Dalkon Shield: how a tail string wicked failure through an entire system

Here is an uncomfortable observation from two decades of failure analysis: nobody has ever asked me to run a PFMEA on a piece of string. The Dalkon Shield is what happens when the simplest component in the kit carries the deadliest failure mode. The shield body was never the killer. The tail – a multifilament string inside a sheath, open at the tip – was a capillary tube implanted across the boundary between a contaminated environment and a sterile one. Capillaries move fluid without asking permission.

The situation

The Shield reached the U.S. market in 1971, before the 1976 Medical Device Amendments gave regulators real premarket authority. A.H. Robins, a pharmaceutical house with no deep device heritage, had acquired the product and marketed it hard. To the eye it was almost embarrassingly simple: a plastic shield with a string hanging from it, so a clinician could confirm placement and later pull the device out.

That string was the design decision. Rival IUDs used a monofilament tail – one solid strand, no channels. The Shield used a bundle of fine filaments inside a sheath that terminated open. On a drawing, trivia. In vivo, a wick.

How it unfolded

Infection reports began arriving while the product was still on sale: pelvic inflammatory disease, septic miscarriages, infertility, deaths. Each case was individually arguable, which is precisely how scattered signals survive. The company disputed causation and defended the product; U.S. sales were suspended in 1974, but the installed base kept the failure mode live for years.

Litigation then did the job the quality system had refused to do. It aggregated the signal. Claims climbed towards 200,000, A.H. Robins filed Chapter 11 in 1985, and a trust of about $2.4 billion was eventually funded to compensate the injured. The company had outsourced signal detection to plaintiffs' lawyers, at the worst possible price.

Root-cause anatomy

Technically, the tail string was the only component spanning two environments: vagina below, uterus above – one laden with bacteria, one defined by their absence. Multifilament construction supplies the channels; the open sheath, the entrance; dwell time, fluid pressure and menstruation, the driving head. Nothing in the design asked how the materials behave after months immersed in vaginal flora, so nothing in the testing did either.

Organisationally, the failure repeated one level up. Complaints went to lawyers, not engineers. No trend thresholds, no engineering triage, no CAPA discipline – the concept barely existed in that industry yet. The device had been acquired rather than developed in-house, so its design assumptions were never interrogated by the people now defending them. Defending instead of investigating turned a correctable defect into an extinction event.

A part that crosses a cleanliness boundary is never just a part. It is a bridge – and bridges carry traffic in both directions.

Where the quality system failed

• PFMEA. The tail was scored, if at all, as a removal aid; severity attached to breakage and fraying, never to being a microbial conduit. Nobody wrote the negative function: must not transport matter between environments.
• Design verification. Bench tests answered tensile questions in laboratory air. No test placed the string between a contaminated chamber and a sterile one and cultured the far side. The use environment was never a test condition, so the failure mode was invisible by construction.
• Complaint handling and the CAPA gate. Envelopes were opened by the legal department. With no trend rules and no escalation trigger, a complaint stream reads as liability paper, not data – everything depends on who opens it first.
• Change control. Once the string became a suspect, the public record shows no documented evaluation of a monofilament replacement. Silence is also a decision.

What would have caught it

One experiment, fully within 1970s microbiology: mount the tail string as the only connection between an inoculated chamber and a sterile one, wait, culture the far side. Weeks of elapsed time. Trivial cost. Definitive answer. That should keep engineers awake – the test was cheap, available, never demanded.

From there, three disciplines, none exotic. Score negative functions: "prevent passage of matter between environments" belongs in the PFMEA of every wall, seal, membrane and string, with a severity attached. Run the P-diagram discipline inside APQP and treat flora, fluid, pressure and dwell time as use-environment inputs, not exotic hypotheses. And put engineering first in complaint triage, with hard rules: any cluster of similar signals involving death or permanent harm triggers a design review that legal attends but does not chair.

My take

I had no involvement in this case; it is public record. I keep it in my teaching set because it maps cleanly onto what I have lived. At Witte Automotive, the failure costs I chased were never concentrated in the parts whose drawings people fought over – they lived in unscored details. At SNOP, building a greenfield quality function for 900-plus people, I made complaint triage an engineering ritual, not a correspondence exercise; the plant ran a quarter with zero critical customer escalations, not because failures stopped but because the third similar signal triggered a response before it became the tenth. Across multi-site work spanning a 2,000-plus workforce, the audit question I trust most is simple: show me where the first complaint lands – an engineer's inbox or a lawyer's filing cabinet. The part that ends careers never has tolerances worth arguing about.

There is also a security reading, and it is mine, not the record's. An ethical hacker looks at any system and asks what connects a hostile environment to a trusted one. The tail string was exactly that: an unguarded connection between two zones at different trust levels. Quality management and penetration testing are the same trade – finding the bridge nobody audited.

The Dalkon Shield's lesson is not that companies fail; it is that systems fail quietly, one unasked question at a time. A skipped challenge test. A complaint stream read as nuisance. A design detail priced by its purchase order instead of its consequence – $2.4 billion, 200,000 claims and a corporate corpse later, the invoice arrived. Somewhere on your floor today sits a component too simple to have a failure mode. Go and score it.