Thanks to the virus crisis, lots of people are designing makeshift ventilator designs in the hopes of saving people’s lives. Many of these are based around some sort of Arduino-powered CPU. [Armstrong Subero] things that’s a great idea, but cautions that making an electronic pair of dice is a different proposition than creating a machine to breathe for someone. But he isn’t just complaining. He talks about considerations when building a real-time and safety-critical system.
[Armstrong] has a lot of good points, although we aren’t sure you need the complexity of a real-time operating system just to squeeze a bag. If anything, that seems like it might make it more susceptible to unexpected operation. However, we agree with his comments that you should have closed-loop control to make sure the device is working, alarming when the device isn’t working, and watchdog timers to guard against lockup.
One excellent point from the post:
For example a high availability system real time system may be specified as having an up time of around 99% in a 24 hour period. Which 1% of the day is it acceptable to have the ventilator not operational? Since we have 1440 minutes in a day, which 14.4 minutes of the day should the patient not be allowed to breathe?
However, he does have some solid suggestions such as using an IDE with debugging and adhering to a coding standard such as MISRA. Of course, he also points out you might choose a different CPU that has safety-critical certifications and corresponding libraries. One suggestion is to have multiple CPUs, and this is a common enough solution in many safety-critical systems. For example, imagine 3 CPUs driving a switching circuit that requires a low logic level to turn on.
You could make the outputs go to inputs if the CPU wants to not drive the switch, or pull the output to ground if it does. Then a pull-up resistor holds the state high if no CPU pulls it to ground. All CPUs could sense the state of the line and if they don’t think it looks right they sound their own alarm. Some systems vote so that two of three CPUs must agree (at least) or, in some cases, three out of five.