This paper presents our effort of using model-driven engineering to establish a safety-assured implementation of Patient-Controlled Analgesic (PCA) infusion pump software based on the generic PCA reference model provided by the U.S. Food and Drug Administration (FDA). The reference model was first translated into a network of timed automata using the UPPAAL tool. Its safety properties were then assured according to the set of generic safety requirements also provided by the FDA. Once the safety of the reference model was established, we applied the TIMES tool to automatically generate platform-independent code as its preliminary implementation. The code was then equipped with auxiliary facilities to interface with pump hardware and deployed onto a real PCA pump. Experiments show that the code worked correctly and effectively with the real pump. To assure that the code does not introduce any violation of the safety requirements, we also developed a testbed to check the consistency between the reference model and the code through conformance testing. Challenges encountered and lessons learned during our work are also discussed in this paper. ABSTRACTThis paper presents our effort of using model-driven engineering to establish a safety-assured implementation of Patient-Controlled Analgesic (PCA) infusion pump software based on the generic PCA reference model provided by the U.S. Food and Drug Administration (FDA). The reference model was first translated into a network of timed automata using the UPPAAL tool. Its safety properties were then assured according to the set of generic safety requirements also provided by the FDA. Once the safety of the reference model was established, we applied the TIMES tool to automatically generate platform-independent code as its preliminary implementation. The code was then equipped with auxiliary facilities to interface with pump hardware and deployed onto a real PCA pump. Experiments show that the code worked correctly and effectively with the real pump. To assure that the code does not introduce any violation of the safety requirements, we also developed a testbed to check the consistency between the reference model and the code through conformance testing. Challenges encountered and lessons learned during our work are also discussed in this paper.

Medical devices historically have been monolithic units -developed, validated, and approved by regulatory authorities as stand-alone entities. Modern medical devices increasingly incorporate connectivity mechanisms that offer the potential to stream device data into electronic health records, integrate information from multiple devices into single customizable displays, and coordinate the actions of groups of cooperating devices to realize "closed loop" scenarios and automate clinical workflows.In this paper, we describe a publish-subscribe architecture for medical device integration based on the Java Messaging Service. We overview of a model-based development environment that we have built for rapidly programming device coordination scenarios. We assess the extent to which this framework is capable of supporting and complementing the Integrated Clinical Environment that has been proposed by the Medical Device Plug and Play Interoperability Project The implementation of this framework is free available and open source. One of the primary goals of the framework is to provide researchers in acadaemia, industry, and government with an open test bed for exploring development, quality assurance, and regulatory issues related to medical device coordination.

As software becomes ever more ubiquitous and complex in medical devices, it becomes increasingly important to assure that it performs safely and effectively. The critical nature of medical devices necessitates that the software used therein be reliable and free of errors. It becomes imperative, therefore, to have a conformance review process in place to ascertain the correctness of the software and to ensure that it meets all requirements and standards.Formal methods have long been suggested as a means to design and develop medical device software. However, most manufacturers shy from using these techniques, citing them as too complex and time consuming. As a result, (potentially life-threatening) errors are often not discovered until a device is already on the market.In this paper we present a safety model based approach to software conformance checking. Safety models enable the application of formal methods to software conformance checking, and provide a framework for rigorous testing. To illustrate the approach, we develop the safety model for a Generic Infusion Pump (GIP), and explain how it can be used to aid software conformance checking in a regulatory environment. Comments Postprint version. Presented at AbstractAs software becomes ever more ubiquitous and complex in medical devices, it becomes increasingly important to assure that it performs safely and effectively. The critical nature of medical devices necessitates that the software used therein be reliable and free of errors. It becomes imperative, therefore, to have a conformance review process in place to ascertain the correctness of the software and to ensure that it meets all requirements and standards.Formal methods have long been suggested as a means to design and develop medical device software. However, most manufacturers shy from using these techniques, citing them as too complex and time consuming. As a result, (potentially life-threatening) errors are often not discovered until a device is already on the market.In this paper we present a reference model based approach to software conformance checking. Reference models enable the application of formal methods to software conformance checking, and provide a framework for rigorous testing. To illustrate the approach, we develop the reference model for a Generic Patient Controlled Analgesic Infusion Pump, and explain how it can be used to aid software conformance checking in a regulatory environment.

Background: The adverse event report of medical devices is one of the post-market surveillance tools for regulators to monitor device performance, detect potential device-related safety issues, and contribute to benefit-risk assessments of these products. Along with the development of the related technologies and market, the amount of adverse events keeps increasing, which results in the need for efficient tools that help to analyze the adverse events monitoring data and to identify the risk signals. Objective: To establish a hazard classification framework of the medical devices, and to apply it over practical adverse event data regarding infusion pumps. Subsequently, to analyze the risks of infusion pumps, and to provide reference for the risk management of this type of device. Methods: The authors defines a general hierarchical classification of medical device hazards. This classification is combined with the Trace Intersecting Theory to form a human-machine-environment interaction model. Such model is applied to the dataset of 2001 ～ 2017 class Ⅰ infusion pump recalls extracted from FDA website. This dataset does not include the cases caused by illegal factors, in order to reflect the risk signals of this type of device. Results: The proposed model is leveraged in the hazard analysis over 70 cases of class I infusion pump recalls by FDA. According to the analytical results, the "infusion pump dose not infuse accurate dosage (over or under delivery of fluid)" is identified to be an important source of product technical risk. The Energy hazard is the major hazard form for infusion pumps. The product component failure is the main direct cause for the studied cases.