• Despite the U.S. government issuing guidelines to allow re-engineering of CPAP sleep apnea machines into ventilators, a major manufacturer stresses the units would need considerable work.
  • However, a security researcher discovered some of the relevant ventilator functions were already hardcoded into the CPAP device firmware.
  • Now, free instructions are available online to help you jailbreak a CPAP machine, though they're meant as a proof of concept.

Due to a shortage of lifesaving breathing machines amid the COVID-19 (coronavirus) pandemic, the U.S. Food and Drug Administration (FDA) issued guidelines last month that allow hospitals, universities, and manufacturers to rejigger sleep apnea machines—like continuous positive airway pressure (CPAP) units and bilevel positive airway pressure (BiPAP) devices—into ventilators.

But ResMed, one of the largest manufactures of CPAP machines, maintains the medical devices are lacking in certain features and "would require significant rework in order to function as a ventilator," the company says in a blog post.

Now here comes the plot twist: Security researcher Trammell Hudson evaluated the AirSense 10, a CPAP model that ResMed produces, and discovered the only tangible difference between it and a higher-end BiPAP machine came down to a software upgrade, not a complicated hardware change. So Hudson has released developer tools on GitHub to jailbreak the devices into ventilators.

"The CPAP machines have many of the same sensors as the more expensive models, and the AirSense 10 CPAP devices include in their firmware all of the other modes, such as iVAPS and BiPAP-ST," Hudson writes in a blog post for his security patch, aptly named Airbreak. "When we unlock that mode in software, the CPAP device functions like a much more capable and expensive iVAPS device."

According to ResMed, the AirSense CPAP machine Hudson has modded is designed only to provide positive airway pressure and would take serious rework to function as a ventilator.

xView full post on X

Instead, the company points to its AirCurve 10 bilevel devices—which look a whole lot like the CPAP machines—to help COVID-19 patients mechanically breathe. It's worth mentioning the AirSense machine costs about $700, while the AirCurve is closer to $1,700. In other words, buying up the CPAP machines to create ventilators would be much more economical.

Circuit component, Electronic engineering, Electronic component, Electronics, Passive circuit component, Technology, Electronic device, Motherboard, Microcontroller, Circuit prototyping,
Airbreak

What's the main difference between the two? The AirCurve is a bilevel device, which means it propels air into a mask and lowers the pressure to filter the air back out. Meanwhile, the AirSense machine only works in one direction. But after reverse engineering the AirSense firmware, Hudson discovered the lower-end CPAP machine could filter air in both directions with a software bump.

So why the discrepancy between Hudson's work and the ResMed blog?

Popular Mechanics reached out to ResMed for comment, and a representative pointed to an April 16 press statement on the role of CPAP machines for use during the COVID-19 pandemic. In it, ResMed's chief medical officer Carlos M. Nunez, M.D., acknowledges the ability to hack CPAP machines into temporary ventilators, but says hospitals still want ventilators and bilevel machines:

There are reports that CPAPs might be modified to serve as ventilators. While technically it is possible to convert CPAPs to bilevel devices, it would take valuable time and resources to test and validate modifications to ensure we are delivering safe and effective devices that meet regulatory requirements during the COVID-19 pandemic. In addition, the hospitals, health systems, and governments who are working directly with ResMed to prioritize their needs are not requesting modified single-purpose CPAP devices that are commonly used in the home to treat sleep apnea. For these reasons, we have prioritized the production of devices that address the immediate needs of hospitals and what clinicians are asking for.

Still, there are millions of unused or underutilized CPAP and BiPAP devices sitting in closets in America, according to Airbreak, and roughly another 500,000 units in warehouses. "These devices can be used as an alternate ventilator, for low-resource hospitals who are still waiting for the hospital ventilators to arrive," Hudson notes.

What would it take to rehab those machines into ventilators? Hudson emphasizes this modified firmware should not be used on CPAP machines to treat COVID-19 patients immediately, even though the tech has been reviewed and validated by expert researchers, biomedical engineers, and clinical pulmonologists. It still hasn't gone through the FDA approvals process.

If the FDA does approve the firmware updates, or manufacturers like ResMed independently develop their own updates, it could speed up the process of getting breathing machines to patients and keep costs low for hospitals. Hudson says the latter is the best option.

"What we've found in our work is that the work needed for the manufacturer to implement these upgrades is pretty minimal—the manufacturer has access to the source code, to the schematics, and to the engineers who are intimately familiar with physiology and safety standards," the Airbreak website says.

Still, if manufacturers absolutely refuse to cooperate, Airbreak will pursue its own FDA approvals.

Headshot of Courtney Linder
Courtney Linder
Deputy Editor
Before joining Pop Mech, Courtney was the technology reporter at her hometown newspaper, the Pittsburgh Post-Gazette. She is a graduate of the University of Pittsburgh, where she studied English and economics. Her favorite topics include, but are not limited to: the giant squid, punk rock, and robotics. She lives in the Philly suburbs with her partner, her black cat, and towers upon towers of books.