Zhihao Jiang, Rahul Mangharam PRECISE Center University of Pennsylvania
Over 600,000 cardiac medical devices recalled from % of recent recalls were due to software issues Implantable Pacemaker Implantable Cardioverter-Defibrillator (ICD)
Two leads in heart chambers Deliver electrical signals when heart rate is low Device malfunction may result in death or injury Flawed devices are recalled
Pacemaker – Autonomous device with minimum human interaction – Limited diagnostic/therapy capability – Its safety is evaluated regarding to its environment – Evaluation requires extensive domain knowledge The physical plant is stochastic: – Complex dynamics of the heart – Interaction between the heart and other parts of the body
Domain Expert Safety/Efficacy Requirements
Domain Expert Software Engineer Safety/Efficacy Requirements Software specifications
Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation
Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation
Examining documents before device released to the market – Software specifications – Justification of the specifications – Test reports Responsibility on manufactures Issue recalls when incidents happen Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation
Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation System model
Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation Safety/Efficacy properties System model Environment model Model Checking
Conformance Testing Test Generation Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation Safety/Efficacy properties System model Test Cases Environment model Model Checking
Refractory Time V out RestERPRRPRest Refractory Time V out RestERPRRPRest node path node
Node AutomataPath Automata
Level of detail AbstractionRefinement
Abstraction TCTL Safe? No Yes Heart Pacemaker Timed automata model Physician Physiological requirements No Bug found System Safe Refinement Valid? Counter- examples Ambiguous? No Yes Model Checker H0H0 H1H1 H2H2 H3H3 H4H4
Quantitative Verification – Cost functions Oxygen demand/debt Battery consumption for the device – Evaluate algorithms with same objectives – Optimal parameter setting for specific patient Patient-specific heart model learning
“Let our heart catch bugs before your heart does.”