Dr. Zhihao Jiang Real-Time & Embedded Systems Lab Dept. - - PowerPoint PPT Presentation

• Dr. Zhihao Jiang

Real-Time & Embedded Systems Lab

• Dept. Electrical & Systems Engineering

University of Pennsylvania

zhihaoj@seas.upenn.edu

1

2

Implantable Pacemaker

1990-2000: 600,000 implantable pacemakers were recalled 200,000 of these recalls were due to software issue 2008-12: 15% of all the medical device recalls (Class I, II & III) due to software

3

• Messy Plant:

– Partially understood physiology

• Large Variability:

– Every patient is different

• Limited Observability:

– Losing physiological context

4

Formal Methods Model-based Design Physiological Modeling

High-confidence Software Development for Life-critical Cyber-Physical Systems

5

“Let our heart models catch bugs before your heart does.”

6

7

• Periodically generates electrical impulses to

initialize heart beats

SA node

• An impulse first triggers muscle contractions

in the atria, pushing blood into the ventricles

Atria

• Delay at AV node which allows the ventricles

to fill fully

AV node

• Strong muscle contractions pump blood out of

the heart

Ventricles

• Delay in generation and/or conduction of the

electrical impulses results in low heart rate

Generation Conduction

• Local electrical activations

A V

Pacemaker

• Generate sensed event when signal above

threshold

A V

AS Pacemaker

Pace Threshold

• Same for ventricular channel

A V

AS VS Pacemaker

Pace

• Pace atrium when no AS within deadline

A V

V-A

AP AS VS Pacemaker

Pace

• Pace ventricle if no VS happen within deadline

A V

V-A

AP

A-V

VP AS VS Pacemaker

Pace

• Maximum interval between two ventricular

events (max(V-A)+max(A-V))

A V

V-A

AP

A-V

VP AS VS Pacemaker

Pace

V-V

• Unnecessary details
• Infeasible model identification

19

Cellular Electrophysiology Tong et. al 2014 Deng et. al 2016 Whole heart Electrophysiology

Refractory Time

Vout

Rest ERP RRP Rest Refractory Time

Vout

Rest ERP RRP Rest

Electrical Conduction System

20

Node Automata Path Automata

21

Represent variety of heart conditions using different topologies and timing parameters

22

Normal Sinus Rhythm Atrial Flutter Ventricle Tachycardia AV Nodal Reentry

23

• Condition-specific heart models

24

Expected Response Simulator Stimuli Model of Atrial Flutter

26

Heart On a Chip Analog Interface Commercial Pacemaker

28

• Explore the whole reachable state space of a

model for property violations

• Widely used in semi-conductor industries for

verifying chip design

M

𝜒

D

29

Counter-example

30

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

Heart Conditions

Observable Behavior Space

• Properties satisfied by M are also satisfied by P1, P2
• Behaviors not exist in P1, P2 may also be physiologically-valid
• Is this a valid counter-example?
• Need a framework to provide context for counter-examples

31

𝜒

D

M

𝜒′

Counter-example

• Multiple transitions are enabled
• Relax guard conditions

32

t==1 if 𝑢 ∈ [1,5] s=1 t==1

• Simplify the model to increase non-

determinism for more behavior coverage

33

REST IDLE REST REST RETRO ERP ERP ANTE REST ERP IDLE ERP ERP IDLE REST REST IDLE ERP REST RETRO REST REST IDLE REST REST ANTE REST

Additional Behavior

• Combine models of different heart conditions

for more behavior coverage

Trest in [a1, b1] Trest in [a2, b2] Trest in [a3, b3] Trest in [min ai, max bi]

Trest

34

35

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

Heart Conditions

Observable Behavior Space

36

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

R2 R2 R2 R2 R1 R1 R1 R1 R1 R2 R2 R2 R2 R2 R2 R2

Heart Conditions

Observable Behavior Space

37

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

R4 R3 R2 R2 R4 R2 R2 R1 R1 R1 R1 R1 R5 R5 R3 R3 R6 R6 R6 R2 R2 R2 R4 R4 R4 R2 R2 R4 R4 R4 R2 R4 R2 R4 R4 R4

Heart Conditions

Observable Behavior Space

38

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

R4 R3 R2 R2 R4 R2 R2 R1 R1 R1 R1 R1 R5 R5 R3 R3 R6 R6 R6 R7 R7 R7 R2 R2 R2 R4 R4 R4

𝐼𝑏𝑚𝑚

R2 R2 R4 R4 R4 R2 R4 R2 R4 R4 R4

Heart Conditions

Observable Behavior Space

39

Normal Sinus Rhythm Bradycardia AV Block Bundle Branch Block Sinus Tachycardia Atrial Flutter AVNRT Atrial Fibrillation Premature Ventricle Contraction Ventricle Tachycardia Ventricle Fibrillation

R4 R3 R2 R2 R4 R2 R2 R1 R1 R1 R1 R1 R5 R5 R3 R3 R6 R6 R6 R7 R7 R7 R2 R2 R2 R4 R4 R4

𝐼𝑏𝑚𝑚

R2 R2 R4 R4 R4 R2 R4 R2 R4 R4 R4

Heart Conditions

Variability Physiological Context

⌐𝜒

Observable Behavior Space

• Basic Safety Properties

– Heart rate never go too slow – Pacemaker never increase the heart rate too high

• Pacemaker Mediated Tachycardia

– Can pacemaker increase heart rate inappropriately? – Are there multiple cases of them? – Can the algorithm terminate the behavior in time?

40

41

Model Checking Simulation Platform Testing

UPPAAL Model Stateflow Chart C Code implementation

UPP2SF Model Translation Simulink Coder

Pacemaker Heart

Non- deterministic Deterministic VHM Heart-on-Chip

Refinement HDL Coder

42

Research Impact

43

Cyber-Physical Systems

ICCPS’11 ECRTS’11 IEEE Proceedings’12

Model-based Design

RTAS’12 (Best Paper Award) TECS’14 FnEDA’16 IEEE Computer’16

Formal Methods

TACAS’12 (Best Paper Nominee) STTT’14 MedCPS’16 HSCC’16

Biomedical Engineering

EMBC’10 EMBC’11 EMBC’16

Development Clinical Market Heart Modeling Closed-loop Model Checking

Research Summary & Plan

Model Translation Quantitative Validation in-silico Pre-clinical Trials Security Verification Data-driven Modeling

Providing Regulatory-grade Safety Evidence With Computer Models

Safety Evidence for Medical Devices

Computer Human Animal Bench

Today

Computer Human Animal Bench

Future

45

Development Clinical Market Heart Modeling Closed-loop Model Checking

Research Summary & Plan

Model Translation Quantitative Validation in-silico Pre-clinical Trials Security Verification Data-driven Modeling

Providing Regulatory-grade Safety Evidence With Computer Models

The clinical trial

The ultimate closed-loop validation

Animal testing

47

Shock Coils Right Ventricular Lead Tip & Ring Left Atrium Left Ventricle Right Atrium Right Ventricle

ICD

Can (Shock) Electrode

Atrial Signal Ventricular Signal Shock Signal

AS VS AS AS VS VS Right Atrium Lead Tip & Ring Sense Therapy

Implantable Cardiac Defibrillator

48

RIGHT

The Rhythm ID Going Head to Head Trial*

49

Primary endpoint: occurrence of inappropriate therapy

*Berger et al., “The Rhythm ID Going Head to Head Trial”, Journal of Cardiovascular EP, Vol. 17, No. 7, July 2006 Select Medtronic ICDs (the control arm) Vitality II ICD (Boston Sci.) (the treatment arm)

Inappropriate Therapy ~2,000 patients, 5 years

Assumed 25% less risk of inappropriate therapy with Vitality II relative to Medtronic ICDs

RIGHT Trial Results – Inappropriate Therapy

Inappropriate Therapy VITALITY 2: 62.2% Medtronic: 45.9% Majority of the therapy episodes were inappropriate

*Michael R. Gold, Primary results of the Rhythm ID Going Head to Head Trial, Heart Rhythm, Vol 9, No 3, March 2012

50

Real Patient Data for Adjudication & Extraction Cohort Generation Synthetic Heart Model Generation

Real Patient Data & Heart Models Synthetic Heart Model Generation Complete Generated Population

Adjudicated EGM Database … … Patient A Patient C Patient B

N Patient Records M Episodes

1 2 3

…

Model A1

Model AN Boston Scientific ICD Medtronic ICD

…

Model JN

Atrial Channel Ventricular Channel Shock Channel

Generated Electrogram Waveforms

Diagnosis Sensitivity and Specificity

ICD Device Model

Synthetic Heart Model

PAC AF VT PVC RVA AV SA VF RBB LVA SVT

Device Testing & Evaluation

4 Learn Parameter distribution Sampling parameters from distribution 10,000’s Condition- specific Model Generation 10,000’s Condition- specific electrograms Closed-loop evaluation

in-silico Pre-Clinical Trials

NSF Frontiers CyberCardia $4.2M. Started May 2015 to May 2020.

51

Result 1: Specificity across populations

52

Atrial fibrillation Atrial flutter PVC Non-sustained VT Other SVT Double Tachycardia Ventricular Fibrillation Ventricular Tachycardia

Result 1: Specificity across populations

53

Result 2: Patient Condition-level Analysis

54

55

In-Silico Pre-Clinical Trials Toolchain

Patient Data Management Virtual Cohort Generation Simulated Trial Device in the Loop Trial Results

Unlabeled patient data is annotated Timing and morphology information is extracted Virtual cohort is generated from extracted information Software simulation using virtual cohort Hardware validation with actual physical device Analysis of results

56

Device-in-the-loop Testing

Device Input … … Device Response

Understanding the Application Domain

57

Medical Collaborators

4/12/2017 58

Heart model development and validation, Device algorithm, De-identified Patient data

Director, Electrophysiology Laboratories, Penn Cardiology, Penn Presbyterian Medical Center Electrophysiology Fellow, Hospital of the University of Pennsylvania Director, Cardiac Electrophysiology, Philadelphia VA Medical Center

Developing clinical assist system for atrial fibrillation Heart Model development and validation, ICD discrimination algorithm development, in silico Pre- clinical trials

Industrial Collaborations

59

Provided algorithm descriptions, sample devices, programmers, testing platform Provided algorithm descriptions, sample devices, programmers, test cases Provided model-based design toolbox Provided software and hardware

Ed Clarke CMU James Glimm Stony Brook Radu Grosu Stony Brook / Vienna Elizabeth Cherry RIT Sean Gao MIT Sanjay Dixit Director of Cardiac Electrophysiology Philadelphia VA Hospital Arnab Ray Fraunhofer Rick Gray FDA Rahul Mangharam Penn Flavio Fenton Gatech Scott Smolka Stony Brook Rance Cleaveland UMD / Fraunhofer

5 Computer Scientists, 2 Cardiologist,s 1 Physicist, 1 BioMed Engineer, 2 Mathematicians, 1 Electrical Engineer

NSF CPS Frontier

Thanks!

Questions?

61