Kobus Cilliers | On 01, Dec 2019

Darrell Mann

This is a photo of Natasha Ednan-Leparouse, recently boarded on a plane from Heathrow to Nice in the South of France. Approximately two hours after this photo was taken, Natasha was tragically pronounced dead. She suffered from extreme food allergies and had unwittingly, just before boarding her plane, eaten a sandwich that contained sesame seeds. As an allergy sufferer, Natasha had two EpiPens with her. Both were injected into her, but neither worked.

The first story here is how come neither EpiPen worked. The simple answer to that question is that the design of EpiPens is not fit for purpose. The world now knows that in a typical year, EpiPens fail over 200 times, will result in over 35 hospitalizations and around seven deaths. The inquest following Natasha’ tragic death concluded that the EpiPen design was ‘inherently unsafe’.

The medical devices industry is understandably a conservative one. What this means in practice is that they are very slow to learn from experience. Clinical trials and ‘clinical evidence’ are what determines the rate of change. The industry also tends to be very insular. Whenever we have attempted to discuss TRIZ and particularly the Trends of Evolution aspects of TRIZ with engineers and scientists within the industry, the overwhelming reaction has been one of ‘this does not apply to us’. Which is in effect a catastrophic illustration of what a sham ‘clinical evidence’ actually is. The TRIZ trends are built on literally millions of pieces of objective evidence. Their job is to point users in the right direction when it comes to designing better products. Of course, having given the design direction there still comes the job of adequately testing the specific design solution in order to achieve the relevant regulatory approvals. I get that part. But thinking forward to that part of the process should not be an excuse for not making use of the Trend knowledge during the design process.

The Resilient Design trend, for example, (Figure 1) plots a very clear trajectory for designers looking to create products and services that are safer and more reliable. We have enough data now to also be able to connect each Trend stage to the level of reliability they will enable, when measured in terms of the number of ‘nines’:

Figure 1: Resilient Design Trend And Connection With Safety Performance

What we now know about EpiPens is that they’re capable of delivering about 99% (i.e. ‘two nines’) likelihood of doing what they were intended to do. This doesn’t sound great. Which is why many allergy sufferers end up – like Natasha – carrying two. Two EpiPens should in theory give four-nines performance. But in reality, will probably be something less than this because if the person using the device gets it wrong the first time, there is a fair likelihood they will also get it wrong the second time as well.

Whatever the precise number of nines EpiPens achieve is, I believe that any medical device designer who wishes to sleep at night would conclude that the current level of performance is not good enough. In terms of the Resilient Design trend, the design method is very likely ‘steady-state’. We can’t say for certain, but the important point is not about the actual position (only the EpiPen designers could tell us whether they’ve built transient performance models, or looked at slow degradation effects, or cross-coupling effects, or ‘idiot-proofing’). Rather the important point is the existence of the Trend and the fact that it should enable designers to think about how many nines reliability they need to achieve and develop the necessary design capability to ensure that reliability target is achieved. If it was me, I think I’d be looking at achieving nine-nines, and as such then set about designing a device that I knew would work no matter how stressed, confused or ill the user might be at the time they need to use my device.

Also relevant in this calculation is the Safetyism Threshold we discussed in the January 2019 issue of this ezine. With regard to the safety-measure/safety curve, I believe we can make another safe bet that the EpiPen is still on the left-hand side of the curve – Figure 2.

Figure 2: EpiPen And The Safety-Measure Versus Safety Curve

This being the case, we should know that adding more safety measures would be a good thing.

A third relevant way for designers to understand their task is to think about the type of design problem they’ve been tasked with working on. Using the Complexity Landscape Model (CLM) we can see that the EpiPen design is expected to operate in a Complicated environment (every patient will have different anatomy, skin thickness, body fat, etc that will give rise to a series of design contradictions). The lack of sufficient reliability, on the other hand is indicative of the fact that the design community has mistakenly assumed that they are operating in the Simple regime. Figure 3 plots these two aspects onto the CLM:

Figure 3: EpiPen Design And Complexity Landscape Model

Crucially, the design sits below the Ashby Line. The EpiPen does not satisfy Ashby’s Law, there being insufficient variety in the pen design to cope with the level of variety in the patients into which it is to be administered. The design is not resilient, and as such, accidents are inevitable.

Honestly, if I was an EpiPen designer I don’t think I’d be happy with what I’ve done. I can imagine, too, that I’d be very frustrated at the ‘clinical evidence’ world in which I had to operate. But at the same time, if the information I needed to do better was out there, I don’t think my conscience could stop me from going to look for it, and, once I’d found it, from then making use of it.

The inquest into Natasha Ednan-Laperouse’s death certainly criticized the EpiPen design and made certain recommendations, but it also made it clear that the inquest team did not possess the requisite engineering skills to really know what had happened.

From the perspective of legislating to ensure Natasha’s tragic case wouldn’t see a repeat in the future, the inquest would have to be deemed a failure. Sadly, when people don’t understand something, they tend to look elsewhere for easier things to blame…

…Which takes us to a very different take on the problem. Relative to understanding the technical functioning of an EpiPen, food labelling is a much easier problem for people to grasp.

Why wasn’t Natasha’s fatal artichoke, olive & tapenade baguette labelled to inform her that it also contained sesame seeds? Especially since the restaurant that she bought the sandwich from was part of a national chain. Everyone – especially the media – could understand this part of the problem. A scandal was duly declared. Followed by the usual witch-hunt. Followed, less than a year after Natasha’s tragic death, by ‘Natasha’s Law’. Which basically means that every sandwich maker in the country, irrespective of whether they are a one-man-band bakery or a national chain, has to label every ingredient on every product they sell starting from next year.

Problem solved everyone now thinks.

But, sadly, that is not how the real world works. Like most similar knee-jerk reactions, all Natasha’s Law will do is the precise opposite of what it has been designed to do. Lots of good intentions, granted, but because those well-intentioned actors don’t understand the bigger picture, lots of terrible, terrible outcomes are the only inevitable result.

The CLM offers up the first hint of what’s going on here:

Figure 4: Natasha’s Law And Complexity Landscape Model

Society-level food labelling is a complex issue, but Natasha’s Law treats is as a simple one. It represents a classic case of the ‘every complex problem has a simple, wrong answer’ aphorism. It is about as far below the Ashby Line as it is possible to be without actually finding ourselves in chaos… there is not enough variety in the Law to handle the range of variety in the environment.

Crucially, when we shift focus to the Safetyism Threshold, food product labelling – in the UK at least – has already crossed the Threshold. Adding more requirements can thus serve to do nothing more than reduce safety. It is the equivalent of 20mph speed limits, No Jaywalking restrictions and signs on stairways instructing people to hold on to the handrails. All done with the best of intentions, but all, too, a proven way to make society less safe.

Part of the issue here is plausible deniability. When someone falls down a staircase at work, those responsible for Health & Safety feel a need to be seen to be doing something. And so, putting up a sign is a very tangible thing for them to do. Putting up a sign fits most people’s idea of common sense. But most people’s idea of common sense is utterly wrong when it comes to complex systems. Still, the H&S officials can demonstrate they’ve done something. And that something is far easier than having to explain that sometimes adding more safety measures makes safety worse. That doesn’t fit most people’s idea of common sense.

Figure 5: Natasha’s Law And The Safety-Measure Versus Safety Curve

Because those responsible for Natasha’s Law don’t understand either this curve or how complex systems work, sadly for them, they’ve encouraged society to put in place another ‘simple, wrong’ solution. One in which everyone loses and society enters a vicious cycle that ultimately will lead to a much more fragile environment for everyone: small food companies go out of business; large food companies put in place ever more expensive, ever more stringent food ‘hygiene’ requirements; which makes those with allergies even more vulnerable when even a microgram of an allergen inevitably works its way through the system; the labels, meanwhile, increase societal paranoia, which means we all become more prone to placebo effects; we all get iller and society as a whole gets more fragile.

Perhaps what makes this all so tragic is the fact that the human body is one of the most resilient (one might go so far as to say ‘antifragile’) systems on the planet. We all of us face a constant battle against the microcosm of viruses and bacteria. Our anti-bodies do a fantastic job of protecting us, but for them to help us, we also have to help them. Take the resilience problem down to first principles, and our body is only able to protect itself if it is constantly stressed. By making our world’s ever more clean and hygienic, we make our bodies less able to cope. Particularly small children. Infants used to eat dirt. Parents today have been told this is a bad thing. They have been mis-informed. The world has an allergy epidemic largely because we’ve all been encouraged to remove the things that made us strong.
In theory, everything – human body included – evolves in the direction of increasing ideality. But that means being able to deal with bad stuff, not removing bad stuff. The human body is supposed to self-repair. By cleaning up the world and filling ourselves with drugs the moment the faintest flicker of illness appears, we’ve gone in precisely the wrong direction. And now with things like Natasha’s Law, we find ourselves legislating to keep going in that wrong direction. And before long the vicious cycle we naively set up by not understanding how the world works, turns itself into a tailspin.

Meanwhile, the real problem – poor EpiPen design – goes unnoticed.

People might have had enough of experts right now, and I can see why. We’ve unwittingly conspired to create a world of expertise in the wrong things. Too many engineering silos; not enough complex systems thinking.