Over-The-Air Updates Could Turn Millions Of Inexpensive Devices Into Much-Needed Ventilators To Treat Seriously-Ill COVID-19 Patients — If Manufacturer Helps
from the profits-before-people dept
Last week we wrote about attempts to repair much-needed ventilators for serious coronavirus cases being stymied by manufacturers’ refusal to allow hospital technicians to carry out the necessary work. Trammell Hudson, who describes himself as “a programmer, photographer, frequent hacker and occasional watchmaker“, has come up with another approach to supplying ventilators to hospitals. It involves taking the inexpensive and widely-used Constant Positive Air Pressure (CPAP) devices typically used for sleep apnea, and turning them into emergency ventilators suitable for COVID-19 patients. These are known as Bi-level Positive Airway Pressure (BiPAP) machines. BiPAP devices are more sophisticated than CPAP ones: they apply higher pressure when the patient tries to breathe in, and lower pressure when they start to breathe out. In investigating the popular Airsense 10 CPAP device manufactured by ResMed, Hudson made a remarkable discovery:
Our work indicates that the actual difference between a low-end CPAP device and a high-end iVAPS [intelligent volume-assured pressure support] device is just a software upgrade. The CPAP machines have many of the same sensors as the more expensive models, and the Airsense 10 CPAP devices include in their firmware all of the other modes, such as iVAPS and BiPAP-ST [spontaneous/timed mode]. When we unlock that mode in software, the CPAP device functions like a much more capable and expensive iVAPS device.
This idea, that the difference between CPAP and BiPAP machines is a software change rather than a hardware change, is at the root of our work. If the common, highly distributed CPAP devices could have a software upgrade that turns them into iVAPS or BiPAP-ST devices capable of ventilating COVID patients, that would be a huge boon to the hospitals and health care workers around the world who are struggling with a lack of ventilators or alternatives to treat the influx of COVID patients.
Following his discovery, Hudson wrote a firmware patch that can be applied to the Airsense 10 CPAP device in order to access its more advanced features. However, he stresses:
We want to be very clear here: this modified firmware should not be flashed on CPAP machines and used to treat COVID patients immediately. The firmware that we’ve developed is an effective demonstration of the capability, and while it has been reviewed and validated by expert researchers, biomedical engineers, and clinical pulmonologists, it has not yet been put through FDA approval.
Although FDA approval could be sought, Hudson points out that by far the best solution would be for ResMed itself to provide the software upgrade — something that doesn’t need FDA permission. There are two other big benefits of taking this route. First, the manufacturer could more easily provide the slightly different patches for the various models of its devices. Perhaps even more importantly, for the majority of machines, the manufacturer could use a built-in always-on cellular connection to upgrade them over the air, without even needing to open them up. Unfortunately, it seems unlikely that the manufacturer will embrace this idea. On its Web site, a FAQ specifically addresses the issue of using a CPAP machine as a ventilator:
CPAP devices are designed to provide only PAP (positive airway pressure) and would require significant rework in order to function as a ventilator.
Hudson’s work suggests that is not true: a simple software upgrade is pretty much all that is required. When asked by Ars Technica whether the company would be willing to work with researchers to convert low-cost models to more capable ventilators, a representative wrote: “We are already exploring that option, but our primary focus is to maximize production of our current ventilation devices, masks, and accessories”. In other words, rather than helping to save thousands of lives by carrying out over-the-air upgrades of existing machines — millions of them in the US alone, according to Hudson — the “primary focus” is on selling more expensive machines. As with the previous story about repairing ventilators, it seems that even during a pandemic, profits are more important than patients.
Follow me @glynmoody on Twitter, Diaspora, or Mastodon.
Filed Under: airsense 10, bipap, covid-19, cpap, fda, hacking, ota, over the air updates, trammell hudson, ventilators
Companies: resmed
Comments on “Over-The-Air Updates Could Turn Millions Of Inexpensive Devices Into Much-Needed Ventilators To Treat Seriously-Ill COVID-19 Patients — If Manufacturer Helps”
but what if ResMed is right?
I’m just thinking…the CPAP machines were designed as CPAP machines: while a simple hack could make it do things it wasn’t supposed to do, what if they don’t function as well as a fully-functional BIPAP machine and could possibly kill the patient? That seems like a liability that ResMed doesn’t want, and I think that’s why they’re refusing to let their machines be hacked. This is not the case of iPhones or John Deere tractors being modified because their alteration doesn’t usually result in death (though I could imagine that to John Deere tractors); when the primary function of CPAP ventilators are being changed, their efficacy as medical equipment could very well be compromised.
Re: but what if ResMed is right?
Never mind, while reading the article, I found out that the software upgrade did receive approval from a lot of stringent authorities. I guess my worries were unfounded.
Re: Re: but what if ResMed is right?
You might have been right from the start. Think of all the wallets that will starve if we could use the things we own already for whatever purpose we wanted instead of buying new things. After all, this is obviously the only part of the economy doing well and magic Wall Street numbers are way more important than people. Or something.
Re: Re: but what if ResMed is right?
Your original fear is correct. Not all covid19 ventilator patients recover. Even if a CPAP ventilator works exactly as promised and approved by the best experts, if a patient dies from other causes, predatory lawyers can still look for juries eager to embrace quackery on behalf of a sympathetic plaintiff. (Look up recent jackpot verdicts against the manufacturer of Round-up.) Only Congress (or perhaps the Administration under emergency powers) can give CPAP’s manufacturer the legal immunity it needs to consider this proposal.
Re: Re: Re: but what if ResMed is right?
"We have a way to save lives, but we’ll hold off because if we try and fail the lawsuits will make it worse for us than if we didn’t even try.". What a sadly, very American, viewpoint on the subject.
Re: Re: Re: but what if ResMed is right?
But even if death could be attributed to an upgraded CPAP machine, liability would attach to whoever performed that upgrade, not the machine’s manufacturer.
Re: Re: but what if ResMed is right?
Even if not unfounded, this is a good idea as a stopgap. Ventilator shortages are a big problem, and if an essentially free update can be applied to thousands of existing pieces of equipment that are already in the possession of hospitals, even an incremental improvement could save a lot of lives, so long as it’s confirmed that no significant new risks are being introduced.
If the choice is "apply a 50% improvement but switch to a proper ventilator when available" or "use nothing and hope people don’t die while waiting", why would you not choose the former?
Re: Re: Re: but what if ResMed is right?
That’s not the only issue though. My mother is a nurse, and while everyone is panicking over how few ventilators their hospital has (12), she keeps trying to point out that they have even fewer nurses capable of operating them! They could have five hundred ventilators and it wouldn’t make a difference…
Re: Re: Re:2 but what if ResMed is right?
That’s true. Which is why the lockdowns etc. have been implemented to try and prevent medical systems from being overrun. But, equally there’s no use having the staff around if they have lots of CPAPs and no ventilators but can’t convert them.
Evil doesn't have a lair, it has a boardroom
Given an option to save lives with a software patch they instead double-down on the more expensive, and therefore profitable, option they are already pushing, using an excuse that has apparently already been shown to be false.
If this pandemic has done one thing very well it has been in showing the true heights that some can rise up to in times of need, and the utter depths of evil that others are quite happy to wallow in.
"We are already exploring that option, but our primary focus is to maximize production of our current ventilation devices, masks, and accessories"
What kind of excuse is that? Operations and Procurement may be busy with get ting parts and making new ventilators but that does not stop Engineering from releasing a patch or Test from verifying it works. The two areas of focus do not conflict – you can do both!
As has been said, obviously more interested in profit than people
An example of how in the medical manufacturing world selling price has no relationship to cost of manufacture, but rather to how desparate the need is.
Re: Re:
That’s supply and demand, which–in a medical emergency–should be irrelevant to pricing because of how many people need the drugs/medical equipment.
Re: Re: Re:
I doubt that unbridled capitalism understands anything you just typed.
Re: Re:
You forgot to include the cost of insurance.
Re: Re: Re:
I don’t know what the word insurance means anymore.
When one encounters an event that hardly ever happens and you lack adequate resources to pay in the limited time afforded … then you might need insurance.
When one encounters an event that happens all the time to everyone and you lack adequate resources to pay in the limited time afforded … the product called insurance is not really insurance – not sure what to call it. Purchasing such their "insurance" product is supposed to save you money but I have yet to see the math. I think they are liars.
Not the first time
I recall upgrading a certain model of IBM laser printer (yes, quite a while ago) from 4 to 8 pages a minute by changing one jumper. It was the only difference between models. Lower production costs (you only vary the jumper and the label on the front) but preserves your ability to charge a premium for the faster model. And sometimes the customer would pay the hefty cost of upgrading an existing printer.
Re: Not the first time
When Intel introduced the 80386 processor they tested each one to find its maximum reliable speed and marked and packaged them by how fast they went. The premium for the faster chips was substantial.
As processes were ironed out, the yield of good chips went up. But Intel didn’t want to give up their pricing scheme, so they modified the clock circuit so that the clock speed could be adjusted by cutting traces. Once they had enough fast chips, they used a laser to cripple each successive speed step so they would run no faster than their price allowed.
And that was before they started shipping chips with internet-accessible hardware back doors…
Over-the-air updates? Are you NUTS?!
As a user of a CPAP device myself, I would be in serious trouble if my CPAP bricked itself because of a flawed — and unnecessary — update.
But more importantly: The CPAP I use (which is, in fact, a ResMed device) is configured by my medical provider – there are damned few user controls available, and the interface is crappy for doing anything complicated. That is not the UI you need for anything like real-time tuning.
We’ve talked on this site before, about updates to hack permissions, OS, functionality. Those have been about cell phones. People don’t rely on cell phones to stay the f— alive on a daily basis. Okay, a bit hyperbolic, but yes, my quality of life would be immensely downgraded without this thing.
You want to talk about case-by-case conversions, sure. But to just push an update and hope for the best? f— that.
"We are already exploring that option" – because our software engineers are people too, read the same news you do, catch the same diseases you do.
"but our primary focus is to maximize production of our current ventilation devices, masks, and accessories". – because we have a lot more people who assemble and ship devices than we have people writing software. And the ventilators don’t require testing to see if the patch works, or whether the hardware collapses after 100 working hours.
Have a little faith. Be careful with your assumptions.
On that last point:
If I’ve told you once, I’ve told you a million times, don’t exaggerate. From Hudson’s article:
That’s counting all devices, all ages, all manufacturers. (And that’s a figure drawn from thin air. 90% of statistics on the internet are bullshit, remember?) The Air-sense 10 is a relatively modern version, by one manufacturer. Yay! How many of them are there? And how many like them, that can be modified easily? How long will it take … per model, per manufacturer?
ANY upgraded CPAPs are better than having NO ventilators. But keep a level head here. You’re not looking at All The World’s ventilator needs being cured by this. You’re looking at Some of those needs being met this way. Maybe.
Re: Over-the-air updates? Are you NUTS?!
According to the article the machines are the same, have the same software, but don’t have the same features enabled. The firmware update would just enable those existing features. I don’t see that there is the problem that you are seeing.
Re: Over-the-air updates? Are you NUTS?!
I don’t imagine an OTA update is meant to upgrade all devices, as people need different things. You realize that they are accessed individually all the time.
Re: Re: Over-the-air updates? Are you NUTS?!
Indeed, it’s push vs. pull. The type of OTA upgrade here would surely be pull (update applied when requested by a specific device) and not push (all devices are updated by a remote broadcast request)
Re: Over-the-air updates? Are you NUTS?!
There are tons of "user controls" available if you enable them. They’re locked down so that users don’t go fiddling with them, spurring potential liability. Most "medical providers" are clueless about them as well, the only thing they’re concerned with is whether the CPAP is being used, not whether it’s being used correctly. It’s all about the compliance, and not the validity of the treatment.
Re: Hardware and Software vs responsibility and indemnity.
TL;DR – well-meaning, unauthorized people modifying existing hardware and wanting support? Fine, first relieve the original vendor from ALL legal peril from ALL potentially affected devices, then we’ll talk.
The problem is: people want things to suddenly move much faster than our existing infrastructure supports. Oh, and it’s not just Play-Doh or Bic Pens we’re talking about, but people’s lives that directly depend upon these things — MAGNITUDES of order more important.
"CPAP: Enabling hidden options." Banners here, get your banners, take your pick:
"Evil Money Grubbing Companies Denying Innocent Hackers Critical Information from Saving Embattered Lives" vs "Misguided Hackers Activating Untested Options in Medical Devices Trying To Save Lives, May Harm or Actually Take Them Instead."
You know what? They’re BOTH right. Companies are in business to … (wait for it) MAKE a PROFIT. They WANT to RECEIVE more money than they SPEND. How horrible, how terrible, how non-Bernie of them.
Some companies Cheat and Steal (and spindle, fold, and mutilate) their customers, providers, overseers, and government. They produce shoddy products that don’t work, are addictive, or even cause harm. Some don’t. Some try their best and are successful, some try and cut some corners and everything’s fine, and some try and are not. (Ford Pinto) Some try and are successful, but find out decades later that things were wrong. (Those Evil Asbestos Companies. By the way, I’m looking at a fireplace that still has it that’s been in use for over 50 years.)
Some people (hackers, whatever) take existing equipment and sometimes "improve" them, sometimes adding, modifying, or even removing features embedded in the software, producing a different, "better" product. [I did that back in 1978 by modifying Okidata dot-matrix printer ROM. We made thousands because I removed functionality and then sold them to radio stations as is.] That’s neither good nor bad, just a system state — but notice that the original company’s name is STILL on the device even though it now acts differently from other "exact" devices even in it’s same manufacturing run. We had them call us for support, but if they’d called Okidata instead, the real company wouldn’t have had a CLUE what was going on.
In my case, I saved them boxes of wasted paper and pages completely full of gibberish. (If you must know, ask.) But if things went wrong, the newsguy just had to find a different source. No one died if my ROM failed, or if the actual modified printer blew up. (I guess it could have burned down a building but we never heard about that — or got caught, anyway.)
A CPAP has motors, sensors, and what-not. A BiPAP has (I assume) more. A true ventilator has much more. IANAL/IAMAD, but watched a Respiratory Therapist critique on YT on the Telsa Ventilator from an engineer describing their build. Among other things, it had: sensors monitoring actual gas intakes and pressure monitors, humidity heaters and sensors, and logging aspects for everything. And that’s not even any masks or breathing options. And I’m sure he omitted some device nuances.
MY CPAP has a humidifier with a manual temperature valve, you set it depending on preference. Mine has a set pressure that it tries to maintain and a few options (kill motor on exhale, ramp down pressure only at initial start / ramp up pressure on each inhale) and I’m sure lots of other options. (I whined at my tech who modified things until he got it right — while I was at home in bed, hitting the "refresh" button occasionally.)
A vent also pulls air outwards like a BiPAP does, so I understand. But a vent can also be placed into "funny" modes, such as quiver (a made-up name, but a nurse friend of mine told me: lung surfaces can sometimes get sticky, and if the insides touch you can’t get them apart, so you must keep them inflated. But if you ONLY keep them inflated then they’re not actually breathing, so you keep things partially pressurized and gently and quickly "puff" air in and out, so they never get a "real breath" but on the other hand keep things inflated WITH continual air exchange.) And who-knows what other odd modes it can do.
And wanting unlicensed devices — I’m the same. At the end of March I called my doctor asking about a DIY poor-man’s ventilator by using my existing CPAP directly fed with O2. But you want to take a Philips ResMed machine and modify it beyond what it’s speced to do? Fine, but then the vendor gets off scott-free no matter what happens. Has the motor been tested for operation for that long? (Of course it has, it’s a 3 to 5 year device. Yes, but for 24 hours a day for weeks in continual operation?) How accurate are the sensors? Are you sure; do they degrade over usage? Because if you put too much pressure in the lungs you can "blow out the air sacs" causing accidental deaths. Real vents add humidity since you’re bypassing the nose that warms the air, but not too much. Oh, out of water? My system doesn’t HAVE a out-of-water alarm, you’re not supposed to be using it that long. I don’t think it has an auto-shutoff, but I’m not 100% sure about that either.
And the kicker: if you’re on a vent, there’s a tube down your throat AND YOU’RE COMPLETELY UNCONSCIOUS. No turning over to crank up the O2 or check the water or handle some beeping alarm, NO UPS backup because you just lost power for only a few minutes. Someone more technical than you dog has to be around and paying intermittent attention to it. And all of those companies are on the hook for providing a registered medical device. YOU pay THEM dearly for it, and THEY pay OUT dearly for development, design, construction, lawyers and government fees. ("My patient died because he put a CPAP up his anus and it blew up his stomach. Jury: his newly-found identical brother gets 1 Billion Dollars in restitution from this evil uncaring company, and 1 Million Dollars from the casket company who couldn’t provide a large enough coffin for the now-missing deceased.")
So: as a culture, we’ve dedicated that the government and the FDA is in control of medical devices, and then make the industry and companies comply with their standards. Fine, most people are happy with that. Now we suddenly want to "hurry up" the available functions that may or may not be embedded within the devices? Maybe that IS an undocumented option that can be enabled without reservation. Maybe it’s reserved for the more-expensive model. Or maybe the code has been swiped from an up-scale machine that supports those functions but now placed in the lower-end machine that doesn’t. Do you STILL want to enable that?
Now to be honest here: YES, yes I do. If there’s absolutely no other option, crank that sucker up to 11 and let’s go. But don’t hold the manufacturer responsible if/when it fails when that’s not what it’s been designed to do. And oh yeah: when we have 1,000 physical vents to 1 operator, are we going to rag on THEM when they don’t manage to keep everyone alive? Oh, this machine has THIS override, that machine has THAT one. That pressure indicator shows high because we’re now running in BiPAP mode. And that purple machine over there only has a 90 hour lifespan, so keep track since it can’t.
This is just a fucking disaster waiting to happen, either in saving lives or in damaging or ending them. And I want one of them as well — if I need it — but don’t blame the vendor if something goes up in smoke when you’re using it out of design specifications. Maybe they did their absolute best. Maybe they didn’t. Maybe they went with the lowest bidder. But now you’ve got some helpful someone that’s flipping hidden switches and doing random things that seem to work? And you’re going to keep the hardware company ONLY completely responsible?
I want THAT job — ALL of the fun and excitement and honor and absolutely NONE of the responsibility. What could go wrong?
Re: Re: Hardware and Software vs responsibility and indemnity.
With covid19, if you need a ventilator, you have a 1 in 5 chance of surviving, and without one, zero. Therefore using a modified ventilator, when nothing better is available, might save your life, and cannot make the outcome worse than not using one.
Re: Re: Hardware and Software vs responsibility and indemnity.
"people want things to suddenly move much faster than our existing infrastructure supports"
People wanted, and were told they were getting, sufficient infrastructure to support future needs. The people have been lied to.
Given the fact that pandemics have occurred in the past, there is ample data from same and there is no doubt that pandemics will occur in the future, why are we never prepared for what will obviously occur again and again? Well, apparently there is no profit from planning for the future and the people are expendable.
Other potential issues
Keep in mind that newer CPAPs are being used, presumably for legitimate medical reasons. You might get a few hundred or even a few thousand unsold CPAPs in the production pipeline, and it is an intriguing idea. However, the "millions" figure seems implausible, even under the best of circumstances and complete manufacturer buy-in.
This is not a situation where you want to repurpose an old, creaky CPAP. In the case of sleep apnea, the CPAP user’s risk goes up slightly if the CPAP keels over. A Covid-19 patient is probably a completely different dependency on breathing assistance.
Re: Other potential issues
If it can give somebody the chance of surviving, which is why there is such a demand for such machines, then it is a risk worth taking.
Re: Re: "Risk worth taking", says some bleeding heart liberal
Taking that risk would put the Corporation in a world of hurt with the SEC, and propagate stockholder litigation for diluting their capital gains. Want some ice cream, my child?
Re: Other potential issues
"This is not a situation where you want to repurpose an old, creaky CPAP. In the case of sleep apnea, the CPAP user’s risk goes up slightly if the CPAP keels over."
It’s also a situation where for many patients, the choice would be "use a creaky old CPAP" or "use nothing and hope that the next delivery of ventilators arrive before the morgue attendant does". Normal cirumstances would mean this was a potentially bad idea (although obviously you’ve be using the newer models first". The current situation means doing nothing because you’re scared the suggested solution is not 100% effective is likely more risky.