High Confidence Medical Device Software and Systems (HCMDSS) Workshop Planning Meeting Insup Lee Department of Computer and Information Science University of Pennsylvania November 16-17, 2004 Arlington, VA

Welcome  The Federal Government sponsor agencies and the university organizers are grateful that you forfeited participation in other activities on your busy schedules to be here  We thank you and hope that this meeting proves to be well worth your time and effort.  Experience has taught us that assembling a small group of experts in planning meetings to prepare for larger related workshops yields highly successful results. Therefore, as leaders and visionaries in the medical device industry, research laboratories, and academia, your full participation in this activity is critical to the success of this planning meeting.  We encourage your thought provoking ideas and insights for identifying the software and systems issues and challenges that face the medical device industry.

The Problem Statement  The rapidly increasing software complexity of medical devices makes the development of high integrity medical device software and systems a crucial issue in reducing medical errors and prolonging and saving lives.  Software for future medical devices cannot be developed using existing design and productivity technologies.  The increasingly heterogeneous nature of medical device design requires the need to identify emerging technical and scientific issues in medical devices and to identify obstacles to the development and certification of medical device software and systems

HCMDSS Workshop Planning Meeting (WPM)  Goal of WPM  Identify crucial medical device software and systems issues that will help shape a research needs agenda for a larger national-level HCMDSS Workshop slated for May  Topics for the workshop  Identify potential stakeholders, key invitees, and PC members  Prepare WPM report

HCMDSS workshop in Spring 2005  Motivation  Improve the design, certification, and operation (by both health care professionals and consumers) of medical device software and systems that will result in better and more cost-effective medical care.  Goals  Identify research challenges and emerging issues  Generate research needs and roadmap at the national level across multiple agencies  Create a community

Schedule: Day One  Panels  Design of future medical devices  Software and systems engineering for medical devices  Future usage environments and systems integration  Breakout sessions 1 & 2  Session 1  Group I: Current/Future Medical Devices  Group II: Medical Software Engineering  Group III: Medical Care and Support Systems  Group IV: Quantum Leap Technologies  Session 1  Group I: Requirements Specifications for Certifiable Design  Group II: Development  Group III: Certification  Group IV: Fielding, Operation, and Maintenance  Wrap-up Session / Review of the next day's schedule

Meeting Agenda: Panels  Panel presentations are designed to help set the tone for the afternoon breakout sessions (be provocative, focus on big problems, speculative on future) Panel 1: Design of future medical devices Panel 2: Software and systems engineering for medical devices Panel 3: Future usage environments and systems integration  Panel presenters might be asked to develop their presentations further as white papers for the May 2005 Workshop.

Breakout Sessions  Participant assignments  Each of you have been pre-assigned to two breakout groups including one for Session 1 and another for Session 2.  Facilitators  Each breakout group has a facilitator and a recorder who are there to facilitate and record! You are to actively provide input.  Deliverables  The facilitators/recorders are expected  to produce summary slides in PowerPoint and written summary  to make oral presentations of the groups’ findings to the full plenary on tomorrow morning

Breakout session guidelines  Brainstorming, brainstorming, brainstorming  Write down all ideas. If you don’t get it in writing now, there’s no way to capture it later.  This is not a time for discussing, criticizing, or wordsmithing.  This is not the time for individuals to talk only about their own research or their company’s products. Rather this is the time for representatives of various parts of the field to identify the key questions that the field needs to address.  We have court reporters for our plenary sessions, but not the breakouts.

Breakout Session 1  Group I: Current/Future Medical Devices - trends and the convergence of information technology and medical device technology. A key area of discussion concerns what we may need to do in order to achieve highly reliable IT-intensive devices that are feasible to both develop and to certify.  Group II: Medical Software and System Engineering - current and needed best practice in software engineering for medical devices and systems. This would consider changes in the software and systems to be deployed, and the increasing challenges of IT certification  Group III: Medical Care and Support Systems - current and changing variety of environments in which the new medical device technology would deployed, and the certification challenges that accompany them.  Group IV: Quantum Leap Technologies - look forward and predict possible future states of medical technologies years out. What breakthroughs are needed to enable this vision, particularly in IT? What are the certification challenges?

Breakout session 2  Group I: Requirements Specifications for Certifiable Design - current and needed future practice in specification of medical devices and systems. Getting the right requirements and specifications is never easy: they must be complete without prematurely constraining design, interoperable, etc.  Group II: Development - current practice and improvements in available technologies and approaches needed for high-confidence system and software development. What are the challenges in developing highly reliable software for medical devices and systems, yet achieving reasonable time-to-market and profitability?  Group III: Certification - best current and possible future practice in device and system certification. Other domains (e.g., aviation) are considering whether certification should move from a process standard to a greater orientation towards product and design evidence. What is the perspective of this community regarding needs in V&V and certification?  Group IV: Fielding, Operation, and Maintenance - current and future scenarios for fielding, operation, and maintenance. What changes are occurring and what changes are needed? What assurance needs exist for high- confidence deployment, operation, and upgrade of medical systems in these settings?

Schedule: Day Two  7:30 - 8:30Continental breakfast  8: :00Breakout sessions reports  10: :00Open discussion  11: :15Break  11: :45Discussion of summary report topics for the May 2005 Workshop  11: :00Wrap-up (Overview of Expectations for the May 2005 Workshop)  12:15Planning Meeting Adjourned  12:30 - 3:00Program Committee meeting (Closed)

Before we begin  Government representatives  Participants

Let’s begin!

Bio Insup Lee received the B.S. degree in mathematics from the University of North Carolina, Chapel Hill, in 1977, and the Ph.D. degree in computer science from the University of Wisconsin, Madison, in He is currently Professor in the Department of Computer and Information Science at the University of Pennsylvania, where he has been since He was CSE Undergraduate Curriculum Chair from September 1994 to August His research interests include embedded systems, real-time computing, formal methods, wireless network, and software engineering. He has been developing programming concepts, language constructs, and operating systems for real-time systems. In recent years, he has developed specification, analysis, and testing techniques based on real-time process algebra (ACSR). In addition, he has devoloped a hierarchical specification language for hybrid systems (CHARON). Based on CHARON, he is currently developing techniques for automatic code generation and test generation. Furthermore, he is currently working in wireless network, especially power-aware protocols and security. He also has benn developing the run-time monitoring and checking framework (MaC) that can be used to assure the correctness of a running system through monitoring and checking of safety, QoS, and security properties. The prototype MaC system has been implemented in Java and is currently being ported to Real-Time Java. He is currently chair of IEEE Technical Committee on Real-Time Systems. He has served on numerous program committees, and also (co-)chaired several conferences and workshops, including IEEE Real-Time Systems Symposium in 1992 and 1993, International Workshop on Real-Time Computing Systems and Applications in 1994 and 1996, CONCUR '95 (Internation Conference on Concurrency Theory) in 1995, IEEE International Symposium on Object- oriented Real-time distributed Computing (ISORC) in 1998 and 2000, and EMSOFT in He has been on the editorial boards of IEEE Transactions on Computers ( ), Formal Methods in System Design, and Journal of Electrical Engineering and Information Science. He is IEEE fellow.