Welcome to chapter seventeen. Chapter sixteen opened the machines that find out what is wrong. This chapter opens the machines that do something about it: the ventilator that breathes for a person, the pump that delivers a drug drop by drop, the defibrillator that restarts a heart, the dialysis machine that stands in for failed kidneys, the electrosurgical unit that cuts and seals, the linear accelerator that kills a tumour, and implants that stay in a body for decades. For each we ask the same questions: what physical principle does it use, how does it work, what is it for, how does it fail, and who operates it.
Almost every device in this chapter is professional territory, tier three in the device index. That is not a reason to skip them. They are the context of most clinical work you will be near: a training manikin is ventilated, a simulation scenario uses an infusion pump, a positioning aid sits in a radiotherapy beam. They are where the engineering safety lessons were learned the hard way: alarm fatigue, unit errors, a radiotherapy machine whose software overdosed patients, burns, and surgical fires. And they are the devices you may be asked to make. In twenty twenty, makers worldwide were asked to build ventilators. This chapter is so that you would understand why the honest answer was usually to build something else.
A life-supporting device is one whose failure or misuse can kill within minutes. Three engineering consequences follow. Single-fault safety: the design must stay safe, or fail to a safe state with an alarm, after any single component failure, whether a sensor, a valve, a power supply or a line of code. Alarms are part of the therapy, because the device cannot fix every problem. And the operator is part of the system. That makes alarm overload a hazard in its own right. An intensive care bed can generate hundreds of alarms a day, most false or needing no action. Staff learn, usually correctly, that an alarm means nothing, and then one does. Every alarm you add competes for the same attention.
We begin with the ventilator.
In normal breathing the diaphragm lowers chest pressure below atmospheric and air is drawn in. A ventilator does the opposite: it pushes gas in under positive pressure and lets the lungs recoil to push it out. That reversal squeezes the great veins in the chest, so starting ventilation can drop blood pressure. Too much pressure or volume injures the lung itself, which is why modern practice uses small breaths, around six millilitres per kilogram of predicted body weight in the most severe lung disease. The circuit is a closed loop: a blender sets the oxygen fraction, valves deliver each breath, sensors measure pressure and flow, and an expiratory valve holds positive end-expiratory pressure, PEEP, to keep small airways open.
There are dozens of named ventilator modes, and the names differ between manufacturers. Nearly all are variations on one choice: what does the machine control, and what does it let vary? In volume control the operator sets the breath size and the machine delivers it, whatever pressure that takes. If the lungs stiffen or the tube kinks, pressure rises, risking injury. In pressure control the operator sets the pressure and the machine delivers it, whatever volume results. If the lungs stiffen, volume falls and the person is under-ventilated. Breaths may be machine-timed, triggered by the patient's own effort, or spontaneous with support, and weaning is a gradual handover of the work of breathing.
Not all support needs a tube. CPAP applies one constant pressure through a mask, splinting the upper airway open in obstructive sleep apnoea. Bilevel non-invasive ventilation alternates higher and lower pressures to assist each breath. High-flow nasal oxygen delivers heated, humidified gas at up to about sixty litres a minute. Oxygen comes from piped systems, from cylinders at one hundred and forty to two hundred and thirty bar, or from concentrators that strip nitrogen from room air. Two things matter to you at once. Masks are a pressure-injury problem on the bridge of the nose. And oxygen is a fire accelerant: materials that barely burn in air burn fiercely in enriched oxygen.
There are two mechanisms. A volumetric pump uses peristaltic fingers or a cassette to squeeze a dedicated administration set, delivering fluids, antibiotics and feeds at several to hundreds of millilitres an hour, typically to within about five percent. A syringe driver uses a lead screw to push the plunger of a syringe at a controlled speed. It is used for small volumes of concentrated, potent drugs at low rates, down to fractions of a millilitre an hour, for neonates, pain relief and end-of-life care. It is accurate once running, but at very low rates its start-up can be slow.
Each failure has a design response, and every response has a limitation. Free flow, when a set is removed unclamped and gravity empties the bag, is stopped by clamps that close automatically. Occlusion is detected by rising pressure, but at low rates pressure builds slowly, so it can go unalarmed for a long time, and the stored volume arrives as a bolus when it clears. Syringe drivers can siphon or lag at start-up. Air is detected ultrasonically. But the dominant failure is programming: fifty instead of five point zero, milligrams where micrograms were meant, pounds treated as kilograms, a rate confused with a dose. Ten-fold and thousand-fold errors are documented again and again.
Smart pumps carry a drug library: concentrations and usual dose ranges for each drug in each clinical area. A soft limit asks whether you are sure; a hard limit refuses. They catch many gross errors. They cannot catch a wrong drug selected, a wrong patient, an error within the allowed range, or a pump programmed outside the library. Sending the prescription straight to the pump removes manual keying, at the cost of new software failure modes, the subject of chapter twenty. Insulin pumps are the same idea worn on the body, and paired with a continuous glucose monitor and an algorithm they form automated insulin delivery systems.
In ventricular fibrillation the heart's electrical activity has disintegrated into chaotic wavelets and the muscle quivers without pumping. A defibrillator passes a large, brief current through the chest that depolarises a critical mass of heart muscle at once, so the chaos is extinguished and the heart's own pacemaker can take over. It charges a capacitor and discharges it through two pads. Modern biphasic devices typically use one hundred and twenty to two hundred joules; older monophasic waveforms used up to three hundred and sixty. The chest's impedance, often fifty to a hundred and fifty ohms, decides the current that flows, so modern devices measure it and compensate. Cardioversion is a smaller shock timed to the heartbeat.
The automated external defibrillator is designed for someone who has never seen one, under extreme stress, in a public place. It turns on when the lid opens. It talks. The pads show where they go. It analyses the rhythm itself and will only shock a rhythm its algorithm classifies as shockable, so a bystander cannot shock someone who does not need it. It prompts and times chest compressions. Survival from a cardiac arrest in ventricular fibrillation falls with every minute without defibrillation, so this matters enormously. It is one of the best examples in medicine of the perception, cognition, action and feedback decomposition from chapter seven, applied so that safety comes from design.
A pacemaker is a battery-powered pulse generator under the skin below the collarbone, with leads into the heart, or a leadless capsule inside it. It senses the heart's own activity and paces, a pulse of a few volts for a fraction of a millisecond, only when the natural rhythm is too slow. Pacing modes use a short letter code, such as VVI or DDD, for the chamber paced, the chamber sensed and the response. An implantable cardioverter-defibrillator adds detection of dangerous fast rhythms and can deliver an internal shock of up to a few tens of joules. Inappropriate shocks are a recognised harm. These devices are now networked, and in twenty seventeen roughly half a million pacemakers received a firmware update for a cybersecurity vulnerability.
When kidneys fail, waste, potassium, acid and water accumulate. Haemodialysis passes blood outside the body through a dialyser, a cartridge of thousands of hollow fibres with a total membrane area of one and a half to two square metres. Small solutes diffuse from blood into dialysate, and running dialysate countercurrent to the blood keeps a gradient along the whole fibre, exactly as in a countercurrent heat exchanger. A pressure difference pushes water out, which is ultrafiltration; too much, too fast, and blood pressure falls. A typical schedule is about four hours three times a week, and each session uses well over a hundred litres of dialysate, so water treatment is a major engineering task.
The heart–lung machine used in cardiac surgery takes over both pumping and gas exchange. Blood is drained, pumped through an oxygenator, another hollow-fibre membrane with gas on one side, and returned. ECMO applies the same idea for days or weeks in intensive care. Veno-venous ECMO supports the lungs alone; veno-arterial ECMO supports heart and lungs. These circuits are run by perfusionists and specialist teams, and their defining hazards are clotting in the circuit, bleeding from anticoagulation, air entry, and disconnection.
Now energy in the operating theatre.
Electrosurgery, often called diathermy, cuts and coagulates with radiofrequency current of a few hundred kilohertz to a few megahertz. At those frequencies current heats tissue without stimulating nerves and muscle, which mains frequency would do. Heating depends on current density, current per unit area. In monopolar electrosurgery, the current entering at a tiny active tip must leave through a large pad on the skin, so the tip burns and the pad does not. If the pad partly peels off, current concentrates in what remains and the patient is burned at the pad, under the drapes. Modern generators monitor pad contact. Bipolar instruments pass current only between forceps jaws, and every mode produces smoke that must be extracted.
Surgical lasers are chosen by how their wavelength is absorbed. The carbon dioxide laser is absorbed by water and vaporises tissue at the surface. Neodymium YAG penetrates deeper and coagulates. Green lasers are absorbed by haemoglobin. Excimer ultraviolet removes corneal tissue a fraction of a micrometre at a time. Eye protection is rated for one wavelength and may be useless against another. Surgical fire needs ignition, fuel and an oxidiser together, and each belongs to a different team member: the surgeon controls ignition, the nursing team much of the fuel, the anaesthetist the oxygen. It is a pure systems problem, a hazard that only exists when several people's separate decisions coincide.
Laparoscopic surgery works through ports a few millimetres wide, with the abdomen inflated by carbon dioxide at around twelve to fifteen millimetres of mercury, a camera, and long instruments that pivot at the abdominal wall. The surgeon loses direct touch, depth perception and natural hand–eye alignment, which is exactly what training boxes rebuild. Robotic surgery puts the instruments on arms controlled from a console. The robot does nothing on its own. It filters tremor, scales hand movements down, adds wristed instruments and gives 3D vision, but haptic feedback has historically been limited. And surgical instruments are a vast, conservative field of precision design, constrained above all by the need to be cleaned and sterilised.
Radiotherapy damages the DNA of cancer cells so that they die when they try to divide. Dose is measured in gray, one joule absorbed per kilogram. Put the numbers beside chapter sixteen: a CT gives an organ dose of tens of milligray, while a curative course might deliver sixty to seventy gray, thousands of times more, typically in daily fractions of about two gray over six or seven weeks. Fractionation works because normal tissues repair sublethal damage between fractions better than many tumours. A linear accelerator drives electrons into a target to make a megavoltage beam, and a multileaf collimator of tungsten leaves shapes it to the tumour. Image guidance checks position before each fraction, and protons stop at a set depth.
Because millimetres matter, patients are held in reproducible positions for every fraction. For head and neck treatment, a sheet of thermoplastic mesh is softened in warm water and moulded over the face and shoulders to make a custom mask that clips to the couch. Vacuum bags, knee rests, breast boards and arm supports do the same elsewhere. These are objects a maker recognises at once, and they sit in the beam. Every material attenuates and scatters radiation and can change the skin dose, so they are specified, measured and commissioned by medical physicists. A custom positioning aid can be a genuine contribution, but only through that route. And masks are a known source of distress, which is a design problem too.
Between nineteen eighty-five and nineteen eighty-seven a computer-controlled radiotherapy machine delivered massive overdoses to six patients, several of whom died. Earlier models had independent hardware interlocks that physically prevented a dangerous beam configuration. The new model relied on software, which contained a race condition triggered when an experienced operator edited settings quickly. The machine showed a cryptic error and allowed treatment to resume, and patients' reports of pain were at first doubted. The lessons, independent safety mechanisms, re-verifying reused software, error messages that mean something, and taking incident reports seriously, are the foundation of the requirements and software chapters.
An implant is meant to remain in the body for decades under millions of loading cycles, so everything about corrosion and leachables applies. A hip replacement has a metal stem, a metal or ceramic ball and a polyethylene bearing, which is why this X-ray shows wire markers outlining the cup. Wear particles trigger inflammation that dissolves bone, and stiff metal carrying load the bone used to carry lets the bone thin. Stents can re-narrow or clot. Mechanical heart valves need lifelong anticoagulation; biological ones degrade over years. Implants carry unique identifiers, and national registries are how failing designs are spotted, statistically, years after approval. That is post-market surveillance working as a measurement system.
Most treatment is a drug, and many devices exist only to get a drug into the right place at the right rate. Pharmacokinetics is what the body does to a drug: absorption, distribution, metabolism and excretion. Many drugs are eliminated at a constant fraction per unit time, summarised by the half-life, and regular doses build to a steady state over four to five half-lives. The therapeutic window is the range between the level that works and the level that harms. Drugs with a narrow window, some anticoagulants, heart drugs, insulin and opioids, are exactly the ones given by pump, protected by drug libraries and checked by blood tests.
The inhaler deserves a closer look because it is a pure usability problem. A pressurised metered-dose inhaler needs you to press the canister while breathing in slowly and deeply, then hold your breath. Many people cannot coordinate that, so most of the dose lands on the back of the throat. A spacer removes the timing requirement. A dry-powder inhaler needs the opposite technique, a fast, forceful breath, so someone moved from one to the other without being retaught may use the right drug with the wrong breath. Autoinjectors tell a similar story: users injected their own thumbs by holding the device backwards, which drove redesign of grip, colour and shape.
The bridge is a set of calculations. During exhalation the lung behaves like a capacitor discharging through a resistor, with time constant resistance times compliance. Triple the resistance, as in a severe asthma attack, and if the ventilator does not allow enough time, air is trapped breath by breath. A defibrillator storing two hundred joules in a hundred and fifty microfarads needs about sixteen hundred volts, roughly twenty amps into the chest, and holds a lethal charge after it is switched off. An infusion of point one microgram per kilogram per minute for an eighty kilogram patient, from four milligrams in fifty millilitres, runs at six millilitres an hour, through three unit conversions, each a documented source of ten, sixty or thousand-fold error.
Very little of this is the therapy itself. A test lung with adjustable resistance and compliance, made from bellows, springs and machined restrictors, teaches the time constant, and never goes in a gas path. Infusion needs mounts, labelling aids and data analysis with pharmacy. Resuscitation needs AED trainer shells and CPR feedback devices built from a sensor, a microcontroller and a display, with no energy storage ever. Theatres need tray layouts and positioning-aid prototypes for review. Radiotherapy positioning aids and bolus are possible only with medical physics commissioning. And rehabilitation needs trainers, grips, covers and liners alongside the prosthetist, but never sockets or load-bearing parts.
In a crisis a hospital asks: could you build simple ventilators, a motor squeezing a bag? Start with what a ventilator has to do. Regulators published minimum specifications for exactly this in twenty twenty. A cam squeezing a bag delivers a volume of motion, not a breath; whether that becomes a safe breath depends on the patient's resistance and compliance, which change over hours. It cannot limit pressure, set oxygen, respond to the patient, or alarm. The honest answer is: we cannot responsibly build one in time, but here is what we can do instead. Mounts for the ventilators you have, test lungs for staff retraining, quick-reference cards, and test fixtures for a team with a real regulatory route.
For the exercises: build the lung as a low-voltage capacitor and resistor, logged by a microcontroller, and watch breath stacking appear when exhalation time is cut. Build a mechanical test lung with interchangeable restrictors and label its limitations. Write an infusion calculator that carries units in its types and refuses ambiguous input, with tests for the ten, sixty and thousand-fold errors. Model repeated dosing on a spreadsheet, and decompose inhaler technique using placebo trainers. And complete a recognised CPR and AED course; it is the one practical skill in this chapter that applies to a person.
The limits. You cannot set, operate or troubleshoot any of these devices on a person; each is operated by trained, often registered professionals. You cannot calculate or check doses for real patients; the arithmetic here explains why errors happen, not how to prescribe. Nothing you build goes in the gas path, fluid path, energy path or beam, or in the body. The figures quoted are orientation, and real settings are individual clinical decisions. And knowing the incidents is not the same as preventing them; that is done through process and independent review, not individual vigilance. Next, discovering a clinical need.