A Forensic Disassembly of the BIS Monitor

Abstract

Background: The bispectral index (BIS) monitor has been available for clinical use for >20 years and has had an immense impact on academic activity in Anesthesiology, with >3000 articles referencing the bispectral index. Despite attempts to infer its algorithms by external observation, its operation has nevertheless remained undescribed, in contrast to the algorithms of other less commercially successful monitors of electroencephalogram (EEG) activity under anesthesia. With the expiration of certain key patents, the time is therefore ripe to examine the operation of the monitor on its own terms through careful dismantling, followed by extraction and examination of its internal software.

Methods: An A-2000 BIS Monitor (gunmetal blue case, amber monochrome display) was purchased on the secondary market. After identifying the major data processing and storage components, a set of free or inexpensive tools was used to retrieve and disassemble the monitor's onboard software. The software executes primarily on an ARMv7 microprocessor (Sharp/NXP LH77790B) and a digital signal processor (Texas Instruments TMS320C32). The device software can be retrieved directly from the monitor's hardware by using debugging interfaces that have remained in place from its original development.

Results: Critical numerical parameters such as the spectral edge frequency (SEF), total power, and BIS values were retraced from external delivery at the device's serial port back to the point of their calculation in the extracted software. In doing so, the locations of the critical algorithms were determined. To demonstrate the validity of the technique, the algorithms for SEF and total power were disassembled, comprehensively annotated and compared to their theoretically ideal behaviors. A bug was identified in the device's implementation of the SEF algorithm, which can be provoked by a perfectly isoelectric EEG.

Conclusions: This article demonstrates that the electronic design of the A-2000 BIS Monitor does not pose any insuperable obstacles to retrieving its device software in hexadecimal machine code form directly from the motherboard. This software can be reverse engineered through disassembly and decompilation to reveal the methods by which the BIS monitor implements its algorithms, which ultimately must form the definitive statement of its function. Without further revealing any algorithms that might be considered trade secrets, the manufacturer of the BIS monitor should be encouraged to release the device software in its original format to place BIS-related academic literature on a firm theoretical foundation and to promote further academic development of EEG monitoring algorithms.

Figure 1:

A healthy 12-year old child in natural, physiologic, unanesthetized sleep records a decline in BIS into the mid-20s. No burst suppression is seen. The low BIS scores seen during physiological sleep are remarkable, and the suppression ratio of zero calls into question the posited linear relationship between burst suppression and BIS scores below 50.

Figure 2:

(A) Front view of the Aspect Medical Systems A-2000 BIS Monitor. (B) Detaching the display and front bezel reveals the Main PCB (Printed Circuit Board) within the body of the device enclosure behind. Dismantling the case in this way allows the critical computing components to be accessed easily with debug and test tools, while the Power Supply PCB and Interconnect PCB remain relatively protected against accidental damage. (C) The Main PCB removed from the BIS Monitor, with critical components and interconnects labeled as referenced in the Methods. (D) For comparison, a partially dismantled flash drive of comparable vintage. Data is stored on the highlighted TSOP chip, similar to the TSOP chip that holds the BIS software on the Main PCB.

Figure 3:

(A) Functional layout of the JTAG Interface, involving the LH77790B ARM Microprocessor, the Xilinx FPGA, and the circuit board jumper J99. The major JTAG control lines are TDI (Test Data In), TDO (Test Data Out), TCK (Test Clock) and TMS (Test Mode Select). (B) Debugging must be enabled by placing a jumper on J99. Connecting the middle two pins of J99 completes the continuity of the TDO line from the ARM Microprocessor to the JTAG Interface port, allowing external debugging to begin. (C) JTAG allows multiple devices to be queried in sequence from one interface bus. Connecting the pins of J99 in pairs, as shown, additionally loops in the JTAG circuitry of the Xilinx FPGA by daisy-chaining the TDI/TDO communication path.

Figure 4:

Screen displays on the A-2000 BIS Monitor at key moments. (A) The ARM internal software periodically calculates a validation checksum against itself to assure its own integrity. If this test fails, the device displays an alert and halts as shown, entering an infinite loop that can only be reset by turning the device off and on again. (B) The moment during startup at which the device uses its main ARM processor to test the function of the TMS320C32 DSP chip and then initialize it with the software that calculates BIS parameters.