1. Zhihao Jiang, Rahul Mangharam PRECISE Center University of Pennsylvania

2. Over 600,000 cardiac medical devices recalled from 1990-2000 40% of recent recalls were due to software issues Implantable Pacemaker Implantable Cardioverter-Defibrillator (ICD)

3. Two leads in heart chambers Deliver electrical signals when heart rate is low Device malfunction may result in death or injury Flawed devices are recalled

4. Pacemaker – Autonomous device with minimum human interaction – Limited diagnostic/therapy capability – Its safety is evaluated regarding to its environment – Evaluation requires extensive domain knowledge The physical plant is stochastic: – Complex dynamics of the heart – Interaction between the heart and other parts of the body

5. Domain Expert Safety/Efficacy Requirements

6. Domain Expert Software Engineer Safety/Efficacy Requirements Software specifications

7. Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation

8. Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation

9. Examining documents before device released to the market – Software specifications – Justification of the specifications – Test reports Responsibility on manufactures Issue recalls when incidents happen Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation

10. Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation System model

11. Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation Safety/Efficacy properties System model Environment model Model Checking

12. Conformance Testing Test Generation Domain Expert Software Engineer Electrical engineer Safety/Efficacy Requirements Software specifications Implementation Safety/Efficacy properties System model Test Cases Environment model Model Checking

13. Refractory Time V out RestERPRRPRest Refractory Time V out RestERPRRPRest node path node

14. Node AutomataPath Automata

15. Level of detail AbstractionRefinement

16. Abstraction TCTL Safe? No Yes Heart Pacemaker Timed automata model Physician Physiological requirements No Bug found System Safe Refinement Valid? Counter- examples Ambiguous? No Yes Model Checker H0H0 H1H1 H2H2 H3H3 H4H4

17. Quantitative Verification – Cost functions Oxygen demand/debt Battery consumption for the device – Evaluate algorithms with same objectives – Optimal parameter setting for specific patient Patient-specific heart model learning

18. “Let our heart catch bugs before your heart does.”