Model-Based Dependability Analysis of Programmable Drug Infusion Pumps

  • Sriram Sankaranarayanan
  • Hadjar Homaei
  • Clayton Lewis
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6919)


Infusion pumps are commonly used in home/hospital care to inject drugs into a patient at programmable rates over time. However, in practice, a combination of faults including software errors, mechanical failures and human error can lead to catastrophic situations, causing death or serious harm to the patient. Dependability analysis techniques such as failure mode effect analysis (FMEA) can be used to predict the worst case outcomes of such faults and facilitate the development of remedies against them.

In this paper, we present the use of model-checking to automate the dependability analysis of programmable, real-time medical devices. Our approach uses timed and hybrid automata to model the real-time operation of the medical device and its interactions with the care giver and the patient. Common failure modes arising from device failures and human error are modeled in our framework. Specifically, we use “mistake models” derived from human factor studies to model the effects of mistakes committed by the operator. We present a case-study involving an infusion pump used to manage pain through the infusion of analgesic drugs. The dynamics of analgesic drugs are modeled by empirically validated pharmacokinetic models. Using model checking, our technique can systematically explore numerous combinations of failures and characterize the worse case effects of these failures.


Model Check Pharmacokinetic Model Patient Control Analgesic Hybrid Automaton Bound Model Check 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Anonymous (Alberta, R.N.). Lack of standard dosing methods contributes to i.v. infusion errors. Institute for Safe Medication Practices (ISMP) Medication Alert, 64(4) (April 2008)Google Scholar
  2. 2.
    Arney, D., Jetley, R., Jones, P., Lee, I., Sokolsky, O.: Formal methods based development of a PCA infusion pump reference model: Generic infusion pump (GIP) project. In: Proc. High Confidence Medical Devices, Software Systems and Medical Device Plug and Play Interoperability (2007)Google Scholar
  3. 3.
    Arney, D.E., Jetley, R., Jones, P., Lee, I., Ray, A., Sokolsky, O., Zhang, Y.: Generic infusion pump hazard analysis and safety requirements: Version 1.0, CIS Technical Report, University of Pennsylvania. (2009), (accessed May 2011)
  4. 4.
    Bates, D.W., Vandervreen, T., Seger, D., Yamaga, C., Rothschild, J.: Variability in intravenous medical practices: Implications for medication safety. J. Joint Commission on Accredication of Healthcare Organizations 31(4), 203–210 (2005)Google Scholar
  5. 5.
    Biere, A., Cimatti, A., Clarke, E., Zhu, Y.: Symbolic model checking without bDDs. In: Cleaveland, W.R. (ed.) TACAS 1999. LNCS, vol. 1579, pp. 193–207. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  6. 6.
    Bolton, M.L., Bass, E.J.: Formally verifying human-automation interaction as part of a system model: limitations and tradeoffs. Innovations Syst. Softw. Eng. 6, 219–231 (2010)CrossRefGoogle Scholar
  7. 7.
    Bozzano, M., Cimatti, A., Tapparo, F.: Symbolic fault tree analysis for reactive systems. In: Namjoshi, K.S., Yoneda, T., Higashino, T., Okamura, Y. (eds.) ATVA 2007. LNCS, vol. 4762, pp. 162–176. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  8. 8.
    Bozzano, M., Cimatti, A., Katoen, J.-P., Nguyen, V.Y., Noll, T., Roveri, M.: The COMPASS approach: Correctness, modelling and performability of aerospace systems. In: Buth, B., Rabe, G., Seyfarth, T. (eds.) SAFECOMP 2009. LNCS, vol. 5775, pp. 173–186. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  9. 9.
    Brady, J.L.: First, do no harm: Making infusion pumps safer. Biomedical Instrumentation & Technology 44(5), 372–380 (2010)CrossRefGoogle Scholar
  10. 10.
    Brooks, P.A., Memon, A.M.: Automated GUI testing guided by usage profiles. In: Prof. ASE 2007, pp. 333–342. IEEE Press, Los Alamitos (2007)Google Scholar
  11. 11.
    Chinnapongse, V., Lee, I., Sokolsky, O., Wang, S., Jones, P.: Model-based testing of GUI-driven applications. In: Lee, S., Narasimhan, P. (eds.) SEUS 2009. LNCS, vol. 5860, pp. 203–214. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  12. 12.
    Clarke, E.M., Grumberg, O., Peled, D.A.: Model Checking. MIT Press, Cambridge (1999)Google Scholar
  13. 13.
    de Moura, L.M., Bjørner, N.: Z3: An efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  14. 14.
    Degani, A., Heymann, M.: Formal Verification of Human-Automation Interaction. Human Factors 44(1), 28–43 (2002)CrossRefzbMATHGoogle Scholar
  15. 15.
    Dekker, S.: The Field Guide to Understanding Human-Error. Ashgate Publishing (2006)Google Scholar
  16. 16.
    Dutertre, B., de Moura, L.: The YICES SMT solver. Cf., (last viewed January 2009)
  17. 17.
    Ebeling, C.E.: Introduction to Reliability and Maintainability Engineering. Waveland Inc. (2005)Google Scholar
  18. 18.
    Egan, T., Lemmens, H., Fiset, P., Hermann, D., Muir, K., Stanski, D., Shafer, S.: The pharamcokinetics of the new short acting opioid remifentanil (G187084B) in healthy adult male volunteers. Anesthesiology 74, 881–892 (1996)Google Scholar
  19. 19.
    Fields, R.: Analysis of erroneous actions in the design of critical systems. PhD thesis, University of York (January 2001)Google Scholar
  20. 20.
    Grissinger, M.: Misprogram a PCA pump? it’s easy!, July 2004. ISMP Medication Safety Alert. (accessed May 2011)Google Scholar
  21. 21.
    Henzinger, T.A.: The theory of hybrid automata. In: LICS 1996, pp. 278–292. IEEE, Los Alamitos (1996)Google Scholar
  22. 22.
    Hollnagel, E.: Human Reliability Analysis Context and Control. Computer And People Series. Academic Press Inc., San Diego (1993)Google Scholar
  23. 23.
    Hollnagel, E.: Cognitive Reliability and Error Analysis Method. Elsevier, Institutt for Energiteknikk, Halden, Norway (1998)Google Scholar
  24. 24.
    Institute for Safe Medication Practices Canada. Fluorocil incident root-cause analysis (2007),
  25. 25.
    Joshi, A., Miller, S.P., Heimdahl, M.P.: Mode confusion analysis of a flight guidance system using formal methods. In: 22nd IEEE Digital Avionics Systems Conference, DASC 2003 (October 2003)Google Scholar
  26. 26.
    Kallen, A.: Computational Pharmacokinetics. Chapman & Hall, Boca Raton (2007)CrossRefzbMATHGoogle Scholar
  27. 27.
    Kirwan, B.: A Guide to Practical Human Reliability Assessment. Taylor & Francis, Abington (1994)Google Scholar
  28. 28.
    Lesar, T.S.: Errors in the useof medication dosage equations. Archives of Pediatric Adoloscent Medicine 152, 340–344 (1998)Google Scholar
  29. 29.
    Leveson, N.G., Palmer, E.: Designing automation to reduce operator errors. In: IEEE Trans. on Systems, Man, and Cybernetics, p. 7 (October 1997)Google Scholar
  30. 30.
    McClain, D.A., Hug, C.C.: Intravenous fentanyl kinetics. Clinical Pharmacology & Therapeutics 28(1), 106–114 (1980)CrossRefGoogle Scholar
  31. 31.
    Nieuwenhuis, R., Oliveras, A., Tinelli, C.: Solving SAT and SAT modulo theories: From an abstract davis–putnam–logemann–loveland procedure to DPLL(T). J. ACM 53(6), 937–977 (2006)MathSciNetCrossRefzbMATHGoogle Scholar
  32. 32.
    Paiva, A., Faria, J.C.P., Tillmann, N., Vidal, R.F.A.M.: A model-to-implementation mapping tool for automated model-based GUI testing. In: Lau, K.-K., Banach, R. (eds.) ICFEM 2005. LNCS, vol. 3785, pp. 450–464. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  33. 33.
    Palanque, P.: Formal Methods in Human-Computer Interaction. Springer-Verlag New York, Inc, Heidelberg (1997) ISBN 3540761586zbMATHGoogle Scholar
  34. 34.
    Paternó, F., Santoro, C.: Integrating model checking and HCI tools to help designers verify user interface properties. In: Paternó, F. (ed.) DSV-IS 2000. LNCS, vol. 1946, pp. 135–150. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  35. 35.
    Pérez-Castañeda, G., Aubry, J.-F., Brinzei, N.: Stochastic hybrid automata model for dynamic reliability assessment. Journal of Risk and Reliability 225(1), 28–41 (2011)Google Scholar
  36. 36.
    Reason, J.T.: Human Error. Cambridge University Press, Cambridge (1990)CrossRefGoogle Scholar
  37. 37.
    Rothschild, J., Keohane, C., Cook, E., Orav, E., Burdick, E., Thompson, S., Hayes, J., Bates, D.: A controlled trial of smart infusion pumps to improve medication safety in critically ill patients. Critical care medicine 33(3) (2005)Google Scholar
  38. 38.
    Rushby, J.: Using model checking to help discover mode confusions and other automation surprises. In: Proc. HESSD 1999 (June 1999)Google Scholar
  39. 39.
    Sartori, V., Schumacher, P.M., Bouillon, T., Luginbuehl, M., Morari, M.: On-line estimation of propofol pharamacodynamic parameters. In: Proc. Conference on Engineering in Medicine and Biology, pp. 74–77. IEEE Press, Los Alamitos (2005)Google Scholar
  40. 40.
    Schein, J., Hicks, R., Nelson, W., Sikirica, V., Doyle, D.: Errors in the postoperative period: Causes and prevention. Drug Safety 32(7), 549–559 (2009)CrossRefGoogle Scholar
  41. 41.
    Shafer, S.L., Siegel, L.C., Cooke, J.E., Scott, J.C.: Testing computer-controlled infusion pumps by simulation. Anesthesiology 68, 261–266 (1988)CrossRefGoogle Scholar
  42. 42.
    Siu, N.: Risk assessment for dynamic systems: An overview. Reliability Engineering & System Safety 43(1), 43–73 (1994)CrossRefGoogle Scholar
  43. 43.
    Tabuada, P.: Verification and Control of Hybrid Systems: A Symbolic Approach. Springer, Heidelberg (2009)CrossRefzbMATHGoogle Scholar
  44. 44.
    Thimbleby, H.: Ignorance of interaction programming is killing people. ACM Interactions, 52–57 (2008)Google Scholar
  45. 45.
    Thimbleby, H.: Contributing to safety and due diligence in safety-critical interactive systems development. In: ACM SIGCHI, EICS 2009, pp. 221–230 (2009)Google Scholar
  46. 46.
    Thimbleby, H.: Is it a dangerous prescription? BCS Interfaces 84, 5–10 (2010)Google Scholar
  47. 47.
    Trbovich, P.L., Pinkney, S., Cafazzo, J.A., Easty, A.: The impact of traditional and smart pump infusion technology on nurse medication administration performance in a simulated inpatient unit. Qual. Saf. Health Care 19, 430–434 (2010)Google Scholar
  48. 48.
    Vuyk, J., Mertens, M.J., Olofsen, E., Burm, A.G., Bovill, J.G.: Propofol anesthesia and rational opioid selection. Anesthesiology 87(6), 1549–2562 (1997)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Sriram Sankaranarayanan
    • 1
  • Hadjar Homaei
    • 1
  • Clayton Lewis
    • 1
  1. 1.University of ColoradoBoulderUSA

Personalised recommendations