1. Towards Patient Safety in Closed-Loop Medical Device Systems Authors David Arney, Miroslav Pajic, Julian Goldman, Insup Lee, Rahul Mangharam, Oleg Sokolsky Presenter Velin Dimitrov

2. Nurses and other clinicians deal with a multitude of tasks They need to quickly assess dangerous situations and take preventive action Delays are life-threatening Adding autonomy to medical devices will relieve the burden on nurses Need

3. The clinician “closes the loop” Alarm sounds when sensor passes threshold Clinician arrives to assess the situation Clinician must first acquaint themselves Clinician takes action Typical Clinical Setting

4. What if devices themselves could sense common fault/dangerous conditions and respond more quickly than a clinician could? Human caregiver will always be in the loop! Proposal

5. ControllerPlantSensors Bridge to Control Systems

6. Formal, timed automata based model  UPPAAL tool  Exhaustively test system behaviors in failure mode  Timing constraints from dynamic model Detailed, informal model  Simulink/MATLAB  Captures dynamics of human/device interaction Two Models

7. MD PnP and ICE Architecture Case Study

8. Patient Control Analgesia (PCA) pump Provide pain meds to patient  Customized dosing Programmed limits on how many doses can be delivered Clinical Use Case

9. Mis-programming Overestimation of maximum dose Wrong concentration Accidental pressing of button These failures cannot be currently avoided Modes of Failure

10. System

11. Control Loop

12. Programmed by caregiver  Normal rate of infusion  Increased rate of bolus  Bolus total duration  Drug limit Built in sensors to catch device faults Network interface for status  No pumps can currently accept control sigs PCA Pump

13. Measure SpO2 and HR Finger clip sensor Ratio of IR to red light Amplitude Pulse Oximeter

14. Pain, Pain-controlled, Overmedicated Critical Region  Overdose, Respiratory distress  SpO2 <70%, HR <11.5 bpm Drug level is a linear mapping to HR and SpO2 in this model Patient Model

15. Decides when to stop pump to keep patient out of critical region Clinical application script (CAS) Alarming Region Sp02 <90% or HR <57 bpm Notify caregiver – Alarming condition Supervisor Model

16. Communication Structure

17. Will the system function correctly? Finding faults and recovering gracefully Verification and Validation

18. Formal Model –Pulse Oximeter

19. Formal Model – PCA Pump

20. Formal Model - Supervisor

21. Formal Model - Patient

22. Formal Model - Network

23. Check that the pain eventually goes up in the model Check that the pump is stopped in the alarming condition Verifying Safety Properties

24. Used to determine the timing/rate parameters that make the system safe Models patient dynamics, network delays, pump delays Informal, Detail Simulink Models

25. System

26. Patient Model

27. PCA pump will always be stopped before we reach critical condition Safety Requirement

28. Variables

29. Finding t_crit

30. alpha is 0.001s^-1 Half life of drug is 11.5 minutes For H1 = 90% and H2 = 70% Tcrit = 26.8 minutes Comparing Time Delays to tcrit

31. Supervisor control algorithm and pump design must maintain open-loop stability Essentially adding capability to limit given dose per command from the supervisor – activation command Network Delay Tolerance

32. Disregard button pressed for tdel time units t_del must be less than t_safe for this to work t_del

33. t_safe t_safe must satisfy the following condition

34. dl_max = 100, Hdl_2 = 85.71, Hdl_1 = 28.57, dl_cur = 20 This corresponds to alarm/critial cond t_safe = 1723 sec t_safe

35. Supervisor dynamically sets max drug level Retrofittable Solution

36. Alaris 8210 SpO2 mdoule connects to Alaris 8000 pump controller Tightly integrated system from single vendor Need good model that captures whole process of drug delivery Pharmacokinetic models are not sufficient Related and Future Work