Medical device bowtie example: unintended drug overdose from an infusion pump
A complete, worked bowtie analysis example: 4 threats, 4 consequences, and 21 controls — 8 of them critical — around the top event, each carrying effectiveness, degradation factors, and a performance standard.
Open it read-only in the real editor → No sign-in required.
Bowtie Risk Engine writes barriers as controls and the top event as the risk — same method, stricter bookkeeping.
Unintended Drug Overdose from Infusion Pump
A patient-safety bowtie for smart-pump infusion: programming error, drug mix-up, pump malfunction, and environment as threats; clinical response and device safeguards on the recovery side. Useful for design teams and hospital risk committees alike.
Area. Smart infusion pumps in a tertiary hospital — ICU, oncology, paediatrics
Hazard. Patient receives a higher-than-intended dose of a high-alert medication, leading to harm or death
Activity. Continuous infusions during inpatient care; programming, line connection, drug-library updates
Top event. Unintended Drug Overdose from Infusion Pump — the moment control of the hazard is lost, at the knot of the bowtie.
Threats and preventive controls
Built to sit alongside an ISO 14971 risk-management file — harm, sequence of events, and risk controls.
| Threat | Control | Criticality | Effectiveness |
|---|---|---|---|
| Programming error (wrong dose, rate, or unit)Clinician programs the pump with an incorrect rate, concentration, weight, or units (mg vs mcg, kg vs lb). | Drug library with hard and soft limits | Critical | High |
| Independent two-clinician double-check (high-alert drugs) | Critical | Medium | |
| CPOE with computerised dose checking | Standard | Medium | |
| Barcode medication administration (BCMA) | Standard | Medium | |
| Drug mix-up or wrong concentrationWrong drug attached, wrong concentration prepared by pharmacy, or look-alike-sound-alike (LASA) substitution. | Pharmacy-prepared standardised concentrations | Critical | High |
| Tall-man lettering and storage segregation | Standard | Medium | |
| Line labelling at point of administration | Standard | Medium | |
| Pump hardware or software malfunctionFree-flow event from broken occluder, runaway-pump software fault, sensor drift, or dose-error reduction software (DERS) failure. | Anti-free-flow IV sets | Critical | High |
| Preventive maintenance and calibration | Standard | High | |
| Dose-Error Reduction Software (DERS) | Standard | High | |
| Environmental / handover factorsDistractions, interruptions during programming, fatigue, shift handover, multi-tasking on multiple high-alert infusions. | No-interrupt zone for medication preparation | Standard | Low |
| Structured shift handover (SBAR with active infusions) | Standard | High |
Consequences and recovery controls
If the top event happens anyway, these are the controls that limit how bad it gets.
| Consequence | Control | Criticality | Effectiveness |
|---|---|---|---|
| Patient harm (mild to severe)Adverse drug event ranging from transient hypotension or bradycardia to permanent injury or death depending on drug and dose. | Continuous patient monitoring | Critical | High |
| Rapid response / MET activation | Critical | High | |
| Reversal agents available at the bedside | Standard | High | |
| MortalityDeath attributed to or contributed to by the infusion event. | Continuous monitoring (linked) | Critical | High |
| Resuscitation capability | Critical | High | |
| Regulatory MDR / event reportingMandatory medical device report (FDA MDR / EU vigilance), root-cause investigation, regulator engagement. | Event-reporting system with root-cause analysis | Standard | High |
| Vendor advisory channel | Standard | High | |
| Litigation and reputational damagePatient or family pursues legal claim; institutional reputation and accreditation affected. | Open disclosure programme | Standard | High |
| Quality and accreditation programme | Standard | High |
| Control | Degradation factor | Degradation control |
|---|---|---|
| Drug library with hard and soft limits | Basic-mode infusions bypassing the drug library | Library-compliance KPI (95% target) and near-miss review of soft-limit overrides |
| Independent two-clinician double-check (high-alert drugs) | Automaticity / non-independent double-check | Simulation training and enforced, truly independent verification |
| Anti-free-flow IV sets | Substitution with non-approved generic IV sets | Formulary restricted to approved anti-free-flow sets |
| Continuous monitoring (linked) | Continuous-monitoring outage | Backup telemetry channels required for high-acuity infusions |
Drug library with hard and soft limits
Every control in this template carries this level of detail — this is one of the critical ones.
What it does. Smart-pump drug library configured by pharmacy with hard upper-limit (cannot be overridden) and soft limits (require confirmation) per drug, care area, and patient population.
Performance standard — objective. Prevent a dangerous dose or rate being programmed by constraining the pump to pharmacy-defined limits per drug and care area.
A verification criterion. Hard upper limits that cannot be overridden are configured per drug, care area, and patient population.
How it erodes. A drug or care area missing from the library, limits set too high 'to avoid nuisance alerts', or firmware/library versions drifting out of sync across the fleet let a dangerous dose be programmed within the hard limit.
Questions about this template
Is this bowtie example free to use?
Yes. Open it read-only in the real editor with no sign-in and read every control in full. To adapt it to your own operation, start the free 3-month trial — full editor and register, work email, no credit card.
What does the template include?
4 threats, 4 consequences, and 21 controls (barriers) around the top event, plus 4 degradation factors with their own controls, and a performance standard on every control. The control register and audit-ready PDF are generated from the same model.
What standard or framework does it align with?
It complements an ISO 14971 risk-management file: the top event is the hazardous situation, threats are sequences of events, and the barriers are your risk-control measures — presented in a form clinicians and auditors can actually read.
Can I export it?
Yes — PNG and SVG for slides and reports, JSON for version control, and a multi-page PDF containing the control registers, degradation factors, and performance standards. Trial exports are brand-marked.
Open this bowtie in the editor.
Read every control, criterion, and degradation factor in the live model — then adapt it to your own operation on the free 3-month trial.
More worked bowtie examples
- Process safety bowtie example: loss of containment of flammable hydrocarbon
- Aviation SMS bowtie example: loss of separation in controlled airspace
- Cyber security bowtie example: unauthorised access to a customer database
- Reliability bowtie example: critical pump failure causing unplanned shutdown
- Psychosocial hazards bowtie example: uncontrolled exposure to psychosocial hazards
Or start from the template gallery.