Robust alarm design strategy for medical devices: Application to air-in-line detection and occlusion management

.


Introduction
Alarms are designed to inform the patient or caregiver of a poor patient's physiological condition, diagnostic, lifethreatening situations, medical device or electrical system failure, or imminent failure.Surprisingly, many adverse events are directly related to alarms [1,2].In other words, alarms in medical devices can be considered dangerous for patient safety.Ruskin et al. reported that healthcare professionals may be exposed to over 1000 alarms per shift, and most of these alarms are nonactionable and require neither technical nor clinical action [3].The term "alarm fatigue" refers to features that increase a clinician's response time and/or decrease the response rate to a clinical alarm due to an excessive number of alarms.The U.S. Food and Drug Administration's (FDA) Manufacturer and User Facility Device Experience (MAUDE) database identifies 566 alarm-related patient deaths between January 2005 and June 2010, a figure that is further considered by industry experts to underrepresent the actual number of incidents [4].It was suggested that alarm fatigue occurs because people usually respond to alarms in the same proportion as the perceived reliability of the alarm system [5].The alarms are indeed too numerous, sometimes confusing, and too loud.Furthermore, a study showed that over the 1455 alarms recorded in an intensive therapy unit, only eight represented potentially a critical risk to the patient [6].Thus, alarms are often turned off due to a high false alarm rate.
Alarm design should consider ways to reduce the false alarm rate to reduce patient and caregiver stress and prevent alarm-related adverse events.

Alarm management: a complex process
Alarm management is a subpart of the risk management process that involves multiple stakeholders including project managers, engineers, physicians, quality systems, and regulatory affairs managers.After a brief discussion about alarmrelated standards, the discussion will focus on the design of the alarm system and two case studies will be used to illustrate different means to reduce false alarms.

Alarm-related standards
FDA recognizes three alarm-related standards [7]: The aforementioned standards provide guidance and examples to tackle alarm-related problems.The present document will focus on technical factors including alarm design and settings but not discuss human and organizational factors to improve alarm safety.

Specific design input requirements
The design input shall precisely describe the requirements of the design mitigation (e.g., a sensor) that is implemented to reduce the risk to an acceptable level.

Air-in-line detection
An air-in-line detection system is considered to mitigate the risk of air injection into the patient through a pumping system.The risk analysis, based on the input of a physician, has determined the amount of air that leads to patient harm and the corresponding severity (or damage) [11].
The requirement is strongly dependent on the therapy.Air entrance through a central venous catheter can lead to retrograde cerebral venous air embolism that has been reported to cause fatal outcomes [12,13].In peritoneal dialysis (PD), a therapeutic fluid (dialysate) flows through a catheter into the peritoneal cavity.The peritoneum membrane acts as a filter and removes waste products from your blood.After a while, the fluid with the waste products is pumped out of your abdomen and discarded.Injection of sterile air during PD is a risk that shows lower severity than during IntraVenous (IV) therapy.Also, air bubbles can indirectly cause harm to the patient when they alter the accuracy of therapeutic delivery.Bubbles in an insulin pump can either cause hypoglycemia (low blood sugar) due to its expansion in the insulin reservoir (e.g., during airplane depressurization) or hyperglycemia (high blood sugar) if the air bubble in the catheter lowers the amount of insulin delivered [14].
Of course, the air is usually not desirable, and the design input may simply require that the device shall not inject air into the patient.There is then a risk that the design output provides a too-sensitive air detection system that leads to a high false alarm rate since there is evidence that injection in the circulation of small air bubbles (typically under 0.2 mL) is not dangerous [15].
On the contrary, a more specific design input can refine this requirement by mentioning the alarm escalation system in relationship with the cumulated air volume estimate, and the corresponding sound levels for audible alarms for instance.An automatic stop of the pumping system shall also be possible if the level of severity becomes unacceptable.
It is therefore important to provide specific requirements in the design input.
The version of the IEC60601-2-24 standard released in 1998 mentioned that "Infusion of 1 mL of air within 15 min is not considered to be a safety hazard [16].Bubbles of less than 0.05 mL of air each are omitted in summing up to the 1 mL."The literature suggests that these limits may be generous for neonates or patients with right-to-left cardiac shunts [17].The new version of the standard provides fewer specific requirements.The manufacturer shall demonstrate, for a medical device that is not intended to infuse via enteral or subcutaneous route, that the system protects the patient from air infusion which can cause an unacceptable risk due to air embolism [16].As discussed before, this maximum amount of air shall be ultimately determined by a physician in the risk analysis.

Insulin pump occlusion detection
Occlusion is a typical failure mode of any infusion system.In insulin therapy, the two main risks are hyperglycemia due to the interruption of the insulin delivery, and hypoglycemia if the issue is due to catheter kinking or compression and if the delivery rate was increased to overcome the issue, a large volume of undelivered insulin can indeed be suddenly administered after the occlusion is released [18].The risk analysis should provide precise criteria for the different categories of patients, notably in pediatric use [19].Thus, the design input shall specify, according to the patient's age, weight, and insulin sensitivity, the amount of undelivered insulin before triggering the occlusion alarm.To limit the number of nuisance alarms, occlusion management shall be patient-specific [7]: alarm settings for a 100 kg adult with type II diabetes, and therefore insulin resistant, must obviously be different from that of a 10 kg infant with type I diabetes.

Design output: the temptation to over-engineer
"Maybe it's better not to be the best".This sentence may be relevant when designing a protective or detection system.
Research showed, notably in physiologic monitor devices like ECG, that 80 to more than 90% of alarms are false positives [20].Alarms are generally designed to be very sensitive and non-patient-specific. Manufacturers prefer to over-engineer alarm systems to detect any potential clinically significant event, but this approach does not consider the problems related to the increased occurrence of false alarms [7].
To illustrate this statement about false alarms, two different case studies will be considered in detail:  Air-in-line detection: The manufacturer selected a very sensitive sensor able to detect small bubbles but that fails by design to provide a quantitative estimate of the air volume  Occlusion detection: The manufacturer developed a very sensitive sensor, but the alarm is not patient-specific, does not adjust to the programmed flow or does not manage partial occlusion

State-of-the-art: ultrasonic technology
Many air-in-line sensors are based on ultrasonic (US) technology.The tubing is slightly pressed between an embedded piezo transducer and receiver as illustrated in Fig. 1.The electric activation of the piezo transducer generates a tone burst ultrasonic signal that propagates through the tubing and its contents while the piezo receiver listens for the transmitted signal.
The US signal is strongly weakened by any bubble present in the liquid.A water-air interface is indeed an almost perfect reflector for acoustic waves.This phenomenon is due to the large contrast in sound speeds (330 m/s in air and 1500 m/s in water) and mass densities (1.3 kg/m3 for air versus 1000 kg/m3 for water).The proportion of acoustic energy transmitted into the air, about 0.12%, represents a 30 dB loss [21].This effect also explains why, underwater, you can hardly hear people talking by the pool.
A US bubble sensor shows numeral advantages:  Non-invasive, compact  Low cost, low power consumption  High EMI and RFI noise immunity  Wide range of tubing sizes  Integrable electronics, chip-only interface option available Because the signal is greatly reduced when an air bubble in the tubing passes between the piezo transducer and the receiver, this sensor has a high sensitivity, and bubbles of 1 microliter or less can be detected.This technology is for instance well suited to high-pressure infusion as contrast medium injection for CT scans, air bubbles are indeed compressed and thus difficult to monitor.US bubble sensors are widely used in other IV infusion systems to prevent any risk of air embolism.Other sensor technologies, which exploit the reflection or refraction of light, are also highly sensitive to tiny air bubbles.
Figure 1 Ultrasonic air bubble detector.The presence of an air bubble between the ultrasonic transmitter and receiver causes a significant decrease in the signal

Change in paradigm
Some applications do not require such high sensitivity for bubble detection.Also, bubble detection using the US technique or light reflection/refraction could lead to a false alarm if tiny bubbles remain stuck on the tubing wall, notably at a low or intermediate flow rate.Such bubbles are present in normal use as a consequence of degassing, in particular, if the liquid is heated at 37°C before injection, tubing permeability to air, the presence of residual air in the primary liquid container… During peritoneal dialysis (PD), the injection of sterile air from the dialysate bag has for instance a lower severity than air injection in IV therapy.The presence of free air in the peritoneal cavity, called pneumoperitoneum (PP), shall indeed be balanced by air absorption up to 13.5 mL/day [22].Injecting non-sterile air is of course not recommended.PD patients with intra-abdominal free air have indeed a higher risk of peritonitis.Okamoto suggested that this might be based on poor PD technique (e.g., the presence of air may be a risk of imperfect sterile technique) or touch contamination [23].Also, once the risk of non-sterile air entrance is fixed, the manufacturer shall be able to determine the correct cumulated volume of air that is infused into the patient rather than detecting any tiny air bubbles.Thus, an alternative air-in-line sensor technique can be used to detect larger air bubbles with improved reliability in terms of cumulated volume estimation.

Infrared bubble sensor
The method can be summarized as follows: detect liquid instead of air.In brief, the bubble detection methods consist of detecting large air bubbles instead of tiny ones that come from degassing or tubing permeability, simply because their contribution to the overall cumulated air volume is negligible.This change of selectivity is obtained by using IR irradiation: bubble sensing is based on the large contrast in light absorption coefficients in water and air.For a correct absorption of light by water the wavelength region is chosen such as the coefficient of absorption is in the same order of magnitude with the inverse of the light path length into water.
Fig. 2 shows the absorption coefficient for water.Absorption becomes very important in the SWIR region (short wavelength infrared region) 1-3 microns.The insert in Fig. 2 shows that the penetration depth of light in the region 1400-1600 nm is lower than 1 mm.
The transmitted optical power () can be estimated according to the following formula: Where z is the depth and  0 the incident optical power.Note that the reflected power at the different interfaces is not considered here.
For a tubing ID 4mm, the transmitted powers at wavelengths corresponding to standard LEDs in the IR region are shown below: An excellent water/air selectivity is obtained using LEDs at 1450 and 1550nm.The IR sensor comprises an InGaAsP LED1450-03 (emitter) and an IR InGaAs PIN photodiode PD1450-35T52 (receiver) as illustrated in Fig. 3.The tests have been performed using LED with epoxy lens (current source = 50 mA) and the detector.The detector is used in the photovoltaic mode with a simple trans-impedance amplifier.The distance between the source and the PIN detector is constant and equal to 7 mm.This IR bubble sensor is insensitive to small bubbles (typically a few microliters) but can detect reliably bubbles of a few tenths of microliters.Through an infusion line in PVC (internal and external diameters of ID=4 mm and OD=6 mm respectively), this all-or-nothing air sensor shows a steep increase in the monitored signal and thus a transition between low and high state for air bubbles greater than 40 microliters (see Fig. 4).These air bubbles were generated with a precision syringe Hamilton of capacity 100 microliters.Above 50 microliters, which corresponds to an entire tube section filled with air, the sensor signal is constant.The relative increase of the signal in the presence of air is limited here because of the parasitic signal transmitted by the transparent tubing itself and the limited collimation of the light which does not completely prevent crosstalk.The cumulated air volume is derived from the bubble sensor signal and the flow rate.Additional in-line sensors (pressure, temperature) can be used to refine this air volume estimation.This non-invasive IR bubble sensor is not the most sensitive device but shares the same advantages listed above regarding the US sensor.In addition, this IR sensor shows:  Excellent reliability  Insensitivity to tiny bubbles that could lead to false alarms  Accurate determination of the cumulated air volume infused  This IR bubble sensor is therefore a technological response to the high false alarm rate due to the presence of small bubbles that do not represent, for a given therapy, any risks to the patient.

Application to occlusion detection
The second case study focuses on occlusion detection, specifically in the context of Continuous Subcutaneous Insulin Infusion (CSII) which has proven to be effective in diabetes care.Diabetes is a chronic, metabolic disorder characterized by high blood sugar levels which leads to severe damage over time.Type 1 diabetes, also known as insulin-dependent diabetes, is a chronic condition in which the beta-cells of the pancreas produce little or no insulin.For people living with type-1 diabetes, daily administration of insulin is essential for their survival.Traditionally, the most common route of insulin administration in patients with diabetes is by subcutaneous injection using an insulin syringe or a pen.The most advanced insulin delivery systems are patch pumps that deliver, through a thin cannula placed subcutaneously, rapidacting insulin 24 hours a day to match body requirements.These pumps can be programmed to deliver both basal and bolus doses of insulin.Rates of basal insulin delivery can be programmed based on individual patient requirements.
Insulin pumps can also deliver bolus insulin to minimize post-meal high blood sugar level excursions.Most marketed insulin pumps comprise a piston-driven mechanism connected either to an insulin infusion set or a cannula patch and occlusion detection [25].These devices are designed to detect occlusion, which is a partial or complete blockage of insulin delivery, by monitoring the in-line pressure.However, occlusion detection is difficult, notably at a low delivery rate, because the in-line build-up pressure varies slowly over time.Some data suggested that the median occlusion detection time (ODT) at 0.1 U/h ranged from 4h to more than 40h in commercial insulin pumps [26].Occlusion may occur shortly after the insertion of the infusion set but usually, the phenomenon appears after 2 or 3 days of use of the infusion set.The effect may be related to the kinking of the catheter or the soft cannula, cannula leakage, chemical precipitation of insulin, or fibrin formation at the needle tip [27].

Occlusion detection in a MEMS-based micropump
Occlusion detection is crucial to maintain the blood glucose level in an acceptable range [28].Novel catheter designs were investigated to reduce the occurrence of silent occlusion [29].In patch or catheter-less devices, an important breakthrough was achieved with a MEMS-based micropump which shows an ODT of about 12 minutes at 0.1 U/h [30][31][32][33].During the filling, while the pumping membrane is pulled down, the outlet valve remains closed and the inlet valve opens when the under-pressure in the pumping chamber reaches the inlet valve opening threshold.During the infusion, the actuator pushes the membrane against the upper mechanical stop, inducing an over-pressure that opens the outlet valve and keeps the inlet valve closed (see Fig. 6 the cross-section of the micropump and the pumping membrane actuation).The relative pressure inside the pumping chamber varies typically between -800 mbar and +800 mbar during an actuation cycle.The stroke volume is 0.2  and a compression ratio larger than 0.8 ensures self-priming capability.The operation of the pump is monitored by the two integrated pressure sensors made of strain gages implanted into silicon membranes: a first sensor is located inside the pumping chamber, and a second sensor is located downstream of the outlet valve to monitor the patient pressure. The fluid path between the pump outlet to the delivery site is very short (patch pump) and shows low compliance. Two check valves isolate the pump reservoir from the delivery site. The pump generates a large pressure during each stroke. The pump has an integrated pressure gauge with a sub-millibar resolution to monitor the pressure at the delivery site.

Adaptative infusion profile for partial occlusion management
This pump technology offers improved occlusion detection, but the downside is a potentially high false alarm rate.
Because the fluid path between the delivery site and the micropump outlet has low compliance (i.e., low compressibility), the pressure sensor can monitor any pressure change due to tissue compression or any other sources of partial occlusion.To limit alarm nuisance, particularly overnight when the patient programs a low basal rate, the occlusion alarm threshold, and the piezo voltage profile shall be adjusted to the delivery rate.

BOLUS MODE
In bolus mode, the actuation frequency is set at 3.125 Hz to deliver 37.5 /.The built-in pressure at the delivery site is thus very fast (a few seconds to reach 1 bar in case of total occlusion), therefore the occlusion alarm threshold shall also be set to prevent any overpressure that can damage the delivery site [16].Once the occlusion threshold is reached, the pump automatically stops the infusion and alarms the patient to resolve the occlusion.

BASAL MODE
The patient can program its pump to deliver insulin at a basal rate, typically 0.1 to 2U/h (1 Unit of insulin U100 corresponds to a volume of 10 ).At the maximum basal rate (10U/h), the time interval between actuation strokes is about 7.2s.There is therefore plenty of time to maintain the piezo actuator at high voltage and thus sufficient pressure to allow insulin to flow toward the delivery site in the presence of partial obstruction of the fluid path.Full infusion is obtained when the outlet valve closes, i.e., when the pressure falls under 100mbar in the pumping chamber.The self-adjustment of the piezo voltage profile to the monitored pressure signals is an interesting method to infuse insulin at a basal rate with a MEMS micropump.The greater the fluid restriction, the larger the generated pressure and the longer the piezo remains activated, and the occlusion alarm should no longer be triggered since insulin is delivered at the intended rate.

Conclusion
Two case studies were used to illustrate how technical factors, in addition to human and organizational factors not discussed here, can reduce false alarm rates, improve patient well-being, and prevent alarm-related adverse events.The proposed solutions are the result of a careful analysis of the design requirements, the risks to the patient, and the pros and cons of current sensor technologies.Two different strategies have been employed to manage highly sensitive sensors: either change the sensor's technology when it is impossible to provide a reliable estimate of the physical quantity being measured or develop a self-adaptive algorithm for processing the sensor signal to limit the triggering of false alarms.Alarm design issues should be ideally addressed in the early phases of medical device development so as not to further increase the cacophony in the hospital setting later on.The IR air-in-line sensor and occlusion management system were implemented in a peritoneal dialysis machine and an insulin patch pump respectively, both devices being currently in the design transfer phase.The next steps include the analysis of HCP and patients' feedback during clinical trials to refine the alarm management system.

Figure 2
Figure 2 Water Absorption spectrum (from data published by Hale et al. [24]).Insert: Penetration depth in the 1300-1600 nm region

Figure 3 Figure 4
Figure 3 Infrared air bubble detector.The presence of liquid between the IR LED (transmitter) and the IR photodiode (receiver) causes a significant decrease in the signal

Figure 5
Figure 5 IR photo of the MEMS-based pump chip (not to scale).The flow direction is indicated by yellow arrows (Courtesy of Debiotech SA, Lausanne, Switzerland) A top view of this piezoelectric positive-displacement MEMS micropump is shown in Fig. 5. Overall chip dimensions are 10 mm x 6 mm x 1.4 mm (Length x Width x Height).The direction of the flow is indicated by arrows.The fluidic pathway comprises (from left to right): the inlet port in direct communication with the reservoir filter; the inlet valve; the pumping chamber; the inner pressure sensor; the outlet valve; the top channel; the outer pressure sensor; the bottom channel; and finally the outlet, leading to the cannula port.

Figure 6
Figure 6 Cross-section (not to scale) of the micropump made of a stack of 3 wafers: top Si, middle SOI (Silicon-On-Insulator), and bottom Si.The green line and the pink squares represent the buried oxide and the anti-bonding structure respectively.The piezo actuator not represented here is linked to the pumping membrane.A pull movement of the piezo induces the filling of the pumping chamber while a push movement generates high pressure to infuse insulin toward the patient (Courtesy of Debiotech SA, Lausanne, Switzerland)Early detection of occlusion is made possible by the following features of the micropump:

Figure 7
Figure 7 Simulated displacement of the outlet valve in microns during the piezo actuation for selected fluidic resistances at the outlet, the reference outlet resistance R being equal to , .  Pa.s/m 3 To illustrate this method, partial occlusions are simulated by adding in the fluid path downward of the micropump fluid restrictions that are a multiple of  = 1,24.10 14 Pa.s/m 3 .The numerical model proposed by Fournier et al. [32-34] was used to simulate the pressure dynamics and the outlet valve displacement during actuation.The evolution of the outlet valve displacement for different values of the outlet fluid restriction is shown in Fig. 7.As expected, the valve requires more time to close as fluid restriction increases.If fluid restriction is greater than 4R, the piezo must remain activated longer to allow insulin to flow into the patient.In case of total occlusion, no insulin flows and the valve remains open until the next downward movement of the piezo.

Table 1
Percentage of transmitted optical power through 4mm of water at 1300, 1450, and 1550 nm