4 ms·

Hi, I worked on this project and have a couple comments to address the issues people are raising. - There are established medical protocols to treat COVID-19 p

Hi, I worked on this project and have a couple comments to address the issues people are raising. - There are established medical protocols to treat COVID-19 patients with BiPAP machines, including the addition of a viral filter to mitigate aerosolizing the virus. People are using these protocols now and we link to them from the site. - There are two separate firmware hacks presented. The first one modifies ~20 bytes and provides UI access to BiPAP code left in the existing binary, which would allow the more common CPAP machines to fulfill the same limited function. The second is a PoC of a 'full ventilator' mode. - The manufacturer's CPAP and BiPAP lines have identical mainboard designs and a near identical array of sensors, which provide realtime data including tidal volume calculations. This project exists as a PoC to show that it would be possible - simple, even - for the manufacturer to convert CPAPs to BiPAPs via an OTA update - or, with significantly more effort, to fully featured ventilators. It is likely that they are reluctant to acknowledge this is possible in fear of destroying the market for the BiPAP machines. - If you are a SleepyHead/OSCAR developer, or have access to an AirCurve S10 and an ST programmer, I would love to talk.

ENOTTY 6y ago
What are the differences in the sensors?
- wormyrocks 6y ago
  CPAP: https://fccid.io/2ACHL-AIR104G/Internal-Photos/Internal-Photos-3173809 https://fccid.io/2ACHL-AIR104G/Internal-Photos/Internal-Phot... BiPAP: https://fccid.io/2ACHL-A10STA3G/Internal-Photos/internal-pictures-2888692 https://fccid.io/2ACHL-A10STA3G/Internal-Photos/internal-pic...
gmueckl 6y ago
> a near identical array of sensors I don't know anything about the devices in question, but from what I know of engineering of medical devices, stating "near identical" makes me listen up. If these devices malfunction, they could hurt people. I expect a device like this to have an extensive array of sensors and a lot of extra hardware for constant self-monitoring. If the two lines of devices don't have exactly identical hardware, the differences need to be checked carefully. The lower tier device may be missing some capabilities because of that. Also, it is not obvious that the main development effort for a medical device often isn't about making a device perform its primary function, but to make it incapable of doing anything else. That includes automatic detection of malfunction and appropriate safe modes (simply turning it off may not be safe!). Of course, all of that needs to be tested and validated very thoroughly. If you ever want to use a hacked device on a patient, you will have to prove that it is up to the same engineering standards. That is no simple task, but it beats hurting or killing people because of bugs. In short, this isn't a job for the regular basement-dwelling hacker, the kind who is happy to have his Roomba drive around with a hacked up firmware. This needs some serious and methodical engineering effort to become practical.
- sneak 6y ago
  > If these devices malfunction, they could hurt people. I think that the circumstances under which these are being developed are a special emergency; the alternative to using such a less-safe, makeshift device here would be no ventilator at all, i.e. near-certain death. In this specific circumstance, I think this sort of criticism should be withheld. I don't think anyone's talking about reflashing CPAPs to be life support outside of a temporary C19 emergency shortage.
  - gmueckl 6y ago
    In these circumstances, this kind of criticism is especially necessary. It's easy to feel like you're doing the right thing and that you're helping people when you set out to hack medical devices. The truth is that you should only even think of doing it as a team with a leadership that understands the full engineering requirements for such a device completely and is very professional about it, including following strict processes (testing separated from development, test documentation, etc...). The consequences of sloppy work in that field can be extreme. I'm not going to put up with "it helps if it saves lives" as a /blanket/ excuse. It fall apart when it saves some and kills others that could have survived.
    - ClumsyPilot 6y ago
      I am sorry but that statement cuts no ice with me. The team clearly doe know what they are doing, you ha e provided no evidence, except a blanket statement of 'something might go wrong'. Unless you can actually point to specific issues, your statement is not very useful
  - bearcobra 6y ago
    The YouTube channel Real Engineering has a great video breaking down why that might not actually be true. The possibility that makeshift devices could cause barotrauma and make things worse seems quite significant. You can check it out here if your interested: https://www.youtube.com/watch?v=7vLPefHYWpY https://www.youtube.com/watch?v=7vLPefHYWpY
dmead 6y ago
i don't know what you mean by "ST" programmer, but i'm a dev and i have an aircurve 10. do you need something?
- Jenda_ 6y ago
  I think it means ST-Link-compatible programmer, a device used to flash/debug ST chips. You can see a big STM32 MCU on one of the FCC ID photos. The protocol can be bitbanged over GPIO, so for example if you own a Raspberry Pi (or anything similar), all you need to do is to install openocd.
  - dmead 6y ago
    ah, well if OP wants me to get one and do something with it and my bi-pap i'm happy to help.
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]
cycologist 6y ago
The hack only works when using the exact firmware it was made for (obviously, but still unfortunately). I have an Airsense 10 Autoset for Her (different simpler menus) and was not successful making the extra menus appear.

ENOTTY 6y ago

What are the differences in the sensors?

wormyrocks 6y ago
CPAP: https://fccid.io/2ACHL-AIR104G/Internal-Photos/Internal-Photos-3173809 https://fccid.io/2ACHL-AIR104G/Internal-Photos/Internal-Phot... BiPAP: https://fccid.io/2ACHL-A10STA3G/Internal-Photos/internal-pictures-2888692 https://fccid.io/2ACHL-A10STA3G/Internal-Photos/internal-pic...

gmueckl 6y ago

> a near identical array of sensors I don't know anything about the devices in question, but from what I know of engineering of medical devices, stating "near identical" makes me listen up. If these devices malfunction, they could hurt people. I expect a device like this to have an extensive array of sensors and a lot of extra hardware for constant self-monitoring. If the two lines of devices don't have exactly identical hardware, the differences need to be checked carefully. The lower tier device may be missing some capabilities because of that. Also, it is not obvious that the main development effort for a medical device often isn't about making a device perform its primary function, but to make it incapable of doing anything else. That includes automatic detection of malfunction and appropriate safe modes (simply turning it off may not be safe!). Of course, all of that needs to be tested and validated very thoroughly. If you ever want to use a hacked device on a patient, you will have to prove that it is up to the same engineering standards. That is no simple task, but it beats hurting or killing people because of bugs. In short, this isn't a job for the regular basement-dwelling hacker, the kind who is happy to have his Roomba drive around with a hacked up firmware. This needs some serious and methodical engineering effort to become practical.

sneak 6y ago
> If these devices malfunction, they could hurt people. I think that the circumstances under which these are being developed are a special emergency; the alternative to using such a less-safe, makeshift device here would be no ventilator at all, i.e. near-certain death. In this specific circumstance, I think this sort of criticism should be withheld. I don't think anyone's talking about reflashing CPAPs to be life support outside of a temporary C19 emergency shortage.
- gmueckl 6y ago
  In these circumstances, this kind of criticism is especially necessary. It's easy to feel like you're doing the right thing and that you're helping people when you set out to hack medical devices. The truth is that you should only even think of doing it as a team with a leadership that understands the full engineering requirements for such a device completely and is very professional about it, including following strict processes (testing separated from development, test documentation, etc...). The consequences of sloppy work in that field can be extreme. I'm not going to put up with "it helps if it saves lives" as a /blanket/ excuse. It fall apart when it saves some and kills others that could have survived.
  - ClumsyPilot 6y ago
    I am sorry but that statement cuts no ice with me. The team clearly doe know what they are doing, you ha e provided no evidence, except a blanket statement of 'something might go wrong'. Unless you can actually point to specific issues, your statement is not very useful
- bearcobra 6y ago
  The YouTube channel Real Engineering has a great video breaking down why that might not actually be true. The possibility that makeshift devices could cause barotrauma and make things worse seems quite significant. You can check it out here if your interested: https://www.youtube.com/watch?v=7vLPefHYWpY https://www.youtube.com/watch?v=7vLPefHYWpY

dmead 6y ago

i don't know what you mean by "ST" programmer, but i'm a dev and i have an aircurve 10. do you need something?

Jenda_ 6y ago
I think it means ST-Link-compatible programmer, a device used to flash/debug ST chips. You can see a big STM32 MCU on one of the FCC ID photos. The protocol can be bitbanged over GPIO, so for example if you own a Raspberry Pi (or anything similar), all you need to do is to install openocd.
- dmead 6y ago
  ah, well if OP wants me to get one and do something with it and my bi-pap i'm happy to help.
deleted 6y ago
[deleted]

deleted 6y ago

[deleted]

cycologist 6y ago

The hack only works when using the exact firmware it was made for (obviously, but still unfortunately). I have an Airsense 10 Autoset for Her (different simpler menus) and was not successful making the extra menus appear.