Case file
- What happened: The Björk-Shiley Convexo-Concave mechanical heart valve, introduced in 1979, could fracture at its welded outlet strut. A fractured strut typically meant sudden death of the patient — the valve's flange could dislodge and block flow within seconds.
- Scale: Roughly 86,000 valves implanted worldwide before production ended in 1986. Hundreds of strut fractures were ultimately reported, and the large majority were fatal.
- Root cause: Welding variability in manufacturing was implicated. The outlet strut weld was a special process whose variation was never fully brought under statistical control — and a fractured weld could not be detected non-destructively before implant.
- The bill: Extensive litigation and settlements for Shiley and its parent Pfizer, plus one of the most damaging reputational collapses in medical-device history. The true bill is measured in patient deaths that a validated weld process and a redundant design were built to prevent.
Here is an uncomfortable observation. The most lethal quality failure in medical-device history did not come from a bad design review, a bad supplier or a bad material cert. It came from a weld — a single weld, on a single strut, with no second load path behind it. Two decades in automotive and aerospace chasing exactly this class of risk at weld stations, and I can do the arithmetic before reading a page of the case file. Severity 10. Occurrence driven by a special process nobody fully validated. Detection near zero, because you cannot inspect quality into a weld after the fact. When that is your PFMEA line, the only controls that count are design redundancy and validated process control. Björk-Shiley had neither.
The situation
The Björk-Shiley Convexo-Concave valve was a tilting-disc mechanical heart valve, an evolution of an earlier design, brought to market in 1979. The disc pivoted on an inlet strut and was retained by an outlet strut — a thin metal leg welded to the valve's metal ring. The geometry change that created the Convexo-Concave shape altered the flow characteristics. It also loaded that welded outlet strut in ways the earlier design did not.
Roughly 86,000 valves went into patients globally before production ended in 1986. The failure mode could hardly have been worse. A fractured outlet strut released the retaining leg, the disc escaped, and blood flow through the valve effectively stopped. Death was typically sudden — no warning symptom, no monitoring regime, no surgical remedy fast enough. Severity 10 in its purest textbook form: death without warning, in use, no mitigation available to anyone.
How it unfolded
The pattern is one every quality professional should recognise, because it is the pattern of every field-failure case I have ever worked: early fractures were absorbed as isolated incidents rather than treated as signals. Individual explants were investigated individually. The statistical picture — fractures clustering around a specific strut and a specific weld — assembled slowly. Reporting was voluntary. The fatal outcome destroyed the evidence. And each death was tragic, singular, and explained away.
That is the cultural failure mode. When a field failure kills the product's evidence along with the patient, and the base rate looks small against 86,000 implants, every fracture can be narrated as an outlier. Investigative press and public reporting eventually forced the picture into the open. Production ended in 1986. Shiley and Pfizer faced years of litigation and settlement. The number that matters, though, is not the settlement figure — it is the gap between how many fractures it took to see a pattern and how many it should have taken.
Root-cause anatomy
Technically, this was a single-point failure in a life-critical load path. The outlet strut carried the disc-retention function alone. No redundant leg, no mechanical interlock, no fail-safe geometry. One weld, and behind it one life. The weld itself was the second failure: welding is the canonical special process, meaning its result cannot be fully verified by inspecting the finished part. Penetration, porosity, heat-affected-zone quality — all determined by parameters, fixtures, operator technique and material state at the moment of joining. Variability in that process, shift to shift and operator to operator, was implicated in the fractures.
Organisationally, the root cause was the absence of anyone asking the special-process question with authority: what, specifically, controls weld variability on this joint, and where is the evidence? In automotive and aerospace that question is the backbone of process audits under VDA 6.3 and of every weld-station review I have ever run. "We have certified welders and a procedure" is not an answer. Parameter windows, capability data, destructive test sampling, requalification triggers — that is the answer. If nobody holds that evidence, the joint is unvalidated. An unvalidated, non-redundant joint in a severity-10 application should never have shipped.
Where the quality system failed
Run this through the disciplines and the failure points line up with brutal clarity.
- PFMEA: The line for outlet strut fracture read severity 10, occurrence uncertain because the special process was unvalidated, detection near zero. That arithmetic does not permit a mitigation of "increase inspection". It demands redundancy in design or proven process capability. Neither was delivered.
- Special-process validation: A weld whose integrity cannot be fully verified non-destructively must be validated through process qualification, parameter control and destructive sampling. The weld variability implicated here says that control loop was never closed.
- CAPA / 8D gate: Early field fractures should have triggered systemic problem-solving across the whole fleet. Instead they were handled as isolated events — the exact cultural failure I spend my working life dismantling, because isolated-incident thinking is how organisations stay comfortable while a systemic problem compounds.
- Postmarket surveillance: Surveillance functioned as an archive — reports filed, numbers accumulating — rather than as a tripwire with a defined threshold that forces action. A fleet of 86,000 severity-10 devices needed a fracture-rate trigger, not a filing cabinet.
When detection is zero and severity is ten, every weld you have not validated is a bet you have placed with someone else's life.
What would have caught it
In the order the controls should have fired:
- Design redundancy at the PFMEA stage: Severity 10 on a single load path is a design rejection, full stop. A redundant retention feature — a second strut leg, a capture geometry that survives single-leg fracture — converts a fatal failure into a survivable one. The PFMEA's first required action for that line is a design change, not a containment.
- Weld process validation with capability evidence: Parameter windows locked, destructive test sampling on production parts, operator-to-operator and shift-to-shift capability studies, requalification on any change of wire, gas, fixture or material lot. If the data shows drift, the line stops.
- Process audit interrogation: The VDA 6.3 style question set — who sets the parameters, who may change them, what evidence exists that the last 500 welds matched the first 500 — asked by someone with the authority to halt shipment.
- A fleet-level fracture tripwire: A pre-defined rule: any confirmed outlet-strut-related event, or a fracture rate above a stated threshold, triggers immediate 8D with fleet-wide risk assessment and regulatory notification. One tripwire, defined in advance, beats a thousand filed reports.
My take
To be clear about my seat: my experience is automotive and aerospace, and this case is public record I was not part of. But the anatomy is one I know from the inside. At Witte Automotive I ran QRQC and A3 problem-solving on exactly this pattern — a special process quietly drifting, field failures absorbed one at a time, until someone forced the systemic view and the failure-cost line dropped substantially. Building a greenfield QA/QC department for over 900 people at SNOP taught me the cheaper lesson: the controls that feel expensive up front — validated processes, capability evidence, defined escalation tripwires — cost a fraction of one serious field campaign. The 70% reduction in defect costs and zero critical customer escalations in a quarter came not through heroics, but because the tripwires were defined before the fire.
What separates my world from Björk-Shiley is severity. A failed weld on a car seat or a bracket costs money and reputations. A failed weld on an outlet strut cost a life within seconds, no warning, no recourse. The disciplines are identical — PFMEA, special-process control, CAPA discipline — but severity 10 removes every margin for the cultural excuses. That is why this case sits in my library. It is the arithmetic of failure in its purest form.
What this means on your floor
- Any severity-10 failure mode resting on a single load path is a design problem first. Redundancy beats inspection, always, when the weld cannot be fully verified after the fact.
- Special processes — welds, brazes, castings, adhesives, heat treatment — are validated through process capability evidence, not certified procedures. Ask what controls variability shift-to-shift and operator-to-operator, and demand the data.
- Treat every early field failure as a sample from a distribution, not an anecdote. If your 8D treats it as an isolated incident, you are archiving, not solving.
- Define your postmarket or field-failure tripwires in advance, with thresholds and named owners. A tripwire you define after the third incident is a tombstone, not a control.
The Björk-Shiley case closes with the arithmetic it opened with: severity 10, occurrence uncontrolled, detection near zero. Two controls could have changed the outcome — a redundant load path and a validated weld process — and neither was exotic. The settlements that followed would have funded weld validation many thousands of times over. That is the trade every quality leader signs, knowingly or not, every day: pay for process control, or pay for its absence. Here the invoice for absence was counted in lives, and no settlement balances that ledger. When detection is near zero, you do not get to hope. You get to design and validate — or you get to explain, afterwards, why you didn't.
