01Executive summary
Three devices that take over the function of an organ. Each one moved engineering inside the body’s control loops, and each one was built substantially by people working outside established institutional support.
Willem Kolff built a working artificial kidney in occupied Holland in 1943 from cellophane sausage casing, a wooden drum and parts from a car. John Gibbon achieved open-heart surgery supported by a heart–lung machine in 1953, after more than twenty years of development. Rune Elmqvist and Ake Senning implanted a pacemaker in 1958; the first unit failed within hours and was replaced the next day. The engineering interest lies in the constraints, which are unlike anything else in this series.
02Why medical devices are a distinct engineering problem
03Dialysis: a membrane and a gradient
The kidney removes metabolic waste, excess water and excess electrolytes, while retaining proteins and cells. Kolff’s insight was that the selective part — discriminating waste from protein by molecular size — could be done by a semipermeable membrane, with concentration gradients doing the work.
- Vascular accessBlood is drawn from the circulation at a controlled rate. Reliable repeated access was the limiting practical problem for years after the machine worked.
- AnticoagulationContact with a foreign surface activates clotting, so the circuit requires anticoagulation — balanced against bleeding risk.
- Diffusive exchangeBlood and dialysate flow either side of a membrane, usually counter-current to hold the concentration gradient along its length.
- UltrafiltrationA pressure difference across the membrane removes excess water, controlled independently of the solute clearance.
- Return and monitoringTreated blood returns with air detection, pressure monitoring and temperature control as mandatory protective functions.
Running the two streams in opposite directions maintains a concentration difference along the entire membrane length. In co-current flow the two streams approach equilibrium and the driving gradient collapses part way along, wasting most of the surface area. The same arrangement gives counter-flow heat exchangers their advantage, and it is one of the most portable ideas in engineering — visible in dialysis, oxygenators, heat recovery and mass transfer columns alike.
Kolff’s early patients mostly died, and the machine was regarded with scepticism. He persisted, and afterwards distributed machines to other centres without charge. That decision — treating the design as something to be spread rather than owned — is a substantial part of why the technology became available quickly.
04The heart–lung machine: two functions, both hard
Operating inside the heart requires it to be still and empty of blood, while the rest of the body continues to be perfused and oxygenated. The machine must therefore replace two organs at once: pumping and gas exchange.
Pumping without destroying blood
Impellers and valves that would be unremarkable in any other fluid shear red cells. Roller pumps compress tubing externally so no mechanism contacts blood; centrifugal pumps use smooth accelerating flow. Both are chosen for gentleness rather than efficiency.
Oxygenating without foaming
Early oxygenators bubbled gas directly through blood, which works but damages proteins and risks embolism. Membrane oxygenators separate gas and blood by a permeable membrane, mimicking the alveolus and greatly reducing trauma.
Managing the whole physiology
Temperature, anticoagulation, electrolytes, haemodilution and perfusion pressure all shift during bypass and interact. The machine is one element in a controlled physiological state, not a standalone device.
Air, always
Any air entering the arterial line becomes an embolism. Bubble detectors, filters, circuit geometry that traps air and rigorous priming procedure are all mandatory, and none is optional.
Gibbon worked on the problem from the early 1930s, motivated by a patient he had watched die from a pulmonary embolism. The first successful clinical use came in 1953. Two decades of development for a single successful operation is a realistic picture of how long a genuinely new capability takes, and it is consistent with the float glass and ammonia examples elsewhere in this series.
05The pacemaker: engineering inside a control loop
The heart has its own electrical conduction system. When it fails, the mechanical pump is sound but uncoordinated or too slow. An external stimulus can restore rhythm, and external pacemakers existed by the early 1950s — but they were mains-powered and tethered the patient to a machine.
Elmqvist and Senning implanted a self-contained device in 1958. It failed after a few hours; a second was implanted the following day and lasted longer. The patient outlived both the surgeon and the engineer, receiving many devices over his life. The honest description is that the first implant was a partial failure that established feasibility, and the technology matured through iteration.
| Constraint | Engineering response |
|---|---|
| No serviceable access | Hermetic sealing, high-reliability components, design life measured in years, replacement by surgery |
| Finite stored energy | Extreme circuit efficiency, output tuned to just above capture threshold, demand pacing that fires only when needed |
| Biocompatibility | Titanium enclosures, inert lead insulation, materials qualified against long-term tissue response |
| Electromagnetic interference | Filtering, shielding, and defined behaviour on interference detection rather than unpredictable response |
| Lead mechanical fatigue | The lead flexes with every heartbeat for the device life; coiled conductors and strain relief address a genuinely enormous cycle count |
| Safe failure behaviour | Reversion to a defined asynchronous mode rather than ceasing output, so a fault does not remove pacing |
Early devices paced at a fixed rate regardless of the heart’s own activity, which wastes energy and can compete with intrinsic beats. Demand pacing senses the intrinsic rhythm and withholds a pulse when the heart has beaten on its own. Adding a sensing function transformed both device life and clinical safety, and it is a general principle worth stating plainly: a controller that observes before acting outperforms one that acts unconditionally, in every domain where both have been tried.
06Takeaways for current practice
- Design around the fragility of what you are handling. Blood forced the pump selection; the same reasoning applies to any shear-sensitive or contamination-sensitive process.
- Counter-current arrangement preserves the driving gradient. It is close to free and is left on the table constantly.
- Define the failure state explicitly. Where there is no safe shutdown, the device must fail into a defined useful mode.
- Sense before acting. Demand pacing extended device life and improved safety simultaneously by adding an observation step.
- Expect a long interval between feasibility and dependability. Two decades of development for one successful operation is normal, not exceptional.
Relevant references include IEC 60601 for medical electrical equipment safety, ISO 14971 for risk management of medical devices, ISO 10993 for biological evaluation, and ISO 13485 for quality management systems, with the Therapeutic Goods Administration regulating supply in Australia. Cited by number for orientation only — verify currency.