Hacker News new | past | comments | ask | show | jobs | submit login
Airbreak.dev: Jailbreak your CPAP machine to turn them into ventilators (airbreak.dev)
463 points by yarapavan on April 14, 2020 | hide | past | favorite | 186 comments



Hi, I worked on this project and have a couple comments to address the issues people are raising.

- There are established medical protocols to treat COVID-19 patients with BiPAP machines, including the addition of a viral filter to mitigate aerosolizing the virus. People are using these protocols now and we link to them from the site.

- There are two separate firmware hacks presented. The first one modifies ~20 bytes and provides UI access to BiPAP code left in the existing binary, which would allow the more common CPAP machines to fulfill the same limited function. The second is a PoC of a 'full ventilator' mode.

- The manufacturer's CPAP and BiPAP lines have identical mainboard designs and a near identical array of sensors, which provide realtime data including tidal volume calculations. This project exists as a PoC to show that it would be possible - simple, even - for the manufacturer to convert CPAPs to BiPAPs via an OTA update - or, with significantly more effort, to fully featured ventilators. It is likely that they are reluctant to acknowledge this is possible in fear of destroying the market for the BiPAP machines.

- If you are a SleepyHead/OSCAR developer, or have access to an AirCurve S10 and an ST programmer, I would love to talk.


What are the differences in the sensors?



The hack only works when using the exact firmware it was made for (obviously, but still unfortunately).

I have an Airsense 10 Autoset for Her (different simpler menus) and was not successful making the extra menus appear.


i don't know what you mean by "ST" programmer, but i'm a dev and i have an aircurve 10. do you need something?


I think it means ST-Link-compatible programmer, a device used to flash/debug ST chips. You can see a big STM32 MCU on one of the FCC ID photos.

The protocol can be bitbanged over GPIO, so for example if you own a Raspberry Pi (or anything similar), all you need to do is to install openocd.


ah, well if OP wants me to get one and do something with it and my bi-pap i'm happy to help.


> a near identical array of sensors

I don't know anything about the devices in question, but from what I know of engineering of medical devices, stating "near identical" makes me listen up.

If these devices malfunction, they could hurt people. I expect a device like this to have an extensive array of sensors and a lot of extra hardware for constant self-monitoring. If the two lines of devices don't have exactly identical hardware, the differences need to be checked carefully. The lower tier device may be missing some capabilities because of that.

Also, it is not obvious that the main development effort for a medical device often isn't about making a device perform its primary function, but to make it incapable of doing anything else. That includes automatic detection of malfunction and appropriate safe modes (simply turning it off may not be safe!). Of course, all of that needs to be tested and validated very thoroughly. If you ever want to use a hacked device on a patient, you will have to prove that it is up to the same engineering standards. That is no simple task, but it beats hurting or killing people because of bugs.

In short, this isn't a job for the regular basement-dwelling hacker, the kind who is happy to have his Roomba drive around with a hacked up firmware. This needs some serious and methodical engineering effort to become practical.


You're being exceedingly uncharitable in characterizing the team that is working on this the way you do in the last paragraph. The article is littered with disclaimers about the current state of the project. They're very quick to point out that this is only a proof-of-concept, that expert review is ongoing and not complete, and that FDA approval needs to be sought before this can be used to treat COVID-19 patients.

It's also at least implied that they're not necessarily hoping that this project specifically is used to treat COVID-19 patients; it seems the outcome they're hoping for is that this will publicly pressure manufacturers (presumably beyond just Airsense) to release their own firmware update to convert their CPAP machines to BiPAP.

In other words, far from being a semi-organized group of "basement-dwelling hacker"s, ths project has the appearance of being a very well-thought-out one with a clear roadmap.


No, I am not implying that this specific project is handled particularly unprofessionally. I want to warn people off who might think that they could just hack devices and put them to use on patients. This stuff requires serious expertise and if you don't have access to it, your effort is for entertainment only.


Hospitals are already pressing CPAP machines into service in this way, this firmware hack is only making the devices more fitting for the role they're being asked to fulfill in exigent circumstances.


> If these devices malfunction, they could hurt people.

I think that the circumstances under which these are being developed are a special emergency; the alternative to using such a less-safe, makeshift device here would be no ventilator at all, i.e. near-certain death.

In this specific circumstance, I think this sort of criticism should be withheld. I don't think anyone's talking about reflashing CPAPs to be life support outside of a temporary C19 emergency shortage.


The YouTube channel Real Engineering has a great video breaking down why that might not actually be true. The possibility that makeshift devices could cause barotrauma and make things worse seems quite significant. You can check it out here if your interested: https://www.youtube.com/watch?v=7vLPefHYWpY


I just watched the video. I'm not sure what outcome is worse than "you need a ventilator, but we are out of all of the safe, high-quality ones, and so you will now suffocate and die". In that circumstance I am certain that very nearly 100% of patients would accept potential barotrauma versus the alternative.


If we're to keep it real, my understanding is that, if you have COVID-19 and need ventilation but can't get it, you're all but guaranteed to die. So, assuming a real ventilator is not available, then avoiding makeshift measures due to worries about barotrauma seems to me to be somewhat akin to saying that people shouldn't administer CPR because it's likely to break ribs.


In these circumstances, this kind of criticism is especially necessary. It's easy to feel like you're doing the right thing and that you're helping people when you set out to hack medical devices. The truth is that you should only even think of doing it as a team with a leadership that understands the full engineering requirements for such a device completely and is very professional about it, including following strict processes (testing separated from development, test documentation, etc...). The consequences of sloppy work in that field can be extreme.

I'm not going to put up with "it helps if it saves lives" as a /blanket/ excuse. It fall apart when it saves some and kills others that could have survived.


I am sorry but that statement cuts no ice with me.

The team clearly doe know what they are doing, you ha e provided no evidence, except a blanket statement of 'something might go wrong'.

Unless you can actually point to specific issues, your statement is not very useful


> I don't know anything about the devices in question,

Since, by your own admission, you nothing about the details here, maybe it would be prudent to dig into the details and to not spread Fear, Uncertainty, and Doubt (FUD) just because you’ve been bitten while working on circuits where “nearly identical“ components often aren’t.

It’s fair to point out for medical equipment, how critical it is that the proper QA be done, to prevent severe injury and possibly death, but the ad-homonym name calling is unnecessary. In fact, there’s a shelter-in-place order in effect in many places, so engineering is being forced to happen in the open, in non-traditional places, including basements.

Like you said, it will have to certified that it’s up to the standards of the FDA before being used in a hospital by a medical professional, so I’m not sure I even see where you’re coming from. We’re not drinking aquarium cleaner here.


> I expect a device like this to have an extensive array of sensors and a lot of extra hardware for constant self-monitoring. If the two lines of devices don't have exactly identical hardware, the differences need to be checked carefully. The lower tier device may be missing some capabilities because of that.

This argument came up in the topic of using ventilators for two patients. It came up again in the topic of using home-built devices.

Of course using untested or under-tested equipment is a last resort. In a situation where there are no alternatives and a patient is dying, we do use unapproved drugs under “compassionate use” with much less testing than is otherwise be necessary. Using hacks like this with only some minimum of clinical testing is similar.

I think all your concerns are addressed in the article. They say it’s a proof of concept that needs more validation, as you would expect.


The CPAP jailbreak community was eye-opening when I first learned of it. I never expected something like that, but with the draconian policies it's not surprising.

For example, my CPAP has a CDMA radio inside, which transmits usage data back to the manufacturer & my doctor. Insurance won't pay for it unless the machine tells them I'm using it – so a medical device company has a record of when I sleep and wake, which is mildly unnerving.

Edit: I think sleepyhead[0] was the biggest project when I started looking into it, but it isn't under active development anymore. Apparently forked to OSCAR[1].

[0]https://gitlab.com/sleepyhead/sleepyhead-code

[1]https://gitlab.com/pholy/OSCAR-code


The CPAP world is a microcosm of what's wrong in the medical world, i.e. why things cost so much.

A CPAP machines costs about 10x as much as it should, and a part of that is insurance companies wanting to make sure they are not paying for a device you are not using.

Which then increases the price, which makes insurance companies even more worried about them.

Then you are paternalism where only a Dr. is allowed to change the settings on the machine. So they lock them down, which adds even more to the cost.

And then they are prescription only, so they have to go through specialized distributors because heaven forbid someone actually buy one without a Dr. letting them.

The end result of all this is lots of people making money, and higher costs for the patient in the form of higher insurance premiums.


One thing about Kaiser CA, they’re very proactive about OSA. Free take home test rig (must be back by 9am), and the sleep specialist pushed a higher end CPAP, 3 masks, 3 pillow types into my hands and said I’d get a 10% copay call. Followup on choosing right mask/pillow, and when my machine starting whistling after 4 years, doc emailed the sleep specialist and they gave me a new machine with no copay. No telemetry.

Think I’ve spent $120 for the machines, the headgear costs (supplier) are overpriced. But you can look for one of those online shops and wait for 4-pack specials, got 16 pillows for $150. Not an expense I can complain about.


"A CPAP machines costs about 10x as much as it should, and a part of that is insurance companies wanting to make sure they are not paying for a device you are not using."

If you look just at BOM, I am sure my insulin pump must seem the same way (about $3500); but the technical support from Medtronic is top notch and the devices are not mass market; probably only about 100,000 of them each year (just based on a 4 year warranty period, which is when your insurance covers them, and a quick google showing about 350,000 on them).

I do think there is a bit of a razor blade model here though, given that the consumables will cost nearly as much as the pump over the course of a year.


Its worse than that. Before receiving a CPAP machine ~$1,000, most doctor's require a sleep study, which costs many thousands of dollars, and many times wait months to get the appointment. CPAP machines are usually the ultimate solution to reported sleep problems involving repeatedly waking up, and I don't see why they can't be prescribed immediately to see if they solve the problem.


Because (a) there are problems that are not sleep apnea that should not be missed, and (b) the cpap pressure needs to be titrated to your need, it’s not a binary device.

Admittedly, (b) is now less of an issue since there are a handful of auto-titrating machines on the market now. They’re less reliable than a sleep study, but they’re better than nothing.


Yeah, the newest modern CPAP machines auto-titrate. On your back? It ups the pressure if it detects less breathing. On your side, it will lower the pressure. Its quite nice. I have a ResMed AirSense 10 for two years now...but I imagine if I had got my machine a few years earlier it would have been different.

It is true that other things can be the issue. There is a place for sleep studies, and at home sleep studies can detect sleep apnea fast and cheaply, and should be the first option, unless some other ?neurological? symptom is already presenting itself.


I have a Resmed S8 that is now at least 10 years old. They had APAP then, so it's not a new option.


My insurance wouldn't even pay for a monitored sleep study before I did an at-home study. Luckily, the at-home device showed moderate apnea, so I didn't have to do the lab study.


That's what they did for me as well, but not for other people I know living in a less affluent area of California. The take-home solution is much more cost-effective, it is a wonder that it hasn't been adopted universally. Also, I LOVE my CPAP.


That's fair, I only know what happened at Stanford. Side note to anyone reading this: don't go to the sleep clinic at Stanford. If your doctor refers to there, ask for another referral. There's a reason they have 1.5 stars on Yelp...

And I totally agree about the CPAP – any morning after I accidentally take it off in my sleep (pretty rare, but happens especially as the seasons change), I feel like absolute garbage. It's amazing what actually breathing through the night can do for you.


Why is a prescription required anyway?


In most medical devices anything, prescription is justified the same (read in a mocking voice) "There could be another reason for those symptoms so if we don't gate your access behind an expensive doctors visit you could treat the wrong thing and die"

This is used to justify eyeglass prescriptions.

This bullshit really needs to go, especially for eyeglass prescriptions. Making people wait weeks for another eye exam when their glasses break after the first year is honestly bullshit.


> "There could be another reason for those symptoms so if we don't gate your access behind an expensive doctors visit you could treat the wrong thing and die"

Like all medical things they're (a) expensive (b) limited in supply (c) you don't have the knowledge, experience or impartiality to self-diagnose (d) you can't tell whether you need the device but buying it anyways removes limited supply from the market (e) you don't know how to calibrate it (f) you might hurt yourself.

Same reason it's insane Americans are allowed to self-refer to specialists: you don't know which specialist you need, you don't know whether you need a specialist at all, there's a limited quantity and you're likely just squandering a valuable resource.

In both cases letting unqualified end users have at it could just as easily increase the price not decrease it.

Glasses, though, no excuse.


I though eyeglasses prescriptions were to assess the right "myopia settings" (not sure what the right word is)?? I guess they should stay valid for some period of time, like 1-5 years, in case you break your glasses, but presumably your sight can change (worsen) over time so another exam is a good thing.


cpaps are in a different ballpark than doctor visits! If you hunt around, you should be able to see a doctor for $100-ish. (Edit: of course, $100-ish is still a large amount of money)

(In some parts of CA, Heal will send a doctor to your house for a one-time fee of $159. And after my mom complained to said doctor about my snoring, their doctor ordered me a sleep study. So yes, that's one way to get it.)

That said, out here, most of the small independent offices that used to exist have been bought out by one of 3 medical groups. And with the large medical groups it's pretty hard to get a concrete number sometimes.


I think you may be able to.purchase one, but if you want insurance to cover it....


To keep the ponzi going


Completely agree. And the worst part is sleep studies are medically unnecessary - an APAP machine (automatic machine) can auto-set the necessary pressure, and no sleep study is needed.

Simply sleep with an APAP for a week, review the pressure graph and draw a line at the bottom of the values. Then set the minimum pressure to that number, or slightly less and done.

Review every few months.

If you ask a Dr. about this they'll talk about the 1% of less cases that will not be correctly adjusted by such a machine. But all you need to do is ask the patient after a week "do you feel better?". If they say no you can go for the more complicated options.


Hahahahah. Oh man.

The vast majority of patients take months or longer to get acclimated to the machine. Most will say they feel /worse/, because the machine gets in the way of their sleep at first.

I look forward to hearing more medical pearls from the web design community.


Apparently I'm an outlier then, I got used to it in under a week, and swear by it. If my wife and I stay up late and get short hours on machine, or nap in the living room instead of upstairs and on machine, I know it the next day.

5, 6 hours in a base minimum for me to not feel sluggish and possibly even start the day with a headache.


I think the autotitration helps acclimation...and for me, I was so anxious for relief, I was acclimated before I even got the machine.


I bought a CPAP off an Amazon seller here in Canada a few years back. I have a large neck and would wake up gasping for air in the night. It was going to be several months to get the sleep study so one day I impulse bought it. First night I slept 8 hours, couldn't remember the last time I did that. Best $600 I ever spent.


Or how about from people who have actually used them? I put getting a study for years because the whole thing seems such a massive scam. Shame on me: I really needed a bipap, and now I feel so much better. But I could have figured this out by trying one for a week, as others have suggested. It blows air into my nose, for heaven’s sake. How many years of med school does it take to learn about that?

Also: wore it 8 hours the first night, and every night since. Not that hard to get used to.


You know CPAP has 50% compliance right? A huge amount of patients never get used to it. And even of those that stick to it, they struggle through the night with it. They define successful CPAP treatment as 4 hours or more a night, when 4 hours is obviously insufficient.


I'll chime in with the sibling comment. I felt immediately better after getting an APAP, within the first few days of using it. And my doctor didn't set specific pressure point but rather a range which we've never adjusted. And from memory that conversation was "I'm going to put it within these broad bounds and let it find the right place during the night. If it's not working for you come back in and we'll figure it out."


The vast majority of patients take months or longer to get acclimated to the machine

Sounds like your experience is with much older machines. Is that reasonable to say?


No. Last time I worked shifts in a pulm/sleep medicine clinic was about 18 months ago.


Maybe it's my bias, but I assume most of that 10x comes from the overly strict medical device regulations from the FDA.


>overly strict

Disclaimer: my opinions, not my company.

I worked as a project engineer for a major testing company (underwriters laboratories). This is a vast simplification, but in essence the difference between medical device testing verses say, household electronics, is that in practice household electronics get evaluated with a "safety checklist" of all the serious and common problems to that kind of device (plus additional testing if deemed necessary which is not common) that UL and industry have seen over the years.

In contrast, each and every kind medical device is torn apart and subject to a clean evaluation. There are still checklists and common issues they look out for of course, but in practice each device is considered novel while the same is not really true for more common devices.

I think the latter type of testing is fundamentally more expensive, that said I think there are tons of regulatory issues that add to cost - I just want to argue that medical device testing will probably never be cheap.


I don't disagree.

Testing should be as strict as is needed. I'm arguing/assuming that US testing standards for medical devices is overly strict.

I think* there is the same "maximum" standard for all medical devices. But what's appropriate for a pacemaker is overkill for a CPAP machine.

* but am happy to be corrected (Cunningham's Law)


Your are partly correct.

There are multiple classifications for medical devices.

CPAPs are class 2 devices whereas a pacemaker is class 3. I don’t want to over simplify, so I will link you to the FDAs entry point into the Byzantine maze of classifications.

https://www.fda.gov/medical-devices/overview-device-regulati...


It doesn't. You can buy CPAP machines from manufacturers that don't work with insurance companies for far less (around 1/4 of the price).

The machines are also not locked down, however they do still require a prescription so that part of the cost still exists.


You can also buy them used, which is perfectly legal.

Insurance is nice because they pay for the supplies (some of which are supposed to be replaced pretty frequently). However, I've found that it's pretty easy to stretch the life of any component, as long as you clean it thoroughly each day.


Why was this downvoted? Do people here seriously believe that the US doesn't have a system of crony capitalism? Is it so implausible to believe that regulations, while created with the best intent, are not susceptible to corruption via lobbying by powerful corporations to keep competitors out of the market?


Once the insurance has finished paying for it (eight months in my case), you can disable the radio.

Some doctors (mine included) prefer getting your data off the memory card when you visit the office, rather than downloading it from the internet anyway.

The radio has to be optional for people whose beds are in places with unreliable or no cellular service (high up in buildings, in basements, fringe areas, etc...)


Yeah the radio is there as an added convenience so you don't have to keep a log and send it in for several months as evidence of usage. This is the fallback for those without radio, and its easy enough to put it in airplane mode.

That said, Resmed provides a nice enough interface where you can track your sleep habits. To be fair it seems all they seem to track is how much you sleep each day, not when, where, etc. So they only collect data on usage, and also they feed some of the data (like detected apnea incidents) to my sleep clinic for review. The medical supply company stops providing the data to my insurance after the probationary period is up. Remember, your insurance already has access to a great deal of your medical information already, this isn't that invasive, and CPAP's are expensive and take a while to adjust to, so I understand why they want to ensure people are using them and they're working if its going to be purchased.


That app isn't available everywhere though. I bought a secondary unit recently and I can't register it with the app (that I can't even download if I remember correctly). At least my other CPAP has an SD card.


The app was just a website. The whole thing was administered through my doctor/supplier when they programmed the thing. It is a bit locked down, but I think its because its a machine that's "prescribed".


I actually already have the option of disabling it (it has an airplane mode), but it spams me to turn the network back on.

I just kinda gave in, to be honest. They're going to get the data anyway, and it is valuable to the doctor. I just don't need the device manufacturer to be storing it.


IIRC the data sent over the cellular connection is just summary information, it doesn't contain a full dump of the detailed measurements that will be stored on the SD card.


You might also find the hacks for diabetes pumps to create closed loops equally fascinating. That and all the projects around it like Nightscout [0].

[0] http://www.nightscout.info/


Don't really know how viable this question is, but for curiousity's sake, is it possible to build a Faraday cage around the machine?


How would that help with this part:

> Insurance won't pay for it unless the machine tells them I'm using it


You instead need to throw most the board of directors of the insurance provider and device manufacturer in question into a Faraday cage, lock it, and walk away.

On a more serious note, this is a new world of crazy for me I wasn't aware of. I wonder how difficult it would be to push forged data back to the monitoring agency with physical access to the machine with an independent setup. Then, simply put your actual device in a Faraday cage so you can still use your device as needed, with insurance covering it, without insurance invading your privacy and likely using that data for other unscrupulous purposes as well.


Might we want to consider that medical insurance fraud is in fact a serious concern?

From prior work in the industry, durable medical equipment is one of the most targeted areas for scams.

Relatively high cost, amortized over an extended utilization time.

I'm not particularly surprised that insurance companies (and therefore manufacturers that are supplying them) include such features. It'd be borderline negligent from a financial perspective not to.


The machine still works if you yank the 4-pin connector from the cellular board, so that's the easiest way. We gotta add that to the instructions...


It would just be easier to remove the chip lol


Here's what you should really know before you design a ventilator, by someone who works for a medical equipment company.

https://www.youtube.com/watch?v=7vLPefHYWpY


I think the whole point of hacking a CPAP is that it's already got the control and sensors that could allow a doctor to use it without injuring a patient. It's just a matter of exposing that via the software.


Really good video right there!


The Indian design with the android phone looks very interesting - I hope that can be shared and mass produced, assuming it does a decent and safe job.


Not a doctor. But I am seeing growing evidence that ventilators are overused potentially. From ref [1]:

> But as doctors learn more about treating Covid-19, and question old dogma about blood oxygen and the need for ventilators, they might be able to substitute simpler and more widely available devices.

and

> "In a small study last week in Annals of Intensive Care, physicians who treated Covid-19 patients at two hospitals in China found that the majority of patients needed no more than a nasal cannula."

1 - https://www.statnews.com/2020/04/08/doctors-say-ventilators-...



That's what I heard as well from https://www.youtube.com/watch?v=6Dwcfye7_LQ

Maybe not overused, but wrongly applied. He cites a doctor from new york in the video and two sources in the video description.


Messing with vents if you don't know what you're doing sounds like a sure fire way to kill yourself.


Looks dicey to me too, but if you are going to die anyway, what's the harm? The choice is between definitely dying with no ventilator or possibly not dying with the aid of a hacked CPAP. No one would use this if they had access to a proper ventilator.


Only if you're unconscious, and in that case you should be in a hospital anyway.

If you're conscious you'll just pull the mask off if you start feeling like you are not getting the right air. These machines, and masks, have all kinds of safety features and safety valves on them.

I have a CPAP, oxygen concentrator and assorted hoses and masks, and I've messed around with them these days while watching ventilator 101 videos on YT. If you're a technical person, the basics are not that hard to grasp.


CPAP machines are usually used when you're asleep, right? Since sleep apnea can sometimes be fatal, it seems like screwing up your CPAP machine could conceivably lead to your death.


For most, yes, but there are people who use them while awake... for instance, people who suffer from conditions like ALS or COPD.

Even as someone with just vanilla sleep apnea I'll occasionally strap mine on for a while when suffering from a head cold...certainly helps open things up.


Yeah, you're basically using Positive End-Expiratory Pressure(PEEP) to keep the alveoli from sticking together or developing stiffness. The problem it solves is under normal conditions your lung compliance goes down and with it your Tidal Volume. My understanding is that PEEP works for COPD patients by maintaining enough alveolar pressure that at the next inspiration all of the alveoli in the lung are recruited to store gas instead of only some which both increases surface area and also volume of gas. Both of these factors improve blood oxygenation. I think it has the same effect with pneumonia too for the same reasons.

I am not an RT but I worked for a ventilator company for like 4 years.


> I'll occasionally strap mine on for a while when suffering from a head cold

Wait, how does this help? Does this clear up stuffed nose and such?


Yes.


My big fear when starting with it was that it would be horrible to use when you have a cold, but so far I haven't had any issues with it.


Yeah it’s been all good for me. Also solved the fairly frequent nosebloods I used to get with the humidity


Note: all of my messing around was just changing settings. No hardware/firmware hacking, so technically the machine is just as fine as before.

And I've bought the machine specifically for coronavirus, since my country health system is quite poor, I don't use it during the night.


Good, I'm glad you're being safe. :)


yea not you're not willing "hacked" ventilator on yourselves then don't expect someone's grandparents to use it.


I think the risks are overstated. Probably not anywhere near surefire.


Agreed. BiPaP to ventilator already seemed like a somewhat questionable transformation, and now we're going

CPAP ----questionable software hackery ----> BiPaP --- questionable hardware hacking ---> Ventilator

This is hubris. Ventilators are not iPhones circa 2010. It's irresponsible for non-medical researchers to not only pursue, but also disseminate, these jailbreaks. A significant portion of medical device RnD is related to creating technology that is hard to misuse and won't result in accidental death, and I just don't see that here.


> it's irresponsible for non-medical researchers to not only pursue, but also disseminate, these jailbreaks. A good portion of medical device RnD is related to creating technology that is hard to misuse and result in accidental death, and I just don't see that here.

This is simply wrong, both from a user perspective and a general research perspective.

Positioning a jailbreak like this as a solution to general vent shortage may be irresponsible if it leads to people trying to treat others instead of relying on doctors, but going beyond that is ignoring the good that's come from work like this.

Hacked up and jailbroken insulin pumps have been a thing for years, often to get increased safety over what manufacturers can provide: https://medium.com/neodotlife/dana-lewis-open-aps-hack-artif...

There's also a history of people unlocking and altering settings in CPAP/BiPAP devices in response to data (many providers treat them as set and forget devices and don't bother reviewing logs except for initial patient compliance).

Beyond people hacking their own devices, we've seen that security of medical devices wouldn't improve without independent researchers highlighting the flaws and driving them to fix them: https://www.cnbc.com/2018/08/17/security-researchers-say-the... and https://www.darkreading.com/vulnerabilities---threats/lethal...


Perhaps this is aimed at non-American healthcare systems, but I have not seen a single report of American hospitals running out of ventilators, let alone BiPaP machines. In order for this to be a responsible hack — used under the guidance of medical professionals — we would need to have run out of both.

If anything, at least in the American context, I'm more worried about running out of the sedative necessary for ventilation.[1]

I have nothing against hardware hacking in non-pandemics. If you want to hack your own insulin pump or create epi-pens on your own (non-crisis) time, that's fine by me.

But I think the cost-benefit-risk analysis changes in pandemics, because people are too hungry for easy fixes and make ill-advised decisions under pressure. For example, even doctors (ostensibly medically-literate professionals) are prescribing themselves hydrochloroquine [2], which does not seem to be a miracle cure and sometimes, itself, dangerous (and also leaves lupus sufferers at risk of a disrupted supply chain).

[1] https://www.vox.com/2020/4/6/21209589/coronavirus-medicine-v...

[2] https://www.nytimes.com/2020/04/12/health/chloroquine-corona...


> but I have not seen a single report of American hospitals running out of ventilators

Are you really not going to just google "USA ventilator shortage"?

Also BiPaP machines require the same hack as CPAP machines. And of course a further hack for invasive intubation (which ventilators can do out of the box), though you aren't going to do that to your nightstand CPAP machine either.

Anyways, rest assured that the few people who can be bothered to jailbreak their CPAP machine are not the same kind of people who drink their koi pond cleaner. I think this kind of fear about people hacking their gadgets is misplaced.

It also reeks of what I can only register as this weird "doc knows best" subservience to the medical system. This is probably the weirdest meme I see on HN. And, as people upstream point out, nobody out there is paying attention to your insulin pump or CPAP machine settings. They just leave it on whatever default setting. It's all entirely on you to do the research to improve things for you.


The search you propose doesn't rebut their comment. We're all aware of the concern about shortages. Their claim was different.

There are stories about NYT hospitals doubling up patients on ventilators, but those stories are explicit about the fact that those hospitals have not run out of vents, and are instead working out the protocols for sharing them when/if it becomes necessary.


To be clear, your position is that we should eschew self care so that we can bankrupt ourselves by only getting care from doctors, who as you note are either hoarding critical medicines for themselves or using wrong medicine for treatment?


I think it's irresponsible to not be donating our full talents as engineers to assisting those medical researchers in getting a head start on such developments. We have the ability to offload trivialities from those researchers like developing a firmware flashing process, so that they can focus on ensuring the reliable operation of such hacks.


The problem is that those talents are being used to solve totally wrong problems because of engineers going gung-ho and starting to "engineer" before they understand the subject. The problem is not lack of designs or ideas for ventilators.

This sort of hack still requires that someone makes those things at scale. That's a supply chain issue, same as taking an existing, proven and actually certified design and manufacturing it at scale. Hacking up a few CPAP machines really doesn't solve the problem when the hospitals need tens of thousands ...

Even if we ignore the legal and medical bits (only in an extreme emergency with no other options and where the alternative is an inevitable death would anyone even contemplate using something like this on a patient), this machine isn't really a ventilator suitable for people with failing lungs. Patients that have to be intubated and the machine actually breathes for them, filters, humidifies and warms the air, allows sucking of phlegm without spewing virus everywhere ... And those are the machines that are in short supply. This hack doesn't do anything from that.

And finally, it doesn't address the issue of having enough trained staff that will operate and supervise the ventilators - these things have to be supervised 24/7, sometimes for weeks. One ICU nurse is commonly supposed to handle up to 6 patients, tops. You can't just add ventilators without adding nurses, because if anything goes wrong, people will die - and where do you get those nurses from? Especially if they have to deal with a gizmo that isn't as failsafe as a real ventilator (because it wasn't meant to be)? If you need more staff to run fewer ventilators/beds, then you haven't really solved anything, have you?

And the lack of trained staff is not something a jailbreak or an Arduino can solve.

People should stop messing with building "ventilators" and focus on things where they can actually make a difference - e.g. the production of face masks, face shields and similar gear, which are in extremely short supply and don't require much sophistication to build. That would make a much bigger difference than pretending that we are somehow solving the lack of ventilators with hacked CPAP machines ...


Classic false dilemma.


In a scenario where people are certain to die if there is a lack of ventilators, I’m willing to take a lot of risk that they instead might die from an alternative course of treatment that doesn’t meet a normal standard of care.

If that means taking already made CPAP machines and modifying them, that’s in bounds as far as I can judge.


This isn't a significant redesign of an existing device. It is essentially a DRM bypass.


Agree with your sentiment. Now to nitpick: the first iPhone jailbreak was achieved days after the iPhone was released way back in July 2007.

Source: https://www.cultofmac.com/192850/the-history-of-jailbreaking...


This is a real adaptation being used by real doctors in real hospitals to save real people's lives. There is a pandemic on.


I actually have yet to hear any reports of improvised ventilators being used outside of ventilating multiple patients from a single ventilator. A big reason is that doctors and nurses simply aren't trained to use improvised devices in a way they can trust to be safe.

First, do no harm.


https://www.nytimes.com/2020/04/14/nyregion/new-york-coronav...

The Italians are using adapted CPAP machines as well.


They describe such usages in the first sentence of the article. Mt. Sinai researchers are actively working on converting BiPAP machines into ventilators.


I mean, it's also irresponsible for societies to have fewer respiratory therapists and ventilators than are needed to support their patients, but here we are.


>It's irresponsible for non-medical researchers to not only pursue, but also disseminate, these jailbreaks.

The reason for the underbelly trend of certain types of people to not trust doctors and scientists is a lack of trust in the system (medical system, science system, etc). The root of this for some people can be tied to this exact condescending attitude towards people.

Nobody responds to being told something is a bad idea, they only respond to understanding why it could be a bad idea and being allowed to decide for themselves, and your attempt at preventing them from deciding in a way you don't like how they treat their own body only furthers the rift that powers essential oil huns.

Me personally, If my local hospitals are out of ventilators and i'm showing signs of URD i'm gonna hack my autoset with this firmware to get the higher pressures needed for peep therapy and not bother going in. There isn't anything you can do to stop me. I might even do it even if they aren't out, as i would be able to start therapy sooner and potentially heed off snowball effects from a lower blood oxygen level on my immune system.

Attitudes like yours create, feed, and recruit anti-vaxxers and essential oil huns, and harm that does, is far greater than somebody hacking their own cpap machine for whatever ends.


> A good portion of medical device RnD is related to creating technology that is hard to misuse and result in accidental death, and I just don't see that here.

The people relying on these hacks would be definitely dead without the hacks, that is the point. Even if the chances of this working successfully are only 10%, you just saved 10% of the patients compared to 0%.


Not a doctor. A major issue with using this type of CPAP machine on a Covid-19 positive person is the high amount of aerosolized virus particles it exhausts. Anyone using this should be extremely careful and know what they're doing. That being said, doctors in many countries are using positive air pressure machines with an air-tight helmet/bag with filtered exhaust.


Mt. Sinai developed a procedure for using these safely in a clinical setting, by using an alternate patient circuit with viral filters to capture the aerosolized particles: https://health.mountsinai.org/wp-content/uploads/sites/14/20...


That's what it says right there on the page already: "Additional equipment like viral filters are also required."


[flagged]


Actually yes(not that this is particularly dangerous) . It happens litteraly all the time. Ever seen all those "don't try this at home" disclaimers? Also someone published a book called "the anarchist cook book" on how to make rudimentary explosives and manufacture illicit substances such as LSD. You can find a pdf of it with a quick google search.


Both of those have fairly obvious consequences. I can definitely see people using this and not recognizing it can put other people in harms way.


This kind of concern-trolling on threads like this gets really tiresome.

Anyone in such a role where they will be fitting ventilators to people (i.e., highly educated, experienced and employed in a critical care role) will understand that this is outside of standard practice and that extra caution will need to be taken and considerations made for the different functionality and behaviour of the machine.

Can't we just appreciate the spirit of inventiveness in a crisis, without having to spoil it by fretting about issues that any grown adult working with this stuff will be fully capable of considering?


I definitely do. One of the main differences is this specifically is not mass-marketed, and I agree that anybody would would have the capability of doing this should already have the knowledge to not fuck it up. I'm just saying its a false equivalency between the two


This post is a perfect distillation of why there should be more history and other humanities subjects in traditionally STEM educations.

>Can't we just appreciate the spirit of inventiveness in a crisis, without having to spoil it by fretting about issues that any grown adult working with this stuff will be fully capable of considering?

Can't we just appreciate the inventiveness of using radium to light up watch dials? Or the inventiveness of the first friction matches?

Someone who is educated or trained doesn't necessarily make a dangerous invention a net-positive.


Please don't make patronising assumptions: my education and topics of interest are far more focused on humanities than STEM.

The examples you cite are not at all apt comparisons, as the risks and mitigation techniques are well known to the highly experienced adults using the equipment, as has been reported elsewhere.

This is a crisis like no other and it is bringing out incredible inventiveness and creativity in the determination to save lives.

That's what should be celebrated.

Nobody is saying due caution should be disregarded.


I sure enjoyed my copy of the Anarchist Cookbook as a teen. :)


I believe so, yes. I like to think people can make reasonable decisions with information they are provided


[flagged]


This is pandering to an extreme situation in order to make a case... I think anyone on HN will acknowledge that people are on a scale from "not reasonable" to "very reasonable".

You're pushing the comment you're responding to over to a binary point of view. I don't believe in good faith that shijie meant "all of the time" when they said "I like to think people can make reasonable decisions with information they are provided". To push their statement to "all of the time" while bringing the ethics of law into this conversation seems disingenuous to the safety/disclaimer concerns you originally called into question.

Personally, I found the disclaimer on the airbreak.dev site to be very clear and appreciated it was on the front-page directly following the product summary. It is clear to me that this is an "in-development" project that is not ready for real-world deployment yet - they're being quite clear/transparent with these facts.


Absolutely, yes.


If you're using this where non-COVID patients could be exposed (e.g. at home) this is a very important consideration.

In a hospital setting (aka an emergency), it's less of an issue. The situation that would warrant this would likely also warrant full PPE just to enter a unit or building.


> it's less of an issue. The situation that would warrant this would likely also warrant full PPE just to enter a unit or building.

Isn't it still important not to spray covid everywhere?

See for example this post: https://emcrit.org/emcrit/covid-airway-management/

> Critical Note: If you use the vent for preox, you MUST disconnect the vent circuit proximal to the viral filter before removing the mask. Otherwise, COVID will be sprayed all around the room!!!!! See Triple C below.

{EDIT: genuinely don't know why this got downvotes.}


What's scary is that CPAP machines are allowed on airplanes. If they really aerosolize virus particles, maybe they shouldn't be.


I don’t want to alarm you unnecessarily, but they let ordinary people with virus aerosolizing equipment (lungs + diaphragm) onto airplanes, currently.


There's a special, enhanced, risk with CPAP that authoritative medical sources warn about.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3338532/

I'm not sure I get your point. Did you have one?


At least on Delta flights they’re not allowed to be used, I’m not sure if the same policy exists on other airlines.

Edit: I was wrong, see below


I'd be very surprised to see any airline restrict the use of a medical device onboard. The manual that came with mine states that airlines are required to let you use it, and the manufacturer sells an airline-friendly battery pack. Do you have a link to Delta's policy on this?


My mistake, I was wrong. They allow use, but it has to have its own power supply https://www.delta.com/us/en/accessible-travel-services/assis...


This would seem to be because they don't want to be held to providing medical grade reliability of electricity to the seat.


I've sat next to people using them on Delta and United. Of course, I'm not without empathy for people who depend on them. But if a person has a viral infection that can be spread through droplets, this can be a very dangerous situation. If I'm ever in this situation again, I'll ask to be reseated. If they can't do that, I'm not sure I'd want to fly.


You'd better not let someone sitting next to you breathe, or cough, or sneeze then.

When I'm using my CPAP, my mouth is closed and I'm asleep. I'm breathing through my nose, which has hairy filters in it, plus a mask that has a filter on its exhaust, plus the machine has a filter on its inlet.

Please stop the knee-jerk reactions. CPAP devices and aerosolized droplets are a problem if you know the patient is infected and you are up close to them putting the masks on.


These are not "knee-jerk" reactions.

There's a special, enhanced, risk with CPAP that authoritative medical sources warn about.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3338532/

Let's be civil here and assume good faith.


The parent commenter only mentioned that it exhausts aerosolized virus particles, not that it produces any. Do they emit/amplify aerosolized virus particles themselves? If so, by what mechanism?


If anything, more tubing would might condense humid lung air in the walls so whatever leaves the tubes is drier.


ventilators don't just pump air. they also monitor and control the amount of air, and beep when something is wrong. plus a bunch of other features...


A typical modern CPAP also takes measurements, and makes limited adjustments based on what it sees. It doesn't just pump air. Not that it's as capable as a real ventilator, but it's not just a simple air pump, either.


You also need to warm and humidify the air because ventilators are inserted past the part of your respiratory system that does that.


You also need to warm and humidify the air because ventilators are inserted past the part of your respiratory system that does that.

Many (most?) CPAP's do that. When you have to fill the reservoir every night you get an interesting perspective on the amount of water you breathe in eight hours.


> When you have to fill the reservoir every night

I accidentally found out one night that I don't need the air to be humidified. That was a revelation, and one that's saved me a lot of work since.


Mine makes a burning smell if I run out of water in the night. Wakes me up very quickly.


Turn off the tank heater?


No option for that. I can adjust the humidity up and down, but the lowest setting still heats.


Mine can replace the reservoir with what's effectively a bypass plug. I assume this also disables the heater.


I assume a CPAP could only ever be hacked into being some form of non-invasive ventilator, not the kind where you are intubated. But I may be 100% wrong.

In any case, a standard Resmed CPAP like the one in the article has a humidifier built in, and if you buy the optional heated hose, it can heat the air too. The tank is kinda small on the humidifier, so you'd have to refill it pretty often. Probably want to hack it into having a lot more volume, if you need the humidity.


Most CPAP machines have built in humidifiers.


Exactly, I would not like being hooked up to a machine that could overinflate my lungs without sounding any alarms.


Well good thing a CPAP won't do that to you then, for obvious reasons.


That is why they are limited to deliver only 20cmH2O (water pressure).

Even at that high setting it does not affect your lungs ... the purpose of a CPAP is keep your upper airways open i.e back of your throat ... you still need to breath on your own.


CPAPs control the amount of air by measuring backpressure AFAIK.


So do CPAP machines, though.


Also worth understanding that a ventilator is not always the best option - there have been findings recently that a tactic called 'proning' is often enough to increase blood oxygen:

https://www.nytimes.com/2020/04/14/nyregion/new-york-coronav...


Here are two useful videos about proning to explain why it works:

https://twitter.com/libbyg9/status/1243813444689821696?s=20

https://www.youtube.com/watch?v=FS4t5w1eCYw

Proning can be done to intubated patients too.


TLDR; They treated patients who presented with low blood oxygen by lying them on their belly or side and giving them oxygen through a nasal tube. No machine required. In many cases it worked perfectly.


Jailbreaking the CPAP machine might not be necessary. From what I understand, a CPAP, in certain circumstances, can be given to someone who has 'milder' COVID-19 symptoms. That would then free up a ventilator so the vent can go to someone who has more severe symptoms.


This is an informative video in what is involved in designing ventilators.

https://www.youtube.com/watch?v=7vLPefHYWpY


Talking about cpap machine, I did some research on it, and found that they are regulated medical device and cannot be purchased without prescription.

I suffer chronicle dry nose, moderate empty nose syndrome on the right side (due to surgery done 20 years ago in China), and Deviated Septum (due to injury as kid). One thing often happen to me is during middle of nigh sleep, my left nose duct will be extremely dry, causing me to wake up and switch side (it seems my nasal cycle is completely gone).

One idea I wanted to try to fix is to use a cpap + humidifier to pump moisturized air.

And I found that I have to get prescription, which I tried with one lab sleep study causing $3000+, and concluded that I do not have sleep apnea, which is one of the symptoms to qualify cpap prescription.

Then I started to look for off market cpap machine on Craigslist. No luck, the machines are often old, and beat up after long usages.

I did not seriously research if cpap has risks to normal people. But it does not seem harmful, unfortunately it has to be regulated and possibly also become very expensive.

Edit: Thanks for the good recommendations. Buying from Chinese site (I often forgot this), nebulizer, etc.


A case can be made that they are being regulated into being expensive to support the rather dysfunctional American health system's need for high insurance charges. At any rate - have a look over on the Chinese sites, you can pick them up new there for $600 or so. Obviously do your own research, and spend some time on the CPAP jailbreak forums as well - the community there is very supportive.


You can find CPAPs on eBay, but my understanding is that you'd want a sleep study to validate the correct pressure settings. Are you sure you can't just set up a room humidifier?


Or sleep with a face mask with a Heat and Moisture Exchanger(HME) in it?


You can also get a home test for about $500 after insurance, get a Rx from your doc, and then buy a $200 CPAP unit with low hours off ebay, Craigslist, FB Marketplace, etc. Or skip the test / Rx and titer the machine yourself using Sleepyhead / OSCAR with the help of very capable folks on cpaptalk.com. It sounds hard until you look into it, and then it's not really that difficult.


If you just want moisture and not pressure you might want to look at a nebulizer rather than a cpap.


"The breath extension replaces the function at 0x80bb734"

It sounds what Naughty Dog did to get RAM on the PSX for Crash Bandicoot ... they grabbed memory already allocated by the Sony runtime libs and would use it if it not do anything bad.

A crashing game console is not a ventilator but a good hack nonetheless.


It's a standard technique -- binary patching.

https://en.m.wikipedia.org/wiki/Patch_(computing)


There is a reasonable chance that this will not be as useful as the team hopes:

1) They are increasing maximum pressure and pressure rate changes beyond the built-in design parameters. If these new parameters are outside what the engineering requirements document spec, these changes are a problem in seeking EUA.

2) In regulatory affairs, authorized, cleared, and approved have very specific (and enforceable) meanings. If someone is loose with how they use these words, it suggests they don’t have someone with regulatory experience involved (a negative sign). The earlier the team can engage with someone with regulatory experience, the better.


These are not normal times, and I can certainly see a doctor with tinkering skills modding his office's CPAP stock in order to save lives.


The problem is that high pressures can cause barotrauma. So you might end up increasing PEEP beyond what a patient's lungs can survive, and because you're using a CPAP machine instead of a ventilator there's not really any facilities to measure pressures that high. Or there are but they were never characterized because the machine doesn't measure pressures that high. And because they were never characterized you may not actually be delivering the pressure that the machine says you're delivering. So this is pretty crazy.

The other thing ventilators typically include is pressure alarms and high pressure limits. Under routine use the high pressure limits keep you from popping patient lungs in volume-controlled modes. A pressure-controlled mode like BiPAP may be okay in this case since it provides those limits. The downside of pressure-control is that the patient's lung compliance and alveolar recruitment may change, so you can start off delivering a certain tidal volume at a certain pressure and then because of compliance changes the patient's alveoli lose the ability to contain the same volume of air, so the patient is losing oxygenation unless you change the settings.

My point is that there are a lot of considerations beyond simply delivering a fixed pressure of gas into a patient's lungs and hacking a CPAP may not meet those requirements.


Not likely a doctor in a US hospital. Too much liability risk.


The idea is manufacturers don't want to loose money and do this stuff themselves, so somebody donates their time to bring this hack to the FDA, and then the hospitals can use it.


This is possibly the most irresponsible project I've ever seen.

There appears to be a deep lack of regulatory experience, along with a deep lack of QC, and it's presented as a jailbreaking, i.e., what is done to your phone.

Some kinds of regulations are written in blood, or, in this case, bloody sputum.


I mean, there’s still time for George Hotz to enter the ring and win that title.

A lament, I wish it were possible to convince tech people that they are not the only clever people in the world: regulatory bodies and medtech and pharma companies are packed with equally clever people, who are quite capable of moving fast but without breaking things, that have an unmatched advantage in having domain experience (part of which is a healthy respect/fear of the unknown in medicine, like you say, regulations are written in blood). It would be a lot more productive to support those people than to do these hackathon projects.


The headline switches from singular to plural halfway through.

I love this idea though. The manufacturers should get onboard with “emergency BiPAP” mode to make this happen without users having to do an elaborate hack.


If the the only difference between company X’s CPAP machine and company X’s BiPAP machine is purely software, shouldn’t we just pay and/or force them to unlock the features via update?


CPAPs are known to be very closed systems, I remember a couple of articles about handy SleepyHead analysis software. If anyone interested, it was forked - new name is OSCAR.


Would these not be too simple to address the ventilation requirements of the coronavirus?

This was the case with the ventilators from a consortium in the UK, where the profile of corona requires more complex ventilation -

https://www.theguardian.com/world/2020/apr/13/uk-scraps-plan...


Very great. I was really really curious if this was possible and how much work it would be. As you said a lot of CPAP machines are very close in functionality to BiPAP machines. I could see this being very helpful to people who are having a hard time with CPAP therapy but are having difficultly getting their insurance provider to approve a BiPAP machine which are more expensive (something I've experienced)


Yeah this is something I’m wondering too. I’m on a CPAP, not sure if I could get approved for a bipap or not. I run quite high pressure for straight CPAP (range from 18.8 up the machines max of 20). Some nights I peak around 19.6 but other nights will Max it out. Most bipaps will go up to 25.


It’s true, it is mostly a software change to upgrade a cpap into a bi-level device more like a ventilator. The barrier is really about procurement, and if they are proposing to reuse devices then it is all about shipping them to a location to be cleaned and tested, modified if necessary, repacked and shipped to a destination with new masks, hoses, and proper updated manuals.


This is very cool. I was wondering the other day if my CPAP machine (same model) would be capable of doubling as a ventilator and I'm surprised that someone has already thought of this and provided a solution.


I've got exactly that model as well. There are probably 10s of millions of them in use in the US. Really cool to see someone hack them, but I can't say that I will be doing that with mine :).


if you vent your home cpap machine into an open room and the person using it is infected, congrats you just vaporized the infection onto anyone nearby


Cool. Everybody in the home is already infected by the time somebody needs breathing assistance, so this is fine.


As a CPAP user who needs a new machine, I am now screwed by this. This will, by the time I have a new sleep study, cause all sorts of supply issues.


The pandemic is causing lots of supply issues. I don't think this firmware patch is even going to be a rounding error in the grand scheme of whats going on in the world right now. There are tons of CPAP machines this doesn't cover.


I have a 9 year old machine that still works perfectly well. Why do you need a new machine?


don't ventilators use intubation? how would this help in that case?


Ventilators can be used invasively or non-invasively.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: