Modeling and Verification of a Dual Chamber Implantable Pacemaker

Jiang, Zhihao; Pajić, Miroslav; Moarref, Salar; Alur, Rajeev; Mangharam, Rahul

doi:10.1007/978-3-642-28756-5_14

Cited by 112 publications

(97 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, we first describe the set of timing requirements used to extract the test vectors, followed by the simulation results. In [17] we presented the UPPAAL model verification of these properties.…”

Section: B Pacemaker Stateflow Designmentioning

confidence: 99%

From Verification to Implementation: A Model Translation Tool and a Pacemaker Case Study

Pajić

Jiang

Lee

et al. 2012

2012 IEEE 18th Real Time and Embedded Technology and Applications Symposium

Self Cite

View full text Add to dashboard Cite

Model-Driven Design (MDD) of cyber-physical systems advocates for design procedures that start with formal modeling of the real-time system, followed by the model's verification at an early stage. The verified model must then be translated to a more detailed model for simulation-based testing and finally translated into executable code in a physical implementation. As later stages build on the same core model, it is essential that models used earlier in the pipeline are valid approximations of the more detailed models developed downstream. The focus of this effort is on the design and development of a model translation tool, UPP2SF, and how it integrates system modeling, verification, model-based WCET analysis, simulation, code generation and testing into an MDD based framework. UPP2SF facilitates automatic conversion of verified timed automata-based models (in UPPAAL) to models that may be simulated and tested (in Simulink/Stateflow). We describe the design rules to ensure the conversion is correct, efficient and applicable to a large class of models. We show how the tool enables MDD of an implantable cardiac pacemaker. We demonstrate that UPP2SF preserves behaviors of the pacemaker model from UPPAAL to Stateflow. The resultant Stateflow chart is automatically converted into C and tested on a hardware platform for a set of requirements. Abstract-Model-Driven Design (MDD) of cyber-physical systems advocates for design procedures that start with formal modeling of the real-time system, followed by the model's verification at an early stage. The verified model must then be translated to a more detailed model for simulation-based testing and finally translated into executable code in a physical implementation. As later stages build on the same core model, it is essential that models used earlier in the pipeline are valid approximations of the more detailed models developed downstream. The focus of this effort is on the design and development of a model translation tool, UPP2SF, and how it integrates system modeling, verification, model-based WCET analysis, simulation, code generation and testing into an MDDbased framework. UPP2SF facilitates automatic conversion of verified timed automata-based models (in UPPAAL) to models that may be simulated and tested (in Simulink/Stateflow). We describe the design rules to ensure the conversion is correct, efficient and applicable to a large class of models. We show how the tool enables MDD of an implantable cardiac pacemaker. We demonstrate that UPP2SF preserves behaviors of the pacemaker model from UPPAAL to Stateflow. The resultant Stateflow chart is automatically converted into C and tested on a hardware platform for a set of requirements.

show abstract

Section: B Pacemaker Stateflow Designmentioning

confidence: 99%

From Verification to Implementation: A Model Translation Tool and a Pacemaker Case Study

Pajić

Jiang

Lee

et al. 2012

2012 IEEE 18th Real Time and Embedded Technology and Applications Symposium

Self Cite

View full text Add to dashboard Cite

show abstract

“…Recently, Jiang et al [8] developed a model-based framework for automatically verifying cardiac pacemakers in the This work is partially supported by the ERC Advanced Grant VERI-WARE and the Institute for the Future of Computing at the Oxford Martin School.…”

Section: Introductionmentioning

confidence: 99%

“…Working from descriptions by Boston Scientific, a leading manufacturer, [8] develop a detailed model of a basic dual chamber pacemaker as a network of timed automata ( [2], TAs). They also provide a model of the heart behaviour as a TA, and perform verification of the composition in UPPAAL [10].…”

Section: Introductionmentioning

confidence: 99%

“…They also provide a model of the heart behaviour as a TA, and perform verification of the composition in UPPAAL [10]. While the pacemaker model of [8] is rather extensive, their (random) heart model is arguably too simplistic, since it generates signals non-deterministically within a real-time interval. As a consequence, the model admits unrealistic and extremely irregular heart behaviours, which would hinder the verification of certain correctness properties.…”

Section: Introductionmentioning

confidence: 99%

“…As a consequence, the model admits unrealistic and extremely irregular heart behaviours, which would hinder the verification of certain correctness properties. Indeed, it is explicitly mentioned in [8] that a more physiologically-relevant heart model is needed for more complex properties.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Quantitative Verification of Implantable Cardiac Pacemakers

Chen

Diciolla

Kwiatkowska

et al. 2012

2012 IEEE 33rd Real-Time Systems Symposium

View full text Add to dashboard Cite

Abstract-Implantable medical devices, such as cardiac pacemakers, must be designed and programmed to the highest levels of safety and reliability. Recently, errors in embedded software have led to a substantial increase in safety alerts, costly device recalls or even patient death. To address such issues, we propose a model-based framework for quantitative, automated verification of pacemaker software. We adapt the electrocardiogram model of Clifford et al, which generates realistic normal and abnormal heart beat behaviours, with probabilistic transitions between them, to produce a timed sequence of action potential signals that serve as pacemaker input. Working with the timed automata model of the pacemaker by Jiang et al, we develop a methodology for deriving the composition of the heart and the pacemaker, based on discretisation. The main correctness properties we consider include checking that the pacemaker corrects Bradycardia (slow heart beat) and does not induce Tachycardia (fast heart beat), for a range of realistic heart behaviours. We also analyse undersensing, through considering noise on sensor readings, and energy usage. We implement the framework using the probabilistic model checker PRISM and MATLAB and demonstrate encouraging experimental results. Our approach can be adapted to individual patients and is applicable to other pacemaker models.

show abstract