Chapter 17
Treatment and life-support devices: how they work and what they are for Ventilators, pumps, defibrillators, dialysis, surgery, radiotherapy, implants, and drugs
Human Biology for the Medical Maker
Welcome to chapter seventeen. Chapter sixteen opened the machines that find out what is wrong. This chapter opens the machines that do something about it: the ventilator that breathes for a person, the pump that delivers a drug drop by drop, the defibrillator that restarts a heart, the dialysis machine that stands in for failed kidneys, the electrosurgical unit that cuts and seals, the linear accelerator that kills a tumour, and implants that stay in a body for decades. For each we ask the same questions: what physical principle does it use, how does it work, what is it for, how does it fail, and who operates it. Why this chapter exists Almost all of these are Tier 3 — that is a reason to understand them They are the context: manikins are ventilated, scenarios use pumps The safety lessons were learned here, the hard way In 2020, makers were asked to build ventilators The goal is to know, from the physics, why the honest answer was usually to build something else.
Almost every device in this chapter is professional territory, tier three in the device index. That is not a reason to skip them. They are the context of most clinical work you will be near: a training manikin is ventilated, a simulation scenario uses an infusion pump, a positioning aid sits in a radiotherapy beam. They are where the engineering safety lessons were learned the hard way: alarm fatigue, unit errors, a radiotherapy machine whose software overdosed patients, burns, and surgical fires. And they are the devices you may be asked to make. In twenty twenty, makers worldwide were asked to build ventilators. This chapter is so that you would understand why the honest answer was usually to build something else. Life support, and why it is different Three consequences Single-fault safety : safe, or alarmed, after any one failureAlarms are part of the therapy The operator is part of the system Alarm fatigue Hundreds of alarms per ICU bed per day Most are false or need no action Staff learn to ignore them — then one matters Treat "add an alarm" as a decision with a cost, not a free safety improvement.
A life-supporting device is one whose failure or misuse can kill within minutes. Three engineering consequences follow. Single-fault safety: the design must stay safe, or fail to a safe state with an alarm, after any single component failure, whether a sensor, a valve, a power supply or a line of code. Alarms are part of the therapy, because the device cannot fix every problem. And the operator is part of the system. That makes alarm overload a hazard in its own right. An intensive care bed can generate hundreds of alarms a day, most false or needing no action. Staff learn, usually correctly, that an alarm means nothing, and then one does. Every alarm you add competes for the same attention. Mechanical ventilation Breathing in reverse
We begin with the ventilator. Breathing in reverse Normal breathing pulls; a ventilator pushes under positive pressure Positive pressure squeezes the great veins — blood pressure can fall Small breaths, about 6 mL per kg predicted weight in severe disease PEEP, at least 5 cmH2O, holds small airways open In normal breathing the diaphragm lowers chest pressure below atmospheric and air is drawn in. A ventilator does the opposite: it pushes gas in under positive pressure and lets the lungs recoil to push it out. That reversal squeezes the great veins in the chest, so starting ventilation can drop blood pressure. Too much pressure or volume injures the lung itself, which is why modern practice uses small breaths, around six millilitres per kilogram of predicted body weight in the most severe lung disease. The circuit is a closed loop: a blender sets the oxygen fraction, valves deliver each breath, sensors measure pressure and flow, and an expiratory valve holds positive end-expiratory pressure, PEEP, to keep small airways open. Modes, in one distinction Volume control Pressure control Operator sets Tidal volume and flow Inspiratory pressure and time Machine delivers The volume, whatever pressure it takes The pressure, whatever volume results If lungs stiffen or tube kinks Pressure rises — injury riskVolume falls — under-ventilationWatch closely Airway pressures Delivered tidal and minute volume
There are dozens of named ventilator modes, and the names differ between manufacturers. Nearly all are variations on one choice: what does the machine control, and what does it let vary? In volume control the operator sets the breath size and the machine delivers it, whatever pressure that takes. If the lungs stiffen or the tube kinks, pressure rises, risking injury. In pressure control the operator sets the pressure and the machine delivers it, whatever volume results. If the lungs stiffen, volume falls and the person is under-ventilated. Breaths may be machine-timed, triggered by the patient's own effort, or spontaneous with support, and weaning is a gradual handover of the work of breathing. Without a tube — and oxygen as a fire accelerant CPAP splints the airway open; bilevel NIV assists each breath High-flow nasal oxygen up to about 60 L/min, heated and humidified Cylinders 140 to 230 bar; concentrators give 90 to 95% oxygen Masks are a pressure-injury problem on the bridge of the nose Nothing with a spark, a hot spot, oil, or grease goes near an oxygen supply.
Not all support needs a tube. CPAP applies one constant pressure through a mask, splinting the upper airway open in obstructive sleep apnoea. Bilevel non-invasive ventilation alternates higher and lower pressures to assist each breath. High-flow nasal oxygen delivers heated, humidified gas at up to about sixty litres a minute. Oxygen comes from piped systems, from cylinders at one hundred and forty to two hundred and thirty bar, or from concentrators that strip nitrogen from room air. Two things matter to you at once. Masks are a pressure-injury problem on the bridge of the nose. And oxygen is a fire accelerant: materials that barely burn in air burn fiercely in enriched oxygen. Two mechanisms Volumetric pump Peristaltic fingers squeeze a dedicated set Fluids, antibiotics, feeds Several to hundreds of mL per hour, about ±5% Syringe driver A lead screw drives the plunger Small volumes of potent drugs; neonates; end of life Down to fractions of a mL per hour; slow start-up There are two mechanisms. A volumetric pump uses peristaltic fingers or a cassette to squeeze a dedicated administration set, delivering fluids, antibiotics and feeds at several to hundreds of millilitres an hour, typically to within about five percent. A syringe driver uses a lead screw to push the plunger of a syringe at a controlled speed. It is used for small volumes of concentrated, potent drugs at low rates, down to fractions of a millilitre an hour, for neonates, pain relief and end-of-life care. It is accurate once running, but at very low rates its start-up can be slow. How they fail Failure Design response The catch Free flow Anti-free-flow clamp on removal Depends on the set Occlusion Pressure sensing and alarm Slow to alarm at low rates; bolus on release Siphoning, start-up lag Secure mounting, pump near patient height A small bolus of a potent drug is a big dose Air in line Ultrasonic detection Stops the infusion Programming error Drug libraries, hard and soft limits The dominant failure mode
Each failure has a design response, and every response has a limitation. Free flow, when a set is removed unclamped and gravity empties the bag, is stopped by clamps that close automatically. Occlusion is detected by rising pressure, but at low rates pressure builds slowly, so it can go unalarmed for a long time, and the stored volume arrives as a bolus when it clears. Syringe drivers can siphon or lag at start-up. Air is detected ultrasonically. But the dominant failure is programming: fifty instead of five point zero, milligrams where micrograms were meant, pounds treated as kilograms, a rate confused with a dose. Ten-fold and thousand-fold errors are documented again and again. Smart pumps, and their limits Drug libraries: soft limits ask, hard limits refuse Catch gross errors outside the configured range Miss: wrong drug, wrong patient, errors within range, basic mode Interoperability removes keying errors — and adds software failure modes Insulin pumps: basal plus boluses; closed loop with a CGM Smart pumps carry a drug library: concentrations and usual dose ranges for each drug in each clinical area. A soft limit asks whether you are sure; a hard limit refuses. They catch many gross errors. They cannot catch a wrong drug selected, a wrong patient, an error within the allowed range, or a pump programmed outside the library. Sending the prescription straight to the pump removes manual keying, at the cost of new software failure modes, the subject of chapter twenty. Insulin pumps are the same idea worn on the body, and paired with a continuous glucose monitor and an algorithm they form automated insulin delivery systems. Defibrillation Ventricular fibrillation: chaos, no pumping A large brief current depolarises a critical mass at once Capacitor discharge: 120 to 200 J biphasic; up to 360 J monophasic Chest impedance 50 to 150 Ω — measured and compensated Cardioversion: a smaller shock synchronised to the R wave In ventricular fibrillation the heart's electrical activity has disintegrated into chaotic wavelets and the muscle quivers without pumping. A defibrillator passes a large, brief current through the chest that depolarises a critical mass of heart muscle at once, so the chaos is extinguished and the heart's own pacemaker can take over. It charges a capacitor and discharges it through two pads. Modern biphasic devices typically use one hundred and twenty to two hundred joules; older monophasic waveforms used up to three hundred and sixty. The chest's impedance, often fifty to a hundred and fifty ohms, decides the current that flows, so modern devices measure it and compensate. Cardioversion is a smaller shock timed to the heartbeat. The AED: usability as a life-saving feature Switches on when opened; talks; shows pad placement Analyses the rhythm and refuses to shock a non-shockable one Prompts and times chest compressions Safe for lay use by design , not by training The automated external defibrillator is designed for someone who has never seen one, under extreme stress, in a public place. It turns on when the lid opens. It talks. The pads show where they go. It analyses the rhythm itself and will only shock a rhythm its algorithm classifies as shockable, so a bystander cannot shock someone who does not need it. It prompts and times chest compressions. Survival from a cardiac arrest in ventricular fibrillation falls with every minute without defibrillation, so this matters enormously. It is one of the best examples in medicine of the perception, cognition, action and feedback decomposition from chapter seven, applied so that safety comes from design. Pacemakers and ICDs Pacemaker: senses, and paces only when needed — a few volts, a fraction of a ms Letter code: VVI, DDD — chamber paced, sensed, response ICD: detects fast rhythms; pacing or an internal shock of tens of joules Inappropriate shocks are a real harm; the algorithm is the device Networked: a 2017 firmware update for about half a million pacemakers A pacemaker is a battery-powered pulse generator under the skin below the collarbone, with leads into the heart, or a leadless capsule inside it. It senses the heart's own activity and paces, a pulse of a few volts for a fraction of a millisecond, only when the natural rhythm is too slow. Pacing modes use a short letter code, such as VVI or DDD, for the chamber paced, the chamber sensed and the response. An implantable cardioverter-defibrillator adds detection of dangerous fast rhythms and can deliver an internal shock of up to a few tens of joules. Inappropriate shocks are a recognised harm. These devices are now networked, and in twenty seventeen roughly half a million pacemakers received a firmware update for a cybersecurity vulnerability. Haemodialysis Hollow-fibre membrane, about 1.5 to 2 square metres Diffusion, countercurrent — like a heat exchanger Ultrafiltration removes water; convection carries solutes About 4 hours, 3 times a week; over 100 L of dialysate a session When kidneys fail, waste, potassium, acid and water accumulate. Haemodialysis passes blood outside the body through a dialyser, a cartridge of thousands of hollow fibres with a total membrane area of one and a half to two square metres. Small solutes diffuse from blood into dialysate, and running dialysate countercurrent to the blood keeps a gradient along the whole fibre, exactly as in a countercurrent heat exchanger. A pressure difference pushes water out, which is ultrafiltration; too much, too fast, and blood pressure falls. A typical schedule is about four hours three times a week, and each session uses well over a hundred litres of dialysate, so water treatment is a major engineering task. ECMO and cardiopulmonary bypass Heart–lung machine: pumping and gas exchange during cardiac surgery Oxygenator: another hollow-fibre membrane, gas on one side ECMO for days or weeks — veno-venous for lungs, veno-arterial for heart and lungs Run by perfusionists; hazards are clotting, bleeding, air, disconnection The heart–lung machine used in cardiac surgery takes over both pumping and gas exchange. Blood is drained, pumped through an oxygenator, another hollow-fibre membrane with gas on one side, and returned. ECMO applies the same idea for days or weeks in intensive care. Veno-venous ECMO supports the lungs alone; veno-arterial ECMO supports heart and lungs. These circuits are run by perfusionists and specialist teams, and their defining hazards are clotting in the circuit, bleeding from anticoagulation, air entry, and disconnection. Energy in the operating theatre Electrosurgery, lasers, fire, and robots
Now energy in the operating theatre. Electrosurgery Radiofrequency, 0.3 to 3 MHz — heats without stimulating nerves Heating depends on current density Tiny active tip cuts; large return pad spreads the current A peeling pad burns the patient — out of sight Bipolar needs no pad; all modes make smoke Electrosurgery, often called diathermy, cuts and coagulates with radiofrequency current of a few hundred kilohertz to a few megahertz. At those frequencies current heats tissue without stimulating nerves and muscle, which mains frequency would do. Heating depends on current density, current per unit area. In monopolar electrosurgery, the current entering at a tiny active tip must leave through a large pad on the skin, so the tip burns and the pad does not. If the pad partly peels off, current concentrates in what remains and the patient is burned at the pad, under the drapes. Modern generators monitor pad contact. Bipolar instruments pass current only between forceps jaws, and every mode produces smoke that must be extracted. Lasers and surgical fire Lasers by absorption CO2, 10.6 μm: water; precise cutting Nd:YAG, 1064 nm: deeper; coagulates Green, 532 nm: haemoglobin Excimer, 193 nm: cornea The fire triangle Ignition — surgeon: energy devices, light sources Fuel — nursing team: drapes, gauze, alcohol prep Oxidiser — anaesthetist: oxygen, nitrous oxide Eye protection is wavelength-specific. Fire needs three separate people's decisions to coincide.
Surgical lasers are chosen by how their wavelength is absorbed. The carbon dioxide laser is absorbed by water and vaporises tissue at the surface. Neodymium YAG penetrates deeper and coagulates. Green lasers are absorbed by haemoglobin. Excimer ultraviolet removes corneal tissue a fraction of a micrometre at a time. Eye protection is rated for one wavelength and may be useless against another. Surgical fire needs ignition, fuel and an oxidiser together, and each belongs to a different team member: the surgeon controls ignition, the nursing team much of the fuel, the anaesthetist the oxygen. It is a pure systems problem, a hazard that only exists when several people's separate decisions coincide. Minimally invasive and robotic surgery Laparoscopy: ports, CO2 at about 12 to 15 mmHg, a camera, pivoting instruments Lost: direct touch, depth perception, natural hand–eye alignment Robots do nothing alone: tremor filtering, motion scaling, wrists, 3D vision Haptic feedback historically limited — force judged visually Instruments: every hinge, lumen, and crevice is a cleaning problem Laparoscopic surgery works through ports a few millimetres wide, with the abdomen inflated by carbon dioxide at around twelve to fifteen millimetres of mercury, a camera, and long instruments that pivot at the abdominal wall. The surgeon loses direct touch, depth perception and natural hand–eye alignment, which is exactly what training boxes rebuild. Robotic surgery puts the instruments on arms controlled from a console. The robot does nothing on its own. It filters tremor, scales hand movements down, adds wristed instruments and gives 3D vision, but haptic feedback has historically been limited. And surgical instruments are a vast, conservative field of precision design, constrained above all by the need to be cleaned and sterilised. Dose, fractions, and the linear accelerator Gray: one joule per kilogram CT organ dose: tens of milligray. Curative course: 60 to 70 Gy About 2 Gy a day over six to seven weeks — normal tissue repairs better Megavoltage beam shaped by a multileaf collimator; IMRT, IGRT, protons Radiotherapy damages the DNA of cancer cells so that they die when they try to divide. Dose is measured in gray, one joule absorbed per kilogram. Put the numbers beside chapter sixteen: a CT gives an organ dose of tens of milligray, while a curative course might deliver sixty to seventy gray, thousands of times more, typically in daily fractions of about two gray over six or seven weeks. Fractionation works because normal tissues repair sublethal damage between fractions better than many tumours. A linear accelerator drives electrons into a target to make a megavoltage beam, and a multileaf collimator of tungsten leaves shapes it to the tumour. Image guidance checks position before each fraction, and protons stop at a set depth. Immobilisation: the maker-shaped object in the room Thermoplastic masks moulded over face and shoulders Vacuum bags, knee rests, breast boards, arm supports They sit in the beam : attenuation, scatter, skin dose Specified, measured, and commissioned by medical physicists Masks cause claustrophobia — a design problem too Because millimetres matter, patients are held in reproducible positions for every fraction. For head and neck treatment, a sheet of thermoplastic mesh is softened in warm water and moulded over the face and shoulders to make a custom mask that clips to the couch. Vacuum bags, knee rests, breast boards and arm supports do the same elsewhere. These are objects a maker recognises at once, and they sit in the beam. Every material attenuates and scatters radiation and can change the skin dose, so they are specified, measured and commissioned by medical physicists. A custom positioning aid can be a genuine contribution, but only through that route. And masks are a known source of distress, which is a design problem too. Therac-25: the machine that taught software engineering Hardware interlocks were removed; software with a race condition took their place. A cryptic error, a resumable treatment, and doubted reports of pain. 1985 to 1987: massive overdoses to six patients, several of whom died
Between nineteen eighty-five and nineteen eighty-seven a computer-controlled radiotherapy machine delivered massive overdoses to six patients, several of whom died. Earlier models had independent hardware interlocks that physically prevented a dangerous beam configuration. The new model relied on software, which contained a race condition triggered when an experienced operator edited settings quickly. The machine showed a cryptic error and allowed treatment to resume, and patients' reports of pain were at first doubted. The lessons, independent safety mechanisms, re-verifying reused software, error messages that mean something, and taking incident reports seriously, are the foundation of the requirements and software chapters. Implants Hips and knees: wear particles, osteolysis, stress shielding Stents: restenosis, clot, fracture; drug-eluting to reduce narrowing Valves: mechanical needs anticoagulation; biological degrades Neurostimulators, cochlear and dental implants Registries spot failing designs, years later, from thousands of patients An implant is meant to remain in the body for decades under millions of loading cycles, so everything about corrosion and leachables applies. A hip replacement has a metal stem, a metal or ceramic ball and a polyethylene bearing, which is why this X-ray shows wire markers outlining the cup. Wear particles trigger inflammation that dissolves bone, and stiff metal carrying load the bone used to carry lets the bone thin. Stents can re-narrow or clot. Mechanical heart valves need lifelong anticoagulation; biological ones degrade over years. Implants carry unique identifiers, and national registries are how failing designs are spotted, statistically, years after approval. That is post-market surveillance working as a measurement system. Drug delivery and pharmacokinetics Absorption, distribution, metabolism, excretion Half-life: steady state after four to five half-lives Narrow therapeutic window drugs are the pump-and-library drugs Routes: IV, subcutaneous, inhaled, transdermal, oral, intrathecal Most treatment is a drug, and many devices exist only to get a drug into the right place at the right rate. Pharmacokinetics is what the body does to a drug: absorption, distribution, metabolism and excretion. Many drugs are eliminated at a constant fraction per unit time, summarised by the half-life, and regular doses build to a steady state over four to five half-lives. The therapeutic window is the range between the level that works and the level that harms. Drugs with a narrow window, some anticoagulants, heart drugs, insulin and opioids, are exactly the ones given by pump, protected by drug libraries and checked by blood tests. The inhaler is a pure usability problem Metered-dose: press while breathing in slowly and deeply, then hold Many cannot coordinate it — the dose hits the throat A spacer removes the timing requirement Dry powder needs the opposite: a fast, forceful breath Autoinjectors: users injected their thumbs; grip, colour, shape redesigned The inhaler deserves a closer look because it is a pure usability problem. A pressurised metered-dose inhaler needs you to press the canister while breathing in slowly and deeply, then hold your breath. Many people cannot coordinate that, so most of the dose lands on the back of the throat. A spacer removes the timing requirement. A dry-powder inhaler needs the opposite technique, a fast, forceful breath, so someone moved from one to the other without being retaught may use the right drug with the wrong breath. Autoinjectors tell a similar story: users injected their own thumbs by holding the device backwards, which drove redesign of grip, colour and shape. Engineering bridge: the numbers inside the machines Calculation Example Lung time constant τ = R × C R 10, C 0.05 gives 0.5 s; R 30 gives 1.5 s — breath stacking Defibrillator E = ½CV² 200 J from 150 μF needs about 1600 V; about 20 A into 75 Ω Infusion rate 0.1 μg/kg/min, 80 kg, 4 mg in 50 mL gives 6 mL/h Half-life 400 mg, 6 h half-life: 25 mg after a day Dialysis clearance 300 mL/min, 30 in and 9 out: 210 mL/min; Kt/V about 1.2
Three unit conversions in one infusion: confuse mg and μg and you are 1000 times out.
The bridge is a set of calculations. During exhalation the lung behaves like a capacitor discharging through a resistor, with time constant resistance times compliance. Triple the resistance, as in a severe asthma attack, and if the ventilator does not allow enough time, air is trapped breath by breath. A defibrillator storing two hundred joules in a hundred and fifty microfarads needs about sixteen hundred volts, roughly twenty amps into the chest, and holds a lethal charge after it is switched off. An infusion of point one microgram per kilogram per minute for an eighty kilogram patient, from four milligrams in fifty millilitres, runs at six millilitres an hour, through three unit conversions, each a documented source of ten, sixty or thousand-fold error. Where an engineer can contribute Area Maker-relevant work Ventilation Test lungs with adjustable R and C — never in a gas path Infusion Pole mounts, labelling aids, drug-library analysis with pharmacy Resuscitation AED trainer shells, CPR feedback electronics — no energy storage, ever Theatre Instrument tray layout, positioning-aid prototypes for review Radiotherapy Positioning aids and bolus — only with medical physics commissioning Drug delivery and rehab Trainers, adaptive grips, covers, liners — not sockets
Very little of this is the therapy itself. A test lung with adjustable resistance and compliance, made from bellows, springs and machined restrictors, teaches the time constant, and never goes in a gas path. Infusion needs mounts, labelling aids and data analysis with pharmacy. Resuscitation needs AED trainer shells and CPR feedback devices built from a sensor, a microcontroller and a display, with no energy storage ever. Theatres need tray layouts and positioning-aid prototypes for review. Radiotherapy positioning aids and bolus are possible only with medical physics commissioning. And rehabilitation needs trainers, grips, covers and liners alongside the prosthetist, but never sockets or load-bearing parts. Worked example: "build us simple ventilators" Requirement Bag-squeezer status Accurate tidal volume or pressure Not met — depends on bag, leaks, compliance Pressure limit Not met — no sensing PEEP, rate, I:E ratio Partly Adjustable oxygen fraction Not met Patient-triggered breaths Not met Alarms and single-fault safety None
"We can't responsibly build a ventilator in time. Here is what we can do instead."
In a crisis a hospital asks: could you build simple ventilators, a motor squeezing a bag? Start with what a ventilator has to do. Regulators published minimum specifications for exactly this in twenty twenty. A cam squeezing a bag delivers a volume of motion, not a breath; whether that becomes a safe breath depends on the patient's resistance and compliance, which change over hours. It cannot limit pressure, set oxygen, respond to the patient, or alarm. The honest answer is: we cannot responsibly build one in time, but here is what we can do instead. Mounts for the ventilators you have, test lungs for staff retraining, quick-reference cards, and test fixtures for a team with a real regulatory route. Workshop exercise and exit criteria An RC lung in low-voltage electronics; watch breath stacking A mechanical test lung with interchangeable restrictors An infusion calculator with units in the types, tested for 10×, 60×, 1000× Repeated dosing to steady state on a spreadsheet; inhaler task analysis Complete a recognised CPR and AED course Never build or salvage anything that stores high energy or delivers therapy.
For the exercises: build the lung as a low-voltage capacitor and resistor, logged by a microcontroller, and watch breath stacking appear when exhalation time is cut. Build a mechanical test lung with interchangeable restrictors and label its limitations. Write an infusion calculator that carries units in its types and refuses ambiguous input, with tests for the ten, sixty and thousand-fold errors. Model repeated dosing on a spreadsheet, and decompose inhaler technique using placebo trainers. And complete a recognised CPR and AED course; it is the one practical skill in this chapter that applies to a person. What this chapter does not establish You cannot set, operate, or troubleshoot any of these on a person You cannot calculate or check doses for real patients Nothing in the gas, fluid, energy, or beam path, or in the body Modes, energies, and doses here are orientation figures Knowing the incidents is not the same as preventing them Next — Discovering a clinical need.
The limits. You cannot set, operate or troubleshoot any of these devices on a person; each is operated by trained, often registered professionals. You cannot calculate or check doses for real patients; the arithmetic here explains why errors happen, not how to prescribe. Nothing you build goes in the gas path, fluid path, energy path or beam, or in the body. The figures quoted are orientation, and real settings are individual clinical decisions. And knowing the incidents is not the same as preventing them; that is done through process and independent review, not individual vigilance. Next, discovering a clinical need. 
