Safety Analysis of Software Components of a Dialysis Machine Using Model Checking
The paper describes the practical use of a model checking technique to contribute to the risk analysis of a new paediatric dialysis machine. The formal analysis focuses on one component of the system, namely the table-driven software controller which drives the dialysis cycle and deals with error management. The analysis provided evidence of the verification of risk control measures relating to the software component. The paper describes the productive dialogue between the developers of the device, who had no experience or knowledge of formal methods, and an analyst who had experience of using the formal analysis tools. There were two aspects to this dialogue. The first concerned the translation of safety requirements so that they preserved the meaning of the requirement. The second involved understanding the relationship between the software component under analysis and the broader concern of the system as a whole. The paper focuses on the process, highlighting how the team recognised the advantages over a more traditional testing approach.
KeywordsRisk analysis Formal methods Model checking Medical devices Haemodialysis
This work has been funded by: EPSRC research grant EP/G059063/1: CHI+MED (Computer–Human Interaction for Medical Devices). It has also been financed by the ERDF – European Regional Development Fund through the Operational Programme for Competitiveness and Internationalisation - COMPETE 2020 Programme, and by National Funds through the FCT – Fundação para a Ciência e a Tecnologia (Portuguese Foundation for Science and Technology) within project POCI-01-0145-FEDER-006961.
- 3.Barnes, J., Chapman, R., Johnson, R., Everett, B., Cooper, D.: Engineering the tokeneer enclave protection software. In: IEEE International Symposium on Secure Software Engineering. IEEE (2006)Google Scholar
- 4.BSI: Medical device software - software life cycle processes. Technical report BS EN 62304:2006, British Standards Institution, CENELEC, Avenue Marnix 17, B-1000 Brussels (2008)Google Scholar
- 6.Cimatti, A., Clarke, E., Giunchiglia, E., Giunchiglia, F., Pistore, M., Roveri, M., Sebastiani, R., Tacchella, A.: NuSMV 2: an opensource tool for symbolic model checking. In: Brinksma, E., Larsen, K.G. (eds.) CAV 2002. LNCS, vol. 2404, pp. 359–364. Springer, Heidelberg (2002). doi: 10.1007/3-540-45657-0_29 CrossRefGoogle Scholar
- 7.Clarke, E.M., Grumberg, O., Peled, D.A.: Model Checking. MIT Press, Cambridge (1999)Google Scholar
- 8.Freitas, L., Stabler, A.: Translation strategies for medical device control software. Technical report, Newcastle University, August 2015Google Scholar
- 12.Kim, B., Ayoub, A., Sokolsky, O., Lee, I., Jones, P., Zhang, Y., Jetley, R.: Safety-assured development of the GPCA infusion pump software. In: Proceedings of the Ninth ACM International Conference on Embedded software, EMSOFT 2011, pp. 155–164. ACM, New York (2011)Google Scholar
- 14.Masci, P., Ayoub, A., Curzon, P., Harrison, M.D., Lee, I., Sokolsky, O., Thimbleby, H.: Verification of interactive software for medical devices: PCA infusion pumps and FDA regulation as an example. In: Proceedings ACM Symposium Engineering Interactive Systems (EICS 2013), pp. 81–90. ACM Press (2013)Google Scholar
- 15.Monk, A.F., Curry, M., Wright, P.C.: Why industry doesn’t use the wonderful notations we researchers have given them to reason about their designs. In: Gilmore, D.J., Winder, R.L., Detienne, F. (eds.) User-Centred Requirements For Software Engineering, pp. 185–189. Springer, Berlin, Heidelberg (1991)Google Scholar
- 16.US Food and Drug Administration: General principles of software validation: final guidance for industry and FDA staff. Technical report, Center for Devices and Radiological Health, January 2002. http://www.fda.gov/medicaldevices/deviceregulationandguidance
- 17.Yeganefard, S., Butler, M.: Structuring functional requirements of control systems to facilitate refinement-based formalisation. In: Proceedings of the 11th International Workshop on Automated Verification of Critical Systems (AVoCS 2011), vol. 46. Electronic Communications of the EASST (2011)Google Scholar