FMEA on an Infusion Pump Controller
A cross-functional team is doing a design FMEA on an infusion pump controller. The team scores a software failure that could cause over-infusion as severity 10, occurrence 4, and detection 6. A second failure mode, a display glitch that shows a stale flow rate, is scored severity 7, occurrence 6, detection 4. A third mode, battery connector corrosion causing shutdown, is scored severity 8, occurrence 3, detection 5. The team lead wants to rank by RPN and fix the top item first. A nurse on the team says the display glitch is the one that actually causes wrong programming in practice. The project has budget for two corrective actions this cycle.
1. Compute RPN for each mode and evaluate whether RPN ranking is the right basis for choosing the two corrective actions.
Read the worked answer
RPN = S × O × D.
- Over-infusion software failure: 10 × 4 × 6 = 240.
- Display glitch (stale flow rate): 7 × 6 × 4 = 168.
- Battery connector corrosion: 8 × 3 × 5 = 120.
RPN ranking alone is insufficient here. RPN treats severity, occurrence, and detection as interchangeable multipliers, which is exactly the criticism of RPN. A severity-10 mode that can injure a patient should not be deprioritized because its occurrence happens to be moderate, and the display glitch's higher occurrence reflects the nurse's field observation that it drives wrong programming.
Better basis:
- Severity first as a gate. Any severity 9-10 mode gets action regardless of RPN. The over-infusion mode qualifies on severity alone.
- Then use occurrence and detection to prioritize within severity tiers. The display glitch has the highest occurrence (6) and a real field pathway, so it is a strong second candidate.
- Consider a criticality-style view (severity × occurrence) alongside RPN to avoid the detection term masking a high-occurrence, high-severity mode.
Conclusion. RPN is a screening aid, not the decision rule. Rank by severity tier, then occurrence/detection.
2. Which two corrective actions would you fund, and what would you do about the third mode?
Read the worked answer
Fund these two:
- Over-infusion software failure (S=10). Highest severity; a software fault that can over-infuse is a patient-safety hazard. Typical actions: independent dose-limit interlock, watchdog/flow cross-check, and verification testing of the dose calculation. Target: reduce occurrence and raise detection (add a redundant flow check).
- Display glitch (O=6, nurse-reported field pathway). Highest occurrence and a documented real-world pathway to wrong programming. Actions: refresh/stale-state detection, distinct visual state for stale data, and a usability test with nurses. This attacks occurrence directly.
The battery connector corrosion (S=8, RPN 120). Do not drop it. It is a severity-8 shutdown mode; RPN ranked it last only because occurrence and detection scores were favorable. Handle it with a low-cost, high-leverage action: specify a corrosion-resistant connector plating and add a connector inspection to the service procedure. If budget truly allows only two engineering actions, this can be a specification change rather than a redesign.
Process note. Record the rationale for departing from RPN order so the decision is auditable, and re-score after actions to show the risk reduction.