Quantitative verification of implantable cardiac pacemakers over hybrid heart models

Abstract

We develop a model-based framework which supports approximate quantitative verification of implantable cardiac pacemaker models over hybrid heart models. The framework is based on hybrid input-output automata and can be instantiated with user-specified pacemaker and heart models. For the specifications, we identify two property patterns which are tailored to the verification of pacemakers: "can the pacemaker maintain a normal heart behaviour?" and "what is the energy level of the battery after t time units?". We implement the framework in Simulink based on the discrete-time simulation semantics and endow it with a range of basic and advanced quantitative property checks. The advanced property checks include the correction of pacemaker mediated Tachycardia and how the noise on sensor leads influences the pacing level. We demonstrate the usefulness of the framework for safety assurance of pacemaker software by instantiating it with two hybrid heart models and verifying a number of correctness properties with encouraging experimental results.

Real-Time Decision Policies With Predictable Performance

“…Works in quantitative verification, such as [44] and [45], model the heart and pacemaker to verify statistically or through simulations whether some quantitative properties are satisfied. This contrasts with our approach which is model-free, and provides cost upper bounds based on the QRE code itself, not a model of it.…”

“…Recently, the implantable pacemaker has been used to illustrate the benefits of model-based design [11], [12], [13]. This involves specifying the algorithms for detecting slower-than-normal rhythms used by pacemakers using formal modeling languages, such as timed automata [14] and hybrid automata [15], and verifying correctness requirements using a model checker such as UPPAAL [16].…”

Hybrid Automata Model of the Heart for Formal Verification of Pacemakers

“…As the complexity of the pacemakers increase, there is a need for the development of better processes for validation of such medical devices. R heart model reported in [3], which was foundational in developing the benchmark 2 Indicate as appropriate: category (academic, industrial), difficulty (low, medium, high, challenge)…”

“…For analytical purposes, an abstract model based on Timed Automata (TA) consisting of a network of 33 nodes (or cells) has used for testing off-the-shelf pacemakers [6]. A more refined approach that models the continuous voltage using Hybrid Input Output Automata (HIOA) is presented in [3]. In both cases, the abstraction from two trillion cell to 33 nodes is not discussed in the literature.…”

“…The abstracted model consisting of nodes and paths is presented in Figure 2(b). In the next section, using Hybrid Input Output Automata (HIOA) [3], we describe the cell's electrical behaviour.…”