Advanced medical devices exploit the advantages of embedded software whose development is subject to compliance with stringent requirements of standardization and certification regimes due to the critical nature of such systems. This paper presents initial results and lessons learned from an ongoing project focusing on the development of a formal model of a subsystem of a software-controlled safety-critical active medical device (AMD) responsible for renal replacement therapy. The use of formal approaches for the development of AMDs is highly recommended by standards and regulations, and motivates the recent advancement of the state of the art of related methods and tools including Event-B and Rodin applied in this paper. It is expected that the presented model development approach and the specification of a high-confidence medical system will contribute to the still sparse experience base available at the disposal of the scientific and practitioner community of formal methods and software engineering.
One of the medical devices relatively close to hemodialysis machines is an infusion pump. It is primarily responsible for delivering fluids, such as nutrients and medications, into a patient's body in controlled amounts. @cite_30 present a reference model of PCA (Patient Control Analgesia) infusion pumps and test the model for structural and safety properties, Jos ' e et al @cite_27 present a formal model in MAL (Modal Action Logic) @cite_36 that helps compare different infusion devices and their provided functionalities, and @cite_1 use the ProZ model checker @cite_28 to test various safety properties of infusion pumps.
@cite_30 @cite_28 @cite_36 @cite_1 @cite_27
2107114959 2149519129 1984010941 2067100278
This paper is concerned with the scaleable and systematic analysis of interactive systems. The motivating problem is the procurement of medical devices. In such situations several different manufacturers offer solutions that support a par- ticular clinical activity. Apart from cost, which is a dominating factor, the variations between devices are relatively subtle and the consequences of particular design fea- tures are not clear from manufacturers' manuals, demonstrations or trial uses. De- spite their subtlety these differences can be important to the safety and usability of the device. The paper argues that formal analysis of the range of offered devices can provide a systematic means of comparison. The paper also explores barriers to the use of such techniques, demonstrating how layers of specification may be used to make it possible to reuse common specification. Infusion pumps provide a motivat- ing example. A specific model is described and analysed and comparison between competitive devices is discussed. As software becomes ever more ubiquitous and complex in medical devices, it becomes increasingly important to assure that it performs safely and effectively. The critical nature of medical devices necessitates that the software used therein be reliable and free of errors. It becomes imperative, therefore, to have a conformance review process in place to ascertain the correctness of the software and to ensure that it meets all requirements and standards. Formal methods have long been suggested as a means to design and develop medical device software. However, most manufacturers shy from using these techniques, citing them as too complex and time consuming. As a result, (potentially life-threatening) errors are often not discovered until a device is already on the market. In this paper we present a reference model based approach to software conformance checking. Reference models enable the application of formal methods to software conformance checking, and provide a framework for rigorous testing. To illustrate the approach, we develop the reference model for a generic patient controlled analgesic infusion pump, and explain how it can be used to aid software conformance checking in a regulatory environment. A syringe infusion or other patient health care fluid delivery arrangement or system having a substantially constant force syringe holder driver for a fluid-dispensing syringe to which an on-off valve and effectively bendably flexible tube connecting set are connected for delivery of a health care fluid to a patient delivery site at a preselected preset rate which is precision self-metered and determined by the fluid pressure and viscosity and the resistence to flow of fluid from the syringe and through the tube connecting set. The tube connecting set may be precision made to enable enhancement of predictability of fluid flow rate therethrough, and the various sets may be individually provided with indicia indicative of flow rate for given fluid and fluid pressure conditions. A single responsible health care professional may fill a syringe with a prescribed dosage and concentration of fluid to be administered to a patient and may preselect the delivery rate, by selecting and assembling a given syringe holder driver, fluid-filled syringe and tube connecting set. The syringe holder driver is powered by a pair of Neg'ator constant force springs which roll off and onto ball-bearing-mounted rotatable drums carried by a syringe plunger pusher or driver which is centered and guided in its longitudinal movement by the opposed Neg'ator springs and the syringe plunger, which springs are laterally stabilized by nonsliding strip-laying stabilizing retentive engagement with, and strip-pickup removal from engagement with, the syringe holder driver cover. Ensuring that users can successfully interact with software and hardware devices is a critical part of software engineering. There are many approaches taken to ensure successful interaction, e.g. the use of user-centred design, usability studies, training and education etc. In this paper we consider how the users of modal medical devices, such as syringe pumps, are supported (or not) post-training by documentation such as user manuals. Our intention is to show that modelling such documents is a useful component in the software engineering process, allowing us to discover inconsistencies between devices and manuals as well as uncovering potentially undesirable properties of the devices being modelled.