Reliability — design FMEA for a medical device

// Design FMEA for a volumetric infusion pump: failure modes ranked by risk priority number (severity × occurrence × detection), each mitigation's residual RPN recomputed from its target ratings, linked to the ISO 14971 risk file.
//
// Every string below is EXAMPLE text from a fictional device: replace it.
//
// Ratings use the team's 1-to-10 scales: severity 10 = death or serious
// injury possible, occurrence 10 = expected in most units, detection 10 =
// no design control would catch it before use. The RPN is never typed:
// the table multiplies the three ratings, ranks the modes, and recomputes
// the residual RPN from each mitigation's target ratings.
//
// Severity rarely moves. A design control changes how often a failure
// happens or how surely it is caught, not how bad it is when it happens,
// so every mitigation below keeps its mode's severity and works on
// occurrence or detection. Rank by severity first and RPN second: a
// severity-10 mode deserves action whatever its RPN.

fmea pump_dfmea {
  title: "Volumetric infusion pump, model VX-3 — design FMEA"
  system: "Pumping mechanism, sensing and alarm subsystems"
  team: "Systems, firmware, human factors, clinical, quality"
  revision: "Rev C, linked to risk management file RMF-031"
}

failure_mode free_flow {
  component: "Set-loading door and anti-free-flow clamp"
  mode: "Uncontrolled free flow when the door is opened"
  cause: "Clamp does not engage if the set is seated at an angle"
  effect: "Bolus of high-alert drug; potential fatal overdose"
  severity: 10
  occurrence: 3
  detection: 6
}
failure_mode occlusion_missed {
  component: "Downstream pressure sensor"
  mode: "Occlusion alarm delayed beyond 2 hours at 1 mL/h"
  cause: "Fixed pressure threshold too high for low flow rates"
  effect: "Therapy interruption; under-dosing of vasoactive drugs"
  severity: 8
  occurrence: 5
  detection: 5
}
failure_mode air_in_line {
  component: "Ultrasonic air-in-line detector"
  mode: "Air bubble above the 50 µL threshold not detected"
  cause: "Detector sensitivity drifts with set wall thickness"
  effect: "Air delivered to the patient; embolism risk in neonates"
  severity: 9
  occurrence: 3
  detection: 6
}
failure_mode keypad_entry {
  component: "Keypad and dose-entry firmware"
  mode: "Tenfold programming error accepted"
  cause: "Decimal point key bounce; no soft limit on the drug entry"
  effect: "Tenfold overdose of the programmed drug"
  severity: 10
  occurrence: 4
  detection: 7
}
failure_mode battery_depletion {
  component: "Li-ion battery pack and fuel gauge"
  mode: "Pump stops before the low-battery alarm"
  cause: "Fuel-gauge model inaccurate after 300 charge cycles"
  effect: "Unannounced interruption during patient transport"
  severity: 7
  occurrence: 4
  detection: 6
}
failure_mode alarm_inaudible {
  component: "Alarm speaker"
  mode: "Alarm below 45 dB(A) at 1 m"
  cause: "Speaker port blocked by disinfectant residue"
  effect: "Alarm not heard; delayed response to any other failure"
  severity: 8
  occurrence: 3
  detection: 4
}

mitigation free_flow_interlock {
  mode: free_flow
  action: "Door cannot open unless the clamp sensor confirms closure; add a set-seating verification step to IFU and verify by usability test"
  owner: "Mechanical lead"
  target_severity: 10
  target_occurrence: 1
  target_detection: 3
}
mitigation occlusion_adaptive {
  mode: occlusion_missed
  action: "Rate-adaptive occlusion threshold; verify time-to-alarm at 1 mL/h per IEC 60601-2-24"
  owner: "Firmware lead"
  target_severity: 8
  target_occurrence: 2
  target_detection: 3
}
mitigation air_self_test {
  mode: air_in_line
  action: "Power-on self-test of the detector against a reference bubble; recalibrate per set lot"
  owner: "Sensing lead"
  target_severity: 9
  target_occurrence: 2
  target_detection: 3
}
mitigation dose_error_reduction {
  mode: keypad_entry
  action: "Drug library with hard and soft limits; require confirmation for any entry 10x the previous rate"
  owner: "Human factors lead"
  target_severity: 10
  target_occurrence: 2
  target_detection: 2
}
mitigation battery_model {
  mode: battery_depletion
  action: "Impedance-tracking fuel gauge; alarm at 30 minutes remaining, verified across aged packs"
  owner: "Electrical lead"
  target_severity: 7
  target_occurrence: 2
  target_detection: 3
}
mitigation alarm_check {
  mode: alarm_inaudible
  action: "Microphone loop-back check of alarm output at power-on; sealed speaker membrane"
  owner: "Electrical lead"
  target_severity: 8
  target_occurrence: 1
  target_detection: 2
}

view rpn: fmea_table