locating the treatment start and end controls (n = 9). Together, these accounted for 25 out of the 66 observed errors. The remaining six error types were classified as operational-performance risks associated primarily with workflow, fixation or positioning. Confusion between the left- and right-side pressure readings was both the most frequent error and one that could impair therapeutic-dose interpretation, making it a priority for interface redesign. Reversed attachment of the angle sensor occurred less frequently but remained safety relevant because incorrect posture feedback could affect force control.

According to the rating scale in Table 6, because 0.6 < ${\mathrm{x}}_4$ ≤ 0.8, the rating vector for the operational safety metric ${\mathrm{A}}_4$ is (0, 1, 0, 0, 0), corresponding to the “Good” category. This result indicates that the current prototype can complete basic treatment procedures during simulated operations following short-term training; however, interface readability, button recognition, and the patient restraint structure remain the primary weak points affecting operational safety.

3.2.2. Root-Cause Analysis of Use Errors

After categorizing use errors, it became evident that current operational risks stem primarily from five causes: unclear interface information mapping, insufficient semantics of control buttons, inconvenient operation of patient restraint structures, inadequate directional cues from sensors, and insufficient device-status indication. The identified contributing factors, potential harms, and corresponding design recommendations are summarized in Table 13.

Table 13. Preliminary contributing factors, potential harms, and recommended improvements for use errors.

Error Category	Representative Error	Root Cause	Potential Harm	Recommended Improvement
Unclear mapping of interface readings	Confusion between left and right pressure values	Insufficient differentiation of the spatial positions, labels, or colors of the left and right pressure values	The operator misjudges the massage force on the left and right sides, resulting in a misjudgment of the therapeutic dose	Fix the display positions of the left and right values on the interface, and add left/right text labels, color differentiation, and abnormal-pressure alerts
Insufficient semantics of control buttons	Confusion between the push-rod rotation buttons; confusion between the push-rod advancement and retraction buttons; inability to locate the Start Treatment and End Treatment buttons	The button names, icons, and grouping do not adequately reflect the movement directions and treatment workflow	Massage-head positioning deviation and delayed treatment start or termination	Display the rotation, advancement/retraction, lifting, and start/stop buttons in separate groups; use directional icons and status feedback; and emphasize the Start, Pause, and End buttons
Inconvenient operation of the restraint structure	Inconvenient fastening of the Velcro straps; legs not correctly placed in the supports; failure to lock the supports	The restraint structure is insufficiently adapted to different lower-limb sizes and operators’ operating habits	Reduced stability of the patient’s lower limbs, affecting massage-head alignment and contact safety	Optimize the shape of the leg supports, the length of the Velcro straps, and the locking mechanism, and add an indication confirming correct fixation
Insufficient sensor-installation guidance	The angle sensor is installed in the reverse orientation	The sensor housing lacks directional markings, and the installation procedure lacks an error-proofing design	Incorrect angle-feedback direction affects control and interpretation of readings	Add directional arrows, color markings, or a mechanical error-proofing structure to the sensor housing
Insufficient device-status indication	Unable to locate the power switch	The location of the power switch and the power-on status indication are not sufficiently clear	Delayed startup; the operator cannot quickly determine the device status	Strengthen the visual identification of the power switch, and add a power-on indicator light and an interface startup prompt

3.3. FAHP and Comprehensive-Evaluation Results

3.3.1. FAHP Weight Results

This study invited 10 experts to complete a questionnaire on the importance of the evaluation criteria, including 5 physicians and 5 medical device design researchers. Based on the risks associated with the massage robot system, the experts conducted pairwise comparisons of indicators such as actuation subsystem, sensing subsystems, drive-control subsystems, and operational safety. All 10 expert questionnaires were considered valid and included in the analysis, which were quantified using the FAHP 0.1–0.9 scale to form a fuzzy judgment matrix. The importance scores for each indicator are shown in Table 14.

Table 14. Group fuzzy complementary judgment matrix for the first-level indicators.

Evaluation Indicator	A1 Actuation Subsystem	A2 Sensing Subsystem	A3 Drive-Control Subsystem	A4 Operational Safety
A1 Actuation Subsystem	0.50	0.60	0.66	0.49
A2 Sensing Subsystem	0.40	0.50	0.44	0.46
A3 Drive-Control Subsystem	0.34	0.56	0.50	0.49
A4 Operational Safety	0.51	0.54	0.51	0.50

The aggregated pairwise judgments in Table 14 formed the group matrix C:

$$C=\left[\begin{array}{cccc}0.50& 0.60& 0.66& 0.49\\ 0.40& 0.50& 0.44& 0.46\\ 0.34& 0.56& 0.50& 0.49\\ 0.51& 0.54& 0.51& 0.50\end{array}\right]$$

(32)

Transformation of C using Equation (6) gave the following matrix F:

$$F\approx \left[\begin{array}{cccc}0.50000& 0.57500& 0.56000& 0.53167\\ 0.42500& 0.50000& 0.48500& 0.45667\\ 0.44000& 0.51500& 0.50000& 0.47167\\ 0.46833& 0.54333& 0.52833& 0.50000\end{array}\right]$$

(33)

$$\Delta ={\displaystyle \frac{2}{4(4-1)}}\sum _{i<j}\left|c_{ij}-f_{ij}\right|\approx 0.03889.$$

(34)

The transformation yielded a mean absolute difference of 0.03889 between C and F. This value was calculated before rounding the matrix entries for display.

The six individual deviations ranged from 0.00333 to 0.10000, with the largest occurring for the actuation–drive-control comparison (A1–A3). Although the mean was below the proposed review trigger of 0.10, the maximum individual deviation reached this value. These results distinguish the average matrix deviation from the larger discrepancy in an individual comparison.

The row sums of C were 2.25, 1.80, 1.89, and 2.06 for the actuation subsystem, sensing subsystem, drive-control subsystem, and operational safety, respectively. Using Equation (9), the corresponding indicator weights were calculated as follows:

$${\mathsf{\omega }}_1={\displaystyle \frac{2.25+2-1}{4(4-1)}} \approx 0.2708,$$

(35)

$${\mathsf{\omega }}_2={\displaystyle \frac{1.80+2-1}{4(4-1)}} \approx 0.2333,$$

(36)

$${\mathsf{\omega }}_3={\displaystyle \frac{1.89+2-1}{4(4-1)}} \approx 0.2408,$$

(37)

$${\mathsf{\omega }}_4={\displaystyle \frac{2.06+2-1}{4(4-1)}} \approx 0.2550.$$

(38)

The resulting weight vector, rounded to two decimal places, was:

$$\mathrm{W} \approx (0.27, 0.23, 0.24, 0.26)$$

(39)

Unrounded weights from Equation (9) were used throughout the sensitivity analysis. Specifically, the weight for the actuator subsystem, sensing subsystem, drive-control subsystem, and operational safety were 0.27, 0.23, 0.24, and 0.26, respectively. The four aggregate weights were relatively close, indicating that the group-averaged judgments assigned comparable importance to the four first-level indicators. This distribution should not itself be interpreted as evidence of inter-expert concordance.

At the aggregate level, the weights assigned to the actuation subsystem and operational safety were slightly higher than those assigned to the sensing and drive-control subsystems. This result aligns with the operational characteristics of massage robots: the actuation subsystem directly determines the positioning of the massage head and the force output, while operational safety determines whether patient positioning, sensor attachment, treatment start/stop, and data retrieval can be performed correctly. Although the weightings for the sensing subsystems and drive-control subsystems were slightly lower, they still accounted for nearly a quarter of the total contribution, indicating that inaccurate feedback and control anomalies cannot be overlooked in the comprehensive evaluation.

Kendall’s coefficient of concordance was: $W=0.403\left({\chi }^2\left(3\right)=12.093,p=0.007\right)$. The individual priority rankings were not identical, although the null hypothesis of no concordance was rejected.

In the leave-one-expert-out analysis, omission of any single expert changed no indicator weight by more than 0.00509. The ranking $A_1>A_4>A_3>A_2$ remained unchanged in all 10 analyses.

Weight sensitivity was assessed by increasing or decreasing each of the six independent upper-triangular entries of C by 0.05. The perturbation magnitude was half the 0.1 increment of the elicitation scale. It defined a deterministic sensitivity scenario, rather than an estimate of uncertainty in expert judgments. For each perturbed matrix, reverse entries were set to $1-c_{ij}$, and diagonal entries remained 0.5. Weights were recalculated using Equation (9) for all 2⁶ = 64 combinations.

The normalized indicator inputs were held constant at the values obtained from Equations (14) and (17). Their values, displayed to eight decimal places, were x₁ = 0.79583333, x₂ = 0.69125000, x₃ = 0.80795455, and x₄ = 0.76842105. All calculations used unrounded inputs and weights; rounding was applied only when reporting results.

Across the 64 scenarios, the continuous weighted score ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}={\sum }_{\mathrm{i}}{\mathsf{\omega }}_{\mathrm{i}}{\mathrm{x}}_{\mathrm{i}}$ ranged from 0.76579 to 0.76893, with a baseline of 0.76736. The grade-derived score Q, calculated using Equation (22), ranged from 0.84567 to 0.85067, with a baseline of 0.84817. The maximum absolute changes from the baseline were 0.00157 and 0.00250, respectively. Although aggregate scores varied little over the specified perturbations, the ranking of some closely weighted indicators changed. These findings characterize numerical sensitivity to the group matrix and provide no estimate of agreement among individual experts. The baseline values and ranges of the indicator weights across the 64 perturbation scenarios are summarized in Table 15.

Table 15. Sensitivity of indicator weights to perturbations in the group judgment matrix. Ranges were obtained from all 64 combinations of ±0.05 perturbations to the six independent upper-triangular entries. Complementarity was preserved, and diagonal entries were fixed at 0.5. Values are reported to five decimal places.

Indicator	Baseline Weight	Minimum	Maximum
Actuation subsystem	0.27083	0.25833	0.28333
Sensing subsystem	0.23333	0.22083	0.24583
Drive-control subsystem	0.24083	0.22833	0.25333
Operational safety	0.25500	0.24250	0.26750

3.3.2. Interval-Based Grade Aggregation Results

Normalization of the FMECA results yielded scores for the actuation, sensing, and drive-control subsystems. The operational-safety score was derived from the normalized use-error records obtained through task analysis. These four scores formed the input vector $\mathrm{X}$, which was mapped to the grade matrix $\mathrm{M}$ using Table 6. The composite score was then calculated from $\mathrm{M}$, the FAHP-derived weights, and the predefined grade scores. The normalized input vector for the four first-level indicators was:

$$\mathrm{X}=\left({\mathrm{x}}_1,{\mathrm{x}}_2,{\mathrm{x}}_3,{\mathrm{x}}_4\right)=(0.796, 0.691, 0.808, 0.768)$$

(40)

Here, the normalized risk-derived inputs were ${\mathrm{x}}_1$ = 0.796 for the actuation subsystem, ${\mathrm{x}}_2$ = 0.691 for the sensing subsystem, ${\mathrm{x}}_3$ = 0.808 for the drive-control subsystem, and ${\mathrm{x}}_4$ = 0.768 for operational safety. According to the grading criteria presented in Table 6 (Section 2.8), the actuator, sensing subsystem, and operational safety all fall into the “Good” grade, while the drive-control subsystem falls into the “Very Good” grade.

Therefore, the grading evaluation matrix is:

$$\mathrm{M}=\left[\begin{array}{ccccc}0& 1& 0& 0& 0\\ 0& 1& 0& 0& 0\\ 1& 0& 0& 0& 0\\ 0& 1& 0& 0& 0\end{array}\right]$$

(41)

The indicator weights, normalized scores, assigned grades, and corresponding grade evaluation vectors are summarized in Table 16.

Table 16. Comprehensive evaluation matrix, weights, and grade inputs.

First-Level Indicator	Weight	Normalized Score	Evaluation Grade	Grade Evaluation Vector
Actuation Subsystem A1	0.27	0.796	Good	(0, 1, 0, 0, 0)
Sensing Subsystem A2	0.23	0.691	Good	(0, 1, 0, 0, 0)
Drive-Control Subsystem A3	0.24	0.808	Very Good	(1, 0, 0, 0, 0)
Operational Safety A4	0.26	0.768	Good	(0, 1, 0, 0, 0)

The comprehensive evaluation vector B can be calculated using the grade evaluation matrix $\mathrm{M}$ and the weight vector $\mathrm{W}$.

$$\mathrm{B}=\mathrm{W}\mathrm{M}=(0.24, 0.76, 0, 0, 0)$$

(42)

Multiplying the comprehensive evaluation vector by the grade score vector yields the grade-derived composite score.

$${\mathrm{Q}}_{\mathrm{g}\mathrm{r}\mathrm{a}\mathrm{d}\mathrm{e}}=\mathrm{B}\mathrm{P}=0.24\times 1.0+0.76\times 0.8=0.848$$

(43)

The grade-derived composite score was $\mathrm{Q}=0.84817$, corresponding to “Very Good” under the specified grading scheme. The secondary continuous comparator yielded $S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}=$ 0.76736 using the same unrounded inputs and weights. The numerical difference between the two scores arose from the grade mapping.

The analytical boundary comparison considered an increase in each input from 0.799 to 0.801, with all other inputs and weights held constant. Across the four indicators, the resulting changes ranged from 0.04667 to 0.05417 for $\delta Q_i$ and from 0.00047 to 0.00054 for $\delta S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t},i}$. Variation within these ranges reflected differences among the four indicator weights.

The sensing subsystem had the lowest normalized score, and the equipment-failure and use-error rankings were unchanged by grade assignment. These indicator values and risk rankings retained information that was not represented in the overall grade.

At the baseline value of $\mathsf{\eta }$ = 0.5, the grade-derived score was Q = 0.84817, whereas the continuous comparator was ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ = 0.76736. Across the full range of $\mathsf{\eta }$, ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ increased continuously from 0.72572 to 0.80900. In contrast, Q changed stepwise from 0.75333 to 0.90233 as individual subsystem inputs crossed the boundaries defined in Table 6.

At $\mathsf{\eta }$ = 0, the sensing input was x₂ = 0.60000 and was therefore assigned to the “Fair” interval. Increasing $\mathsf{\eta }$ shifted this input into the “Good” interval. The drive-control input crossed the 0.8 boundary between $\mathsf{\eta }$ = 0.3 and 0.4, and the actuation input crossed the same boundary between $\mathsf{\eta }$ = 0.5 and 0.6. The resulting changes in Q reflect the combined effects of the normalization parameter and interval-based grade coding. The normalized subsystem inputs and the corresponding values of ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ and Q across the full range of $\mathsf{\eta }$ are presented in Table 17.

Table 17. Sensitivity of the normalized subsystem inputs and composite scores to $\mathsf{\eta }$. Values were calculated using the unrounded RPN statistics and FAHP weights. The operational-safety input was held constant at x₄ = 0.76842. Categories apply only to the grade-derived score Q; no separate grade was assigned to ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$.

$\mathsf{\eta }$	${\mathbf{x}}_1$, Actuation	${\mathbf{x}}_2$, Sensing	${\mathbf{x}}_3$, Drive-Control	${\mathbf{S}}_{\mathbf{c}\mathbf{o}\mathbf{n}\mathbf{t}}$	Q	Grade Derived from Q
0.0	0.75000	0.60000	0.77500	0.72572	0.75333	Good
0.1	0.75917	0.61825	0.78159	0.73405	0.80000	Good
0.2	0.76833	0.63650	0.78818	0.74237	0.80000	Good
0.3	0.77750	0.65475	0.79477	0.75070	0.80000	Good
0.4	0.78667	0.67300	0.80136	0.75903	0.84817	Very Good
0.5	0.79583	0.69125	0.80795	0.76736	0.84817	Very Good
0.6	0.80500	0.70950	0.81455	0.77569	0.90233	Very Good
0.7	0.81417	0.72775	0.82114	0.78402	0.90233	Very Good
0.8	0.82333	0.74600	0.82773	0.79234	0.90233	Very Good
0.9	0.83250	0.76425	0.83432	0.80067	0.90233	Very Good
1.0	0.84167	0.78250	0.84091	0.80900	0.90233	Very Good

3.4. Descriptive Comparison with Expert Ratings

The same ten experts who provided the FAHP pairwise judgments in Section 2.5 also rated the four first-level indicators. Ratings reflected their assessment of the prototype’s current condition and were expressed using the five grades from “Very Good” to “Very Poor”. The number of ratings assigned to each grade are reported in Table 18. These ratings were aggregated for a descriptive comparison with the model output. This comparison did not include ratings from an independently recruited expert panel.

Table 18. Same-panel expert ratings of the first-level indicators.

Evaluation Grade	Very Good	Good	Fair	Poor	Very Poor	Normalized Expert Evaluation Vector
A1 Actuation Subsystem	6	3	1	0	0	(0.6, 0.3, 0.1, 0, 0)
A2 Sensing Subsystem	7	3	0	0	0	(0.7, 0.3, 0, 0, 0)
A3 Drive-Control Subsystem	6	4	0	0	0	(0.6, 0.4, 0, 0, 0)
A4 Operational Safety	5	3	2	0	0	(0.5, 0.3, 0.2, 0, 0)

Let ${\mathrm{M}}_{\mathrm{expert}}$ denote the matrix of expert rating proportions in Table 18. Its rows correspond to the four indicators, and its columns follow the grade order in $P$. Each entry is the proportion of the ten experts assigning the corresponding grade to an indicator. The expert ratings were aggregated using the same weight vector $\mathrm{W}$ and grade-score vector $P$ as the model:

$${\mathrm{B}}_{\mathrm{expert}} = \mathrm{W}{\mathrm{M}}_{\mathrm{expert} }\approx (0.59783, 0.32408, 0.07808, 0, 0).$$

(44)

The resulting expert-derived score was calculated from the aggregated rating vector:

$$Q_{\mathrm{expert}} ={ B}_{\mathrm{expert}}P = 0.90395\approx 0.904.$$

(45)

Calculations used the unrounded weights from Equation (9), with rounding applied only to the reported values.

At three decimal places, the expert-derived score was 0.904 and the model score was 0.848, giving a difference of approximately 0.056. Both values fell within the predefined “Very Good” interval in Table 6. The comparison shared the expert panel, indicator weights, and grade scores. The matching categories therefore document descriptive correspondence within this shared assessment structure and do not constitute independent validation. The lower model score alone does not establish greater accuracy or a more conservative assessment.

4. Discussion

This study developed an integrated framework combining the fuzzy analytic hierarchy process (FAHP), failure mode, effects, and criticality analysis (FMECA), and task analysis to evaluate the reliability and operational safety of a seated knee-adjustment bionic massage robot. The grade-derived model score of 0.848 and the expert-derived score of 0.904 both fell within the predefined “Very Good” category. This categorical correspondence was obtained using the same expert panel, indicator weights, and grade-score coding. It provides a descriptive comparison of the two scoring procedures but does not independently establish model validity.

The model and expert scores were constructed from different inputs within a shared weighting and grading structure. The model considered both the mean risk across each subsystem and the highest individual risk within that subsystem. Consequently, a critical failure mode could meaningfully constrain the subsystem score even when the remaining failure modes presented relatively low risks. In contrast, the expert evaluation reflected a broader judgement of the prototype’s overall condition. This distinction is important for direct-contact therapeutic robots because a favorable average performance cannot compensate for a single failure that could expose a patient to excessive force, incorrect positioning, or uncontrolled contact [15,17]. The findings therefore support a systems-level approach in which equipment failures and use-related risks are evaluated together, consistent with the principles of medical-device risk management and usability engineering [20,21].

The subsystem results identify sensing performance as the principal engineering limitation of the current prototype. The sensing subsystem received the lowest normalized reliability score at 0.691, and inaccurate pressure-sensor output had the highest RPN of all identified failure modes at 32. Pressure feedback is central to both closed-loop force control and the operator’s assessment of treatment status [7]. An inaccurate reading could therefore affect the delivered therapeutic dose even when the mechanical and control components continue to operate [7,15]. Pressure-sensor calibration, drift monitoring, abnormal-reading detection, and communication robustness should consequently be treated as priority design requirements [7,18]. These measures should be accompanied by verification procedures that assess sensor accuracy throughout the expected operating range and under repeated-use conditions [7,18].

Although the actuation subsystem received a higher normalized score of 0.796, its risk profile included failure modes with direct implications for patient contact. Massage-head detachment had an RPN of 20, while coupling deformation or fracture and push-rod latch deformation or wear each had an RPN of 18. These failures could compromise positioning accuracy, force transmission, or the integrity of the patient-contact structure. Design improvements should therefore strengthen the massage-head retention mechanism, rotational transmission components, and push-rod connections. Their effectiveness should be confirmed through mechanical endurance testing, connection-integrity testing, and repeated positioning assessments.

The drive-control subsystem achieved the highest subsystem score at 0.808, but the force-control chain remains a priority for further risk reduction. Existing tests provide quantitative evidence of normal-operation performance: during the programmed standing–sitting sequence, knee-contact force ranged from 0 to 62 N, the mean measured force was 33.213 ± 11.259 N, and the measured and target force profiles were strongly correlated (r = 0.966, p < 0.01). The actuator’s 0–50 mm stroke constrains linear travel, and the interface Stop command provides supervised interruption of stepper-motor operation.

These measures do not, however, define the fault-condition force envelope of the 150 N actuator. The travel limit does not impose a contact-force ceiling, and the Stop command and primary pressure feedback operate through the same control chain rather than through an independent hardware safety channel. Because feedback loss was not deliberately induced, the present results do not establish signal-loss detection latency, stopping time or peak contact force during a fault, nor do they demonstrate that force remains below the 100 N embedded-sensor range.

The assessment therefore identifies a specific requirement for the next prototype iteration: a patient-contact force limit enforced independently of the primary feedback loop, together with monitored signal-loss detection, a defined stopping or unloading response and induced-fault verification. Such testing should interrupt the pressure and angle channels separately and measure detection latency, stopping time and peak contact force.

The frequency-based operational-safety input and the consequence assessment provide complementary information. Joint consideration of these results identified confusion between the left- and right-side pressure readings and difficulty locating the treatment start and end controls as priorities because these errors were frequent and had direct implications for therapeutic-dose interpretation or timely treatment termination. Reversed attachment of the angle sensor occurred less frequently but remained safety relevant because incorrect posture feedback could affect force control. This combined interpretation ensures that design priorities reflect both how often an error occurred and the seriousness of its potential consequences. The qualitative consequence classification informs control priorities without numerically rescaling the frequency-based input.

The operational-safety assessment further showed that technical reliability alone is insufficient to characterize the safety of the complete human-machine system [16,19,23]. A total of 66 use errors were recorded across 285 observable subtask opportunities, resulting in an operational-safety score of 0.768. The most frequent error was confusion between the left- and right-side pressure values, which occurred 11 times. Confusion involving the push-rod rotation controls and difficulty locating the treatment start and end controls each occurred nine times. These findings indicate that inadequate information mapping and control semantics may contribute directly to therapeutic-dose errors, delayed intervention, and incorrect massage-head positioning [19,26,35].

The observed use errors also show that operational safety should not depend solely on training [19,21,26]. Interface layout, control grouping, sensor-installation cues, and lower-limb fixation should themselves reduce the likelihood of foreseeable errors [21,26,35]. The left and right pressure values should occupy fixed and intuitive interface positions, supported by explicit labels and consistent visual differentiation. Rotation, advancement and retraction, lifting, and treatment-control functions should be separated into clearly defined groups. Directional icons, operating-state feedback, and visually prominent start, pause, and end controls may further reduce ambiguity. The angle sensor should include clear directional markings or an error-proofing feature, while the leg supports, straps, and locking mechanisms should accommodate different lower-limb dimensions and operating habits.

These design recommendations provide a basis for a closed-loop risk-control process. After each prototype modification, the relevant failure modes and use errors should be reassessed using the same FMECA and task-analysis procedures [20,21,25]. Repeated evaluation would allow changes in RPN values, subsystem reliability scores, and task-error frequencies to be compared across prototype iterations. Such comparisons would be more informative than relying exclusively on a single composite score because they would show whether specific design changes reduced the risks they were intended to address.

The principal contribution of this study is a structured assessment approach for early-stage, direct-contact rehabilitation-robot prototypes, for which long-term failure and operational data are often unavailable. By integrating subsystem-level FMECA, observed use errors and FAHP-derived indicator weights, the framework links component failures and human–machine interaction risks within a traceable evaluation process. Retaining the normalized subsystem inputs and individual risk rankings alongside the composite score allows the results to support targeted redesign rather than relying solely on an overall category. In the investigated prototype, this approach identified sensor accuracy, patient-contact component integrity, interface information mapping and treatment-control design as the principal priorities for subsequent development.

Several limitations constrain the interpretation of these findings. First, the evaluation concerned a single prototype designed to reproduce one seated knee-adjustment technique. The resulting weights, failure rankings, and reliability scores cannot therefore be directly generalized to other massage techniques, robot architectures, or commercial systems. Second, the operational-safety test involved 15 operators and 15 healthy adults acting as simulated patients. It did not include patients with knee osteoarthritis or reproduce the full complexity of clinical practice. The findings should therefore not be interpreted as evidence of clinical efficacy, long-term patient safety, or post-market reliability.

Third, the FMECA scores and FAHP weights incorporated expert judgement because long-term operational and failure data were unavailable [23,24,33]. The occurrence and detectability ratings may consequently differ from those observed during extended clinical or commercial use [23,33]. Kendall’s W indicated incomplete concordance in the experts’ priority rankings. However, omission of any single expert changed no weight by more than 0.00509 and did not alter the indicator ranking, indicating that no single expert dominated the aggregated weights. This finding is limited to individual-expert influence within the present panel and does not establish reproducibility across independently constituted expert panels.

The comparative expert ratings were provided by the panel responsible for FAHP weighting and were aggregated using those same weights. This shared source of judgment limits the comparison to a descriptive assessment within the participating panel. It provides no independent evidence of model accuracy or reproducibility across expert groups. Independent assessors and external performance criteria are needed to evaluate model validity.

Finally, the interpretation of Q depends on the interval boundaries and numerical grade scores that define the assessment scale. These modeling assumptions have not been empirically calibrated against independent reliability, safety, or performance criteria. Continuous triangular or trapezoidal membership functions could represent gradual transitions, although their specification would also require choices of transition locations, shapes, and overlap widths.

The fixed intervals and grade scores were retained as an explicit, reproducible descriptive scheme without introducing additional membership parameters lacking independent empirical support. This rationale concerns the transparency of the model specification rather than evidence that hard boundaries are more accurate. The individual inputs and $S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ retain numerical information, while the analytical boundary comparison quantifies the discontinuity associated with grade assignment.

Accordingly, Q should be interpreted as a grade-based descriptive summary alongside the continuous comparator, individual indicator values, and critical-risk rankings. It does not provide an empirical estimate of the probability of reliable operation.

At the baseline value of $\mathsf{\eta }$ = 0.5, the grade-derived score was Q = 0.84817, whereas direct weighting of the same unrounded inputs yielded $S_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ = 0.76736. The latter lies numerically within the interval labelled “Good”, although it was retained as a continuous comparator rather than assigned a separate grade. Across the full range of $\mathsf{\eta }$, Q varied from 0.75333 to 0.90233 and changed discontinuously when subsystem inputs crossed grade boundaries. The overall category is therefore conditional on both the normalization parameter and the grade-coding scheme and should be interpreted together with the subsystem inputs and critical-risk rankings.

Future studies should evaluate multiple robot configurations, larger and more diverse operator groups, and scenarios that more closely represent clinical use [11,16,34]. Independent expert panels should be used to assess the reproducibility of the indicator weights and the external validity of the overall rating [24,27,36]. As operational data accumulate, occurrence and detectability estimates should be updated using device logs, sensor-drift records, maintenance data, abnormal shutdowns, use errors, and adverse events [20,25,33]. Further work should also examine how engineering measures, including pressure-feedback error, positioning deviation, fixation stability, and treatment interruption, relate to patient comfort, tissue loading, joint function, and adverse events. Establishing these relationships is necessary before the framework can progress from prototype-stage risk screening to clinical decision support. Within its present scope, the integrated framework provides a structured and interpretable method for identifying critical engineering and use-related risks during the early development of massage robots.

5. Conclusions

This study established an integrated FAHP–FMECA–task analysis framework for evaluating the reliability and operational safety of a seated knee-adjustment bionic massage robot at the prototype stage. The framework extends the evaluation beyond individual mechanical components by jointly considering the actuation subsystem, sensing subsystem, drive-control subsystem, and operator-dependent treatment workflow. It also provides a common evaluation structure for combining equipment-failure risks with observable use-related risks when long-term operational data are not yet available.

The normalized reliability scores for the actuation subsystem, sensing subsystem, drive-control subsystem and operational safety were 0.796, 0.691, 0.808 and 0.768, respectively. At the baseline value of $\mathsf{\eta }$ = 0.5, interval-based grade aggregation produced Q = 0.84817, corresponding to “Very Good”, whereas direct weighting of the same unrounded inputs produced ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ = 0.76736, which lies numerically within the “Good” interval. Across $\mathsf{\eta }$ ϵ [0, 1], Q ranged from 0.75333 to 0.90233 and ${\mathrm{S}}_{\mathrm{c}\mathrm{o}\mathrm{n}\mathrm{t}}$ from 0.72572 to 0.80900. The overall category should therefore be interpreted as conditional on the specified normalization and grade-coding procedures. The expert-derived score of 0.904 fell within the same category under the shared weighting and grading scheme. This correspondence was descriptive because the same panel contributed to both weighting and expert appraisal; independent validation remains necessary. Inaccurate pressure-sensor output had the highest RPN at 32, while massage-head detachment had an RPN of 20. The operational test recorded 66 use errors across 285 observable subtask opportunities, with confusion between the left- and right-side pressure values being the most frequent error.

Taken together, the findings demonstrate the feasibility and practical value of the integrated framework for prototype-stage risk assessment of the investigated seated knee-adjustment massage robot. The framework connects equipment failures, observed use errors and indicator weighting within a single traceable workflow and produces both an overall assessment and actionable risk priorities. In this case, it identified sensor accuracy, patient-contact component integrity, interface information mapping and treatment-control design as the principal targets for subsequent prototype development. Before clinical evaluation, the force-control chain requires an independently enforced patient-contact force limit and induced-fault testing to establish feedback-loss detection latency, actuator stopping time and peak contact force. The current study therefore provides a methodological and empirical basis for iterative risk identification, redesign and reassessment in early-stage direct-contact rehabilitation robots. Evaluation across additional robot architectures, independently constituted expert panels, clinically representative participants and longitudinal operational records will extend the evidence for its reproducibility and transferability to broader clinical and regulatory settings.