
Airbreak.dev: Jailbreak your CPAP machine to turn them into ventilators - yarapavan
https://airbreak.dev
======
wormyrocks
Hi, I worked on this project and have a couple comments to address the issues
people are raising.

\- There are established medical protocols to treat COVID-19 patients with
BiPAP machines, including the addition of a viral filter to mitigate
aerosolizing the virus. People are using these protocols now and we link to
them from the site.

\- There are two separate firmware hacks presented. The first one modifies ~20
bytes and provides UI access to BiPAP code left in the existing binary, which
would allow the more common CPAP machines to fulfill the same limited
function. The second is a PoC of a 'full ventilator' mode.

\- The manufacturer's CPAP and BiPAP lines have identical mainboard designs
and a near identical array of sensors, which provide realtime data including
tidal volume calculations. This project exists as a PoC to show that it would
be possible - simple, even - for the manufacturer to convert CPAPs to BiPAPs
via an OTA update - or, with significantly more effort, to fully featured
ventilators. It is likely that they are reluctant to acknowledge this is
possible in fear of destroying the market for the BiPAP machines.

\- If you are a SleepyHead/OSCAR developer, or have access to an AirCurve S10
and an ST programmer, I would love to talk.

~~~
gmueckl
> a near identical array of sensors

I don't know anything about the devices in question, but from what I know of
engineering of medical devices, stating "near identical" makes me listen up.

If these devices malfunction, they could hurt people. I expect a device like
this to have an extensive array of sensors and a lot of extra hardware for
constant self-monitoring. If the two lines of devices don't have exactly
identical hardware, the differences need to be checked carefully. The lower
tier device may be missing some capabilities because of that.

Also, it is not obvious that the main development effort for a medical device
often isn't about making a device perform its primary function, but to make it
incapable of doing anything else. That includes automatic detection of
malfunction and appropriate safe modes (simply turning it off may not be
safe!). Of course, all of that needs to be tested and validated very
thoroughly. If you ever want to use a hacked device on a patient, you will
have to prove that it is up to the same engineering standards. That is no
simple task, but it beats hurting or killing people because of bugs.

In short, this isn't a job for the regular basement-dwelling hacker, the kind
who is happy to have his Roomba drive around with a hacked up firmware. This
needs some serious and methodical engineering effort to become practical.

~~~
sneak
> _If these devices malfunction, they could hurt people._

I think that the circumstances under which these are being developed are a
special emergency; the alternative to using such a less-safe, makeshift device
here would be no ventilator at all, i.e. near-certain death.

In this specific circumstance, I think this sort of criticism should be
withheld. I don't think anyone's talking about reflashing CPAPs to be life
support outside of a temporary C19 emergency shortage.

~~~
bearcobra
The YouTube channel Real Engineering has a great video breaking down why that
might not actually be true. The possibility that makeshift devices could cause
barotrauma and make things worse seems quite significant. You can check it out
here if your interested:
[https://www.youtube.com/watch?v=7vLPefHYWpY](https://www.youtube.com/watch?v=7vLPefHYWpY)

~~~
sneak
I just watched the video. I'm not sure what outcome is worse than "you need a
ventilator, but we are out of all of the safe, high-quality ones, and so you
will now suffocate and die". In that circumstance I am certain that very
nearly 100% of patients would accept potential barotrauma versus the
alternative.

~~~
mumblemumble
If we're to keep it real, my understanding is that, if you have COVID-19 and
need ventilation but can't get it, you're all but guaranteed to die. So,
assuming a real ventilator is not available, then avoiding makeshift measures
due to worries about barotrauma seems to me to be somewhat akin to saying that
people shouldn't administer CPR because it's likely to break ribs.

------
favorited
The CPAP jailbreak community was eye-opening when I first learned of it. I
never expected something like that, but with the draconian policies it's not
surprising.

For example, my CPAP has a CDMA radio inside, which transmits usage data back
to the manufacturer & my doctor. Insurance won't pay for it unless the machine
tells them I'm using it – so a medical device company has a record of when I
sleep and wake, which is mildly unnerving.

Edit: I think sleepyhead[0] was the biggest project when I started looking
into it, but it isn't under active development anymore. Apparently forked to
OSCAR[1].

[0][https://gitlab.com/sleepyhead/sleepyhead-
code](https://gitlab.com/sleepyhead/sleepyhead-code)

[1][https://gitlab.com/pholy/OSCAR-code](https://gitlab.com/pholy/OSCAR-code)

~~~
ars
The CPAP world is a microcosm of what's wrong in the medical world, i.e. why
things cost so much.

A CPAP machines costs about 10x as much as it should, and a part of that is
insurance companies wanting to make sure they are not paying for a device you
are not using.

Which then increases the price, which makes insurance companies even more
worried about them.

Then you are paternalism where only a Dr. is allowed to change the settings on
the machine. So they lock them down, which adds even more to the cost.

And then they are prescription only, so they have to go through specialized
distributors because heaven forbid someone actually buy one without a Dr.
letting them.

The end result of all this is lots of people making money, and higher costs
for the patient in the form of higher insurance premiums.

~~~
SubiculumCode
Its worse than that. Before receiving a CPAP machine ~$1,000, most doctor's
require a sleep study, which costs many thousands of dollars, and many times
wait months to get the appointment. CPAP machines are usually the ultimate
solution to reported sleep problems involving repeatedly waking up, and I
don't see why they can't be prescribed immediately to see if they solve the
problem.

~~~
prostheticvamp
Because (a) there are problems that are not sleep apnea that should not be
missed, and (b) the cpap pressure needs to be titrated to your need, it’s not
a binary device.

Admittedly, (b) is now less of an issue since there are a handful of auto-
titrating machines on the market now. They’re less reliable than a sleep
study, but they’re better than nothing.

~~~
SubiculumCode
Yeah, the newest modern CPAP machines auto-titrate. On your back? It ups the
pressure if it detects less breathing. On your side, it will lower the
pressure. Its quite nice. I have a ResMed AirSense 10 for two years now...but
I imagine if I had got my machine a few years earlier it would have been
different.

It is true that other things can be the issue. There is a place for sleep
studies, and at home sleep studies can detect sleep apnea fast and cheaply,
and should be the first option, unless some other ?neurological? symptom is
already presenting itself.

------
stcredzero
Here's what you should really know before you design a ventilator, by someone
who works for a medical equipment company.

[https://www.youtube.com/watch?v=7vLPefHYWpY](https://www.youtube.com/watch?v=7vLPefHYWpY)

~~~
alepacheco
Really good video right there!

~~~
quickthrower2
The Indian design with the android phone looks very interesting - I hope that
can be shared and mass produced, assuming it does a decent and safe job.

------
dfsegoat
Not a doctor. But I am seeing growing evidence that ventilators are overused
potentially. From ref [1]:

> _But as doctors learn more about treating Covid-19, and question old dogma
> about blood oxygen and the need for ventilators, they might be able to
> substitute simpler and more widely available devices._

and

> _" In a small study last week in Annals of Intensive Care, physicians who
> treated Covid-19 patients at two hospitals in China found that the majority
> of patients needed no more than a nasal cannula."_

1 - [https://www.statnews.com/2020/04/08/doctors-say-
ventilators-...](https://www.statnews.com/2020/04/08/doctors-say-ventilators-
overused-for-covid-19/)

~~~
imhoguy
More sources: [https://time.com/5818547/ventilators-
coronavirus/](https://time.com/5818547/ventilators-coronavirus/)
[https://www.telegraph.co.uk/global-health/science-and-
diseas...](https://www.telegraph.co.uk/global-health/science-and-
disease/intensive-care-doctors-question-overly-aggressive-use-ventilators/)

------
dontparticipate
Messing with vents if you don't know what you're doing sounds like a sure fire
way to kill yourself.

~~~
schuetze
Agreed. BiPaP to ventilator already seemed like a somewhat questionable
transformation, and now we're going

CPAP ----questionable software hackery ----> BiPaP --- questionable hardware
hacking ---> Ventilator

This is hubris. Ventilators are not iPhones circa 2010. It's irresponsible for
non-medical researchers to not only pursue, but also disseminate, these
jailbreaks. A significant portion of medical device RnD is related to creating
technology that is hard to misuse and won't result in accidental death, and I
just don't see that here.

~~~
jauer
> it's irresponsible for non-medical researchers to not only pursue, but also
> disseminate, these jailbreaks. A good portion of medical device RnD is
> related to creating technology that is hard to misuse and result in
> accidental death, and I just don't see that here.

This is simply wrong, both from a user perspective and a general research
perspective.

Positioning a jailbreak like this as a solution to general vent shortage may
be irresponsible if it leads to people trying to treat others instead of
relying on doctors, but going beyond that is ignoring the good that's come
from work like this.

Hacked up and jailbroken insulin pumps have been a thing for years, often to
get increased safety over what manufacturers can provide:
[https://medium.com/neodotlife/dana-lewis-open-aps-hack-
artif...](https://medium.com/neodotlife/dana-lewis-open-aps-hack-artificial-
pancreas-af6ef23a997f)

There's also a history of people unlocking and altering settings in CPAP/BiPAP
devices in response to data (many providers treat them as set and forget
devices and don't bother reviewing logs except for initial patient
compliance).

Beyond people hacking their own devices, we've seen that security of medical
devices wouldn't improve without independent researchers highlighting the
flaws and driving them to fix them: [https://www.cnbc.com/2018/08/17/security-
researchers-say-the...](https://www.cnbc.com/2018/08/17/security-researchers-
say-they-can-hack-medtronic-pacemakers.html) and
[https://www.darkreading.com/vulnerabilities---
threats/lethal...](https://www.darkreading.com/vulnerabilities---
threats/lethal-dosage-of-cybercrime-hacking-the-iv-pump/d/d-id/1329490)

~~~
schuetze
Perhaps this is aimed at non-American healthcare systems, but I have not seen
a single report of American hospitals running out of ventilators, let alone
BiPaP machines. In order for this to be a responsible hack — used under the
guidance of medical professionals — we would need to have run out of both.

If anything, at least in the American context, I'm more worried about running
out of the sedative necessary for ventilation.[1]

I have nothing against hardware hacking in non-pandemics. If you want to hack
your own insulin pump or create epi-pens on your own (non-crisis) time, that's
fine by me.

But I think the cost-benefit-risk analysis changes in pandemics, because
people are too hungry for easy fixes and make ill-advised decisions under
pressure. For example, even doctors (ostensibly medically-literate
professionals) are prescribing themselves hydrochloroquine [2], which does not
seem to be a miracle cure and sometimes, itself, dangerous (and also leaves
lupus sufferers at risk of a disrupted supply chain).

[1] [https://www.vox.com/2020/4/6/21209589/coronavirus-
medicine-v...](https://www.vox.com/2020/4/6/21209589/coronavirus-medicine-
ventilators-drug-shortage-sedatives-covid-19)

[2] [https://www.nytimes.com/2020/04/12/health/chloroquine-
corona...](https://www.nytimes.com/2020/04/12/health/chloroquine-coronavirus-
trump.html)

~~~
hombre_fatal
> but I have not seen a single report of American hospitals running out of
> ventilators

Are you really not going to just google "USA ventilator shortage"?

Also BiPaP machines require the same hack as CPAP machines. And of course a
further hack for invasive intubation (which ventilators can do out of the
box), though you aren't going to do that to your nightstand CPAP machine
either.

Anyways, rest assured that the few people who can be bothered to jailbreak
their CPAP machine are not the same kind of people who drink their koi pond
cleaner. I think this kind of fear about people hacking their gadgets is
misplaced.

It also reeks of what I can only register as this weird "doc knows best"
subservience to the medical system. This is probably the weirdest meme I see
on HN. And, as people upstream point out, nobody out there is paying attention
to your insulin pump or CPAP machine settings. They just leave it on whatever
default setting. It's all entirely on you to do the research to improve things
for you.

~~~
tptacek
The search you propose doesn't rebut their comment. We're all aware of the
concern about shortages. Their claim was different.

There are stories about NYT hospitals doubling up patients on ventilators, but
those stories are explicit about the fact that those hospitals have not run
out of vents, and are instead working out the protocols for sharing them
when/if it becomes necessary.

------
tcbawo
Not a doctor. A major issue with using this type of CPAP machine on a Covid-19
positive person is the high amount of aerosolized virus particles it exhausts.
Anyone using this should be extremely careful and know what they're doing.
That being said, doctors in many countries are using positive air pressure
machines with an air-tight helmet/bag with filtered exhaust.

~~~
fortran77
What's scary is that CPAP machines are allowed on airplanes. If they really
aerosolize virus particles, maybe they shouldn't be.

~~~
dpeck
At least on Delta flights they’re not allowed to be used, I’m not sure if the
same policy exists on other airlines.

Edit: I was wrong, see below

~~~
reaperducer
I'd be _very_ surprised to see any airline restrict the use of a medical
device onboard. The manual that came with mine states that airlines are
required to let you use it, and the manufacturer sells an airline-friendly
battery pack. Do you have a link to Delta's policy on this?

~~~
dpeck
My mistake, I was wrong. They allow use, but it has to have its own power
supply [https://www.delta.com/us/en/accessible-travel-
services/assis...](https://www.delta.com/us/en/accessible-travel-
services/assistive-devices-medication)

~~~
cameldrv
This would seem to be because they don't want to be held to providing medical
grade reliability of electricity to the seat.

------
jon_elbrook
ventilators don't just pump air. they also monitor and control the amount of
air, and beep when something is wrong. plus a bunch of other features...

~~~
takk309
Exactly, I would not like being hooked up to a machine that could overinflate
my lungs without sounding any alarms.

~~~
CydeWeys
Well good thing a CPAP won't do that to you then, for obvious reasons.

------
fowkswe
Also worth understanding that a ventilator is not always the best option -
there have been findings recently that a tactic called 'proning' is often
enough to increase blood oxygen:

[https://www.nytimes.com/2020/04/14/nyregion/new-york-
coronav...](https://www.nytimes.com/2020/04/14/nyregion/new-york-
coronavirus.html)

~~~
w0mbat
TLDR; They treated patients who presented with low blood oxygen by lying them
on their belly or side and giving them oxygen through a nasal tube. No machine
required. In many cases it worked perfectly.

------
bhartzer
Jailbreaking the CPAP machine might not be necessary. From what I understand,
a CPAP, in certain circumstances, can be given to someone who has 'milder'
COVID-19 symptoms. That would then free up a ventilator so the vent can go to
someone who has more severe symptoms.

------
pkaye
This is an informative video in what is involved in designing ventilators.

[https://www.youtube.com/watch?v=7vLPefHYWpY](https://www.youtube.com/watch?v=7vLPefHYWpY)

------
justicezyx
Talking about cpap machine, I did some research on it, and found that they are
regulated medical device and cannot be purchased without prescription.

I suffer chronicle dry nose, moderate empty nose syndrome on the right side
(due to surgery done 20 years ago in China), and Deviated Septum (due to
injury as kid). One thing often happen to me is during middle of nigh sleep,
my left nose duct will be extremely dry, causing me to wake up and switch side
(it seems my nasal cycle is completely gone).

One idea I wanted to try to fix is to use a cpap + humidifier to pump
moisturized air.

And I found that I have to get prescription, which I tried with one lab sleep
study causing $3000+, and concluded that I do not have sleep apnea, which is
one of the symptoms to qualify cpap prescription.

Then I started to look for off market cpap machine on Craigslist. No luck, the
machines are often old, and beat up after long usages.

I did not seriously research if cpap has risks to normal people. But it does
not seem harmful, unfortunately it has to be regulated and possibly also
become very expensive.

Edit: Thanks for the good recommendations. Buying from Chinese site (I often
forgot this), nebulizer, etc.

~~~
robterrell
You can find CPAPs on eBay, but my understanding is that you'd want a sleep
study to validate the correct pressure settings. Are you sure you can't just
set up a room humidifier?

~~~
jschwartzi
Or sleep with a face mask with a Heat and Moisture Exchanger(HME) in it?

------
tibbydudeza
"The breath extension replaces the function at 0x80bb734"

It sounds what Naughty Dog did to get RAM on the PSX for Crash Bandicoot ...
they grabbed memory already allocated by the Sony runtime libs and would use
it if it not do anything bad.

A crashing game console is not a ventilator but a good hack nonetheless.

~~~
gowld
It's a standard technique -- binary patching.

[https://en.m.wikipedia.org/wiki/Patch_(computing)](https://en.m.wikipedia.org/wiki/Patch_\(computing\))

------
IdoRA
There is a reasonable chance that this will not be as useful as the team
hopes:

1) They are increasing maximum pressure and pressure rate changes beyond the
built-in design parameters. If these new parameters are outside what the
engineering requirements document spec, these changes are a problem in seeking
EUA.

2) In regulatory affairs, _authorized_ , _cleared_ , and _approved_ have very
specific (and enforceable) meanings. If someone is loose with how they use
these words, it suggests they don’t have someone with regulatory experience
involved (a negative sign). The earlier the team can engage with someone with
regulatory experience, the better.

~~~
reaperducer
These are not normal times, and I can certainly see a doctor with tinkering
skills modding his office's CPAP stock in order to save lives.

~~~
gowld
Not likely a doctor in a US hospital. Too much liability risk.

~~~
Ericson2314
The idea is manufacturers don't want to loose money and do this stuff
themselves, so somebody donates their time to bring this hack to the FDA, and
then the hospitals can use it.

------
w0mbat
The headline switches from singular to plural halfway through.

I love this idea though. The manufacturers should get onboard with “emergency
BiPAP” mode to make this happen without users having to do an elaborate hack.

------
oxymoran
If the the only difference between company X’s CPAP machine and company X’s
BiPAP machine is purely software, shouldn’t we just pay and/or force them to
unlock the features via update?

------
ac130kz
CPAPs are known to be very closed systems, I remember a couple of articles
about handy SleepyHead analysis software. If anyone interested, it was forked
- new name is OSCAR.

------
fiftyacorn
Would these not be too simple to address the ventilation requirements of the
coronavirus?

This was the case with the ventilators from a consortium in the UK, where the
profile of corona requires more complex ventilation -

[https://www.theguardian.com/world/2020/apr/13/uk-scraps-
plan...](https://www.theguardian.com/world/2020/apr/13/uk-scraps-plans-to-buy-
thousands-of-bluesky-ventilators-coronavirus)

------
VectorLock
Very great. I was really really curious if this was possible and how much work
it would be. As you said a lot of CPAP machines are very close in
functionality to BiPAP machines. I could see this being very helpful to people
who are having a hard time with CPAP therapy but are having difficultly
getting their insurance provider to approve a BiPAP machine which are more
expensive (something I've experienced)

~~~
TylerE
Yeah this is something I’m wondering too. I’m on a CPAP, not sure if I could
get approved for a bipap or not. I run quite high pressure for straight CPAP
(range from 18.8 up the machines max of 20). Some nights I peak around 19.6
but other nights will Max it out. Most bipaps will go up to 25.

------
Isamu
It’s true, it is mostly a software change to upgrade a cpap into a bi-level
device more like a ventilator. The barrier is really about procurement, and if
they are proposing to reuse devices then it is all about shipping them to a
location to be cleaned and tested, modified if necessary, repacked and shipped
to a destination with new masks, hoses, and proper updated manuals.

------
dimgl
This is very cool. I was wondering the other day if my CPAP machine (same
model) would be capable of doubling as a ventilator and I'm surprised that
someone has already thought of this and provided a solution.

~~~
rootusrootus
I've got exactly that model as well. There are probably 10s of millions of
them in use in the US. Really cool to see someone hack them, but I can't say
that I will be doing that with mine :).

------
ck2
if you vent your home cpap machine into an open room and the person using it
is infected, congrats you just vaporized the infection onto anyone nearby

~~~
souprock
Cool. Everybody in the home is already infected by the time somebody needs
breathing assistance, so this is fine.

------
huslage
As a CPAP user who needs a new machine, I am now screwed by this. This will,
by the time I have a new sleep study, cause all sorts of supply issues.

~~~
VectorLock
The pandemic is causing lots of supply issues. I don't think this firmware
patch is even going to be a rounding error in the grand scheme of whats going
on in the world right now. There are tons of CPAP machines this doesn't cover.

------
rmrfrmrf
don't ventilators use intubation? how would this help in that case?

~~~
VectorLock
Ventilators can be used invasively or non-invasively.

