Every drop accounted for.
How does an infusion pump know how much drug it has delivered, and why can a pump that works perfectly still give the wrong dose?
A key that counted twice.
On Friday 23 April 2010, Jeffrey Shuren, director of the Center for Devices and Radiological Health at the US Food and Drug Administration, used a meeting of the Association of Health Care Journalists in Chicago to announce what his agency called the Infusion Pump Improvement Initiative. The white paper behind it, dated April 2010, counted about 56,000 reports of adverse events with infusion pumps from 2005 to 2009, and 87 recalls, 14 of them in Class I, the category for problems that could cause serious harm or death. Citing market research, FDA put the number of external infusion pumps in US hospitals and other settings in 2006 at over two million.
The problems, the paper said, had been seen "across multiple manufacturers, pump types, and use environments". It named the most common types as software defects, user-interface issues, and mechanical or electrical failures, and gave examples of each. In one, a software fault called a key bounce made a pump occasionally register a single press of the zero key as two, so that "0" became "00". In others, a screen did not make clear whether a patient's weight was to be entered in pounds or in kilograms; alarms failed to sound when something went wrong, or sounded when nothing had; housings broke in routine use, batteries failed early, and pumps sparked or caught fire. FDA's reading was that many of these problems appeared "to be related to deficiencies in device design and engineering."
A week later, on 30 April 2010, FDA wrote to Baxter ordering it to recall and destroy the Colleague volumetric pumps then in use in the United States. Baxter had stopped shipping new Colleague pumps in July 2005, after recall notices over batteries and over the pump's user interface and failure codes, both later classed Class I. In October 2005 the government seized several thousand of its pumps in Northern Illinois, and in June 2006 Baxter signed a consent decree, a court-enforced agreement with the government. On 13 July 2010 a final order covered the Colleague pumps in American hospitals, about 200,000 by Baxter's count.
Few of the examples in the white paper described a pump that could not push fluid. They described a key that counted twice, a screen that left a unit unclear, an alarm that stayed silent and a battery that gave out. A pump can move fluid with great precision and still deliver a dose nobody ordered, because what it delivers depends on what it was told, on the line between it and the vein, and on everything inside it that is not the pumping mechanism.
Before we start.
An infusion is a drug or fluid given into a vein over time rather than all at once. The pump sits between a bag or syringe and a plastic tube, the administration set, that runs to a catheter in the patient's vein. The order a clinician writes is a dose: so many micrograms of a drug per kilogram of body weight per minute, or so many units an hour. The pump knows nothing of doses. It knows a rate, the volume to move each hour, and it reaches the dose only through numbers entered into it: the drug's concentration in the bag, the patient's weight, the rate. This guide asks two questions about that arrangement: how does an infusion pump know how much drug it has delivered, and why can a pump that works perfectly still give the wrong dose?
The short answer comes first, and the chapters justify it. A pump does not watch the drug leave. It counts the motion of its own mechanism, the steps of a motor or the turns of a screw, and converts that motion into milliliters through assumptions about the tube or syringe, the temperature, and a line that is neither blocked, leaking nor holding air. Sensors check some of those assumptions, and only after a delay. The answer to the second question follows from the first. Because the pump reaches the dose only through what it is told and through the line beyond it, a pump that moves its fluid exactly as designed can still give the wrong dose. The cause can be a decimal point in the wrong place, a concentration that does not match the bag, a drug that sits for an hour in tubing before it reaches the vein, or a second infusion on the same line that pushes the first one ahead of it.
Most infusion pumps never measure the drug they deliver. They infer the volume from how far their mechanism has moved, so every number on the screen rests on assumptions about the set, the line and the entry. A few newer pumps measure or monitor the volume moved through a chamber inside the pump, and even they do not measure the flow that reaches the patient. Every chapter comes back to this fact: the physics of the line in Part I, the mechanisms in Part II, the accuracy tests in Part III, the sensors in Part IV, and the people and software in Parts V and VI that supply the numbers the pump takes on trust.
A few everyday words carry a narrower sense here. A bolus is an extra amount given quickly on top of a steady rate. An occlusion is a blockage anywhere in the line, and free flow is fluid running by gravity with nothing controlling it. A drug library is a list, loaded into the pump, of drugs with their usual concentrations and safe dose limits; makers and hospitals call a pump that checks entries against one a smart pump. Other terms are defined where they first matter, and all of them are in the glossary.
Two cases recur. The thread is FDA's 2010 initiative, from the white paper and the Colleague recall to the guidance that followed in 2014 and the recalls of 2025 and 2026. The second case is the intensive care units of Mount Sinai Morningside in New York, which in 2020 moved infusion pumps outside the rooms of patients with COVID-19 and ran the lines to them through the doors. That decision tested nearly every assumption in the chapters on the line, on occlusion and on the hospital fleet.
How to read this guide
The 31 chapters run in nine parts. The first six work back from the line toward the order: the line, the mechanism, the measurement of accuracy, the sensors, the people who program the pump, and its software. Then come the pump as a system of devices from several makers, kept running by a hospital; the companies that make pumps; and finally the standards and regulators, as of October 2026. Chapter 25, at the end of Part VII, gathers the answer to the central question. Each chapter opens with a question left open by the one before and carries at least one solved example with real numbers. Plates are numbered on their own, so any one can be cited by itself. Four kinds of box recur:
Blue edge. Carries the structural point of a section, or a calculation worked once with real values and stated assumptions.
Orange edge. Names a common misreading, a trap, or the limit of a claim.
Green edge. Maps the idea onto the reader's own work: design, verification, the ward, the pharmacy or a regulatory file.
- Each chapter closes with what it established, in four lines.
Inside the plates, color is a legend and never decoration. Fluid and drug are violet, pressure and force gold, air red, software and data teal, and what people enter, including their errors, magenta. The measured readout is always blue, and one orange mark in each plate points at the detail that matters most. A key strip under every plate lists only the colors that plate uses.
This is a reference for understanding, not a protocol, a regulatory opinion or clinical advice. Drug doses, concentrations and pump settings in the examples illustrate the arithmetic and are not settings for any patient. Products, recalls and regulatory positions are stated as of October 2026 and will date; manufacturer figures are identified as such in the text. Cost, pricing and business strategy are outside its scope.
+ Part I · The line
Fluid, pressure and a vein.
One drop from a standard administration set is meant to hold 0.05 mL, because the set is built to give 20 drops per milliliter. A metrology laboratory that weighed drops of water from three such sets found them 2 to 5 % larger than that. Before any machine is involved, an infusion is a column of liquid, a length of tubing and a catheter in a vein, and each of them affects the dose. Chapter 1 follows the gravity drip, set by counting drops and turning a clamp, and shows why its rate drifts. Chapter 2 measures how catheters and extension tubing resist flow, and the pressure it takes to push fluid through them. Chapter 3 counts the volume that sits in the line between the pump and the vein, and the time a drug takes to cross it.
A drip is not a dose.
+ The questionHow did infusions run before pumps, and why could a nurse not trust the rate of a drip?
A wheel that pinches a tube
A roller clamp is a small plastic case clipped around the tubing of an administration set, with a wheel inside that rides along a sloping track and presses the tube against the case. Rolled one way, the wheel squeezes the tube shut; rolled the other, it lets the tube open again. Every rate a gravity infusion can run at lies between those two positions. Wherever there is no pump, this wheel is the only control on the line. Gravity supplies the push, the clamp supplies the resistance, and the nurse supplies the measurement, by watching drops fall and counting them against a watch.
The rest of a gravity infusion is just as simple. The bag hangs on a pole above the patient, a spike at the top of the set pierces it, and liquid runs into the drip chamber, a short clear cylinder in which it falls as separate drops from a small tip before pooling and continuing down the tubing, through the clamp, to the catheter. The drops are there to be counted. Each set is built so that a fixed number of drops makes one milliliter, its drop factor, stated on the package. A standard set is made for 20 drops per mL, so each drop should hold 0.05 mL. Sets with a finer tip are made for 60 drops per mL, about 0.017 mL a drop.
An order for a gravity infusion names a volume and a time, such as 1,000 mL over 8 hours. That volume to be infused, divided by the time, gives the rate, here 125 mL/h, and the drop factor turns the rate into something the eye can check: drops a minute. The nurse counts the drops falling in a measured interval and turns the wheel until the count is right. Nothing in this arrangement measures volume. The volume is inferred from a count and an assumed drop size. In its simplest form, this is the same kind of inference a pump makes from the motion of its mechanism.
Height supplies the pressure
What pushes the liquid is the weight of the column above the vein. Pressure in a liquid grows with depth, so the pressure at the catheter depends on how far the surface of the liquid in the bag sits above the vein, not on the size of the bag or the length of the tubing. This height is called the head. Water at 20 °C gives 1 mmHg for every 1.36 cm of head, so a bag whose liquid stands 80 cm above the vein drives the infusion with 58.8 mmHg. MHRA, the UK regulator, put the pressure from a hanging bag at about 110 mmHg, which corresponds to a head of about 1.5 m. MHRA issued that guidance on infusion systems in 2013 and withdrew it in September 2019.
Those are small pressures, and the vein pushes back against them with a pressure of its own, so the liquid flows only because of the difference between the two. Anything that changes either side changes the rate. As the bag empties, its liquid level falls and the head with it. If the bag is moved on its pole, or the patient raises the arm that holds the catheter, the height between bag and vein changes, and the drip slows or speeds with nothing on the set touched. A shift of 6 mmHg, about what a change of 8 cm in height produces, is a tenth of the 58.8 mmHg that an 80 cm head provides, and a larger share of what remains once the vein's own pressure is subtracted. Chapter 2 measures that back pressure.
A drop is not a fixed volume
A drop forms at the tip in the drip chamber and grows until its weight exceeds the pull of surface tension holding it there; then it falls. Its size therefore depends on the diameter of the tip, which the drop factor describes, but also on the liquid's surface tension and density and on how fast liquid feeds the growing drop. In a study presented at a measurement conference in 2013, a metrology laboratory weighed drops of distilled water at 20 °C from three sets made for 20 drops per mL and three made for 60. Averaged over the rates tested, the first three gave drops of 0.0512 to 0.0525 mL, between 2.4 and 5.0 % above the nominal 0.05 mL. The fine sets ranged from 1.1 to 13.2 % above their nominal volume.
The authors judged the sets against a tolerance they attribute to the infusion-set standard ISO 8536-4: 20 drops of water should make 1 mL within 0.1 mL, that is, within 10 %. One of the fine sets fell outside it, and one of the standard sets erred by more than 10 % at the lowest rate tested, 50 mL/h. All of these tests used water; the study tested no drug solutions. A drug solution with a lower surface tension than water would form smaller drops from the same tip, so a nurse counting the right number of drops would deliver less than intended. The count can be exact while the volume behind it is not.
The rate is 1,000 mL divided by 8 h, or 125 mL/h, which is 125 divided by 60, or 2.08 mL/min. With a set of 20 drops per mL, that is 2.08 × 20 = 41.7 drops a minute, set in practice as about 42. If each drop actually holds 0.0525 mL, as the drops from one set in the 2013 study did, the same count delivers 41.7 × 0.0525 × 60 = 131 mL/h, 5 % above the order, and the bag empties in 7 hours 37 minutes instead of 8 hours. If a 60-drop set is hung and counted as if it gave 20 drops per mL, each of the 41.7 drops holds 0.0167 mL, so the infusion runs at 41.7 × 0.0167 × 60 = 41.7 mL/h, a third of the order, and the bag lasts 24 hours. The count is the same in all three cases. Only the assumption about the drop changes, and the delivered volume changes with it.
The clamp creeps after it is set
Even with the right set and the right count, the rate does not stay where it was set. Where the tubing under the clamp is PVC, a plastic that keeps deforming slowly under a steady load, the pinched wall goes on creeping into the narrow gap after the nurse has walked away. Engineers call this slow deformation cold flow. An inventor's account in a US patent granted in 2012 describes its effect: the flow under a roller clamp falls after it is set, about half of the change happens within about 10 minutes and the rest over the following hour, and the largest percentage changes come at low flows. The same account says total variations of 10 to 20 % "are generally considered acceptable".
The account comes from the background section of a patent, not from a measured study, and no peer-reviewed measurement of clamp drift is known. The patent does not say how large the drift is: its 10 to 20 % is a tolerance for total variation from all causes, and it adds that "unacceptably higher flow rate variations have been observed". A fall of 10 to 20 %, the total variation the patent calls acceptable, would still take the 125 mL/h infusion of the solved example to between 100 and 112.5 mL/h. The drip that was counted correctly at the bedside is running slow by the time anyone looks again, and the largest relative errors fall on the slowest infusions. A drug whose effect depends on a steady rate cannot be given this way with any confidence, and that is the problem a pump addresses.
One count at set-up checks the clamp, the set and the head at that moment only. Cold flow under the clamp, the falling level in the bag, a change in the height of the bag or the arm, and the pressure in the vein all move the rate afterward, and no count can reveal a drop of the wrong size. Only the volume left in the bag, read against the clock, shows what has actually been delivered.
From counting drops to moving a volume
Some electronic devices kept the drop as their unit, counting the drops in the chamber automatically. IEC 60601-2-24 is the international safety standard for infusion pumps and controllers. A certifier's summary of its editions reports that the first, published in 1998, set a test rate for these drip-rate devices in drops, 20 a minute, alongside 25 mL/h for volumetric pumps. Counting by machine removes the miscount and the lapses of attention. It does not remove the uncertainty of the drop, because the device's milliliters are still drops multiplied by an assumed volume.
A volumetric pump abandons the drop. Most push a defined volume with each movement of their mechanism, a finger pressing on tubing or a screw advancing a plunger, and count movements instead. Chapters 4 and 5 describe these mechanisms, and Chapter 4 names the few exceptions. That takes the drop and the clamp out of the chain, and because the pump raises its own pressure until the fluid moves, the head and the vein's pressure matter much less. The inference remains, now resting on the bore of a tube or syringe, and every pump still delivers through the same line, whose resistance and volume Chapters 2 and 3 examine. The clamp stays on the set as the deliberate way to close the line, the "primary means of occlusion" in MHRA's guidance, for reasons Chapter 14 explains.
For a maker of administration sets, or of a device that converts drop counts into milliliters, treat the drop factor as a claim to be tested, not a constant. Weigh drops across the full range of rates the set will see, including the slowest, since the 2013 study found one standard set outside a 10 % tolerance only at its lowest rate. Test representative solutions as well as water, and state in the instructions the conditions behind the drop factor. A drop-counting device should show how its stated accuracy holds when drop size varies across the set's tolerance.
- A gravity infusion is pushed by the head of liquid above the vein, held back by the vein's own pressure and set by a roller clamp, while the nurse checks the rate by counting drops.
- A drop count gives volume only through the set's drop factor, and a 2013 laboratory study found drops of water 1.1 to 13.2 % larger than nominal, with two sets outside a 10 % tolerance in at least one test.
- Cold flow of the tubing under the clamp, the falling level in the bag and changes in height or venous pressure move the rate after it is set; a patent puts about half the clamp's drift in the first 10 minutes and treats 10 to 20 % total variation as acceptable.
- A volumetric pump takes the drop and the clamp out of the chain, but most designs still infer volume from their own motion, and every pump still delivers through the same line.
The line pushes back.
+ The questionWhat pressure does it take to push fluid through a catheter, and what does the vein push back with?
Flow follows pressure, divided by resistance
BD rates its 20-gauge catheter, 29.5 mm long, at 61 mL/min under gravity, its 18-gauge of the same length at 95 mL/min and its 16-gauge at 193 mL/min. A catheter here is the short plastic tube that stays in the vein and carries the infusion into it, and its gauge is a size number that runs backward: the higher the gauge, the narrower the bore. BD gives the bore of its 20 G catheter as 0.76 to 0.84 mm, of its 18 G as 0.94 to 1.02 mm and of its 16 G as 1.32 to 1.40 mm. A bore less than twice as wide carries about three times the flow, and the reason begins with how pressure, resistance and flow relate.
For a steady flow through a tube, the flow is proportional to the pressure difference between its ends and inversely proportional to a property of the tube called its resistance. Doubling the pressure doubles the flow, and doubling the resistance halves it. The relation is the same as the one between voltage, current and resistance in an electrical circuit, and as in a circuit, the resistances of parts joined end to end add. In the gravity drip of Chapter 1 the pressure is fixed by the head, so resistance decides the flow, and the roller clamp works by adding resistance.
A pump reverses the roles. It fixes the flow and lets the pressure rise to whatever the resistance of the line demands. MHRA, the UK regulator, put it in one sentence in its 2013 guidance on infusion systems, since withdrawn: "The pump detects any resistance to flow and increases the pumping pressure." For a pump, then, the useful question is how much pressure it must make to hold a rate, and at what pressure that effort becomes a sign that something is wrong. Answering it needs the resistance of each part of the line.
Why the radius counts four times
For smooth, steady flow in a narrow tube, the resistance is given by Poiseuille's law. It rises in proportion to the liquid's viscosity and to the length of the tube, and it falls with the fourth power of the radius. Halving the radius raises the resistance sixteenfold, so at the same pressure the narrow tube carries one-sixteenth of the flow. Length enters simply: a tube twice as long has twice as much wall dragging on the liquid, so it needs twice the pressure for the same flow. The fourth power comes from two effects of width that multiply.
Liquid touching the wall does not move, and each layer further in slides past its neighbor, so the speed rises from zero at the wall to a maximum on the axis. A wider tube has more area, in proportion to the square of its radius. It also has more liquid far from the wall, where the wall's drag is felt least, so under the same pressure the average speed across the tube also rises with the square of the radius. Flow is area times average speed, so it grows as the square times the square: the fourth power. The narrowest part of a line therefore dominates its resistance far more than its share of the length would suggest.
Viscosity is a liquid's internal friction, and it multiplies the resistance directly: a liquid twice as viscous needs twice the pressure for the same flow. It also changes with temperature. NIST's reference values for the viscosity of water are 1.00 mPa·s at 20 °C and 0.69 mPa·s at 37 °C, so at body temperature water is about 31 % less viscous than at room temperature, and the same pressure pushes about 45 % more of it through the same tube. The worked numbers in this chapter use water at 20 °C. Drug solutions have viscosities of their own, and Chapter 7 describes a pump that relies on viscosity to set its rate.
Resistances add along the line
If the catheter were the only resistance in BD's test, its ratings would follow the fourth power. The 16 G bore is 1.39 times the 18 G bore, taking the middle of each range, which predicts 3.7 times the flow; the ratings give 2.0 times. BD's 20 G catheter also comes in a 47.8 mm length, and Poiseuille's law predicts that the 29.5 mm version carries 1.62 times as much; the ratings give 61 against 54 mL/min, or 1.13 times. Something else in the test resists. A gravity test runs through a container, tubing and connectors as well as the catheter, and their resistances add to the catheter's in series, so the ratings spread far less than the catheters alone would predict.
BD's product pages do not state the conditions behind the ratings. A rating made with one head and one set does not carry over to another set, a long extension, a pump or a more viscous liquid, because the fourth-power law applies to the whole line and the catheter is only part of it. The ratings rank catheters within one maker's table; they do not give the flow of any particular line.
The same arithmetic shows how little a catheter resists at the rates pumps use. For the 20 G catheter alone, 29.5 mm long with a bore of 0.80 mm, the middle of BD's range, Poiseuille's law gives a pressure drop of 0.61 mmHg at 100 mL/h and 1.8 mmHg at 300 mL/h. Its gravity rating of 61 mL/min is 3,660 mL/h. At pump rates a peripheral catheter is a small part of the line's resistance. The parts that matter are long and narrow, the kind of tubing added when a pump must sit away from the bed.
What the vein pushes back with
The fluid enters a vein whose blood is under pressure, and the bag or the pump must exceed that pressure before anything flows. The pressure in a peripheral vein is neither fixed nor well predicted from elsewhere. In a 2023 study of 60 patients during high-risk abdominal surgery, pressure measured through an 18 G catheter at the elbow was compared with the central venous pressure, the pressure in the large veins near the heart. The two agreed only loosely: the 95 % limits of agreement, the range expected to hold 95 % of the differences between paired readings, ran from about 6 mmHg one way to 9 mmHg the other. For the gravity drip of Chapter 1, driven by 58.8 mmHg from an 80 cm head, an uncertainty of that size in the back pressure is a tenth or more of the push. For a pump, such uncertainties are small beside the pressure it can make.
Pumps push much harder, up to a limit. The occlusion limit, the subject of Chapter 12, is the pressure at which a pump stops and alarms on the assumption that the line is blocked. BD states that the limit on its Alaris Pump Module can be set from 50 to 525 mmHg, with a ceiling of 525 mmHg at 30 mL/h and above and lower ceilings below it. Fresenius Kabi states 50 to 750 mmHg for its Agilia VP MC. The limit must sit above what the line itself needs: MHRA's guidance worked an adult example in which the pressure drops along the line add to 141 mmHg, and a neonatal one in which they add to 22 mmHg.
Long extensions meet the pressure ceiling
An extension set is a length of tubing added between the administration set and the catheter. BD classes extension tubing with a bore under 2 mm as microbore. Its 213 cm microbore extension has a priming volume, the fluid needed to fill it, of 0.7 mL, which implies a bore of about 0.65 mm: narrower than the 20 G catheter and more than seventy times as long. By the fourth-power law such a tube resists far more than the catheter at its end. ECRI, a device-evaluation organization, issued a COVID-19 alert on long extension sets on 1 April 2020. In it, ECRI reported that its laboratory, testing 20 ft of microbore tubing, saw "frequent occlusion alarms, which made the pump unusable" at 300 mL/h.
The bore comes from the maker's volume: 0.7 mL is 700 mm³, spread along 2,130 mm, a cross-section of 0.3286 mm². A circle of that area has a radius of 0.3234 mm, a bore of about 0.65 mm. The flow, 300 mL/h, is 300,000 mm³ in 3,600 s, or 83.33 mm³ a second. Poiseuille's law gives the pressure drop as 8 × viscosity × length × flow, divided by 3.142 × radius to the fourth power. With water at 20 °C, 1.0016 mPa·s, that is 8 × 1.0016 × 2,130 × 83.33 = 1,422,000, divided by 3.142 × 0.01094 = 0.03437, which gives 41,380,000 mPa, or 41,380 Pa. Divided by 133.3 Pa per mmHg, that is 310 mmHg; at 100 mL/h it would be a third as much, 103 mmHg. Two extensions in series double the length and the pressure, to about 620 mmHg at 300 mL/h, above the 525 mmHg ceiling BD states for its pump module. That pump would alarm for occlusion with nothing blocked. The calculation uses BD's published tubing geometry; Mount Sinai did not name its tubing. The priming volume includes the connectors, so the true bore is, if anything, narrower and the pressure higher.
The intensive care units of Mount Sinai Morningside, whose long lines Chapter 3 describes, met the problem in 2020: they raised their occlusion limits from 300 to 500 mmHg and warned of false occlusion alarms at high rates. If the tubing matched BD's microbore geometry, the arithmetic shows why: a line that needs hundreds of millimeters of mercury just to flow leaves little room below the ceiling. Raising the limit restores that room at high rates, at a cost that falls on low rates, where the pump must build a higher pressure before it alarms. Chapter 3 follows that line through the door, and Chapter 12 measures the cost.
For a biomedical engineer asked to support long lines, compute the pressure the tubing needs at the highest rate that will run through it, from each maker's length and priming volume, and compare it with the pump's ceiling at that rate. Where the sum comes close to the ceiling, expect nuisance occlusion alarms at high rates. Where the limit is raised to prevent them, check what the higher limit does to the time a pump takes to detect a real blockage at low rates (Chapter 12). Record the tubing, rates and limits chosen, so that a later investigation can reconstruct them.
- A gravity drip has a fixed pressure and lets resistance set the flow, while a pump fixes the flow and raises its pressure until the line's resistance is overcome.
- Resistance rises with length and viscosity and falls with the fourth power of the radius, so halving a tube's radius raises its resistance sixteenfold.
- Resistances in series add, which is why BD's catheter ratings spread less than the fourth-power law predicts and why a peripheral catheter barely resists at pump rates.
- Calculated on BD's tubing geometry, one 213 cm microbore extension needs about 310 mmHg at 300 mL/h, so two in series exceed a 525 mmHg pump ceiling, consistent with ECRI's alarms and Mount Sinai's raised limits.
Drug the patient has not yet received.
+ The questionWhy does a change at the pump take minutes, sometimes hours, to reach the patient?
Pumps outside the room, lines through the door
In 2020 the intensive care units of Mount Sinai Morningside in New York moved the infusion pumps of patients isolated with COVID-19 out of their rooms and ran the lines to them through the doors. A brief report published on 30 July 2020 set out how. Each line gained two 210 cm "microbore transducer extensions", in the paper's words, passed through the gap between double doors rather than under a door. A second identification band was taped inside the glass of the door so that the patient's barcode could still be scanned from outside. Chapter 2 showed what that length of narrow tubing does to the pressure a pump must make, and why the team raised its pumps' occlusion limits.
The paper also stated the cost in volume: "Transducer extension tubing adds approximately 20 mL of circuitry." Before connection, the lines were flushed with a priming volume that the paper estimated at about 30 mL. To keep drugs moving through that circuit, the lines ran a carrier, a plain fluid infused continuously into the same line to push the drugs along, started at 50 mL/h and later individualized down to a minimum of 10 mL/h. The report listed the limits of the arrangement as well: rates above 300 mL/h could set off false occlusion alarms, rates below 5 mL/h could delay real ones, and the pumps could detect a blockage but not a disconnection. It named no pump and measured no patient outcomes.
The drug moves only as fast as the fluid behind it
Every infusion line holds fluid between the point where a drug enters it and the tip of the catheter. That fluid is the line's dead volume for that drug, and the drug cannot reach the vein until the fluid ahead of it has been pushed out. To a first approximation, liquid in a narrow tube at infusion rates moves in plug flow: what enters first leaves first, with some smearing at the front because, as Chapter 2 showed, liquid near the axis moves faster than liquid near the wall. The time a change takes to cross the line is then the dead volume divided by the total flow through it, the transit time. Nothing the pump does alters that arithmetic except the flow itself. A drug running at 2 mL/h on its own through 20 mL of line takes 10 hours to arrive.
The patient therefore receives whatever is in the line, at the rate the line delivers it, not what the pump is set to. When a nurse titrates a drug, adjusting its rate step by step to hold a measured effect such as blood pressure, each new rate reaches the vein one transit time later, and until then the old one continues. A carrier shortens the delay because it adds to the total flow: the drug joins a faster stream. It also ties the drug's delivery to the carrier, since drug already mixed into the line arrives as fast as the carrier pushes it, and Chapter 11 shows the surges and gaps that follow when a carrier's rate is changed.
Transit time is the dead volume divided by the total flow. The dead volume is the paper's 20 mL; the drug rate of 2 mL/h is chosen for illustration. With the carrier at 50 mL/h, the total flow is 52 mL/h, and 20 divided by 52 is 0.385 h, about 23 minutes. With the carrier at its 10 mL/h minimum, the total is 12 mL/h, and 20 divided by 12 is 1.67 h, or 1 hour 40 minutes. With no carrier, the drug alone at 2 mL/h takes 20 divided by 2, or 10 hours. If the line held 1.4 mL instead, the volume BD gives for two of its 213 cm microbore extensions, the same three cases would take about 1.6, 7 and 42 minutes. At the minimum carrier rate, a new drug rate set outside the door would reach the patient 1 hour 40 minutes later, if the paper's 20 mL is right.
The number on the screen changes the moment the nurse confirms it. The vein sees the change one transit time later, and meanwhile the drug in the line keeps arriving at the old rate. The same holds when a drug's pump is stopped while a carrier keeps running: the drug already in the shared line goes on reaching the patient until the carrier has flushed it through.
A volume that does not fit the tubing
The paper's 20 mL is hard to reconcile with the tubing it names. BD, one maker of such tubing, gives its 213 cm microbore extension a priming volume of 0.7 mL, so two would hold about 1.4 mL. Holding 20 mL in 420 cm takes a bore of about 2.5 mm, and BD classes tubing as microbore only below 2 mm. The paper is not consistent on length either, describing the tubing elsewhere as "six feet", or 183 cm, against two lengths of 210 cm. Either its 20 mL covers more of the circuit than the two extensions, or the tubing was wider than microbore. The 20 mL stands in the chapters that follow as the paper's own figure, with the smaller volume beside it.
The two figures differ by a factor of about 14, and transit time scales with whichever is right. At the 10 mL/h minimum carrier and a 2 mL/h drug, 1.4 mL is crossed in about 7 minutes and 20 mL in 1 hour 40 minutes. Norepinephrine, a drug infused to raise blood pressure, has a half-life of about 2.4 minutes according to its FDA-approved label: in that time the body clears half of it from the blood. The label adds that its effect on blood pressure stops within 1 to 2 minutes after the infusion stops. Both delays are long beside these times. Chapter 10 returns to drugs this short-lived. ECRI's alert of 1 April 2020 advised that pumps for vasopressors and other drugs titrated to effect stay in the room (Chapter 12). Vasopressors are drugs, such as norepinephrine, that raise blood pressure.
Carrier flow trades delay for fluid
A faster carrier is the obvious remedy, and Mount Sinai's two settings show its price. A carrier at 50 mL/h delivers 1,200 mL of fluid a day; at 10 mL/h it delivers 240 mL. Lowering the carrier from the first rate to the second cuts that fluid to a fifth and, by the arithmetic of the solved example, multiplies the transit time through 20 mL by more than four, from about 23 minutes to 1 hour 40 minutes. No carrier rate removes the trade, because the delay falls only as the fluid rises. The team also flushed 20 mL of saline through after drugs that contained dextrose, so even the flushes added volume that the patient received.
The carrier also changes what each drug does in the line. Once a drug joins a carrier, it is diluted in the line by the ratio of its own rate to the total flow, and the patient receives that mixture at whatever speed the total flow sets. A change in the carrier is then a change in the dose of every drug already mixed into it, for one transit time, even though no drug pump has been touched. Chapter 11 measures those effects in lines that share a catheter. Here the point is narrower: a long line makes the delay longer, and a carrier that shortens it makes the drug's delivery depend on a second pump.
Real lines are slower than the arithmetic
Plug-flow arithmetic gives the shortest possible delay, not a forecast. A 2020 bench study modeled a neonatal epinephrine infusion: the drug at 0.2 mL/h from a syringe pump joined a 5 mL/h carrier and crossed an extension with a priming volume of 0.4 mL. The formula gives 0.4 mL divided by 5.2 mL/h, about 4.6 minutes. The measured mean times for the drug to reach its target concentration were 30, 21 and 46 minutes with 3, 10 and 60 mL syringes, with wide spreads, and the drug column stalled in 3 of 7 runs with the 10 mL syringe and 3 of 4 with the 60 mL one. The authors also saw fluid flow backward at the connector.
The extra delay belongs to the pump and the line together: a syringe pump's slow start and the give in the syringe and tubing, their compliance, add to the time the plug needs (Chapters 5 and 10). The abstract of a 2022 bench study of lag times concludes that peristaltic and syringe pumps are "similarly susceptible to dead volume effects", so the delay is a property of the line more than of one kind of pump. Mount Sinai's report measured no delays at all. Its remote pumps return in Chapter 12, where the same long line slows the detection of a blockage, and in Chapter 24, which follows what the arrangement asked of the hospital's fleet.
For a pharmacist or an intensive care team planning infusion lines, list every component between the point where each drug enters and the catheter tip, add their priming volumes from the makers' instructions, and divide by the total flow to get the transit time at the rates in use. Compare it with how quickly the drug's effect must follow a change, and favor joining titrated drugs close to the catheter, where the volume downstream of the junction is smallest. Treat the result as the shortest delay possible, since pump start-up and compliance add to it. Where a remote pump makes the delay too long for a drug, keep that pump at the bedside, as ECRI advised in 2020.
- A drug reaches the vein only after the fluid ahead of it has been pushed out, so a change at the pump arrives one transit time later, the dead volume divided by the total flow.
- Mount Sinai's remote pumps added two 210 cm microbore extensions and, by the paper's figure, about 20 mL of circuitry, which at a 10 mL/h carrier and a 2 mL/h drug means 1 hour 40 minutes for a new rate to arrive.
- The paper's 20 mL does not fit microbore geometry, in which two such extensions would hold about 1.4 mL by BD's figures, and transit time scales directly with whichever volume is right.
- A carrier shortens the delay at the cost of fluid and of tying the drug to a second pump, and real lines are slower than the plug-flow arithmetic because pump start-up and compliance add to it.
+ Part II · Mechanisms
Machines that push.
A large-volume pump with its door open shows how little it knows. Inside runs a row of fingers, and pressed into a channel across them lies a short length of the set's tubing, threaded from the bag above to the patient below. When the door closes, the fingers squeeze the tube in a moving wave, and the motor that drives them counts its own steps. Nothing in the pump looks at the drug. The milliliters on its screen are that count multiplied by a volume the pump assumes for each step. Part II takes each way of moving a measured volume in turn: the peristaltic and cassette pumps at the hospital bed, the syringe pump of intensive care, the ambulatory and patient-controlled pumps that go to the ward and home, and the elastomeric pump that has no motor at all. For each one it asks what the pump assumes.
Fingers on a tube.
+ The questionHow does a large-volume pump turn motor steps into milliliters, and why do some pumps use a molded cassette instead of the tubing?
A fixed volume for every wave
A large-volume pump, also called a volumetric pump, is a pump that draws fluid from a bag through an administration set and delivers it at a programmed rate by displacing a known volume with each movement of its mechanism. Chapter 3 showed that the line beyond the pump holds drug the patient has not yet received. This chapter steps back to the pump itself, and to how it decides how much it has sent into that line. The short answer is that it does not measure the fluid. It moves its mechanism by a counted amount and multiplies the count by a volume fixed when the pump was designed, so the milliliters on its screen are a calculation about the tubing in its door.
FDA describes the peristaltic mechanism in one sentence: a set of rollers pinches down on a length of flexible tubing and pushes the fluid forward. In the rotary form the rollers sit on a turning wheel. Other pumps use a linear form, a row of fingers that press a straight section of the set against the door one after another, so that the closed point travels along the tube. Fresenius Kabi calls one of its pumps linear peristaltic, and BD calls the mechanism of its Alaris Pump Module linear and positive displacement. At least one finger is closed at every moment, which is why a loaded set cannot run freely; Chapter 14 deals with a set that comes out.
Each wave pushes the volume of tube under the fingers: the cross-section of its bore times the squeezed length, less whatever the tube fails to refill before the next wave. The pump measures none of these. Its software holds a volume per wave, fixed when the pump and its set were designed and tested together, and reaches any programmed rate by choosing how many waves to make each hour. The same figure drives the counters on the screen. A nurse programs the volume to be infused, the amount to give before the pump stops or drops to a slow keep-vein-open rate that keeps the catheter from blocking. The pump counts that volume down by subtracting what it believes each wave has moved.
An illustrative pumping segment has a bore of 3.0 mm and is squeezed over a length of 30 mm; the figures are assumed for illustration, not taken from any maker. The cross-section is 3.1416 × 1.5 mm × 1.5 mm = 7.07 mm², and the volume under the fingers is 7.07 × 30 = 212 mm³, which is 0.212 mL per wave. To deliver 125 mL/h the pump makes 125 ÷ 0.212 = about 590 waves an hour, nearly 10 a minute. A tube with a bore 2.5 % wider, 3.075 mm, has a cross-section larger by the square of that ratio, 1.025 × 1.025 = 1.0506, so each wave moves 0.223 mL. The pump still makes 590 waves an hour and still shows 125 mL/h, but it delivers 590 × 0.223 = about 131 mL/h, 5 % more than the screen says. Over 24 hours that is about 3,150 mL against the 3,000 mL on the screen.
The tube changes as it works
Tubing does not keep its shape. A 2015 patent from Baxter, a maker of peristaltic pumps, describes the problem in the company's own words: repeated squeezing breaks down the tube so that it "no longer fully re-opens to its original shape", which lowers the volume per wave and raises the percentage error the longer the set is pumped. Sets are typically used for 72 to 96 hours, and the patent gives 5 % as an example of an error it treats as unacceptable. Its remedy is not a sensor: the pump corrects its wave rate from a table of how such tubing usually ages. In the patent's example, the correction starts about 24 hours into a 72-hour set running at 125 mL/h.
A later Baxter patent, granted in 2021, reports that tubing wear tracks the volume pumped better than the time elapsed. In the company's tests at 25, 125 and 400 mL/h, run for up to 72 hours or 12 L, the accuracy measured at the three rates differed by up to about 10 % when compared at the same elapsed time, but by only about 3.5 % when compared at the same volume pumped. The tube wears with each squeeze rather than each hour, so, on the patent's reasoning, a set that has pumped 9 L should have aged alike whether that took 72 hours at 125 mL/h or about 9 hours at 999 mL/h, a rate the tests did not reach. Baxter's 2025 summary of its premarket notification, or 510(k), for the SIGMA Spectrum pump states that accuracy holds for up to 96 hours or 12 L. A 510(k) is the file a maker submits to FDA to compare a new or changed device with one already legally sold, and FDA's finding that the two are substantially equivalent is called clearance (Chapter 28). The pump knows the volume pumped only from its own count, so the wear correction relies on the same inferred volume that it is meant to correct.
A pump's accuracy figure is measured with a particular set, fluid and temperature. The pump supplies the count and the set supplies the volume per count. A set from another source, a set used beyond its stated hours or liters, or a pumping segment of a different material can shift the volume per wave by several percent while the screen shows the programmed rate. Chapter 8 shows one maker's two figures for the same pump.
The set and the mechanism can also fail together in ways no table anticipates. In July 2025 Baxter began a Class I correction of its Novum IQ large-volume pump, which could underinfuse after a large rate increase; misloading of the set was also implicated. Chapter 31 opens with this correction. A wear-correction table assumes a set seated where the design expects it and a rate that changes gradually, so it says nothing about either failure.
A cassette carries its own chamber
The other answer to an unreliable tube is to stop pumping on the tube. In a cassette pump each set includes a rigid molded piece, the cassette, that the pump grips. Two Abbott patents of 1989 and 1995, the second naming the company's LifeCare 5000 system, describe the principle. A plunger in the pump pushes an elastomeric diaphragm into a pumping chamber molded in the cassette, other parts of the same diaphragm act as inlet and outlet valves, and the plunger withdraws by the same number of steps it advanced to let the chamber refill. The chamber and diaphragm, in the 1995 patent's words, define "a predetermined volume and maximum possible displacement".
The stroke volume is then set by a molded chamber and a plunger's travel rather than by the bore and springiness of an extruded tube, and the molding can carry other parts. ICU Medical's Plum 360, first cleared by FDA in January 2015 as a Hospira product, has a proprietary cassette with its own pumping chamber in every set. The maker's manual describes an air trap in the cassette that holds 1 mL of air before the pump alarms, with air sensors above and below it. A secondary infusion is a second container delivered through the same pump and set, usually a limited volume, after which the pump returns to the primary infusion, the one that runs continuously (Chapter 11). ICU Medical's catalogue describes a secondary line that joins the Plum 360's cassette directly, so that two compatible drugs can run at independent rates through one line.
Every set must carry a cassette, so the pump runs only on its maker's sets, and the principle the patents describe is unchanged: the pump counts plunger steps and trusts the chamber to have filled. How fully the chamber fills depends on conditions such as the height of the bag above the pump, which is why the maker's accuracy figures, set out in Chapter 8, name them.
Two pumps that measure the chamber
A few pumps close the loop. FDA cleared the Ivenix large-volume pump on 7 June 2019, and Fresenius Kabi has sold it since 2022. It drives a diaphragm with air instead of a plunger. Negative air pressure fills an intermediate pumping chamber and positive pressure empties it, and because the drive is a gas, the pump can work out how much the chamber's volume changed. Its 510(k) summary names the ideal gas law: at constant temperature, the pressure of a fixed amount of gas times its volume stays the same, so pressures read against a known reference volume give the chamber's volume. The pump adjusts its drive pressure, or a variable fluidic resistor, to hold the rate; the company claims ±5 % from 0.5 to 1,000 mL/h.
As an illustration, 1.00 mL of air at 100 kPa squeezed until it reads 120 kPa must occupy 100 ÷ 120 of its former volume, 0.833 mL. The air has therefore shrunk by 0.167 mL, a change found from two pressure readings without counting steps. DEKA's RemunityPRO+, cleared on 24 July 2026, delivers one drug subcutaneously, under the skin rather than into a vein, and uses acoustic volume sensing instead; its 510(k) summary describes the sensor as feedback for monitoring delivery accuracy (Chapter 6). The Ivenix pump measures the volume that left its chamber and DEKA's sensor monitors delivery, but neither measures the flow that reaches the patient. A leak, a disconnection or a line still filling with drug (Chapter 3) lies beyond the chamber, and a measured stroke can still carry the wrong concentration. The exceptions narrow the rule set out in "Before we start" without removing it.
For a maker developing a large-volume pump, in India or anywhere else, the pumping segment is a measuring part. Specify its bore, wall and material with tolerances derived from the volume per wave, and qualify every tubing supplier against them, because a bore 2.5 % off delivers about 5 % off. Test accuracy across the set's whole stated life, in liters pumped as well as in hours, at low, intermediate and high rates (Chapter 9), and print that life in the instructions. If hospitals may load sets made by others, test those sets or exclude them in the labeling, and treat a change of tubing supplier as a design change.
- A peristaltic pump never measures the fluid: it counts waves of its fingers and multiplies by a volume per wave that depends on the bore and recovery of the tube in its door.
- Because volume goes with the square of the bore, a tube 2.5 % wider delivers about 5 % more, and a tube that wears refills less fully, so the set is part of the pump's accuracy.
- A cassette moves the volume into a molded chamber with its own valves, air trap and secondary inlet, but the pump still counts plunger steps.
- The Ivenix pump measures its chamber with the gas law and DEKA's RemunityPRO+ uses an acoustic sensor, yet neither measures the flow that reaches the patient.
A screw and a plunger.
+ The questionHow does a syringe pump deliver 0.1 mL an hour to a newborn, and what makes it stall and then surge?
A screw turns steps into distance
A 50 mL syringe emptied at 0.1 mL/h lasts 500 hours, nearly three weeks, and the pump must move its plunger too slowly for the eye to see. Chapter 4 showed that a peristaltic pump depends on the bore and springiness of a tube. A syringe pump takes the tube out of the calculation: it clamps a filled syringe in place and drives the plunger forward with a carriage on a screw. Smiths Medical's 2017 guide to its Medfusion 3500 gives a lowest rate of 0.01 mL/h with 1 mL syringes, and Baxter's 2022 specification for its Novum IQ syringe pump gives a range of 0.01 to 1,200 mL/h. Each rate comes from turning the screw by a counted amount.
The motor is a stepper motor, which turns through a fixed angle each time its driver sends a pulse. Ossila, which makes laboratory syringe pumps, gives typical figures on an undated web page: a step of 1.8 degrees, or 200 steps a turn, driving a lead screw, a threaded rod whose nut and carriage advance a fixed distance for each turn. A screw cut with four interleaved threads 2 mm apart advances 8 mm a turn, so each step moves the plunger 0.04 mm. Drivers can also divide each step into microsteps, commonly 1/32 or 1/64 and sometimes 1/256, though at 1/64 the torque for one microstep is under 2.5 % of the maximum. These are laboratory figures, and the step sizes of clinical pumps are not known.
Distance becomes volume through the bore of the barrel. The volume pushed out equals the barrel's inside cross-section times the plunger's travel, so the pump has to know which syringe it holds. It looks the bore up in a table of syringes its maker has tested, after the user confirms the brand and size, and some pumps also sense the syringe's size. The pump's knowledge of the volume delivered therefore rests on two numbers it never measures during the infusion: the distance its screw has moved, counted from motor steps, and the bore it was told.
The illustration assumes a 50 mL barrel with an inside cross-section of 5.5 cm², which is 550 mm² and about 26.5 mm across; makers publish exact bores only in their pumps' syringe tables. With the laboratory figures above, one full step moves the plunger 0.04 mm and pushes out 550 × 0.04 = 22 mm³, or 22 µL. One microstep at 1/64 moves 0.04 ÷ 64 = 0.000625 mm and pushes out 550 × 0.000625 = about 0.34 µL. A rate of 0.1 mL/h is 100 µL/h, so the plunger travels 100 ÷ 550 = 0.18 mm an hour. In full steps that is 100 ÷ 22 = 4.5 steps an hour, a pulse of 22 µL about every 13 minutes. In microsteps it is 100 ÷ 0.34 = about 290 an hour, one every 12 seconds or so. Microstepping turns a pump of pulses into one that flows.
The syringe is part of the calibration
Because the cross-section grows with the square of the diameter, the arithmetic of Chapter 4 applies again: a barrel 3 % wider than the table assumes delivers about 6 % more for every millimeter of travel. A syringe of one brand selected as another, or a brand the pump was never tested with, changes the dose while the plunger moves exactly as commanded. BD, which makes syringes, states in a 2021 brochure that syringes not validated for a pump, or a wrong syringe type selected on it, have produced over-delivery of more than 20 %. The same brochure cites FDA's advice to choose the smallest compatible syringe for high-risk drugs at rates below 5 mL/h. Makers' accuracy figures for syringe pumps are often tighter than those for large-volume pumps, and hold only with the syringes and rates they name (Chapter 8).
Slack to take up before the drug flows
When a syringe pump starts, the plunger moves at once and the drug does not. Before fluid leaves the far end of the line, the drive must take up the play in its gears and nut and overcome the friction of the stopper in the barrel, and the stopper, the barrel and the tubing must be squeezed and stretched until the pressure inside can push fluid through the catheter. The property that stores this volume is compliance, the volume a syringe or line takes up for each unit of pressure. A 2015 study by metrology institutes measured 0.21 mL per bar for a 10 mL syringe and 1.54 mL per bar for a 50 mL syringe, about seven times as much, and more again with a filter in the line. One bar is 750 mmHg, so at an occlusion limit of 500 mmHg the 50 mL syringe stores about 1 mL.
Bench studies show how long that slack takes to fill. In a 2007 study of one syringe pump with two brands of syringe, the time to reach the set flow ranged from 3.6 minutes for a 10 mL syringe at 1 mL/h to 74.5 minutes for a 50 mL syringe at 0.1 mL/h. Start-up was slower at the lower rate, with the larger syringe and with one brand, and the authors attributed it to gear engagement in the drive and compliance of the syringe assembly. A 2020 study of seven current pump and syringe combinations at 1 mL/h found 89 to 1,622 seconds, about 1.5 to 27 minutes, before flow was steady. Its authors traced the low-rate problems mainly to the working principle of the syringe pump.
A syringe pump counts volume from the first step of its motor, so in the first minutes at a low rate it reports drug that is still being stored in the syringe and line. With a 50 mL syringe at 0.1 mL/h, the set flow may not arrive for more than an hour. A slow response read as a drug that has failed, and answered with a higher rate or a second drug, can stack doses on a line that has not yet delivered the first.
The slack can be taken up before the infusion starts. A 2022 nursing study timed the first drop reaching a balance for two unnamed pumps with a 50 mL syringe and a 150 cm line. At 1 mL/h, with the line primed by hand, the first drop took 25.5 minutes with one pump and 34.7 with the other; when the pump's own priming bolus was given after the syringe was loaded, it took 0.2 and 3.0 minutes. At 0.3 mL/h the times fell from 74.2 and 97.7 minutes to 6.7 and 19.3. At 20 mL/h, primed by hand, the first drop came in 0.9 minutes with either pump. Priming by hand fills the line but leaves the drive's play and the syringe's compliance for the infusion to take up.
Stall and surge come from the same stored volume
Compliance does more than delay the start: whatever volume the syringe and line take up under pressure they give back when it falls, so anything that raises the pressure makes delivery stall and anything that lowers it makes delivery surge. In a blocked line the plunger keeps advancing and the syringe absorbs drug until the pressure reaches the alarm limit, which with a 50 mL syringe at 1 mL/h can take about an hour; Chapter 12 shows that the syringe's compliance accounts for most of that hour. When the block clears, the stored volume comes out at once, and Chapter 12 gives the volumes measured on release. Height works the same way. Lowering a syringe pump below the patient raises the pressure the syringe must hold, so delivery pauses while its compliance fills, and raising it releases a bolus. Chapter 10 follows height changes and syringe changeovers through drugs whose effect fades within minutes.
FDA warned in August 2016 of flow-continuity problems with syringe pumps below 5 mL/h (Chapter 10). The newborn of this chapter's question is the patient for whom start-up, stall and surge matter most. The newborn's rates are the lowest, and in the 2020 study of seven assemblies, which modeled a newborn's epinephrine infusion, the occlusion-alarm delays and the flow irregularities after height changes gave deviations of more than 25 % in the simulated level of the drug in the blood with every assembly.
For biomedical engineers and pharmacists: configure each pump's syringe table to the brands and sizes the hospital stocks and remove the rest, so that nobody can confirm a syringe the pump was not tested with, and review the table whenever purchasing changes supplier. For drugs below 5 mL/h, agree the smallest syringe that holds the dose and a concentration that keeps the rate up, as one pediatric unit did (Chapter 10). Teach priming with the pump after loading, and keep the pump level with the patient during transfers.
- A syringe pump turns motor steps into plunger travel with a lead screw and into volume through the bore of the syringe, so microstepping sets how smooth a low rate is and the syringe table sets how large it is.
- A syringe of another brand or size than the one selected changes the dose while the plunger moves as commanded, and makers' tight accuracy figures hold only with the syringes and rates they name.
- At low rates the plunger runs ahead of the drug while the play in the drive and the compliance of syringe and line are taken up, for more than an hour with a 50 mL syringe at 0.1 mL/h, and priming with the pump shortens the wait.
- The same stored volume makes delivery stall when pressure rises and surge when it falls, after a blocked line clears or the pump is moved in height.
Pumps that leave the bedside.
+ The questionHow do ambulatory and patient-controlled analgesia pumps limit what a patient can give, and where do insulin pumps fit?
A button, a lockout and a limit
A patient-controlled analgesia pump, used for pain relief, gives a patient in pain a dose of a strong opioid, a morphine-like painkiller, whenever the patient presses a button. The arrangement is safe only as long as nobody else presses it. The pump supplies half of that safety and the patient the other half. The large-volume and syringe pumps of Chapters 4 and 5 do only what a clinician has programmed. A patient-controlled analgesia (PCA) pump also takes requests from the patient, and its software decides which to honor. Each press of the handset delivers a fixed demand dose; a press during the lockout interval that follows a dose is refused; and a limit over one or four hours caps the total. Some orders add a continuous basal rate beneath the demand doses.
One health system's standard adult order set, the Alberta Health Services form of October 2020, shows typical numbers for morphine at 5 mg/mL: demand doses of 0.5, 1, 1.5 or 2 mg, lockouts of 10, 8 or 6 minutes, a suggested start of 1 mg every 6 minutes, a 4-hour limit of 30 mg, and no basal rate. Its hydromorphone and fentanyl orders follow the same pattern at 1 mg/mL and 25 mcg/mL. A 2017 review in US Pharmacist gives similar starting doses for adults new to opioids, morphine 1 mg, hydromorphone 0.2 mg and fentanyl 20 mcg, but a longer lockout for morphine, 10 to 15 minutes. Protocols differ on the lockout; the arithmetic of what any lockout allows is the same.
The Alberta order's suggested start is morphine at 5 mg/mL, 1 mg a press, a 6-minute lockout and a 4-hour limit of 30 mg. One dose is 1 ÷ 5 = 0.2 mL. The lockout allows at most 60 ÷ 6 = 10 doses an hour, so 10 mg, or 2 mL, an hour. Over 4 hours the lockout alone would allow 40 doses, 40 mg; the limit stops delivery at 30 mg, so the 31st press is refused even though its lockout has passed. A patient pressing at every opportunity reaches the limit after 30 doses, 3 hours of pressing, and further presses in that 4-hour period deliver nothing. If a visitor presses while the patient sleeps, every 6 minutes for 2 hours, the pump gives 20 doses, 20 mg, every one of them allowed by the lockout and inside the limit.
The patient is the sensor
The pump's limits are a backstop, because PCA relies on a safeguard outside the pump. An opioid makes a patient drowsy before it slows breathing dangerously; the US Pharmacist review puts it as "sedation always precedes respiratory depression". A patient who has had too much falls asleep and stops pressing, so the loop through the patient's own hand closes before the limits are reached. A basal rate keeps running whether the patient is awake or not, so it never passes through that loop, and the same review advises that a basal rate supply no more than about half of the daily requirement. The software counts presses and times; the patient's level of consciousness is the sensor that decides whether there are any presses to count.
The design fails when someone else presses. In December 2004 the Joint Commission, which accredits US hospitals, issued Sentinel Event Alert 33 on "PCA by proxy": serious harm when family members, caregivers or clinicians activate the pump for the patient without authorization. A 2005 trade report on the alert, a secondary source, gave its context: one such event in the Joint Commission's own database, and 6,069 PCA error reports collected by the US Pharmacopeia, 460 of them with harm, including 5 deaths. The alert recommended criteria for selecting patients, monitoring, teaching patients and families, and warning tags on the handset; AHRQ's patient-safety network records it as retired in June 2016.
The pump judges the timing and the total of presses, never the hand that made them. A press by a relative, a visitor or a clinician who believes the patient is in pain is honored exactly like the patient's own, and the safeguard that rests on drowsiness stopping the presses is gone. Monitoring sedation and breathing, which the 2004 alert recommended, is what can catch it; the pump cannot.
The alert did not deal with people who are allowed to press. A 2007 position statement from the American Society for Pain Management Nursing drew that line: dosing by someone the care team has authorized, which it called authorized agent-controlled analgesia, is distinct from unauthorized dosing, which is PCA by proxy. Nothing in a press identifies the hand that made it. A pump's records can show when doses were given, but not who pressed, so an investigation of an opioid overdose on PCA has to read them against the nursing notes and the accounts of the people present. Chapter 25 shows what pump logs can and cannot establish.
Pumps carried by the patient
An ambulatory pump is built to be carried, so that an infusion can continue at home or at work. The CADD-Solis, first sold by Smiths Medical and now by ICU Medical, weighs 595 g with four AA batteries. A 2025 study describes it as pumping by sequential squeezing of a tube. Smiths Medical's 2010 manual for the VIP model lists cassette reservoirs of 50 to 250 mL or bags of up to 3 L, clinician boluses of up to 50 mL, a limit on doses per hour, and rates up to 500 mL/h. ICU Medical's 2026 brochure states a delivery accuracy of ±6 % (nominal), without conditions. On a 100 mL reservoir at 4 mL/h, ±6 % means a nominal 25-hour infusion may end from 23.6 to 26.6 hours.
The pump does not see the reservoir on the patient's belt. A reservoir volume, programmable from 0 to 9,999 mL, is entered when the reservoir is attached, and the pump tracks what remains by subtracting its own count. That reckoning is only as good as the count. In the 2025 bench study, whose pumps were supplied by their makers, a CADD-Solis at 4 mL/h delivered 98.1 % of its set rate at 25 °C and 102.4 % in motion. Through a 20 G epidural catheter 100 cm long, however, it delivered 93.1 %, and a 3 mL bolus pushed through that catheter delivered 2.7 mL. A count of the mechanism's motion cannot see any of these differences.
At the smallest scale the measurement question returns. DEKA's RemunityPRO+, cleared by FDA on 24 July 2026, is a small pump for subcutaneous treprostinil that delivers 8 to 225 µL/h in steps of 1 µL/h from a 3 mL cassette used for 72 hours, and it uses acoustic volume sensing as feedback (Chapter 4). DEKA's 510(k) summary claims ±6 % and states that a blockage alarms within 12 minutes at 100 µL/h or more but may take up to 8 hours below that. At the 8 µL/h minimum, 8 hours is 64 µL not delivered. What changed from its predicate, the legally sold device its 510(k) compared it with, was its connection, to the cloud and to the patient's own device, which Chapter 28 takes up.
Insulin pumps, in one section
Insulin pumps belong to the same family and differ in scale. A cartridge in Tandem's t:slim X2 holds up to 3 mL, or 300 units of U-100 insulin, so one unit is 10 µL. Tandem's 2015 specification for the original t:slim gives basal rates up to 15 units an hour in steps of 0.001 unit, which is 10 nanoliters, and boluses up to 25 units. A basal rate of 0.5 units an hour is 5 µL/h, a twentieth of the newborn's syringe infusion in Chapter 5 and a 25,000th of the 125 mL/h of Chapter 4. A full cartridge holds 7.5 days' supply at 40 units a day.
At that scale too the pump counts what its mechanism moved, not what entered the tissue. In 2026 FDA classified two recalls of Insulet's Omnipod 5 Pods, a patch pump worn on the skin, as Class I, for cannula damage that could cause under-delivery. Insulin pumps also differ in control. Some now take their rate from a glucose sensor through an algorithm, which FDA regulates as a device of its own called a controller. FDA files interoperable insulin pumps that work with such controllers under a separate product code, FDA's three-letter code for a type of device. A De Novo grant, FDA's route for a new low- to moderate-risk type of device with no predicate, created the code in February 2019, and FDA had recorded 28 clearances under it by September 2026. That loop, its algorithms and its evidence are the subject of a planned guide in this series on automated insulin delivery. This guide treats insulin pumps only as pumps, which count steps like the others.
For pharmacists and pain teams: check every PCA order with the arithmetic of the solved example, working out what the lockout allows in one hour and in four and how long a patient pressing at every chance takes to reach the limit, and set the limit from the doses the order intends. Build each protocol into the drug library so the pump rejects a concentration or lockout outside it (Chapter 21). Tell families in writing, and on a tag on the handset, that only the patient presses unless the team has authorized someone, and pair every PCA with sedation and breathing checks at set intervals.
- A PCA pump delivers a fixed demand dose per press, refuses presses during the lockout and caps the total over one or four hours; at one health system's suggested morphine start, the lockout allows at most 10 mg an hour and the limit 30 mg in 4 hours.
- The design relies on the patient as the sensor, because sedation comes before dangerous slowing of breathing and a drowsy patient stops pressing; a press by anyone else defeats it, which the Joint Commission called PCA by proxy in 2004.
- Ambulatory pumps such as the CADD-Solis track the reservoir by their own count, and what they deliver depends on the catheter and on motion; DEKA's RemunityPRO+ takes acoustic feedback on microliter volumes.
- Insulin pumps move steps as small as 10 nanoliters and, like the other pumps, count what the mechanism moved rather than what reached the tissue.
A pump with no motor.
+ The questionHow can a stretched balloon and a narrow flow restrictor deliver a drug for days, and what changes their rate?
Rubber pushes, a restrictor resists
An elastomeric pump fits in one hand: a clear shell around a balloon of stretched rubber filled with drug, a length of tubing, and, near the patient's end, a narrow flow restrictor. There is no motor, battery, screen or alarm. The pumps of Chapters 4 to 6 count the motion of a mechanism and infer a volume from it; an elastomeric pump has nothing to count and infers nothing. FDA describes it in one line: the fluid sits in a stretchable balloon, and pressure from the balloon's elastic walls drives delivery. The rate is whatever that pressure can push through the restrictor, so it is set entirely by the physics of Chapter 2, and every condition that changes that physics changes the rate.
Chapter 2 showed that the flow through a narrow tube is the driving pressure divided by the tube's resistance, and that the resistance rises in proportion to the liquid's viscosity and the tube's length and falls with the fourth power of its radius. In an elastomeric pump the flow restrictor is by design the narrowest part of the path, so it sets the resistance. Makers choose the restrictor's bore and length to give a labeled rate: Avanos's catalogue lists an ON-Q pump of 400 mL at 4 mL/h, which would take about 100 hours to empty. Some non-electric infusers use a spring instead of a balloon, and EU classification guidance revised in April 2026 counts both kinds among active devices, the EU's term for devices that depend on a source of energy other than gravity or the energy the body generates for that purpose (Chapter 29).
Nothing in the device responds when the rate drifts. An electronic pump that meets more resistance raises its pumping pressure to hold the set rate, up to its occlusion limit (Chapter 12). A balloon has only the pressure its rubber gives, so anything that adds resistance, lowers the pressure or thickens the liquid lowers the rate, and nothing records or reports the change. The only readout is the balloon itself, shrinking over hours or days, set against the expected end time on the label. A pump that finishes hours early or late may be working exactly as its physics dictates, under conditions other than those it was set for.
Viscosity follows temperature
The restrictor's resistance is proportional to the viscosity of the liquid, and the viscosity of water falls steeply as it warms. The international formulation published in 2009 gives 1.0016 mPa·s at 20 °C, 0.93213 at 23 °C, 0.76441 at 32 °C and 0.74881 at 33 °C. With the pressure unchanged, flow rises in the same proportion as viscosity falls, by about 2.1 % for each degree near skin temperature. Where the restrictor sits therefore matters: taped to the skin it runs warm, while lying on a bedside table it runs at room temperature. A pump calibrated for one of those places runs at a different rate in the other.
Makers state where their figures hold. Baxter's 2021 Canadian brochure gives an accuracy of ±10 % for its Infusor range, calibrated with 5 % dextrose at 31.1 or 33.3 °C with the restrictor at the skin, and ±15 % for its Intermate range, calibrated with saline at 21.1 °C. A pharmacy checklist from BC Cancer, reviewed in March 2023, relays Baxter's guidance that flow changes by about 2.3 % per degree, slightly more than viscosity alone predicts; the source of the difference is not documented. The ±10 or ±15 % applies only at the stated temperature, fluid and fill.
A pump calibrated at 33 °C, close to Baxter's 33.3 °C, delivers its labeled rate with the restrictor at skin temperature. If the restrictor lies on a table at 23 °C instead, flow goes as the inverse of viscosity, so the rate becomes 0.74881 ÷ 0.93213 = 0.803 of the label, about 20 % slow. An illustrative 250 mL pump labeled 5 mL/h should empty in 250 ÷ 5 = 50 hours; it runs at about 5 × 0.803 = 4.0 mL/h and takes about 250 ÷ 4.0 = 62 hours. Baxter's rule of about 2.3 % per degree gives 10 × 2.3 = 23 % slow for the same 10 degrees. The reverse case is a restrictor calibrated at 20 °C and worn against the skin at 32 °C: 1.0016 ÷ 0.76441 = 1.31, so it runs about 31 % fast.
Bench studies show the same effect. In a 2025 Japanese study of two elastomeric and two electronic pumps at 4 mL/h, with devices supplied by their makers, warming from 25 to 32 °C took one elastomeric pump from 98.2 to 117.5 % of its set rate and the other from 78.9 to 99.3 %. Viscosity alone predicts a rise of 0.89002 ÷ 0.76441, about 16 %, smaller than the rises of about 20 and 26 % that the two pumps showed. Time within ±15 % of the set rate fell from 65.5 to 43.3 % for the first and rose from 31.0 to 89.1 % for the second, while the electronic pumps barely changed. A 2003 study, with pumps donated by their makers, found flow within ±15 % for 29 to 100 % of the infusion across its five pumps, one of them elastomeric.
Fluid, fill and height
Temperature is not the only condition on the label. The fluid matters: the BC Cancer checklist states that an Infusor filled with saline runs about 10 % faster than with the 5 % dextrose it was calibrated with, and Baxter names the calibration fluid for each range. The fill matters, because a balloon's pressure depends on how far its rubber is stretched; the checklist warns that a device filled to less than 81 % of its nominal volume runs faster. Height matters because the pump's height above the catheter adds the pressure of a column of liquid. The checklist gives about 0.5 % per inch, faster with the pump above the outlet and slower below, so a pump carried 40 cm (15.7 inches) above the catheter runs about 8 % fast.
Resistance downstream adds to the restrictor's. The checklist notes that catheters narrower than 22 G may slow the flow, and a 2019 bench study of four elastomeric pumps and one electronic pump measured the effect of everyday conditions directly. Under ideal conditions the pumps delivered 88.5 to 99 % of their total volume. Raising or lowering them by 20 or 40 cm, or applying back pressures of 10 to 30 mmHg of the kind met in home infusion, changed the flow and the delivered volume of the elastomeric pumps, while the electronic pump was barely affected. Every one of these effects is a term in the same division of pressure by resistance, and the pump has no means of correcting any of them.
An elastomeric pump's rate and its accuracy band are measured under conditions printed beside them. Filled with another fluid, filled short, carried high or low, or kept at another temperature, it runs at another rate with no sign of the change, and the ±10 or ±15 % no longer describes it. Two devices can be compared only under the same stated conditions.
Nothing to alarm and nothing to record
Removing the motor removes whole classes of failure: there is no software to update, no battery to run down and no key to bounce. It adds one. The device cannot tell anyone that it is wrong. It has no occlusion alarm, so a kinked line simply stops it; it has no air detector, and it keeps no record of what it delivered. Baxter presents its range for pain management, antibiotics and oncology, and its accuracy claims of ±10 and ±15 % are wider than the ±5 % many large-volume pumps claim (Chapter 8). What the device delivers is fixed by the restrictor, the balloon and the conditions of use, so the label carries the accuracy claim as much as the device does.
The standards also separate pumps with a motor from devices without one. IEC 60601-2-24, the international standard for electrically driven infusion pumps, excludes the devices covered by ISO 28620. ISO 28620 covers non-electrically driven portable infusion devices that deliver continuously or as boluses around the spinal cord (neuraxial), into blood vessels or under the skin, and excludes devices driven by gravity alone. Its second edition was published on 16 January 2020 and confirmed by ISO in August 2026. In the EU, the revised guidance places elastomeric pumps in risk class IIa, one class below infusion pumps, and India's 2017 risk classification lists "infusion pump or elastomeric infusion device" in Class C. Chapters 27, 29 and 30 set those rules beside the mechanisms of this part.
For hospital pharmacists who fill elastomeric pumps: use the diluent the maker calibrated the device with and fill to the nominal volume, because saline in a dextrose-calibrated device runs about 10 % fast and an underfilled one runs faster too. Write the expected end time with its tolerance; for a 250 mL device at 5 mL/h, ±10 % means about 45 to 56 hours. Tell the patient where the restrictor must sit, taped to the skin for a skin-calibrated device, and to keep the pump at about the level of the catheter. Record the lot, fill and diluent on the dispensing record, because the device keeps no record of its own.
- An elastomeric pump has no motor or sensor: the balloon's pressure pushes the drug through a narrow restrictor, and the rate is that pressure divided by the restrictor's resistance.
- The restrictor's resistance follows the viscosity of the liquid, which falls about 2 % per degree near skin temperature, so a pump calibrated at 33 °C runs about 20 % slow at 23 °C.
- Makers state accuracy of about ±10 or ±15 % at a named temperature, fluid and fill, and the fluid, the fill, the height and the back pressure each move the rate away from it.
- With nothing to alarm and nothing to record, an elastomeric pump's accuracy depends on its conditions of use, so the conditions on its label are part of the accuracy claim.
+ Part III · Accuracy
How accurate, measured how.
Two syringe pumps can carry the same accuracy claim, such as the ±2 % that BD states for its Alaris syringe pump at 1 mL/h and above, and both can meet it. Yet when a 2020 laboratory study ran seven syringe pump assemblies at 1 mL/h, the time each took to reach a steady flow ranged from 89 seconds to 27 minutes. A claim calculated after the pump has settled says nothing about how it got there, and for a drug whose effect fades within a minute or two of the flow stopping, those first minutes count most. Part III asks what an accuracy claim measures and leaves out, how a laboratory weighs flow to draw a trumpet curve, why low rates, syringe changes and a pump moved up or down matter for short-acting drugs, and what happens to each drug when several pumps share one vein.
Two numbers for one pump.
+ The questionWhat does a pump's accuracy claim mean, and what does it leave out?
The mechanism and the system
A supplier's listing for one large-volume pump, the B. Braun Infusomat Space, gives two accuracies for the same machine, both taken from the maker's specification. The first is a "mechanical accuracy" better than 0.5 %. The second is ±5 % "according to IEC/EN 60601-2-24", the international standard for infusion pumps. The two need not conflict, because they describe different things, and the gap between them is the subject of this chapter. Part II showed that a pump counts the motion of its own mechanism and converts that motion into milliliters through assumptions about the tubing or the syringe. The first number describes the motion. The second describes the volume that leaves the set, which is what the patient receives.
Mechanical accuracy is how closely the fingers, the cam or the lead screw move as commanded: a motor told to turn a certain number of steps turns that number, and the parts it drives travel the distance the design says. Modern drives do this very well, which is why the figure is small. System accuracy is how closely the volume delivered matches the volume programmed, with a real set or syringe in place and under stated conditions. Chapter 4 showed that a 2.5 % change in the bore of a pumping segment changes the volume per stroke by about 5 %. A mechanism that moves perfectly can therefore be several percent out once the tubing is a little wider, softer or warmer than the design expected.
Syringe pumps show the same split. Two staff of the Therapeutic Devices Branch of Australia's Therapeutic Goods Administration noted that the figure quoted for a syringe pump is often the accuracy of the plunger's travel. In the same review, undated on the agency's web page, they added that a single-use syringe can bring up to 4 % of further deviation, because the syringe, not the pump, sets how much volume each millimeter of travel pushes out. BD's instructions for its Alaris syringe pump state ±2 % "typical by volume" at 1 mL/h and above, measured with the syringes BD recommends, and warn that accuracy "may be compromised" below 1 mL/h. The claim describes a pump and a named syringe together, never the pump alone.
Even a pump that measures volume makes a claim of the same kind. The Ivenix large-volume pump of Chapter 4 works out the volume in its pumping chamber from air pressure, yet the summary its maker filed for its 2019 clearance states an accuracy of ±5 % from 0.5 to 1,000 mL/h, the same form of claim as a peristaltic pump's. Measuring the chamber removes one assumption, about the size of each stroke, but it leaves the rest of the line, from the chamber's outlet to the vein, exactly as uncertain as before. Whatever the mechanism, the percentage on the label is a statement about the volume that reached the end of a set in a test.
A claim carries its conditions
An accuracy claim is a sentence with conditions attached, and the conditions are as much a part of it as the percentage. ICU Medical's specification for its Plum 360 cassette pump, as reproduced by a distributor, states ±5 % from 1 to 999 mL/h and ±10 % from 0.1 to 0.9 mL/h. The conditions follow: room and fluid at 22 °C, within 5 °C either way; no back pressure; sterile water as the fluid; and a container 30.5 to 61 cm above the pump. Back pressure is the pressure the pump must push against at the far end of the line, from the catheter and the vein (Chapter 2). Head height is the height of the container above the pump, which sets the pressure at its inlet; Chapter 1 measured the head from the container to the vein instead.
Each condition stands for an assumption that a ward will break. A narrow catheter and a vein supply back pressure that the test excluded, drugs are more viscous than water, and Chapter 7 showed how strongly viscosity changes with temperature. A bag hung low or high changes how fully each stroke fills. BD's syringe-pump instructions add their own allowances to the headline figure: a further ±0.5 % across 5 to 40 °C, and ±2 % more at rates above one syringe volume per hour. The plain reading of "±2 %" is therefore longer: ±2 % with this syringe, at these rates and this temperature, with stated allowances outside them.
FDA's guidance on infusion pumps, issued on 2 December 2014 after the initiative of 2010, turns this into a requirement. It asks makers to show accuracy at the limits of the pump's operating range and across expected changes in ambient and fluid temperature, head height, back pressure, atmospheric pressure and viscosity, with the effects "discussed quantitatively in the labeling". It also asks the label to state the period over which accuracy is specified, the effect of rate changes and boluses, and the time to steady state, that is, how long the pump takes to reach the accuracy it claims. The Plum 360 sheet quoted above gives no averaging period at all.
Every percentage has an averaging period
A percentage error needs a period, because it compares two volumes: what the pump delivered in some interval and what it should have delivered in that interval. The averaging period is that interval. Over a long period, short excesses and shortfalls cancel; over a short one they show. A pump that pauses for a minute and then catches up is exact over an hour and badly out over the minute that contained the pause. Both statements are true of the same delivery, and a single percentage chooses one of them without saying which, so the period is part of the claim.
A claim of ±5 % computed over an hour says nothing directly about any ten minutes inside that hour. A label that gives no period leaves the reader to guess, and the natural guess, that the error is spread evenly through the hour, is the one the mechanisms of Part II give least reason to expect.
The period matters most where the drug acts fastest, the subject of Chapter 10, and at the start of an infusion, before the pump has settled. FDA's request for the time to steady state exists for the second reason. As Chapter 5 showed, a syringe pump takes up slack in its drive and compresses the syringe's stopper before fluid moves at the set rate, and a claim measured after the pump has settled leaves that delay out. The test method of Chapter 9, as secondary accounts describe it, plots the start separately for the same reason and analyzes accuracy only once the pump has run for an hour.
- Over one hour at 25 mL/h the pump should deliver 25 mL. A tolerance of ±5 % is ±1.25 mL, so any delivery from 23.75 to 26.25 mL meets the claim.
- Over ten minutes the pump should deliver 25 × 10 ÷ 60 = 4.17 mL. If the claim applied to every ten-minute window, the allowance would be ±5 % of 4.17 mL, or ±0.21 mL, giving 3.96 to 4.38 mL.
- A claim stated over the hour sets no such limit. In the extreme, the hour's whole allowance of 1.25 mL could fall in one ten-minute window: 4.17 − 1.25 = 2.92 mL, or 4.17 + 1.25 = 5.42 mL.
- Those volumes are 30 % below and 30 % above the ten-minute target, while the hour as a whole stays within ±5 %.
- In words, an hourly claim of ±5 % at 25 mL/h is compatible with a ten-minute error of up to ±30 %, which is why the averaging period has to be stated.
When the claim fails in the field
Two recent recalls show where accuracy claims break. Baxter's Novum IQ large-volume pump, met in Chapter 4, could underinfuse when its rate was more than doubled by a new rate or a bolus. Its Class I correction, begun in July 2025, is the case that opens Chapter 31. A claim measured at steady rates said nothing about the moment the rate changed, which is one of the items FDA asks labels to state.
The second recall shows that a claim belongs to the pump and the set together. In July 2025 BD began a Class I correction because its Alaris Pump Module, with certain compatible sets, might perform outside its published ranges for flow-rate and bolus accuracy, the time to an occlusion alarm and the bolus after an occlusion. FDA's notice linked the deviations to set features such as filters and in-line components. Another Class I recall of BD sets, for low-rate performance worse than previously disclosed, followed in August 2026 (Chapter 26).
Before a pump enters a formulary or a tender, list what its accuracy claim assumes: the averaging period, the time to steady state, the test fluid, the temperature, back pressure and head height, and the sets or syringes it names. Check those sets against the ones the hospital actually stocks, including filters and extensions added at the bedside. A maker, in India or anywhere else, should write each item of FDA's 2014 list into the label, because a claim without its period and conditions cannot be checked against anything.
- Mechanical accuracy describes how exactly a pump's mechanism moves, while system accuracy describes the volume delivered through a real set or syringe, and in one maker's figures the two differ tenfold.
- An accuracy claim holds only under its conditions, among them temperature, back pressure, fluid, head height and the named set, and FDA asks makers to state the effect of each in the labeling.
- A percentage needs an averaging period: ±5 % over an hour at 25 mL/h allows an error of up to ±30 % in a single ten-minute window.
- Recent Class I recalls arose at rate changes, which a steady-rate claim does not describe, and from sets that performed outside the published claims.
Flow, minute by minute.
+ The questionHow is flow measured on a balance, and what does a trumpet curve show that an average hides?
Weighing the flow
The instrument that settles an accuracy claim is a laboratory balance. The end of the pump's set is led into a beaker on the pan, the balance sits under a draft shield, and a computer records its reading at fixed intervals while the pump runs. Because a milliliter of water weighs about a gram, each reading is a volume, and the change between two readings is the volume delivered in between. This is the gravimetric method: flow measured by weight against a clock. It answers the question Chapter 8 left open, because once the readings are logged, the error can be computed over any period an analyst chooses, an hour or two minutes.
The method looks simple and is exacting at low rates. The sampling interval, the time between readings, is 30 seconds in IEC 60601-2-24, according to a 2024 article by staff of Sartorius, a balance maker, and B. Braun, a pump maker. At 25 mL/h each reading adds about 208 mg, but at 1 mL/h only 8.3 mg. Water evaporating from the beaker would pass for missing flow, so a 2013 metrology study that weighed gravity drip sets to 1 mg every 30 seconds covered the water with a film of oil, which kept the loss below 1 mg over five hours.
The 2024 article adds that the depth of the outlet needle in the liquid changed the measured mass by up to 0.264 g, and that two rigs measuring one 1 mL/h flow gave 0.99 ± 0.02 and 0.96 ± 0.32 mL/h. A test rig can add more error than the pump it tests claims. The balance must also resolve masses this small, and the same article tabulates the readability that AAMI's 2021 report on fluid delivery testing recommends: a balance reading to 0.1 mg for flows of 10 to 1,000 mL/h, and to 0.01 mg for 0.1 to 10 mL/h. At 1 mL/h, one step of a 0.1 mg balance is about 1.2 % of a 30-second reading, while one step of a 0.01 mg balance is about 0.12 %.
The test the standard describes
The method most often cited is the one in IEC 60601-2-24, the international standard for infusion pumps. Its second edition, of 2012, is current as of October 2026, and a third edition is in draft (Chapter 27). The standard's text is sold rather than published, so the test details in this chapter come from secondary accounts, marked as such: a certifier's slides on the 2012 revision, a published evaluation that applied the method, and articles by makers of balances and test equipment.
On those accounts, a volumetric pump is tested at an intermediate rate of 25 mL/h and a syringe pump at 5 mL/h. Further tests run at the lowest rate the user can select, but not below 1 mL/h, and in the 2012 edition at the highest selectable rate too. A white paper from a maker of test equipment describes a test period of 120 minutes at the intermediate rate. The readings of the first hour are plotted as a start-up curve, flow against time from the moment the pump starts, which shows how long the pump takes to reach its set rate. The readings of the second hour, when the pump has settled, are the ones analyzed for accuracy.
From readings to a trumpet
The analysis asks a question that a single average cannot: how far off can the flow be over a window of a given length? The analysis takes an observation window, for example 2 minutes long. Starting at the first reading of the second hour, the analysis computes the average rate over the next 2 minutes and its percentage difference from the set rate, then slides the window on by one reading, 30 seconds, and repeats to the end of the hour. With 120 readings in the hour, a 2-minute window fits 117 times, and only the largest and the smallest of those 117 errors are kept. The same is done for windows of 5, 11, 19 and 31 minutes, the lengths the secondary sources give, and a 31-minute window fits 59 times.
Plotted against window length, the largest error above zero and the smallest below it form two lines that flare apart at short windows and close in at long ones, like the bell and the pipe of a trumpet: hence the trumpet curve. The overall error of the whole hour sits at its narrow end. The review by two TGA staff in Chapter 8 printed one such curve for an unnamed pump. Over the hour the error was −2 %, but over 2-minute windows it reached +7 % and −10 %. A spread of 17 points at 2 minutes sat behind a figure of 2 % for the hour.
- For illustration, a pump set to 0.5 mL/h delivers nothing for 90 seconds, the longest pause Baxter declares for its pump at that rate in a 2025 510(k) summary, and then delivers the volume owed at once. Each pulse is 0.5 × 90 ÷ 3,600 = 0.0125 mL, or 12.5 µL, and with readings every 30 seconds, every third reading shows one pulse.
- A 2-minute window spans four readings and should hold 0.5 × 2 ÷ 60 = 16.7 µL. Depending on where it starts, it holds one pulse (12.5 µL, an error of −25 %) or two (25 µL, +50 %).
- A 5-minute window spans ten readings and should hold 41.7 µL. It holds three pulses (37.5 µL, −10 %) or four (50 µL, +20 %).
- An 11-minute window spans 22 readings and should hold 91.7 µL. It holds seven pulses (87.5 µL, −4.5 %) or eight (100 µL, +9.1 %).
- Over the full hour, 40 pulses deliver exactly 0.5 mL, an error of zero.
- In words, a pump that is perfect over the hour can be 25 % short or 50 % over in a 2-minute window, and the trumpet records both.
The curve answers a clinical question that the average cannot. For a drug whose effect fades within two minutes, the 2-minute end of the curve matters far more than the 31-minute end; for a feed or a bag of fluid, the reverse. A pump whose curve stays narrow at short windows delivers smoothly, while one whose curve flares delivers in pulses that the long average conceals. Two pumps with the same hourly error can have very different trumpets, and only the trumpet tells them apart.
Because the curve is computed from the second hour, it leaves out the start, when a syringe pump may take many minutes to reach its set rate (Chapter 5). The start-up curve covers that period, and a pump chosen for short-acting drugs should be judged on both plots, not on the trumpet alone.
Two methods, two markets
In the United States FDA recognizes AAMI TIR101 rather than IEC 60601-2-24 (Chapter 28). TIR101 is a technical information report on fluid delivery performance testing for infusion pumps. It was issued in 2021, entered in FDA's database on 30 May 2022 and reaffirmed in 2026. It covers syringe, container and volumetric pumps across delivery modes, including enteral, patient-controlled and epidural use. According to the 2024 article by balance and pump makers, it reads the balance every 10 seconds rather than every 30. It sets no criteria for clinical acceptability and does not address measurement uncertainty.
At least one maker now cites it in a claim. ICU Medical's 510(k) summary for the Plum Solo, cleared on 2 April 2025, states ±3 % from 0.1 to 999 mL/h "under standard conditions" per TIR101 and ±5 % under non-standard conditions. The pair makes Chapter 8's point again: one pump, one test report, two accuracies, each true under its own conditions. Faster readings show more detail at low rates, but each reading then holds less, 2.8 mg at 1 mL/h, and the balance's own limits loom larger. A 2015 metrology study of syringe pumps met the same limit, confirming a claimed 2 % at 2 and 10 mL/h but not at 0.5 mL/h, where the uncertainty of the measurement itself reached 2 %.
For a maker preparing a submission, or a hospital laboratory checking pumps after repair, measure the rig first. Choose a balance whose readability suits the lowest rate tested, cover the water against evaporation, fix the depth of the outlet, and run a known flow at 1 mL/h to see what the rig itself adds. Record both the start-up and the trumpet curves, at the 30-second interval of IEC 60601-2-24 and the 10-second interval of TIR101 when the pump is meant for both markets, and state which method each claim rests on.
- The gravimetric method weighs the fluid a pump delivers at fixed intervals, and at low rates the balance, evaporation and the outlet's position can add more error than the pump claims.
- Secondary accounts of IEC 60601-2-24 describe tests at 25 mL/h for volumetric and 5 mL/h for syringe pumps, readings every 30 seconds, a start-up curve from the first hour and accuracy analyzed in the second.
- A trumpet curve plots the largest and smallest errors over windows of 2 to 31 minutes, and shows the pauses and pulses that an hourly average hides.
- FDA recognizes AAMI TIR101 rather than IEC 60601-2-24, and at least one maker, ICU Medical for the Plum Solo in 2025, states its accuracy claim against TIR101 conditions.
When minutes matter.
+ The questionWhy do short-acting drugs at low rates need steadiness as much as accuracy, and how do a syringe change or a change in height upset it?
Drugs that leave as fast as they arrive
Norepinephrine, also called noradrenaline, is infused to raise blood pressure in shock, and its US label gives its mean half-life as about 2.4 minutes. The half-life is the time the body takes to clear half of the drug present. When the infusion stops, the level in the blood therefore halves roughly every 2.4 minutes, and the label adds that the effect on blood pressure ends within 1 to 2 minutes. The labels of two related drugs give similar figures: an effective half-life of under 5 minutes for epinephrine, and about two minutes for dopamine. For all three, the blood level follows the pump with a delay of minutes, the time scale of the short windows in Chapter 9's trumpet curve.
That is why the trumpet's short end matters most for these drugs. A slowly cleared drug averages out a pump's pauses and pulses, because the body holds so much of it that a minute's shortfall barely moves the level. A drug with a half-life of 2.4 minutes does not: a pause becomes a fall in blood level within minutes, and a pulse becomes a rise. Clinicians titrate these drugs, adjusting the rate in small steps while watching the blood pressure until it reaches a target. Each step means something only if the pump turns the new rate into a steady flow. Accuracy over an hour is necessary, but steadiness over minutes is what the patient feels.
Low rates make steadiness harder. Short-acting drugs are prepared concentrated, so that small volumes carry the dose: in a 2016 study in one 15-bed intensive care unit in Lyon, norepinephrine syringes held 0.17 to 1 mg/mL and ran at 2 to 10 mL/h. At such rates a syringe pump advances its plunger very slowly. The slack, friction and compliance described in Chapter 5 then become comparable with the volume delivered in a few minutes. A conference poster from a pediatric intensive care unit in Newcastle upon Tyne reported bench errors over 5-minute windows of +30 % and −20 % at 0.5 mL/h, against +5 % and −10 % at 1 mL/h.
Changing a syringe
A 50 mL syringe running at 2 mL/h empties in 25 hours, so syringes are changed, and each change disturbs the flow. Two manual methods are taught. In a quick change, the pump is stopped, the empty syringe is replaced with a full one, and the pump is restarted. A 2025 bench study timed a quick change at a mean of 9.48 seconds, according to a summary of its abstract. In double pumping, the new syringe is started on a second pump before the first is stopped, so that for a time both run into the line. Some pumps also offer an automated changeover from one syringe to the next.
The Lyon study followed 118 patients through 764 automated changeovers of norepinephrine syringes. It counted an incident whenever the mean arterial pressure, the average pressure in the arteries over a heartbeat, changed by more than 25 % within 30 minutes. Incidents followed 114 changeovers, 15 %, and 63 patients, 53 %, had at least one. The only factor that independently predicted an incident was a change of concentration between the old syringe and the new, and when the new syringe was weaker, pressure rose in 40 of 43 cases. Chapter 3 suggests one reason: a weaker syringe runs at a higher rate to keep the dose, and that rate pushes the stronger drug still in the line into the vein faster.
A randomized trial published in 2020 compared the methods in 286 patients in six intensive care units, counting a change in mean arterial pressure of more than 15 mmHg within 15 minutes. Such swings followed 89 of 224 double-pumping changeovers, or 39.7 %, against 57 of 223 quick changes, 25.6 %, and 46 of 181 automated changes, 25.4 %. The abstract gives no mechanism, but Chapters 5 and 11 suggest one: two pumps in parallel bring two sets of start-up slack and two flows into one line, and the moment to stop the first is judged by eye.
Double pumping is taught because it seems to guarantee that the drug never stops. In the 2020 trial it produced more swings in blood pressure than a plain quick change, so the overlap that looks safe on paper did not protect the patient.
The 2025 bench study measured the fluid displaced at each of 108 changeovers. The mean was only 8 µL, but single changeovers ranged from 262 µL drawn back into the syringe's line to 156 µL pushed forward, depending on the pump's height, the venous pressure and whether a carrier ran. At 0.5 mg/mL, the concentration used in the 2015 Y-set study of Chapter 11, 156 µL holds 78 mcg of norepinephrine: almost five minutes of a 1 mg/h infusion, arriving at once.
Raising and lowering the pump
A syringe pump placed above or below the patient adds the pressure of a column of liquid: about 0.74 mmHg for each centimeter of height, or 36.8 mmHg for 50 cm. One maker's performance tips for its syringe pump round this up to "approximately 25 mm Hg per linear foot"; the physical figure is about 22 mmHg per 30 cm. The tips warn that raising the pump, "even briefly, can cause bolusing", while lowering it can interrupt flow. The reason is compliance, met in Chapter 5: the rubber stopper, the barrel and the tubing stretch a little with pressure, and hold a little extra volume when the pressure rises.
Lowering the pump raises the pressure inside the syringe by the height of the column, so the syringe and line swell and take up the pump's next few minutes of output before any reaches the vein. Raising the pump does the reverse: the pressure falls, the stretched parts relax, and the stored volume is pushed out at once. How much is stored depends on the compliance that the 2015 metrology study of Chapter 5 measured: 1.54 mL per bar for a 50 mL syringe and 0.21 mL per bar for a 10 mL one. At low rates, that stored volume can equal many minutes of delivery.
- The gap: treating the body as one well-mixed pool, norepinephrine halves every 2.4 minutes once delivery stops. About 75 % remains after 1 minute, 56 % after 2 minutes and 24 % after 5 minutes.
- The column: 50 cm of water exerts 50 × 0.7356 = 36.8 mmHg. One bar is 750 mmHg, so that is 36.8 ÷ 750 = 0.049 bar.
- The stored volume: a 50 mL syringe with a compliance of 1.54 mL per bar takes up or releases 1.54 × 0.049 = 0.076 mL, or 76 µL.
- At 1 mL/h the pump delivers 16.7 µL/min, so 76 µL is 76 ÷ 16.7 = 4.5 minutes of delivery; at 0.5 mL/h it is 9.1 minutes.
- In words, lowering the pump 50 cm can withhold about 4.5 minutes of a 1 mL/h infusion, long enough on this simple model for the drug level to fall to about a quarter, and raising it can push the same volume in at once. A 10 mL syringe, at 0.21 mL per bar, would store about 10 µL, a seventh as much. The model ignores how the drug spreads through the body.
Bench studies agree. One 2020 study moved three syringe pumps 25 or 50 cm up or down at 0.5 to 5 mL/h, according to a summary of its abstract. A downward move stopped delivery for up to 11.8 minutes, an upward move gave a bolus equal to up to 15.8 minutes of steady delivery, and a constant height difference had no effect. A second 2020 study, of seven assemblies at 1 mL/h, met at the start of this part, found no delivery for 145 to 335 seconds after lowering, and its authors concluded that the problems stem "mainly from the functional principle of syringe pumps". In a 2012 study, an in-line filter halved the volume held back after lowering, but left the bolus after raising unchanged.
Steadier flow by design and by habit
FDA took up the problem in 2016. According to a summary by the American Society of Anesthesiologists, a safety communication on programmable syringe pumps described problems of flow continuity below 5 mL/h, and especially below 0.5 mL/h. It drew on more than 300 reports received between March 2013 and July 2016, with harms that included unstable blood pressure in critically ill infants. The Australian review of Chapter 8 advised against running short-acting catecholamines, the family of drugs that includes norepinephrine, epinephrine and dopamine, below 5 mL/h from syringes larger than 30 mL. The common thread is compliance and slack. A smaller syringe stores less, and a higher rate takes up slack sooner, which is why the Newcastle unit halved its epinephrine and norepinephrine concentrations for babies under 5 kg, so as to double their rates.
Designs that do not depend on a syringe's plunger behave differently. A 2002 study found a micro-volumetric piston pump, the Panomat P-10, within 5 % at 10 to 100 µL/h. After a 50 cm lowering at 100 µL/h it resumed delivery in 1.5 minutes, against 28.5 minutes for a conventional syringe assembly. DEKA's RemunityPRO+ of Chapter 6 uses acoustic volume sensing as feedback to monitor delivery accuracy. DEKA states an accuracy of ±6 % without naming the rate it applies at, for a pump that runs from 8 to 225 µL/h. Movement adds forces of its own: a 2025 study modeled blood levels of 96 to 216 % of steady state during ambulance transport with standard positioning of the syringe pump, and 103 to 123 % with the best positioning.
For pharmacists setting standards for short-acting infusions: fix one concentration for each drug and patient group, so that the new syringe at a changeover matches the old one, since a change of concentration was the strongest predictor of swings in the Lyon study. Prepare the next syringe before the current one empties, choose the smallest syringe that lasts a sensible interval, and mount the pump at a fixed height relative to the patient. During transfers, move the pump with the patient rather than lifting it, and treat any change of height as a change of dose.
- Norepinephrine's half-life of about 2.4 minutes means that a pause or pulse lasting a few minutes changes the blood level within the same minutes, so steadiness matters as much as hourly accuracy.
- At syringe changeovers, a change of concentration was the strongest predictor of swings in blood pressure in one study, and double pumping produced more swings than a quick change in a randomized trial.
- Raising or lowering a syringe pump changes the pressure in a compliant syringe, which releases or absorbs volume: about 76 µL for 50 cm with a 50 mL syringe, or 4.5 minutes of delivery at 1 mL/h.
- Smaller syringes, higher rates with weaker concentrations, a fixed pump height and pumps that do not rely on a syringe plunger all reduce these effects.
Infusions that share a vein.
+ The questionWhat happens to each drug when several pumps feed one catheter?
Three pumps, one line
In a 2015 laboratory study in Utrecht, three pumps fed one infusion line: a carrier of plain fluid at 8 mL/h, the sedative midazolam at 5 mL/h, and norepinephrine at 0.1 mg/mL and 2 mL/h, joined in a set whose shared part held 1.8 mL. When the norepinephrine was started, it took a mean of 3,797 seconds, more than an hour, to reach 95 % of its intended delivery. When the rate of another pump on the line was raised, the midazolam delivered rose by an average of 27.5 % for about 8 minutes, and the norepinephrine by 23.5 %. The study traced these deviations to the physical properties of the infusion system, not to a faulty pump.
Chapter 3 showed that drug waits in the volume of a line before it reaches the vein, and Chapter 10 showed that short-acting drugs follow their delivery within minutes. A line shared by several pumps combines both facts. Each pump decides how much of its own drug enters the line, but none of them decides when that drug leaves it, because every fluid in the shared part moves at the total flow of all the pumps together. So when one pump changes its rate, it changes the timing of every other drug in the shared part.
A shared line holds a mixture
Beyond the junction where the lines meet, the shared tubing and catheter hold a mixture, and its strength is set by the ratio of the flows. Norepinephrine at 0.1 mg/mL and 2 mL/h enters the junction at 200 mcg/h, and a carrier at 8 mL/h dilutes it into 10 mL/h, so the mixture holds 20 mcg per mL. In steady running the patient receives 200 mcg/h whatever the carrier's rate, because the drug's own pump alone decides how much drug enters. The shared volume, however, holds a stock of drug, 36 mcg in 1.8 mL, and the carrier decides how fast that stock moves.
Any change in total flow changes the speed at which the stock leaves. When the carrier's rate is raised, the stored mixture is pushed out faster, so the patient briefly receives more drug though no one touched its pump. When the carrier's rate is lowered or the carrier is stopped, the stock leaves slowly, so the patient receives less until fresh drug fills the line. A 2005 study that traced a blue dye through administration sets showed these effects: the lag after a change grew with the shared volume and shrank with the total flow, and a carrier stopped and restarted cut delivery for a long time and then released a bolus. The simplest way to size them is to treat the line as plug flow (Chapter 3).
- Inputs, from the Utrecht study with its third pump left out: norepinephrine 0.1 mg/mL at 2 mL/h (200 mcg/h), a carrier at 8 mL/h, and 1.8 mL of shared volume.
- The mixture holds 200 ÷ 10 = 20 mcg/mL, so the shared volume stores 20 × 1.8 = 36 mcg.
- Carrier doubled to 16 mL/h: the stored mixture now leaves at 18 mL/h, carrying 20 × 18 = 360 mcg/h, 80 % more than ordered, for 1.8 ÷ 18 = 0.1 h, or 6 minutes. In those 6 minutes 36 mcg reach the vein instead of 20 mcg, an extra 16 mcg.
- Carrier stopped: the mixture leaves at 2 mL/h, carrying 40 mcg/h, 80 % less than ordered, for 1.8 ÷ 2 = 0.9 h, or 54 minutes. The patient misses 144 mcg.
- Carrier restarted at 8 mL/h after those 54 minutes: the line now holds undiluted drug at 100 mcg/mL, which leaves at 10 mL/h, carrying 1,000 mcg/h for 10.8 minutes. The extra is again 144 mcg: the drug withheld returns as a bolus.
- In words, on a plug-flow model, a carrier change produces a step in delivery whose height is set by the change in total flow and whose length is set by the shared volume.
Real lines smear the step. Fluid near the wall of a tube moves more slowly than fluid at its center, so a sharp front spreads as it travels, and the compliance of each syringe softens every change in rate (Chapter 5). Applied to the rig's second step, which raised the carrier from 16 to 25 mL/h with all three pumps running, the plug model gives about +39 % for 3.4 minutes; the Utrecht rig measured deviations of about a quarter, lasting about 8 minutes. Its authors found that shared volume and syringe compliance push in opposite directions, the first delaying a change and the second smoothing it. A 2017 model from the same group predicted measured delays with a standard deviation of about 16 seconds, and showed in an illustrative case that a fivefold increase in one pump can briefly triple another drug's output.
A carrier is plain fluid, and changing its rate looks like changing nothing. On a shared line it changes how fast every drug already in the line reaches the vein, so a flush, a bolus of fluid, a carrier bag running out or a carrier slowed to save fluid is, for a few minutes, a change in the dose of each drug on that line.
Late starts and lines that run backward
The same physics explains the slow start. A drug started into a shared line must take up its syringe's slack, fill its own tubing and then replace the shared volume, which moves only at the total flow. A rule of thumb from studies of this shared volume, also called dead volume, puts the time to steady delivery at one to three times the shared volume divided by total flow. A standard Y-set, a Y-shaped piece that joins two lines into one, holds 1.5 mL, so at a total of 10 mL/h the rule gives 9 to 27 minutes. Yet a 2015 bench study, with norepinephrine at 0.5 mg/mL, measured a median of 40 minutes with such a set, with an overshoot lasting about 35 minutes, and 12.6 minutes with a set whose shared volume was 0.046 mL. The maker of that low-volume set supplied the devices, and four authors had travel paid by the company.
Lines also run backward. When the shared line is blocked, or one pump stops while others keep running, fluid from the running pumps can travel up the quiet line instead of on to the vein. This backflow stores drug where no one expects it and returns it later as a bolus; at the syringe changeovers of Chapter 10, a running carrier made both backflow and forward surges larger. An anti-reflux valve, a one-way valve fitted to each line above the junction, prevents backflow, and one low-crack model opened at an average of 5.3 mmHg in a 2014 study. An anti-siphon valve stops a syringe emptying by gravity when the pump hangs above the patient; it opens only above about 100 to 150 mmHg, a range the 2018 bench study below cites from earlier work.
Valves have costs. A 2018 bench study measured the pressure a syringe pump needed to push through three-way devices fitted with anti-siphon valves: 178.7 mmHg at 10 mL/h, rising to 243.3 mmHg at 400 mL/h, about five times the 37 to 44 mmHg needed without them. The authors, who ran the pump at a 500 mmHg limit, inferred that at its lowest setting, 75 mmHg, it would alarm rather than run through the anti-siphon devices; that setting was not tested. Joined lines also pool their compliance. In the 2014 study, with the occlusion alarm set at 1,000 mmHg, a 50 mL/h line alone alarmed 81 seconds after a block downstream; joined to a 10 mL/h line behind an anti-reflux valve it took 133 seconds, 64 % longer, and adding an anti-siphon valve brought the time back to 74 seconds (Chapter 12).
Two drugs through one pump
Some pumps combine lines inside the machine. ICU Medical's Plum 360 can deliver two compatible drugs at independent rates through one set, because its secondary line joins its cassette directly (Chapter 4). ICU Medical's specification gives a minimum of 0.5 mL/h on each line and a maximum of 500 mL/h combined. In pumps that run secondary infusions, software makes the switch between primary and secondary infusions, and a 2025 correction of Fresenius Kabi's Ivenix pump concerned exactly that moment (Chapter 20).
Long lines magnify everything in this chapter. Mount Sinai's 2020 report gives a volume of 20 mL for its lines, a figure Chapter 3 found hard to reconcile with the tubing the report names. Through 20 mL, the plug arithmetic above would stretch from minutes to more than an hour. For makers, FDA's 2014 guidance asks for performance testing in every configuration of the system, or in a justified representative set of them.
For the nurses, pharmacists and biomedical engineers who set up critical care lines: record which drugs share each lumen, or channel, of the catheter, where they join and how much volume lies between the junction and the vein. Give a short-acting, high-alert drug its own lumen where one is free, or join it as close to the catheter as possible, and fit an anti-reflux valve to every line above a junction. Check that valves and the pump's occlusion setting are compatible, and treat a change in carrier rate as a change in the dose of every drug on that line.
- Beyond a junction the line holds a mixture whose strength is set by the ratio of flows, so the shared volume stores drug that every pump on the line moves.
- On a plug-flow model, doubling an 8 mL/h carrier raises a 2 mL/h drug's delivery by 80 % for 6 minutes, and stopping it cuts delivery by 80 % for 54 minutes, with the shortfall returning as a bolus on restart.
- Real lines spread and soften these steps, and bench studies measured start-ups longer than an hour and deviations of about a quarter lasting several minutes.
- Anti-reflux and anti-siphon valves prevent backflow and siphoning, but they add opening pressure and change how quickly a blockage is detected.
+ Part IV · Sensing
Sensing trouble.
A syringe pump running at 1 mL an hour can push into a blocked line for about an hour before it raises an alarm. B. Braun's manual for its Perfusor Space pump gives that figure for the maker's own 50 mL syringe with the alarm at its middle setting of 487 mmHg: up to about 63 minutes. Nothing in the pump has failed. It is waiting for pressure to build in a syringe and a line that stretch under load. This part asks what a pump can sense, how soon, and what it does next: a blockage in Chapter 12, air in Chapter 13 and fluid running with no pump in control in Chapter 14. Chapter 15 turns to the alarms that report all three, on units where alarm signals can number several hundred per patient a day.
A blocked line at 1 mL an hour.
+ The questionHow does a pump know a line is blocked, and why can it take an hour to notice?
Pressure is the only sign of a blockage
In 2020 the intensive care units of Mount Sinai Morningside raised the occlusion limit on their pumps from 300 to 500 mmHg. The pumps had been moved outside the patients' rooms, and each line now ran through two 210 cm microbore extensions, whose resistance Chapter 2 worked out. On a simple proportional model, the higher limit makes the pump take about two-thirds longer to detect a blocked line. The benefit of the higher limit, and its cost, follow from what a pump can observe. A pump counts the motion of its own mechanism, the steps of a motor or the turns of a screw, and that count does not change when the line beyond the pump closes: the motor keeps stepping as if fluid were still leaving.
What does change is pressure. Liquid barely compresses, so a pump that keeps moving against a closed line can make room for each new microliter only by stretching whatever lies between its mechanism and the block: the syringe barrel and plunger seal, the tubing, any filter. As these parts stretch, the pressure climbs. A sensor reads it, either as the force on the syringe plunger or as the pressure in the tube just beyond the mechanism. When the reading crosses a set limit, the pump stops and raises an occlusion alarm.
A block downstream, between the pump and the patient, raises the pressure the pump pushes against. A block upstream, between the container and the pump, such as a closed clamp or an empty bag, starves the mechanism instead, and a pump with a sensor on its inlet side sees the pressure there fall. BD lists the two as separate alarms for its Alaris neXus GP large-volume pump. Both rest on the same principle: the pump infers a blockage from pressure, never from a measured absence of flow.
Two failures therefore go unseen. In extravasation, the catheter has slipped out of the vein and fluid leaks into the surrounding tissue. MHRA, the UK regulator, noted in guidance it has since withdrawn that extravasation does not trigger an occlusion alarm, because the tissue offers too little resistance for the pressure to reach the limit. A disconnected line raises no pressure either, and the Mount Sinai team's 2020 report states that pumps detect occlusion but not disconnection. In both cases the drug leaves the pump at the programmed rate and goes somewhere other than the vein.
No alarm means only that the pressure has not yet reached the limit. At low rates and high limits that can take more than an hour, and all the while the display goes on counting volume the patient has not received. A slipped catheter or a parted line may never raise the pressure at all.
The give in the line sets the delay
Compliance, introduced in Chapter 5, is the volume a syringe, a set or a filter takes up for each unit of pressure. The 2015 metrology study of Chapter 5 measured it for syringes at about 0.65 bar, or about 490 mmHg, close to typical occlusion limits. A 10 mL syringe took up 0.21 mL per bar and a 50 mL syringe 1.54 mL per bar; adding an in-line filter raised the figures to 0.52 and 2.10 mL per bar. A pump pushing into a block has to fill this give at its programmed rate before the pressure reaches the limit. The time to alarm is therefore roughly the compliance multiplied by the limit and divided by the rate, which makes it long whenever the syringe is large, the limit high or the rate low.
Makers publish the result as a table. B. Braun's manual for the Perfusor Space gives the longest time to an occlusion alarm for each listed syringe at three of its nine pressure levels: P1 at 75 mmHg, P5 at 487 mmHg and P9 at 900 mmHg. With the maker's own 50 mL syringe at 1 mL/h, the times are about 13, 63 and 91 minutes. At 5 mL/h they shrink to 2.5, 9.5 and 16 minutes, and at 0.01 mL/h every syringe in the table takes more than 3 hours.
Smaller syringes stretch less, so they reach the limit sooner. At 1 mL/h and P5, the same manual gives about 11 minutes for a BD 3 mL syringe, 12.5 minutes for 5 mL, 25 minutes for 20 mL and 41 minutes for 30 mL. The 50 mL syringe takes almost six times as long as the 3 mL one, so the brand and size of syringe belong in any statement of how fast a pump detects a block. At microliter rates the wait stretches further: DEKA states 8 hours below 100 µL/h for its RemunityPRO+ subcutaneous pump, cleared in July 2026.
- A 50 mL syringe takes up 1.54 mL per bar (the 2015 study). One bar is 750 mmHg, so its compliance is 1.54 ÷ 750 = 0.00205 mL, about 2 µL, per mmHg.
- At the P5 limit of 487 mmHg the syringe stores 487 × 0.00205 = 1.00 mL before the alarm. At 1 mL/h the pump needs 1.00 ÷ 1 = 1.0 h, or 60 minutes, to store it; the maker's table gives at most 62.7 minutes for its own 50 mL syringe. At 5 mL/h the estimate is 1.00 ÷ 5 = 0.2 h, or 12 minutes, against 9.5 minutes in the table.
- Mount Sinai's change, applied to the same syringe for illustration: 300 mmHg stores 300 × 0.00205 = 0.62 mL and 500 mmHg stores 1.03 mL. At 5 mL/h the wait grows from 7.4 to 12.3 minutes, and at 1 mL/h from 37 to 62 minutes.
- Raising the limit by two-thirds lengthens both the wait and the volume held behind the block by about two-thirds.
A limit set between false alarms and late ones
The alarm limit is a compromise between two failures. A limit close to the pressure the infusion needs trips on every surge, while a high limit finds a real block later and stores more volume behind it. The adult line analyzed in Chapter 2 loses 141 mmHg across its parts, so its limit must sit above that to avoid false alarms. BD states that its Alaris Pump Module allows a maximum limit of 525 mmHg at 30 mL/h and above, decreasing in a straight line toward 50 mmHg as the rate approaches 1 mL/h. The ceiling is therefore lowest at low rates, where a high limit would take longest to reach.
Mount Sinai's long lines made false alarms likely. Microbore tubing needs more pressure for the same flow, and in 2020 ECRI's laboratory saw frequent occlusion alarms at 300 mL/h on long microbore extensions, while the Mount Sinai report warned of false alarms above that rate. Raising the limit from 300 to 500 mmHg gave the pumps headroom against false alarms but delayed the detection of real blocks. ECRI's alert of April 2020 on long extension sets found occlusion alarms delayed beyond the makers' specifications below 5 mL/h. It judged that these limitations "may be unacceptable for some high alert drugs", such as vasopressors, and advised keeping those pumps in the room.
Parts added to the line can also look like a block. A valve stays closed until the pressure behind it passes its opening pressure, and the sensor reads that rise as it would read a block. The authors of the bench study in Chapter 11 inferred that a syringe pump set to its lowest limit, 75 mmHg, would alarm on anti-siphon valves alone, with nothing blocked; they did not test that setting. In a Class II recall, Fresenius Kabi corrected Ivenix pumps that raised occlusion alarms at low flow when a check valve was added.
A carrier, the steady flow of plain fluid that takes a drug toward the vein, adds its own flow into any block beyond the junction where the lines meet. A 2014 bench study with a 1,000 mmHg limit found that joining lines moves detection in both directions. A block that a 10 mL/h line alone took 416 seconds to detect raised an alarm in 133 seconds once a 50 mL/h line joined it, because the faster pump reached the limit first. For the faster pump, the same junction lengthened detection from 81 to 133 seconds.
The bolus waiting behind the block
Whatever the pump pushed into the compliance before the alarm is still there, under pressure, when the alarm sounds. If the block then clears, because a clamp is opened, a kink straightened or a stopcock turned, the stored fluid leaves at once as a post-occlusion bolus. MHRA's guidance said the bolus grows with the alarm pressure set, and listed three ways to reduce it: smaller syringes, plungers that need little force, and back-off, in which the mechanism reverses slightly after the alarm to relieve the pressure. B. Braun's manual gives a maximum bolus of 0.2 mL for its 50 mL syringe at all three pressure levels on small-bore and microbore tubing, and up to 0.6 mL in all on standard-bore tubing.
A 2013 bench study measured what happens when an occluded line is released the wrong way, by opening a closed stopcock with the pressure still in the line. With a 50 mL syringe and the alarm set to High, one Terumo syringe pump flushed 1.99 mL and another 0.67 mL; the volume was smaller with a low alarm setting or a 10 mL syringe. At 1 mL/h, 1.99 mL is about two hours of infusion arriving at once.
Each of these numbers belongs to one combination of pump, syringe and set. BD's Class I recall of Alaris sets in July 2025, described in Chapter 8, named the time to occlusion alarm and the post-occlusion bolus among the ranges the sets might miss, and a second set recall followed in August 2026. The time to alarm is therefore a property of the whole line, not of the pump alone. A hospital that changes the syringe, the set or the extension is running a configuration the maker's table does not describe.
For a low-rate infusion of a short-acting drug, look up the maker's time to occlusion alarm for the brand and size of syringe in use, at the planned rate and pressure level. Use the smallest syringe that holds the dose, keep the limit as low as the line's normal pressure allows, and count every filter, valve and extension. A pump maker, in India or elsewhere, should publish the time to alarm and the bolus for every syringe and set on its compatible list at the lowest rates it offers.
- A pump cannot see flow stop; it infers a blockage when the pressure it reads crosses a set limit, so it cannot detect extravasation or a disconnection.
- Time to alarm is roughly compliance times limit divided by rate: at 1 mL/h and 487 mmHg, one maker's 50 mL syringe may take over an hour and a 3 mL syringe about 11 minutes.
- The limit trades false alarms against late ones; Mount Sinai's rise from 300 to 500 mmHg on long microbore lines gave headroom against false alarms at the price of slower detection at low rates.
- The volume stored before the alarm can reach the patient as a bolus when the block clears, from 0.2 mL in one maker's table to 1.99 mL in a bench test of a wrongly released line.
Bubbles the pump must see.
+ The questionHow does a pump detect air, and how much air matters?
A detector that tells liquid from gas
An air-in-line detector is a sensor clamped around the tubing that tells liquid from gas as the line passes through it. A blockage can only be inferred from rising pressure (Chapter 12), but air can be watched directly, because it changes how the tube carries a beam of sound or light. MHRA's 2013 guidance, since withdrawn, described the detectors on volumetric pumps as ultrasonic or optical. In an ultrasonic detector a small transmitter on one side of the tube sends sound to a receiver on the other. Liquid carries the sound across, while a bubble carries it far less well, so the receiver's signal drops for as long as the bubble takes to pass.
What the detector reports is therefore a gap with a duration, and turning that gap into a size takes two more facts. At a known flow through a tube of known bore, the fluid moves at a known speed, so the duration gives the length of the bubble, and the bore turns the length into a volume. Baxter's 510(k) summary for its SIGMA Spectrum pump, cleared in July 2025, states its threshold in exactly these terms: an alarm for bubbles longer than 2.5 cm, or 1 inch, which the maker puts at about 140 µL in its own sets. That volume holds only for the bore of those sets. Air detection, like the volume on the display, rests on an assumption about the tubing.
Some designs also catch air before it reaches the detector. According to its operating manual, the cassette of ICU Medical's Plum 360 holds up to 1 mL of air in an air trap before the pump raises a cassette alarm, and the pump carries air sensors on both its inlet, or proximal, side and its outlet, or distal, side. Syringe pumps are a different case: a primed syringe has no container to run dry, and the same MHRA guidance rated the risk of air with syringe pumps as minimal. For volumetric pumps it recommended that every pump have some means, by design or by detector, of preventing air embolism, the entry of air into the bloodstream that the next section describes. It also recommended that a detector offered as an option always be bought.
Single bubbles and accumulated air
Pumps apply two limits, because air can arrive as one bubble large enough to matter or as a stream of small ones, each below the single limit, that add up. Baxter's summary gives both: the 2.5 cm single bubble, and more than 1 mL of air accumulated within 15 minutes at room temperature, or more than 1.5 mL at 15.5 °C, with bubbles smaller than 10 µL left out of the count. ICU Medical's specification sheet for the Plum 360, as reproduced by a reseller, gives a distal limit of 0.1 mL for a single bubble and 0.25 mL accumulated in 4.9 mL of fluid, with proximal limits of 0.5 mL and 1.0 mL. The withdrawn MHRA guidance said most volumetric pump detectors stop single bubbles of about 100 µL.
Sensitivity has a price. MHRA noted that more sensitive detectors pick up what it called champagne bubbles, fine bubbles that can cause nuisance alarms, alarms that sound when nothing needs to be done. BD's tip sheet on air-in-line alarms for its Alaris system, which gives no thresholds, names a common cause of nuisance alarms: tubing not fully inserted in the detector. Air alarms are frequent without being the main burden. A 2019 paper by two BD staff analyzed BD Alaris pump logs from European critical care units. Of 467,437 alarms of all kinds, 17,100 were single-bubble alarms and 6,975 air-accumulation alarms, or 3.7 and 1.5 % (Chapter 15).
How much air harms
Air that enters a vein travels with the blood toward the heart and lungs, and enough of it at once, a venous air embolism, can be fatal. A 2016 review gives the lethal venous dose for adults as "between 200 and 300 cc, or 3–5 mL/kg", figures drawn from adult cases and animal models that give no safe volume for a newborn. The same review reports that small amounts of venous air are seen on CT scans in up to 23 % of patients with peripheral intravenous lines, usually without symptoms. Air that reaches the arteries, directly or by crossing from the venous side, is another matter: the review says it can harm "even when the volume of air is small", and gives no threshold.
Set against those figures, a single bubble at a pump's limit is small. At Baxter's 140 µL, it would take about 1,400 such bubbles to reach the lower adult figure of 200 mL. The detector's limits sit far below the adult venous range, and the harmful volumes cited here arrived by routes no pump detector watched. Open lines are one. The 2016 review cites a report in which a large 15 French peel-away sheath admitted 300 mL of air, the top of the adult lethal range, in half a second, through an opening no pump was watching.
Devices with no detector are another. A New South Wales safety newsletter of 2003 relayed reports to Australia's regulator, the TGA, of deaths and serious injuries from air delivered by high-flow infusers and fluid warmers, mostly when partly emptied bags were reconnected. ECRI's list of top health technology hazards for 2023 included inflatable pressure infusers, which squeeze a bag to drive fluid in fast and can deliver fatal air emboli from it. In each case the air reached the patient along a path with no detector on it, from equipment built to move fluid fast.
Air that enters below the detector, at a port or a loose connection near the patient, passes unseen, and so does air from any device that has no detector, such as a pressure infuser. A pump that has not alarmed for air has checked only its own segment of the line.
Length is what the detector sees
The same volume of air looks very different in different tubing. After the pump, air may pass into an extension of much narrower bore, where a given volume stretches into a long column. BD lists a microbore extension set with a 1 mm bore, 250 cm long, holding 2.1 mL when primed. At that bore a bubble of 140 µL fills about 18 cm of tube, so a long white gap in microbore tubing can hold less air than a short one in a standard administration set. The same rule works against the patient inside the pump: if a set of wider bore than the maker specified were loaded, the same 2.5 cm limit would let a larger volume through before alarming.
- Baxter sets its single-bubble limit at 2.5 cm, about 140 µL, in its own sets (the maker's figure). A cylinder's volume is its cross-section times its length, so the cross-section is 140 mm³ ÷ 25 mm = 5.6 mm². A circle of that area has a radius of 1.34 mm (3.14 × 1.34 × 1.34 = 5.6), so the set's bore is about 2.7 mm.
- In BD's 1 mm microbore extension the cross-section is 3.14 × 0.5 × 0.5 = 0.785 mm². The same 140 µL there is 140 ÷ 0.785 = 178 mm long, about 18 cm, and a 2.5 cm bubble holds only 0.785 × 25 = 19.6 µL, about a seventh as much.
- Against the review's lower adult figure of 200 mL, or 200,000 µL, it takes 200,000 ÷ 140 = about 1,400 bubbles at the limit.
- The detector's limit is a length, which the bore turns into a volume, and the same length can mean seven times more air in one tube than in another.
The arithmetic explains why makers state air limits for named sets and why a set from another maker, even one that fits, changes what the detector protects against. It also explains why the accumulated-air limit matters as much as the single-bubble one. Eight bubbles, each just under Baxter's 140 µL single limit, add up to more than 1 mL without tripping it, and only a count kept over time, like Baxter's 15-minute window, will catch them.
In the ward and the workshop, check that the tubing is fully seated in the detector before suspecting the pump, and use only the sets the pump's maker lists, because the air limit was set for their bore. Never clear repeated air alarms by lifting the tubing out of the detector. For a maker, in India or elsewhere: state each air limit as a volume for each compatible set, give the bore it assumes, and test both the single-bubble and the accumulated limit with fine bubbles as well as large ones.
- An air-in-line detector, ultrasonic or optical, sees a gap in its signal as a bubble passes, and the pump turns the gap into a length and, through the bore of its set, a volume.
- Pumps set two limits, one for a single bubble (2.5 cm, about 140 µL, in one maker's sets) and one for air accumulated over time, such as 1 mL in 15 minutes.
- A bubble at such a limit is about 1 part in 1,400 of 200 mL, the lower end of the 200 to 300 mL that a review gives as the lethal venous dose for adults, though arterial air can harm in small amounts and no figure covers newborns.
- The harmful volumes of air cited in this chapter came through routes no pump detector watches, such as pressure infusers, reconnected bags and open lines.
When the pump lets go.
+ The questionWhat happens when a set comes out of a pump with its clamp open, and how did designs stop it?
A pump is also a valve
In 1991 an aide switched off an infusion pump delivering oxytocin, a drug given to start or strengthen labor contractions, without closing the manual clamp on its set, and the mother received nearly 35 times the prescribed dose, as ECRI later recounted. The pump stopped when told to; the open clamp then left gravity in control of the line. Chapters 12 and 13 described what a pump senses while it holds the line. This chapter is about the moment it stops holding it, and about the long effort to make sure that something else holds it then.
A large-volume pump controls flow by closing the tube. The fingers of a peristaltic pump press it shut in sequence, and the valves of a cassette pump close off its chamber (Chapter 4), so that at every moment some part of the mechanism blocks the path from bag to patient. That closure makes the pump the line's valve as well as its motor. Once the set is out of the pump, or the door is open, only two things remain between the bag and the vein: the roller clamp of Chapter 1, if someone has closed it, and the resistance of the set and catheter. ECRI defines what follows: "Free-flow, or unrestricted gravity flow, refers to the uncontrolled delivery of an infusion to a patient."
Gravity's push is easy to estimate. A bag hanging 1 m above the heart drives the fluid with the weight of a 1 m column of water, about 74 mmHg, and MHRA's withdrawn guidance gave about 110 mmHg for a typical hanging bag (Chapter 1). A pump cannot measure flow it no longer controls. In a 2017 column summarizing its work on the hazard, ECRI noted that a pump's alarm can show only that its safety mechanism is not engaged, not that fluid is running, and that some pumps do not alarm at all. Makers, the column added, name the roller clamp as the primary safeguard.
Syringe pumps have their own version. A syringe held above the patient is a small hanging container, and if its plunger is not held by the pump's driver it can empty by gravity, which is called siphonage. The same MHRA guidance recommended anti-siphon valves for syringe users: valves that open only above a set pressure (Chapter 11), so that gravity alone cannot draw the syringe down. Neither an anti-siphon valve nor an anti-free-flow set, MHRA added, replaces closing the roller clamp, which it called "the primary means of occlusion".
The stop key halts the mechanism. If the set is out of the pump, or the pump does not hold the tube shut, the line keeps running at whatever gravity and resistance allow. A 2003 New South Wales safety newsletter advised that in an emergency the roller clamp must be closed, because stopping the pump is not enough.
How fast an open set runs
An open set runs far faster than any drug rate, and its speed is set by the narrowest parts of the path. By Poiseuille's law, the 20 G catheter of Chapter 2 needs only 0.61 mmHg to pass 100 mL/h of water at 20 °C. On the same law it would pass about 200 mL/min at the push of a bag 1 m up, but at that speed the flow is no longer smooth and the law overstates it; the flows makers measure are far lower. BD's product pages give gravity flow rates for its Insyte Autoguard catheters of 20 mL/min at 24 G, 61 mL/min at 20 G and 95 mL/min at 18 G, under test conditions the pages do not state.
- Push of a 1 m column of water: 1,000 kg/m³ × 9.81 m/s² × 1 m = 9,810 Pa. One mmHg is 133.3 Pa, so the push is 9,810 ÷ 133.3 = 73.6 mmHg. The vein's own pressure would subtract a little; it is left out here.
- Why Poiseuille's law fails here: scaled from 0.61 mmHg per 100 mL/h, 73.6 mmHg would pass 100 × 73.6 ÷ 0.61 = about 12,000 mL/h, or 200 mL/min. Through a 0.80 mm bore, whose cross-section is 0.50 mm², that is 3,333 mm³/s ÷ 0.50 mm² = 6.6 m/s. The Reynolds number, density × speed × bore ÷ viscosity, is then 1,000 × 6.6 × 0.0008 ÷ 0.001 = about 5,300, far above the 2,000 or so below which flow in a tube stays smooth, so 200 mL/min is not a real ceiling and the example uses measured flows.
- Catheter as BD rates it (test conditions not stated): 20 mL/min at 24 G to 95 mL/min at 18 G, or 1,200 to 5,700 mL/h; at 20 G, 61 mL/min is 3,660 mL/h.
- Against an order: a 250 mL bag of norepinephrine at 16 mcg/mL running at 30 mL/h gives 8 mcg/min, the label's lowest starting dose, and lasts 250 ÷ 30 = 8.3 h. Open through a 20 G catheter it runs 3,660 ÷ 30 = 122 times faster, giving about 976 mcg/min, and empties in 250 ÷ 61 = 4.1 minutes.
- On these figures an open set runs about 40 to 190 times faster than this drug rate, depending on the catheter, and empties the bag in minutes.
The ratio, more than the absolute flow, is what makes free flow dangerous. The pump's rate set the dose rate. Unrestrained, gravity multiplies the dose rate by the same factor as the flow, so a drug whose dose was worked out to the microgram arrives at about a hundred times its ordered rate. The oxytocin case, at nearly 35 times the prescribed dose, is of the same order. Short-acting drugs of the kind Chapter 10 described act within minutes, so the bag can empty before anyone has looked at the line.
Making the set close itself
Free flow was recognized as a design problem long before it was solved. The 2017 ECRI column records that ECRI's 1982 evaluation of infusion controllers raised the need for safeguards, that in 1992 it recommended phasing out devices without set-based free-flow protection, and that in 1997 it rated devices lacking it "Unacceptable". A set-based anti-free-flow device is a clamp built into the administration set that closes the tube automatically whenever the set is taken out of the pump. The protection then travels with the set instead of depending on someone remembering the roller clamp.
Pressure also came from the Joint Commission, the main accreditor of US hospitals. On 30 November 2000 it issued a Sentinel Event Alert, its bulletin on a kind of serious harm, on infusion pumps. A trade newsletter reported the alert together with recommendations from the US Pharmacopeia, the body that sets US drug standards: identify pumps that can free-flow, quarantine or phase them out, and ask FDA and makers to stop such pumps reaching the market. Among the alert's cases, as the newsletter reported, was 60 mEq of potassium delivered in 20 minutes, three times the intended amount. From 1 January 2003 the National Patient Safety Goals of the Joint Commission, then called JCAHO, required "free-flow protection on all general-use and PCA (patient controlled analgesia) intravenous infusion pumps". Those are the goal's words as a trade newsletter quoted them. A New South Wales newsletter reported the start date that year.
Makers built the answer into the set. In May 2003 FDA cleared Deltec's CADD high-volume administration set with FlowStop, a feature that closes the tube if the set is misloaded or detached from the pump. FlowStop replaced a separate anti-siphon valve. Baxter's 2025 summary for its SIGMA Spectrum pump lists free-flow protection by a slide clamp in the set. No FDA rule is known to have required such protection; the push came from ECRI's ratings and the Joint Commission's goals.
Protection that depends on loading and service
A set that closes itself protects only if the pump, its maintenance and its instructions let it. MHRA listed incidents of free flow after a door-contact check was missed during maintenance, and after the wrong sets were used. In January 2025 BD began a Class II recall because the manual for its Alaris Pump Module 8100 told users to leave the safety clamp open when reloading a set, which risked over-infusion. FDA's record lists about 242,000 systems. In October 2025 BD began a Class I recall because the module's bezel assembly may be damaged if dropped or jarred, with unregulated flow among the possible results. Free-flow protection is a chain of parts and steps, and a missed check at service or a wrong instruction can break it.
In the workshop, include the door and set-detection checks in every preventive maintenance, and confirm after any repair that the pump stops the flow or alarms when its door is opened with a set loaded. On the ward, close the roller clamp before opening the door or removing a set, and take out of service any pump that lets fluid run with the door open. For a maker, in India or elsewhere: build the protection into the set so that it closes on removal, list only sets that carry it, and read the instructions for any step that leaves a clamp open.
- A large-volume pump is also the line's valve, so once a set leaves it with the roller clamp open, gravity alone drives the flow, and the pump cannot measure it.
- A bag 1 m above the heart pushes with about 74 mmHg, and one maker gives gravity flows of 20 to 95 mL/min through common catheters, about 40 to 190 times a 30 mL/h infusion.
- ECRI raised the hazard in 1982 and rated pumps without set-based protection unacceptable in 1997, and the Joint Commission's goals required free-flow protection from 2003.
- Protection travels with the set but depends on loading, service and instructions, as BD's 2025 recall over a manual that said to leave a safety clamp open showed.
Alarms someone acts on.
+ The questionWhy do so many pump alarms go unanswered, and what makes an alarm worth hearing?
Two and a half alarms for every infusion
Pump logs from hospitals in Europe recorded about 2.2 million alarms during about 1.6 million infusions; 467,437 of those alarms came from critical care units, during 187,441 infusions. The logs came from 1,183 BD Alaris pumps, 566 large-volume and 617 syringe pumps. Two BD employees analyzed these logs in a 2019 paper, and BD funded the study. Chapters 12 to 14 showed what a pump can sense: pressure in a blocked line, air passing its detector, a door or set out of place. Each of those ends in an alarm, and the alarm is the only way the pump's knowledge reaches a person. A sensor whose alarm goes unanswered protects nobody.
Two words need their field sense here. An alarm is a signal from the pump that a condition needs attention, from a blocked line to an infusion about to finish. An alert is a prompt on the screen that asks the user to confirm or change an entry, such as a drug library's warning that a dose exceeds a soft limit (Chapter 21). IEC 60601-1-8, the international standard for alarm systems in medical electrical equipment, sorts alarm conditions into priorities by degree of urgency, so that a pump can tell a person how soon to come as well as that something is wrong. It is in force as the 2006 edition with amendments of 2012 and 2020, and FDA recognizes it.
What pumps alarm for
The 2019 paper breaks the critical care alarms down by type. Downstream occlusion led with 136,148, or 29.1 %, the blockages of Chapter 12. Close behind came 134,754 callback alarms, 28.8 %; a callback is a reminder that a pump has been left unattended, not a fault. Near end of infusion accounted for 107,236, or 22.9 %, and end of infusion for 20,762. Single-bubble and air-accumulation alarms, the subject of Chapter 13, totaled 24,075, about 5 %. Syringe disengaged (15,400), upstream occlusion (14,602), drive engage failure (10,850) and end of syringe (3,396) made up nearly all the rest.
The near-end and end alarms count down the volume to be infused, the amount the user programmed the pump to deliver. At the end a pump can fall back to a keep-vein-open rate, a trickle that keeps the catheter open until someone comes. These alarms are predictable by design: the pump knows from the start when they will sound. Sorted by what each type asks of a nurse, the counts fall into two groups. Callbacks, near-end and end-of-infusion alarms and end-of-syringe alarms announce an expected event or a pump left waiting. Occlusions, air, a syringe out of its holder and a drive that failed to engage report a condition that has stopped or threatens delivery.
- All critical care alarms, 467,437, divided by all infusions, 187,441, give 2.49 alarms per infusion. The paper reports 4.50, the plain average of four unit ratios: (3.71 + 4.36 + 1.33 + 8.61) ÷ 4 = 4.50.
- Expected events and reminders: callbacks 134,754 + near end 107,236 + end of infusion 20,762 + end of syringe 3,396 = 266,148, or 56.9 % of all alarms.
- Faults that stop or threaten delivery: downstream occlusion 136,148 + upstream occlusion 14,602 + single bubble 17,100 + air accumulation 6,975 + syringe disengaged 15,400 + drive engage failure 10,850 = 201,075, or 43.0 %. The other 214 fall in neither list: 14 door-open alarms and 200 that the paper's counts by type do not account for.
- Per infusion that is 201,075 ÷ 187,441 = 1.07 fault alarms and 266,148 ÷ 187,441 = 1.42 others.
- In this log fewer than half of all alarms reported a fault, and because the log cannot tell a blocked catheter from a kink cleared in seconds, 43 % is an upper bound on alarms that reported a fault in the pump or line.
The paper does not say how many alarms were actionable, so the sorting above is this guide's, not the paper's. It is generous to the fault group, since a downstream occlusion alarm may come from a catheter that has clotted or from an arm bent for a minute. Even so, more than half of what a critical care nurse hears from these pumps is a reminder or the announcement of something expected. The two averages tell their own story: the pooled figure is lower because most infusion starts were in units with fewer alarms per infusion, while the pediatric ICU, at 8.61, contributed only 904 of the 187,441 starts.
Dividing total alarms by total infusions and averaging each unit's ratio give different answers from the same log, here 2.49 and 4.50, because a small unit counts as much as a large one in the second method. A comparison of alarm burden between hospitals, units or products means little until the method is stated.
When alarms stop being heard
One reason alarms go unanswered is their number. The Joint Commission's 2013 report on alarm system safety noted that alarm signals of all kinds can reach several hundred per patient per day on some units. Each one asks for a judgment, and when most need nothing urgent, staff learn to treat them as background, a response hospitals call alarm fatigue. In its Sentinel Event Alert of 8 April 2013 the Joint Commission counted 98 alarm-related events reported to it from January 2009 to June 2012, of which 80 ended in death, 13 in permanent loss of function and 5 in extra care or a longer stay; infusion pumps were among the devices named. FDA's database held 566 alarm-related deaths from January 2005 to June 2010, across all devices.
The response took the form of a goal. The Joint Commission's National Patient Safety Goal NPSG.06.01.01, "Improve the safety of clinical alarm systems", came in two phases for hospitals. Phase I, effective 1 January 2014, asked leaders to make alarm safety a priority by 1 July 2014 and hospitals to identify their most important alarm signals during 2014. Phase II, from 1 January 2016, required policies and procedures and staff education. Its scope named "IV machines". On 1 January 2026 the Joint Commission replaced these goals with National Performance Goals, and alarm safety became NPG.01.05.01, which asks hospitals to identify their most important alarm signals and to document policies and procedures for them. A 2012 survey cited in the report drew about 1,600 responses: 90 % called alarm management a safety issue, and fewer than half had an organization-wide process. Trade reports of ECRI's hazard lists put alarm hazards first for 2012 and 2014, with infusion pump medication errors third in 2012 and second in 2014.
Alarms also fail in the other direction. FDA's 2010 white paper reported that "some pumps fail to activate pre-programmed alarms when problems occur", while "others activate an alarm in the absence of a problem." Both kinds have recurred. BD's Class I recall of its Alaris system in February 2020 covered, among five issues, a low-battery alarm that could fail and the priority given to keep-vein-open and end-of-infusion alarms. Fresenius Kabi's Ivenix software recall begun on 14 November 2025 covered a misreported battery capacity that could shut the pump down without a low-battery alarm. In 2025 ICU Medical's Smiths Medical unit recalled CADD-Solis VIP ambulatory pumps for false upstream occlusion alarms, a cause FDA records as labeling design.
Seconds against half-lives
Some answers can be timed. The same BD-authored paper measured, for infusions of the short-acting drugs epinephrine, norepinephrine, dobutamine and dopamine, the time from an interruption to the infusion's restart. Median times were short: 17.5 seconds in the neonatal ICU, 12.75 in the pediatric ICU, 7.5 in the general ICU and 8.38 in the cardiac ICU. The neonatal mean was 58.73 seconds, and the longest neonatal restart in the paper's table was 444.25 seconds, although its text mentions some responses beyond 13 minutes. The paper set these times against half-lives of 180 seconds for epinephrine, 120 for dobutamine, 60 to 120 for dopamine and 120 to 180 for norepinephrine (Chapter 10).
Against a half-life of 180 seconds, a 17.5 second gap costs little, about a tenth of a half-life. The longest restart in the paper's table is another matter. At 444 seconds, about 2.5 half-lives of epinephrine, a simple model in which the drug clears at a constant fractional rate leaves about 18 % of its steady level: two half-lives leave a quarter, and the further 0.47 of a half-life reduces that to about 18 %. The model ignores how the body redistributes a drug. The medians describe units that answer quickly, and the patient at risk is the one in the tail.
An alarm is worth hearing when it is rare enough to be believed, reports a condition that needs a person, and says how urgently. The earlier chapters supply the levers: an occlusion limit matched to the line cuts false occlusion alarms (Chapter 12), seated tubing and the right set cut nuisance air alarms (Chapter 13), and priorities by urgency, as IEC 60601-1-8 defines them, let the urgent alarm stand out from the reminders. The Joint Commission's goal asks hospitals to do the same sorting for every device that alarms, starting from the signals that matter most, and to back the result with documented policies and procedures.
For the biomedical engineer or pharmacist who looks after a fleet: pull alarm data from the pumps' own logs (Chapter 25), count them by type and by unit, and divide totals by totals. Start with the largest category that needs no action, such as callbacks, and the largest fault category, in this log downstream occlusion, and trace each to its cause: a limit too low for the line, a set that kinks, a reminder nobody needs. Write the resulting settings into policy, as the Joint Commission's goal requires, and check that every change leaves the urgent alarms loud.
- In one maker's logs from European critical care units, pumps raised 467,437 alarms in 187,441 infusions, 2.49 per infusion when totals are divided, though the paper's average of unit ratios gives 4.50.
- Downstream occlusion (29.1 %), callbacks (28.8 %) and near-end warnings (22.9 %) led, and 56.9 % of all alarms announced an expected event or a reminder rather than a fault, so the urgent alarm has to stand out from the routine ones.
- The Joint Commission counted 80 deaths among alarm-related events from 2009 to 2012 and made alarm safety a goal from 2014, and FDA's white paper and recalls of 2020 and 2025 describe pump alarms that failed to sound or sounded falsely.
- Median restart times for short-acting drug infusions were 7.5 to 17.5 seconds against half-lives of minutes, but the longest in the paper's table, 444 seconds, would leave about 18 % of the drug's level in a simple model.
+ Part V · Told what to do
Told what to do.
FDA's white paper of April 2010 recorded that "a software problem called a 'key bounce' caused an infusion pump to occasionally register one keystroke (e.g., a single zero, '0') as multiple keystrokes (e.g., a double zero, '00')." The paper named no pump and gave no dose. The paper filed the fault under software defects, yet the number the fault corrupted was one that a person had typed, and every infusion passes through such numbers before any mechanism moves. Chapter 16 turns a dose into a rate and shows where tenfold errors enter, Chapter 17 sets out which keypads and screens invite wrong entries, and Chapter 18 explains how a maker shows that a pump can be programmed safely. Chapter 19 turns to the connector at the end of the line, which can take a correct dose to the wrong place, and to the feeding pumps behind a new connector standard.
From an order to a keypad.
+ The questionHow does a dose in micrograms per kilogram per minute become a rate in milliliters an hour, and where does a tenfold error come from?
Three numbers stand between a dose and a rate
A dose rate is the amount of a drug that a patient is to receive in a unit of time, and for many drugs given by infusion it is also scaled to body weight. An order for norepinephrine, a drug that raises blood pressure, might read 0.1 micrograms per kilogram per minute, written 0.1 mcg/kg/min on charts and pump screens. The pump has no use for that figure. It moves a volume at a rate in milliliters an hour, and the sensors of Part IV watch only the line that the volume enters: the pressure behind a blockage, a bubble crossing an ultrasonic beam, a door or set out of place. None of them can tell whether the rate itself was the one the order meant.
Three numbers turn the dose rate into a pump rate, each in a separate step. The patient's weight in kilograms turns the dose per kilogram into a dose per minute. Sixty turns minutes into hours. The drug's concentration, the mass of drug in each milliliter of the bag, divides the dose per hour into milliliters per hour. Of the three, only sixty is fixed. The weight comes from a scale, a chart or an estimate, the concentration from a bag label or a drug library (Chapter 21). A pump in dose-calculation mode does the arithmetic once the weight, concentration and dose are entered; in plain milliliter mode it receives the answer worked out by a nurse. Either way, a person supplies the numbers that the arithmetic rests on.
A program carries more than a rate. The nurse also enters the volume to be infused, the amount after which the pump ends the infusion, and many pumps then drop to the keep-vein-open rate of Chapter 4. A secondary infusion (Chapter 4) hands back to the primary infusion when it is done. Each of these is another number typed or confirmed. The volume to be infused, divided by the rate, also gives the time the infusion should take, the simplest check on a rate that a screen can show, and the worst case in this chapter turns on its absence.
The bag sets the concentration
The concentration is the number most easily taken for granted, because it is printed on the bag. The FDA-approved prescribing information for Baxter's premixed norepinephrine, revised in February 2026, lists three strengths in 250 mL bags: 4 mg, 8 mg and 16 mg, which are 16, 32 and 64 mcg/mL. Those strengths are stated as norepinephrine base, the drug molecule alone. What is dissolved is a salt, norepinephrine bitartrate monohydrate, which weighs about twice as much for the same amount of drug, and the same label gives it as 31.9, 63.8 and 127.6 mcg/mL. A library entry or a hand calculation built on the salt figure for the first bag would deliver about half the intended dose, since 16 divided by 31.9 is 0.50.
The strength also decides the number that a nurse types. On the arithmetic of the solved example below, a dose that runs at 30 mL/h from the 16 mcg/mL bag runs at 7.5 mL/h from the 64 mcg/mL bag. A rate is therefore meaningless without its concentration, and one carried over from a handover note or a previous bag of another strength is wrong by the ratio of the strengths, here 2 or 4. The label itself doses in micrograms a minute, not per kilogram: it gives 8 to 12 mcg/min to start and 2 to 4 mcg/min to maintain; at 16 mcg/mL the maintenance dose is 7.5 to 15 mL/h and the starting dose 30 to 45 mL/h. Many intensive care units order the same drug per kilogram instead, so two conventions for one drug can circulate in one building.
The order is 0.1 mcg/kg/min for a patient of 80 kg, an illustrative weight, from the 4 mg in 250 mL bag on the FDA label. - Concentration: 4 mg is 4,000 mcg, and 4,000 ÷ 250 = 16 mcg/mL. - Dose per minute: 0.1 × 80 = 8 mcg/min, the lowest starting dose on the label. - Dose per hour: 8 × 60 = 480 mcg/h. - Rate: 480 ÷ 16 = 30 mL/h. - Decimal point moved one place to the right, 1.0 mcg/kg/min: 80 mcg/min, 4,800 mcg/h, 300 mL/h. - Moved one place to the left, 0.01 mcg/kg/min: 0.8 mcg/min, 48 mcg/h, 3 mL/h. The intended rate is 30 mL/h. One misplaced decimal point gives ten times or one tenth of the dose, and the pump receives 300 or 3, numbers it has no reason to refuse.
Norepinephrine is also titrated: its rate is raised or lowered in small steps against the patient's measured blood pressure, so one infusion may be reprogrammed many times, and each change is a fresh entry. The concentration entry can fail even in software built to check it. In February 2020 BD began a recall of its Alaris system for five issues, one of them errors in programming custom concentrations. FDA classified the recall Class I, and Chapter 26 follows it. ISMP, the Institute for Safe Medication Practices, places intravenous adrenergic agonists such as norepinephrine on its list of high-alert medications, drugs that "bear a heightened risk of causing significant patient harm when they are used in error."
How a decimal point multiplies a dose by ten
The factor of ten in a tenfold error is no coincidence. In written numbers each position is worth ten times the one to its right, so a digit added, a digit lost or a decimal point moved by one place multiplies or divides the whole number by exactly ten. Such tenfold errors arise wherever a number is written, read or keyed: in the order, in the pharmacy, at the pump. The white paper's key bounce produces the same factor mechanically. If the zero of a 30 mL/h rate registered twice, the pump would run at 300 mL/h.
A tenfold error is also large without being absurd, and that is what makes it hard to catch. One maker's 510(k) summary states the accuracy of its large-volume pump from 0.1 to 999 mL/h, and both 3 and 300 mL/h lie well inside that span, so a pump that checks only whether a rate is within its mechanical range cannot tell 300 from 30. Other conversion factors produce errors of their own size: 1,000 between milligrams and micrograms, 60 between minutes and hours, and the patient's weight between a dose per minute and a dose per kilogram per minute.
An entry of 8 meant as mcg/min but read as mcg/kg/min, for the same 80 kg patient, asks for 640 mcg/min. From the 16 mcg/mL bag that is 2,400 mL/h, beyond the range, and the pump refuses it; from the 64 mcg/mL bag it is 600 mL/h, and the pump accepts it. Whether a slip is caught therefore depends on the other numbers in the arithmetic, not on the size of the slip. A drug library narrows the accepted range for each drug, as Chapter 21 shows, but it can reject only what falls outside its limits.
The pump in a fatal case from Alberta in 2006 had no dose limits at all. ISMP Canada's root-cause analysis, published in 2007, describes fluorouracil, a cancer drug, ordered at 5,250 mg as a continuous infusion over four days. The intended rate was 1.2 mL/h. The pump was programmed at 28.8 mL/h, "24 times greater," and the drug ran in about four hours instead of 96. The factor of 24 is the number of hours in a day: 28.8 mL is what the pump should have delivered in a whole day. The pump did not show how long the infusion would take, so nothing on its screen contradicted the entry. The patient died on 22 August 2006, and Chapter 25 returns to the pump's data history, which confirmed the rate afterward.
Bedside studies count different things
Studies that watch infusions at the bedside show how often rates go wrong, and how rarely the cause is a slip at the keypad alone. A 2018 study in 16 English hospital trusts observed 2,008 infusions and found errors in 231 of them, 11.5 %, and discrepancies, which it counted separately, in 1,065, or 53.0 %. Only 23 infusions, 1.1 %, carried errors judged potentially harmful. Deviations in rate appeared in 152 infusions, 7.6 %, split almost evenly between errors and discrepancies.
A 2005 study at Northwestern Memorial Hospital found at least one error in 285 of 426 pump infusions, 66.9 %, but of its 37 rate deviations only 3 were programming mistakes, and its authors judged that the smart pumps of the day would have prevented only one error without further features. A 2017 study in ten US hospitals observed 1,164 intravenous administrations and found at least one error in 699 of them, or 60 %. Two of its authors were on the staff of BD, a pump maker, and the CareFusion Foundation and AAMI funded it. Its count included deviations from hospital policy, such as labeling. Its most frequent errors were unauthorized medication, infusions run without the smart pump's drug library, and wrong rates.
The 60 %, 11.5 % and 66.9 % above are not three estimates of one quantity. One study counted deviations from hospital policy as errors, one set errors apart from discrepancies, and one found that only 3 of its 37 rate deviations were programming mistakes. None is a rate of keypad slips, and an error rate can be compared only with another built on the same definitions.
The pattern across the three studies holds even though their totals differ. Wrong rates are common, but a slip at the keypad is one source among several: a bag of another strength, a rate carried over from an earlier order, a library skipped, an order never written. The pump sees only the final number. Chapter 17 asks which ways of entering it make a wrong one more likely, and Chapter 18 how a maker shows that its own screens do not invite such errors.
For pharmacists building a drug library, enter each concentration exactly as the label states it, noting whether it is base or salt, and in the same unit as the order. Keep the number of strengths per drug small, because each added strength is another factor by which a carried-over rate can be wrong. Give each drug entry one dose unit, per minute or per kilogram per minute, so that the two conventions cannot meet on one screen. Check that the pump shows the expected duration beside the rate, and add that check to the library's acceptance tests.
- A pump receives a rate in milliliters an hour, and the dose rate in the order reaches it only through a weight, a concentration and the factor of sixty, each supplied by a person or a library.
- The concentration on the bag decides the number keyed: the same norepinephrine dose runs at 30 mL/h from a 16 mcg/mL bag and at 7.5 mL/h from a 64 mcg/mL bag.
- Because each written digit is worth ten times the next, a moved decimal point, a lost digit or a doubled zero changes a rate by exactly ten, and 3 or 300 mL/h lies inside one maker's stated range.
- Bedside studies find wrong rates often but keypad slips rarely among them, and their headline error rates count different things.
Screens that invite errors.
+ The questionWhich ways of entering a number lead to wrong entries, and what has research measured?
A pump that stored a different number
In a 2010 study of number entry, Thimbleby and Cairns keyed 10,000 mg/h into a Graseby 3400 syringe pump, and the pump recorded 100.00 mg/h without a warning. Every key had been pressed as intended, yet the number in the pump was a hundredth of the number typed. The same paper reported that the Graseby 500 discarded every digit after the first one past the decimal point, and that an unfinished entry on the 3400 reset itself after about 4 seconds. These were pumps and software of that era, not current products, but they answer the question Chapter 16 left open. Arithmetic that is right on paper still has to pass through a keypad, a program and a screen before it becomes a rate.
Pumps take numbers in two main ways. In serial entry, digits are typed in order on a numeric keypad, as on a calculator. In incremental entry, arrow keys or on-screen chevrons step a displayed number up or down until it reads correctly. Each fails in its own way. A keypad accepts any sequence of keys, including sequences that are not well-formed numbers, and the pump's software must decide what to make of them. Arrow keys can produce only numbers the pump is able to hold, but they are slow, as the measurements later in this chapter show. The interface therefore does more than pass a number from a nurse to a motor: it decides which mistakes are possible, which are caught and which pass silently into the rate.
Malformed numbers, and the zero that doubled
A malformed number is a keystroke sequence that is not a valid number for its field: two decimal points, digits beyond the field's precision, or superfluous zeros at the front. Thimbleby and Cairns argued that a pump should block such an entry rather than repair it silently as the Graseby pumps did. They tested the idea in a simulation of 5,000 runs of random keying errors against target numbers from 0.01 to 99.99, with a wrong keystroke at most 1 time in 10, and probably 1 in 100 to 1 in 20. Blocking malformed numbers removed between 32.7 % and 55.2 % of the errors that left a number out by ten, wrong by a factor of ten or more, depending on the assumptions. The figures come from a model, not from wards.
The key bounce of FDA's 2010 white paper is the opposite case: not a person's wrong keystroke but a digit that nobody typed. The fault lay in the program that reads the keys, and Chapter 20 shows the timing that prevents it. Where such a fault strikes matters. A 2013 analysis of real pump logs found that the digit 0 is used far more than any other, and that the values 1,000, 100 and 50 appear in nearly half of all infusions, so the key pressed most often is the very key that the white paper's example doubled.
Malformed numbers were still the subject of a recall in 2025. On 14 November 2025 Fresenius Kabi began a correction of software 5.10.1 and earlier on its Ivenix large-volume pump, which FDA classified Class I. One of its two faults froze the screen when a rate entered with two leading zeros exceeded the drug library's limit, leaving the pump in what FDA's record calls a fail-stop state (Chapter 20). FDA's record lists 30 units, with two serious injuries and no deaths reported as of 18 November 2025. The fix was pump software 5.10.2 with version 5.2.2 of the management software. Until it arrived, users were advised to "avoid programming infusates with two leading zeros when possible." Fifteen years after the white paper, zeros at the front of a number were again a hazard, and Chapter 20 follows what became of the fix.
What laboratory studies have measured
Laboratory studies have compared the two styles directly. In a 2015 study, 22 participants entered 90 numbers on each of a keypad and an incremental interface. Their error rates were 1.36 % with the keypad and 1.41 % with arrow keys, a difference too small to be significant, but each number took 4.95 seconds on the keypad and 25.45 seconds with arrows, about five times as long. In 74.95 % of trials the participants did not look back at the display before confirming. They were students working at a laboratory task, not nurses on a ward, so the figures compare the two styles rather than measure error rates in hospitals.
According to later papers that summarize them, two earlier studies point to the checking step as the place where entry errors are caught or missed. A 2011 study found that incremental interfaces led participants to notice more of the errors deliberately inserted into their entries, and to look at the display for longer. A checksum is a short number worked out from the digits of an entry, so that a wrong digit almost always changes it. A 2013 study of checking found that participants caught every error when they had to enter a checksum themselves, but only 36 % when they were asked to verify one shown to them. A check that makes a person produce a number catches more than a check that asks them to look at one, a finding that bears on how a second nurse checks a pump before a high-alert infusion starts.
The 2015 laboratory rates are 1.36 % per number on the keypad and 1.41 % with arrow keys. A program of three numbers, a weight, a rate and a volume to be infused, is entered without a slip with probability 0.9864³ = 0.960 on the keypad and 0.9859³ = 0.958 with arrows. - Chance of at least one slip: 1 − 0.960 = 4.0 % on the keypad, and 1 − 0.958 = 4.2 % with arrows. - Time for the three numbers: 3 × 4.95 = 14.9 s on the keypad, and 3 × 25.45 = 76.4 s with arrows. - Over an illustrative 20 programs in a shift: 20 × 0.040 = 0.8 programs with a slip on the keypad, against 20 × 0.042 = 0.84 with arrows. At these rates about 1 program in 25 carries a slip whichever style is used, and the arrows cost about a minute more per program without making slips rarer.
A screen that shows the number the pump will use
FDA's white paper filed its other examples under user-interface issues. It cited "numerous reports of confusing or unclear on-screen user instructions," and it described the screens of the opening story that left a patient's weight unclear between pounds and kilograms, "leading to inappropriate dosing." A weight in the wrong unit is an error the size of the conversion factor, the same arithmetic as in Chapter 16, and nothing in a keypad prevents it. Only the screen can, by showing the unit beside the number and the consequence beside the rate: the dose as the pump has understood it, and the time the infusion will take. In the Alberta case of Chapter 16, the pump did not show the duration.
A report in FDA's adverse event database, quoted in the 2010 paper by Thimbleby and Cairns, describes a pump programmed at 68 mL/h instead of 6.8 mL/h: "The patient expired the next day." The authors point out that the record cannot say how the error arose, because a pump keeps the number it accepted, not the keys pressed to reach it. A missed decimal key, a key that registered twice and a misread order all leave the same 68 behind.
An event log shows the rate a pump ran, when it was entered and, on pumps with a drug library, the alerts it raised. It does not show whether the user pressed the decimal key, whether a key registered twice or what the order said. An investigation that finds 68 where 6.8 was meant has found the outcome of an error, not its mechanism, and Chapter 25 sets out what logs can and cannot establish.
An interface can also enter numbers that nobody chose. In May 2026 Fresenius Kabi began a further recall of Ivenix large-volume pumps because a drop or a severe jolt could loosen the touchscreen's input cable so that "unintended touch inputs may register at arbitrary screen locations." FDA classified the recall Class I; its record lists 18,444 units. A key that bounced in the 2000s and a touchscreen that registers phantom touches in 2026 are one hazard at two ends of the period this guide covers: input the user did not give, arriving in a field that the pump will read as part of a dose.
For pump makers, including those designing for Indian hospitals, reject malformed numbers, such as two decimal points, digits beyond the field's precision or leading zeros, and ask for the entry again instead of trimming it. Show every accepted number with its unit, and beside the rate show the dose it gives and the time to the end of the volume to be infused. Test number entry with the values real logs are full of, 0, 50, 100 and 1,000, and with a zero that registers twice. Record keystrokes as well as accepted values in the event log, so that an investigation can tell a user's slip from a software fault.
- An interface can change a correct number on its way into a pump: two Graseby pumps tested in 2010 altered or truncated entries without a warning, and one reset unfinished entries.
- A simulation found that blocking malformed numbers removes about a third to a half of out-by-ten errors, and an entry with two leading zeros still froze a large-volume pump in a Class I recall begun in November 2025.
- In a laboratory study, keypads and arrow keys gave similar error rates of about 1.4 % per number, but the arrows took about five times as long and most participants never looked back at the display.
- A pump's log keeps the accepted number and not the keystrokes, so the screen, showing unit, dose and duration, is where an interface can expose a wrong entry before it runs.
Testing with the people who will use it.
+ The questionHow does a maker show that nurses can program a pump safely before it is sold?
Infusion pumps as FDA's example
On 29 May 2026 FDA finalized its guidance on the human factors information that a medical device marketing submission should contain. When it needed an example of a device type that "historically has been associated with known use error issues," it named infusion pumps. The arithmetic of Chapter 16 and the keypads of Chapter 17 are where a working pump meets the person who programs it. A laboratory study of students cannot show how one particular pump, with its own screens, sets and users, will fare. A maker has to show that for its own design before the pump is sold. The discipline that does so is called usability engineering, or human factors engineering, and FDA's guidance on the subject puts both names in its title.
Its central idea is the use error: an action, or a failure to act, by which a user brings about a result that the maker did not intend or the user did not expect. A rate entered in the wrong unit is a use error, and so is a set loaded with its clamp left open (Chapter 14) or an alarm silenced and forgotten (Chapter 15). The term deliberately avoids blame. It treats the error as the outcome of a meeting between a person and a design, which the designer can change, rather than as a fault of the person. That makes the maker's question concrete: which use errors does this pump allow, and how likely and how harmful is each?
A process that starts from the tasks
IEC 62366-1 sets out the work as a process to analyze, specify, develop and evaluate a device's usability as it bears on safety. Its first edition was published on 25 February 2015, replacing IEC 62366 of 2007, and an amendment of 2020 was merged with it into a consolidated edition 1.1 on 17 June 2020. ISO records the standard as confirmed in June 2021 and current, with no successor in development as of October 2026. It covers normal use, including use errors, and leaves out what it calls abnormal use. The process begins with tasks rather than screens: what the users must do, in what conditions, and what could go wrong at each step.
For a pump the task list is long: hang a bag or load a syringe, seat the set, prime it, select a drug, enter a concentration, a weight, a dose and a volume to be infused, start, answer an alarm, change a bag. Each task is examined for the use errors it allows and the harm each could cause. The result picks out the critical tasks, which FDA's guidance defines as user tasks that, if performed incorrectly or not performed at all, "would or could cause serious harm." A task is critical because of what its failure would do, not because it is difficult.
FDA's infusion pump guidance of 2 December 2014 asks that the hazard analysis cover "drug loading, priming, programming, infusion." Its table of hazards includes a key struck twice, a wrong key, programming sequences "beyond user expectations or capabilities," an incorrect concentration and a wrongly loaded set. The table reads as a summary of Chapters 14, 16 and 17, and it turns the errors those chapters trace into hazards for a maker to analyze and test before a pump is sold.
Design then proceeds in rounds. Formative evaluations, smaller studies with users during development, find where people stumble while the design can still change, and each round feeds the next version of the screens, the set and the instructions. The last step is a human factors validation test, also called a summative test. Representative users perform the critical tasks on the final design, and every use error, close call and difficulty is recorded and traced to its cause. The 2014 guidance says that a pump submission "should include a Human Factors Validation study report." A use error on a critical task found at this stage has to be explained, and a cause in the design can send it back to an earlier round.
Two FDA documents of 2026
In 2026 FDA finalized one of its human factors documents and revised the other. The guidance of 29 May 2026 covers the content of human factors information in marketing submissions. It finalizes a revised draft of 9 December 2022, which had itself replaced a 2016 draft list of the devices of highest priority for human factors review. FDA generally does not expect the new content in submissions received before 1 August 2026. The guidance sorts submissions into three categories, chosen through four decision points, A to D. At D, a device type with a history of known use errors is one for which validation data are likely to be needed. Infusion pumps are the example, which points a new pump toward the third category.
| Category | What the submission contains |
|---|---|
| 1 | A conclusion that human factors are unaffected |
| 2 | A rationale: there are no critical tasks, or no validation data are needed |
| 3 | A full human factors and usability engineering report, including validation testing |
The second document, Applying Human Factors and Usability Engineering to Medical Devices, was first issued on 3 February 2016 and revised on 3 August 2026. The revision keeps the rule of the 2016 text for validation tests: "the minimum number of participants should be 15" for each distinct user group. A pump programmed by intensive care nurses, configured by pharmacists who build its drug library and serviced by biomedical technicians may have three user groups, and so, on that rule, at least 45 participants. Both documents are final guidance, not drafts, and Chapter 28 places them in the clearance process for a pump.
Why fifteen participants
Fifteen is not a figure for finding every problem but for finding the common ones. The revised guidance's appendix on sample size cites a 2003 study by Faulkner. The model behind such figures is simple. If every participant has the same chance of meeting a given problem, independently of the others, the chance that at least one of them meets it is one minus the chance that all of them miss it. A common use error is then almost certain to appear in a test of fifteen, and a rare one is likely to be missed, as the example below shows.
A use error is made by 1 user in 10 who attempt the task. Each of 15 participants misses it with probability 0.9, so all 15 miss it with probability 0.9¹⁵. - 0.9¹⁵ = 0.206, so at least one participant meets the error with probability 1 − 0.206 = 0.794, about 79 %. - For an error made by 1 user in 20: 0.95¹⁵ = 0.463, and 1 − 0.463 = 54 %. - For an error made by 1 user in 100: 0.99¹⁵ = 0.860, and 1 − 0.860 = 14 %. Fifteen participants will usually reveal a use error that one user in ten makes, have about even odds of revealing one that one in twenty makes, and will usually miss one that one in a hundred makes.
A pump that is programmed many times a day across a hospital will meet use errors that fifteen participants per group are unlikely to show. A clean validation test means the known critical tasks were performed without errors that matter; it does not show that rare errors are absent. Those are reduced by design, such as limits in the drug library or connectors that cannot be joined wrongly, and found after release.
What a simulated ward cannot show
A validation test measures tasks, not working days. The 2017 study of ten US hospitals in Chapter 16 found infusions run without the smart pump's drug library among its most frequent errors. Two of its authors were BD staff, and the CareFusion Foundation was among its funders. Running an infusion around the library is a decision taken on a ward, under that ward's pressures. A test that asks participants to program a dose through the library, under observation, is not built to measure how often they would bypass it over a full shift.
Human factors work therefore continues after clearance. Chapter 21 shows how often drug libraries are bypassed in practice, Chapter 25 what pump logs reveal about it, and Chapter 31 how use errors reach FDA as reports once pumps are in service. The validation test establishes that the final design, used by the people it was designed for, does not invite the errors its makers could foresee. It cannot establish how a hospital will use it, and the connectors of Chapter 19 show the other route the field has taken: a design that makes one class of error impossible, whatever the user does.
For a pump maker, including an Indian maker preparing a first US submission, write the use-related risk analysis first and derive the critical tasks from it: concentration and weight entry, dose and volume to be infused, set loading, alarm response. Recruit at least 15 participants from each distinct user group, drawn from the people who will use the pump in the market it is sold into, and test the final design with its real instructions and training. Plan for Category 3, the full report, under FDA's May 2026 guidance for any submission received from 1 August 2026. Keep the IEC 62366-1 usability engineering file as the record for every market, noting that EN 62366-1 was not on the EU's list of harmonized standards for the MDR in June 2026 (Chapter 29).
- Usability engineering, set out in IEC 62366-1 (2015, consolidated with its 2020 amendment), starts from the tasks users perform and picks out the critical tasks whose failure could cause serious harm.
- FDA's 2014 pump guidance asks for a human factors validation report and names a key struck twice, an incorrect concentration and a misloaded set among the hazards to analyze.
- In 2026 FDA finalized guidance on human factors content in submissions, with infusion pumps as its example of a device likely to need validation data, and revised its 2016 guidance while keeping a minimum of 15 participants per user group.
- Fifteen participants will usually reveal a use error made by 1 user in 10 but will usually miss one made by 1 in 100, so validation confirms a design rather than proving rare errors absent.
A connector that cannot fit.
+ The questionHow did feeding tubes come to be connected to veins, and what has a new connector standard changed for feeding pumps and their sets?
Feeds that reached a vein
In 2014 the Joint Commission, which accredits US hospitals, cited 116 published cases, in 34 papers, in which an enteral feed had been delivered into an intravenous line, and 21 of those patients died. Enteral feeding delivers liquid formula into the stomach or small intestine through a tube, and an enteral feeding pump moves it at a set rate. Formula is made for the gut, not the bloodstream. A feeding line joined to a catheter in a vein delivers it into the blood, and the pump, which infers volume from its mechanism and senses at most pressure and air in the line, has no means of knowing where its line ends. The rate can be exactly the one ordered and the patient still harmed, because the fluid went into the wrong tube.
Chapter 18 showed how a maker tests whether people can program a pump correctly. For this error, a clearer screen or more training does not reach the cause. The Joint Commission's earlier alert, of 3 April 2006, described nine cases reported to it, in seven adults and two infants, eight of them fatal, according to a trade publication's summary at the time. Four were enteral feeds into intravenous catheters and two were blood-pressure cuff tubes joined to intravenous catheters; the others put barium into a central line, a feed into a peritoneal dialysis catheter and intravenous fluid into a tracheostomy cuff. The common factor was not a drug or a dose but a connection.
The problem was wider than feeding. In a 2010 review, the Pennsylvania Patient Safety Authority counted 36 reports of wrongly joined lines in 21 months, 35 of them between two lines that both carried liquid. They included eight secondary intravenous sets attached to the wrong port, five reversed hemodialysis lines, three reversed gastric and jejunal feeding ports, two swapped epidural and patient-controlled analgesia lines, and two feeding sets connected to central venous catheters. A misconnection, a line joined to a port meant for another, can happen between almost any two tubes at a bedside that share a connector.
One connector that fit everything
That shared connector was the Luer connector, the small tapered fitting on intravenous lines and syringes. Feeding tubes, epidural lines and cuff tubes also used it, or a fitting close enough to mate with it. A connector that fits everything turns each connection into a choice that only the user's eyes can check. Lines lie close together at a bedside and can look alike, and training and labels ask the user to be right on every occasion. A connector that physically cannot join the wrong line removes the choice. This is a forcing function, a design that makes the wrong action impossible rather than unlikely, and unlike a label or a training session it does not depend on attention.
FDA wrote to makers of enteral feeding tubes on 9 July 2010 that misconnections were "associated with death and serious injury" and probably under-reported, and pointed to a connector standard then in preparation, ISO 80369-1. FDA's own account dates its recognition of the ISO 80369 series to 2011. The series divides small-bore connectors into families by application, each made so that it does not mate with the others. The Joint Commission's alert of 20 August 2014, which updated the 2006 alert, named the families: intravascular, which keeps the Luer; limb cuff; enteral; neuraxial, for epidural and spinal lines; and breathing and driving gases.
A standard that makes connections fail on purpose
Part 1, the general requirements, sets out how a maker assesses what the standard calls "non-interconnectable characteristics". Its third edition was published on 10 October 2025, replacing that of 2018, and FDA recognized it in December 2025. Part 7, for intravascular and hypodermic connectors, is the Luer itself, in a second edition of 4 May 2021. Part 3, for enteral connectors, was published in July 2016 and amended in 2019, and ISO confirmed it in 2023. It covers feeding sets, enteral syringes, drainage sets and access ports. Many connectors made to it are sold under the trade name ENFit. Because the intravascular line keeps the old fitting, every other family has to change, and the change runs through every enteral item a hospital stocks: tubes, pump sets, syringes and the ports between them.
FDA did not mandate the new connectors. It issued guidance on small-bore connectors for enteral use on 11 February 2015, and its letter of 7 September 2018 recommended enteral devices with ISO 80369-1 or ISO 80369-3 connectors, "many sold under the name ENFit." It asked makers to plan the removal of older devices and hospitals to keep transition adapters, which join a new connector to an old one, to a minimum. The letter counted 2 deaths, 24 serious injuries and 32 malfunctions reported for enteral misconnections since 2011, and noted that FDA's testing found gravity flow through ENFit "slightly slower" with 24 Fr tubes, which it did not consider a safety concern.
An adapter lets an ENFit set join an older feeding tube, and so keeps in use the older fitting, the one able to mate with lines of other families. A ward that still holds legacy enteral stock and adapters holds part of the old hazard with them, and FDA asked in 2018 that adapters be kept to a minimum.
The transition is not finished. GEDSA, the makers' trade association, announced in July 2021 that its members had stopped making the older feeding tubes and cross-application connectors on 1 July 2021 and would stop stand-alone transition sets and adapters on 1 January 2022. It said that about 80 % of the top 25 US hospitals were using or converting to ENFit. In January 2026 ECRI placed "Tubing Misconnections Remain a Threat Amid Slow ENFit and NRFit Adoption" fifth on its list of health technology hazards for the year; NRFit is the counterpart connector for neuraxial lines.
Enteral feeding pumps, and doses too small for the connector
In the United States an enteral feeding pump is regulated as an infusion pump. Its FDA product code is LZH, "pump, infusion, enteral" (Chapter 6). LZH falls under 21 CFR 880.5725, the same regulation as other infusion pumps, in device Class II, and pumps under it are cleared through 510(k). IEC 60601-2-24, the particular standard for infusion pumps, includes enteral nutrition pumps in its scope, and the EU's classification guidance gives feeding pumps as an example of class IIa (Chapter 29). FDA's database holds 34 clearance records under the code, the most recent for the Luminoah FLOW Enteral Nutrition System, cleared on 20 April 2026. Like most pumps of Part II, a feeding pump infers its volume from its mechanism, and like them it delivers whatever enters its set into whatever the set is joined to.
A feeding pump's specification reflects its job. Cardinal Health's figures for its Kangaroo OMNI pump, as a reseller reproduces them, give rates of 1 to 400 mL/h in steps of 1 mL/h and an automatic water flush at 875 mL/h every 1 to 24 hours. The stated accuracy is ±5 % or 0.5 mL/h for standard formula, and ±10 % for thick formula. At 60 mL/h for 20 hours the pump delivers 1,200 mL, and ±5 % allows 1,140 to 1,260 mL. At 5 mL/h the 0.5 mL/h figure is itself 10 %, and the specification does not say whether the larger of the two applies.
The new connector created a problem of its own at the smallest doses, given by enteral syringe. The ENFit syringe tip has a small recess between the tip and its collar, which industry testing calls the moat. Liquid that collects there can be added to the dose or lost from it, which matters most when the whole dose is a fraction of a milliliter. A low-dose tip design, used with a tap to clear the moat, addresses the problem. A poster from GEDSA, hosted by a maker and dated about 2020, reports tests of 1 mL syringes delivering low volumes. Against a range of ±10 % that a clinician consensus judged acceptable, the low-dose tip ranged from −2.90 % to +10.47 %, the standard ENFit tip from −24.06 % to +28.15 % and oral syringes from −7.37 % to +9.69 %. These are the industry's own figures, with no affiliations or funding stated.
The target is 0.2 mL from a 1 mL syringe, so the acceptable range of ±10 % is 0.18 to 0.22 mL. The bounds are those on the GEDSA poster. - Standard ENFit, −24.06 % to +28.15 %: 0.2 × 0.7594 = 0.152 mL to 0.2 × 1.2815 = 0.256 mL. - Low-dose tip, −2.90 % to +10.47 %: 0.2 × 0.9710 = 0.194 mL to 0.2 × 1.1047 = 0.221 mL. - Oral syringe, −7.37 % to +9.69 %: 0.2 × 0.9263 = 0.185 mL to 0.2 × 1.0969 = 0.219 mL. In these tests a standard ENFit syringe gave from about three quarters to about one and a quarter of a 0.2 mL dose. The oral syringe stayed inside the clinicians' range, and the low-dose tip stayed inside it except for an upper bound of 0.221 mL, about one thousandth of a milliliter over.
For biomedical engineers, pharmacists and purchasing teams, list every enteral item in stock, including feeding pump sets, tubes, syringes, extension sets and medication ports, and confirm that each carries an ISO 80369-3 connector. Treat each remaining transition adapter as a hazard to be removed, and record where any remains and why. Use low-dose tip syringes for small enteral doses, and train staff in the tap that clears the moat. For makers of feeding pumps, design the set with ISO 80369-3 connectors and assess non-interconnectability by ISO 80369-1:2025.
- Feeds, air and other fluids reached veins because one connector, the Luer, fitted lines with very different destinations, and a pump cannot sense where its line ends.
- The ISO 80369 series separates small-bore connectors into families that do not mate, keeping the Luer for intravascular lines and giving enteral lines ENFit (ISO 80369-3, 2016, amended 2019), under a general part in its third edition of 2025.
- FDA recommended rather than mandated the new connectors, and GEDSA's members said they ended legacy enteral connectors in 2021 and would end adapters in 2022, but ECRI still ranked slow adoption among the hazards of 2026.
- Enteral feeding pumps are regulated as infusion pumps, and in industry testing a standard ENFit syringe gave about 0.15 to 0.26 mL for a 0.2 mL dose, where a low-dose tip stayed close to the acceptable range.
+ Part VI · Software
Software that checks the dose.
A 2013 analysis of FDA's recall database by engineers at the University of Illinois found fifteen recalls between 2006 and 2011 that corrected or removed infusion pumps because of computer faults bearing on safety; together they covered about 945,000 devices. Across all medical devices in those years, 1,210 of 5,294 recalls, about 23 %, were computer-related, and nearly two thirds of those were classed as software. Part VI follows that software. Chapter 20 opens the pump to its firmware, the code between the keypad and the motor, and to what FDA asked of such code after 2010. Chapter 21 turns to the drug library, the hospital's own table of limits that checks each entry, and to why it has caught fewer errors than hoped. Chapter 22 connects the pump to the health record and the hospital network, and counts what the connection removes and what it adds.
Software inside the pump.
+ The questionWhat does a pump's software do, and what did the 2010 failures teach about writing it?
Software defects, by FDA's own account
When FDA launched its infusion pump initiative on 23 April 2010, it wrote to pump makers offering to review their software before they submitted it. Its white paper said the agency would examine pump code itself with static analysis, tools that inspect source code without running it. The reason was in the same paper: "The most common types of reported problems have been associated with software defects." The key bounce of the opening story was one example; the paper gave no count.
The defects outlived the initiative: in November 2025 a rate keyed with two leading zeros could freeze the Ivenix pump's screen (Chapter 17). Both faults, fifteen years apart, sat in the software that reads keys, builds them into a number and checks it against limits. A pump's software does nearly everything except push the fluid, and after 2010 FDA asked that it be treated as a safety system, specified from its hazards and checked by tools as well as tests.
Everything between the key and the motor
A pump's software is usually called firmware: code stored in the pump, written for its own processor and changed only by a deliberate update. It reads the keys or the touchscreen and builds a value from them. It converts a dose into a rate when the nurse programs in micrograms per kilogram per minute (Chapter 16), and it checks the entry against the drug library (Chapter 21). It then turns the rate into a schedule of motor steps and counts those steps to report the volume infused. That count is the inference this guide began with: in most pumps the volume on the screen is the firmware's arithmetic on its own motor, not a measurement of the drug.
Around that main path the firmware watches. It reads the downstream pressure sensor and decides when a rise means a blockage (Chapter 12), reads the air detector (Chapter 13), and ranks and sounds alarms (Chapter 15). It also estimates the battery's remaining time and logs each event for reading after an incident (Chapter 25). A fault can therefore surface almost anywhere: in a silent alarm, a wrong battery estimate or a false log.
Two properties of this code matter most. The firmware is the only part of the pump that holds the dose: the mechanism knows only steps, and the nurse sees only the screen. And every check the firmware makes is a check of its own inputs. It can compare a typed rate with a library limit, but it cannot know whether a key was pressed once or twice unless it was designed to tell. The bouncing key shows the design method on a small scale: the physical behavior is measured, a margin chosen and the result tested.
A key must be read once
A key on a pump's keypad closes a pair of metal contacts. Contacts do not close cleanly: they strike, separate and strike again before they settle, and a processor that reads the key every few milliseconds sees each strike as a new press. This is contact bounce. An embedded-systems engineer who measured 18 ordinary switches in 2004 found that 16 of them settled within 6.2 ms, with an average bounce of about 1.6 ms, while one switch bounced for 157 ms as it opened. These were generic switches, not pump keypads, but they show the spread to plan for: most contacts settle quickly, and a few take a hundred times longer.
Firmware answers bounce by debouncing: it accepts a change of state only after the contact has held that state for a set time. The same engineer recommends a period of 20 to 50 ms, sampled every 1 to 5 ms, and notes that a response delay of 50 ms seemed instantaneous to users while 100 ms was noticeable. The period has to be longer than any bounce the keypad will produce over the life of the pump, and shorter than the gap between two deliberate presses, or the pump will swallow a digit the nurse meant to type. Picking a number between those limits looks like a detail of electronics and is a safety decision.
The firmware in this illustration samples a key every 5 ms and accepts a change only after four identical samples in a row, which is 4 × 5 = 20 ms of steady contact. - An average bounce of 1.6 ms touches at most one sample. The longest of the 16 ordinary switches, 6.2 ms, touches at most two (6.2 ÷ 5 = 1.24, so it can straddle two). Four identical samples cannot occur inside the bounce, so one press is counted. - The press is accepted at most 6.2 + 20 = 26.2 ms after first contact, inside the 50 ms that seemed instantaneous. - The margin is 20 ÷ 6.2, about 3.2 times the longest ordinary bounce. - The outlier bounced for 157 ms, about 157 ÷ 5 = 31 samples. If its contact rests closed for four samples in a row during that time, the firmware counts a second press, and "30" becomes "300" (Chapter 16).
A 20 ms period rejects every ordinary bounce. A period long enough to cover 157 ms would exceed the 100 ms that users notice, so such a switch has to be found by testing and replaced, not filtered.
Defects that live in a version
Hardware wears, and maintenance can catch some wear before it causes a failure (Chapter 24). Software does not wear. A firmware defect is present from the day its version is installed, in every pump that runs it, and it shows itself only when the conditions that reach it occur: a particular sequence of keys, a battery in a particular state, a second infusion that starts at an exact moment. Such conditions can stay hidden for a long time and then recur in every pump that meets them.
A defect lives in a version, so its remedy is a new version, with risks of its own. FDA's records for the Ivenix pump show five such corrections in about 26 months, at least three of them Class I. Version 5.8.0 was corrected in March 2024; 5.9.1 in August 2024; and 5.9.2 from January 2025, because the pump could stop working, or over-infuse if a secondary infusion started exactly as the primary ended. Version 5.10.1, corrected from November 2025, also misjudged the battery's remaining capacity (Chapter 15). Its remedy, 5.10.2, was itself corrected in May 2026 for a false battery reading, in the recall that opens Part IX; a separate correction concerned a touchscreen cable (Chapter 17).
A version that has run for years without a reported fault has been tested only on the sequences of keys, states and timings that users happened to produce. The 2025 Ivenix defects needed two leading zeros above a library limit, or a secondary infusion starting as the primary ended, and a long clean record rules out neither.
One fault must not reach the patient
Because a defect can sit unseen in every pump running a version, a pump cannot assume that its controller is right. IEC 60601-1, the general safety standard of Chapter 27, defines a single fault condition as one in which "a single means for reducing a risk is defective or a single abnormal condition is present", and asks that equipment stay free of unacceptable risk under such a condition, according to a consultancy's quotation of the standard's 2022 German edition. A test laboratory's account of clause 4.7 gives three ways to comply: one protective means whose failure is negligibly unlikely; a second protective means whose own failure is just as unlikely; or a first fault detected before a second means can fail.
One certifier's account of the editions of IEC 60601-2-24, a secondary source, describes how the standard applies the rule to pumps. A single fault that could cause over-infusion must raise a high-priority alarm and stop delivery or cut it to the keep-vein-open rate or less. Stopping this way is a fail-stop: the pump halts and alarms rather than carry on in a state its software can no longer trust. FDA's record uses the same term for the frozen Ivenix screen of November 2025, where a defect, not a detected fault, brought the stop. A fault in the protection itself must become obvious to the operator within the interval at which the set is changed, so a broken protection cannot stay hidden for long.
Makers state how much a single fault can deliver before the pump stops: BD gives 0.87 mL for its Alaris syringe pump MK4 with a 50 mL syringe, Baxter 0.56 mL for the SIGMA Spectrum and BD 0.1 mL for its BodyGuard T ambulatory syringe pump. At 1 mL/h those are about 52, 34 and 6 minutes of infusion at once. In principle the protection is independent of the controller it guards, sharing neither processor nor sensors, so that one fault cannot disable both. How any named pump arranges that is not known.
What FDA asked of pump software after 2010
Static analysis, the step the white paper promised, flags constructions in the code known to cause faults, so it reaches defects that testing finds only by chance. The white paper also pointed to the Generic Infusion Pump project, in which FDA researchers and engineers at the University of Pennsylvania set out the hazards of a generic pump and the safety requirements that follow, as an open reference for any maker.
The project's model of a patient-controlled analgesia pump shows how far formal checking reaches. In slides presented in May 2011, its authors list 97 safety requirements. About 20 could be verified against the model with a model checker, a program that examines every state the model can reach, and about 23 more with further detail. Formal proof covered about one requirement in five, and the rest still rested on testing and review.
FDA's final guidance of 2 December 2014 turned these ideas into two expectations for a 510(k) (Chapter 28). One is static analysis of all of the code. The other is a safety assurance case, a structured argument backed by evidence that the pump is safe, built on a hazard analysis whose causes include software. IEC 62304, the software life-cycle standard, is in Chapter 27.
Run static analysis on every build and keep each unresolved finding with its reason. Set the debounce period from bounce measured on worn keypads as well as new ones. Give each hazard-related requirement a test, inject single faults to show that the protection stops the pump and that its own failure shows, and rerun those tests on every version, including a correction issued under recall pressure. For each change, ask which other functions read the same data: the 2026 Ivenix fault lay in the battery estimate that the 2025 correction was meant to fix.
- A pump's firmware does every step between a keystroke and a motor step, and the volume it reports is its own count of that motion.
- Sampling every 5 ms with a 20 ms debounce period rejects ordinary bounce of up to 6.2 ms with a threefold margin, but a switch that bounces for 157 ms can still turn "0" into "00".
- Software defects sit in a version, so each correction is a new release needing full verification, as five Ivenix corrections from 2024 to 2026 show, and after 2010 FDA asked for static analysis of all pump code.
- No single fault may leave an unacceptable risk, so a pump that detects one alarms and stops, and two makers state, for three pumps, that 0.1 to 0.87 mL can be delivered before it does.
Limits that catch a slip.
+ The questionHow does a drug library catch a wrong entry, and why has it caught fewer errors than hoped?
A trial that found no difference
In a trial published in 2005, smart pumps with their dose checks switched on prevented no more serious medication errors than the same pumps with the checks switched off. The trial ran in cardiac surgical intensive care units and in step-down units, which take patients leaving intensive care, over four periods of eight weeks. The dose checks were off in the first and third periods and on in the second and fourth, so that each condition was seen twice and a slow drift in practice would show. Across 744 admissions the investigators found 219 medication errors. Among them were 25 preventable adverse drug events, meaning harm caused by a drug, and 155 potential adverse drug events, errors able to cause harm, that nobody intercepted. The number of serious medication errors did not differ between the periods.
This account rests on the summary published in April 2005 by the Agency for Healthcare Research and Quality, which funded the study, rather than on the paper itself, by Rothschild and colleagues in Critical Care Medicine. The summary points to the reason for the null result: nurses could easily bypass the drug library, and they often overrode its alerts. The most common errors were wrong doses of titrated drugs (Chapter 3) and wrong intravenous rates. Those are the errors a library exists to catch. Chapter 20 showed that firmware can check an entry only against the limits it has been given: a bypassed library gives it none, and an overridden alert stops nothing.
What a library holds
A drug library, introduced in "Before we start", is a table that a hospital's pharmacists build and load into the pump. A pump that checks entries against one runs what makers and hospitals call a dose error reduction system, or DERS. Each entry names a drug, its standard concentration or concentrations, the unit in which it is dosed, such as milligrams per hour or micrograms per kilogram per minute, and limits on the dose. Entries are grouped by care area, because a dose that is routine in an adult intensive care unit can be dangerous on a neonatal unit. The nurse selects the care area and then the drug; the pump fills in the concentration and computes the rate from the dose, as in Chapter 16.
Limits come in two kinds. A soft limit marks a dose that is unusual but sometimes right. When an entry crosses it, the pump shows an alert (Chapter 15), a message asking the nurse to confirm or change the entry, and the nurse may override it and proceed. A hard limit marks a dose that should never be given in that care area; the pump refuses the entry and the nurse must reprogram. A library can hold lower and upper limits of each kind, which bracket a band of ordinary doses.
The design has a clear logic. A tenfold error, the slip of Chapters 16 and 17, lands far outside the band of ordinary doses, so a limit set anywhere sensible catches it. A 20 % error lands inside the band and passes. A library is therefore a coarse check that catches the large slips and leaves the small ones to other checks. A 2014 systematic review of 22 studies reached the same view from the evidence: smart pumps reduce but do not eliminate programming errors, hard limits did most of the intercepting, and high override rates weakened soft limits.
The pump compares an entry with the limits for the drug and care area the nurse selected. It cannot see the bag. If the nurse picks the wrong drug or the wrong care area, or keys a dose inside the limits that is wrong for this patient, the library has nothing to object to, and the 2014 review lists selection of the wrong library among the risks of smart pumps. A dose the library accepts has passed one check, not every check.
Three conditions for a catch
For a library to stop an error, three things must happen in order. The infusion must be programmed through the library rather than in plain milliliters per hour. The error must cross a limit, which a tenfold slip usually does and a small error does not. And, if the limit is soft, the nurse must take the alert's advice. The first and third conditions have been measured, and each loses a share of the errors, so the share a library stops is the fraction of infusions programmed through it multiplied by the fraction of alerts heeded, which is smaller than either.
Library use, called library compliance, is the first; it has nothing to do with the compliance of tubing in Chapters 5 and 12. A Canadian clinical engineering group reported, in a conference paper from about 2006, that only 241 of 1,827 infusions, 13.2 %, used the drug library at all. A 2012 study read the event logs of syringe pumps in a Berlin cardiothoracic intensive care unit and found the library used for 92.8 % of 133,601 infusion starts. An institutional grant from CareFusion, now part of BD, sponsored the study. A further 5.7 % ran in plain milliliters per hour and 1.5 % were programmed as a dose without the library. In 2017 the AAMI Foundation, part of the Association for the Advancement of Medical Instrumentation, set a target of at least 95 % of all primary and secondary infusions.
The third condition, overrides, removes the most. The Canadian group saw 21 of 34 alerts overridden. A 2019 analysis of DERS data from several hospital systems, with pumps from Baxter, BD and ICU Medical, found that nurses overrode 73.8 % of alerts for ordinary drugs and 75.8 % for the high-alert drugs of Chapter 16, a difference that was not significant. Its funding is not known. The systems varied widely, and Chapter 25 reads the same analysis as a library report. A soft limit set to flag unusual doses also flags intended ones, so many overrides are correct, and an alert that is usually dismissed teaches the nurse to dismiss it, including on the day it is right.
The illustration assumes 1,000 tenfold errors, each large enough to cross the drug's limit, in a unit whose library use matches the Berlin logs (92.8 %). - Through the library: 1,000 × 0.928 = 928 errors. The other 72 are entered in plain mL/h or as a dose without the library, and meet no check. - If the limit crossed is hard, all 928 are stopped: 92.8 % of the errors. - If it is soft, and these alerts are overridden as often as alerts for high-alert drugs in general (75.8 %), 928 × 0.242 = about 225 are stopped and about 703 proceed: 22.5 %. - At the 95 % target, the hard-limit case stops 950 and the soft-limit case 950 × 0.242 = about 230.
The library stops between about one error in four and nine in ten, depending mostly on whether the limit is hard, and it cannot stop an error that never passes through it. The override assumption is pessimistic, since a tenfold error may look wrong enough on the screen to be corrected; the studies report no override rate for true errors alone.
A library is maintained, not installed
Every alert, and what the nurse did next, goes into the pump's records, and pharmacists read reports built from them: alerts by drug and care area, override rates, library compliance and good catches, entries that crossed a limit and were then corrected. The AAMI Foundation's 2017 guide asks for such reports at least quarterly. A soft limit that draws mostly overrides is often set too tight, and widening it makes the remaining alerts more credible; a drug that never alerts may have limits too wide to catch much. The reports measure what the library questioned, not what it missed, because an entry inside the limits raises nothing, and Chapter 25 reads such a report line by line.
A corrected limit protects only the pumps that have received it. Hospitals send new library versions over the wireless network or by cable, and a pump takes a new version only when it is switched on and connected. Chapter 24 follows how long a new version takes to reach every pump.
Use, too, remains incomplete as of October 2026. ECRI placed the underuse of medication safety technologies in perioperative care sixth on its list of health technology hazards for 2026, naming smart infusion pumps among them. The checks of this chapter work only where they are switched on, kept current and believed, and Chapter 22 turns to the change that removes most of the typing they were built to check.
Report library compliance by care area and treat any unit below 95 % as one where the library protects fewer infusions than the totals suggest. Read the override report drug by drug: widen a soft limit that fires mostly on intended doses, and set as hard limits the boundaries that no patient in that care area should cross. Record each good catch with the drug, the size of the error and the care area, so the library's effect can be shown. After each release, check from the server or the alert logs which pumps still run the old version.
- A drug library holds, for each drug and care area, a concentration and dose limits; a soft limit raises an alert the nurse may override, and a hard limit refuses the entry.
- A 2005 trial, known here from its funder's summary, found no difference in serious medication errors with the checks on or off, a result the summary links to nurses bypassing the library and overriding its alerts.
- A library stops an error only if the infusion goes through it, the error crosses a limit and, for a soft limit, the alert is heeded; at 92.8 % use a hard limit stops about nine tenfold errors in ten, and a soft limit, overridden as often as alerts for high-alert drugs, about 22 %.
- With override rates near three in four and each new library version reaching a pump only when it is switched on and connected, a library has to be read, tuned and distributed continually to protect anyone.
The order goes straight to the pump.
+ The questionWhat changes when the health record programs the pump, and what new risks come with the connection?
Fifteen keystrokes become two
At one 286-bed hospital, according to a 2018 report, programming an infusion took a mean of 15 keystrokes before its pumps were connected to the electronic health record and 2 afterward, a fall of 86 % in the first eight months. The keystrokes that disappeared are the ones in which Chapters 16 and 17 found the tenfold errors, and Chapter 21 showed that a drug library catches only some of those. Interoperability, the exchange of data between the pump and the hospital's information systems, removes most of them at the source. The same report states that every prepopulated infusion and dose change ran under the pump's dose limits.
The usual arrangement has two directions. The electronic health record is the hospital's electronic chart of the patient and of the orders for that patient. In auto-programming, an order written in it travels as data to the pump. The nurse scans a barcode on the patient's wristband, one on the bag and one on the pump channel, and the record matches the bag to an active order. An integration server then sends a programming request with the drug, concentration, dose and rate to that channel. The pump shows the values, checks them against its drug library and waits for the nurse to confirm. In auto-documentation, the running pump sends its rate, the volume infused and its state back to the record, which writes them into the chart.
The change is larger than it looks. A keypad entry is built by a person from an order; an auto-programmed entry is copied by software from an order. The nurse's work shifts from composing numbers to checking numbers composed elsewhere, and the pump, which in Chapter 20 trusted its keypad, now trusts a message from a server. The error that remains is whatever was already in the order, or whatever the copying gets wrong.
Removing the keypad removes the typing slip and keeps every error made upstream. A wrong dose in the order, a weight recorded wrongly in the chart or a bag matched to the wrong order arrives at the pump already formed, and it looks as authoritative as a correct one. The pump's library still checks the values against its limits, which is why the dose-limit check matters as much after the connection as before it.
What the connection removed
A 2024 before-and-after study at Norton Children's Hospital, which has 274 beds, measured the effect in a pediatric setting with BD Alaris pumps; its authors declared no conflicts of interest. They compared January to June 2020, before interoperability went live in September 2020, with January to June 2022. Infusions rose from 143,997 to 165,343. Library alerts fell from 32,422 to 8,335, errors caught before they reached the patient from 197 to 20, and events the system recorded as harm averted from 1,731 to 295. Library compliance at the main hospital rose from 94 % to 97.9 %, above the 95 % target of Chapter 21.
These falls need careful reading. Fewer alerts and fewer caught errors could mean that fewer errors were typed, because there was less typing, or that the same errors were no longer caught. A comparison of two periods cannot separate those. It does show how the remaining alerts were treated: the override rate barely moved, from 73 to 70.6 %, and the share of overrides made in under two seconds changed little (61.5, then 58.5 %). What changed was the kind of alert overridden: overrides the study classed as high-risk fell from 5,851, or 24.6 % of all overrides, to 207, or 3.5 %.
Figures from the 2024 pediatric study, first half of 2020 against first half of 2022; keystrokes from the 2018 report at another hospital. - Keystrokes: 15 − 2 = 13 fewer per program, or 130,000 fewer key presses per 10,000 programs. - Library alerts: 32,422 ÷ 143,997 × 10,000 = about 2,252 before, and 8,335 ÷ 165,343 × 10,000 = about 504 after, a fall of about 78 % per infusion. - Errors caught before administration: 197 ÷ 143,997 × 10,000 = about 13.7 before, and 20 ÷ 165,343 × 10,000 = about 1.2 after. - Harm-averted events: 1,731 ÷ 143,997 × 10,000 = about 120 before, and 295 ÷ 165,343 × 10,000 = about 18 after, a fall of about 85 %. - Paused infusions not restarted: none before, and 6 ÷ 165,343 × 10,000 = about 0.36 after.
Per 10,000 infusions the connection removed about 1,750 alerts and about 12 caught errors, and added about one third of a failure of a kind the earlier period had not recorded.
New ways to fail
A connection adds parts, and each can fail in ways a standalone pump could not. The pediatric study found one at once: reports of a paused infusion that was never restarted rose from none to six, a change its authors found statistically significant. A 2024 descriptive report from an 11-hospital system using ICU Medical Plum 360 pumps recorded programming edits falling from 1.27 to 0.18 per 100 programs; its authors include recipients of research grants from ICU Medical. It also recorded one episode in which auto-programming failures, which had run at 80 to 90 cases over two months, rose to more than 900 in two weeks.
The servers between record and pump are devices with their own recalls. In February 2025 BD began a correction because its Alaris Systems Manager could send an outdated auto-programming request to a pump; FDA placed it in Class I. Network details become safety details too. In February 2026 BD began correcting Alaris labeling that did not say which version of TLS, the encryption protocol of the secure wireless link, had to be enabled. FDA placed that recall, covering about one million units, in Class II. Each of these failures lies outside the pump's mechanism and outside its keypad, in the data path that replaced the keypad.
A pump on the network can be attacked
A connection also makes the pump reachable. ICS-CERT is the US government team that issues advisories on industrial control systems. In 2015 it reported, first on its secure portal on 23 June, that the Hospira Symbiq infusion system, version 3.13 and earlier, had a vulnerability "which can be exploited to remotely control the device". It scored 7.1 on version 2 of the Common Vulnerability Scoring System, whose scale runs to 10. On 31 July 2015 FDA strongly encouraged hospitals to move to other infusion systems, according to trade-press reports of its safety communication. News reports called it the first time FDA had told users to stop using a device over a cybersecurity risk. FDA knew of no case of remote access, and Hospira had stopped making Symbiq in 2013.
Later findings show where the openings lie. A security researcher who examined Baxter's SIGMA Spectrum pumps reported in 2022 that their Wi-Fi credentials were stored in the battery's memory, so a battery sold on after a pump left service could carry a hospital's network password, and that an unauthenticated message could change the pump's gateway address. The flaws were reported to Baxter on 20 April 2022, and the researcher and Baxter both published on 8 September 2022, 141 days later. That interval, in which the maker confirms a flaw and prepares a fix before it becomes public, is the core of coordinated vulnerability disclosure.
Since 29 March 2023, under section 524B of the Federal Food, Drug, and Cosmetic Act, a US submission for a networked pump has had to include a plan for such vulnerabilities after sale, including coordinated disclosure, and processes to patch them (Chapter 28). A patch is a new software version, with the risks Chapter 20 described. The Ivenix correction of August 2024 fixed a cybersecurity vulnerability together with other software anomalies in one release, the kind of update the section expects a maker to be able to issue. The device-software guide in this series treats device cybersecurity in depth. For a pump, the plan matters for as long as it stays on a hospital network, because every update and every new connection is a route by which its instructions can change.
Before go-live, and after every server, record or pump software update, test what happens when the network drops during an infusion, when an order changes while a request waits, and when a paused infusion's order is discontinued. Keep keypad programming procedures and library limits ready for downtime. Ask each maker for its software bill of materials (Chapter 28) and its vulnerability-disclosure contact, record the TLS and wireless settings its labeling requires, and erase network credentials from pumps and batteries before they leave the hospital.
- Interoperability sends the order from the health record to the pump and the pump's data back to the chart, cutting programming at one hospital from 15 keystrokes to 2.
- In a 2024 pediatric study, library alerts fell from about 2,252 to 504 per 10,000 infusions and caught errors from about 14 to 1, while the override rate barely changed.
- The connection adds failures of its own: paused infusions not restarted, bursts of auto-programming failures and an outdated programming request that FDA placed in Class I.
- A networked pump can be attacked, as the 2015 Symbiq advisory showed, and since 2023 section 524B has required makers submitting such devices to FDA to plan for vulnerabilities and to patch them.
+ Part VII · The system
The pump as a system.
A pump on the shelf of a hospital's biomedical engineering workshop is checked on its own, for flow, occlusion alarm and battery. On a ward it is one part of something larger: it drives a set from its maker's list, carries a library that the hospital's pharmacists wrote, may take orders from a server on the wireless network and is programmed by a nurse, and each of these has its own owner. Brigham and Women's Hospital in Boston replaced about 3,800 large-volume pumps on its main campus in one day, 19 May 2019. Part VII treats the pump as part of a system. Chapter 23 asks who owns each interface between the pump and the rest, Chapter 24 follows the fleet through maintenance, batteries, cleaning and library updates, and Chapter 25 reads the records pumps keep and answers the central question of this guide.
Who owns the interfaces.
+ The questionIf the pump, the set, the drug library and the health record each work as designed, who makes sure they work together?
A pump evaluated as a system
In its guidance of 2 December 2014, FDA told infusion pump makers that a pump "should be evaluated as a system", and it drew the system wide. Besides the pump, it includes the set for the whole fluid path, to be identified "whether manufactured by you or another firm", and accessories such as a power cord or a wireless controller. It includes the network, meaning any device or system connected to the pump, and the patient, the user and the environment of use. Chapter 22 found failures in the path between pump and health record, and FDA's definition puts that path inside the maker's evidence. That gives half of the answer: before sale, the pump maker answers for the whole system.
After sale the system has a second owner. The guidance asks for testing "with the complete infusion pump system", but a maker's file holds only the configurations it tested. The hospital decides the rest: library limits, server software version, wireless settings, health record and link, the sets it buys and the extensions added at the bedside, each changing on its own schedule. When Mount Sinai Morningside ran its intensive care lines through long extensions in 2020 (Chapters 3 and 12), it changed the system without touching a pump. Making the parts work together is shared work, and the discipline that organizes it is systems engineering.
INCOSE, the international council of systems engineers, defines a system as "a set of elements that work together to produce results that the individual elements couldn't achieve alone." No part of an infusion gives a dose alone: the pump moves, the set turns motion into milliliters, the library and the record supply numbers, and a nurse starts it. Systems engineering, in INCOSE's description, integrates many disciplines across a system's life, from its realization to its retirement, and ISO/IEC/IEEE 15288, revised in 2023, is the international standard for those life-cycle processes.
From hazards to requirements to parts
The work begins with hazards. The hazard analysis behind a pump's 510(k) (Chapter 28) names the ways the system could harm a patient, and each hazardous situation needs at least one control. Each control is written as a requirement, a statement of what the system must do that a test, an inspection or an analysis can check. For example, a requirement might read: the system shall alarm and stop delivery when the line downstream of the pump is blocked, within the time its labeling states for each listed set. How it does so is decided in the architecture, the division of the system into parts and the connections between them.
Each requirement is then allocated, assigned to the parts that will meet it, and the occlusion requirement goes to five parts. A pressure sensor reads the line: hardware. Firmware compares the reading with a limit and raises the alarm: software. The give of the set or syringe decides how long the pressure takes to build (Chapter 12): the set. The hospital decides which limits its units may use: the hospital. A nurse must hear the alarm and act on it (Chapter 15): the user. The labeled time holds only while all five do their part, and two of them lie outside the maker's hands.
Two kinds of evidence close the loop. Verification asks whether each part, and the whole, meets its requirements, such as whether the alarm sounds within the stated time with each listed set at the lowest rate offered. Validation asks whether the requirements were the right ones, by trying the finished system with real users in its intended use, as the human factors validation test of Chapter 18 does. A trace links each hazard to its controls, each control to its requirements, and each requirement to the parts that carry it and the tests that verified it, so that a change to any part shows which hazards it can reach.
Four interfaces, each with two owners
An interface is a boundary across which two parts exchange something: force and fluid, data, or what a screen shows a person. Four decide a dose. Between pump and set the exchange is mechanical, and the set's bore and give turn motion into milliliters (Chapter 8). The pump maker lists the sets it tested. ICU Medical's 2025 510(k) summary for the Plum Solo states compatibility with "currently marketed Plum Administration Sets" without listing them. The hospital buys the sets and adds filters, valves and extensions. BD's Class I recalls of Alaris sets in 2025 and 2026 sat on this interface (Chapters 8 and 26), as did an Ivenix correction for low-flow occlusion alarms when a check valve was added (Chapter 12).
Between pump and drug library the exchange is data that pharmacists write with the maker's software. Baxter's 2025 510(k) summary for the SIGMA Spectrum describes a stand-alone application, on a computer the hospital provides, that builds one library file for every compatible pump. The contents are the hospital's (Chapter 21), and so, largely, is the time a new version takes to reach each pump (Chapter 24). Between pump, network and health record the exchange is orders and status. The maker supplies the pump's side and often the server; the hospital runs the rest. Two recalls described in Chapter 22 concerned this interface: BD's Alaris Systems Manager, which could send an outdated programming request, and Alaris labeling that did not say which TLS version to enable.
Between pump and user the exchange is what the screen shows and what the keys or touchscreen take in. The maker's evidence is the human factors file of Chapter 18; the hospital owns the training, staffing and policies that shape how the screen is used. Two Ivenix corrections concerned this interface: the rate with two leading zeros that froze the screen, and the loosened touchscreen cable that registered touches nobody made (Chapter 17). None of the four interfaces has a single owner, and many of the recalls of 2025 and 2026 sat on an interface rather than in the pumping mechanism alone.
An interface written as a specification
FDA's guidance of 6 September 2017 on interoperable devices treats each electronic interface as a specification for its maker to publish. Makers should "clearly set forth in device labeling the functional and performance requirements of their electronic interface": its purpose, the devices and software versions it is meant to connect with, what it needs from them, its timing, how it tolerates faults and fails safe, and its known limits. The guidance asks for risk analysis of data that arrive late, corrupted, misformatted or out of step, and for tests under abnormal conditions. Its examples are infusion pumps.
Such a specification also allocates work, and part of it falls to the nurse. In its 510(k) summary for its 2023 Alaris clearance, BD states that if communication is interrupted the pump "will continue to function as programmed". IHE International, where health professionals and industry agree how standards are used together, publishes profiles for particular exchanges of data. Its profile for sending infusion orders to pumps states that "The clinician must always verify all settings and start the infusion directly on the pump." Both leave the last check to the nurse at the pump.
A recognized standard names the two owners outright. ANSI/AAMI/UL 2800-1 is a family of interoperability standards, and FDA recognized its 2022 edition on 19 December 2022. It has one part for the life cycle of developing an interoperable product (2800-1-2) and another for integrating such products into a working system (2800-1-3). The first is the maker's work. The second belongs to whoever assembles the system, often the hospital or the integrator it hires. None of four recent pump 510(k) summaries cites the family.
Testing the versions a fleet runs at once
A maker can test its pump with its own sets, server and library tool, in the versions it ships, but not the limits a hospital writes, the extensions a ward adds or the mix of versions a fleet runs. Integration testing, the testing of parts together across their interfaces, therefore happens twice: by the maker against the configurations it labels, and by the hospital against the configuration it runs. The second must cover every combination of versions in use, and since a library update spreads unevenly (Chapter 24), the count grows by multiplication.
- Library versions. One 11-hospital system released a library about every 60 days, according to a 2024 report whose authors include recipients of ICU Medical research grants. In the 2018 study of Chapter 24, a replaced version kept raising alerts for a median of 22 to 192 days, depending on the health system, and for at most 661 days. In the system with the slowest median, 192 ÷ 60 = 3.2, so about the three latest replaced versions run beside the current one, which makes 4 library versions in use. On the longest delay, 661 ÷ 60 = 11.0, so 11 replaced versions run beside the current one: 11 + 1 = 12.
- Pump and server software in the Ivenix correction of November 2025: pumps on 5.10.1 or 5.10.2, servers before or after 5.2.2, which went first. Of 2 × 2 = 4 pairs, new pump software on the old server is ruled out by that order, so 3 remain.
- Across the correction: 4 × 3 = 12 configurations, or 12 × 3 = 36 on the long tail. Once the server is updated, both pump versions run on it: 4 × 2 = 8 to 12 × 2 = 24 at the same moment.
A fleet built from these figures runs 8 to 24 combinations of library, pump and server software at once, and 12 to 36 across one correction, before set catalog numbers multiply them. The three sources do not report these combinations: they come from joining their figures and reading the installation order as ruling out one pair.
Every change restarts the count. A change impact analysis asks, before release, which requirements, interfaces and parts a change can reach, and the trace makes the question answerable. Chapter 20 follows the Ivenix pump through five software corrections, and Chapter 28 sets out when FDA treats a change as needing a new 510(k). A hospital faces the same question with every library release, server patch and new set catalog number.
For a pump or set maker, an Indian maker in particular, record each requirement with the parts it is allocated to, set, hospital and user included, and the test that verifies it. Label each electronic interface as FDA's 2017 guidance asks, with the sets, software versions and systems it was tested with, what it needs from them and what the pump does when the link fails. For the hospital team that owns the integration, name an owner for each interface, keep a register of the library, pump, server and set combinations in use, and retest those combinations after each change.
- FDA's 2014 guidance asks that a pump be evaluated as a system with its set, accessories, network, user and environment, so the maker answers for the whole before sale and the hospital owns its configuration after.
- Systems engineering derives requirements from hazards, allocates each to hardware, software, set, hospital or user, verifies the parts against them and validates the whole with its users.
- Each interface, from pump to set, library, network and user, has an owner on each side; FDA's 2017 guidance asks makers to label each electronic interface, and the UL 2800-1 family separates the maker's work from the integrator's.
- Joining one system's library cadence, a published update delay and the Ivenix correction gives 8 to 24 configurations running at once and 12 to 36 across the correction.
Thousands of pumps, one library.
+ The questionWhat does a hospital have to keep doing, pump by pump and library by library, once the pumps arrive?
The assumptions a hospital keeps
A 50 mL graduated cylinder is one of the two instruments that the maker's 2009 service manual for the SIGMA Spectrum pump names for its yearly flow check. The technician runs the pump at 200 mL/h into the cylinder, or onto a balance, and compares what arrived with what the pump says it moved. Chapter 4 showed why that comparison is needed: the pump counts the motion of its mechanism and converts it into milliliters through assumptions about the tubing it squeezes. Chapter 23 left the hospital owning the system once the pumps arrive, network and library included. Neither the pump's count nor its network can tell whether the mechanism still matches the numbers it was built with.
Every number on a pump's screen rests on assumptions that hold for the pump as tested and drift in the pump as used. The mechanism wears, a battery loses capacity, a keypad seal lifts, and the pharmacy replaces the drug library. None of these changes shows on the screen, because the pump checks its dose against the same parts that changed. Keeping each assumption true falls to the biomedical engineers, also called clinical engineers, who maintain the equipment, and to the pharmacists who build the drug library. Their unit of work is the fleet, every pump of a kind the hospital owns, and fleets are large: a conference paper from one engineering service in British Columbia counted over 18,000 pumps, an estimated 4 % or more of them misplaced.
Checks on a schedule, and checks on a risk
How often a pump returns to the workshop is set first by its maker, and makers differ. The Spectrum manual recommends preventive maintenance, the scheduled check made whether or not anything seems wrong, at least once a year and after any drop. A 2014 service manual for BD's Alaris GP volumetric pump asks for it at least every three years. In the United States, a 2013 memorandum from the Centers for Medicare & Medicaid Services lets a hospital replace maker schedules with an alternate equipment management program, provided it is documented, based on risk and followed strictly. A 2013 study that modeled maintenance histories of infusion pumps and ventilators found that makers' intervals did not match observed failure rates.
The checks test the parts that the dose depends on. In the Spectrum procedure the flow test runs at 200 mL/h and passes within ±5 %, by weighing a 50 mL delivery or by collecting 40 mL in the cylinder. The occlusion test confirms that the downstream alarm trips within 13 ± 6 psi, about 360 to 980 mmHg, and the air test that a bubble at least 1 inch long, about 25 mm, raises an alarm. A battery test completes the checks, and a pump outside any band is taken out of service.
A pass shows that the mechanism converts motion into volume within its band on the bench, at one rate, with a set from the workshop drawer. It says nothing about the next set's tubing, the bag height on the ward, a rate of 1 mL/h or the line beyond the pump (Chapters 8 and 9): it checks the pump, not any infusion. The workload is large. For Brigham's 3,800 large-volume pumps, a yearly schedule would mean about 15 checks every working day over 250 working days, and a three-yearly one about 5, though the two makers' intervals were written for other models.
Batteries and keypads wear out in use
The pump cannot fully judge its battery. The Spectrum test runs a charged pump at 125 mL/h: a new battery must last at least 8 hours, about 1,000 mL, and a used one passes at 6 hours, about 750 mL. B. Braun's 2013 service bulletin says batteries in its Space pumps should be tested or replaced after four years, because an aged one may not supply the current for a syringe change even when its gauge shows full. The gauge is an estimate. In 2023, with an update in 2024, ICU Medical corrected its instructions for one supplier's batteries in Plum pumps, whose capacity could fall faster than expected, and FDA classified this correction as a Class I recall. The company puts the low-battery alarm at an estimated 30 minutes of running time.
Cleaning is the other daily stress. Pumps are wiped down between patients, and the agents an infection-control team prefers are not always those the maker tested; the Spectrum manual allows 10 % bleach and isopropyl alcohol but forbids phenolic cleaners, sprays aimed at the pump and immersion. In 2020 BD recalled front-case keypads for its Alaris PC unit and Alaris Pump Module because keys could stick or stop responding after fluid ingress, liquid getting inside the case, delaying or interrupting infusions; FDA classified the recall Class I. A follow-on recall in March 2021 covered about 160,000 units with keypads made in 2019 that could lift and let fluid in, and FDA recorded the root cause as the supplier's process design.
A library update reaches the last pump late
A drug library changes more often than any part. Pharmacists add drugs, correct limits and adjust concentrations, and each change makes a new version that must reach every pump. A 2017 quick guide from the AAMI Foundation (Chapter 21) advises defined update intervals, monthly or quarterly for example, separate routes for urgent changes, and wireless distribution where possible. It measures the result as library currency, the share of pumps carrying the current library, and suggests that hospitals updating by cable mark each updated pump with a colored sticker.
Wireless distribution is faster than a cable, and still slow. A 2019 study of BD Alaris pumps in two hospital systems followed each pump from noncurrent through pending to current: half a fleet became current five to nine days after a release, sooner for busy pumps, later for those left switched off. A 2018 study by the same group timed the delay from a library's replacement to the last alert raised by the old version, and across 49 hospitals in 12 health systems found medians of 22 to 192 days and a longest of 661 days. A 2024 report from an 11-hospital system using ICU Medical's Plum 360 gave about 75 % of the fleet updated within 72 hours; two authors had received ICU Medical research grants.
This example uses Brigham's 3,800 large-volume pumps and the 2019 finding that half a fleet is current five to nine days after a release. On those days 3,800 × 0.5 = 1,900 pumps still carry the previous version, and the AAMI measure of currency is 1,900 ÷ 3,800 × 100 = 50 %. At the 11-hospital system's pace, 3,800 × 0.25 = 950 pumps are still on the old version after three days. The 2018 medians of 22 to 192 days are about 3 to 27 weeks, and the longest, 661 days, is 661 ÷ 365 = 1.8 years. A limit corrected in the pharmacy stays uncorrected on hundreds of pumps for days and on a few for months. The result combines inputs from different hospitals.
Releasing a library over the network changes the file on the hospital's server, not every pump. Pumps that are switched off, out of range or in storage keep the version they last received, and in the 2018 study the slowest still raised alerts from a replaced library more than a year and a half later. Library currency is a figure to measure pump by pump.
Replacing a fleet, and changing one
Sometimes a hospital changes every pump at once. Brigham and Women's had used Alaris large-volume pumps since 2003, and its one-day swap to Baxter's Spectrum IQ took twelve teams, about 120 hospital staff and 40 Baxter representatives, with wireless programming and documentation through the health record as the stated aim (Chapter 22). More often a recall decides. After the final order of 13 July 2010 that closes the opening story, Baxter offered SIGMA Spectrum pumps or a payment in exchange for its Colleague pumps; it charged $588 million against its 2010 results and reported the recall substantially complete in July 2012.
After BD's Class I recall of February 2020 (Chapter 26), BD shipped new Alaris pumps in the United States only for medical necessity until FDA cleared a new 510(k) in July 2023. The recall and the clearance were three and a half years apart. Through that time hospitals with Alaris fleets kept, repaired and updated pumps they could not renew in the ordinary way, and the clearance brought a second task: remediation, meaning correction in place, or replacement of every device, which BD said would follow.
In 2020 the intensive care units of Mount Sinai Morningside made a third kind of fleet decision: they changed how every pump was used. Pumps for patients with COVID-19 moved outside the rooms on long extension lines, with higher occlusion limits and a carrier on every line, so one decision moved the lag of Chapter 3 and the alarm limits of Chapter 12 for every infusion together. Its paper reports no patient numbers, no pump brand and no outcomes. The decision was the hospital's, and so was the checking.
For biomedical engineering and pharmacy: after every library release, list the pumps that have not been switched on since, because they are the ones stored or out of range, and report currency pump by pump. Record battery age and measured run time at each check, not only pass or fail. Check the maker's list of cleaning agents against what infection control uses, and test any new agent before it reaches the wards. When a recall or an emergency changes how every pump is used, list the accuracy and alarm assumptions it touches and measure them on the bench, as ECRI did in 2020 (Chapter 12).
- A pump checks its dose against its own parts, so a hospital's biomedical engineers and pharmacists keep the assumptions behind those parts true across the fleet.
- Preventive maintenance tests flow, occlusion, air detection and batteries against maker bands at intervals that differ several-fold between makers, and a pass shows the pump is sound, not that every infusion is.
- Batteries and keypads wear in use and in cleaning, and the Plum battery and Alaris keypad recalls show that either can put infusions at risk.
- A library update reached half of one fleet in five to nine days and the last pumps of some fleets months later, while recalls and emergencies such as Mount Sinai's in 2020 can change every pump at once.
Reading a pump's log.
+ The questionWhat can a pump's event log and library reports show after an incident, and what can they not?
The pump's own account
A pump's own record settled within a day what had happened in the Alberta fluorouracil infusion of Chapter 16, and it could not settle why. The day after the four-day infusion ran out in about four hours, the unit manager and a nurse checked the pump's data history and found the rate it had been given, 28.8 mL/h. ISMP Canada's 2007 root cause analysis, a structured search for every cause behind an incident, reports that check and its result.
The record answered the first question any investigation asks, what the pump had been told. It could not say why 28.8 was entered when the order meant 1.2, and nothing in it showed what reached the patient beyond the pump's own count. This chapter reads what the fleet of Chapter 24 writes down, and takes its frame from a 2010 summit of AAMI and FDA whose first theme asked for standard ways to report, pool and analyze incidents like this one. What every such record can hold follows from the rule set out in "Before we start": a pump's records are written by the pump, so they hold what it was told, what its software decided, what its mechanism counted and what its sensors flagged, and nothing beyond its outlet.
What an event log holds
An event log, also called a history log, is the pump's time-stamped list of what happened to it, and its maker decides what goes in; as Chapter 17 showed, it keeps the number the pump accepted, not the keys pressed to reach it. The SIGMA Spectrum service manual of Chapter 24 describes downloading the log over an infrared link or a memory card as a file that can run to more than 300 pages of text. A 2012 study sponsored by CareFusion, now part of BD, used syringe-pump event logs from a Berlin intensive care unit to sort 133,601 infusion starts by how each was programmed (Chapter 21).
| Record | What it shows | What it cannot show |
|---|---|---|
| Pump event log | Values accepted and when; starts, stops, alarms and alerts; the volume the pump counted | What the order meant; what the bag held; what reached the vein |
| Library report | Alerts, overrides and corrected entries; drugs that alert most; share of infusions through the library; pumps on the current version | Errors inside the limits; infusions programmed around the library; why an alert was overridden |
| Incident report | What a person saw, judged worth reporting and wrote down | Incidents nobody noticed or reported; close calls that need not be reported |
The volume column of a log needs the most care, because it looks like a measurement and is not one. A large-volume pump computes volume infused from the strokes of its mechanism, and a syringe pump from the travel of its plunger (Chapters 4 and 5), so the figure in the log is exactly as right as the conversion behind it. A log that shows a bag fully delivered shows that the mechanism moved as far as that volume should take it.
Worn tubing, a syringe the pump took for another size, a line blocked for an hour before the alarm (Chapter 12) or a catheter leaking into tissue can each leave a log showing the programmed volume delivered. Fluid that ran by gravity with the set out of the pump (Chapter 14) never appears at all. Even the Ivenix pump, which measures the volume in its chamber from air pressure (Chapter 4), records the chamber and not the vein.
Reading a library report
The library keeps a second record. When an entry crosses a limit, the pump records the alert and what the nurse did next: override it and run the entry as programmed, change the entry, or cancel. Pharmacists download these records and read them as continuous quality improvement (CQI) reports, whose contents the AAMI Foundation's 2017 guide lists and the table above summarizes. An entry beyond a limit that is then corrected is the good catch of Chapter 21.
The 2019 analysis of Chapter 21, whose override rates averaged about three in four, also reports the override-to-reprogram ratio, the number of overrides for each corrected entry: 9.92 for high-alert drugs and 7.30 for the rest. The AAMI guide shows how far the ratio can climb: at an override rate of 98 %, with corrections making up the other 2 %, there are 49 overrides for every correction.
For illustration, the 2019 means are applied to a report of 2,000 alerts on high-alert drugs. Overrides, at 75.8 % (Chapter 21): 2,000 × 0.758 = 1,516. Corrected entries, the good catches: 1,516 ÷ 9.92 = about 153. The other 2,000 − 1,516 − 153 = 331 ended in neither, a cancelled infusion for example; the published summary does not break them down. About 1 alert in 13 (2,000 ÷ 153 = 13.1) led to a corrected entry, and those 153 are the report's whole record of errors caught. A mean of ratios across hospitals is not any one hospital's ratio.
What the 1,516 overrides mean, the report cannot say. An override is a keystroke: it records that a nurse ran an entry the library questioned, not whether the limit was too tight for the unit, the order was unusual and right, or the alert was misread. The 153 corrections are a floor on errors caught, not a count of errors made, since an entry inside the limits raises no alert, and an infusion programmed in plain mL/h, around the library, raises none at all. A speaker from Intermountain, a 22-hospital system, told the 2010 summit that 137 alerts had saved patients from harm over almost two years; how many alerts there were in all was not given.
Theme 1: incidents that are not counted
The summit, held at FDA's headquarters on 5 and 6 October 2010, drew 330 attendees. Its report, Infusing Patients Safely, set out five themes, and the first was to "standardize systems and processes for reporting, aggregating, and analyzing infusion device incidents." Four priority issues sat beneath it. Systems that pooled adverse-event reports, FDA's among them, were incomplete and lacked a standard form. Reported incidents understated the true number, partly because close calls, errors caught before they reached a patient, did not have to be reported. Makers often could not find root causes because they could not see hospitals' incident and quality data. And there was no safe, shared process for analyzing failures together.
The report's examples show the difficulty from inside hospitals. A speaker from Duke University Medical Center described pump quality data as a spreadsheet about 30 columns wide with 85,000 rows, which staff searched for hours and which "never really answers the question, why?" That comes to some 2.55 million cells. Of 978 root cause analysis reports involving devices at the Veterans Health Administration since 1999, 129 involved infusion pumps, about 13 %, and 69 of those concerned patient-controlled analgesia.
Some of what the summit asked for now exists. A research group led from Purdue University pooled alert records from 49 hospitals for the 2018 study of library delays, and pooled logs revealed what no single report could: an old library still raising alerts 661 days after its replacement (Chapter 24). Pooling cannot add what the pumps never recorded, and Chapter 31 sets out the limits of FDA's own database of device reports.
How the pump knows, and why it can still be wrong
The records make the answer to this guide's question visible, because they hold exactly what the pump knows: the numbers it was told and the motion of its own mechanism. A large-volume pump knows how many strokes its mechanism has made and how much each should move in tubing of its design bore (Chapter 4); a syringe pump knows how far its screw has turned and which syringe it was told it holds (Chapter 5). Neither meets the drug. The Ivenix pump measures the volume in its chamber from air pressure, and DEKA's RemunityPRO+ monitors its delivery by acoustic volume sensing (Chapters 4 and 6), but both stop at their own outlet. Everything past the outlet is assumed.
Sensors are the pump's only check on those assumptions, and each answers narrowly or late. Pressure climbs slowly against the give of syringe and line, so, by its maker's figures, one syringe pump at 1 mL/h with a 50 mL syringe may take up to about an hour to alarm at its middle setting (Chapter 12). Air detectors see bubbles above a threshold (Chapter 13), and nothing in the pump detects a catheter leaking into tissue or, as Mount Sinai's paper noted, a line that has come apart. Under its maker's test conditions, the volume a perfect pump counts matches the volume leaving its outlet within the ±5 % makers commonly state (Chapter 8). Outside those conditions, and everywhere past the outlet, the count rests on assumptions that a sensor may contradict only after a delay.
The wrong dose begins where that knowledge stops. The dose is the pump's volume multiplied by numbers people supply, carried through a line nobody measures, so a pump can work as built and still deliver a dose nobody ordered. An entry can carry a tenfold slip, a key read twice or a wrong unit (Chapters 16 and 17), and a 2025 recall of Ivenix software told users to avoid programming two leading zeros. A bag can hold a concentration other than the one selected. Mount Sinai's added tubing, about 20 mL by its paper's figure, takes over an hour to clear at a 10 mL/h carrier (Chapter 3), and a change in another infusion on the catheter pushes drug already in the shared line into the vein (Chapter 11).
Software and people complete the list. A library catches only entries that cross its limits, and only on infusions programmed through it (Chapter 21); the software that does the arithmetic can itself fail, as the Ivenix versions of Chapter 20 and BD's 2020 Alaris recall showed. People bridge every gap the machine leaves: they choose the bag, prime the line, answer the alarm and judge the alert (Part V). A pump's records therefore describe its half of the chain completely and say nothing of the other half, where a perfect pump's wrong doses begin.
After an incident, keep the pump, its set and the bag, and download the event log and library records with the serial number and library version. Read the log for what it can prove: entries and their times, alerts and what followed them, alarms. Then gather what it cannot show: the order, the bag's label and contents, the line as set up, other infusions on the catheter, and the accounts of the people involved. In library reports, read every override rate beside the limits that produced it, and treat corrections as a floor on errors caught.
- A pump's event log and library records are written by the pump, so they show what it was told, decided, counted and flagged, and nothing past its outlet.
- In a library report an override is a keystroke and a correction is a floor on errors caught: at the 2019 means, about 1 high-alert alert in 13 ended in a corrected entry.
- The first theme of the 2010 AAMI and FDA summit asked for standard ways to report, pool and analyze incidents, and pooled pump data now show what single reports cannot, but not what pumps never recorded.
- A pump knows its mechanism's motion and tests its assumptions only through sensors that answer late, so a perfect pump gives a wrong dose whenever the entry, bag, line, another infusion, software or people carry the error.
+ Part VIII · The field in 2026
The pump, the set and the software.
On 19 August 2026 BD wrote to its customers that its Alaris Pump Module 8100 "may perform worse than previously disclosed" with certain infusion sets at low flow rates or small bolus volumes. It told them to discard the listed sets, starting in critical care, neonatal, infant and pediatric areas. FDA posted the recall as Class I on 15 September 2026. Its record covers about 94 million sets under about 50 catalog numbers and gives the reason as "discrepancies in specific attributes in the performance data for infusion sets". No pump was removed. The recall concerned the published behavior of the plastic that turns the pump's motion into milliliters. Part VIII describes who makes and sells infusion pumps as of October 2026, sorted by pump type and by layer: the pump, the set, the drug-library software and the connection to the hospital network, with India included.
Who makes infusion pumps.
+ The questionWho builds and sells each kind of pump, and what has changed since 2020?
A clearance shows who filed, not who sells
Chapter 25 answered this guide's question: a pump knows how far its mechanism has moved and what it was told. Each part of that answer is a product with a maker. The mechanism is the pump. The set's bore and plastic turn the mechanism's motion into milliliters, which is why makers state accuracy for named sets and syringes (Chapter 8). The drug library that checks what the pump was told is software, released and updated on its own schedule (Chapter 21). The connection that carries orders, libraries and updates from the hospital network is a separate layer with software of its own (Chapter 22). This chapter sorts the makers by pump type and by these layers, using FDA's records and the companies' own statements, and ranks none of them.
From January 2025 to late September 2026, FDA cleared ten 510(k)s under FRN, the product code it gives to the general infusion pump, and they went to six companies: BD, Baxter, ICU Medical, Iradimed, Koru Medical and DEKA. Fresenius Kabi, which sells the Ivenix pump in the United States, received none of them, yet it appears in 15 of FDA's recall records since 2025, seven of them Class I. A count of clearances shows who brought a new or changed pump to FDA, not who sells pumps or how many.
Large-volume pumps after 2020
BD makes the Alaris system through its subsidiary CareFusion 303. The system shows how long a large-volume pump can take to return after a recall. On 4 February 2020 BD began a Class I recall of Alaris point-of-care units and modules for five problems, among them a low-battery alarm that could fail and errors in programming custom concentrations; FDA's record counts about 870,000 units in commerce. BD committed to seeking a comprehensive new 510(k), and FDA cleared it on 21 July 2023 for the Alaris system with Guardrails Suite MX version 12, about three and a half years after the recall began. A further Alaris 510(k) followed on 25 April 2025. Chapter 24 follows what the wait and the promised remediation meant for hospital fleets.
Baxter sells two families. Its Spectrum IQ and SIGMA Spectrum systems received 510(k) clearances on 28 July 2025. Its newer Novum IQ large-volume pump was the subject of a Class I correction begun on 14 July 2025, described in Chapter 31. Baxter first disclosed a pause in distribution with its second-quarter 2025 results, at the end of July 2025. In its report for the quarter ended 30 June 2026 it said it had elected to temporarily stop distributing and installing the Novum LVP in the United States and Canada except where medically necessary. Whether the pause has since ended is not known.
ICU Medical added two pump lines by acquisition. In January 2022 it completed its purchase of Smiths Medical, whose products included the Medfusion syringe pumps and the CADD ambulatory pumps, and added them to the Plum cassette pumps it already sold. On 2 April 2025 FDA cleared the new single-channel Plum Solo and an updated version of the dual-channel Plum Duo, first cleared in August 2023, both with the company's LifeShield software. Two days later FDA sent ICU Medical a warning letter saying that changes to the Medfusion 4000 and the CADD-Solis VIP had needed new 510(k)s, a question Chapter 28 takes up. The company says it filed 510(k)s for a next-generation Medfusion and a refreshed CADD pump in July 2025; no clearance of either is known as of October 2026.
ICU Medical's announcement claims "±3% accuracy in real-world conditions" for the Plum Solo. The company's 510(k) summary in FDA's record gives ±3 % for 0.1 to 999 mL/h under the standard conditions of AAMI TIR101 (Chapter 9), ±5 % under non-standard conditions, and ±5 % for the predicate, the Plum Duo. In an illustrative order of 1,000 mL at 125 mL/h, the pump counts the volume down over 8 hours from the motion of its own mechanism. Under standard conditions the volume actually delivered when the count reaches zero lies between 1,000 × 0.97 = 970 mL and 1,000 × 1.03 = 1,030 mL, a spread of 60 mL. Under non-standard conditions it lies between 950 and 1,050 mL, a spread of 100 mL. Which band applies depends on the conditions of use, and only the summary names them.
Fresenius Kabi completed its purchase of Ivenix on 4 May 2022, weeks after FDA cleared Fresenius Kabi's own Agilia Connect pumps on 1 March 2022. The Ivenix pump is one of the two exceptions to the rule that pumps infer volume rather than measure it: its 2019 clearance describes a pneumatic pump that measures the volume in its pumping chamber with the gas law, as Chapter 4 explained. B. Braun's Space system pairs the Infusomat Space large-volume pump with the Perfusor Space syringe pump and the DoseGuard drug library. For the MRI suite, B. Braun's SpaceStation MRI, cleared in 2020, holds up to four Space pumps, and Iradimed's MRidium 3870 was cleared in May 2025.
Syringe, ambulatory, elastomeric and feeding pumps
Syringe pumps come from the same large firms, as modules or standalone units: the Alaris syringe module, ICU Medical's Medfusion, B. Braun's Perfusor Space and Baxter's Novum IQ syringe pump. Baxter's syringe pump had Class I corrections, begun on 4 August 2025, for a blank run screen and false motor-movement errors. Ambulatory and PCA pumps include ICU Medical's CADD-Solis, Moog's CURLIN 6000 and 8000, and Eitan Medical's Sapphire. Eitan says it launched its Avoset system for regional anesthesia in the United States on 16 April 2026. DEKA's RemunityPRO+, cleared on 24 July 2026, is built for one drug, subcutaneous treprostinil. Its 510(k) summary describes acoustic volume sensing as feedback for monitoring delivery accuracy, which makes it the second exception.
Elastomeric pumps, which have no motor (Chapter 7), are cleared under a product code of their own, MEB, with close to 90 records in FDA's 510(k) database by October 2026. Among the holders are Halyard for the ON-Q pump, which Avanos now sells, Baxter for its Infusor, Nipro for SureFuser and, most recently, Epic Medical of Singapore for SMARTeZ, cleared on 24 April 2026. A 510(k) holder is not always the present seller, as the ON-Q shows. Enteral feeding pumps have another code, LZH, with 34 records, among them Cardinal Health's Kangaroo OMNI of 2022 and Luminoah's FLOW system, cleared in April 2026. Interoperable insulin pumps have yet another code, QFG, held by eight companies from Tandem and Insulet to Beta Bionics; Chapter 6 covers these pumps.
The set, the library and the network
The recalls of 2025 and 2026 reached beyond the pump. On the set side, BD began a Class I recall on 8 July 2025 because the Alaris Pump Module with compatible sets might perform outside its established ranges, which Chapter 8 lists; FDA's record counts about 33 million sets. A further Class I recall of Alaris sets began in September 2025, and the August 2026 recall that opens this part covers about 94 million. The two large counts belong to separate recalls, and FDA's records do not say whether any set is counted in both. ICU Medical's IV sets with drip chambers had a Class II recall in May 2026 for black specks in the plastic, covering about 100 million units.
Library and connection software have recalls of their own. In February 2025 BD began a Class I recall of its Alaris Systems Manager, the software that relays auto-programming requests to the pumps (Chapter 22), because it could send an outdated request to the point-of-care unit. ICU Medical recalled its LifeShield library software in November 2025 (Class II) because its change-summary review failed after a library migration. In April 2026 it recalled Plum Solo and Duo pumps that might not show a soft-limit alert before delivery started. On the network side, Alaris labeling did not say which version of the TLS encryption protocol had to be enabled for secure Wi-Fi to the pumps (Class II, February 2026, about one million units).
The quantity in an FDA recall record counts whatever that record counts: pumps in commerce, modules with repair kits, sets or hospital systems. The Alaris units of 2020, about 870,000, and the sets of 2026, about 94 million, differ by a factor of about 108, but a set serves one patient and is thrown away, while a pump stays in service for years. The ratio says nothing about relative risk or market size. Fresenius Kabi's Class I software recall of May 2026 counts "32 systems", which may mean hospital servers rather than pumps; FDA does not define the term.
India: makers, a launch and an estimate
India's pump makers are documented mostly by their own websites, so what follows is what the companies say about themselves. AKAS Infusions of Chennai, founded in 1996, has factories in Tiruchirapalli and Chennai and lists four syringe pumps, among them the Syru 4004, and two infusion pumps. It says that more than 50,000 of its products are installed and calls two models "CE approved". Skanray Technologies of Mysuru sells the floSKAN 3000 syringe pump, listed at 0.1 to 2,000 mL/h with a library of 1,000 drugs; its page does not say where the pump is made. BPL Medical Technologies of Bengaluru lists an infusion pump category, and Narang Medical of New Delhi calls itself a manufacturer and exporter of volumetric pumps, but neither page names a factory. Poly Medicure's home page lists infusion sets, not pumps.
Multinationals sell alongside them. In August 2025 a trade report described Terumo India's launch of its Terufusion range, a syringe pump, a volumetric pump and monitoring software, and the distribution list of BD's September 2025 set recall shows that Alaris sets reached India. The size of the market is known only from estimates. The market-research firm IMARC puts India's syringe-pump market at 157.5 million US dollars in 2025 and 230.6 million in 2034, growing at 4.19 % a year from 2026. Those three figures do not quite agree, since 157.5 million growing at 4.19 % for nine years gives 227.9 million, and none of them counts pumps. Which licenses these companies hold from CDSCO, India's national device regulator, is not known; Chapter 30 explains how licensing works.
Before buying, list for each candidate pump its authorization and date, the catalog numbers of the sets its maker lists, the versions of its library and server software, and the network settings it requires. Search FDA's recall database for every layer before purchase and again at each update; in 2025 and 2026 each layer had recalls of its own. Ask in which document, and under which conditions, a maker states its accuracy before comparing it with another's. An Indian maker preparing a technical file can define its product the same way: the pump, the sets validated with it, the software versions and the connection.
- Ten 510(k)s under FRN, the code for the general infusion pump, from January 2025 to late September 2026 went to six companies, while Fresenius Kabi received none and appeared in 15 recall records, so clearances show who filed rather than who sells.
- Since 2020, BD's Alaris system has been recalled and, about three and a half years later, cleared under a new 510(k) in 2023; ICU Medical has bought Smiths Medical and Fresenius Kabi has bought Ivenix; and Baxter's Novum IQ has had corrections and a pause in distribution.
- The recalls of 2025 and 2026 reached the set, the library and the network as well as the pump, and FDA's quantity fields count different units.
- India's pump makers are documented mainly by their own websites, multinationals such as Terumo sell alongside them, and the only market size is an estimate whose figures do not quite agree.
+ Part IX · Quality and regulation
Quality and regulation, as of October 2026.
FDA's recall database dates the start of one Class I recall to 6 May 2026. Version 5.10.2 of the software for Fresenius Kabi's Ivenix large-volume pump had been released as the remedy for an earlier Class I software recall, begun on 14 November 2025. The new version could show a false battery-health value, "typically 69%", and the pump could then shut itself down for a depleted battery unless it was running on AC power. The remedy for one software recall had become the subject of the next. Part IX sets out, as of October 2026, the standards a pump is built and tested to, how the United States, the European Union and India decide whether it may be sold, and how problems are found and corrected once pumps are in use, mapping the mechanisms of the earlier parts onto the rules.
The standards that define a pump.
+ The questionWhich standards set what a pump must do and how it is tested?
Product standards and process standards
A standard, in the sense this part uses, is a document published by a standards body, such as the International Electrotechnical Commission (IEC) or the International Organization for Standardization (ISO), that states what a product or a process must achieve and, usually, how to show it. A standard binds no one by itself. It gains force when a regulator gives it standing: FDA recognizes standards, the European Union lists them as harmonized, and India's Medical Devices Rules make an Indian standard mandatory where one exists (Chapters 28 to 30). A maker of Chapter 26 that sells in more than one of these markets finds most of what each regulator asks of a pump written in the same few documents, adopted in different ways.
Two kinds of standard matter for a pump. Product standards say what the pump must do and how a test laboratory checks it: the IEC 60601 family for medical electrical equipment, the ISO 80369 family for the connectors on its sets, and ISO 28620 for pumps with no electrical drive. Process standards say how the maker must work: ISO 14971 for risk management, IEC 62366-1 for usability engineering and IEC 62304 for the software life cycle. A product standard can be checked on a finished pump. A process standard is checked in the maker's files, which is where FDA's 2010 white paper on infusion pumps placed many of the problems it listed, in "deficiencies in device design and engineering."
Within the 60601 family the structure is layered. A general standard, IEC 60601-1, covers every medical electrical device. Collateral standards, numbered 60601-1-x, each add requirements on one topic, such as alarms, for all such devices. A particular standard, numbered 60601-2-x, amends and adds to the general standard for a single type of device, and for infusion pumps that is IEC 60601-2-24. A pump is therefore tested to a stack: the general standard as its particular standard modifies it, plus every collateral standard that applies, while the process standards run underneath all of them.
The general standard and its collaterals
IEC 60601-1 is in its third edition, published in 2005 and amended in 2012 and 2020; the consolidated text of August 2020, numbered edition 3.2, runs to 842 pages. A working document of IEC's medical-equipment committee listed an edition 4 as in development in July 2026, without a stage or a date. Three collateral standards bear most on a pump. IEC 60601-1-2, on electromagnetic compatibility, is the 2014 edition amended in 2020; it concerns whether the pump keeps working beside other equipment's emissions without disturbing them. IEC 60601-1-8, on alarm systems, dates from 2006 with amendments in 2012 and 2020, and defines alarm priorities by degree of urgency (Chapter 15). IEC 60601-1-11, of 2015 amended in 2020, covers equipment used in the home.
IEC 60601-1:2005 is the current general standard as amended in 2020, IEC 62304:2006 is the current software standard as amended in 2015, and ISO 80369-7:2021 was confirmed as current on 28 September 2026. The year in a standard's name says when that edition was first published. Whether it is in force, amended, confirmed at review or replaced is recorded in the standards body's catalog, and a test report should name the edition and every amendment it applied.
What IEC 60601-2-24 asks of a pump
IEC 60601-2-24 is the particular standard for infusion pumps and controllers. Its second edition, published on 19 October 2012, replaced the first of 1998, aligned the text with the 2005 general standard as amended in 2012, renumbered its clauses and added requirements on usability and alarms. Its scope covers infusion pumps, including enteral nutrition pumps, ambulatory pumps and syringe or container pumps, and volumetric infusion controllers, which regulate a flow driven by gravity rather than pump it. It reaches the administration set only where the set's characteristics affect the pump's safety or performance. Pumps without an electrical drive are left to ISO 28620, and implanted pumps are excluded.
A commercial test laboratory describes the core tests as weighing, by the gravimetric method of Chapter 9. Bolus volumes are weighed the same way, and occlusion is tested on a closed line, recording the pressure at which the pump alarms and the mass it releases once the line opens, the unintended bolus of Chapter 12. A certifier's presentation on the 2012 edition gives the test rates set out in Chapter 9, and says that the instructions must state the range of rates and the conditions, such as temperature, under which the stated accuracy holds. The standard fixes how accuracy is measured (Chapter 9), and the maker declares what the pump achieves, so a test is judged against the accuracy the pump's own instructions state.
A volumetric pump runs at 25 mL/h with the balance read every 30 seconds, so each reading should add 25 ÷ 120 = 0.208 mL, about 208 mg of water. Over the analyzed hour the balance gains 24.10 g, an illustrative reading rather than a published result. Taking the water at 20 °C, where it weighs 0.99821 g per mL, the volume is 24.10 ÷ 0.99821 = 24.14 mL, and the error is (24.14 − 25) ÷ 25 = −3.4 %. Against ±5 %, the figure BD states for its Alaris Pump Module and Fresenius Kabi for its Ivenix pump at this rate, the pump passes. Against the ±3 % that ICU Medical states for the Plum Solo under TIR101's standard conditions, the same −3.4 % would fail. TIR101, however, reads the balance every 10 seconds under its own conditions, so a result from this test and a TIR101 result are not interchangeable. The same hour of data passes or fails according to the claim it is judged against.
A particular standard due for revision
The 2012 edition's stability date, the year until which IEC expected to leave it unchanged, is 2026. According to national standards bodies' copies of IEC's project records, a first project for a third edition was deleted on 31 October 2024. A second project reached a committee draft, the first text circulated for comment, and its comment period closed on 21 August 2026. A draft for vote and a final draft follow, and no publication date is forecast. The British Standards Institution's comment draft names subcutaneous, body-worn and syringe pumps in its scope; whether the test method will change is not known. As of October 2026 the 2012 edition is current, and India adopted it unchanged as IS 13450 (Part 2/Sec 24):2019.
Connectors, non-electric pumps and the US test report
ISO 80369 covers the small-bore connectors that join a set to a syringe, a catheter or a feeding tube, so that connectors meant for different routes cannot be joined by mistake; Chapter 19 gives the editions of its parts for general requirements (part 1), the Luer (part 7) and enteral connectors (part 3). ISO 28620, for portable pumps with no electrical drive, such as the elastomeric pumps of Chapter 7, is a second edition of 2020, confirmed in August 2026.
In the United States, fluid-delivery testing has a document of its own, AAMI TIR101:2021, reaffirmed in 2026, whose method Chapter 9 sets beside the particular standard's. FDA recognizes TIR101 and not IEC 60601-2-24 (Chapter 28). ICU Medical's 2025 summary for the Plum Solo states accuracy against TIR101 and does not cite the particular standard, while DEKA's 2026 summary for the RemunityPRO+ cites IEC 60601-2-24.
Risk, usability and software processes
ISO 14971, the risk management standard, is the third edition of 2019, confirmed in March 2025 with no revision under way. It asks the maker to identify hazards, estimate and control their risks, and judge the risk that remains, across the product's life. The product standards feed its file, from an occlusion alarm limit to an alarm priority to a use error seen in testing. IEC 62366-1, published in 2015 and amended in 2020, is the usability engineering process of Chapter 18. IEC 62304, the software life-cycle process of Chapter 20, is still the 2006 edition with its 2015 amendment.
The second edition of IEC 62304 is not published as of October 2026. Its design specification widens the scope from medical device software to health software and replaces the three software safety classes with two levels of process rigor: class A becomes level I, and classes B and C become level II. A software vendor, a secondary source, reported in June 2026 that the draft had reached the final-draft stage in May, with publication expected late in 2026 or in 2027. An earlier attempt at a second edition was abandoned.
| Standard | Edition in force, October 2026 | What it asks of a pump | Chapter |
|---|---|---|---|
| IEC 60601-1 | 2005, amended 2012 and 2020; edition 4 in development | general safety and performance of electrical equipment | — |
| IEC 60601-1-8 | 2006, amended 2012 and 2020 | alarm systems and their priorities | 15 |
| IEC 60601-2-24 | 2012 (second edition); third at committee draft | accuracy, bolus and occlusion tests, by weighing | 8, 9, 12 |
| ISO 80369-1, -7, -3 | 2025; 2021; 2016 amended 2019 | connectors that resist misconnection | 19 |
| ISO 28620 | 2020 (second edition) | pumps with no electrical drive | 7 |
| ISO 14971 | 2019 | risk management over the life cycle | — |
| IEC 62366-1 | 2015, amended 2020 | usability engineering process | 18 |
| IEC 62304 | 2006, amended 2015; second edition unpublished | software life-cycle process | 20 |
| AAMI TIR101 | 2021, reaffirmed 2026 | fluid-delivery performance testing in the US | 9 |
Name each standard in a test plan with its edition and amendments, as IEC 60601-1:2005+A1:2012+A2:2020 rather than IEC 60601-1, and check the ISO and IEC catalogs for confirmations and replacements before each submission. An Indian maker testing a pump for CDSCO can cite IS 13450 (Part 2/Sec 24):2019, identical to IEC 60601-2-24:2012, and should add AAMI TIR101 if the same pump is meant for the United States. Follow the third edition of IEC 60601-2-24 and the second of IEC 62304 through their drafts, because a pump designed in 2026 may reach a regulator after both are published.
- A standard binds only through a regulator; product standards say what a pump must do and how it is tested, and process standards say how its maker must work.
- IEC 60601-2-24:2012, the particular standard for pumps, tests accuracy, bolus and occlusion at fixed rates by weighing what the pump delivers, judged against the accuracy the maker declares, and its third edition is at committee draft.
- The editions in force in October 2026 include ISO 80369-1:2025, ISO 80369-7:2021, ISO 28620:2020, ISO 14971:2019, IEC 62366-1 as amended in 2020 and IEC 62304 as amended in 2015.
- In the United States, fluid-delivery testing follows AAMI TIR101:2021, reaffirmed in 2026, which FDA recognizes while it does not recognize IEC 60601-2-24.
Clearance after 2010.
+ The questionWhat does FDA ask of a new pump, and how did the 2010 initiative change that?
A warning letter about changed pumps
On 4 April 2025, FDA sent ICU Medical a warning letter about two pumps that FDA had not reviewed in their present form. Inspectors had visited the former Smiths Medical site in Minneapolis between 23 July and 9 August 2024. They found that the Medfusion 4000 syringe pump, cleared in 2011, and the CADD-Solis VIP ambulatory pump, cleared in 2013, had been changed without new premarket notifications. One of the changes was a Medfusion software update of 28 April 2023. The letter said that, without those notifications, the pumps were adulterated and misbranded under US law, terms that here cover devices sold without the clearance their changes required. A pump in the United States is cleared as it was described to FDA, and these pumps no longer matched their descriptions.
FDA's rules for a new pump, which draw on the standards of Chapter 27, have four parts: the class FDA gives a pump and the comparison a 510(k) makes; the guidance in force since 2 December 2014; the design controls of a quality regulation in force since 2 February 2026; and the cybersecurity duties added in 2023. The guidance began as a draft issued on the day FDA announced its 2010 Infusion Pump Improvement Initiative, and the chapter ends with what FDA says that initiative changed.
Class II, cleared by comparison
The federal regulation for infusion pumps, 21 CFR 880.5725, dates from 21 October 1980 and keeps its 1980 wording. It describes a device used in a health care facility to pump fluids into a patient in a controlled manner, and says the device may detect faults, such as air in the line or a blockage, and sound an alarm. It places the pump in Class II, the middle of FDA's three risk classes. Seventeen product codes sit under it, from FRN for the general pump to PHC for infusion safety management software. All of them need a 510(k), and none may be reviewed by an accredited third party.
A 510(k) is a premarket notification that compares a new or changed device with one already legally sold, called its predicate. It takes its name from the section of the Federal Food, Drug, and Cosmetic Act that requires it. FDA clears a 510(k) when it finds the two devices substantially equivalent; it does not approve it. The predicate need not work the same way. The 2019 summary for the Ivenix pump named Baxter's SIGMA Spectrum and ICU Medical's Plum 360 as predicates, although the Ivenix pump measures the volume in its pumping chamber with the gas law, a principle neither of them uses (Chapter 4). What a pump's 510(k) must contain is set out in a guidance of its own.
The 2014 guidance asks for a safety case
FDA issued that guidance in draft on 23 April 2010, the day it announced the initiative, and in final form on 2 December 2014 as "Infusion Pumps Total Product Life Cycle". At its center is a safety assurance case, a structured argument that the pump is safe for its intended use. The case is made of claims, the arguments that link them and the evidence behind each. It starts from a hazard analysis, which the maker must argue is complete. The analysis is organized under four system hazards: infusion delivery error, incorrect therapy, contamination and traumatic injury. Their causes are grouped as operational, environmental, electrical, hardware, software, mechanical, biological or chemical, and use.
The rest of the guidance says what evidence to bring. Accuracy must hold over the whole infusion, at the pump's operating limits and across the conditions of Chapter 8. It must be shown in every configuration, or in representative ones the maker can justify. The software is treated as a major level of concern, and all of it is to be checked by static analysis. The guidance expects a report of a human factors validation study (Chapter 18), and a wireless pump's submission must describe its radio technology, data and security. The guidance gives no numerical test conditions, does not cite IEC 60601-2-24 and does not mention trumpet curves.
Much of that evidence is test reports, and the standards behind them can come from FDA's list of recognized consensus standards, which a maker can cite in a submission. IEC 60601-2-24 is not on the list: FDA's database held no record of it in October 2026. AAMI TIR101:2021 has been recognized since 30 May 2022. The broader standards a pump shares with other devices are recognized in their current editions, from IEC 60601-1 as amended in 2020 to ISO 14971:2019 and ISO 80369-1:2025. Which of them a 510(k) summary cites varies by maker (Chapter 27).
The guidance also lets FDA look at the factory before clearance. FDA may conduct a pre-clearance inspection when a pump has new technological characteristics or the 510(k) was filed to fix failures. It may also inspect when the maker has gone two years without an inspection, or when the last inspection did not cover similar products or found that action was needed. FDA may withhold clearance until the inspection is done. Neither the guidance nor FDA's account of the initiative says how many such inspections were made.
The guidance's "major level of concern" belongs to a scheme that FDA replaced in June 2023 with software documentation levels. A notice now carried in the guidance says infusion pumps should generally meet the enhanced level. Its human factors section predates FDA's two human factors documents of 2026 (Chapter 18), and its wireless section predates section 524B. A submission in 2026 takes its structure from the guidance and its detail from the newer documents.
Design controls and the trace from hazard to test
How a maker designs a pump is regulated too, under rules called design controls. Until 1 February 2026 they were 21 CFR 820.30: design planning, inputs, outputs, review, verification, validation, transfer to production and control of changes, recorded in a design history file. On 2 February 2026 the Quality Management System Regulation, published in 2024, replaced FDA's earlier Quality System Regulation. The new regulation incorporates ISO 13485:2016, the international quality standard for medical devices, whose requirements FDA judged substantially similar to the old ones. Design now follows the same elements in clause 7.3 of ISO 13485, and a design and development file for each device type or family replaces the design history file.
Verification and validation keep the meanings given in Chapter 23, and traceability joins them. Clause 7.3.2 asks the design plan to state how outputs will be traced to inputs. FDA's 2014 pump guidance notes that "A traceability analysis is useful in demonstrating that all identified hazardous situations have at least one corresponding control".
The trace also decides what happens after clearance, because it shows which risk controls a change touches. Clause 7.3.9 asks that a change be reviewed for its effect on the device's "constituent parts". FDA's two final guidances of October 2017 set out when a changed device needs a new 510(k). The software guidance asks, among other questions, whether a change creates or modifies a risk control for a hazard that could cause significant harm. Its own pump example is the occlusion alarm of Chapter 12: splitting one alarm into upstream and downstream alarms is likely to need a new 510(k), because it modifies an existing control. A change made solely to strengthen cybersecurity, by contrast, is in many cases not likely to need one. Either way the decision is documented and the change verified. In FDA's view, the 2023 Medfusion update named in the warning letter needed a new 510(k).
Software and cybersecurity since 2023
Section 524B was added to the Federal Food, Drug, and Cosmetic Act by the Consolidated Appropriations Act, signed on 29 December 2022. It applies to a cyber device: one that includes software validated, installed or authorized by the sponsor, can connect to the internet, and has characteristics that could be vulnerable to cybersecurity threats. A sponsor that submits one for premarket review must include a plan to monitor, identify and address vulnerabilities after sale, including coordinated vulnerability disclosure, in which outside researchers report a vulnerability to the maker so that it can be fixed before the details are made public. It must keep processes that provide patches on a regular cycle it can justify, and out of cycle for critical vulnerabilities. It must also provide a software bill of materials, the list of commercial, open-source and off-the-shelf components in the device. FDA applied the section to submissions from 29 March 2023, and its transition period ended on 1 October 2023.
FDA's current premarket guidance on cybersecurity is the final version of 27 June 2025, which added a section on 524B. DEKA's 510(k) summary for the RemunityPRO+, cleared on 24 July 2026, shows what this means for a pump. It lists the changes from the predicate as two-way cloud communication, secure pairing, software updates over the air and cybersecurity controls for use on phones or tablets the user supplies, with no change to clinical performance. Each is a route by which the pump's instructions can change after it leaves the factory (Chapter 22), so the plan that section 524B requires lasts as long as the pump is in use.
What FDA says changed after 2010
FDA's account of the initiative lists three lines of action: requirements for makers, help with device improvements and awareness among users. By its own account, FDA inspected all 20 infusion pump manufacturers registered with it as of November 2011. It kept firms with serious findings under surveillance and put the rest on a two-year cycle. It reports an overall improvement in findings but gives no numbers. A pilot that tried safety assurance cases on 30 510(k)s found longer response times for sponsors, more clearances, fewer withdrawals and no significant change in review time, again without counts. The number of FRN clearances, by contrast, can be counted from FDA's data.
FDA's 510(k) data list 45 cleared decisions under FRN from 1 January 2015 to late September 2026, or 46 counted from the guidance date of 2 December 2014. From 2015 to 2021 the yearly counts are 3, 3, 3, 3, 2, 1 and 2: 17 in seven years, about 2.4 a year. From 2022 to 2025 they are 6, 7, 5 and 8: 26 in four years, or 6.5 a year. 2026 has 2 so far, and 17 + 26 + 2 = 45. The four years from 2022 hold 26 of the 45, or 58 %. The counts use FDA's dataset as updated on 28 September 2026. They cover FRN only, leaving out PCA, elastomeric and enteral pumps and safety software. A clearance can cover a changed pump as well as a new one, so the rise from 2022 is a rise in filings, not a count of new designs.
Choose the predicate early and list every difference from it, because each difference needs a claim, an argument and evidence in the safety assurance case. Build the hazard analysis under the guidance's four system hazards and its cause categories, test flow to AAMI TIR101, and write the 524B vulnerability plan and software bill of materials with the design. After clearance, keep the trace from each hazard to its verified control up to date. Put every change through FDA's 2017 questions on whether it needs a new 510(k), and file the decision; the 2025 warning letter turned on that question.
- Infusion pumps are Class II under 21 CFR 880.5725 and reach the US market through a 510(k) that FDA clears against a predicate, with evidence built into the safety assurance case of FDA's 2014 guidance.
- Since 2 February 2026 a pump's design controls follow clause 7.3 of ISO 13485 under the Quality Management System Regulation, tracing each hazard to a verified control, and FDA's 2017 guidances decide when a change needs a new 510(k).
- FDA recognizes AAMI TIR101:2021 but not IEC 60601-2-24, and a connected pump submitted for premarket review on or after 29 March 2023 must also meet section 524B, with a vulnerability plan and a software bill of materials.
- FDA cleared 45 pump 510(k)s under FRN from 2015 to September 2026, 26 of them in 2022 to 2025, and reports improvement after 2010 without publishing outcome numbers.
A pump under the MDR.
+ The questionWho decides whether a pump may be sold in the European Union, and against which rules?
A certificate instead of a clearance
On 17 June 2026 the Official Journal of the European Union carried a Commission decision of 11 June that added the general safety standard for medical electrical equipment, EN 60601-1, to the list of standards that support the EU's medical device law. EN 60601-1 is the European adoption of IEC 60601-1, and each EN standard in this chapter is the European adoption of the IEC or ISO standard with the same number. The decision noted that no reference to EN 60601-1 had been published under that law before. The particular standard for infusion pumps and controllers, EN 60601-2-24, was not added, and as of October 2026 it is still missing. The decision shows where the European system differs from the American one of Chapter 28. In the United States, FDA itself reviews a pump before clearing it. In the EU, much depends on which published standards a manufacturer can point to.
The law is Regulation (EU) 2017/745, the Medical Device Regulation, called here the MDR. In the United States the same letters stand for the medical device reports of Chapter 31. No EU agency reviews a pump before it is sold. The manufacturer compiles technical documentation showing that the pump meets the Regulation's general safety and performance requirements. For all but the lowest-risk devices, that documentation is assessed by a notified body, an independent organization designated by a national authority, which also audits the maker's quality management system. When the notified body is satisfied it issues a certificate. The maker then declares conformity and affixes the CE mark, and the pump may be sold in every member state.
A harmonized standard is a European standard whose reference the Commission has published in the Official Journal for this purpose. A device that meets it is presumed to meet the requirements the standard covers, so the notified body checks the test results rather than an argument that they were the right tests. The MDR's list began with an implementing decision of 16 July 2021 and had been amended ten times by 11 June 2026. Which standards are on it decides how much of a pump's evidence the maker must defend clause by clause.
Rule 12 puts a pump in class IIb
The MDR has four classes, I, IIa, IIb and III, assigned by the rules of its Annex VIII. Rule 12 covers active devices intended to administer or remove medicinal products, body liquids or other substances. Such devices are class IIa "unless this is done in a manner that is potentially hazardous", in which case they are class IIb. The hazard is judged by the substance, the part of the body and the mode of application. In April 2026 the Medical Device Coordination Group, or MDCG, where the member states' authorities meet, revised its classification guidance as MDCG 2021-24 Rev.1. Its examples settle the question: infusion pumps are class IIb, beside ventilators, dialysis equipment and blood pumps for heart-lung machines.
The same guidance puts feeding pumps and "elastomeric or balloon pumps for infusion" in class IIa. An elastomeric pump has no motor (Chapter 7), but the guidance treats as active any device that delivers a drug from stored energy, whether in a stretched balloon or a spring. The split matches the mechanisms of the earlier chapters. A powered pump pushes a drug into a vein at whatever rate it is told (Chapter 16). It keeps pushing against rising pressure until its occlusion alarm sounds (Chapter 12). An elastomeric pump runs at a fixed rate, so no wrong rate can be keyed into it, and a feeding pump delivers into the gut rather than into a vein. In its notes on the same phrase under other rules, the guidance says that "potentially hazardous" refers to the device's characteristics, not to its user's competence.
The disposable parts have classes of their own. Under Rule 2, tubing that serves as a channel in an active drug delivery system is class IIa, which covers a pump's administration set. Syringes made for syringe pumps are class IIa too, while a gravity set is class I. A pump set is therefore a device with its own documentation and, when it fails, its own corrective action. Such actions have reached tens of millions of sets at a time (Chapter 26).
- A large-volume pump with a motor, for intravenous drugs, administers medicinal products, so Rule 12 applies, and the guidance lists infusion pumps in class IIb.
- Its administration set is tubing in an active drug delivery system: Rule 2, class IIa. A gravity set for the same bag is class I.
- In this example the pump holds a certificate under the Medical Devices Directive that preceded the MDR. Its maker had a quality management system and an application with a notified body by 26 May 2024, and a written agreement by 26 September 2024. As a class IIb device that is not implanted, it may then be placed on the market until 31 December 2028.
- From 11 October 2026 to 11 December 2028 is 26 months, and the last 20 days add about 0.7 of a month: about 26.7 months.
From October 2026, the maker of this class IIb pump therefore has about two years and three months to complete its MDR certification before the legacy route closes.
A second opinion on the clinical evidence
For a pump, class IIb brings a step that most class IIb devices escape. Recital 56 of the MDR says that notified bodies should generally ask an expert panel to review their assessment of the clinical evaluation for two groups: class III implants, and class IIb active devices intended to administer or remove a medicinal product. An infusion pump fits the second group exactly. Article 54 sets out this clinical evaluation consultation procedure. Before it certifies a new pump, the notified body asks a panel of experts appointed under the Regulation for its view on the clinical evaluation assessment report, the document in which the notified body judges the maker's clinical evidence.
Article 54(2) exempts three cases, and the second is interpreted in the MDCG's guidance of 2020, MDCG 2019-3 rev.1. The first is the renewal of a certificate already issued under the MDR. The second is a modification of a device that the same maker already markets for the same purpose, where the change does not worsen the balance of benefit and risk. In the MDCG's reading, devices sold under the old directives count as already marketed. The third is a device whose clinical evaluation is covered by a common specification. A maker updating its own established pump may therefore avoid the panel, while a new design, or a pump from a new maker, goes through it.
Standards that carry no presumption
A pump's technical documentation rests on tests to the standards of Chapter 27. The Commission's summary list of harmonized standards, generated on 17 June 2026, has 71 entries. Two of them bear directly on a pump: EN 60601-1 with its 2024 amendment A13, cited since June 2026, and the risk management standard EN ISO 14971:2019 with its 2021 amendment, cited since 2022. EN 60601-2-24 is absent. So are the collateral standards EN 60601-1-2 for electromagnetic compatibility and EN 60601-1-8 for alarm systems, the software life-cycle standard EN 62304, the usability standard EN 62366-1 and EN ISO 28620 for pumps without electric drive.
The difference is one of argument rather than of testing. Nothing prevents a maker from testing to EN 60601-2-24, whose accuracy and occlusion tests remain the obvious evidence for a pump (Chapters 9 and 12). For alarms, software, usability and the particular pump tests, however, no presumption applies. The maker must show that the standard it used reflects the state of the art and covers the relevant requirements, and the notified body judges that case. In standards usage the state of the art means generally acknowledged current practice, not necessarily the newest technology. FDA does not recognize IEC 60601-2-24 either, so a US submission cannot cite it as a recognized standard (Chapter 28). India, as Chapter 30 shows, names its own identical version of the particular standard first.
EUDAMED, the 2028 deadline and a proposal
EUDAMED is the EU's database of devices, makers, certificates and, in time, incidents. The Commission declared its first four modules functional on 26 November 2025, in a decision published the next day. They cover actor registration, the registration of devices with their unique device identifiers, notified bodies and certificates, and market surveillance. Regulation (EU) 2024/1860 set a gradual roll-out in which each obligation applies six months after a notice of functionality is published in the Official Journal. Registration in those modules became mandatory on 28 May 2026, with later deadlines for devices and certificates already on the market. The vigilance module is still in development as of October 2026. Until it runs, field safety notices are published nationally (Chapter 31). Since 10 January 2025 the same 2024 regulation has also obliged a maker to give at least six months' notice of an expected end of supply that could cause serious harm. That notice matters to a hospital whose fleet depends on one pump (Chapter 24).
On 16 December 2025 the Commission adopted a proposal to simplify the MDR and its companion regulation for diagnostics, COM(2025) 1023. It would limit the expert panel consultation to class III implants, taking infusion pumps out of it. It would replace the five-year maximum validity of certificates with periodic reviews scaled to risk. It would also extend the deadline for reporting a serious incident from 15 to 30 days, except for deaths, serious deteriorations of health and public health threats. The Parliament's public health committee received a draft report on 30 June 2026, and the Parliament's indicative date for a plenary vote at first reading is 14 December 2026.
Until COM(2025) 1023, or a revised version of it, is adopted and applies, a new class IIb pump still goes through the consultation procedure unless an exemption fits, certificates still run for at most five years, and the 15-day reporting deadline still holds.
Pumps certified under the old directive have a deadline of their own. Regulation (EU) 2023/607, published on 20 March 2023, extended directive certificates to 31 December 2027 for class III and implantable class IIb devices, and to 31 December 2028 for other class IIb devices, class IIa and some class I devices. The extension holds only while the device still complies with the directive, presents no unacceptable risk and has no significant change in design or intended purpose, and only if the maker had a quality management system and an application with a notified body by 26 May 2024, and a written agreement with it by 26 September 2024. A substantial redesign of a legacy pump therefore needs an MDR certificate.
Map each general safety and performance requirement to the standard used. Where that standard is not harmonized, as EN 60601-2-24 and EN 62304 are not, state why it represents the state of the art for the pump. Plan a new pump's certification around the expert panel consultation, and record the reasoning when a modified pump claims the exemption. Register the company and the pump's unique device identifier data in EUDAMED, and keep the set's class IIa file in step with the pump's. For a legacy pump, count back from 31 December 2028 and treat any significant design change as the end of the extension.
- In the EU a notified body, not a regulator, assesses a pump against the MDR and issues the certificate behind its CE mark.
- Rule 12 puts an infusion pump in class IIb, while elastomeric and feeding pumps are class IIa and pump sets are class IIa devices in their own right.
- A new pump goes through expert panel consultation, and its particular standard, EN 60601-2-24, carries no presumption of conformity as of October 2026.
- EUDAMED's first four modules have been mandatory since 28 May 2026, legacy class IIb certificates run to 31 December 2028, and the 2025 revision of the MDR is still a proposal.
Licensing a pump in India.
+ The questionHow does India's regulator classify and license an infusion pump, and what does that ask of a company that makes pumps in India?
Class C, from an entry among disposable sets
On 1 November 2017 the Drugs Controller General of India issued a classification list whose entry 204 reads "Infusion Pump or Elastomeric Infusion Device". The entry describes a device intended "for slow, continuous delivery through clinically acceptable routes of administration" and places it in Class C. India regulates devices under the Medical Devices Rules, 2017, published on 31 January 2017 and administered by the Central Drugs Standard Control Organisation, or CDSCO. The Rules have four classes, from A for the lowest risk to D for the highest, so Class C is second from the top. Class IIb holds the same rank among the EU's four classes (Chapter 29). In the United States, which has three classes, a pump sits in the middle, in Class II (Chapter 28).
Entry 204 sits among disposable perfusion sets, which suggests it was written mainly with disposable and elastomeric pumps in view. It does not mention syringe pumps. Other CDSCO lists fill in part of the picture. A draft list of 29 June 2017 put an "External Infusion Pump" in Class C, an enteral infusion pump in Class B and an implantable infusion pump in Class D. A later category list puts implantable intrathecal infusion pumps in Class D and enteral feeding kits, used by gravity or with "an enteral pump", in Class C. The General Hospital list, updated on 16 March 2022, has 146 entries and no infusion or syringe pump. It does class an electronic monitor for gravity-flow infusion as C and a pressure infusor for an intravenous bag as B.
No known CDSCO list names a syringe pump or a large-volume pump in those words. What a merged classification list dated 15 October 2025 says about pumps is not known. Class C for an electronic infusion or syringe pump follows from the final 2017 entry for infusion pumps and from the draft's "External Infusion Pump". Because the class decides which authority licenses the pump, a maker needs its own device's class confirmed against CDSCO's current lists before it files.
Two licensing authorities and an import route
The class decides who issues the license. For Class A and B devices made in India, the application on Form MD-3 goes to the State Licensing Authority, which grants a manufacturing license on Form MD-5. For Class C and D, the application on Form MD-7 goes to the Central Licensing Authority at CDSCO, and the license is issued on Form MD-9. Every imported device, whatever its class, needs an import license from the Central Licensing Authority, applied for on MD-14 and granted on MD-15. Test licenses use MD-12 and MD-13 for manufacture and MD-16 and MD-17 for import, and a clinical investigation needs MD-22 and MD-23. Applications are made online.
CDSCO's 2024 answers to frequently asked questions give the clocks. The Central Licensing Authority inspects the factory of a Class C or D maker within 60 days of the application, and an import license takes about nine months when the documents are in order. According to a 2023 trade report, licensing became mandatory on 1 October 2023 for Class C and D devices not previously notified, meaning devices outside the categories that had been notified one by one before 2020, and firms that had applied by the end of September could keep selling for up to six months or until a decision. Before licensing, a device could carry a registration number under a notification of 11 February 2020. CDSCO's answers state that such a number is not regulatory approval. For a pump in Class C, the practical result is a central license with an inspected factory, not a state license or a registration.
- An Indian company makes a volumetric infusion pump, taken as Class C, and files Form MD-7 with the Central Licensing Authority on 1 December 2026.
- The authority inspects within 60 days. December has 31 days, so day 30 is 31 December and day 60 is 30 January 2027.
- A company importing a similar pump files Form MD-14 on the same day. At about nine months for a complete file, the license on Form MD-15 would come around the start of September 2027.
- Once pumps are in use, a hospital records a serious adverse event on 3 March 2027, day 0. Under the 2026 timelines of India's materiovigilance program, described later in this chapter, the report is due within 15 days, by 18 March. A non-serious event would be due within 30 days, by 2 April, since March has 31 days.
The clocks before sale run in months, from the 60-day inspection to the nine-month import license, while the clocks after sale run in days.
One standard under two numbers
CDSCO's answers also set the order of standards. A device must conform to the standard of the Bureau of Indian Standards, or BIS, where one exists. Where none exists, it must conform to an ISO or IEC standard, and failing both, to a pharmacopoeia or to the maker's own validated standard. For infusion pumps BIS has published IS 13450 (Part 2/Sec 24):2019, the first revision of its particular standard for infusion pumps and controllers. It is identical to IEC 60601-2-24:2012. Under dual numbering it is the same document as the particular standard of Chapter 27, with an Indian number. No BIS quality control order covering infusion pumps is known, so the standard appears to apply through the device rules rather than a separate certification scheme.
Here India differs from the other two jurisdictions. In the EU the particular standard gives no presumption of conformity (Chapter 29), and FDA does not list it among its recognized standards (Chapter 28). In India it is the first reference the device rules name. Its accuracy test is the trumpet-curve method of Chapter 9, so an Indian file reports flow accuracy in the IEC's terms, while a US file may state it under AAMI TIR101 conditions. The Indian text is fixed at the 2012 edition. IEC's third edition was still a committee draft in August 2026 (Chapter 27), and IS 13450 (Part 2/Sec 24) will keep the 2012 text until BIS adopts a revision.
MvPI, India's materiovigilance program
Materiovigilance is to devices what pharmacovigilance is to drugs: the collection and study of adverse events once products are in use. MvPI, India's materiovigilance program, was approved by the Ministry of Health and Family Welfare on 6 July 2015. The Indian Pharmacopoeia Commission has been its national coordination center since 2018, the Sree Chitra Tirunal Institute for Medical Sciences and Technology is its national collaboration center, the health ministry's NHSRC gives technical support, and CDSCO is the regulator. Reports reach the program through medical device adverse event monitoring centers, of which there were 775 in September 2026, and also through an online portal and a toll-free helpline. The program's guidance for hospitals, version 1.3 of 2026, names infusion pumps among critical devices. It also sets the timelines of the solved example: a serious adverse event goes to MvPI within 15 days, a serious unexpected one goes to the licensing authority within 15 days, and a non-serious event is reported within 30 days.
No published count of infusion pump reports to MvPI is known, so the Indian record cannot yet be read the way Chapter 31 reads FDA's. For an Indian maker the consequence is practical. Reports about its pumps begin at a monitoring center in a hospital that may never have contacted the company, so its complaint handling has to connect with the program rather than wait for complaints to arrive. The same holds in the other direction: Chapter 31 shows that recalls starting abroad can reach Indian wards through the distribution lists of US corrections.
Test to IEC 60601-2-24:2012 and keep the trumpet-curve data, because the same report answers IS 13450 (Part 2/Sec 24):2019, which is identical. Confirm the class against CDSCO's current lists before filing, since Class C sends Form MD-7 to the Central Licensing Authority and brings a factory inspection within 60 days. For the United States, add flow-accuracy data under AAMI TIR101 conditions, and for the EU, argue that each standard without presumption reflects the state of the art (Chapters 28 and 29). Give hospital buyers the MD-9 license number rather than an older registration number, and route complaints so that serious events reach MvPI within 15 days.
- India's 2017 list puts "Infusion Pump or Elastomeric Infusion Device" in Class C, second of four classes, but no known list names a syringe pump.
- A Class C pump made in India is licensed centrally on Form MD-9 after an application on MD-7, and an imported pump of any class on MD-15 after MD-14.
- India's particular pump standard, IS 13450 (Part 2/Sec 24):2019, is identical to IEC 60601-2-24:2012 and is the first reference the device rules name.
- MvPI, India's materiovigilance program, had 775 monitoring centers as of September 2026 and sets 15 days for serious events and 30 days for non-serious ones.
After the pump is sold.
+ The questionHow are pump problems found and corrected once pumps are in use, and what do the recalls since 2010 show?
A recall that left the pumps in place
On 14 July 2025 Baxter wrote to hospitals that its Novum IQ large-volume pump could underinfuse when the rate was raised to more than twice its previous value, by a rate change or a bolus. It added that a wrongly loaded set could cause over- or underinfusion. In the worst case no fluid might be delivered. By 27 June 2025 Baxter had received reports of 79 serious injuries and 2 deaths. FDA relayed these as the company's figures, not as established causes. FDA classed the action as a Class I recall, and its record covers about 37,000 units and gives the cause as "device design".
The pumps stayed on the wards, although Baxter paused distribution in the United States and Canada except where medically necessary (Chapter 26). Until a fix arrived, users who could not change the pump or set without unacceptable delay were told to move the set about 13 mm downstream in the pump before a bolus or any rate increase above 100 %. Most pump recalls take this shape once a pump has passed the regulators of Chapters 28 to 30. Problems are found as reports accumulate: hospitals report to makers, and both report to the regulator. The maker then corrects them, usually in place, with a letter, a workaround, a changed instruction or new software.
In FDA's regulations a recall is a firm's removal or correction of a product. A correction includes repair, modification, adjustment, relabeling, destruction or inspection without moving the product. FDA assigns the class. Recall classes are a separate scale from the device classes of Chapter 28 and run the other way: Class I is the lowest-risk device class but the most serious recall class. Class I means "a reasonable probability" that using the product "will cause serious adverse health consequences or death"; Class II covers temporary or medically reversible harm, and Class III covers products unlikely to cause harm. FDA's recent notices call Class I "the most serious type of recall".
From a report to the record
In the United States the reports that start most recalls run on fixed clocks. A hospital must report a death linked to a device to FDA and to the maker within 10 work days, and a serious injury to the maker within 10 work days. A manufacturer must file its reports within 30 calendar days, or within 5 work days when an event calls for remedial action. A firm that starts a correction or removal must report it to FDA within 10 working days. These medical device reports, mandatory and voluntary, go into FDA's MAUDE database, which is updated monthly and searchable online for the last ten years.
FDA states that MAUDE data are not meant for judging rates of adverse events. A report has no denominator: nobody counts the infusions that ran without incident, or the pumps in use. One event can produce several reports, and each records a suspicion rather than a finding. The reports counted in the 2010 white paper, about 56,000, were of this kind. Recalls, which FDA classes after review, are firmer ground. A 2019 analysis by academic authors covered 70 Class I recalls of infusion pumps from 2001 to 2017, 12 of them for insulin pumps. Among the 66 recalls that stated a harm, it found underdosing in 36 and overdosing in 18, or 55 % and 27 %. It attributed 45 of 65 recalls to hardware faults and 17 to software, or 69 % and 26 %. Underdosing fits the mechanisms of Part IV: a pump that stops, locks up or alarms for nothing delivers less.
Sixteen years of Class I records
FDA's recall database can be searched by product code (Chapter 6). Under FRN, the code for infusion pumps, it lists 163 records of Class I recalls posted from 1 January 2010 to 11 October 2026. By year they run 10, 19, 9, 11, 7 and 8 from 2010 to 2015; 0, 1, 0 and 3 from 2016 to 2019; then 27, 11, 4, 15, 15 and 21 from 2020 to 2025, and 2 so far in 2026.
- 2010 to 2015: 10 + 19 + 9 + 11 + 7 + 8 = 64 records in six years, about 10.7 a year.
- 2016 to 2019: 0 + 1 + 0 + 3 = 4 records in four years, 1 a year.
- 2020 to 2025: 27 + 11 + 4 + 15 + 15 + 21 = 93 records in six years, 15.5 a year.
- Check: 64 + 4 + 93 = 161, and the 2 records of 2026 make 163.
- Ratio of the last period to the first: 15.5 ÷ 10.7 ≈ 1.45.
Class I records under FRN were therefore about 45 % more frequent from 2020 to 2025 than from 2010 to 2015. Each record, however, is one product line, so a recall of several models makes several records, and PCA pumps, insulin pumps and many sets carry other codes.
The 163 records cannot be set against the white paper's 14 Class I recalls of 2005 to 2009, because one counts product records and the other recall events. Neither has a denominator of pumps or infusions, and the near-empty years 2016 to 2018 may reflect how recalls were coded rather than a safer fleet. A rising count can mean more problems, better reporting or a recall split into more records.
What the recalls of 2025 and 2026 were about
Few of the recent records concern the pumping mechanism alone. Several concern the set. BD's Class I recalls of July 2025 and August 2026 covered about 33 million and 94 million Alaris sets whose performance might fall outside, or below, what BD had published (Chapter 26). FDA's record gives the reason for the second as discrepancies in the sets' performance data. No pump was removed. That is the point of Chapters 8 and 9: accuracy belongs to a pump and its set together.
Others concern software, screens, alarms and power. Fresenius Kabi's Ivenix pump had Class I corrections for software that locked up and for a touchscreen cable that could loosen after a drop (Chapter 17). Another, described at the end of this chapter, concerned a misread battery capacity and a frozen screen. The software issued as its fix, version 5.10.2, was itself corrected in May 2026 because it could show a false battery reading; that recall opens Part IX. ICU Medical's CADD-Solis VIP ambulatory pump could give false upstream occlusion alarms, in a recall that covered about 186,000 units in the United States and about 128,000 elsewhere. These problems belong to the alarms, interfaces, firmware and fleet batteries of Chapters 15, 17, 20 and 24.
Field safety notices in Europe and reports in India
In the EU the duties sit in the MDR (Chapter 29). A manufacturer reports a serious incident within 15 days of becoming aware of it, a death or unanticipated serious deterioration of health within 10 days, and a serious public health threat immediately, and no later than 2 days, counting calendar days from awareness. A field safety corrective action is the maker's action to prevent or reduce the risk of a serious incident, and the field safety notice is the letter that tells users about it. The maker sends a draft of the notice first to the national authority evaluating the case, which has 48 hours to comment except in urgent cases. Until EUDAMED's vigilance module runs, national authorities publish the notices.
In India, reports go to MvPI, the materiovigilance program, on the clocks Chapter 30 sets out. The distribution list of a BD Alaris set recall that FDA classed as Class I in 2025 includes India. An Indian hospital may therefore receive a notice that began as a US correction, while its own reports go to MvPI and CDSCO.
Match the notice's models, serial numbers, lots and software versions against the pump inventory and the set stock. Put interim instructions where users see them: the Novum IQ set move before a large rate increase, the Ivenix advice to keep pumps plugged in, and any entry the maker says to avoid. Check the drug library entries the notice touches, and check whether the fix has a notice of its own, as Ivenix version 5.10.2 did. Report events to the maker and the regulator on their clocks, and record each correction in the pump's service history (Chapters 24 and 25).
April 2010, and two zeros in 2025
The guide's opening story is set on 23 April 2010, when FDA announced its initiative with a white paper that described a key registering one press of zero as two, so that "0" became "00". A week later FDA ordered Baxter to recall and destroy its Colleague pumps, about 200,000 of them in American hospitals by Baxter's count, and FDA issued its final order on 13 July. The pumps were recalled for documented defects in their batteries, their user interface and failure codes, and a temperature-sensitive part of their timing circuit. The white paper's examples, like the recalls of 2025 and 2026, were mostly about what surrounds a pumping mechanism.
As Chapter 25 concluded, most pumps know how much they have delivered only by inference. Each counts the motion of its own mechanism, the steps of a motor or the strokes of a cassette, and converts that motion into milliliters through assumptions about the set, the line, the fluid and the numbers it was given. Its sensors test some of those assumptions, and only after a delay (Chapters 4, 8 and 12). The key bounce of 2010, which registered one press of zero as two, gave the pump a number nobody meant. A pump that worked perfectly would deliver exactly that number, which is how a faultless mechanism gives a wrong dose. The BD sets broke an assumption about the set, and the Ivenix battery reading broke one about power. Each time, the dose depended on something other than the mechanism.
Even the exceptions to that rule show it. The Ivenix pump measures the volume in its pumping chamber with air pressure and the gas law, so its milliliters are measured rather than inferred, and DEKA's RemunityPRO+ monitors delivery accuracy with acoustic volume sensing (Chapter 4). Neither measures the flow that reaches the patient, and no pump measures what it is told. On 14 November 2025 Fresenius Kabi began a Class I correction of the Ivenix pump's software for two anomalies (Chapters 15 and 17). A misread battery capacity could shut the pump down, and a rate entered with two leading zeros above a drug library limit could freeze the interface. Until the fix, users were to keep the pumps plugged in and to avoid programming two leading zeros. Fifteen years after one press of zero became two, a pump again took a zero differently from what was meant.
- Most pump recalls are corrections in place, by letter, workaround or new software, and FDA assigns the class, with Class I for a reasonable probability of serious harm or death.
- Reports to MAUDE, EU authorities and MvPI run on clocks of days, but without a denominator they show where to look, not how often harm occurs.
- FDA's database holds 163 Class I records under product code FRN from 2010 to October 2026, a count of product records shaped by coding, not a measure of risk.
- The recalls of 2025 and 2026, like the examples of April 2010, mostly concerned sets, software, screens, alarms and power, which a pump's count of milliliters takes on trust.
Lessons.
The chapters leave fourteen working rules for anyone who designs, tests, buys, programs or maintains an infusion pump. After each rule come the chapters that explain why it holds.
- Treat the volume on the screen as a count, not a measurement. Most pumps multiply their own motion by a volume per stroke or step that depends on the tube, syringe or cassette, so a change of set, syringe, temperature or wear changes the delivered volume without changing the display (Chapters 4, 5, 8 and 25).
- Work out the transit time before trusting a rate change. A change at the pump reaches the vein only after the volume ahead of the drug has moved, so divide that volume by the total flow, and shorten the line or use a carrier when minutes matter (Chapters 3 and 11).
- Count every resistance in the line. Resistances in series add, and a long narrow extension can need more pressure than the pump's occlusion ceiling allows, so the line changes the alarms as well as the delivery (Chapters 2 and 12).
- Read an accuracy claim with its conditions and its averaging period. A percentage holds only for the named set, fluid, temperature, back pressure, head height and window, and ±5 % over an hour allows ±30 % over ten minutes (Chapters 7, 8 and 9).
- Ask for the start-up and trumpet curves when steadiness matters. Short-acting drugs at low rates answer within minutes to pauses, pulses, syringe changes and changes in pump height (Chapters 5, 9 and 10).
- Expect an occlusion alarm late at low rates, and a bolus when the block clears. Time to alarm is roughly compliance times pressure limit divided by rate, so smaller syringes, suitable limits and clamping before release shorten both the wait and the bolus (Chapters 5 and 12).
- Know what the pump cannot sense. It does not see a leak into tissue, a disconnection, air that enters by a route outside its detector, or free flow once the set is out of the pump; protection against those depends on the set, the clamp and the people at the bedside (Chapters 12, 13 and 14).
- Make the urgent alarm stand out from the routine one. In one maker's logs most pump alarms announced an expected event or a reminder, and an alarm nobody answers protects nobody (Chapter 15).
- Check the concentration and the units, not only the rate. The same dose runs at very different rates from different bags, and a moved decimal point or a doubled zero changes a rate exactly tenfold, often inside the pump's accepted range (Chapters 16 and 17).
- Validate with the people who will use the pump, and size the test for the errors it must reveal. Fifteen participants per user group usually reveal a use error made by one user in ten and usually miss one made by one in a hundred (Chapter 18).
- Run the drug library as a product that needs upkeep. It protects only the infusions programmed through it, only against errors that cross its limits, and only when its alerts are heeded. Override reports, limits and the spread of each new version across the fleet therefore need regular review (Chapters 21, 24 and 25).
- Give every interface an owner on each side. Pump, set, library software, integration server, health record and user are often the work of different makers or departments, and many of the recalls of 2025 and 2026 sat on those interfaces (Chapters 22, 23 and 31).
- Treat every fix as a change that needs its own verification. A software correction is a new version that can carry a fault of its own, as the Ivenix remedy recalled in 2026 showed, and a change to a cleared pump may need a new 510(k) (Chapters 20, 23 and 28).
- State regulatory status with a date and a jurisdiction. As of October 2026 a general infusion pump is Class II and cleared by 510(k) in the United States, and class IIb under the EU MDR. In India, CDSCO's general entry for infusion pumps places it in Class C. Each maker should confirm that class for its own device, and the regulators rely on different standards: FDA recognizes AAMI TIR101 rather than IEC 60601-2-24 (Chapters 27 to 31).
Glossary.
Terms are defined as they are used in this guide.
- 510(k)
- A premarket notification, named for the section of the Federal Food, Drug, and Cosmetic Act that requires it, comparing a new or changed device with a legally sold predicate; FDA clears it when it finds the two substantially equivalent, and does not approve it (Chapters 4, 26, 28).
- AAMI TIR101
- AAMI's 2021 technical information report on fluid delivery performance testing for infusion pumps, reaffirmed in 2026 and recognized by FDA; it sets no clinical acceptance criteria.
- adverse drug event
- Harm caused by a drug. A 2005 trial of smart pumps counted 25 preventable adverse drug events, and 155 potential ones that nobody intercepted, among 219 medication errors in 744 admissions.
- air embolism
- Air in the circulation in an amount that can harm. For veins, a 2016 review gives 200 to 300 mL, or 3 to 5 mL/kg, as the lethal dose for adults, from adult cases and animal models; air reaching the arteries can harm in small volumes.
- air-in-line detector
- A sensor, ultrasonic or optical, clamped around the tubing that tells liquid from gas. A bubble appears as a gap in its signal, which the pump turns into a bubble length and, through the bore of the set, a volume (Chapter 13).
- alarm
- A signal from the pump that a condition needs attention, from a blocked line to an infusion about to finish. IEC 60601-1-8 sorts alarm conditions into priorities by degree of urgency.
- alarm fatigue
- The name hospitals give to staff learning to treat alarms as background when most of them need nothing urgent.
- alert
- A prompt on the pump's screen that asks the user to confirm or change an entry, such as a drug library's warning that a dose exceeds a soft limit.
- alternate equipment management
- A program, allowed to US hospitals by a 2013 CMS memorandum, that replaces makers' maintenance schedules with the hospital's own, provided it is documented, based on risk and followed strictly (Chapter 24).
- Ambulatory pump
- A pump built to be carried so that an infusion can continue at home or at work; it tracks the reservoir by subtracting its own count from an entered reservoir volume (Chapter 6).
- anti-reflux valve
- A one-way valve fitted to each line above a junction to prevent backflow; one model opens at 5.3 mmHg.
- anti-siphon valve
- A valve that opens only above about 100 to 150 mmHg, stopping a syringe from emptying by gravity, at the cost of a higher pressure in the line.
- Architecture
- The division of a system into parts and the connections between them, which decides how each requirement will be met.
- auto-documentation
- The pump sending its rate, the volume infused and its state back to the electronic health record, which writes them into the chart.
- auto-programming
- Sending an order's drug, concentration, dose and rate from the electronic health record, through an integration server, to the pump channel the nurse has scanned, for the nurse to confirm. At one 286-bed hospital it cut programming from a mean of 15 keystrokes to 2.
- averaging period
- The interval over which a percentage error is computed. An error of ±5 % over an hour at 25 mL/h allows up to ±30 % in a single ten-minute window.
- back pressure
- The pressure a pump must push against at the far end of the line, from catheter and vein; accuracy claims are often stated at 0 mmHg.
- backflow
- Fluid driven from a shared junction up a stopped or slower line instead of on to the vein, storing drug that later returns as a bolus.
- Basal rate
- A continuous infusion running beneath PCA demand doses. It keeps running whether or not the patient is awake (Chapter 6).
- biomedical engineer
- A hospital engineer, also called a clinical engineer, who maintains medical equipment, including the pump fleet, its checks and its repairs (Chapter 24).
- callback
- A reminder alarm that a pump has been left unattended, not a fault; 28.8 % of critical care alarms in one maker's pump logs.
- care area
- A group of drug library entries for one kind of unit, such as an adult intensive care unit or a neonatal unit, so that limits suit the patients there. The nurse selects it on the pump before the drug.
- carrier
- A plain fluid infused continuously into the same line as a drug to push it to the vein sooner. It shortens the transit time, adds fluid and ties the drug's delivery to the carrier's rate; Mount Sinai ran carriers at 50 mL/h and later at no less than 10 mL/h.
- Cassette
- A rigid molded piece in the set of a cassette pump, containing a pumping chamber, valves formed by a diaphragm and, in some designs, an air trap and a secondary inlet. The pump's plunger presses the diaphragm and the pump counts plunger steps (Chapter 4).
- catheter
- The short plastic tube that stays in the vein and carries the infusion into it.
- CDSCO
- The Central Drugs Standard Control Organisation, India's national regulator for drugs and devices and the seat of the Central Licensing Authority.
- CE mark
- The mark a maker affixes after declaring that a device conforms to the MDR, backed for all but the lowest-risk devices by a notified body's certificate; it allows sale in every EU member state.
- Central Licensing Authority
- The authority at CDSCO that licenses the manufacture of Class C and D devices (application on Form MD-7, license on MD-9, factory inspection within 60 days) and the import of devices of any class (MD-14, MD-15).
- Change impact analysis
- The review, before a change is released, of which requirements, interfaces and parts the change can reach.
- Class I recall
- FDA's most serious recall class: a reasonable probability that use of the product will cause serious adverse health consequences or death. Class II covers temporary or medically reversible harm; Class III, products unlikely to cause harm. The class is FDA's.
- Class II (FDA)
- The middle of FDA's three device risk classes, in which 21 CFR 880.5725 places infusion pumps; every pump product code under it needs a 510(k) (Chapter 28).
- Clinical evaluation consultation procedure
- The MDR procedure (Article 54) in which a notified body consults an expert panel on its clinical evaluation assessment report before certifying a class III implant or a class IIb active device that administers a medicinal product, such as a new infusion pump. The 2025 proposal would remove pumps from it.
- cold flow
- The slow deformation of a plastic under a steady load. Under a roller clamp, PVC tubing keeps creeping after the clamp is set, so the flow falls; a 2012 patent puts the change at 10 to 20 percent, half of it within about 10 minutes.
- collateral standard
- A standard numbered IEC 60601-1-x that adds requirements on one topic, such as alarms (60601-1-8) or electromagnetic compatibility (60601-1-2), for all medical electrical devices (Chapter 27).
- committee draft
- The first text of a new standard circulated to national bodies for comment, followed by a draft for vote and a final draft before publication; the third edition of IEC 60601-2-24 closed its committee-draft comments on 21 August 2026 (Chapter 27).
- Compliance
- The volume a syringe, line or filter takes up for each unit of pressure; one 2015 study measured 0.21 mL per bar for a 10 mL syringe and 1.54 mL per bar for a 50 mL syringe. It delays start-up and stores volume that is released as a surge when pressure falls (Chapter 5).
- Configuration
- One combination of library version, pump software, server software and set in use together. During one software correction a fleet can run 8 to 24 at once, on the guide's arithmetic.
- continuous quality improvement (CQI) report
- A report built from a drug library's records: alerts, overrides, corrected entries, the drugs that alert most, the share of infusions programmed through the library and the share of pumps on the current version (Chapter 25).
- coordinated vulnerability disclosure
- The practice by which a security flaw is reported to the maker, confirmed and fixed before it is made public. Flaws in Baxter's SIGMA Spectrum pumps were reported on 20 April 2022 and published on 8 September 2022, 141 days later.
- Correction
- A recall action that leaves the product where it is: repair, modification, adjustment, relabeling, destruction or inspection without moving it.
- Critical task
- In FDA's guidance, a user task that, if performed incorrectly or not performed at all, would or could cause serious harm (Chapter 18).
- cyber device
- Under section 524B of the US Federal Food, Drug, and Cosmetic Act, a device that includes software validated by its maker, can connect to the internet and has characteristics that could be vulnerable to cybersecurity threats; a premarket submission for one made on or after 29 March 2023 must include a plan for vulnerabilities after sale, processes to patch them and a software bill of materials (Chapters 22 and 28).
- dead volume
- The fluid in a line between the point where a drug enters it and the tip of the catheter. The drug reaches the vein only after this fluid has been pushed out.
- debouncing
- Accepting a change in a key's state only after the contact has held that state for a set period, typically 20 to 50 ms, sampled every 1 to 5 ms. The period must outlast any bounce and stay shorter than the gap between deliberate presses.
- Demand dose
- The fixed dose a PCA pump delivers for each honored press of the handset, for example 1 mg of morphine (Chapter 6).
- Design and development file
- Under clause 7.3.10 of ISO 13485:2016, and so under FDA's Quality Management System Regulation, the file for each device type or family that contains or references the records of its design.
- Design controls
- The regulated process by which a maker designs a device: planning, inputs, outputs, review, verification, validation, transfer to production and control of changes. In the US under 21 CFR 820.30 until 1 February 2026, and under clause 7.3 of ISO 13485 since 2 February 2026.
- dose error reduction system (DERS)
- The software in a smart pump that checks each entry against the drug library's concentrations and limits for the selected drug and care area.
- Dose rate
- The amount of drug a patient is to receive per unit of time, often scaled to body weight, such as 0.1 mcg/kg/min of norepinephrine; the pump never sees it, only the rate in mL/h derived from it (Chapter 16).
- double pumping
- A syringe changeover in which the new syringe is started on a second pump before the first is stopped; in a 2020 trial it was followed by more swings in blood pressure than a quick change.
- downstream
- In an infusion line, the stretch between the pump and the patient. A downstream block raises the pressure the pump pushes against.
- drip chamber
- The short clear cylinder at the top of an administration set in which liquid falls as separate drops from a small tip, so that the drops can be counted.
- drop factor
- The number of drops an administration set is built to make per milliliter: 20 for a standard set (0.05 mL a drop) and 60 for sets with a finer tip (about 0.017 mL). A nominal figure: a 2013 laboratory study measured drops of water 1.1 to 13.2 percent larger.
- Elastomeric pump
- A pump with no motor or sensor in which a stretched rubber balloon pushes the drug through a narrow flow restrictor; its rate is the balloon's pressure divided by the restrictor's resistance (Chapter 7).
- electronic health record (EHR)
- The hospital's electronic chart of a patient, including the orders for that patient; also called the electronic medical record.
- ENFit
- Trade name under which many enteral connectors made to ISO 80369-3 are sold (Chapter 19).
- Enteral feeding
- Delivery of liquid formula into the stomach or small intestine through a tube (Chapter 19).
- Enteral feeding pump
- A pump that moves feeding formula at a set rate; in the US it is regulated as an infusion pump under product code LZH, Class II (Chapter 19).
- EUDAMED
- The EU database of devices, makers, certificates and, in time, incidents. Its first four modules have been mandatory since 28 May 2026; its vigilance module is still in development as of October 2026.
- event log
- A pump's time-stamped record of what happened to it: values entered, starts, stops, alarms and alerts, and the volume it counted. Also called a history log; its maker decides its contents (Chapter 25).
- extension set
- A length of tubing added between the administration set and the catheter.
- extravasation
- Fluid leaking into the tissue around a catheter that has slipped out of the vein. It does not trigger an occlusion alarm, because the tissue offers too little resistance for the pressure to reach the limit (MHRA).
- fail-stop
- The state a pump enters when its software can no longer trust its own condition: it halts and alarms rather than carry on. A fault in Ivenix software 5.10.1 could freeze the screen in this state when a rate with two leading zeros exceeded a library limit (corrected from November 2025).
- Field safety corrective action
- In the EU, a maker's action to prevent or reduce the risk of a serious incident with a device already in use.
- Field safety notice
- The letter that tells users about a field safety corrective action; its draft goes first to the evaluating national authority, which has 48 hours except in urgent cases.
- firmware
- The software stored in a pump and written for its own processor, changed only by a deliberate update. It reads the keys, converts a dose into a rate, checks the entry against the drug library, schedules the motor steps, watches the sensors, raises alarms, estimates the battery and keeps the log; in most pumps the volume shown on the screen is its count of motor steps.
- fleet
- Every pump of a kind that a hospital owns, managed as one population; one British Columbia service reported over 18,000 pumps, an estimated 4 percent or more of them misplaced (Chapter 24).
- Flow restrictor
- The narrowest part of an elastomeric pump's fluid path, chosen to give the labeled rate. Its resistance follows the liquid's viscosity, so the rate changes with temperature (Chapter 7).
- fluid ingress
- Liquid getting inside a pump's case, for example through a lifted keypad during cleaning; it led to Class I recalls of Alaris keypads in 2020 and 2021 (Chapter 24).
- Forcing function
- A design that makes a wrong action impossible rather than unlikely, such as a connector that cannot join the wrong line (Chapter 19).
- Formative evaluation
- A smaller study with users during development, run to find where people stumble while the design can still change (Chapter 18).
- gauge
- The size number of a catheter, which runs backward: the higher the gauge, the narrower the bore. BD gives its 20 G catheter a bore of 0.76 to 0.84 mm and its 16 G 1.32 to 1.40 mm.
- general standard
- IEC 60601-1, the standard for the basic safety and essential performance of every medical electrical device; in October 2026 the 2005 edition as amended in 2012 and 2020 (Chapter 27).
- Generic Infusion Pump project
- Work by FDA researchers and engineers at the University of Pennsylvania, begun before 2010, that set out the hazards and safety requirements of a generic pump as an open reference. Its patient-controlled analgesia model listed 97 safety requirements, about 20 of which could be verified formally against the model.
- good catch
- An entry that crossed a drug library limit and was then corrected; the count of errors a library report can show it caught.
- gravimetric method
- Measuring flow by weighing the fluid a pump delivers on a balance at fixed intervals; a milliliter of water weighs about a gram.
- gravity infusion
- An infusion driven only by the head of liquid above the vein, with its rate set by a roller clamp and checked by counting drops.
- half-life
- The time the body takes to clear half of the drug present; about 2.4 minutes for norepinephrine, so a gap of a few minutes lowers the blood level markedly.
- hard limit
- A drug library limit marking a dose that should never be given in that care area. The pump refuses an entry beyond it, and the nurse must reprogram.
- Harmonized standard
- A European standard whose reference the Commission has published in the Official Journal; a device that meets it is presumed to meet the requirements it covers. As of October 2026, EN 60601-1 and EN ISO 14971 are cited under the MDR and EN 60601-2-24 is not.
- head
- The height of the liquid surface in the bag above the vein, which sets the pressure driving a gravity infusion: 1 mmHg for every 1.36 cm of water at 20 °C, so 80 cm gives 58.8 mmHg.
- head height
- The height of the fluid container above the pump, which sets the pressure at the pump's inlet; one maker's claim assumes 30.5 to 61 cm.
- High-alert medication
- In ISMP's list, a drug that bears a heightened risk of causing significant patient harm when used in error; intravenous adrenergic agonists such as norepinephrine are on it (Chapter 16).
- Human factors validation test
- Also called a summative test: representative users perform the critical tasks on the final design, with every use error recorded and traced to its cause; FDA asks for at least 15 participants per distinct user group (Chapter 18).
- Incremental entry
- Entering a number by stepping a displayed value up or down with arrow keys or chevrons; in a 2015 laboratory study, 1.41 % slips per number and 25.45 s per number (Chapter 17).
- Integration testing
- Testing parts together across their interfaces: by the maker against the configurations it labels, and by the hospital against the configuration it runs.
- Interface
- A boundary across which two parts of a system exchange something: force and fluid, data, or what a screen shows a person. Four decide a dose: pump and set, pump and drug library, pump and network or health record, and pump and user.
- interoperability
- The exchange of data between a pump and the hospital's information systems, so that orders reach the pump as data and the pump's status returns to the chart.
- IS 13450 (Part 2/Sec 24):2019
- The Indian standard for infusion pumps and controllers, identical to IEC 60601-2-24:2012 under dual numbering; India's device rules name a BIS standard first where one exists.
- Keep vein open (KVO)
- A slow flow that many pumps drop to after the volume to be infused is delivered, to stop the catheter clotting until someone attends (Chapter 16).
- Large-volume pump
- Also called a volumetric pump: a pump that draws fluid from a bag through an administration set and delivers it at a programmed rate by displacing a known volume with each movement of its mechanism. It counts that movement and does not measure the fluid (Chapter 4).
- Lead screw
- A threaded rod whose nut and carriage advance a fixed distance for each turn; a screw with four threads 2 mm apart advances 8 mm a turn (Chapter 5).
- Legacy device
- A device still placed on the EU market under a certificate issued under the directives that preceded the MDR; for a class IIb pump that is not implanted, possible until 31 December 2028 if the 2023 conditions were met and the design has not changed significantly.
- library compliance
- The share of infusions programmed through the drug library rather than in plain mL/h or without it; unrelated to the compliance of tubing. A Berlin cardiothoracic ICU measured 92.8 percent of 133,601 syringe-pump starts in 2012; the AAMI Foundation's 2017 target is at least 95 percent of primary and secondary infusions.
- Lockout interval
- The period after a PCA dose during which further presses are refused, for example 6 to 10 minutes for morphine in one order set (Chapter 6).
- Low-dose tip
- An enteral syringe design that, used with a tap to clear the recess between tip and collar, delivered small doses close to a range of plus or minus 10 % in industry testing (Chapter 19).
- Luer connector
- The small tapered fitting on intravenous lines and syringes, now specified in ISO 80369-7; it was also used, or matched closely enough to mate, on feeding, epidural and cuff lines (Chapter 19).
- Malformed number
- A keystroke sequence that is not a valid number for its field, such as two decimal points, digits beyond the field's precision or superfluous leading zeros (Chapter 17).
- Materiovigilance
- The collection and study of adverse events with medical devices once they are in use, as pharmacovigilance does for drugs.
- MAUDE
- FDA's database of medical device reports, updated monthly and searchable online for the last ten years; FDA states it is not meant for judging rates of adverse events, because reports have no denominator.
- MDCG
- The Medical Device Coordination Group, where the EU member states' authorities meet; its guidance MDCG 2021-24 Rev.1 (April 2026) gives the classification examples for pumps.
- MDR (EU Medical Device Regulation)
- Regulation (EU) 2017/745, under which a pump is classified, assessed by a notified body and CE marked in the EU. Not to be confused with US medical device reports.
- mean arterial pressure
- The average pressure in the arteries over a heartbeat; the measure used to count swings in blood pressure at syringe changeovers.
- mechanical accuracy
- How closely a pump's mechanism moves as commanded, without the set: one maker gives better than 0.5 % for a large-volume pump whose system accuracy is ±5 %.
- Medical device report
- In the US, a report of a death, serious injury or malfunction sent to FDA by a user facility, maker or importer, or voluntarily; reports go into MAUDE. Not the EU MDR.
- Medical Devices Rules, 2017
- India's device regulations, published on 31 January 2017 and administered by CDSCO, with four risk classes from A (lowest) to D (highest).
- microbore
- Narrow-bore tubing. BD classes extension tubing with a bore under 2 mm as microbore; its 213 cm microbore extension holds 0.7 mL, a bore of about 0.65 mm.
- Microstep
- A fraction of a motor step, commonly 1/32 or 1/64, produced by the motor's driver. Microstepping turns a delivery of separate pulses into a near-continuous flow at low rates (Chapter 5).
- Misconnection
- A line joined to a port meant for another, such as an enteral feed connected to an intravenous catheter (Chapter 19).
- MvPI
- India's materiovigilance program, approved on 6 July 2015 and coordinated by the Indian Pharmacopoeia Commission; 15 days for serious adverse events and 30 days for non-serious ones.
- Notified body
- An independent organization, designated by a national authority, that audits a maker's quality management system and assesses its technical documentation before issuing the certificate behind a CE mark. In the EU it, not a regulator, assesses a pump.
- nuisance alarm
- An alarm that sounds when nothing needs to be done, such as an air alarm caused by tubing not fully seated in the detector.
- observation window
- A period of fixed length slid through the test readings one reading at a time, over which the average error is computed; 2, 5, 11, 19 and 31 minutes in secondary accounts of IEC 60601-2-24.
- occlusion alarm
- The alarm a pump raises when the pressure it reads, as the force on a syringe plunger or the pressure in the tube beyond the mechanism, crosses a set limit. The pump infers a blockage from pressure; it never measures the absence of flow (Chapter 12).
- occlusion limit
- The pressure at which a pump stops and alarms on the assumption that the line is blocked. BD states 50 to 525 mmHg for its Alaris Pump module; it must sit above the pressure the line itself needs.
- Out by ten
- Wrong by a factor of ten or more between the number intended and the number the device processed, the measure used in Thimbleby and Cairns's 2010 simulation (Chapter 17).
- override
- Proceeding with an entry after a soft-limit alert. A 2019 multi-hospital analysis found 73.8 percent of alerts overridden for ordinary drugs and 75.8 percent for high-alert drugs.
- override rate
- The share of drug-library alerts that a user overrides to run the entry as programmed; a 2019 analysis found means of 75.8 percent for high-alert drugs and 73.8 percent for others (Chapter 25).
- override-to-reprogram ratio
- The number of alerts overridden for each one corrected; 9.92 for high-alert drugs and 7.30 for others in a 2019 multi-hospital analysis, and 49 at an override rate of 98 percent (Chapter 25).
- particular standard
- A standard numbered IEC 60601-2-x that amends and adds to the general standard for one type of device; for infusion pumps and controllers, IEC 60601-2-24:2012 (Chapter 27).
- Patient-controlled analgesia (PCA)
- Pain relief, usually an opioid, that a patient gives by pressing a handset; the pump delivers a fixed demand dose per press within a lockout interval and a cumulative limit (Chapter 6).
- PCA by proxy
- Activation of a PCA pump for the patient by a family member, caregiver or clinician without authorization, the subject of the Joint Commission's Sentinel Event Alert 33 of December 2004 (Chapter 6).
- Peristaltic pump
- A pump that pinches a length of flexible tubing and moves the closed point along it, pushing fluid forward: with rollers on a wheel (rotary) or with a row of fingers pressing the tube against the door (linear). The volume per wave depends on the tube's bore and how fully it re-opens (Chapter 4).
- plug flow
- The approximation that liquid moves along a narrow line as a plug, first in, first out; it gives the shortest possible transit time, and real lines are slower.
- Poiseuille's law
- The relation for smooth, steady flow in a narrow tube: resistance rises in proportion to viscosity and length and falls with the fourth power of the radius, so halving the radius raises it sixteenfold.
- post-occlusion bolus
- The volume a pump pushed into the stretched syringe and line before an occlusion alarm, released at once when the block clears: at most 0.2 mL in one maker's table for small-bore and microbore tubing, and 1.99 mL in a 2013 bench test of a wrongly released line.
- pre-clearance inspection
- An inspection of the maker that FDA may conduct before clearing a pump 510(k), for example when the pump has new technological characteristics or the maker has not been inspected in two years, and that may delay clearance (Chapter 28).
- predicate
- The legally sold device a 510(k) compares a new or changed device with; it need not work on the same principle, as the Ivenix pump's predicates show (Chapters 6, 28).
- preventive maintenance
- The scheduled check of a pump made whether or not anything seems wrong: flow, occlusion alarm, air detection and battery against the maker's bands. One maker recommends it at least yearly, another at least every three years (Chapter 24).
- Primary and secondary infusion
- The primary infusion is the main fluid running through a set; a secondary infusion is a second fluid given through the same set (Chapters 4 and 11).
- priming volume
- The volume of fluid needed to fill a set or extension before use, stated by its maker; it approximates the dead volume the component adds to a line.
- product code
- The three-letter code FDA gives to a type of device, under which its 510(k)s and recalls are filed: FRN for the general infusion pump, MEB for elastomeric pumps, LZH for enteral feeding pumps, PHC for infusion safety management software (Chapters 6, 26, 28).
- Quality Management System Regulation
- FDA's quality regulation for devices, 21 CFR Part 820 as amended by the rule published on 2 February 2024 (89 FR 7496) and in force from 2 February 2026. It incorporates ISO 13485:2016 by reference and replaced the quality system regulation.
- quick change
- A syringe changeover in which the pump is stopped, the syringe replaced and the pump restarted, in a mean of 9.48 seconds in one bench study.
- Recall
- In FDA's regulations, a firm's removal or correction of a product. For infusion pumps it is usually a correction in place, by letter, workaround, changed instruction or new software.
- recognized consensus standard
- A standard on FDA's list of standards a maker can cite in a submission as part of its evidence; AAMI TIR101:2021 is recognized, IEC 60601-2-24 is not (Chapter 28).
- Requirement
- A statement of what a system must do that a test, an inspection or an analysis can check. It says what, not how.
- resistance
- The property of a tube or line that sets how much pressure a given flow needs; flow is the pressure difference divided by the resistance, and the resistances of parts joined end to end add.
- roller clamp
- A plastic case on the tubing of an administration set with a wheel that pinches the tube; the only rate control of a gravity infusion, and in MHRA's words the "primary means of occlusion" of a line. Under it, PVC tubing creeps after the clamp is set (cold flow).
- root cause analysis
- A structured search for every cause behind an incident, not only the last action before it; ISMP Canada's 2007 analysis of a fluorouracil infusion is one (Chapter 25).
- Rule 12
- The MDR classification rule for active devices that administer or remove medicinal products, body liquids or other substances: class IIa, or class IIb when done in a potentially hazardous manner. Infusion pumps are class IIb; elastomeric and feeding pumps class IIa.
- safety assurance case
- A structured argument that links each claim about a device's safety to evidence, built on a hazard analysis. FDA's infusion pump guidance of 2 December 2014 asks for one in a 510(k) submission.
- sampling interval
- The time between balance readings in a flow test: 30 seconds for IEC 60601-2-24 and 10 seconds for AAMI TIR101, as secondary sources give them.
- Serial entry
- Entering a number by typing its digits in order on a numeric keypad, as on a calculator; in a 2015 laboratory study, 1.36 % slips per number and 4.95 s per number (Chapter 17).
- set-based anti-free-flow device
- A clamp built into the administration set that closes the tube automatically whenever the set is taken out of the pump, so that free-flow protection travels with the set (Chapter 14).
- Single fault condition
- In IEC 60601-1, a condition in which a single means for reducing a risk is defective or a single abnormal condition is present. Equipment must stay free of unacceptable risk under it, and for a pump a fault that could cause over-infusion must raise an alarm and stop delivery or cut it to the keep-vein-open rate.
- single-bubble and accumulated-air limits
- The two air thresholds a pump applies: one for a single bubble (2.5 cm, about 140 µL, in one maker's sets) and one for air added up over time (more than 1 mL within 15 minutes in the same pump).
- siphonage
- Gravity emptying a syringe held above the patient when its plunger is not held by the pump's driver. Anti-siphon valves, which open only above a set pressure, prevent it.
- soft limit
- A drug library limit marking a dose that is unusual but sometimes right. An entry beyond it raises an alert that the nurse may override.
- software bill of materials
- The list of commercial, open-source and off-the-shelf software components inside a device, required under section 524B for cyber devices submitted to FDA from 29 March 2023.
- start-up curve
- Flow plotted against time from the start of an infusion, showing how long a pump takes to reach its set rate; drawn from the first hour of the IEC test.
- State Licensing Authority
- The state authority that licenses the manufacture of Class A and B devices in India (application on Form MD-3, license on MD-5).
- static analysis
- Inspection of source code by tools, without running it, to flag constructions known to cause faults. FDA's 2010 white paper said the agency would apply it to pump code, and its 2014 guidance asks for static analysis of all pump software with an account of unresolved findings.
- Stepper motor
- A motor that turns through a fixed angle for each pulse from its driver, typically 1.8 degrees, or 200 steps a turn (Chapter 5).
- Syringe pump
- A pump that clamps a filled syringe and drives its plunger forward with a carriage on a lead screw turned by a stepper motor. It infers volume from plunger travel and the syringe bore in its table (Chapter 5).
- System
- In the plain-language definition of INCOSE, the international council of systems engineers, a set of elements that work together to produce results that none could achieve alone. For an infusion: the pump, the set, the drug library, the health record and network, and the people who use them.
- system accuracy
- How closely the volume delivered through a real set or syringe matches the volume programmed, under stated conditions; the figure an accuracy claim normally gives.
- Systems engineering
- The discipline that integrates many disciplines across a system's life, from its realization to its retirement: it derives requirements from hazards, allocates them to parts, specifies the interfaces, and verifies and validates the whole.
- Tenfold error
- An error in which a number is multiplied or divided by ten, because a digit was added or lost or a decimal point moved by one place; 30 mL/h becomes 300 or 3 (Chapter 16).
- time to occlusion alarm
- The time from a blockage to the occlusion alarm, roughly the compliance times the limit, divided by the rate. One maker gives up to 1 h 02 min 40 s for its 50 mL syringe at 1 mL/h and a limit of 487 mmHg.
- time to steady state
- How long a pump takes after starting, or after a change, to reach the accuracy it claims; FDA's 2014 guidance asks for it on the label.
- titrate
- To adjust a drug's rate step by step to hold a measured effect, such as blood pressure.
- Trace (traceability)
- The links from each hazard to its controls, from each control to its requirements, and from each requirement to the parts that carry it and the tests that verified it, so that a change shows which hazards it can reach.
- transit time
- The time a change at the pump takes to cross a line's dead volume: the dead volume divided by the total flow, in the plug-flow approximation. 20 mL at 12 mL/h is 1 hour 40 minutes.
- trumpet curve
- A plot of the largest and smallest average errors against observation window length, flaring at short windows and closing toward the overall error at long ones.
- upstream
- In an infusion line, the stretch between the container and the pump. An upstream block, such as a closed clamp or an empty bag, starves the mechanism instead of raising the pressure against it.
- Usability engineering
- The work of analyzing, specifying, developing and evaluating a device's usability as it bears on safety, set out in IEC 62366-1; FDA's guidance calls it human factors and usability engineering (Chapter 18).
- Use error
- An action, or a failure to act, by which a user brings about a result the maker did not intend or the user did not expect; a rate entered in the wrong unit is one (Chapter 18).
- Validation
- Evidence that the requirements were the right ones, from trying the finished system with real users in its intended use; for a pump, the human factors validation test is its core.
- venous pressure
- The pressure of the blood in a vein, against which an infusion must push. In a peripheral vein it follows the central venous pressure only loosely.
- Verification
- Evidence that each part, and the whole, meets its requirements, by test, inspection or analysis; in design-control terms, that the design output meets the design inputs.
- viscosity
- A liquid's internal friction, which multiplies the resistance of a tube; water's is 1.00 mPa·s at 20 °C and 0.69 mPa·s at 37 °C.
- Volume to be infused (VTBI)
- The volume a nurse programs after which the pump ends the infusion; divided by the rate, it gives the time the infusion should take (Chapter 16).
Sources.
Sources are listed by the chapter in which they are first used. Figures from companies, and from papers whose authors include company staff, are identified as such. Products, recalls and regulatory positions are stated as of October 2026.
- Opening — US Food and Drug Administration, Center for Devices and Radiological Health. White Paper: Infusion Pump Improvement Initiative. April 2010. https://www.fda.gov/medical-devices/infusion-pumps/white-paper-infusion-pump-improvement-initiative
- Opening — HealthDay. FDA targets safety problems with infusion drug pumps. 23 April 2010. https://www.healthday.com/health-news/public-health/fda-targets-safety-problems-with-infusion-drug-pumps-638434.html (secondary: date and speaker of the announcement)
- Opening — NPR, Shots. FDA pushing for safer infusion pumps. April 2010. https://www.npr.org/sections/health-shots/2010/04/fda_pushing_for_safer_infusion.html (secondary: the Chicago meeting)
- Opening — Baxter International Inc. Form 10-Q for the quarter ended 30 September 2005. https://www.sec.gov/Archives/edgar/data/0000010456/000095013705013292/c99475e10vq.htm (manufacturer filing: 2005 Colleague notices, shipment hold, seizure)
- Opening — United States Attorney, Northern District of Illinois. Baxter Healthcare agrees to U.S. court order to remedy infusion pump defects and to comply with FDA requirements. Press release. 29 June 2006. https://www.justice.gov/archive/usao/iln/chicago/2006/pr0629_01.pdf
- Opening — Baxter International Inc. Form 10-Q for the quarter ended 30 June 2010. https://www.sec.gov/Archives/edgar/data/0000010456/000095012310072736/c58286e10vq.htm (manufacturer filing: FDA initial order of 30 April 2010 and final order of 13 July 2010)
- Opening — US FDA. Medical Device Recalls Z-0001-2011 (Colleague single channel) and Z-0002-2011 (Colleague triple channel). Posted 12 October 2010. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=93646
- Opening — Shah A.G., Taduran C., Friedman S., et al. Relocating IV pumps for critically ill isolated coronavirus disease 2019 patients from bedside to outside the patient room. Crit Care Explor 2, e0168 (2020). doi:10.1097/CCE.0000000000000168
- Ch. 1 — Leetang K., Samanpiboon P., Chinarak T. Drop volume estimation of intravenous set using gravimetric method. IMEKO TC9 paper 041 (2013; year from the conference name). https://imeko.org/publications/tc9-2013/IMEKO-TC9-2013-041.pdf (tolerance attributed by the authors to ISO 8536-4; the ISO text was not read)
- Ch. 1 — NIST. Chemistry WebBook, SRD 69: thermophysical properties of water (IAPWS formulation), isobaric data at 0.101325 MPa. https://webbook.nist.gov/chemistry/fluid/
- Ch. 1 — MHRA. Infusion systems. Version 2.1. December 2013 (withdrawn 18 September 2019). https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/403420/Infusion_systems.pdf
- Ch. 1 — Adelberg K.N. Parallel-acting roller clamp for intravenous administration set. US Patent 8,313,081 B2. Filed 10 October 2006; granted 20 November 2012. https://patents.google.com/patent/US8313081 (patent background: an inventor's statement, not a measured study)
- Ch. 1 — Lam L. IEC 60601-2-24 standard update requirements (presentation). IEEE Orange County PSES chapter. Undated. https://ewh.ieee.org/r6/ocs/pses/IEC%2060601-2%2024%20standard%20update%20requirements%20presentation.pdf (secondary: a certifier's slides; the standard's text was not read)
- Ch. 2 — BD. BD Insyte Autoguard BC Shielded IV Catheter, product pages for SKUs 382534, 382537, 382544 and 382554 (gravity flow ratings and inner diameters). Accessed 11 October 2026. https://www.bd.com/en-us/products-and-solutions/products/product-page.382534 (manufacturer; test conditions not stated on the pages)
- Ch. 2 — Desebbe O., Vallier S., Gergelé L., et al. Diagnostic accuracy of the peripheral venous pressure variation induced by an alveolar recruitment maneuver to predict fluid responsiveness during high-risk abdominal surgery. BMC Anesthesiol 23, 249 (2023). doi:10.1186/s12871-023-02194-x
- Ch. 2 — BD. BD Alaris Pump module FAQs. BD-22513. 1 August 2021. https://www.bd.com/content/dam/bd-assets/na/medication-management-solutions/documents/brochure/IF_Alaris-Pump-Module_FQ_EN.pdf (manufacturer)
- Ch. 2 — Fresenius Kabi. Agilia VP MC / VP MC WiFi product sheet (Norway). MD-20171219c. Undated. https://www.fresenius-kabi.com/content/dam/fresenius-kabi/no/products/product-documents/agilia-vp-mc-wifi/Produktark%20Agilia%20VP%20MC.pdf.coredownload.inline.pdf (manufacturer)
- Ch. 2 — BD. Other IV extension sets, product family page (microbore under 2 mm; standard-bore and microbore priming volumes). Accessed 11 October 2026. https://stg-preview.bd.com/en-menat/products-and-solutions/products/product-families/other-iv-extension-sets (manufacturer; read on a BD preview site)
- Ch. 2 — BD. Microbore extension set C25006, 213 cm (84 in), priming volume 0.7 mL, product page. Accessed 11 October 2026. https://www.bd.com/en-us/products-and-solutions/products/product-page.c25006 (manufacturer)
- Ch. 2 — ECRI. Large-Volume Infusion Pumps—Considerations When Used with Long Extension Sets. COVID-19 Alert S0392. 1 April 2020 (updated 9 April 2020). https://www.ecri.org/EmailResources/Health%20Devices/ECRI_COVID-19_Alert_S0392.pdf
- Ch. 3 — Hospira. LEVOPHED (norepinephrine bitartrate) injection, prescribing information, sections 12.2 and 12.3. Revised June 2023. DailyMed setid 2c7dd2b0-cc10-4db6-bf56-6eb154ebeb10 (FDA-approved label)
- Ch. 3 — Madson Z.C., Vangala S., Sund G.T., Lin J.A. Does carrier fluid reduce low flow drug infusion error from syringe size? World J Clin Pediatr 9, 17-28 (2020). doi:10.5409/wjcp.v9.i2.17
- Ch. 3 — Gibson L.E., Knudsen A.S., Arney D., et al. Lag times to steady state drug delivery by continuous intravenous infusion. J Clin Monit Comput 36, 1489-1498 (2022). doi:10.1007/s10877-021-00790-1 (abstract only)
- Ch. 4 — US FDA. What Is an Infusion Pump? Content current as of 13 December 2017. https://www.fda.gov/medical-devices/infusion-pumps/what-infusion-pump
- Ch. 4 — Zhu H. Infusion pump and method to enhance long term medication delivery accuracy. US Patent 9,056,166 B2, assigned to Baxter. Granted 16 June 2015. https://patents.google.com/patent/US9056166B2/en (manufacturer; read to about 100,000 of 113,608 characters)
- Ch. 4 — Hopkins P.M., Weber H.J., Sun H. Volume-based flow rate compensation technique for infusion therapy. US Patent 11,116,895 B2, assigned to Baxter. Granted 14 September 2021. https://patents.google.com/patent/US11116895B2/en (manufacturer; read to about 100,000 of 111,944 characters)
- Ch. 4 — US FDA. 510(k) summary K251640, Baxter SIGMA Spectrum Infusion System with Master Drug Library. 28 July 2025. https://www.accessdata.fda.gov/cdrh_docs/pdf25/K251640.pdf (manufacturer's figures in an FDA record)
- Ch. 4 — US FDA. Medical Device Recall Z-2173-2025, Baxter Novum IQ Large Volume Pump, Class I (initiated 14 July 2025, posted 14 August 2025); and Infusion Pump Correction: Baxter Issues Correction for Novum IQ Large Volume Pumps (early alert 22 July 2025, updated 22 December 2025). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=214709 ; https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-pump-correction-baxter-issues-correction-novum-iq-large-volume-pumps
- Ch. 4 — Pastrone J. Disposable fluid infusion pumping chamber cassette and drive mechanism thereof. US Patent 4,842,584 A, assigned to Abbott Laboratories. Granted 27 June 1989. https://patents.google.com/patent/US4842584A/en (manufacturer)
- Ch. 4 — Abrahamson K.D., Ogden J.E. Diaphragm cassette for solution pumping system. US Patent 5,378,126 A, assigned to Abbott Laboratories. Granted 3 January 1995. https://patents.google.com/patent/US5378126A/en (manufacturer)
- Ch. 4 — US FDA. 510(k) K141789, Plum 360 Infusion System with Hospira MedNet (Hospira, Inc.). Received 2 July 2014; cleared 16 January 2015. openFDA 510(k) record. https://api.fda.gov/device/510k.json?search=k_number:K141789 (first clearance of the Plum 360)
- Ch. 4 — US FDA. 510(k) K161469, Plum 360 Infusion System. Cleared 28 March 2017. https://www.accessdata.fda.gov/cdrh_docs/pdf16/K161469.pdf
- Ch. 4 — ICU Medical. Plum 360 Infuser System Operating Manual. 430-98340-004 (01, 2018-09). https://www.icumed.com/media/dqigztsm/430-98340-004.pdf (manufacturer; text read to about p. 3-17)
- Ch. 4 — ICU Medical. Plum 360 Infusion System Catalogue. P26-5581-EMEA (2026). https://www.icumed.com/media/mt2nun2g/p26-5581-emea_plum-360-catalogue_v1_web.pdf (manufacturer)
- Ch. 4 — US FDA. 510(k) summary K183311, Ivenix Infusion System (Ivenix, Inc.). Received 29 November 2018; cleared 7 June 2019. https://www.accessdata.fda.gov/cdrh_docs/pdf18/K183311.pdf (applicant's summary in an FDA record)
- Ch. 4 — Fresenius Kabi. Fresenius Kabi completes acquisition of Ivenix. 4 May 2022. https://www.fresenius-kabi.com/us/news/fresenius-kabi-completes-acquisition-of-ivenix (manufacturer)
- Ch. 4 — US FDA. 510(k) summary K253703, DEKA RemunityPRO+. 24 July 2026. https://www.accessdata.fda.gov/cdrh_docs/pdf25/K253703.pdf (manufacturer's figures in an FDA record)
- Ch. 5 — Smiths Medical. Syringe Pump Performance Tips: Medfusion 3500 v6. IN193728EN-022017. 2017. https://www.agilitihealth.com/wp-content/uploads/2023/08/medfusion-3500-syringe-infusion-pump.pdf (manufacturer; hosted by a distributor)
- Ch. 5 — Baxter. Novum IQ Syringe Infusion Pump technical specifications. US-MD34-220080 v1.0. October 2022. https://ushospitalproducts.baxter.com/sites/g/files/ebysai2186/files/2024-04/Novum_IQ_Syringe_Tech_Spec_Sheet.pdf (manufacturer)
- Ch. 5 — Ossila Ltd. How Do Syringe Pumps Work? Undated. https://www.ossila.com/pages/how-do-syringe-pumps-work (manufacturer of laboratory syringe pumps; generic figures, not a clinical pump)
- Ch. 5 — BD. BD Plastipak infusion pump compatibility. BD-36479. June 2021. https://www.bd.com/documents/international/brochures/syringes-and-needles/MDS_BD-Plastipak-infusion-pump-compatibility_BR_EN_EU.pdf (manufacturer)
- Ch. 5 — Batista E., et al. Assessment of drug delivery devices. Biomed Tech 60 (2015). doi:10.1515/bmt-2014-0138
- Ch. 5 — Neff S.B., Neff T.A., Gerber S., Weiss M.M. Flow rate, syringe size and architecture are critical to start-up performance of syringe pumps. Eur J Anaesthesiol 24, 602-608 (2007). doi:10.1017/S0265021506002328 (abstract only)
- Ch. 5 — Baeckert M., Batliner M., Grass B., Buehler P.K., Schmid Daners M., Meboldt M., Weiss M. Performance of modern syringe infusion pump assemblies at low infusion rates in the perioperative setting. Br J Anaesth (2020; online December 2019). doi:10.1016/j.bja.2019.10.007 (abstract only)
- Ch. 5 — Vieira N.M., Pires M.P.O., Crespo G.B., Nascimento L.P.P., Peterlini M.A.S., Pedreira M.L.G. Start-up delay in syringe infusion pumps with different rates and priming techniques of intravenous sets. Rev Gaucha Enferm 43, e20210071 (2022). doi:10.1590/1983-1447.2022.20210071.en
- Ch. 5 — B. Braun Medical Inc. Perfusor Space Syringe Infusion Pump Operator's Manual, software 588U. 38910389U. About July 2023. https://infusystem.com/images/catalog_manuals/English/Syringe_Pump_Manuals/Perfusor%20Space%20Syring%20Pump_Operator%20Manual_SW%20588U.pdf (manufacturer; hosted by a distributor; table values read by text extraction)
- Ch. 5 — Kawakami H., Miyashita T., Yanaizumi R., et al. Amount of accidental flush by syringe pump due to inappropriate release of occluded intravenous line. Technol Health Care 21, 581-586 (2013). doi:10.3233/THC-130754 (abstract only)
- Ch. 5 — American Society of Anesthesiologists. Programmable Syringe Pumps: FDA Safety Communication - Problems With Fluid Flow Continuity at Low Infusion Rates. Posted 31 August 2016. https://www.asahq.org/advocacy-and-asapac/fda-and-washington-alerts/fda-alerts/2016/08/progrm-syringe-pumps-problems-with-fluid-flow-continuity-at-low-infusion-rates (secondary, for FDA's safety communication of August 2016; FDA's page returned HTTP 429)
- Ch. 5 — Bulmer J., Smith J., Whitaker M. Monitoring low-rate inotrope delivery infusion pressures in syringe pumps used in paediatric intensive care. APAGBI poster P49 (year not stated). https://www.apagbi.org.uk/sites/default/files/inline-files/P49.pdf (conference poster)
- Ch. 6 — Alberta Health Services. PCA Adult Standard Order Set. Form 21524 (2020-10). https://www.albertahealthservices.ca/frm-21524Bond.pdf
- Ch. 6 — Stewart D. Pearls and pitfalls of patient-controlled analgesia. US Pharm 42(3), HS24-HS27 (2017). https://www.uspharmacist.com/article/pearls-and-pitfalls-of-patientcontrolled-analgesia
- Ch. 6 — The Joint Commission. Sentinel Event Alert Issue 33: Patient controlled analgesia by proxy. December 2004. (not opened; content from the two secondary sources that follow)
- Ch. 6 — JCAHO alert gives new recommendations for PCA. Clinician.com, 1 February 2005. https://www.clinician.com/articles/84678-jcaho-alert-gives-new-recommendations-for-pca (secondary)
- Ch. 6 — AHRQ Patient Safety Network. Patient controlled analgesia by proxy (record of Sentinel Event Alert 33, retired June 2016). https://psnet.ahrq.gov/issue/patient-controlled-analgesia-proxy (secondary)
- Ch. 6 — Wuhrman E., Cooney M.F., Dunwoody C.J., et al. Authorized and unauthorized ("PCA by proxy") dosing of analgesic infusion pumps: position statement with clinical practice recommendations. Pain Manag Nurs 8, 4-11 (2007). doi:10.1016/j.pmn.2007.01.002
- Ch. 6 — ICU Medical. CADD-Solis brochure. P26-5599-2-EMEA (2026). https://www.icumed.com/media/irun2ff5/p26-5599-2_cadd-solis-brochure.pdf (manufacturer)
- Ch. 6 — Sekiguchi R., Kinoshita M., Maeda Y., Tanaka K. Accuracy of infusion flow rates and bolus doses for portable infusion pump. Sci Rep (2025). doi:10.1038/s41598-025-98533-8 (devices supplied by their makers)
- Ch. 6 — Smiths Medical. CADD-Solis VIP Ambulatory Infusion System Operator's Manual (2010-05). https://infusystem.com/images/catalog_manuals/English/Ambulatory_Pump_Manuals/CADD-Solis_VIP_Operators_Manual_2010-05.pdf (manufacturer; hosted by a distributor)
- Ch. 6 — US FDA. 510(k) decision summary K232380, t:slim X2 Insulin Pump with Interoperable Technology (Tandem Diabetes Care). https://www.accessdata.fda.gov/cdrh_docs/reviews/K232380.pdf
- Ch. 6 — Tandem Diabetes Care. t:slim Technical Specifications. ML-000029_C (2015). https://tandemdiabetes.com/docs/default-source/product-documents/tslim-insulin-pump/t-slim-technical-specifications.pdf (manufacturer)
- Ch. 6 — US FDA. Medical Device Recalls Z-1797-2026 and Z-2603-2026, Insulet Omnipod 5 Pods, Class I (initiated 12 March 2026 and 20 May 2026). openFDA device enforcement records. https://api.fda.gov/device/enforcement.json
- Ch. 6 — US FDA. 510(k) records under product code QFG (interoperable insulin pumps), 2019 to 2026. openFDA 510(k) dataset. https://api.fda.gov/device/510k.json?search=product_code:QFG (28 510(k) clearances, 20 September 2019 to 11 September 2026; the code was created by a De Novo grant of 14 February 2019)
- Ch. 7 — Avanos. ON-Q elastomeric pump, 400 mL × 4 mL/hr, product catalogue page. Undated. https://avanos.com/product-catalog/product/on-q-elastomeric-pumps/p400x4__on-q-elastomeric-pump-400-ml-x-4-ml-hr/ (manufacturer)
- Ch. 7 — Medical Device Coordination Group. MDCG 2021-24 Rev.1, Guidance on classification of medical devices. April 2026. https://health.ec.europa.eu/document/download/cbb19821-a517-4e13-bf87-fdc6ddd1782e_en?filename=mdcg_2021-24_en.pdf
- Ch. 7 — Baxter Corporation. Baxter Elastomeric Pumps brochure. CA-MD16-210002 (2021). https://cumming.ucalgary.ca/sites/default/files/teams/5/courses/emergency-medicine/BAXTER%20ELASTOMERIC%20For%20Pain%20Management%20Antibiotic%20Oncology.pdf (manufacturer; hosted by the University of Calgary)
- Ch. 7 — Community Oncology Network Pharmacy Educators (BC Cancer). Pharmacy FAQ: Infusor Rate Errors Checklist. Reviewed March 2023. https://www.bccancer.bc.ca/pharmacy-site/Documents/Pharmacy%20FAQs/Pharmacy-FAQ-Infusor-Rate-Error-Checklist.pdf (secondary: relays Baxter's information)
- Ch. 7 — Ilfeld B.M., Morey T.E., Enneking F.K. Delivery rate accuracy of portable, bolus-capable infusion pumps used for patient-controlled continuous regional analgesia. Reg Anesth Pain Med 28, 17-23 (2003). https://rapm.bmj.com/content/28/1/17 (abstract only; pumps donated by their manufacturers)
- Ch. 7 — Hobbs J.G., Ryan M.K., Mohtar A., Sluggett A.J., Sluggett J.K., Ritchie B., Reynolds K.J. Flow rate accuracy of ambulatory elastomeric and electronic infusion pumps when exposed to height and back pressures experienced during home infusion therapy. Expert Rev Med Devices 16, 735-742 (2019). doi:10.1080/17434440.2019.1632187 (abstract only)
- Ch. 7 — IEC. IEC 60601-2-24:2012 Medical electrical equipment, Part 2-24: Particular requirements for the basic safety and essential performance of infusion pumps and controllers. Ed. 2.0. 19 October 2012. https://webstore.iec.ch/en/publication/2635 (catalogue page)
- Ch. 7 — ISO. ISO 28620:2020 Medical devices, Non-electrically driven portable infusion devices. Edition 2. 16 January 2020 (confirmed 2026; replaces ISO 28620:2010, withdrawn 16 January 2020). https://www.iso.org/standard/74736.html (catalogue page)
- Ch. 7 — Drugs Controller General (India). Classification of medical devices and in vitro diagnostic medical devices under the provisions of the Medical Devices Rules, 2017. File No. 29/Misc./3/2017-DC(292). 1 November 2017. https://cdsco.gov.in/opencms/export/sites/CDSCO_WEB/Pdf-documents/medical-device/Classificationg1.pdf
- Ch. 8 — BD (CareFusion). Alaris Syringe Pump (with Plus Software) MK4 Directions For Use. 1000DF00693 Issue 9. Undated. https://www.bd.com/Documents/international/guides/directions-for-use/infusion/1000DF00693.pdf (manufacturer)
- Ch. 8 — MESM Ltd. B. Braun Infusomat Space infusion pump (product listing of the maker's specification). Undated. https://mesm.resonantclinical.com/products/infusion-syringe-pumps/b-braun-infusomat-space-infusion-pump/ (secondary: supplier listing of a manufacturer's figures)
- Ch. 8 — Ferrari R., Beech D.R. (Therapeutic Devices Branch, Therapeutic Goods Administration). Infusion pumps: guidelines and pitfalls. Aust Prescr (volume, pages and year not shown on the page). https://www.nps.org.au/australian-prescriber/articles/infusion-pumps-guidelines-and-pitfalls (secondary: review by regulator staff)
- Ch. 8 — ICU Medical. Hospira Plum 360 Specifications. Undated (file posted January 2017), reproduced by Soma Tech Intl. https://somatechnology.com/app/uploads/2017/01/ICU-Medical-Hospira-Plum-360-Specifications.pdf (manufacturer; read via a distributor's reproduction)
- Ch. 8 — US FDA, CDRH. Infusion Pumps Total Product Life Cycle: Guidance for Industry and FDA Staff. Document 1694, docket FDA-2010-D-0194. 2 December 2014 (draft 23 April 2010). https://www.fda.gov/media/78369/download
- Ch. 8 — US FDA. Update on Alert: Infusion Set Performance Issue from BD (letter MMS-25-5311, 11 September 2025; content current 29 September 2025). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/update-alert-infusion-set-performance-issue-bd ; recall record Z-2180-2025, https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=214860
- Ch. 8 — US FDA. Infusion Set Recall: BD and CareFusion 303, Inc. Remove BD Alaris Pump Infusion Sets (customer letter 19 August 2026; content current 5 October 2026). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-set-recall-bd-and-carefusion-303-inc-remove-bd-alaris-pump-infusion-sets ; recall record Z-3080-2026, https://api.fda.gov/device/recall.json?search=product_res_number:%22Z-3080-2026%22
- Ch. 9 — Foerster L., Peissig D. Challenges in testing the accuracy of infusion pump doses. ONdrugDelivery 160, 58-62 (2024). https://php.ondrugdelivery.com/wp-content/uploads/2024/05/160_2024_May_Injectables_Sartorius.pdf (authors include company staff: Sartorius and B. Braun)
- Ch. 9 — AAMI. AAMI TIR101:2021 (R2026) Fluid delivery performance testing for infusion pumps. ANSI Webstore listing. https://webstore.ansi.org/standards/aami/aamitir1012021r2026 (catalogue description; text not read)
- Ch. 9 — DPS (Albania) and ISME (Montenegro). Project record IEC 60601-2-24 ED3, iec:proj:130217, stage 30.60, 21 August 2026. https://dps.gov.al/en/project/show/iec:proj:130217 ; https://isme.me/en/project/show/iec:proj:130217 (secondary: national standards bodies' mirrors of IEC project data)
- Ch. 9 — Makobore P.N., Mulerwa M., Kagoda H., et al. Early feasibility study of an electronically controlled gravity feed infusion set for intravenous fluids in adults. Proc. 42nd CMBEC (year not shown). https://proceedings.cmbes.ca/index.php/proceedings/article/download/884/874/1753 (secondary for the standard's method; applies the 1998 edition)
- Ch. 9 — Khanna S., Zion J. Testing the Performance of Infusion Devices. Fluke Biomedical white paper 6001335A_EN. October 2013. https://www.flukebiomedical.com/sites/default/files/resources/ida-5_whitepaper_eng_a_w.pdf (manufacturer of test equipment)
- Ch. 9 — US FDA. Recognized Consensus Standards database: searches for 60601-2-24 (no record) and TIR101 (recognition 6-482, entered 30 May 2022). Accessed 11 October 2026. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/search.cfm
- Ch. 9 — US FDA. 510(k) Summary K242114, Plum Solo Precision IV Pump (ICU Medical). Cleared 2 April 2025. https://www.accessdata.fda.gov/cdrh_docs/pdf24/K242114.pdf (manufacturer data in FDA record)
- Ch. 10 — Par Health. ADRENALIN (epinephrine in sodium chloride) injection, prescribing information. Revised August 2023. DailyMed setid 61b0e2a2-71ed-43d6-b1a7-36d2dae651b5
- Ch. 10 — Baxter. Dopamine Hydrochloride and 5% Dextrose Injection, prescribing information. 11 November 2020. DailyMed setid cb97d4a0-89ed-407c-a763-209386b6f75c
- Ch. 10 — Cour M., Bénet T., Hernu R., Simon M., Baudry T., Vanhems P., Argaud L. Predictors of haemodynamic instability during the changeover of norepinephrine infusion pumps. Ann Intensive Care 6, 38 (2016). doi:10.1186/s13613-016-0139-3
- Ch. 10 — Lucchini A., Elli S., Burgazzi A., Malvestuto Grilli L., Pes C., Ferrari K., Fumagalli L., Fiorillo C., Giani M., Rezoagli E. Simulated haemodynamic parameters and different infusion set-up affect drug delivery during syringe pump change over: a bench-top study in a laboratory setting. Intensive Crit Care Nurs 86, 103861 (2025). doi:10.1016/j.iccn.2024.103861 (secondary: read through an IVTEAM summary of the abstract)
- Ch. 10 — [Authors not verified.] Minimising haemodynamic lability during changeover of syringes infusing norepinephrine in adult critical care patients: a multicentre randomised controlled trial. Br J Anaesth 125, 622-628 (2020). NCT02304939. https://serval.unil.ch/notice/serval:BIB_6B899620E90E (abstract only, from a university repository record)
- Ch. 10 — Genay S., Décaudin B., Scoccia S., Barthélémy C., Debaene B., Lebuffe G., Odou P. An in vitro evaluation of infusion methods using a syringe pump to improve noradrenaline administration. Acta Anaesthesiol Scand 59, 197-204 (2015). doi:10.1111/aas.12439 (devices supplied by Doran International, maker of the low dead-space set; four authors had travel reimbursed by the company)
- Ch. 10 — Zahid A., Raffaj D., Wignell A., Davies P. Continuous drug delivery is significantly affected by relative height changes between patient and syringe driver. J Patient Saf (online 12 March 2020). doi:10.1097/PTS.0000000000000645 (secondary: read through an IVTEAM summary of the abstract)
- Ch. 10 — Brotschi B., Grass B., Weiss M., Doell C., Bernet V. In-line filter included into the syringe infusion pump assembly reduces flow irregularities. Intensive Care Med 38, 518-522 (2012). (abstract only)
- Ch. 10 — Neff T.A., Fellmann C., Fuechslin R.M., Gerber A.C., Weiss M. The Panomat P-10 micro-volumetric infusion pump is suitable for continuous drug administration at minimal flow rates. Can J Anaesth (2002). doi:10.1007/BF03017900 (abstract only)
- Ch. 10 — Smith M., Dyson G., Rhodes H., et al. Minimising syringe pump delivery instability under G-force stress in ambulance transports. Intensive Care Med Paediatr Neonatal 3, 15 (2025). doi:10.1007/s44253-025-00072-7
- Ch. 11 — Timmerman A.M., et al. How physical infusion system parameters cause clinically relevant dose deviations after setpoint changes. Biomed Eng / Biomed Tech 60 (2015). doi:10.1515/bmt-2014-0139 (author list not verified)
- Ch. 11 — Lovich M.A., Doles J., Peterfreund R.A. The impact of carrier flow rate and infusion set dead-volume on the dynamics of intravenous drug delivery. Anesth Analg 100, 1048-1055 (2005). doi:10.1213/01.ANE.0000146942.51020.88 (abstract only)
- Ch. 11 — Konings M.K., Snijder R.A., Radermacher J.H., Timmerman A.M. Analytical method for calculation of deviations from intended dosages during multi-infusion. BioMed Eng OnLine (2017). doi:10.1186/s12938-016-0309-4
- Ch. 11 — Joe H.B., Moon B.K., Lee Y.J., Min S.K. Arrangements of the intravenous parallel infusions with anti-reflux valves decreasing occlusion alarm delay. Korean J Anesthesiol 66, 300-305 (2014). doi:10.4097/kjae.2014.66.4.300 (the anti-reflux valve's 5.3 mmHg opening pressure is reported without a stated source; only the anti-siphon valve's tolerable back pressure is attributed to its maker)
- Ch. 11 — Chua J., Ratnavadivel A. Comparison of flow pressures in different 3-way infusion devices: an in-vitro study. Patient Saf Surg 12, 19 (2018). doi:10.1186/s13037-018-0165-1 (run at a 500 mmHg limit; the 75 mmHg setting was not tested; the anti-siphon opening range is cited from earlier work)
- Ch. 11 — US FDA. Update on Alert: Infusion Pump Software Issue from Fresenius Kabi USA (letters from 10 January 2025; early alert 16 January 2025; update 5 March 2025). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/update-alert-infusion-pump-software-issue-fresenius-kabi-usa
- Ch. 12 — BD. BD Alaris neXus GP Volumetric Pump specification sheet. 0000CF04403 Issue 3. 2022. https://www.bd.com/documents/international/brochures/infusion/BD-Alaris-neXus-GP-Spec-Sheet-Issue-3-0000CF04403.pdf (manufacturer)
- Ch. 12 — US FDA. Medical device recall Z-0848-2026, Fresenius Kabi USA, Ivenix large-volume pump (Class II): downstream occlusion alarms at low flow when a check valve is added. openFDA enforcement records. https://api.fda.gov/device/enforcement.json?search=recalling_firm:%22Fresenius+Kabi+USA%22+AND+report_date:[20250101+TO+20261011]
- Ch. 13 — BD. BD Alaris System Air-In-Line Alarms tip sheet. MC190002457. 2020. https://bd.com/content/dam/bd-assets/na/medication-management-solutions/documents/tip-sheet/IF_Alaris-System-Air-In-Line-Alarms_TS_EN.pdf (manufacturer)
- Ch. 13 — Waterson J., Bedner A. Types and frequency of infusion pump alarms and infusion-interruption to infusion-recovery times for critical short half-life infusions: retrospective data analysis. JMIR Hum Factors 6, e14123 (2019). doi:10.2196/14123 (authors are BD staff; BD-funded)
- Ch. 13 — McCarthy C.J., Behravesh S., Naidu S.G., Oklu R. Air embolism: practical tips for prevention and treatment. J Clin Med 5, 93 (2016). doi:10.3390/jcm5110093 (review; its primary source for the lethal dose, Mirski et al., Anesthesiology 2007, was not opened)
- Ch. 13 — NSW Department of Health. Infusion pump safety. Safety newsletter Issue 5, SHPN (QCP) 030261. September 2003. https://health.nsw.gov.au/sabs/Publications/safety-ad-5.pdf
- Ch. 13 — ECRI. Advancing patient safety through better designs or processes: Top 10 Health Tech Hazards, part 2. Blog, undated (2023 list). https://home.ecri.org/blogs/ecri-blog/advancing-patient-safety-through-better-designs-or-processes-top-10-health-tech-hazards-part-2
- Ch. 13 — BD. Microbore extension set, bore 1 mm, PE-lined PVC, 250 cm, PB-G40725 (product page). Accessed 11 October 2026. https://www.bd.com/en-uk/products-and-solutions/products/product-page.pb-g40725 (manufacturer)
- Ch. 14 — TechNation Magazine. ECRI Update: A top hazard - deadly infusion errors persist, but simple safety steps can prevent harm. 1 February 2017. https://1technation.com/?p=22718 (secondary: ECRI column in a trade magazine)
- Ch. 14 — NIST. Chemistry WebBook, SRD 69: thermophysical properties of water (viscosity at 20 °C, used in the Poiseuille estimate). https://webbook.nist.gov/cgi/fluid.cgi?ID=C7732185
- Ch. 14 — Baxter Healthcare. Norepinephrine Bitartrate in Dextrose Injection / in Sodium Chloride Injection, prescribing information. NDA 214313 (s008). Revised February 2026. https://www.accessdata.fda.gov/drugsatfda_docs/label/2026/214313s008lbl.pdf (FDA-approved label)
- Ch. 14 — Relias Media. Joint Commission warns about infusion pumps. c. 2001. https://reliasmedia.com/articles/71836-joint-commission-warns-about-infusion-pumps (secondary; reports the Sentinel Event Alert of 30 November 2000, which was not opened)
- Ch. 14 — Relias Media. Joint Commission sets 2003 patient safety goals. Undated. https://reliasmedia.com/articles/109663-joint-commission-sets-2003-patient-safety-goals (secondary; quotes goal 5, free-flow protection on all general-use and PCA intravenous infusion pumps; the same wording appears in an ISMP Canada slide, https://www.ismp-canada.org/Jul17I-Christine/tsld004.htm)
- Ch. 14 — US FDA. 510(k) K031361, CADD High-Volume Administration Set with FlowStop (Deltec Inc.). Cleared 23 May 2003. https://www.accessdata.fda.gov/cdrh_docs/pdf3/K031361.pdf
- Ch. 14 — US FDA. Medical device recall Z-1231-2025, BD Alaris Pump Module 8100 directions for use (Class II; initiated 23 January 2025). openFDA enforcement. https://api.fda.gov/device/enforcement.json?search=product_description:Alaris+AND+report_date:[20250101+TO+20261011]
- Ch. 14 — US FDA. Medical device recall Z-0430-2026, BD Alaris Pump Module 8100 bezel assembly (Class I; initiated 17 October 2025). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=216289
- Ch. 15 — IEC. IEC 60601-1-8:2006+AMD1:2012+AMD2:2020 CSV. Medical electrical equipment, Part 1-8: General requirements for basic safety and essential performance, Collateral standard: alarm systems. Edition 2.2. 23 July 2020. https://webstore.iec.ch/en/publication/67388
- Ch. 15 — The Joint Commission. R3 Report Issue 5: Alarm system safety. 11 December 2013. https://digitalassets.jointcommission.org/api/public/content/aa15f8d34283484d9947f6802aa14122?v=4e9c34ef
- Ch. 15 — The Joint Commission. Sentinel Event Alert Issue 50: Medical device alarm safety in hospitals. 8 April 2013. https://digitalassets.jointcommission.org/api/public/content/f65e5c9df2b94000a99445e0a7877007
- Ch. 15 — The Joint Commission. National Performance Goals Effective January 2026 for the Hospital Program (NPG.01.05.01, clinical alarm systems). 2025 (report generated 26 September 2025). https://digitalassets.jointcommission.org/api/public/content/9ca80055182b4274842a5780a94f2c82
- Ch. 15 — LAMMICO. News item on the Joint Commission's National Performance Goals for 2026. Accessed 11 October 2026. https://www.lammico.com/article/NPG-2026 (secondary: the new chapter replaces the National Patient Safety Goals on 1 January 2026)
- Ch. 15 — Becker's Hospital Review. ECRI Institute lists Top 10 Health Technology Hazards for 2012. 9 November 2011. https://www.beckershospitalreview.com/healthcare-information-technology/ecri-institute-lists-top-10-health-technology-hazards-for-2012/ (secondary)
- Ch. 15 — DAIC. ECRI Institute releases Top 10 Health Technology Hazards report 2014. 20 November 2013. https://www.dicardiology.com/article/ecri-institute-releases-top-10-health-technology-hazards-report-2014 (secondary)
- Ch. 15 — US FDA. Medical device recall Z-1359-2020, BD Alaris System PC units and modules (Class I; initiated 4 February 2020). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=178655
- Ch. 15 — US FDA. Medical device recall Z-0885-2026, Fresenius Kabi Ivenix large-volume pump software 5.10.1 and earlier (Class I; initiated 14 November 2025). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=217423 ; FDA. Infusion Pump Software Correction: Fresenius Kabi Issues Correction for Ivenix Large Volume Pump Software (content current 25 February 2026). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-pump-software-correction-fresenius-kabi-issues-correction-ivenix-large-volume-pump-software
- Ch. 15 — US FDA. Medical device recall Z-1668-2025, Smiths Medical (ICU Medical) CADD-Solis VIP ambulatory infusion pump, false upstream occlusion alarm (initiated 10 April 2025). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=213269
- Ch. 16 — Institute for Safe Medication Practices. ISMP List of High-Alert Medications in Acute Care Settings. 2018 (date as cited on the page). https://www.ismp.org/recommendations/high-alert-medications-acute-list
- Ch. 16 — ISMP Canada. Fluorouracil Incident Root Cause Analysis Report. Final 30 April 2007; posted 22 May 2007. https://www.ismp-canada.org/download/reports/FluorouracilIncidentMay2007.pdf
- Ch. 16 — Lyons I., Furniss D., Blandford A., et al. Errors and discrepancies in the administration of intravenous infusions: a mixed methods multihospital observational study. BMJ Qual Saf 27, 892-901 (2018). doi:10.1136/bmjqs-2017-007476
- Ch. 16 — Husch M., Sullivan C., Rooney D., et al. Insights from the sharp end of intravenous medication errors: implications for infusion pump technology. Qual Saf Health Care 14, 80-86 (2005). doi:10.1136/qshc.2004.011957 (abstract only; volume, pages and DOI to be confirmed)
- Ch. 16 — Schnock K.O., Dykes P.C., Albert J., et al. The frequency of intravenous medication administration errors related to smart infusion pumps: a multihospital observational study. BMJ Qual Saf 26, 131-140 (2017). doi:10.1136/bmjqs-2015-004465 (authors include company staff: two BD employees; funded by the CareFusion Foundation and AAMI; abstract only)
- Ch. 17 — Thimbleby H., Cairns P. Reducing number entry errors: solving a widespread, serious problem. J R Soc Interface 7, 1429-1439 (2010). doi:10.1098/rsif.2010.0112
- Ch. 17 — Wiseman S.E.M., Cox A.L., Brumby D.P. Designing devices with the task in mind: which numbers are really used in hospitals? Hum Factors 55, 61-74 (2013). doi:10.1177/0018720812471988 (abstract only)
- Ch. 17 — Wiseman S., Borghouts J., Grgic D., Brumby D.P., Cox A.L. The effect of interface type on visual error checking behavior. Proc Hum Factors Ergon Soc Annu Meet 59, 436-439 (2015). doi:10.1177/1541931215591092
- Ch. 17 — Oladimeji P., Thimbleby H., Cox A. Number entry interfaces and their effects on error detection. INTERACT 2011, LNCS 6949 (2011). (secondary: read through the summary in Wiseman et al. 2015; original not opened)
- Ch. 17 — Oladimeji P. Designing number entry user interfaces: a focus on interactive medical devices. PhD thesis, Swansea University (2014). https://cronfa.swansea.ac.uk/Record/cronfa42894 (secondary route for the 2013 checksum study by Wiseman and colleagues; thesis read only in part)
- Ch. 17 — US FDA. Medical Device Recall Z-2224-2026, Fresenius Kabi Ivenix LVP-0004 touchscreen input cable (Class I). Initiated 6 May 2026; posted 29 May 2026. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=220255
- Ch. 18 — US FDA, CDRH. Content of Human Factors Information in Medical Device Marketing Submissions. Final guidance, docket FDA-2015-D-4599. 29 May 2026 (draft 9 December 2022). https://www.fda.gov/media/163694/download ; Federal Register notice 91 FR 32061, document 2026-10734. https://www.federalregister.gov/d/2026-10734
- Ch. 18 — International Electrotechnical Commission; ISO. IEC 62366-1:2015 Medical devices, Part 1: Application of usability engineering to medical devices. Edition 1, 25 February 2015; Amendment 1:2020; consolidated edition 1.1, 17 June 2020. https://www.iso.org/standard/63179.html ; https://webstore.iec.ch/en/publication/67220
- Ch. 18 — US FDA, CDRH. Applying Human Factors and Usability Engineering to Medical Devices. Final guidance, docket FDA-2011-D-0469. Issued 3 February 2016; revised 3 August 2026. https://www.fda.gov/media/80481/download
- Ch. 18 — European Commission. Summary list of harmonised standards, Regulation (EU) 2017/745 (generated 17 June 2026). Via https://single-market-economy.ec.europa.eu/single-market/european-standards/harmonised-standards/medical-devices_en
- Ch. 19 — The Joint Commission. Sentinel Event Alert Issue 53: Managing risk during transition to new ISO tubing connector standards. 20 August 2014. https://digitalassets.jointcommission.org/api/public/content/df1ada467ed147518c77827f35acd1ea
- Ch. 19 — The Joint Commission. Sentinel Event Alert Issue 36: Tubing misconnections, a persistent and potentially deadly occurrence. 3 April 2006. (not opened; content read through Relias Media and AHRQ PSNet, secondary)
- Ch. 19 — Relias Media. Alert issued on tubing, catheter misconnections. 2006. https://reliasmedia.com/articles/125231-alert-issued-on-tubing-catheter-misconnections (secondary)
- Ch. 19 — Pennsylvania Patient Safety Authority. Tubing misconnections: making the connection to patient safety. Pa Patient Saf Advis 7, 41-45 (June 2010). https://digirepo.nlm.nih.gov/pdfdownload/nlm:nlmuid-101546438-pdf
- Ch. 19 — US FDA, CDRH. Letter to manufacturers of enteral feeding tubes on tubing misconnections. 9 July 2010. https://fda.gov/media/78921/download
- Ch. 19 — US FDA. FDA Activities: Medical Device Connectors. Content current as of 6 September 2018. https://www.fda.gov/medical-devices/medical-device-connectors/fda-activities-medical-device-connectors
- Ch. 19 — ISO. ISO 80369-1:2025 Small-bore connectors for liquids and gases in healthcare applications, Part 1: General requirements. Edition 3, 10 October 2025. https://www.iso.org/standard/82071.html
- Ch. 19 — ISO. ISO 80369-7:2021 Small-bore connectors for liquids and gases in healthcare applications, Part 7: Connectors for intravascular or hypodermic applications. Edition 2, 4 May 2021. https://www.iso.org/standard/79173.html
- Ch. 19 — ISO. ISO 80369-3:2016 Small-bore connectors for liquids and gases in healthcare applications, Part 3: Connectors for enteral applications. Edition 1, July 2016; Amendment 1:2019; confirmed 2023. https://www.iso.org/standard/50731.html
- Ch. 19 — US FDA, CDRH. Letter to manufacturers of enteral feeding tubes, health care professionals, and hospital purchasing departments and distributors. 7 September 2018. https://www.fda.gov/media/115846/download
- Ch. 19 — GEDSA. GEDSA members end production of legacy enteral connectors. Press release, Business Wire, 12 July 2021. https://www.businesswire.com/news/home/20210712005679/en/GEDSA-Members-End-Production-of-Legacy-Enteral-Connectors (trade association)
- Ch. 19 — ECRI. Examining the greatest health technology threats of 2026. 26 January 2026. https://home.ecri.org/blogs/ecri-news/examining-the-greatest-health-technology-threats-of-2026
- Ch. 19 — US FDA. Product Classification: LZH, Pump, Infusion, Enteral (21 CFR 880.5725, Class II). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfPCD/classification.cfm?ID=LZH
- Ch. 19 — US FDA. openFDA 510(k) records, product code LZH (34 records; K253558, Luminoah FLOW Enteral Nutrition System, 20 April 2026). Accessed 11 October 2026. https://api.fda.gov/device/510k.json?search=product_code:LZH&sort=decision_date:desc&limit=40
- Ch. 19 — Cardinal Health. Kangaroo OMNI enteral feeding pump specifications, as reproduced by DiaMedical USA. https://www.diamedicalusa.com/Kangaroo-OMNI-Enteral-Feeding-Pump (manufacturer's figures via a reseller)
- Ch. 19 — Deken A., Davis B., Giles A., Koelper C., McMichael D., Phillips P. Dose accuracy: performance testing of enteral, oral, ENFit and ENFit LDT syringes. GEDSA poster, about 2020, hosted by Avanos. https://avanosmedicaldevices.com/wp-content/uploads/2020/11/GEDSA-ENFit-LDT-Research-Poster.pdf (trade association and manufacturer-hosted; affiliations and funding not stated)
- Ch. 20 — Alemzadeh H., Iyer R.K., Kalbarczyk Z., Raman J. Analysis of Safety-Critical Computer Failures in Medical Devices. University of Illinois at Urbana-Champaign, Coordinated Science Laboratory report UILU-ENG-13-2203 / CRHC-13-03 (2013). https://www.ideals.illinois.edu/items/100651 (report read; the journal version, IEEE Security & Privacy 11(4), 14-26 (2013), was not read)
- Ch. 20 — US Food and Drug Administration. Infusion Pump Improvement Initiative (web page; letter to manufacturers of 23 April 2010 offering a voluntary review of pump software). Content current as of 13 December 2017. https://www.fda.gov/medical-devices/infusion-pumps/infusion-pump-improvement-initiative
- Ch. 20 — Ganssle J. A Guide to Debouncing, Parts 1 and 2. The Ganssle Group, August 2004, revised 4 March 2014. http://www.ganssle.com/debouncing.htm ; http://www.ganssle.com/debouncing-pt2.htm (measurements of generic switches, not pump keypads)
- Ch. 20 — Gao X., Wen Q., Duan X., et al. A hazard analysis of class I recalls of infusion pumps. JMIR Hum Factors 6(2), e10366 (2019). doi:10.2196/10366
- Ch. 20 — US Food and Drug Administration. Fresenius Kabi USA, LLC Recalls Ivenix Infusion Pump LVP Software for Anomalies (software 5.8.0; letter of 7 March 2024). https://www.fda.gov/medical-devices/medical-device-recalls/fresenius-kabi-usa-llc-recalls-ivenix-infusion-pump-lvp-software-anomalies-have-potential-cause
- Ch. 20 — US Food and Drug Administration. Infusion Pump Software Correction: Fresenius Kabi USA, LLC Issues Correction for Ivenix Infusion System LVP Software due to Multiple Anomalies (software 5.9.1 and earlier; letter of 30 August 2024; posted 1 October 2024). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-pump-software-correction-fresenius-kabi-usa-llc-issues-correction-ivenix-infusion-system
- Ch. 20 — US Food and Drug Administration. Medical Device Recall Z-2223-2026 (Fresenius Kabi Ivenix LVP software 5.10.2). Initiated 6 May 2026; posted 3 June 2026. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?id=220229 ; and Infusion Pump Correction: Fresenius Kabi Issues Correction for Ivenix Large Volume Infusion Pump (7 July 2026; gives the firm's letter as 30 April 2026). https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-pump-correction-fresenius-kabi-issues-correction-ivenix-large-volume-infusion-pump
- Ch. 20 — Arney D., Jetley R., Jones P., Lee I., Sokolsky O. Generic Infusion Pump Hazard Analysis and Safety Requirements, Version 1.0. University of Pennsylvania Technical Report MS-CIS-08-31. 6 February 2009. https://repository.upenn.edu/cis_reports/893 (repository abstract only)
- Ch. 20 — University of Pennsylvania, PRECISE Center. Generic PCA Infusion Pump Reference Implementation (web page naming FDA as collaborator). Undated. https://rtg.cis.upenn.edu/medical/gpca/gpca.html
- Ch. 20 — Lee I., et al., with Jones P., Jetley R., Zhang Y. (FDA). Toward the model-based development of a GPCA reference implementation. Slides, Annapolis, 2 May 2011. https://sos-vo.org/system/files/sos_files/Toward_the_model-based_development_of_a_GPCA_reference_implementation.pdf (the total of 97 requirements is the sum of the slides' category counts)
- Ch. 20 — Johner Institute. Functional safety (article quoting DIN EN 60601-1:2022-11, definitions 3.116 single fault condition and 3.117 single fault safe). Undated; accessed 11 October 2026. https://johner-institute.com/articles/risk-management-iso-14971/functional-safety/ (consultancy; secondary for the standard's wording)
- Ch. 20 — Intertek. Single Fault Condition, Clause 4.7 of Third Edition IEC 60601-1, Part 1. 25 April 2011. https://w3inte.intertek.ch/blog/2011/04-25-single-fault-condition-iec-60601-1-part1/ (test laboratory; paraphrase of clause 4.7)
- Ch. 20 — BD. BodyGuard T Syringe Pump Quick Reference Guide, QRG999-103BDEN Rev. 03 (February 2020), hosted by NHS Scotland Right Decisions. https://www.rightdecisions.scot.nhs.uk/media/5wththw0/bodyguard-t-qrg-quick-reference-guide.pdf (manufacturer)
- Ch. 21 — Agency for Healthcare Research and Quality. Research Activities, April 2005: summary of Rothschild et al., smart infusion pumps in critical care (AHRQ grant HS11534). https://archive.ahrq.gov/research/apr05/0405RA22.htm (secondary: the funder's summary, the only account of the trial read)
- Ch. 21 — Rothschild J.M., Keohane C.A., Cook E.F., et al. A controlled trial of smart infusion pumps to improve medication safety in critically ill patients. Crit Care Med 33(3), 533-540 (2005). doi:10.1097/01.ccm.0000155912.73313.cd (not read; known from the AHRQ summary and from AHRQ PSNet, https://psnet.ahrq.gov/issue/controlled-trial-smart-infusion-pumps-improve-medication-safety-critically-ill-patients)
- Ch. 21 — Ohashi K., Dalleur O., Dykes P.C., Bates D.W. Benefits and risks of using smart pumps to reduce medication error rates: a systematic review. Drug Saf 37(12), 1011-1020 (2014). doi:10.1007/s40264-014-0232-1 (abstract only)
- Ch. 21 — Byrne S., Do Q.M., Gretzinger D., Kresta P. Are "smart pumps" preventing medication errors? Proceedings of the Canadian Medical and Biological Engineering Society (c. 2006; year not printed). https://proceedings.cmbes.ca/index.php/proceedings/article/download/424/418/848
- Ch. 21 — Kastrup M., Balzer F., Volk T., et al. Analysis of event logs from syringe pumps. Drug Saf 35, 563-574 (2012). doi:10.2165/11597350-000000000-00000 (abstract and funding statement read; sponsored by an institutional grant from CareFusion (Alaris Asena CC))
- Ch. 21 — AAMI Foundation. Quick Guide: What You Need to Know About Smart Pump Compliance and Drug Libraries. 2017. https://www.aami.org/docs/default-source/foundation/infusion/infusion-therapy-quick-guide3.pdf
- Ch. 21 — Marwitz K.K., Giuliano K.K., Su W.-T., Degnan D., Zink R.J., DeLaurentis P. High-alert medication administration and intravenous smart pumps: a descriptive analysis of clinical practice. Res Social Adm Pharm 15(7), 889-894 (2019). doi:10.1016/j.sapharm.2019.02.007 (abstract only; funding and disclosures not seen)
- Ch. 22 — Biltoft J., Finneman L. Clinical and financial effects of smart pump-electronic medical record interoperability at a hospital in a regional health system. Am J Health-Syst Pharm 75(14), 1064-1068 (2018). doi:10.2146/ajhp161058 (abstract only)
- Ch. 22 — VanHorn T., Harris J., Mayes S., Infanti L.M., Kennedy A. Evaluation of the effect of smart pump interoperability on infusion errors in the pediatric hospital setting. J Pediatr Pharmacol Ther 29(3), 323-330 (2024). doi:10.5863/1551-6776-29.3.323 (authors declare no conflicts)
- Ch. 22 — Giuliano K.K., Mahuren R.S., Balyeat J. [Descriptive report on intravenous smart pump interoperability in an 11-hospital health system; title not printed in the copy read]. Am J Health-Syst Pharm 81(1), e30-e36 (2024). doi:10.1093/ajhp/zxad245 (authors include recipients of ICU Medical research grants; an ICU Medical pharmacist supported the program)
- Ch. 22 — US Food and Drug Administration. Recall Z-1645-2026, BD Alaris labeling without the required TLS version for secure Wi-Fi; Class II; initiated 11 February 2026; 1,025,567 units. openFDA device enforcement record (same query as above).
- Ch. 22 — Cybersecurity and Infrastructure Security Agency (ICS-CERT). Hospira Symbiq Infusion System Vulnerability. ICSA-15-174-01. 23 June 2015. https://www.cisa.gov/news-events/ics-advisories/icsa-15-174-01
- Ch. 22 — US Food and Drug Administration. Cybersecurity Vulnerabilities of Hospira Symbiq Infusion System: FDA Safety Communication. 31 July 2015. https://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-hospira-symbiq-infusion-system-fda-safety-communication (not opened; its wording is taken from trade-press reports)
- Ch. 22 — Newmarker C. FDA: Stop using infusion pump vulnerable to hacking. MDDI Online (31 July 2015, updated 3 August 2015). https://www.mddionline.com/regulatory-quality/fda-stop-using-infusion-pump-vulnerable-to-hacking (secondary)
- Ch. 22 — CNBC. Citing hacking risk, FDA says Hospira pump shouldn't be used. 3 August 2015. https://www.cnbc.com/2015/08/03/citing-hacking-risk-fda-says-hospira-pump-shouldnt-be-used.html (secondary; source of the "first time" description, which FDA's own text was not checked for)
- Ch. 22 — Heiland D. Baxter SIGMA Spectrum infusion pumps: multiple vulnerabilities (FIXED). Rapid7 blog. 8 September 2022. https://www.rapid7.com/blog/post/2022/09/08/baxter-sigma-spectrum-infusion-pumps-multiple-vulnerabilities-fixed/ (the discovering researcher's account)
- Ch. 22 — US Congress. Consolidated Appropriations Act, 2023, Pub. L. 117-328, div. FF, title III, sec. 3305; Federal Food, Drug, and Cosmetic Act sec. 524B, 21 U.S.C. 360n-2. 29 December 2022. https://www.law.cornell.edu/uscode/text/21/360n-2 (read via Cornell LII)
- Ch. 22 — US Food and Drug Administration. Cybersecurity in Medical Devices Frequently Asked Questions. Content current as of 26 June 2025. https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs
- Ch. 22 — US Food and Drug Administration. Cybersecurity (hub page listing Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, final guidance of 27 June 2025). Content current as of 6 July 2026. https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity (the guidance page itself was not opened)
- Ch. 23 — INCOSE (International Council on Systems Engineering). System and SE definitions. Page dated 2025; accessed 11 October 2026. https://www.incose.org/about-systems-engineering/system-and-se-definitions
- Ch. 23 — ISO/IEC/IEEE. ISO/IEC/IEEE 15288:2023, Systems and software engineering: System life cycle processes. Edition 2, 16 May 2023 (replaces the 2015 edition). Catalogue page. https://www.iso.org/standard/81702.html
- Ch. 23 — US FDA, CDRH. Design Considerations and Premarket Submission Recommendations for Interoperable Medical Devices: Guidance for Industry and Food and Drug Administration Staff. Final, 6 September 2017 (draft 26 January 2016; docket number not confirmed). Read in the HHS guidance repository copy: https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/FDA/Design-Considerations-and-Pre-market-Submission-Recommendations-for-Interoperable-Medical-Devices---Guidance-for-Industry-and-Food-and-Drug-Administration-Staff.pdf ; FDA page (not opened): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/design-considerations-and-pre-market-submission-recommendations-interoperable-medical-devices
- Ch. 23 — US FDA. 510(k) K211218, BD Alaris System with Guardrails Suite MX v12. Decision 21 July 2023. https://www.accessdata.fda.gov/cdrh_docs/pdf21/K211218.pdf
- Ch. 23 — IHE International. IHE Devices (DEV) Technical Framework, Volume 1: Profiles, Revision 10.0, Final Text, 4 November 2024, section 4, Point-of-Care Infusion Verification (PIV). https://www.ihe.net/uploadedFiles/Documents/PCD/IHE_PCD_TF_Vol1.pdf
- Ch. 23 — US FDA. Recognized Consensus Standards database, ANSI/AAMI/UL 2800-1:2022 Standard for Medical Device Interoperability (recognition 13-121), 2800-1-1:2022 (13-125), 2800-1-2:2022 Interoperable Item Development Life Cycle (13-126) and 2800-1-3:2022 Interoperable Item Integration Life Cycle (13-127), all entered 19 December 2022. Accessed 11 October 2026. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/results.cfm?start_search=1&referencenumber=2800
- Ch. 23 — DeLaurentis P., Hsu K.Y., Bitan Y. Prevalence of wireless smart-pump drug library update delays. Am J Health-Syst Pharm 75(15), 1140-1144 (2018). (abstract only)
- Ch. 24 — SIGMA International. SIGMA Spectrum Infusion Pump Service Manual. P/N 41019 Rev W. August 2009 (manufacturer; read in a copy hosted by bioclinicalservices.com.au). https://www.bioclinicalservices.com.au/sigma/sigma-infusion-pumps/spectrum-service-manual-rev-w-august-2009
- Ch. 24 — Brigham and Women's Hospital. Get pumped: Brigham completes infusion pump transition. Brigham Bulletin. 23 May 2019. https://bwhbulletin.org/2019/05/23/get-pumped-brigham-completes-infusion-pump-transition/
- Ch. 24 — Casagrande Cesconetto A., Rose E. Management of infusion pumps in the Lower Mainland of British Columbia. Proceedings of the 44th CMBES Conference (year not printed). https://proceedings.cmbes.ca/index.php/proceedings/article/download/968/877/2028
- Ch. 24 — CareFusion (BD). Alaris GP Volumetric Pump Technical Service Manual. 1000SM00013 Issue 11. November 2014 (manufacturer; preview pages of a copy hosted by bioclinicalservices.com.au). https://www.bioclinicalservices.com.au/alaris/clinical/alaris-gp-technical-service-manual-issue-11-nov-2014
- Ch. 24 — Centers for Medicare & Medicaid Services. Hospital Equipment Maintenance Requirements. S&C: 14-07-Hospital. 20 December 2013. https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/SurveyCertificationGenInfo/Downloads/Survey-and-Cert-Letter-14-07.pdf
- Ch. 24 — Khalaf A.B., Hamam Y., Alayli Y., Djouani K. The effect of maintenance on the survival of medical equipment. J Eng Des Technol 11, 142-157 (2013). doi:10.1108/JEDT-06-2011-0033 (abstract only)
- Ch. 24 — B. Braun Melsungen AG. Statement: Battery life for Space pumps (service bulletin). 30 October 2013 (manufacturer; copy hosted by bioclinicalservices.com.au). https://www.bioclinicalservices.com.au/b-braun-medical/clinical/service-bulletin-statement-battery-life-for-space-pumps
- Ch. 24 — ICU Medical. Updated Urgent Medical Device Correction: Batteries Supplied by CSB and Used with Plum Infusion Systems. 7 May 2024 (manufacturer). https://www.icumed.com/media/wxvlrylg/ma2303-01_e-customer-letter.pdf
- Ch. 24 — US FDA. Infusion Pump Battery Correction: ICU Medical Updates Instructions for Use Regarding Batteries for Plum 360 and Plum A+ Infusion Systems. 20 August 2024. https://www.fda.gov/medical-devices/medical-device-recalls/infusion-pump-battery-correction-icu-medical-updates-instructions-use-regarding-batteries-plum-360
- Ch. 24 — US FDA (company announcement). BD Announces FDA Classifications for August 4th Recalls of BD Alaris System Hardware. 21 September 2020. https://www.fda.gov/safety/recalls-market-withdrawals-safety-alerts/bd-announces-fda-classifications-august-4th-recalls-bd-alaristm-system-hardware-keypads-incorrect
- Ch. 24 — US FDA. Medical Device Recall Z-1309-2021 (BD Alaris Pump Module 8100 keypad). Initiated 3 March 2021. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRes/res.cfm?id=185943
- Ch. 24 — Hsu K.Y., DeLaurentis P., Yih Y., Bitan Y. Tracking the progress of wireless infusion pump drug library updates: a data-driven analysis of pump update delays. J Med Syst 43, 75 (2019). doi:10.1007/s10916-019-1189-5 (abstract only)
- Ch. 24 — Baxter International Inc. Form 10-K for fiscal year 2010, note R13. Filed 23 February 2011 (manufacturer SEC filing). https://www.sec.gov/Archives/edgar/data/10456/000095012311017190/R13.xml
- Ch. 24 — Baxter International Inc. Form 10-K for fiscal year 2012. Filed 21 February 2013 (manufacturer SEC filing). https://www.sec.gov/Archives/edgar/data/10456/000119312513069609/d410594d10k.htm
- Ch. 24 — BD. BD Provides Update on Feb. 4, 2020 Voluntary Recall of the BD Alaris System PC Units and Modules (manufacturer; posted by FDA 10 March 2020). https://www.fda.gov/safety/recalls-market-withdrawals-safety-alerts/bd-provides-update-feb-4-2020-voluntary-recall-bd-alaristm-system-pc-units-and-modules
- Ch. 24 — Becton, Dickinson and Co. Form 10-K for fiscal year 2020. Filed 25 November 2020 (manufacturer SEC filing; read in part). https://www.sec.gov/Archives/edgar/data/10795/000001079520000055/bdx-20200930.htm
- Ch. 24 — BD. BD Receives FDA 510(k) Clearance for Updated BD Alaris Infusion System. 21 July 2023 (manufacturer). https://news.bd.com/2023-07-21-BD-Receives-FDA-510-k-Clearance-for-Updated-BD-Alaris-TM-Infusion-System
- Ch. 25 — AAMI. Infusing Patients Safely: Priority Issues From the AAMI/FDA Infusion Device Summit. 2010 (summit held 5-6 October 2010; text read to about 93 percent of its length). https://www.aami.org/docs/default-source/reports/aami_fda_summit_report.pdf
- Ch. 25 — US FDA. Manufacturer and User Facility Device Experience Database (MAUDE). Accessed 11 October 2026. https://www.fda.gov/medical-devices/mandatory-reporting-requirements-manufacturers-importers-and-device-user-facilities/manufacturer-and-user-facility-device-experience-database-maude
- Ch. 26 — US FDA. 510(k) K210073 and K210074, Agilia VP and Agilia SP infusion pumps (Fresenius Kabi). Decision 1 March 2022. openFDA 510(k) database. https://api.fda.gov/device/510k.json?search=k_number:K210073
- Ch. 26 — Fierce Biotech. Baxter cuts financial forecast while pausing infusion pump shipments. 1 August 2025. https://www.fiercebiotech.com/medtech/baxter-cuts-financial-forecast-while-pausing-infusion-pump-shipments (secondary: date the pause was first disclosed)
- Ch. 26 — US FDA. openFDA 510(k) data, product code FRN, decisions 1 January 2025 to 11 October 2026 (10 records). Accessed 11 October 2026. https://api.fda.gov/device/510k.json?search=product_code:FRN+AND+decision_date:[2025-01-01+TO+2026-10-11]&sort=decision_date:desc
- Ch. 26 — Baxter International Inc. Form 10-Q for the quarter ended 30 June 2026. https://www.sec.gov/Archives/edgar/data/0000010456/000162828026051118/bax-20260630.htm (manufacturer)
- Ch. 26 — ICU Medical. ICU Medical completes acquisition of Smiths Medical. Press release, 6 January 2022. https://www.icumed.com/about-us/news/2022/icu-medical-completes-acquisition-of-smiths-medical/ (manufacturer)
- Ch. 26 — US FDA. Warning letter to ICU Medical, Inc., CMS #702535. 4 April 2025. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/icu-medical-702535-04042025
- Ch. 26 — ICU Medical, Inc. Form 10-K for fiscal year 2025. https://www.sec.gov/Archives/edgar/data/883984/000088398426000008/icui-20251231.htm (manufacturer)
- Ch. 26 — ICU Medical. ICU Medical introduces its new category of infusion devices with FDA clearances of Plum Solo and Plum Duo precision IV pumps. Press release, 7 April 2025. https://www.icumed.com/about-us/news/2025/icu-medical-introduces-its-new-category-of-infusion-devices-with-fda-clearances-of-plum-solo-and-plum-duo-precision-iv-pumps/ (manufacturer)
- Ch. 26 — B. Braun. B. Braun receives FDA clearance for SpaceStation MRI. Press release, 27 August 2020, via BioSpace. https://www.biospace.com/b-braun-receives-fda-clearance-for-spacestation-mri-allows-space-infusion-pumps-to-continuously-deliver-medications-within-the-mri-suite (manufacturer)
- Ch. 26 — US FDA. openFDA device enforcement data, Novum IQ, report dates 2025 to 11 October 2026 (Z-1767-2025, Z-2332-2025, Z-2333-2025, Z-2334-2025). Accessed 11 October 2026. https://api.fda.gov/device/enforcement.json?search=product_description:Novum+AND+report_date:[20250101+TO+20261011]
- Ch. 26 — Moog. Medical pump systems (CURLIN 6000 and 8000; Infinity enteral pumps). Accessed 11 October 2026. https://moog.com/products/medical-pump-systems (manufacturer)
- Ch. 26 — Eitan Medical. Home page and news items, 16 April to 16 June 2026 (Sapphire; Avoset launch). Accessed 11 October 2026. https://www.eitanmedical.com/ (manufacturer)
- Ch. 26 — US FDA. openFDA 510(k) data, product code MEB, elastomeric infusion pumps (88 records). Accessed 11 October 2026. https://api.fda.gov/device/510k.json?search=product_code:MEB&sort=decision_date:desc&limit=40
- Ch. 26 — US FDA. openFDA 510(k) data, product code QFG, interoperable insulin pumps (29 records, 2019 to 2026). Accessed 11 October 2026. https://api.fda.gov/device/510k.json?search=product_code:QFG&sort=decision_date:desc&limit=40
- Ch. 26 — US FDA. Medical device recall Z-0035-2026, BD Alaris infusion sets, Class I, initiated 11 September 2025 (distribution list includes India). CDRH recall database. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm?id=215834
- Ch. 26 — AKAS Infusions. About us. Accessed 11 October 2026. https://www.akasinfusions.com/about-us/ (manufacturer)
- Ch. 26 — Skanray Technologies. floSKAN 3000. Accessed 11 October 2026. https://world.skanray.com/product/floskan-3000-2/ (manufacturer)
- Ch. 26 — BPL Medical Technologies. Home page. Accessed 11 October 2026. https://www.bplmedicaltechnologies.com/ (manufacturer)
- Ch. 26 — Narang Medical. Infusion pump. Accessed 11 October 2026. https://www.narang.com/icu-equipments/infusion-pump/index.php (manufacturer)
- Ch. 26 — Poly Medicure. Home page. Accessed 11 October 2026 (URL not recorded in the research ledger; re-check). (manufacturer)
- Ch. 26 — BioSpectrum India. Terumo India launches Terufusion advanced infusion systems. 26 August 2025. https://www.biospectrumindia.com/news/93/26593/terumo-india-launches-terufusion-advanced-infusion-systems.html (secondary, reporting a company release)
- Ch. 26 — IMARC Group. India syringe pumps market (public summary). Accessed 11 October 2026. https://www.imarcgroup.com/india-syringe-pumps-market (market-research estimate)
- Ch. 27 — CDSCO. Frequently asked questions on Medical Devices Rules, 2017. CDSCO/FAQ/MD/01/2024 (FAQ 25 to 27). https://cdsco.gov.in/opencms/export/sites/CDSCO_WEB/Pdf-documents/MDFAQ1324.pdf
- Ch. 27 — IEC. IEC 60601-1:2005+AMD1:2012+AMD2:2020 CSV, Medical electrical equipment, Part 1: General requirements for basic safety and essential performance. Edition 3.2. 20 August 2020. https://webstore.iec.ch/en/publication/67497
- Ch. 27 — IEC TC 62. Standards suitable to be used for the development of AI/ML standards in the medical area. 62/502B/INF. 3 July 2026. https://assets.iec.ch/public/tc62/62-502B-INF.pdf
- Ch. 27 — IEC. IEC 60601-1:2026 SER, series bundle (collateral editions listed). 10 July 2026. https://webstore.iec.ch/en/publication/2603
- Ch. 27 — IEC. IEC 60601-1-2:2014/AMD1:2020, electromagnetic disturbances. 1 September 2020. https://webstore.iec.ch/publication/59644
- Ch. 27 — IEC. IEC 62304:2006, Medical device software, Software life cycle processes; IEC 62304:2006/AMD1:2015. https://webstore.iec.ch/en/publication/6792 ; https://webstore.iec.ch/publication/22790
- Ch. 27 — Smithers. Infusion pump testing, IEC 60601. Undated. https://smitherspira.com/industries/medical-device/physical-and-functional-testing/infusion-pump-testing-iec-60601 (commercial test laboratory)
- Ch. 27 — BSI. BS EN IEC 60601-2-24, edition 3.0, draft for public comment. Project 2025-00869. Accessed 11 October 2026. https://standardsdevelopment.bsigroup.com/projects/2025-00869 (project page; draft text not read)
- Ch. 27 — Bureau of Indian Standards. IS 13450 (Part 2/Sec 24):2019, identical with IEC 60601-2-24:2012. https://www.services.bis.gov.in/php/BIS_2.0/bisconnect/knowyourstandards/Indian_standards/isdetails_mnd/21306
- Ch. 27 — ISO. ISO 14971:2019, Medical devices, Application of risk management to medical devices. Edition 3; confirmed 7 March 2025. https://www.iso.org/standard/72704.html
- Ch. 27 — IEC SC 62A. Design specification for the second edition of IEC 62304. Undated (drafting May 2022 to April 2023). https://assets.iec.ch/public/sc62a/IEC%2062304%20Ed.%202.0%20Design%20Specification.pdf (working document)
- Ch. 27 — Critical Software. IEC 62304 Edition 2 changes. 12 June 2026. https://criticalsoftware.com/en/newsroom/iec-62304-edition-2-changes (software vendor)
- Ch. 28 — eCFR. 21 CFR 880.5725, Infusion pump. 45 FR 69682, 21 October 1980. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-880/subpart-F/section-880.5725
- Ch. 28 — US FDA. openFDA device classification data, regulation number 880.5725 (17 product codes). Accessed 11 October 2026. https://api.fda.gov/device/classification.json?search=regulation_number:880.5725&limit=50
- Ch. 28 — US FDA. Product classification database: FRN, Pump, Infusion. Accessed 11 October 2026. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfPCD/classification.cfm?id=FRN
- Ch. 28 — US FDA CDRH. Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions. Final guidance. 27 June 2025. (guidance page not opened, HTTP 429; date from FDA's cybersecurity page)
- Ch. 28 — US FDA. openFDA 510(k) data, product code FRN, decisions 1 January 2015 to 11 October 2026 (45 records), counted by decision year; codes MEA, MEB, LZH and PHC counted the same way. Dataset updated 28 September 2026. https://api.fda.gov/device/510k.json?search=product_code:FRN+AND+decision_date:[20150101+TO+20261011]&count=decision_date
- Ch. 28 — Code of Federal Regulations. 21 CFR 820.30, Design controls. Title 21, Chapter I (revised as of 1 April 2024), in force until 1 February 2026. https://www.govinfo.gov/content/pkg/CFR-2024-title21-vol8/pdf/CFR-2024-title21-vol8-sec820-30.pdf
- Ch. 28 — US FDA. Medical Devices; Quality System Regulation Amendments. Final rule. 89 FR 7496-7525, Federal Register document 2024-01709, docket FDA-2021-N-0507, 2 February 2024; effective 2 February 2026; incorporates ISO 13485:2016 by reference. https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-system-regulation-amendments
- Ch. 28 — NSAI (National Standards Authority of Ireland). Medical Device Seminar: ISO 13485:2016 & MDR (slides quoting ISO 13485:2016 clauses 7.3.2, 7.3.6 to 7.3.10). May 2016. https://www.nsai.ie/download/certification/ISO-13485-MDR-Seminar-May-2016.pdf (certification body; secondary for the standard's wording)
- Ch. 28 — US FDA, CDRH. Deciding When to Submit a 510(k) for a Change to an Existing Device: Guidance for Industry and Food and Drug Administration Staff. Final, October 2017, docket FDA-2011-D-0453. https://www.fda.gov/media/99812/download
- Ch. 28 — US FDA, CDRH. Deciding When to Submit a 510(k) for a Software Change to an Existing Device: Guidance for Industry and Food and Drug Administration Staff. Final, October 2017, docket FDA-2016-D-2021 (Appendix A, example 4.5, infusion pump occlusion alarm). https://www.fda.gov/media/99785/download
- Ch. 29 — European Commission. Commission Implementing Decision (EU) 2026/1231 of 11 June 2026 amending Implementing Decision (EU) 2021/1182 as regards harmonised standards for medical devices. OJ L, 17 June 2026. https://eur-lex.europa.eu/eli/dec_impl/2026/1231/oj
- Ch. 29 — European Parliament and Council. Regulation (EU) 2017/745 on medical devices, recital 56 and Article 54. OJ L 117, 5 May 2017. https://eur-lex.europa.eu/eli/reg/2017/745/oj (recitals read in full; Annex VIII Rule 12 read as quoted in MDCG 2021-24 Rev.1; Article 54 not opened directly, the fetch was truncated)
- Ch. 29 — European Parliament and Council. Regulation (EU) 2023/607 of 15 March 2023 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards the transitional provisions. OJ L 80, 20 March 2023. https://eur-lex.europa.eu/eli/reg/2023/607/oj
- Ch. 29 — Medical Device Coordination Group. MDCG 2019-3 rev.1, Clinical evaluation consultation procedure exemptions: interpretation of Article 54(2)b. April 2020. https://health.ec.europa.eu/document/download/c66ca211-7390-4d60-90fc-0fc30652f3db_en?filename=md_mdcg_2019_3_rev1_cecp_en.pdf
- Ch. 29 — European Commission. EUDAMED overview, reporting Commission Decision (EU) 2025/2371 of 26 November 2025 on the functionality of four EUDAMED modules (OJ 27 November 2025). Accessed 11 October 2026. https://health.ec.europa.eu/medical-devices-eudamed/overview_en
- Ch. 29 — European Parliament and Council. Regulation (EU) 2024/1860 of 13 June 2024 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards a gradual roll-out of Eudamed and the obligation to inform in case of interruption or discontinuation of supply. OJ L, 9 July 2024. https://eur-lex.europa.eu/eli/reg/2024/1860/oj
- Ch. 29 — European Commission. Proposal for a regulation simplifying the rules on medical devices and in vitro diagnostic medical devices. COM(2025) 1023 final. 16 December 2025. https://health.ec.europa.eu/publications/proposal-regulation-simplify-rules-medical-and-vitro-diagnostic-devices_en (explanatory memorandum and recitals read; article text truncated)
- Ch. 29 — European Parliament. Legislative Observatory, procedure file 2025/0404(COD). Accessed 11 October 2026. https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0404%28COD%29
- Ch. 30 — CDSCO. Medical Devices Rules, 2017 (G.S.R. 78(E), 31 January 2017) and amendments, rules page. Accessed 11 October 2026. https://cdsco.gov.in/opencms/opencms/en/Acts-and-rules/Medical-Devices-Rules/
- Ch. 30 — CDSCO. Draft list of medical devices and in vitro diagnostics along with their risk class. Notice DCG(I)/Misc./2017(68). 29 June 2017. https://www.cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2018/UploadPublic_NoticesFiles/notice29_6_2017_55.pdf (draft for comment)
- Ch. 30 — CDSCO. Final classification of medical devices, Annexure II (category lists). Undated. https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2018/UploadPublic_NoticesFiles/Final%20Classification%20of%20MD.pdf
- Ch. 30 — CDSCO. Classification of medical devices pertaining to General Hospital. File No. 29/Misc./03/2020-DC (193). Updated 16 March 2022. https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2018/UploadPublic_NoticesFiles/Notice%20Updated%20General%20Hospital%20classification%2016.3.2022.pdf
- Ch. 30 — CDSCO. Regulatory pathway to be followed for the medical device from its development to commercialisation under Medical Devices Rules, 2017. Undated. https://cdsco.gov.in/opencms/export/sites/CDSCO_WEB/Pdf-documents/medical-device/RegulatoryMDR-2017.pdf
- Ch. 30 — RAPS. Asia-Pacific Roundup: India defers enforcement of licensing for Class C and D devices. 16 October 2023. https://www.raps.org/resource/asia-pacific-roundup-india-defers-enforcement-of-l.html (secondary)
- Ch. 30 — Indian Pharmacopoeia Commission. Materiovigilance Programme of India (MvPI): About us. Accessed 11 October 2026. https://ipc.gov.in/mandates/materiovigilance-programme-of-india-mvpi/about-us.html
- Ch. 30 — Indian Pharmacopoeia Commission. Guidance document for hospitals in India for safety monitoring and reporting of medical devices adverse events (MDAE), version 1.3. 2026. https://ipc.gov.in/images/mvpi/BOOK-FINAL-FOR-PRINTING-15-SEP_compressed.pdf
- Ch. 31 — US FDA. 21 CFR 7.3, Definitions (recall, correction, recall classes). eCFR, current at 11 October 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-7/subpart-A/section-7.3
- Ch. 31 — US FDA. 21 CFR Part 803, Medical Device Reporting, and 21 CFR 806.10, Reports of corrections and removals. eCFR, current at 11 October 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-803
- Ch. 31 — US FDA. Medical Device Recalls database, product code FRN, Class 1, posted 1 January 2010 to 11 October 2026 (163 product records; query 11 October 2026). https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?start_search=1&productcode=FRN¢erclassificationtypetext=1&postdatefrom=01/01/2010&postdateto=10/11/2026&pagenum=500&sortcolumn=cdd
- Ch. 31 — Medical Device Coordination Group. MDCG 2023-3 rev.2, Questions and answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745. January 2025. https://health.ec.europa.eu/document/download/af1433fd-ed64-4c53-abc7-612a7f16f976_en?filename=mdcg_2023-3_en.pdf
Take the PDF with you.
Reading online needs no sign-up. For the PDF edition, laid out for print and offline reading, tell us where to send it and we will email you.
Check your inbox.
The download link is on its way to your email. If it has not arrived in a few minutes, check your spam folder or write to info@unplex.tech.
Preview only — nothing was sent