Case file
- What happened: St. Jude Medical's Riata and Riata ST silicone defibrillator leads suffered internal abrasion – cables inside the lead wore through their own insulation and protruded externally, causing painful inappropriate shocks, sensing and pacing failure, and in reported cases contributing to death.
- Scale: about 128,000 leads implanted worldwide, roughly 79,000 in the US. The failure developed silently over years while the lead stayed electrically normal.
- Root cause: a mechanical wear mechanism – multilumen cables rubbing against silicone insulation with every heartbeat – against a detection strategy built entirely on electrical measurements that cannot see insulation integrity.
- The bill: a 2011 FDA Class I recall, global fluoroscopy screening for every living patient, extraction decisions for thousands, years of litigation, and a permanently damaged product line.
Here is an uncomfortable observation: every monitoring system attached to the Riata lead worked exactly as designed, and roughly 128,000 patients were still carrying cables wearing through their own insulation. That should disturb any quality engineer. The failure did not slip past the controls. The controls were never pointed at the mechanism that actually failed. The defect was invisible only to the instruments we had chosen to trust.
The situation
Riata and Riata ST were thin, silicone-insulated implantable defibrillator leads, cleared in the US in 2002. Silicone was the industry's trusted material: flexible, biocompatible, stable in tissue for decades. Multiple lumens ran through the silicone body, conductor cables through them. The design passed the standard pre-market battery – bench electrical tests, fatigue cycling, accelerated aging – then went on to build one of the largest implant bases in the field.
Post-implant surveillance was equally standard: remote monitoring of impedance and performance trends. Verified, validated, watched. On paper. The paper was the problem.
How it unfolded
A lead flexes with every heartbeat. Call it 100,000 cycles a day, tens of millions a year, for years. Inside the lumens the cables pressed and rubbed against the silicone walls until they wore through from the inside out and migrated outside the lead body – externalisation. Abraded or externalised cables could short, fire inappropriate shocks, or stay silent when therapy was needed. Deaths were reported in connection with these failures.
Many externalised leads stayed electrically normal. That detail is the one that should keep you awake. Impedance fine, thresholds fine – the defect usually surfaced on a chest X-ray taken for something else. Physician case reports accumulated through the late 2000s. St. Jude stopped selling Riata in 2010, issued a physician advisory in late 2010, and the FDA classified the action Class I in December 2011. In 2012 the manufacturer sued a prominent cardiologist over his published mortality data – a crisis-communication decision that aged badly and taught the industry what not to do when a silent field failure surfaces.
Root-cause anatomy
Technically, a classic wear-out mechanism: cumulative, geometry-dependent, hostage to individual anatomy and implant path. Silicone is a fine material for tissue and a poor abrasion shield – chosen for how it behaves in the body, then asked to serve as a wear surface. Verification simulated years of flexing, but the mechanism that mattered was cable-on-insulation abrasion inside the finished assembly, and the bench programme never reproduced it faithfully.
The organisational root cause ran deeper: a detection philosophy anchored to what the device could measure about itself. Telemetry sees electrical change. An insulation breach that has not yet altered electrical behaviour is invisible to it. The complaint system inherited the same blindness – it only heard from failures that announced themselves electrically, while the quietly externalised survivors generated no signal at all. Survivor bias, baked into a regulatory control.
A meter tells you the circuit works today – never how much life is left in the insulation.
Where the quality system failed
Start at the PFMEA. The detection rating for insulation abrasion was scored against electrical testing and in-device monitoring – a mechanical wear mode assigned an electrical detective. Severity was correctly catastrophic. Detection was fatally optimistic. The RPN built on that pairing was fiction.
Post-market surveillance, in too many systems, is a reporting obligation rather than a design control. This one ran on complaints, and complaints were structurally biased toward the electrically loud. Then the CAPA gate: isolated physician case reports accumulated for years before they aggregated into an advisory. Each report got triaged. Nobody owned the trend. In VDA 6.3 terms this is P7 – customer feedback and complaint management – the element where auditors most often find a process that exists on paper and never loops back into design. Here it never looped.
What would have caught it
Four controls would have changed the story. Wear validation against the real duty cycle comes first: accelerated cable-on-insulation abrasion equivalent to ten-plus years of cardiac flexion, run on the finished multilumen assembly – not functional electrical checks after a generic fatigue run. Second, an autopsy programme for returns: systematic dissection of every explanted lead, including electrically normal ones removed after a patient death, with imaging before teardown. Externalisation would have surfaced years earlier as a physical finding instead of a complaint statistic.
Third, planned imaging surveillance after approval – periodic fluoroscopy in a defined patient cohort, run as a post-market design-control activity, because X-ray was the one instrument that could see the failure mode. Fourth, and cheapest in hindsight: the successor lead added an abrasion-resistant outer layer. The mechanism was addressable, which means it was foreseeable.
My take
I have lived the cheap version of this failure. In automotive, a door harness chafes through its insulation, passes end-of-line continuity with a green light and comes back as a warranty claim two years later. I have run QRQC sessions on exactly that pattern. The tester blessed the product for the eight minutes it ran, not the eight years it had to survive.
At SNOP, building the QA/QC department for a 900-person greenfield plant, the first discipline I installed was return autopsy: cut open every returned part, including the ones that tested normal on arrival. It is the only honest conversation you will ever have with your own design. My VDA 6.3 audit years taught me the same lesson from the other side of the table – ask a supplier how they detect failure modes that never announce themselves, and the silence is usually the finding.
What this means on your floor
- Score PFMEA detection ratings per failure mechanism, not per part number – an electrical control cannot see a mechanical wound.
- Treat warranty and post-market data as design verification phase three, not paperwork for the regulator.
- Autopsy your survivors, not just your complaints – the parts that come back still working carry your blind spots.
- When a silent field failure surfaces, protect the user first. Suing the messenger is a CAPA in reverse.
Riata is what happens when a quality system measures what is easy instead of what fails. The monitoring was never looking at the right mechanism, and the gap between the two was priced in patients, extractions and a Class I recall. Post-market surveillance is the last line of defence between a silent defect and the person living with it. Build it as though it were the first.
