Technical dossier: modular artificial heart system

The system combines a pulsatile membrane pump for systemic circulation, a continuous microaxial pump with pulse chamber and bypass logic for pulmonary circulation, a sensor and control unit, an implantable battery module with BMS, and TET-based inductive charging (three independent coil pairs).

Modular separation reflects different pressure levels, flow rates and failure modes of both circuits.

Systemic circulation requires higher outlet pressure and larger stroke volumes. Pulmonary circulation operates at lower pressure with gentle flow requirements. A single chamber for both tasks would either overload the lungs or under-supply the body.

Core components: blood-contacting membrane (silicone-based), pressure plate, inlet/outlet valves, electric linear drive via roller screw. This main chamber supplies the systemic circuit only.

• Concept stroke: 8–12 mm
• Chamber volume: up to 130 ml (short-term design maximum)
• Outlet pressure: up to 210 mmHg (short-term design maximum, not a normal operating pressure)
• Materials outside the membrane: Ti-6Al-4V, PEEK, EPDM, PU

Converts motor rotation into defined linear stroke. Requires position, current and temperature monitoring plus rules against hard overdrive into closed hydraulic paths.

Membrane geometry controls deformation and residual volume. Valve timing is safety-critical. Validation includes cyclic fatigue, opening pressure and partial obstruction behavior.

Continuous baseline pump, pulse chamber and bypass valves form one coordinated control unit.

Continuous baseline pump with a rotor/impeller — an impeller in the blood path is deliberately used here (unlike the systemic pump).

• Diameter: approx. 21 mm
• Pump body: approx. 10 mm
• Pressure rise: up to 20 mmHg
• Flow rate: up to 13 l/min

The pulmonary circuit runs well below the systemic side; the microaxial pump is designed for a pressure rise of up to 20 mmHg. The actual operating point must be patient-adaptive — people with pre-existing pulmonary hypertension run higher than rigid limits. Control must limit pressure rise when downstream resistance increases.

The small chamber on the pulmonary side adds controlled pulsatile energy (silicone-based membrane) on top of the microaxial pump's continuous baseline flow and can act as a pressure buffer. It exists solely for pulsatility, not as a replacement for the main pump.

• Fill volume: 40–50 ml
• Operating pressure: 8–20 mmHg
• Beat frequency: follows the main pump (no independent fixed value)

First relief stage — diverts flow toward pulse chamber when outlet pressure or flow plausibility thresholds are exceeded.

Second safety path when bypass 1 is insufficient. Final relief route requires architectural definition and hydraulic verification.

Pressure, flow, RPM, temperature, valve state, pulse chamber pressure — with cross-sensor plausibility checks.

Staged response: reduce power → bypass 1 → bypass 2 → alarm → defined safe mode. Each stage requires bench and fault-injection testing.

• 14.8 V, 4.7 Ah, approx. 70 Wh (concept)

Cell balancing, thermal monitoring, overcharge/deep discharge protection.

3 equally sized external coils, 3 equally sized implanted receiver coils — 3 independent pairs, no intermediate coils. 2 redundant electronics/control modules per unit. External coil positioning is magnetically assisted.

• Receiver implantation depth: approx. 3–4 mm under the skin
• Frequency: still open (150 kHz so far only a preliminary investigation value)
• Target efficiency: 85% (not yet a finished value range)
• Coil size and magnetic force: still open

Validation: positional tolerance, tissue heating, EMC, mispositioning, shutdown logic.

Flat heat spreader with a non-conductive, tissue-compatible fluid and a small active circulation loop (not purely passive).

• Dimensions: approx. 25 × 8 × 0.4 cm, both large surfaces combined approx. 400 cm²
• Working assumption for first thermal modelling: approx. 70–100 ml/min fluid flow
• Example dissipated power of 10.7 W is a calculation assumption only, not a confirmed limit
• Fluid type, circulation pump and absolute electrical power draw: still open

Note: off-the-shelf silicone oils are used for the calculation only and are nowhere near implantable as-is.

Already fixed (unconfirmed numbers remain explicitly TBD; earlier performance estimates are not a specification):

• Normal energy transfer: 3 independent TET/coil channels
• Two redundant, equally sized internal battery modules — if one fails (and it must never leak), the other takes over
• Purpose of the battery modules: not only an emergency fallback, but everyday freedom from the inductive charging belt (e.g. sport, showering) for some duration
• Total capacity and per-module split: not yet fixed (TBD)
• Emergency pump: 1 unit, 2 separate impellers, 2 fully separate hydraulic circuits, equal flow on both sides, flow rate 4–5 l/min — a pure emergency-run value, not normal operation
• Systemic emergency operation: mean arterial pressure at least 70 mmHg, target approx. 80 mmHg
• Pulmonary emergency operation: not yet fixed — must be patient-adaptive, since people with pre-existing pulmonary hypertension run physiologically higher than a rigid 12 mmHg limit
• Emergency pump electrical power: TBD — via bench measurement including startup and worst-case operating point
• Port service duration: until repair/replacement; concrete minimum duration TBD

The port is the fourth and final energy level: three inductive channels, redundant internal battery modules, an independent emergency controller with emergency pump, and a direct percutaneous emergency power port.

After all coils fail, the system continues on battery and immediately triggers an alarm. The port should be connected while battery reserve remains — not only after full depletion.

Operating sequence: port closed → sterile probe inserted → mechanically locked → seal checked → isolation checked → contacts checked → precharge → power release → emergency pump takes over → battery charged only with surplus.

Removal reverses the order: battery takeover and power cutoff first, then unlocking.

• A single bipolar connector, not two separate puncture sites
• Two robust power contacts (plus/minus) plus two low-energy pilot/test contacts or an equivalent contactless seating check
• Power contacts fully within a sealed chamber; no live metal surface may contact tissue or body fluid
• Probe and port mechanically coded — wrong orientation or reversed polarity is physically impossible
• Pilot contacts close last and open first: power flows only once the power contacts are fully seated
• Self-closing inner barrier plus outer sterile seal; on fluid ingress, no power release, alarm, switch to battery
• Port fully under intact skin in normal operation; access only as a sterile medical emergency procedure

Emergency power path: external medical power source → emergency probe → hermetic feedthrough → independent input protection → emergency DC bus → emergency controller/pump. Separate branch: emergency DC bus → independent, protected charging electronics → battery modules.

• Both supply conductors floating relative to earth, housing and patient; no body as return conductor; galvanic isolation of the external source
• No ordinary power supply, USB supply, or open lab connection may connect directly to the port
• Power input de-energized during insertion/removal; hardware-based enable — software alone cannot switch on the contacts
• Precharge against sparking/inrush/voltage sag; reverse-polarity, over/undervoltage, overcurrent and short-circuit protection
• Monitoring of insulation and contact resistance, voltage, current, power, temperature; defibrillation and electrosurgery immunity must be tested
• Power loss or cable break must not cause the emergency controller to restart; insufficient input power stops charging first — the pump always has priority
• Battery cells are never charged bypassing a validated protection circuit; the direct pump path works even with a defective normal BMS
• No internet, cloud, account or radio requirement

Still TBD: nominal input voltage, allowed voltage range, continuous current, peak current/duration of pump startup, required continuous power, maximum contact losses, allowed leakage current, isolation voltage, battery ↔ external switchover time, maximum charging power — fixable only after measuring the pump, controller and battery.

• Hermetic implanted housing, titanium preferred as the base material; ceramic or glass-ceramic feedthrough for the electrical conductors
• Polymer may serve as an insulating guide but not, unvalidated, as the sole long-term barrier
• Corrosion- and wear-resistant contact alloy (material TBD); no galvanically unfavourable metal pairing; no sharp edges near skin
• Mechanical lock with clear feedback; external cable with strain relief and a controlled breakaway point so pull is not transmitted to implant/tissue
• Port must be palpable or locatable via a defined medical locating system; location must not conflict with coils, blood lines or pressure zones
• Magnetic positioning may assist but must not be the sole lock

Still TBD: port diameter/height, mass, implantation depth, insertion path/force, retention force, allowed lateral load, cable pull limit, number of allowed accesses, intended implant lifetime, replacement requirement after emergency use. Safest current concept assumption: a single emergency access followed by surgical inspection or replacement.

• Temperature sensor directly at the power connector, second sensor at the implanted housing surface
• Continuous calculation of contact losses from current and voltage drop — no undetected local hotspot
• Staged response to heating: stop battery charging → trigger alarm → switch to a second external input or battery if possible → reduce power only if the minimum required blood flow is maintained
• A temperature fault must not silently shut down the pump

Allowed surface/tissue temperature and maximum temperature rise remain TBD, to be derived from standards, preclinical data and risk assessment.

• Skin fully closed in normal operation; port permanently sealed against body fluids
• Sterile single-use probe or single-use access set; reusable external electronics stay outside the sterile barrier
• Sterilisation method must account for material, seals, contacts and electronics; retest for microbial seal integrity after ageing/access cycles
• No fluid as an electrical contact medium; no antibiotic coating as a substitute for a real barrier
• Clinical use only by trained personnel; continuous monitoring for infection, tissue damage and local heating after use

The port must not depend on: the three receive coils, their rectifiers, normal charging electronics, the main controller, the normal communication system, a functioning battery, or an internet/radio connection.

Single faults to be tested: line broken, contact shorted, probe only partially seated, wrong probe, fluid/contamination in the access path, one temperature sensor failed, pilot contact stuck, main controller fully failed, normal BMS failed, external supply collapses, cable pulled out, software hangs, electromagnetic interference, defibrillation during supply, contact resistance rising, seal damaged.

A single fault must neither energise open contacts nor disable all power paths simultaneously. Where these two goals conflict technically, a documented risk decision with an independent manual clinical fallback is required.

• Physically and electrically independent emergency controller; minimal function scope: control the pump, monitor the power path, issue alarms
• Independent hardware watchdog; defined restart without uncontrolled pump stoppage; no firmware update during emergency operation
• Local hardware identification of the approved power supply/cable; safety function does not rely solely on encryption or software

Event log for: coil failure timestamp, battery charge state, port connection time, voltage/current/power, contact and housing temperature, insulation status, contact resistance, pump RPM/flow/pressure, alarms and switchovers.

• Medically isolated, battery-backed power source with mains operation and its own external battery
• Two independent external supply units or an immediately available spare unit; output stays de-energised until fully locked
• Voltage conversion and further electronics deliberately live in this external, patient-remote unit — not in the small connector itself — to keep the attack surface small right at the body interface
• Display of connection, isolation, voltage, current, power, temperature, battery state; audible and visual alarms
• No standard connector that could accidentally be plugged into an unsuitable source; one-handed operability with medical gloves must be tested; no cloud requirement
• Sterile access set with monitored expiry and packaging data

Deployment environment (EMS, clinic, or both) still TBD.

Planned evidence: CFD, hemolysis screening, membrane/valve endurance, rotor/bearing life, thermal/electrical safety, software fault handling, sterilization, biocompatibility.

Status: concept and engineering documentation only.