The Dark Cockpit
Aviation worked out how to stop warning people in 1977. Medicine copied the labels in 2003 and left the rule behind. Here is what that costs, per bed, per day
You have walked past a Proposition 65 sign a thousand times. This facility contains chemicals known to the State of California to cause cancer and reproductive harm. It is on parking garages. It is on coffee shops. It is on a hotel lobby you stayed in last month and on the back of a receipt in your pocket right now.
You did not read it. Neither did I.
That is not stupidity and it is not indifference. That is what happens to a warning attached to nine hundred substances and posted on approximately everything. The sign stopped carrying information the day it stopped being possible for it to be absent. Whether the law changed anyone’s behavior is actively disputed and has been for thirty years, but the part nobody disputes is what happened to your attention. You learned to not see it.
Now put that same sign on a heart monitor, next to a person who is actually sick.
The number
In March of 2013, a research team at the University of California, San Francisco did something nobody had bothered to do. They counted.
Not sampled. Not modeled. Counted. Every alarm, audible and silent, from every physiologic monitor in five adult intensive care units, seventy seven beds, for thirty one consecutive days. Four hundred and sixty one patients.
Two million, five hundred and fifty eight thousand, seven hundred and sixty alarms.
Of those, 381,560 made a sound. Divide it out and you get the number that should be printed on the wall of every hospital that has ever convened an alarm safety committee:
One hundred and eighty seven audible alarms, per bed, per day.
That is one noise demanding a human being’s attention roughly every seven and a half minutes, around the clock, in the room of every single patient, for a month.
Then they did the harder part. They took 12,671 arrhythmia alarms and had trained annotators judge them, with ninety five percent agreement between raters.
Eighty eight point eight percent were false.
And here is the finding I almost missed the first three times I read the paper. Take ventricular tachycardia on its own, the alarm nobody would ever tell you to ignore. The annotators judged 502 of them to be true.
Three hundred and thirty four of those 502 came from a single patient in ventricular storm. One human being generated two thirds of every true ventricular tachycardia alarm in a 461 patient study. Set that patient aside and 168 true alarms remain across everybody else, real events, correctly detected, exactly as designed.
Ninety three percent of them did not last long enough to require treatment.
Read that again, because it breaks the usual argument. The standard defense of alarm burden is that a false alarm is the price of never missing a real one. Fine. But when they went and looked, the real ones mostly did not need anyone either. The system was not trading noise for safety. It was generating noise, and then generating a smaller pile of noise that happened to be technically accurate.
Nine times out of ten the alarm was wrong. On the tenth, it was right and it did not matter.
It has a name, and medicine named it a long time ago
I don’t want to present this as a discovery. It is not. This is one of the best documented problems in patient safety, and the people who documented it were not gentle about it.
Alarm fatigue is the accepted term. The Joint Commission issued Sentinel Event Alert 50 on 8 April 2013, and the numbers in it are not soft. Between January 2009 and June 2012 the Commission’s sentinel event database recorded 98 alarm related events. Eighty of them ended in a death. Thirteen more caused permanent loss of function. That alert also states, flatly, that the number of alarm signals per patient per day “can reach several hundred depending on the unit within the hospital.”
So the UCSF count did not surprise anybody. It confirmed, with a month of exhaustive data, a thing the field had already written down.
And medicine did respond. Alarm management became a National Patient Safety Goal. Hospitals stood up alarm committees. Manufacturers retuned defaults, added delays, tightened artifact rejection. Good people did real work and some of it helped.
The burden is still there. That is not because anybody was lazy. It is because everything we did was tuning, and the problem is not tuning.
What aviation did, and when
“Why can’t healthcare be more like aviation” is one of the laziest sentences in our industry, and I have heard it in a hundred conference rooms from people who had never read a single aviation document.
So let us read one.
In May of 1977, Boeing Commercial Airplane Company delivered a study to the Federal Aviation Administration called Aircraft Alerting Systems Criteria Study, report FAA-RD-76-222. They had gone and counted too. They tallied the alerts on nine aircraft types and found the number climbing with every new model. More systems, more sensors, more things worth telling a pilot about, and a flight deck that was starting to shout.
That was 1977. Medicine would take another thirty six years to run the equivalent count in an ICU.
Out of that work came a discipline with three parts.
First, a hierarchy with teeth. Warning, caution, advisory. Not a labeling convention but a definition of what the human is expected to do. Warning means immediate awareness and immediate response. Caution means immediate awareness and subsequent response. Advisory means awareness, and a response may follow. Those definitions are federal regulation now, 14 CFR 25.1322, Amendment 25-131, published 2 November 2010 and effective 3 January 2011.
Second, and this is the part medicine skipped: the deliberate withholding of true information. The FAA’s advisory circular on flight crew alerting, AC 25.1322-1, dated 13 December 2010, directs manufacturers to consider “inhibiting alerts for specific phases of flight (for example, takeoff and landing) and for specific airplane configurations.” An aircraft in a takeoff roll will not tell the crew about a condition that is real, correctly detected, and none of their business for the next forty seconds. The information is accurate. It is suppressed anyway, on purpose, because a pilot rotating at 150 knots has exactly one job.
Third, the philosophy that falls out of the first two. Airbus calls it the dark cockpit, and the rule is beautifully simple: if a system is doing what it should be doing, the light on its button stays out. A light means a fault, or a system switched off that ought to be on. Illumination is exception. Darkness is the affirmative statement that everything has been checked and everything is fine.
Look at that photograph again. That flight deck is not quiet because nobody is watching. It is quiet because everything is being watched, continuously, by something that has been given permission to say nothing.
Silence is the message. Lights out means ready to fly.
What medicine took, and what it left
In August of 2003 the International Electrotechnical Commission published IEC 60601-1-8, the collateral standard for alarm systems in medical electrical equipment. It defines three alarm priorities.
High. Medium. Low.
We took the tiers. We took the color conventions and the tone patterns and the compliance testing. We did not take the rule underneath them, and the rule underneath them is the whole invention.
So here is what one bed looks like.
I went through a photograph of a single intensive care bay and counted what was in it. Not a busy one. A bed rigged and ready with nobody in it, linens flat, ECG leads coiled on the rail, ventilator circuit hanging on its arm.
On the two poles beside it, four BD Alaris point of care units driving fourteen pump channels. Behind them a ventilator. In front, a console running arterial waveforms. Above the bed a physiologic monitor, and a second one to the right.
Eighteen devices at one bedside, every one of which can raise an alarm on its own authority. The bed was empty and the monitors were already lit.
I should say plainly that I have a personal stake in this. I spent the last stretch of my career as a vice president of connectivity at Alaris, then CareFusion, then Becton Dickinson. Those are my pumps. I worked on getting them talking to the electronic record, and that work was worth doing, and I would do it again.
And not one of those fourteen channels knows the ventilator four feet away exists. Or the monitor above the bed. Or the thirteen other channels bolted to the same pole.
There is no phase of care in a hospital during which a device will decline to tell you something true. There is no equivalent of the takeoff roll. There is no cross device prioritization, because the pump, the ventilator, the monitor and the bed are four products from four vendors and none of them knows the others are in the room, let alone which of them has earned the next four seconds of a nurse’s attention.
And there is certainly no dark cockpit, because in an intensive care unit silence does not mean everything has been checked. Silence just means nothing has crossed a threshold yet.
Everything speaks, all the time, and nothing is in charge of deciding who speaks next.
Why louder or smarter alarms do not fix this
Here is where I changed my own mind, and it took me an embarrassingly long time.
For most of my career I thought alarm fatigue was a signal processing problem. Better algorithms, tighter filters, smarter thresholds, fewer artifacts. That work is real, it has helped, and the people doing it are good at their jobs.
But look again at the UCSF finding. Ninety three percent of the true ventricular tachycardia alarms did not need treating. You cannot filter your way out of that, because those alarms were not errors. The detector did precisely what it was built to do. The machine did not get the answer wrong. Nobody ever asked it a question.
A threshold is not a question. A threshold is a comparison, and a comparison is what we have been shipping since I started in this business in 1985. Is this number above that number. Yes. Make a noise.
The question a clinician actually has is different in kind. Given this patient, on these drugs, with this history, at this hour, with those other thirteen channels running what they are running, does this matter to anyone right now?
That is not a threshold. That is reasoning over context. And for the forty years I spent acquiring medical data and normalizing it and moving it from one machine to another, there was nothing on earth that could do it. So we did the only thing available. We compared numbers to numbers and we made a noise, and we made a hundred and eighty seven noises per bed per day, and we called it vigilance.
It was not vigilance. It was the absence of anything better, wearing vigilance as a costume.
That part has changed. Not “is about to change,” not “shows promise in early studies.” Changed, in the last three years, and most of our industry is still designing alarms as though it had not.
The prediction is on a screen. The response to the prediction is on a piece of paper. Nothing in that room connects the two, and no amount of retuning an alarm threshold ever will.
One more thing, and I missed it the first three times I looked at that photograph. At the bottom of the toolbar on the left of the Edwards screen there is a bell with a line through it. The alarms on that monitor are silenced.
I am not going to tell you why, because I do not know and neither does anybody else looking at that picture. What I will tell you is that it is the only thing in the frame doing what aviation has done since 1977. And it was done by a person reaching up and pressing a button, on one device, for one shift, with no rule behind it, no record of it, and nothing whatsoever to stop the other fifteen machines in that bay carrying on without her.
Now look at the bottom of the frame, at the laminated sheet cable-tied to the pole. It is a flowchart, printed in red and black, and one of the boxes on it says MAP 65.
There has been a predictive algorithm at that bedside for seven years.
The monitor on the left is an Edwards HemoSphere. In a small box in the top right of that screen is the Acumen Hypotension Prediction Index, reading 42. That is a machine learning model, built from more than two hundred thousand patient events, telling the room how likely it is that this person’s blood pressure is about to fall. It is not a prototype and it is not a research tool. The FDA cleared it on the third of December, 2018 [9].
Before anybody writes to tell me the industry has not tried, look at this photograph. I did not take it. I went looking for a picture of an intensive care bay that was not a marketing shot, gave up on the stock libraries twice because every one of them is too clean, and eventually licensed this.
It is already in the room
What I would actually build
Not a better threshold. A layer above the devices that holds the whole picture, that knows what a takeoff roll looks like for this particular patient, and that is permitted to stay quiet.
The hard part is not the reasoning. The reasoning is close to free now, and I mean that literally: a reasoning pass over one patient’s full context costs somewhere between a cent and a dime. The hard part is the one it has been since 1985, which is being allowed to reach the data in the first place, and being permitted to say nothing.
We have never given a medical device permission to stay silent about something true. Aviation did it in 1977 and had it in regulation by 2010.
That is the gap. It is not a technology gap.
And a small piece of news. After forty years of this I finally wrote the book: The Technology Was Never the Problem, twenty two chapters on what we built, why so little of it moved outcomes, and what changed. It is with reviewers now and it will be on Amazon in mid September. I will say more closer to the date, and I will not turn this newsletter into an advertisement for it. Inside the Loop keeps doing what it has always done, and the reporting here stays new.
Sources
[1] Drew BJ, Harris P, Zegre-Hemsey JK, Mammone T, Schindler D, Salas-Boni R, et al. “Insights into the Problem of Alarm Fatigue with Physiologic Monitor Devices: A Comprehensive Observational Study of Consecutive Intensive Care Unit Patients.” PLOS ONE 2014;9(10):e110274. Five adult ICUs, 77 beds, 461 patients, 31 days, March 2013. 2,558,760 total alarms; 381,560 audible; 187 audible alarms per bed per day; 12,671 arrhythmia alarms annotated at 95 percent inter-rater reliability, of which 88.8 percent were false. Ventricular tachycardia: 502 true positives, of which 334 occurred in one patient with ventricular storm; of the remaining 168, 93 percent were not sustained long enough to warrant treatment.
[2] The Joint Commission. Sentinel Event Alert, Issue 50: Medical device alarm safety in hospitals. 8 April 2013. 98 alarm related events reported between January 2009 and June 2012: 80 deaths, 13 permanent loss of function, 5 unexpected additional care or extended stay. Also the source for “several hundred” alarm signals per patient per day.
[3] Veitengruber JE, Boucek GP, Smith WD. Aircraft Alerting Systems Criteria Study, Volume I. Report FAA-RD-76-222, Boeing Commercial Airplane Company for the Federal Aviation Administration, May 1977.
[4] 14 CFR 25.1322, Flightcrew alerting. Amendment 25-131, published 2 November 2010, 75 Federal Register 67201, effective 3 January 2011. Warning: immediate awareness and immediate response. Caution: immediate awareness and subsequent response. Advisory: awareness and possible subsequent response.
[5] Federal Aviation Administration. Advisory Circular AC 25.1322-1, Flightcrew Alerting, 13 December 2010. Sections 8(d) and 13(c)(1)(h) address inhibiting alerts for specific phases of flight, giving takeoff and landing as the examples.
[6] IEC 60601-1-8, Medical electrical equipment, Part 1-8: General requirements for basic safety and essential performance, Collateral standard: General requirements, tests and guidance for alarm systems. First edition, August 2003. Establishes high, medium and low alarm priority.
[7] California Safe Drinking Water and Toxic Enforcement Act of 1986, Proposition 65, administered by the Office of Environmental Health Hazard Assessment. The list has grown from its first publication in 1987 to roughly nine hundred chemicals. Whether the warnings change behavior is actively disputed and the law has been criticized on precisely the grounds described here.
[8] Device counts are the author’s own, taken from a photograph of a single unoccupied intensive care bay. No patient was present in the bed. That bay is not the one reproduced in this article. It is a different room in a different hospital, and it is not published here, so counting the pumps in the photograph above will not produce the same numbers. The flight deck photograph is licensed stock.
[9] Edwards Lifesciences. HemoSphere advanced monitoring platform with the Acumen suite of decision-support solutions, FDA clearance announced 3 December 2018. Edwards describes the Acumen Hypotension Prediction Index as introducing “artificial intelligence (AI) to hemodynamic monitoring through a machine learning, data-driven algorithm that indicates the likelihood of a hypotensive, or low blood pressure, event before it occurs”, with algorithms derived from more than 200,000 patient events. The reading of 42 and the paper protocol are the author’s observations from the licensed photograph. No patient is visible in the frame.
Daniel Pettus spent nearly fifty years in medical device and health IT leadership at Alaris, CareFusion and Becton Dickinson. He contributed to IHE Patient Care Device interoperability standards and holds two patents with three provisional filed. He is the inventor of AI MedAgent and the founder of Inside the Loop.