Airbreak.dev: Jailbreak your CPAP machine to turn them into ventilators
airbreak.dev
airbreak.dev
- There are established medical protocols to treat COVID-19 patients with BiPAP machines, including the addition of a viral filter to mitigate aerosolizing the virus. People are using these protocols now and we link to them from the site.
- There are two separate firmware hacks presented. The first one modifies ~20 bytes and provides UI access to BiPAP code left in the existing binary, which would allow the more common CPAP machines to fulfill the same limited function. The second is a PoC of a 'full ventilator' mode.
- The manufacturer's CPAP and BiPAP lines have identical mainboard designs and a near identical array of sensors, which provide realtime data including tidal volume calculations. This project exists as a PoC to show that it would be possible - simple, even - for the manufacturer to convert CPAPs to BiPAPs via an OTA update - or, with significantly more effort, to fully featured ventilators. It is likely that they are reluctant to acknowledge this is possible in fear of destroying the market for the BiPAP machines.
- If you are a SleepyHead/OSCAR developer, or have access to an AirCurve S10 and an ST programmer, I would love to talk.
I don't know anything about the devices in question, but from what I know of engineering of medical devices, stating "near identical" makes me listen up.
If these devices malfunction, they could hurt people. I expect a device like this to have an extensive array of sensors and a lot of extra hardware for constant self-monitoring. If the two lines of devices don't have exactly identical hardware, the differences need to be checked carefully. The lower tier device may be missing some capabilities because of that.
Also, it is not obvious that the main development effort for a medical device often isn't about making a device perform its primary function, but to make it incapable of doing anything else. That includes automatic detection of malfunction and appropriate safe modes (simply turning it off may not be safe!). Of course, all of that needs to be tested and validated very thoroughly. If you ever want to use a hacked device on a patient, you will have to prove that it is up to the same engineering standards. That is no simple task, but it beats hurting or killing people because of bugs.
In short, this isn't a job for the regular basement-dwelling hacker, the kind who is happy to have his Roomba drive around with a hacked up firmware. This needs some serious and methodical engineering effort to become practical.
I think that the circumstances under which these are being developed are a special emergency; the alternative to using such a less-safe, makeshift device here would be no ventilator at all, i.e. near-certain death.
In this specific circumstance, I think this sort of criticism should be withheld. I don't think anyone's talking about reflashing CPAPs to be life support outside of a temporary C19 emergency shortage.
I'm not going to put up with "it helps if it saves lives" as a /blanket/ excuse. It fall apart when it saves some and kills others that could have survived.
The team clearly doe know what they are doing, you ha e provided no evidence, except a blanket statement of 'something might go wrong'.
Unless you can actually point to specific issues, your statement is not very useful
This argument came up in the topic of using ventilators for two patients. It came up again in the topic of using home-built devices.
Of course using untested or under-tested equipment is a last resort. In a situation where there are no alternatives and a patient is dying, we do use unapproved drugs under “compassionate use” with much less testing than is otherwise be necessary. Using hacks like this with only some minimum of clinical testing is similar.
I think all your concerns are addressed in the article. They say it’s a proof of concept that needs more validation, as you would expect.
It's also at least implied that they're not necessarily hoping that this project specifically is used to treat COVID-19 patients; it seems the outcome they're hoping for is that this will publicly pressure manufacturers (presumably beyond just Airsense) to release their own firmware update to convert their CPAP machines to BiPAP.
In other words, far from being a semi-organized group of "basement-dwelling hacker"s, ths project has the appearance of being a very well-thought-out one with a clear roadmap.
Since, by your own admission, you nothing about the details here, maybe it would be prudent to dig into the details and to not spread Fear, Uncertainty, and Doubt (FUD) just because you’ve been bitten while working on circuits where “nearly identical“ components often aren’t.
It’s fair to point out for medical equipment, how critical it is that the proper QA be done, to prevent severe injury and possibly death, but the ad-homonym name calling is unnecessary. In fact, there’s a shelter-in-place order in effect in many places, so engineering is being forced to happen in the open, in non-traditional places, including basements.
Like you said, it will have to certified that it’s up to the standards of the FDA before being used in a hospital by a medical professional, so I’m not sure I even see where you’re coming from. We’re not drinking aquarium cleaner here.
The protocol can be bitbanged over GPIO, so for example if you own a Raspberry Pi (or anything similar), all you need to do is to install openocd.
I have an Airsense 10 Autoset for Her (different simpler menus) and was not successful making the extra menus appear.
For example, my CPAP has a CDMA radio inside, which transmits usage data back to the manufacturer & my doctor. Insurance won't pay for it unless the machine tells them I'm using it – so a medical device company has a record of when I sleep and wake, which is mildly unnerving.
Edit: I think sleepyhead[0] was the biggest project when I started looking into it, but it isn't under active development anymore. Apparently forked to OSCAR[1].
Some doctors (mine included) prefer getting your data off the memory card when you visit the office, rather than downloading it from the internet anyway.
The radio has to be optional for people whose beds are in places with unreliable or no cellular service (high up in buildings, in basements, fringe areas, etc...)
I just kinda gave in, to be honest. They're going to get the data anyway, and it is valuable to the doctor. I just don't need the device manufacturer to be storing it.
That said, Resmed provides a nice enough interface where you can track your sleep habits. To be fair it seems all they seem to track is how much you sleep each day, not when, where, etc. So they only collect data on usage, and also they feed some of the data (like detected apnea incidents) to my sleep clinic for review. The medical supply company stops providing the data to my insurance after the probationary period is up. Remember, your insurance already has access to a great deal of your medical information already, this isn't that invasive, and CPAP's are expensive and take a while to adjust to, so I understand why they want to ensure people are using them and they're working if its going to be purchased.
A CPAP machines costs about 10x as much as it should, and a part of that is insurance companies wanting to make sure they are not paying for a device you are not using.
Which then increases the price, which makes insurance companies even more worried about them.
Then you are paternalism where only a Dr. is allowed to change the settings on the machine. So they lock them down, which adds even more to the cost.
And then they are prescription only, so they have to go through specialized distributors because heaven forbid someone actually buy one without a Dr. letting them.
The end result of all this is lots of people making money, and higher costs for the patient in the form of higher insurance premiums.
Disclaimer: my opinions, not my company.
I worked as a project engineer for a major testing company (underwriters laboratories). This is a vast simplification, but in essence the difference between medical device testing verses say, household electronics, is that in practice household electronics get evaluated with a "safety checklist" of all the serious and common problems to that kind of device (plus additional testing if deemed necessary which is not common) that UL and industry have seen over the years.
In contrast, each and every kind medical device is torn apart and subject to a clean evaluation. There are still checklists and common issues they look out for of course, but in practice each device is considered novel while the same is not really true for more common devices.
I think the latter type of testing is fundamentally more expensive, that said I think there are tons of regulatory issues that add to cost - I just want to argue that medical device testing will probably never be cheap.
Testing should be as strict as is needed. I'm arguing/assuming that US testing standards for medical devices is overly strict.
I think* there is the same "maximum" standard for all medical devices. But what's appropriate for a pacemaker is overkill for a CPAP machine.
* but am happy to be corrected (Cunningham's Law)
There are multiple classifications for medical devices.
CPAPs are class 2 devices whereas a pacemaker is class 3. I don’t want to over simplify, so I will link you to the FDAs entry point into the Byzantine maze of classifications.
https://www.fda.gov/medical-devices/overview-device-regulati...
The machines are also not locked down, however they do still require a prescription so that part of the cost still exists.
Insurance is nice because they pay for the supplies (some of which are supposed to be replaced pretty frequently). However, I've found that it's pretty easy to stretch the life of any component, as long as you clean it thoroughly each day.
And I totally agree about the CPAP – any morning after I accidentally take it off in my sleep (pretty rare, but happens especially as the seasons change), I feel like absolute garbage. It's amazing what actually breathing through the night can do for you.
Simply sleep with an APAP for a week, review the pressure graph and draw a line at the bottom of the values. Then set the minimum pressure to that number, or slightly less and done.
Review every few months.
If you ask a Dr. about this they'll talk about the 1% of less cases that will not be correctly adjusted by such a machine. But all you need to do is ask the patient after a week "do you feel better?". If they say no you can go for the more complicated options.
The vast majority of patients take months or longer to get acclimated to the machine. Most will say they feel /worse/, because the machine gets in the way of their sleep at first.
I look forward to hearing more medical pearls from the web design community.
5, 6 hours in a base minimum for me to not feel sluggish and possibly even start the day with a headache.
Sounds like your experience is with much older machines. Is that reasonable to say?
Also: wore it 8 hours the first night, and every night since. Not that hard to get used to.
Admittedly, (b) is now less of an issue since there are a handful of auto-titrating machines on the market now. They’re less reliable than a sleep study, but they’re better than nothing.
It is true that other things can be the issue. There is a place for sleep studies, and at home sleep studies can detect sleep apnea fast and cheaply, and should be the first option, unless some other ?neurological? symptom is already presenting itself.
This is used to justify eyeglass prescriptions.
This bullshit really needs to go, especially for eyeglass prescriptions. Making people wait weeks for another eye exam when their glasses break after the first year is honestly bullshit.
(In some parts of CA, Heal will send a doctor to your house for a one-time fee of $159. And after my mom complained to said doctor about my snoring, their doctor ordered me a sleep study. So yes, that's one way to get it.)
That said, out here, most of the small independent offices that used to exist have been bought out by one of 3 medical groups. And with the large medical groups it's pretty hard to get a concrete number sometimes.
Like all medical things they're (a) expensive (b) limited in supply (c) you don't have the knowledge, experience or impartiality to self-diagnose (d) you can't tell whether you need the device but buying it anyways removes limited supply from the market (e) you don't know how to calibrate it (f) you might hurt yourself.
Same reason it's insane Americans are allowed to self-refer to specialists: you don't know which specialist you need, you don't know whether you need a specialist at all, there's a limited quantity and you're likely just squandering a valuable resource.
In both cases letting unqualified end users have at it could just as easily increase the price not decrease it.
Glasses, though, no excuse.
If you look just at BOM, I am sure my insulin pump must seem the same way (about $3500); but the technical support from Medtronic is top notch and the devices are not mass market; probably only about 100,000 of them each year (just based on a 4 year warranty period, which is when your insurance covers them, and a quick google showing about 350,000 on them).
I do think there is a bit of a razor blade model here though, given that the consumables will cost nearly as much as the pump over the course of a year.
Think I’ve spent $120 for the machines, the headgear costs (supplier) are overpriced. But you can look for one of those online shops and wait for 4-pack specials, got 16 pillows for $150. Not an expense I can complain about.
> Insurance won't pay for it unless the machine tells them I'm using it
On a more serious note, this is a new world of crazy for me I wasn't aware of. I wonder how difficult it would be to push forged data back to the monitoring agency with physical access to the machine with an independent setup. Then, simply put your actual device in a Faraday cage so you can still use your device as needed, with insurance covering it, without insurance invading your privacy and likely using that data for other unscrupulous purposes as well.
From prior work in the industry, durable medical equipment is one of the most targeted areas for scams.
Relatively high cost, amortized over an extended utilization time.
I'm not particularly surprised that insurance companies (and therefore manufacturers that are supplying them) include such features. It'd be borderline negligent from a financial perspective not to.
> But as doctors learn more about treating Covid-19, and question old dogma about blood oxygen and the need for ventilators, they might be able to substitute simpler and more widely available devices.
and
> "In a small study last week in Annals of Intensive Care, physicians who treated Covid-19 patients at two hospitals in China found that the majority of patients needed no more than a nasal cannula."
1 - https://www.statnews.com/2020/04/08/doctors-say-ventilators-...
Maybe not overused, but wrongly applied. He cites a doctor from new york in the video and two sources in the video description.
CPAP ----questionable software hackery ----> BiPaP --- questionable hardware hacking ---> Ventilator
This is hubris. Ventilators are not iPhones circa 2010. It's irresponsible for non-medical researchers to not only pursue, but also disseminate, these jailbreaks. A significant portion of medical device RnD is related to creating technology that is hard to misuse and won't result in accidental death, and I just don't see that here.
The people relying on these hacks would be definitely dead without the hacks, that is the point. Even if the chances of this working successfully are only 10%, you just saved 10% of the patients compared to 0%.
Source: https://www.cultofmac.com/192850/the-history-of-jailbreaking...
First, do no harm.
The Italians are using adapted CPAP machines as well.
This is simply wrong, both from a user perspective and a general research perspective.
Positioning a jailbreak like this as a solution to general vent shortage may be irresponsible if it leads to people trying to treat others instead of relying on doctors, but going beyond that is ignoring the good that's come from work like this.
Hacked up and jailbroken insulin pumps have been a thing for years, often to get increased safety over what manufacturers can provide: https://medium.com/neodotlife/dana-lewis-open-aps-hack-artif...
There's also a history of people unlocking and altering settings in CPAP/BiPAP devices in response to data (many providers treat them as set and forget devices and don't bother reviewing logs except for initial patient compliance).
Beyond people hacking their own devices, we've seen that security of medical devices wouldn't improve without independent researchers highlighting the flaws and driving them to fix them: https://www.cnbc.com/2018/08/17/security-researchers-say-the... and https://www.darkreading.com/vulnerabilities---threats/lethal...
If anything, at least in the American context, I'm more worried about running out of the sedative necessary for ventilation.[1]
I have nothing against hardware hacking in non-pandemics. If you want to hack your own insulin pump or create epi-pens on your own (non-crisis) time, that's fine by me.
But I think the cost-benefit-risk analysis changes in pandemics, because people are too hungry for easy fixes and make ill-advised decisions under pressure. For example, even doctors (ostensibly medically-literate professionals) are prescribing themselves hydrochloroquine [2], which does not seem to be a miracle cure and sometimes, itself, dangerous (and also leaves lupus sufferers at risk of a disrupted supply chain).
[1] https://www.vox.com/2020/4/6/21209589/coronavirus-medicine-v...
[2] https://www.nytimes.com/2020/04/12/health/chloroquine-corona...
Are you really not going to just google "USA ventilator shortage"?
Also BiPaP machines require the same hack as CPAP machines. And of course a further hack for invasive intubation (which ventilators can do out of the box), though you aren't going to do that to your nightstand CPAP machine either.
Anyways, rest assured that the few people who can be bothered to jailbreak their CPAP machine are not the same kind of people who drink their koi pond cleaner. I think this kind of fear about people hacking their gadgets is misplaced.
It also reeks of what I can only register as this weird "doc knows best" subservience to the medical system. This is probably the weirdest meme I see on HN. And, as people upstream point out, nobody out there is paying attention to your insulin pump or CPAP machine settings. They just leave it on whatever default setting. It's all entirely on you to do the research to improve things for you.
There are stories about NYT hospitals doubling up patients on ventilators, but those stories are explicit about the fact that those hospitals have not run out of vents, and are instead working out the protocols for sharing them when/if it becomes necessary.
This sort of hack still requires that someone makes those things at scale. That's a supply chain issue, same as taking an existing, proven and actually certified design and manufacturing it at scale. Hacking up a few CPAP machines really doesn't solve the problem when the hospitals need tens of thousands ...
Even if we ignore the legal and medical bits (only in an extreme emergency with no other options and where the alternative is an inevitable death would anyone even contemplate using something like this on a patient), this machine isn't really a ventilator suitable for people with failing lungs. Patients that have to be intubated and the machine actually breathes for them, filters, humidifies and warms the air, allows sucking of phlegm without spewing virus everywhere ... And those are the machines that are in short supply. This hack doesn't do anything from that.
And finally, it doesn't address the issue of having enough trained staff that will operate and supervise the ventilators - these things have to be supervised 24/7, sometimes for weeks. One ICU nurse is commonly supposed to handle up to 6 patients, tops. You can't just add ventilators without adding nurses, because if anything goes wrong, people will die - and where do you get those nurses from? Especially if they have to deal with a gizmo that isn't as failsafe as a real ventilator (because it wasn't meant to be)? If you need more staff to run fewer ventilators/beds, then you haven't really solved anything, have you?
And the lack of trained staff is not something a jailbreak or an Arduino can solve.
People should stop messing with building "ventilators" and focus on things where they can actually make a difference - e.g. the production of face masks, face shields and similar gear, which are in extremely short supply and don't require much sophistication to build. That would make a much bigger difference than pretending that we are somehow solving the lack of ventilators with hacked CPAP machines ...
If that means taking already made CPAP machines and modifying them, that’s in bounds as far as I can judge.
The reason for the underbelly trend of certain types of people to not trust doctors and scientists is a lack of trust in the system (medical system, science system, etc). The root of this for some people can be tied to this exact condescending attitude towards people.
Nobody responds to being told something is a bad idea, they only respond to understanding why it could be a bad idea and being allowed to decide for themselves, and your attempt at preventing them from deciding in a way you don't like how they treat their own body only furthers the rift that powers essential oil huns.
Me personally, If my local hospitals are out of ventilators and i'm showing signs of URD i'm gonna hack my autoset with this firmware to get the higher pressures needed for peep therapy and not bother going in. There isn't anything you can do to stop me. I might even do it even if they aren't out, as i would be able to start therapy sooner and potentially heed off snowball effects from a lower blood oxygen level on my immune system.
Attitudes like yours create, feed, and recruit anti-vaxxers and essential oil huns, and harm that does, is far greater than somebody hacking their own cpap machine for whatever ends.
If you're conscious you'll just pull the mask off if you start feeling like you are not getting the right air. These machines, and masks, have all kinds of safety features and safety valves on them.
I have a CPAP, oxygen concentrator and assorted hoses and masks, and I've messed around with them these days while watching ventilator 101 videos on YT. If you're a technical person, the basics are not that hard to grasp.
And I've bought the machine specifically for coronavirus, since my country health system is quite poor, I don't use it during the night.
Even as someone with just vanilla sleep apnea I'll occasionally strap mine on for a while when suffering from a head cold...certainly helps open things up.
I am not an RT but I worked for a ventilator company for like 4 years.
Wait, how does this help? Does this clear up stuffed nose and such?
Edit: I was wrong, see below
When I'm using my CPAP, my mouth is closed and I'm asleep. I'm breathing through my nose, which has hairy filters in it, plus a mask that has a filter on its exhaust, plus the machine has a filter on its inlet.
Please stop the knee-jerk reactions. CPAP devices and aerosolized droplets are a problem if you know the patient is infected and you are up close to them putting the masks on.
There's a special, enhanced, risk with CPAP that authoritative medical sources warn about.
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3338532/
Let's be civil here and assume good faith.
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3338532/
I'm not sure I get your point. Did you have one?
In a hospital setting (aka an emergency), it's less of an issue. The situation that would warrant this would likely also warrant full PPE just to enter a unit or building.
Isn't it still important not to spray covid everywhere?
See for example this post: https://emcrit.org/emcrit/covid-airway-management/
> Critical Note: If you use the vent for preox, you MUST disconnect the vent circuit proximal to the viral filter before removing the mask. Otherwise, COVID will be sprayed all around the room!!!!! See Triple C below.
{EDIT: genuinely don't know why this got downvotes.}
Even at that high setting it does not affect your lungs ... the purpose of a CPAP is keep your upper airways open i.e back of your throat ... you still need to breath on your own.
In any case, a standard Resmed CPAP like the one in the article has a humidifier built in, and if you buy the optional heated hose, it can heat the air too. The tank is kinda small on the humidifier, so you'd have to refill it pretty often. Probably want to hack it into having a lot more volume, if you need the humidity.
Many (most?) CPAP's do that. When you have to fill the reservoir every night you get an interesting perspective on the amount of water you breathe in eight hours.
I accidentally found out one night that I don't need the air to be humidified. That was a revelation, and one that's saved me a lot of work since.
https://www.nytimes.com/2020/04/14/nyregion/new-york-coronav...
https://twitter.com/libbyg9/status/1243813444689821696?s=20
https://www.youtube.com/watch?v=FS4t5w1eCYw
Proning can be done to intubated patients too.
I suffer chronicle dry nose, moderate empty nose syndrome on the right side (due to surgery done 20 years ago in China), and Deviated Septum (due to injury as kid). One thing often happen to me is during middle of nigh sleep, my left nose duct will be extremely dry, causing me to wake up and switch side (it seems my nasal cycle is completely gone).
One idea I wanted to try to fix is to use a cpap + humidifier to pump moisturized air.
And I found that I have to get prescription, which I tried with one lab sleep study causing $3000+, and concluded that I do not have sleep apnea, which is one of the symptoms to qualify cpap prescription.
Then I started to look for off market cpap machine on Craigslist. No luck, the machines are often old, and beat up after long usages.
I did not seriously research if cpap has risks to normal people. But it does not seem harmful, unfortunately it has to be regulated and possibly also become very expensive.
Edit: Thanks for the good recommendations. Buying from Chinese site (I often forgot this), nebulizer, etc.
It sounds what Naughty Dog did to get RAM on the PSX for Crash Bandicoot ... they grabbed memory already allocated by the Sony runtime libs and would use it if it not do anything bad.
A crashing game console is not a ventilator but a good hack nonetheless.
1) They are increasing maximum pressure and pressure rate changes beyond the built-in design parameters. If these new parameters are outside what the engineering requirements document spec, these changes are a problem in seeking EUA.
2) In regulatory affairs, authorized, cleared, and approved have very specific (and enforceable) meanings. If someone is loose with how they use these words, it suggests they don’t have someone with regulatory experience involved (a negative sign). The earlier the team can engage with someone with regulatory experience, the better.
The other thing ventilators typically include is pressure alarms and high pressure limits. Under routine use the high pressure limits keep you from popping patient lungs in volume-controlled modes. A pressure-controlled mode like BiPAP may be okay in this case since it provides those limits. The downside of pressure-control is that the patient's lung compliance and alveolar recruitment may change, so you can start off delivering a certain tidal volume at a certain pressure and then because of compliance changes the patient's alveoli lose the ability to contain the same volume of air, so the patient is losing oxygenation unless you change the settings.
My point is that there are a lot of considerations beyond simply delivering a fixed pressure of gas into a patient's lungs and hacking a CPAP may not meet those requirements.
There appears to be a deep lack of regulatory experience, along with a deep lack of QC, and it's presented as a jailbreaking, i.e., what is done to your phone.
Some kinds of regulations are written in blood, or, in this case, bloody sputum.
A lament, I wish it were possible to convince tech people that they are not the only clever people in the world: regulatory bodies and medtech and pharma companies are packed with equally clever people, who are quite capable of moving fast but without breaking things, that have an unmatched advantage in having domain experience (part of which is a healthy respect/fear of the unknown in medicine, like you say, regulations are written in blood). It would be a lot more productive to support those people than to do these hackathon projects.
I love this idea though. The manufacturers should get onboard with “emergency BiPAP” mode to make this happen without users having to do an elaborate hack.
This was the case with the ventilators from a consortium in the UK, where the profile of corona requires more complex ventilation -
https://www.theguardian.com/world/2020/apr/13/uk-scraps-plan...