Towards Patient Safety in Closed-Loop Medical Device Systems Authors David Arney, Miroslav Pajic, Julian Goldman, Insup Lee, Rahul Mangharam, Oleg Sokolsky Presenter Velin Dimitrov

Nurses and other clinicians deal with a multitude of tasks They need to quickly assess dangerous situations and take preventive action Delays are life-threatening Adding autonomy to medical devices will relieve the burden on nurses Need

The clinician “closes the loop” Alarm sounds when sensor passes threshold Clinician arrives to assess the situation Clinician must first acquaint themselves Clinician takes action Typical Clinical Setting

What if devices themselves could sense common fault/dangerous conditions and respond more quickly than a clinician could? Human caregiver will always be in the loop! Proposal

ControllerPlantSensors Bridge to Control Systems

Formal, timed automata based model  UPPAAL tool  Exhaustively test system behaviors in failure mode  Timing constraints from dynamic model Detailed, informal model  Simulink/MATLAB  Captures dynamics of human/device interaction Two Models

MD PnP and ICE Architecture Case Study

Patient Control Analgesia (PCA) pump Provide pain meds to patient  Customized dosing Programmed limits on how many doses can be delivered Clinical Use Case

Mis-programming Overestimation of maximum dose Wrong concentration Accidental pressing of button These failures cannot be currently avoided Modes of Failure

System

Control Loop

Programmed by caregiver  Normal rate of infusion  Increased rate of bolus  Bolus total duration  Drug limit Built in sensors to catch device faults Network interface for status  No pumps can currently accept control sigs PCA Pump

Measure SpO2 and HR Finger clip sensor Ratio of IR to red light Amplitude Pulse Oximeter

Pain, Pain-controlled, Overmedicated Critical Region  Overdose, Respiratory distress  SpO2 <70%, HR <11.5 bpm Drug level is a linear mapping to HR and SpO2 in this model Patient Model

Decides when to stop pump to keep patient out of critical region Clinical application script (CAS) Alarming Region Sp02 <90% or HR <57 bpm Notify caregiver – Alarming condition Supervisor Model

Communication Structure

Will the system function correctly? Finding faults and recovering gracefully Verification and Validation

Formal Model –Pulse Oximeter

Formal Model – PCA Pump

Formal Model - Supervisor

Formal Model - Patient

Formal Model - Network

Check that the pain eventually goes up in the model Check that the pump is stopped in the alarming condition Verifying Safety Properties

Used to determine the timing/rate parameters that make the system safe Models patient dynamics, network delays, pump delays Informal, Detail Simulink Models

System

Patient Model

PCA pump will always be stopped before we reach critical condition Safety Requirement

Variables

Finding t_crit

alpha is 0.001s^-1 Half life of drug is 11.5 minutes For H1 = 90% and H2 = 70% Tcrit = 26.8 minutes Comparing Time Delays to tcrit

Supervisor control algorithm and pump design must maintain open-loop stability Essentially adding capability to limit given dose per command from the supervisor – activation command Network Delay Tolerance

Disregard button pressed for tdel time units t_del must be less than t_safe for this to work t_del

t_safe t_safe must satisfy the following condition

dl_max = 100, Hdl_2 = 85.71, Hdl_1 = 28.57, dl_cur = 20 This corresponds to alarm/critial cond t_safe = 1723 sec t_safe

Supervisor dynamically sets max drug level Retrofittable Solution

Alaris 8210 SpO2 mdoule connects to Alaris 8000 pump controller Tightly integrated system from single vendor Need good model that captures whole process of drug delivery Pharmacokinetic models are not sufficient Related and Future Work