Formal Approaches to Safe Software Development for Medical Devices

Size: px

Start display at page:

Download "Formal Approaches to Safe Software Development for Medical Devices"

Russell Mills
8 years ago
Views:

1 Formal Approaches to Safe Software Development for Medical Devices by Alena Simalatsar RiSD, EPFL In collabora9on with: Nicolas Widmer, Thierry Buclin, CHUV Romain Bornet, Yann Thoma, HEIG- VD Dechao Sun, Wenqi You, Giovanni De Micheli, EPFL

2 Better safe than sorry The problem in medical errors is not bad people in health care it is that good people are working in bad systems that need to be made safer [1] The gap between medical and engineering domains [1] To Err Is Human: Building a Safer Health System (2000), Linda T. Kohn, Janet M. Corrigan, and Molla S. Donaldson 2

3 Better safe than sorry The problem in medical errors is not bad people in health care it is that good people are working in bad systems that need to be made safer [1] The gap between medical and engineering domains [1] To Err Is Human: Building a Safer Health System (2000), Linda T. Kohn, Janet M. Corrigan, and Molla S. Donaldson 3

4 On the one hand Nowadays, there exist a large set of electronic medical devices to support medical doctors in the process of pabents: Monitoring Controlling Treatment These devices are controlled by software: 1) drivers 2) decision- support Software developers have no medical knowledge: Assume the requirements Produce open interface devices that need to be further used and programmed By medical doctors with now engineering background 4

5 On the other hand When treating patients practitioners are following Medical Guidelines A Medical Guideline (GL) is a document used to guiding decisions and criteria regarding diagnosis, management and treatment in specific areas of healthcare However, GLs are often: Non formally represented (text form and likely tables), therefore Suffer from such structural problems as: incompleteness, inconsistency, ambiguity and redundancy Which: Source of errors when applying them Make automatisation of the GLs hard Formalize Compose Verify 5

6 From GLs to Executable Code!!"#$%&'( )*$#"'$+",($+( -"./(&+#( =258&'$D&/$2+(( =258&'( >"45","+/&/$2+(!"#$%&'(")*&+,' 3-?( -#".*#/0*+,' 36!A(( B-BC(9-B( ( ( =258&'(!2#"'$+E(&+#(A"5$:$%&/$2+(F$/<(-?-( Give GiveDose "#$$%#! "#&$'! Location1 t1<p1, t2<p2, t3<p3 "($$%(! "(&$'! 67+/<",$,( Calculate CalculateDose 1"%$,$2+3,*4425/(67,/"8( 25(92#"(:25(&+( ;80"##"#( 67,/"8(( ")$$%)! Location_4 Terminate 6

7 Agenda Exis%ng formalisms ImaBnib GL modelling Response to the treatment definibon Protocol formal analysis Conclusion: drug delivery reminder 7

8 Medical Records Formal Modeling Common practice Arden (1989) Asbru (1998) EON (1996) GLARE (1997) GLIF (1998) GUIDE (1998) Prestige (1996) PRODIGY (1996) PROforma ( ) SAGE (2002) Stepper ( ) translation Formal Verification SPIN (Promela); SMV symbolic model checker; Some are discontinued - No support for verification - Trace back the counterexamples is hard - Notion of time only in flow-chart order - 8

9 Timed Automata (TA) 9

10 Timed Automata extended with Tasks (TAT) Task queue: CalculateDose GiveDose CalculateDose GiveDose Terminate 10

11 Agenda ExisBng formalisms Ima%nib GL modelling Response to the treatment definibon Protocol formal analysis Conclusion: drug delivery reminder 11

12 Imatinib GL modeling 12

13 Agenda ExisBng formalisms ImaBnib case study modelling Response to the treatment defini%on Protocol formal analysis Conclusion: drug delivery reminder 13

14 NI and DA, and by a difference in the expected side effects, which may be important depending on patient clinical conditions and on co-morbidities. In case of suboptimal response to IM, there are at Table 4 Response definition Definition of the response to treatment with IM, early chronic phase, frontline. The response is assessed based the time, the grade and the loss of hematologic, cytogenetic and molecular responses, and on the detection of BCR-ABL KD mutations. The detection of other clonal chromosome abnormalities is a marker of failure if they occur in Ph+ cells, and is a factor of warning when they occur in Ph- cells. Warnings Failure Suboptimal response Optimal response / / / BASELINE - High risk a - CCA/Ph + b 3 months / - Non CHR - No CgR (Ph+ > 95%) - At least minor CgR (Ph+ 65%) 6 months / - No CgR (Ph+ > 95%) - Less than PCgR (Ph+ > 35%) - At least PCgR (Ph+ 35%) 12 months - Less than MMolR b - Less than PCgR - PCgR (Ph+ 1 35%) - CCgR (Ph+ > 35%) 18 months / - Less than CCgR - Less than MMolR c - MMolR c Any Time, - Rise in transcript levels - Loss of CHR - Loss of MMolR c - Stable or improving during treatment M. -Baccarani CCA/Ph- d et al. / Best Practice -& Loss Research of CCgR Clinical Haematology - Mutations 22 (2009) f MMolR c Mutations e Table 1 - CCA/Ph + b Definition a High risk of haematologic, according Sokal cytogenetic [47] orand Hasford molecular [48] response. b Clonal chromosome abnormalities in Ph+ cells. Complete c Hematologic Response (CHR) - WBC< /L, no immature granulocytes, BCR-ABL: ABL 0.1% on the International Scale. less than 5% basophils, platelets< 450x10 9 /L, Clonal chromosome abnormalities in Ph- cells. spleen non palpable BCR-ABL KD mutations poorly sensitive to IM (see Table 2). Complete f Cytogenetic Response (CCgR) - No Phþ metaphases BCR-ABL KD mutations still sensitive to IM (see Table 2). Partial Cytogenetic Response (PCgR) % Phþ metaphases Minor Cytogenetic Response (mcgr) % Phþ metaphases Minimal Cytogenetic Response (mincgr) % Phþ metaphases No Cytogenetic Response (NoCgR) - 95% Phþ metaphases Major Molecular Response (MMolR) Complete Molecular Response (CMolR) - BCR-ABL: ABL 0.1% on the International Scale - BCR-ABL transcript undetectable by RT-Q-PCR M. Baccarani, F. CastagneA, G. GuglioCa, F. Palandri, and S. Soverini. Response defini%ons and european leukemia management recommenda%ons. Best Pract Res Clin Haematol, 22(3):331 41, The value of other clonal chromosome abnormalities in Phþ cells (CCA/Phþ) is a factor of warning if 14

15 Response definition - graph 15

16 Response definition - optimal response 16

17 Response definition - loss of response 17

18 Response definition - lack of response 18

19 Response observer Observer TAT: TAT insures that the progressive pabent reacbon to the treatment will always remain at least above the failure level, at the level of subopbmal response and higher. 19

20 Agenda ExisBng formalisms ImaBnib case study modelling Response to the treatment definibon Protocol formal analysis Conclusion: drug delivery reminder 20

21 Imatinib GL extended 21

22 Imatinib GL extended 22

23 Imatinib GL extended chronic_p - - > E <> (lack_loss_resp_ch) 23

24 Imatinib GL extended 24

25 Agenda ExisBng formalisms ImaBnib case study modelling Response to the treatment definibon Protocol formal analysis Conclusion: drug delivery reminder 25

26 Conclusion: drug delivery reminder code genera9on The Icycom plaporm by CSEM SA, Switzerland 26

27 Conclusion TAT is suitable for action and definition based GLs modelling; Structural problems of GLs can be fixed; The verification of life-cycle properties requires a patient or a model: Pharmacokinetic (PK) - pharmacodynamic (PD) modeling Formally models of GLs must be complemented with other functionality; TAT is compositional and synthesisable. 27

Response Definition, Evaluation and Monitoring. Michele Baccarani

Response Definition, Evaluation and Monitoring Michele Baccarani European LeukemiaNet EVOLVING CONCEPTS IN THE MANAGEMENT OF CHRONIC MYELOID LEUKEMIA VENICE 8 9 MAY 2006 Response definition, evaluation