When a Ventilator Takes Autonomous Decisions without Seeking Approbation nor Warning Clinicians: A Case Series

Introduction

Since the beginning of mechanical ventilation, huge progresses in safety have been made, both involving technical manufacturer-dependent improvements (metrological precision, number of monitored parameters, human–machine interface, etc.), and medical physician-dependent ones concerning the settings of ventilation (pressure and volume limitation, pathophysiology, hemodynamic consequences, etc.).

Alongside, manufacturers have progressively implemented new features, with variable successes and interest, designed to distinguish themselves from others, like new ventilation modes or proprietary algorithms. The ultimate goal is here to better control and manage mechanical ventilation and to improve patients’ and clinicians’ experiences.

Among these algorithms, many of them were developed based on clinically relevant issues and pathophysiological realities. As examples, one may cite the algorithms controlling the inspiratory trigger in non-invasive ventilation operated with a dual limb respiratory circuit, where leaks created by the non-airtight interface (the mask) have to be analyzed to limit unwanted triggering.¹ Another example are algorithms developed to facilitate and automatize the weaning process in pressure support ventilation based on patient spontaneous activity (respiratory rhythm, tidal volume) and expired CO₂.^2,3 A third example are algorithms dedicated to control the airway pressure, called adaptive pressure-controlled mode (or dual mode) like AutoFlow^® (Dräger), VC+ (Puritan Bennett), APV (Hamilton Galileo).^4,5

All these algorithms respect a basic rule: the clinician is aware of their existence and can switch them off or on. The clinician is also supposed to know the aim of such algorithms, the rough operation mechanism behind them, as well as the potential associated drawbacks.

Here, we report the presence of an unexpected and unwanted algorithm, responsible for airway pressure control in volume-controlled mode, observed in Evita^® V300 and Evita^® Infinity^® V500 ICU ventilators manufactured by Dräger (launched on the market in 2013). When airway resistance suddenly increased, this algorithm switched itself on autonomously and shifted the ventilation from a volumetric mode to a barometric mode, without providing any information to the clinician, with potential lethal consequences.

Materials and Methods

Ventilators presented in this case series were acquired in 2014 (Louis Mourier Hospital, Colombes, France) and 2017 (René Dubos Hospital, Pontoise and Beaumont-sur-Oise Hospital, Beaumont-sur-Oise, France).

These ventilators belong to class IIb of medical devices defined by the European Community regulation (Council Directive 93/42/EEC) and are thus operated under this framework and the national one.⁶ These devices benefit from a yearly maintenance performed by the manufacturer together with regular inspections and maintenance performed by the hospital biomedical department, according to the legal French regulation framework (decree n°2001-1154, December 5, 2001, regarding maintenance obligations and quality control of medical devices mentioned in article L. 5212–1 of the Public Health Code). In the ICU, before being used to ventilate a new patient in the ICU, ventilators are checked through the classical self-test procedure according to the manufacturer instructions.

Identification data of ventilators, time, and place of the observations presented in this article are summarized in Table 1.

Table 1

In experiment 1, we used an ASL 5000 Breathing Simulator (IngMar Medical, Pittsburgh, PA) and a classical dual-limb circuit.

Note that V300 and V500 ventilators share a common foundation regarding the mechanical and pneumatic part but differ in their screen size and slightly in the interface.

Results

Cases Presentation

Case #1

In 2014, a 50-year-old woman was hospitalized in the intensive care unit (Louis Mourier Hospital, Colombes, France) for severe acute respiratory distress syndrome. The patient was ventilated using an Evita^® Infinity^® V500 ventilator (Dräger, Germany), deeply sedated, curarized, and placed in prone position. The ventilator was running in volume-controlled mode. FiO₂, tidal volume (Vt), constant inspiratory flow (V̇), and high-pressure alarm (P_high) were set to 90%, 400 mL, 60 L/min, and 50 mbar, respectively. Autoflow^® (automatic flow variation allowing the prescribed Vt to be applied with the minimal necessary pressure), ATC^® (automated endotracheal tube compensation), and P_max (maximal pressure) functions were set off.

An acute desaturation occurred, with SpO₂ falling from 94% to 78%. The ventilator displayed an intermediate priority alarm of “partially delivered tidal volume”. Expiratory Vt (Vte) and minute volume were indeed decreased. Surprisingly, the intensivist noticed unexpected changes in the pressure and flow curves pattern displayed on the ventilator screen: the typical peak-plateau shape and the square inspiratory flow usually observed in volume-controlled mode were replaced by pressure-support like curves with a constant pressure and a decelerating flow, respectively. Delivered Vt was consistent with Vte and both were constantly below 200 mL. The maximal V̇ visualized on the flow curve was below 30 L/min. Setting FiO₂ to 100% did not improve SpO₂. Simultaneously, a systematic endotracheal tube aspiration was performed and allowed the nurse to detect a tube bending in its external portion. Immediate correction of this anomaly instantaneously modified the pressure-flow curves, with a return to the expected curve shape usually observed in volume-controlled mode and to the expected respiratory parameters including Vt, V̇, and SpO₂. Lowest SpO₂ was 50% and no adverse cardiac event occurred. The patient’s head position was subsequently modified to avoid further tube bending. It turned out that small alternating movements produced by the automatic anti-bedsore mattress were responsible for head and endotracheal tube conformation changes and explained the bending of the endotracheal tube, already positioned in a non-optimal way in prone position.

Because the ventilator temporarily operated with different ventilation settings (mode, Vt and V̇) than those prescribed, a ventilator failure was considered and the machine was replaced. Basic testing of the ventilator performed offline did not reveal any problem and the case was “classified” as unresolved and progressively forgotten.

Case #2

In November 2017, a 60-year-old man was admitted to the ICU for septic shock (Hôpital de Beaumont-sur-Oise, France) and was mechanically ventilated in volume-controlled mode using an Evita^® Infinity^® V500 ventilator, with AutoFlow^®, ATC^®, and P_max functions set off. A few days later, the patient’s condition improved and weaning from the mechanical ventilation was considered, though the weaning process was hindered by an ICU-acquired weakness, a bronchial hypersecretion, and a residual sedation.

While ventilated with an FiO₂ of 50%, a Vt of 430 mL with a P_high alarm set to 50 mbar, the patient’s SpO₂ suddenly dropped from 97% to 85%. Simultaneously, the ventilator was warning with a message of partially delivered Vt and a high priority low minute volume alarm. The nurse set the FiO₂ to 100% and called the intensivist. When the latter arrived, the SpO₂ was 82% and he first noticed that pressure and flow curves were those usually observed in pressure support mode. The clinician's first thought was the ventilator mode had been switched from volume-controlled to pressure support by the nurse. Analysis of the settings confirmed that the ventilator was still set in volume-controlled mode despite the presence of decelerating inspiratory flow and constant pressure (around 30 mbar) displayed on the screen. Vte was <200 mL without leak. At this stage, the diagnosis was unclear and the intensivist was unable to understand why the prescribed tidal volume was not delivered and why a pressure limitation was operated by the ventilator.

Failure in an attempt to perform endotracheal aspiration led to the diagnosis of endotracheal tube obstruction. Increasingthe upper limit of the airway pressure alarm to its maximum value did not change anything with a pressure limitation around 40 mbar. Because the ventilation was not correctly delivered, the saturation worsened, leading to hypoxic bradycardia followed by asystole.

The endotracheal tube was then promptly withdrawn. A manual ventilation provided through a bag and mask supplied with pure oxygen allowing spontaneous cardiac rhythm return after a brief cardiac massage. A new endotracheal tube was then inserted. The patient was connected to another ventilator.

Facing this severe adverse event, the Dräger company was asked to check and service the involved ventilator, but no malfunction was revealed. No satisfactory answer was proposed to explain the whole scenario and this event was once again progressively forgotten.

Case #3

In February 2018, a 55-year-old patient with a history of COPD was admitted to the ICU for acute respiratory failure (Hôpital de Beaumont-sur-Oise, France). He was mechanically ventilated with an Evita^® Infinity^® V500. Later during his stay, a tracheotomy was performed for weaning purpose. While ventilated through the tracheotomy tube in volume-controlled mode, without receiving any sedation, the patient was triggering each inspiratory cycle. Vt was set to 420 mL, FiO₂ to 30%, and P_high alarm to 50 mbar (and AutoFlow^®, ATC^®, Pmax functions set off).

Suddenly, intermittent desaturation episodes occurred and were associated with an alarm of partially delivered Vt, witnessed by the nurse. Each time, a tracheal aspiration was performed through the tracheotomy tube and improved the situation, with full correction of SpO₂ and alarm message, without the need to increase the FiO₂. A few hours later, intense dyspnea with desaturation occurred. The on-duty physician noticed that the ventilator displayed pressure and flow curves usually observed in pressure support mode (fixed pressure and decelerating flow), while it was still set in volume-controlled mode. Vte decreased below 200 mL and two alarms were present: a low minute volume and a partially delivered Vt.

Knowing the related events in the previous hours, the clinician evoked an obstruction of the tracheotomy tube, confirmed by the impossibility to freely insert an aspiration cannula through the inner cannula of the tracheotomy. The increase in FiO₂ did not alleviate the patient’s dyspnea but improved the SpO₂ value. The patient rapidly fell into a coma due to hypercapnia with decreasing respiratory drive, but he was still triggering each cycle. The increase of the upper limit of the airway pressure alarm to its maximal value did not change anything with the ventilator operation as pressure was limited during inspiration (a permanent flat line was displayed during inspiration). Inspiratory flow was decelerating and its value was below those prescribed. Once SpO₂ corrected, the ventilator was unplugged, the inner cannula of the tracheotomy replaced by a new one (and its obstruction by dried and clogged secretions confirmed). The patient was then reconnected to the same ventilator without any change in its settings. As soon as it was reconnected, the ventilator displayed the expected curves with peak and plateau pressures associated with a constant inspiratory flow, the values of which were those prescribed. Regarding the ventilator, its unexpected behavior was interpreted as a malfunction and it was sent for service. No dysfunction was found and this third incident was interpreted, with some black humor, as a curse.

Case #4: When the Introduction of a Fiberscope in the Endotracheal Tube Reproduced the Above Described Phenomenon

In August 2018, a fiberoptic bronchoscopy was needed for a patient in brain death state before lung removal within the context of an organ donation (Centre Hospitalier Régional René Dubos, Pontoise, France). The patient was ventilated in volume-controlled mode with an Evita^® V300 ventilator through a 8.0 mm endotracheal tube, with AutoFlow^®, ATC^®, and P_max function set off. As routinely performed in our ward, this fiberoptic examination was carried out after changes in the settings of the ventilator, to permit the pursuit of the mechanical ventilation despite the increase in resistance provoked by the endoscope insertion in the endotracheal tube: inspiratory flow was decreased (28 L/min), Vt was reduced (420 mL), Ti set to 0.9 seconds with a RR of 18/min. The upper limit of the airway pressure alarm was set to 100 mbar.

The introduction of the endoscope instantaneously resulted in a switch of the ventilation mode, similar to the above described changes: usual peak-plateau pressure curve was changed into a pressure support-like shape (square, controlled) while the usual inspiratory flow curve (constant, set) was replaced by a decelerating flow. The major problems observed then were: a) due to the pressure limitation settled autonomously by the ventilator, the prescribed Vt was not delivered to the patient, but only a Vt <100 mL; b) nothing could be done by the intensivist to force the ventilator to correctly administer the set Vt and to continue a high-pressure ventilation. A low-severity alarm of partially delivered tidal volume appeared, followed by a high-severity alarm of low minute volume. The phenomenon was reproduced three times and the fiberoptic examination had to be discontinued to limit hypercapnia. The bronchoscopy was then continued using a transport ventilator (Oxylog 3000, Dräger) without incident.

At this stage, discussion with colleagues of such unwanted behavior from a ventilator led to an acute understanding of what was formerly observed and described in the previous mentioned cases. We reported this incident to Dräger company and to the ANSM (Agence National de Sécurité du Médicament et des produits de santé, the French regulatory agency in charge of drugs and medical devices) through a materiovigilance report. We also decided to go further in analyzing the reported phenomenon by performing on-bench studies (see below).

Case #5

In April 2020 (same ward as case #4), a critically ill obese patient (body mass index 43 Kg/m²) was ventilated with an Evita^® Infinity^® V500 in volume-controlled mode for a SARS-Cov-2 induced acute respiratory distress syndrome. Prone positioning was performed to improve gas exchanges and lung recruitment, despite associated difficulties in terms of mobilization and positioning.

Ventilation was performed with the following settings: Vt 430 mL, FiO₂ 90%, RR 32/min, V̇ 60 L/min, Ti 0.7 seconds, and P_high alarm to 60 mbar (AutoFlow^®, ATC^®, P_max functions set off). While in prone position, the patient presented a progressive decrease in SpO₂ and the nurse noticed at that time a decrease in the delivered Vt (<100 mL) together with an alarm of low minute ventilation (set to 7 L/min). On the ventilator screen, the physician rapidly observed the already described unexpected shape of flow and pressure curves. This time, thanks to a large information diffused to all physician in our ward following the event related in Case #4 (and subsequent materiovigilance report), the diagnosis of increased airway resistance was immediately considered despite the conflicting pressure displayed on the screen (not increased): the endotracheal tube was checked and turned out to be partially bent (head positioning) as well as obstructed by copious tracheal secretions. Tracheal aspiration and head repositioning solved the problem. The lowest SpO₂ value was 56% without cardiac event.

Reproduction of the Anomaly and Analysis on Test Bench

Experiment 1

First, we performed tests with an Evita^® Infinity^® V500 ventilator connected to an ASL 5000 Breathing Simulator through a classical dual-limb circuit with an Y porter patient plug. The ventilator was set in volume mode, as follows: Vt 500 mL, RR 20/min, V̇ 60 L/min, Positive End Expiratory Pressure (PEEP) 10 mbar, P_high 50 mbar with Pmax, ATC^® and AutoFlow^® functions set to off. The breathing simulator was set to deal passively with the ventilator behavior (no triggering, no inspiratory or expiratory participation). Compliance of the system was set to 40 mL/mbar, while resistance (R) was progressively increased from 5 to 40 mbar/L/s (increments of 5 mbar/L/s). A decelerating flow was observed when R was higher than 20 mbar/L/s, preventing: a) an increase in airway pressure; and b) the triggering of the high airway pressure alarm. A pressure limitation was operated by the ventilator with a progressively increasing value, until the high airway pressure limit defined in the alarm setting was reached. Typical presentations observed on the ventilator’s screen of these changes in pressure and flow curves are shown in Figure 1B.

Figure 1 Screenshots illustrating the activation of the pressure limitation algorithm. In both situations (A and B) the ventilator was set in volume-controlled mode with the following parameters: tidal volume 500 mL, RR 20/min, PEEP 5 mbar, inspiratory flow 60 L/min, inspiratory time 0.8 seconds. High airway pressure alarm (red line) was set to 60 mbar (A) or 45 mbar (B). A complete (A) or incomplete (B) obstruction were simulated by a direct maneuver exerted on the tube, triggering the activation of the algorithm. This activation was associated with changes in pressure and flow curves shape, adopting from that moment the shape usually observed in pressure support mode (target of pressure and decelerating flow). Note that delivered volume was lower (A) or absent (B) compared to the one prescribed, without an alarm being triggered.

When R was ≥35 mbar/L/s, the high airway pressure alarm was instantaneously triggered without activation of the pressure regulation algorithm (ie, the classical behavior of a ventilator confronted with an increase in resistance).

Experiment 2

Second, to illustrate the inactivation (and uselessness) of the airway pressure alarm when the above-mentioned algorithm is self-activated, we deliberately reproduced a worst-case scenario where airway obstruction was sudden and complete together with an alarm of low minute ventilation improperly set to its lowest value (0.02 L/min). An Evita^® Infinity^® V500 ventilator was used in volume-controlled mode with standard settings (Vt 500 mL, RR 20/min, V̇ 60 L/min, Ti 0.8 sec, P_high 50 mbar, PEEP 5 mbar with P_max, ATC^®, and AutoFlow^® functions set to off). The high airway pressure alarm was set to 60 mbar. The Y porter patient plug of a classical dual-limb circuit (ref. 2004000, Intersugical, Wokingham, UK) was connected to a passive heat and moisture exchanger (ref. 1341580S, Intersurgical), itself plugged to an endotracheal tube (size 7.5 mm ID, Shiley Hi-Lo Cuffed Basic Endotracheal tube, Medtronic, Minneapolis, MN). The extremity of this tube was inserted air-tightly within a test balloon (2,3 L, silicone, ref. 2166062, Dräger). Absence of leak was checked (Vt=Vte). With this setting, peak pressure was 34 mbar, plateau pressure 25 mbar, and R 9 mbar/L/s.

After the continuity of normal ventilation cycles (>2 minutes), we reproduced a caricatural situation of obstruction by suddenly bending the endotracheal tube in order to totally interrupt the air flow (see Supplementary Video S1 and Figure 1A). To our knowledge, whereas all ventilators available on the market would have instantaneously produced an alarm of high airway pressure, the behavior of the ventilator was here inadequate: no alarm was emitted and the ventilator tried to deliver a Vt during vain and repeated attempts. The pressure setpoint determined by the ventilator progressively increased, step by step, until it reached the limit of the airway pressure alarm. An alarm was then emitted only after a delay of approximately 75 seconds while no Vt was delivered. Paradoxically and without explanation, the ventilator never displayed an alarm of partially delivered tidal volume.

Generally speaking, an alarm was emitted only once the airway pressure and/or the minute volume reached the alarm limit (the first of these limits to be attained being able to trigger an alarm, depending on the set values of these limits).

A more systematic analysis showed that this algorithm was only activated when the difference between the set value of the airway pressure alarm and the peak pressure was higher than 15 mbar (tested for V̇ equal to 60 and 40 L/min).

Discussion and Conclusions

In patients under mechanical ventilation, pressure and flow curves displayed on the ventilator screen are of prime interest to quickly comprehend critical problems that may happen. These curves allow instantaneous diagnosis of many issues, eg, a circuit disconnection (no pressure), an air trapping (incomplete expiration with expiratory flow still present when inspiration begin), an increased resistance (increase in peak-pressure with unmodified plateau) or a patient-ventilator asynchrony. More basically, curves allow clinicians and nurses to grasp instantaneously the ventilation mode in operation and ongoing issues.

In the described cases, the increased resistance in the airways (comprising here anatomical and instrumental airways) was related to an obstacle (or a bending) on the endotracheal tube. This triggers automatically the activation of an unexpected and unwanted algorithm resulting in an airway pressure limitation that entails a switch from a volume mode to a pressure mode.

Here, we identified the following critical points and issues:

• Such a change in the way the ventilation is performed is totally autonomous and the physician is never aware of that, whether it be before it happens or through the process (ie, there is no warning when a change in resistance is detected by the ventilator).
• On a sound and visual perspective, the alarm of partially delivered tidal volume is a low-gravity alarm. In light of the underlying severity of the event, such an alarm does not trigger the required attention from nurses or physicians.
• When this self-regulation (unknown from the physician) is activated, no action allowing the correction of the incomplete delivery of the Vt is possible for the clinician. The administration of the correct volume using a low inspiratory flow and a high-pressure ventilation is not possible (allowing one to gain a few minutes to re-oxygenate the patient and prepare necessary things to re-intubate for example). To our knowledge, to replace the ventilator or to perform manual ventilation is the only thing to do.
• In our unit, Autoflow^® and P_max are systematically inactivated to avoid some unwanted and perverse situations already described.^4,7 It is therefore difficult to observe that a ventilator, without any information delivered to the clinicians, possesses a closely-related algorithm that autonomously deals with changes in resistance, with potential lethal consequences. Moreover, if a legal framework asks that Autoflow^® and P_max could be turned off, intensivists do not want another algorithm that keeps watch over a patient’s ventilation without the possibility to quickly drive corrective actions in the case of critical issues.
• Last, with such an algorithm, the fact that an increase in airway resistance is ultimately notified by a low minute volume alarm (and not by a high airway pressure alarm) raises questions in terms of safety, due to the associated delay. In a worst-case scenario, if the minute volume alarm is not correctly set, this delay may reach an intolerable value with potential life-threatening consequences.

This observation also highlights the vital roles of health professionals in the market surveillance activities together with the dedicated institution, here the French competent authority ANSM (Agence Nationale de Sécurité du Médicament et des produits de santé). Indeed, this market surveillance can only be effective thanks to a close collaboration of health professionals with their feedback regarding a risk situation, but also through their expert assessment, especially for rare and complex events. Given the initial difficulties we had in defining the problem and the low prevalence of the event, we also believe that such cases are greatly underreported.

Despite the absence of similar reports in other European countries, the manufacturer initially modified, at the request of ANSM, the user manual of involved ventilators in order to explain the specific behavior of these machines, but without a strong risk reduction (June 2019). Later, and following fruitful discussions, commitment was taken by the manufacturer to correct this unexpected functioning, due to the unwanted effects of complex counter regulation algorithms. Dräger is now developing modifications at the software level and forecasts to implement them during 2020.

The substantive issue raised by this story could be the following: should a machine and its artificial intelligence replace and decide instead of its user? Recent events involving two automation-related accidents with a Boeing 737 Max, despite the existence of highly secured procedures and environment, illustrate the complexity of the question, but also deepen the need for safety-driven answers. We also concede that such an answer cannot be binary as the complexity of each domain of application is highly pleiotropic, preventing any easy and straightforward conclusions. Clearly, automation (regarding basic actions but also analysis of complex signals) improve reliability and reactivity when applied to reproductive and invariable schemes. But when unexpected and imponderable situations emerge with signals not originally included in the analysis loops, an automated answer cannot be the best answer and the human intellect proves to be the best tool in these situations.^8,9 The increasing involvement of algorithms and automation in medical devices, in addition to improving precision and complexity (ie, overall system performance), is not necessarily associated with greater reliability. As discussed by Bequette¹⁰ in a commentary focusing on automated insulin delivery devices (insulin pumps and continuous glucose monitoring systems), the presence “in the loop” of a human eye (or action) is critical when facing unusual situations or unexpected behavior of a system.

One thing remains certain: humans using a machine have to be informed of its behavior, particularly in critical situations requiring urgent actions, in order to correctly analyze the problems and jointly act to correct them. Otherwise, as observed in recent and tragic events related to the crashes of two Boeing 737 Max, if the pilot and the copilot  do not know they are not alone to drive, nobody feels secure.¹⁰⁻¹²

Beside minimum performances and accuracy requirements in ventilators, unfortunately not always achieved,¹³ the post-marketing surveillance of such devices appears as critical as those existing with medicinal products. As such, intensivists and respiratory care specialists should remain vigilant regarding the risk of rare but critical events related to unexpected functioning or insufficiently tested equipment during the pre-clinical development phases. They should not neglect misunderstood critical events without having performed sufficient investigations.

Video S1 See file attached to submission.