From Verified Models to Verified Code for Safe Medical Devices

Medical devices play an essential role in the care of patients around the world, and can have a life-saving effect. An emerging category of autonomous medical devices like implantable pacemakers and implantable cardioverter defibrillators (ICD) diagnose conditions of the patient and autonomously deliver therapies. Without trained professionals in the loop, the software component of autonomous medical devices is responsible for making critical therapeutic decisions, which pose a new set of challenges to guarantee patient safety. As regulation effort to guarantee patient safety, device manufacturers are required to submit evidence for the safety and efficacy of the medical devices before they can be released to the market. Due to the closed-loop interaction between the device and the patient, the safety and efficacy of autonomous medical devices must ultimately be evaluated within their physiological context. Currently the primary closed-loop validation of medical devices is in form of clinical trials, in which the devices are evaluated on real patients. Clinical trials are expensive and expose the patients to risks associated with untested devices. Clinical trials are also conducted after device development, therefore issues found during clinical trials are expensive to fix. There is urgent need for closed-loop validation of autonomous medical devices before the devices are used in clinical trials. In this thesis, I used implantable cardiac devices to demonstrate the applications of model-based approaches during and after device development to provide confidence towards the safety and efficacy of the devices. A heart model structure is developed to mimic the electrical behaviors of the heart in various heart conditions. The heart models created with the model structure are capable of interacting with implantable cardiac devices in closed-loop and can provide physiological interpretations for a large variety of heart conditions. With the heart models, I demonstrated that closed-loop model checking is capable of identifying known and unknown safety violations within the pacemaker design. More importantly, I developed a framework to choose the most appropriate heart models to cover physiological conditions that the pacemaker may encounter, and provide physiological context to counter-examples returned by the model checker. A model translation tool UPP2SF is then developed to translate the pacemaker design in UPPAAL to Stateflow, and automatically generated to C code. The automated and rigorous translation ensures that the properties verified during model checking still hold in the implementation, which justifies the model checking effort. Finally, the devices are evaluated with a virtual patient cohort consists of a large number of heart models before evaluated in clinical trials. These in-silico pre-clinical trials provide useful insights which can be used to increase the success rate of a clinical trial. The work in this dissertation demonstrated the importance and challenges to represent physiological behaviors during closed-loop validation of autonomous medical devices, and demonstrated the capability of model-based approaches to provide safety and efficacy evidence during and after device development

Cyber-Physical Modeling of Implantable Cardiac Medical Devices

The design of bug-free and safe medical device software is challenging, especially in complex implantable devices that control and actuate organs in unanticipated contexts. Safety recalls of pacemakers and implantable cardioverter defibrillators between 1990 and 2000 affected over 600,000 devices. Of these, 200,000 or 41%, were due to firmware issues and their effect continues to increase in frequency. There is currently no formal methodology or open experimental platform to test and verify the correct operation of medical device software within the closed-loop context of the patient. To this effect, a real-time Virtual Heart Model (VHM) has been developed to model the electrophysiological operation of the functioning and malfunctioning (i.e., during arrhythmia) heart. By extracting the timing properties of the heart and pacemaker device, we present a methodology to construct a timed-automata model for functional and formal testing and verification of the closed-loop system. The VHM\u27s capability of generating clinically-relevant response has been validated for a variety of common arrhythmias. Based on a set of requirements, we describe a closed-loop testing environment that allows for interactive and physiologically relevant model-based test generation for basic pacemaker device operations such as maintaining the heart rate, atrial-ventricle synchrony and complex conditions such as pacemaker-mediated tachycardia. This system is a step toward a testing and verification approach for medical cyber-physical systems with the patient-in-the-loop

Heart Rhythm Insights Into Structural Remodeling in Atrial Tissue: Timed Automata Approach

The heart rhythm of a person following heart transplantation (HTX) is assumed to display an intrinsic cardiac rhythm because it is significantly less influenced by the autonomic nervous system—the main source of heart rate variability in healthy people. Therefore, such a rhythm provides evidence for arrhythmogenic processes developing, usually silently, in the cardiac tissue. A model is proposed to simulate alterations in the cardiac tissue and to observe the effects of these changes on the resulting heart rhythm. The hybrid automata framework used makes it possible to represent reliably and simulate efficiently both the electrophysiology of a cardiac cell and the tissue organization. The curve fitting method used in the design of the hybrid automaton cycle follows the well-recognized physiological phases of the atrial myocyte membrane excitation. Moreover, knowledge of the complex architecture of the right atrium, the ability of the almost free design of intercellular connections makes the automata approach the only one possible. Two particular aspects are investigated: impairment of the impulse transmission between cells and structural changes in intercellular connections. The first aspect models the observed fatigue of cells due to specific cardiac tissue diseases. The second aspect simulates the increase in collagen deposition with aging. Finally, heart rhythms arising from the model are validated with the sinus heart rhythms recorded in HTX patients. The modulation in the impairment of the impulse transmission between cells reveals qualitatively the abnormally high heart rate variability observed in patients living long after HTX

Stories from different worlds in the universe of complex systems: A journey through microstructural dynamics and emergent behaviours in the human heart and financial markets

A physical system is said to be complex if it exhibits unpredictable structures, patterns or regularities emerging from microstructural dynamics involving a large number of components. The study of complex systems, known as complexity science, is maturing into an independent and multidisciplinary area of research seeking to understand microscopic interactions and macroscopic emergence across a broad spectrum systems, such as the human brain and the economy, by combining specific modelling techniques, data analytics, statistics and computer simulations. In this dissertation we examine two different complex systems, the human heart and financial markets, and present various research projects addressing specific problems in these areas. Cardiac fibrillation is a diffuse pathology in which the periodic planar electrical conduction across the cardiac tissue is disrupted and replaced by fast and disorganised electrical waves. In spite of a century-long history of research, numerous debates and disputes on the mechanisms of cardiac fibrillation are still unresolved while the outcomes of clinical treatments remain far from satisfactory. In this dissertation we use cellular automata and mean-field models to qualitatively replicate the onset and maintenance of cardiac fibrillation from the interactions among neighboring cells and the underlying topology of the cardiac tissue. We use these models to study the transition from paroxysmal to persistent atrial fibrillation, the mechanisms through which the gap-junction enhancer drug Rotigaptide terminates cardiac fibrillation and how focal and circuital drivers of fibrillation may co-exist as projections of transmural electrical activities. Financial markets are hubs in which heterogeneous participants, such as humans and algorithms, adopt different strategic behaviors to exchange financial assets. In recent decades the widespread adoption of algorithmic trading, the electronification of financial transactions, the increased competition among trading venues and the use of sophisticated financial instruments drove the transformation of financial markets into a global and interconnected complex system. In this thesis we introduce agent-based and state-space models to describe specific microstructural dynamics in the stock and foreign exchange markets. We use these models to replicate the emergence of cross-currency correlations from the interactions between heterogeneous participants in the currency market and to disentangle the relationships between price fluctuations, market liquidity and demand/supply imbalances in the stock market.Open Acces