Supplementary oxygen therapy
Supplementary oxygen is administered to a large proportion of hospital patients, typically via a nasal cannula or face mask at a constant flow rate. While clinically effective, this delivery method is inherently inefficient: during exhalation, oxygen flows directly into the environment, and even during inhalation a significant fraction never reaches the alveoli.
Any attempt to reduce this waste must operate under a strict constraint: oxygen must never be withheld when it could benefit the patient. This single requirement dominated all subsequent design decisions.
The challenge
The challenge was not simply to detect breathing, but to do so under conditions that amplify risk: weak signals, long distances between sensor and actuator, strict power limits, and a safety-critical failure mode.
There were a number of constraints:
- Facemasks and cannulae are disposable items → infection control and extreme cost pressure
- The valve is typically positioned on top of the gas bottle or at the wall distribution panel, some 2m away from the patient → risk of signal integrity and latency
- The total system (sensing, valve, and user interface) would be battery-powered, with an autonomy of at least 24 hours → risk of power failure
- Failure modes of the system must not restrict oxygen supply → primary hazard
Sensing principle
Our initial thoughts were to measure the patient’s blood oxygen saturation using a pulse oximeter to create a closed-loop control system. This was quickly rejected as it would significantly increase system complexity and introduce additional, coupled failure modes.
We evaluated several alternative sensing approaches and rejected any that could interfere with oxygen delivery or be contaminated by it. We decided on detecting pressure variations in cannula or mask caused by breathing airflow. The sensor had to sit at the distal/valve end: putting it nearer the patient increased risk of contamination as well as cost.
We further used a dual-lumen tube, separating the oxygen supply from the pressure sensing. Not only did this increase sensing accuracy, it also allowed us to treat the sensing path as a separate “advisory” rather than safety-critical feature. This simplified both the product architecture and the risk management.
Given pressure variations of only a few Pascals, especially in patients with shallow, rapid breathing, we concluded that single-sample or low-rate detection would be too fragile. Instead, we found oversampling and looking for temporal patterns in the signal (using frequency-domain analysis) improved discrimination of inhalation and exhalation.
Risk analysis and management
The dominant hazard was an erroneous interruption of oxygen flow during inhalation.
The Camcon valve design was bistable, meaning that under power loss it could remain either open or closed. From a safety perspective this was unacceptable: any failure must default to oxygen delivery. Addressing this required modifications to the valve actuation circuitry; this was done by Camcon, while we focused on the sensing and signal interpretation.
On the software side, we deliberately biased the detection logic towards false positives rather than false negatives. In practice, this meant that ambiguous signal patterns were treated as inhalation, ensuring oxygen flow was maintained whenever uncertainty existed.
Together, these measures ensured that uncertainty always resolved in favour of oxygen delivery, rather than attempting to eliminate uncertainty through added sensing complexity.
What happened next
Once we demonstrated we were able to reliably detect breathing patterns in healthy volunteers (the client team, consultant clinicians from Addenbrookes Hospital, and myself), detection trials were organised with patients receiving supplementary oxygen. Importantly, these early trials were conducted with continuous oxygen delivery, allowing us to validate detection reliability without exposing patients to risk.
Following these trials, our client Camcon Medical decided to take the system forward into further development in collaboration with a manufacturing partner.
This project reinforced that in safety-critical systems, reducing risk is often about removing assumptions rather than adding features.