Infusion Pump Occlusion Alarm Delay Case Study

An infusion pump can deliver the correct programmed rate under normal conditions and still fail a clinically important alarm requirement. A downstream occlusion blocks flow to the patient while the pump continues to displace fluid into a compliant line. Pressure rises, stored volume accumulates, and the alarm may be delayed. If the occlusion is released without control, some stored volume can be delivered as a bolus.

This case study follows a design-review finding for a volumetric infusion pump used with a specific disposable administration set. The case is hypothetical and intended for engineering education. It shows how biomedical engineers connect pressure sensing, flow rate, line compliance, alarm latency, accumulated volume, usability controls, and verification evidence.

The central question is:

Does the pump meet the downstream occlusion alarm requirement for the intended low-flow therapy profile, or does line compliance make the alarm too late?

The answer depends on the installed fluid path, not only on the pump mechanism.

Case Context

The reviewed pump delivers medication through a disposable set with a pressure sensor upstream of the patient-side line. A downstream occlusion is simulated at the distal end of the administration set. The therapy profile in this review uses a low continuous flow rate.

Item	Value or requirement
Programmed flow rate	12\ \text{mL/h}
Baseline downstream pressure	15\ \text{kPa gauge}
Original occlusion alarm threshold	85\ \text{kPa gauge}
Disposable-set compliance near operating range	0.010\ \text{mL/kPa}
Alarm-processing and display latency	8\ \text{s}
Maximum allowed alarm time for this therapy profile	120\ \text{s}
Maximum allowed uncontrolled stored volume	0.50\ \text{mL}
Proposed revised alarm threshold	50\ \text{kPa gauge}
Proposed post-alarm rollback volume	0.10\ \text{mL}

The values are simplified for the case study. A real medical-device review must use the applicable intended use, risk management file, standard test methods, disposable-set variants, patient population, clinical workflow, software configuration, and regulatory evidence.

Pressure Rise Model

For a fully blocked downstream line, the pump displacement goes into elastic storage in the disposable set and fluid path. A first engineering screen is:

where:

• \Delta V is stored volume;
• C is line compliance;
• \Delta P is pressure rise above baseline.

The pump flow rate is:

With the original alarm threshold:

Stored volume at alarm threshold:

Pressure-rise time:

Add alarm-processing and display latency:

The predicted alarm time is longer than the 120\ \text{s} requirement. It also stores more than the 0.50\ \text{mL} uncontrolled-volume limit:

The original alarm setting should not be accepted for this therapy profile.

Test Observation and Model Check

The verification bench test records an alarm at:

The model error is:

Relative error:

That agreement is close enough for a screening calculation. It does not prove the model is complete, but it supports the conclusion that line compliance and low flow rate dominate the alarm delay.

The engineering comment is important: the problem is not a defective pressure sensor alone. The sensor may read pressure correctly, but the pressure takes too long to rise because the line stores volume.

Revised Alarm Threshold

The proposed correction lowers the downstream occlusion threshold to:

The pressure rise from baseline becomes:

Stored volume:

Pressure-rise time:

If firmware changes reduce alarm-processing and display latency to 2\ \text{s}:

The revised configuration passes the 120\ \text{s} alarm-time requirement:

The stored volume before the alarm is also lower:

False Alarm Margin

Lowering an occlusion threshold can create nuisance alarms if normal hydrostatic pressure, patient-position changes, line motion, pump pulsation, or sensor noise approach the new threshold. The engineering decision must check both missed occlusion and false alarm risk.

Assume the normal operating pressure contributors are:

Contributor	Conservative value
baseline pressure	15\ \text{kPa}
hydrostatic height variation	7\ \text{kPa}
pump pulsation allowance	4\ \text{kPa}
pressure sensor noise and quantization allowance	3\ \text{kPa}

Conservative normal high pressure:

Margin to the revised alarm threshold:

The threshold change has a reasonable pressure margin for this simplified case. If clinical workflow or disposable-set variation produces higher normal pressures, the threshold would need more evidence or a more adaptive detection method.

Post-Occlusion Bolus Screen

Stored volume is not automatically delivered as a bolus, but it is a credible hazard if the occlusion is released while the line remains pressurized. A conservative first screen treats stored volume as releasable unless the pump has an anti-bolus control.

Original configuration:

This exceeds the uncontrolled-volume limit:

With the revised threshold and a commanded rollback of 0.10\ \text{mL} after alarm:

The revised bolus screen passes:

The rollback feature must itself be validated. It should not create reverse flow that violates therapy requirements, introduce air-in-line risk, or restart infusion without a user action when the occlusion has not been resolved.

Engineering Decision

The original configuration should be rejected for this therapy profile. The decision basis is:

1. predicted alarm time is about 218\ \text{s};
2. observed alarm time is about 225\ \text{s};
3. the requirement is 120\ \text{s};
4. stored volume at alarm is about 0.70\ \text{mL};
5. revised threshold and lower latency reduce alarm time to about 107\ \text{s};
6. revised stored volume with rollback is about 0.25\ \text{mL};
7. false alarm margin remains positive under the stated normal-pressure assumptions.

The release decision should require software configuration control, disposable-set compatibility control, pressure-sensor calibration evidence, alarm usability validation, and a post-occlusion bolus test before the pump is released for the reviewed profile.

RPN Screen

A simple risk-priority-number screen documents the risk-control decision:

Before correction:

Factor	Value	Rationale
Severity S	8	Delayed occlusion detection can interrupt therapy and create bolus risk after release.
Occurrence O	3	Downstream occlusion is credible but not expected in every use.
Detection D	6	The failure can be missed if testing uses only high flow rates or low-compliance sets.

Initial risk priority number:

After revised threshold, lower latency, rollback, and validation across disposable-set variants:

Factor	Value	Rationale
Severity S	8	The clinical consequence remains serious if controls fail.
Occurrence O	2	Earlier detection and anti-bolus behavior reduce occurrence of hazardous exposure.
Detection D	3	Verification tests and production configuration checks make the issue easier to detect.

Contained risk priority number:

The RPN does not replace the device risk management file. It is a compact engineering summary of why the risk control is materially better after correction.

Validation Evidence

A defensible closeout package should include:

Evidence item	Why it matters
Occlusion alarm time test	Verifies that alarm time meets the therapy-profile requirement.
Disposable-set compliance characterization	Shows whether the tested set covers worst-case storage volume.
Pressure sensor calibration	Confirms that threshold decisions are based on valid pressure measurements.
Low-flow worst-case test	Demonstrates performance where pressure rises slowly.
False alarm challenge	Checks hydrostatic height, motion, pulsation, and sensor noise against the revised threshold.
Post-occlusion bolus test	Confirms stored volume and rollback behavior after release.
Software configuration record	Locks threshold, latency, alarm priority, and rollback behavior to the released version.
Usability validation	Confirms that users understand the alarm, stop condition, line check, and restart sequence.
Traceability matrix	Links hazard, requirement, design control, verification, validation, and release decision.

The validation plan should include the disposable-set combinations and flow-rate range that define the intended use. A pump that passes at 100\ \text{mL/h} can still fail at 12\ \text{mL/h} because pressure-rise time scales inversely with flow rate.

Engineering Lessons

The first lesson is that occlusion alarm delay is a system property. Pump displacement, line compliance, baseline pressure, sensor placement, firmware latency, threshold setting, and user workflow all matter.

The second lesson is that low flow rate is often the critical condition for alarm delay. Lower flow means slower pressure rise for the same compliance and threshold.

The third lesson is that lowering an alarm threshold is not automatically safe. It can reduce detection time while increasing nuisance alarms unless normal pressure variation is understood.

The final lesson is that bolus risk must be evaluated after alarm detection. Detecting the occlusion is not enough if stored volume can be delivered when the line is reopened.