An RPN Cutoff That Spends the Safety Budget on a Cosmetic Display
A six-person FMEA team is reviewing a large-volume infusion pump before design freeze. The facilitator applies the plant's standard rule: any failure mode with RPN of 100 or more receives a corrective action, and any mode below 100 is closed with no action. The team scores five modes. M1, dose value truncated on the display: S=3, O=6, D=6, RPN 108. M2, air-in-line sensor misses a 0.3 mL bolus: S=9, O=4, D=5, RPN 180. M3, downstream occlusion with a 30-second alarm delay: S=7, O=5, D=4, RPN 140. M4, single pressure-sensor offset produces twofold over-delivery: S=10, O=3, D=6, RPN 180. M5, battery-gauge error shuts the pump down mid-infusion: S=9, O=2, D=2, RPN 36. Engineering has budget for exactly two design changes this cycle. The M5 detection score of 2 was justified on the grounds that the low-battery alarm warns the user, and that alarm is generated by the same firmware module that computes state of charge. The team intends to spend one of the two changes on M1 because it is above the cutoff and cheap to fix.
1. Which two failure modes should receive the design changes? Justify your selection against the team's RPN rule, addressing how severity and detection behave inside the RPN product.
Read the worked answer
The cutoff is the defect, not just the ranking. RPN multiplies three ordinal scores, so a large severity difference can be outweighed by a modest detection difference. M1 with S=3 scores 108 and is actioned, while M5 with S=9 scores 36 and is closed. The arithmetic is asserting that a truncated display matters more than a mid-infusion shutdown that can interrupt therapy or deliver an unintended bolus. Nothing in the numbers supports that.
Severity must gate the decision, not be one factor among three. With S=10 on M4 and S=9 on M5, both require action or a documented, justified acceptance regardless of RPN. A workable substitute for the cutoff is: severity 9-10 requires mandatory action or management sign-off; severity 5-8 is prioritized by occurrence and detection; severity 4 or below goes to the normal backlog.
Spend the changes on M4 and M2. M4 is catastrophic and effectively invisible, with D=6, so a twofold over-delivery can reach the patient before anyone knows. M2 has the highest occurrence among the high-severity modes, and its detection rests on a sensor whose sensitivity at a 0.3 mL bolus is unproven. M5 is next in severity but has low occurrence; before spending a design change on it, fix the invalid detection credit described below.
Do not spend a change on M1. It is cheap, but cheapness is not a risk criterion. A display formatting correction belongs in the user-interface backlog, and using a scarce safety change to clear an arbitrary cutoff is exactly the failure mode of RPN-driven FMEA.
2. The team proposes to re-score M5 after adding a second, identical battery gauge wired in parallel with the first. Evaluate that proposal, including how the detection score should be treated.
Read the worked answer
Two identical gauges are not redundancy in any useful sense. Both channels share the state-of-charge algorithm, the analog front end, the calibration procedure, and the environmental exposure. A firmware defect, a common calibration error, or a shared supply-rail fault moves both readings together, and the comparison logic simply sees agreement.
Quantify it with a beta factor. At beta = 10%, adding a parallel channel reduces the dangerous undetected contribution of that function by roughly a factor of ten, not a hundred, and the common-cause term typically dominates the residual risk. The FMEA must not be re-scored as if occurrence fell by two orders of magnitude.
The original detection score was invalid regardless. M5's D=2 credited a low-battery alarm generated by the same firmware that computes state of charge. A detector that depends on the failed function is not a detector. On re-score, D should rise to 7 or higher unless an independent means of detecting the fault genuinely exists - and then M5's RPN climbs well above the cutoff and its priority becomes visible on its own.
What would earn the credit: a diverse measurement (coulomb counting plus voltage or impedance), computed on a separate microcontroller with a documented independence argument, supported by a fault-injection test showing the discrepancy is annunciated before the gauge error can cause a shutdown. Re-score occurrence only after independence is demonstrated. Also add the new failure modes the second gauge introduces - nuisance shutdowns from disagreement, extra connectors, and added calibration steps.
3. Before the team closes M3 (occlusion with a 30-second alarm delay) on the strength of its detection score of 4, what evidence should be required?
Read the worked answer
Detection scores are claims about the effectiveness of controls, and this one has not been tested. Require evidence before closing the mode:
- Sensitivity at the worst case. A fault-injection test with the specified 0.3 mL bolus at the lowest flow rate, the most adverse tubing orientation, the most viscous fluid in the labelling, and the noisiest pump speed. Bubble sensors commonly lose sensitivity at low flow and small volumes. A detection score of 4 is only valid if that test passes with margin.
- Convert the 30-second delay into delivered volume. At the maximum flow rate, 30 seconds of continued delivery may already exceed the dose error that causes harm. Compute the volume delivered during the delay and compare it with the harm threshold. If the delay alone is hazardous, the detection score is wrong and the mitigation is a faster response, not a louder alarm.
- Independence. The alarm must be generated and annunciated by a path that does not share the failed function. If occlusion pressure sensing and alarm generation share a firmware module, the detector can fail along with the detected condition.
- Human response. Detection is not mitigation. Verify that the clinician can see and act on the alarm in the real use environment: audibility against ward noise, priority relative to other alarms, alarm fatigue, and time to stop the infusion.
Record the verification alongside the score. If a test cannot be completed before design freeze, lower the detection credit to reflect the uncertainty rather than assuming it. Closing a mode on an untested detection claim is how a detection score becomes a fiction.