Six hundred volumetric infusion pumps in one hospital, each running about 2,500 hours a year, each carrying a pumping mechanism, an occlusion sensor, an air-in-line detector, a dose controller and a rechargeable battery. The self test on this device is not a maintenance signal. It is a permission, and the person reading it is a nurse at three in the morning with a patient waiting and no interest whatever in diagnostics.
That changes what the test is for. On an aircraft or a compressor, built-in test informs a maintenance organisation that will act in due course. Here it stands between the device and a patient, and its output is consumed as a binary right to proceed: a gate that passes a sick pump puts a degraded device on a therapy, and a gate that fails a healthy one removes capacity from a ward that has none to spare. The design question is therefore not only what fraction of the failure rate the test sees, but what it is entitled to conclude from what it sees.
The technique, and why this one
Power-on self test specified as a release-to-use gate: rate-weighted detection coverage over the mode inventory, with the gate's decision rule treated as a design parameter, and wear-out items modelled with a Weibull because a pass/fail verdict cannot represent a margin. The gate framing is what forces the second half. A maintenance test may report "degraded, plan a replacement". A gate has two outputs and must convert every measurement into one of them, so any item whose failure arrives gradually needs the threshold chosen deliberately against its life distribution rather than set at the point of functional failure.
| Item | λ per 10⁶ h | Model used | What the gate can check |
|---|---|---|---|
| Pumping mechanism | 300 | Weibull, β = 1.6, η = 26,000 operating h; wear on the plunger drive | motor current and encoder travel through a short priming stroke |
| Occlusion sensor | 150 | constant λ | forced deflection against a known reference |
| Air-in-line detector | 120 | constant λ; itself a protective device | ultrasonic path self-check with an injected reference |
| Dose controller board | 90 | constant λ | memory and processor self-test, watchdog, display integrity |
| Battery | 800 | Weibull, β = 3.4, η = 17,500 calendar h; strong wear-out | terminal voltage, and optionally capacity under load |
Two clocks run in this table and mixing them is the standard error. The mechanism wears with use, so its clock is operating hours. The battery ages whether the pump is used or not, so its clock is calendar hours, which is why its characteristic life is quoted against the two-year replacement cycle of 17,520 hours rather than against the 5,000 operating hours a pump accumulates in the same period. The reliability page shows what happens when the two populations are fitted together: the mixture returns β close to 1 and hides both mechanisms.
Rolling up the gate's coverage
FFD = Σλ(detected) / Σλ(all)
| Item | λ per 10⁶ h | Detected at power-up | Undetected λ |
|---|---|---|---|
| Pumping mechanism | 300 | 80.0% | 60.0 |
| Occlusion sensor | 150 | 88.0% | 18.0 |
| Air-in-line detector | 120 | 92.0% | 9.6 |
| Dose controller board | 90 | 96.0% | 3.6 |
| Battery | 800 | 95.0% | 40.0 |
| Total | 1,460 | 131.2 |
FFD = (1,460 − 131.2) / 1,460 = 1,328.8 / 1,460 = 0.910
Across the fleet, 600 pumps at 2,500 hours a year is 1.5 million pump-hours:
fleet failures per year = 1,460 × 10⁻⁶ × 1.5 × 10⁶ = 2,190
unannounced per year = 131.2 × 10⁻⁶ × 1.5 × 10⁶ = 197
Roughly 197 times a year a therapy begins on a pump that is degraded and has just been told it is fit. That is a materially different exposure from the same 9% on an aircraft, where the residue meets a crew rather than a patient. The mechanism at 80% is the weakest item and carries 46% of the undetected budget, because a short priming stroke at power-up exercises the drive for a few seconds under no load, which is no test at all of a mechanism that fails under sustained back pressure.
A gate also has constraints no maintenance test faces. It must finish in the seconds a nurse will actually wait, or it will be worked around, and a worked-around gate has coverage of zero. Its bias must be chosen explicitly too, because there is no neutral setting: the availability page shows the loaner pool absorbing the false fails is only 40 pumps deep.
The battery, and why a gate is the wrong instrument for a wearing item
The battery is 800 of the pump's 1,460 per 10⁶ hours, more than half the device by rate, and it is the most strongly ageing item in the system. At the two-year replacement point the surviving fraction is
R(17,520) = exp(−(17,520 / 17,500)^3.4) = exp(−1.0039) = 0.366
so the policy replaces batteries at an age by which nearly two thirds of them have already reached the failure criterion. Setting the replacement at the characteristic life is setting it at the wrong percentile, and the B10 age says where it should sit:
B10 = η·(−ln 0.9)^(1/β) = 17,500 × (0.10536)^(1/3.4) = 17,500 × 0.5159 = 9,030 h
about twelve months. The testability consequence follows from the hazard rate rather than the survival curve:
h(8,760) = (3.4/17,500) × (8,760/17,500)^2.4 = 1.943 × 10⁻⁴ × 0.190 = 3.69 × 10⁻⁵ per hour
h(17,520) = (3.4/17,500) × (17,520/17,500)^2.4 = 1.943 × 10⁻⁴ × 1.003 = 1.95 × 10⁻⁴ per hour
36.9 per 10⁶ hours rising to 195 across the second year, a factor of 5.3. A pass/fail voltage check cannot see any of that. Terminal voltage on a lithium or nickel chemistry holds up almost to the end of usable capacity, so the gate reports "battery present and charged" on a pack whose hazard has quintupled and whose run time on mains failure has collapsed. The gate must measure a margin, not a state: a brief load pulse with the voltage sag recorded, trended pump by pump, converts a binary check into a capacity estimate and gives the biomedical department something to schedule against.
Checking the checker
The air-in-line detector deserves separate treatment because it is itself a protective device. Its failure is dangerous and silent unless something checks the checker: a dead detector silences precisely the alarm the hazard analysis relies on, and it does so without any symptom at all. The FMEA rule that monitors carry their own failure modes like everybody else is nowhere more literal.
Its self-check runs at power-up, and the value of that placement is entirely a question of how often the pump is power-cycled. The latent exposure of a protective item checked every T hours is λT/2, and the sensitivity is brutal:
T = 2,500 h (annual service only): U = 120 × 10⁻⁶ × 1,250 = 1.5 × 10⁻¹
T = 24 h (a daily power cycle): U = 120 × 10⁻⁶ × 12 = 1.4 × 10⁻³
a factor of 104 between the two, bought with nothing but the frequency of an existing test. The design implication is that the self-check must be tied to the start of every infusion rather than to power-up alone, because a pump left switched on at a bedside for a week has not run its gate for a week.
What the analysis tells you to do
Three actions, in order. Make the battery check a capacity measurement and move the replacement age from 17,520 hours towards B10 at 9,030; that is one decision addressing 55% of the device's failure rate and the item most likely to fail during a mains interruption. Bind the air-in-line self-check to infusion start rather than to power-on, collapsing its test interval by two orders of magnitude at no hardware cost. Then work on the mechanism's 80%, which needs a loaded stroke rather than a free one and therefore a real design change rather than a firmware one.
The no-fault-found rate frames all three. Seventeen per cent of returned pumps test good, so if the 2,190 genuine failures are 83% of the stream, the bench sees about 2,640 units a year and roughly 450 healthy pumps make the trip. Most of that is setup error reported as device failure: the pump worked, the programming was wrong, and the ward returned equipment it had lost confidence in. The safety page finds about four fifths of the over-infusion hazard use-related, so the diagnostics are being asked informally to diagnose the human-device system, and no threshold change will fix that.
What a different technique would have given
The alternative is the traditional one in hospital equipment management: rely on the annual preventive service as the primary detection means and treat the power-on test as a convenience. Thirty minutes a year with proper test equipment reaches more modes than a five-second gate ever will, and on a mode-counted basis it would report better coverage.
The λT/2 arithmetic above shows what that trade actually costs. Detection interval, not detection reach, dominates for every protective and dormant function in the device, and moving the air-in-line check from a daily cycle to an annual visit multiplies its latent unavailability by 104. A weaker test run constantly beats a stronger test run annually whenever the item protects against an event that can arrive at any time, and on a bedside device that is nearly all of them. The annual service keeps its place for calibration and the checks that need reference equipment, and stops being asked to carry detection.