Safety-critical Devices Research Articles

Modeling and simulation of Fuzzy-rule based WBAN using multi-level fuzzy colored petri-nets and reinforcement learning

By developing IoTs (Internet of Things), a new concept is arising in WBANs (Wireless Body Area Networks), called IoBs (Internet of Bodies). WBANs are the safety-critical devices that use rule-based knowledge with fuzzy variables for monitoring patients. There are two issues with the knowledgebase: (1) appropriate knowledge representation and inference and (2) handling the situations for which there is no rule in the knowledgebase. In this paper, for the first issue we present MFCPN (Multi-level Fuzzy Colored Petri-nets) and for the second one we present a RL (Reinforcement Learning) mechanism for decision making based on the past device’s feedback to the environment. Through a few scenarios and two datasets, the proposed approach has been applied to pacemakers to show the approach's effectiveness. The comparison between decision making by our approach and two real datasets indicates the proposed approach has 79.3 % accuracy.

Guidelines for the development of a critical software under emergency.

Context:During the first wave of the COVID-19 pandemic, an international and heterogeneous team of scientists collaborated on a social project to produce a mechanical ventilator for intensive care units (MVM). MVM has been conceived to be produced and used also in poor countries: it is open-source, no patents, cheap, and can be produced with materials that are easy to retrieve.Objective:The objective of this work is to extract from the experience of the MVM development and software certification a set of lessons learned and then guidelines that can help developers to produce safety–critical devices in similar emergency situations.Method:We conducted a case study. We had full access to source code, comments on code, change requests, test reports, every deliverable (60 in total) produced for the software certification (safety concepts, requirements specifications, architecture and design, testing activities, etc.), notes, whiteboard sketches, emails, etc. We validated both lessons learned and guidelines with experts.Findings:We contribute a set of validated lessons learned and a set of validated guidelines, together with a discussion of benefits and risks of each guideline.Conclusion:In this work we share our experience in certifying software for healthcare devices produced under emergency, i.e. with strict and pressing time constraints and with the difficulty of establishing a heterogeneous development team made of volunteers. We believe that the guidelines will help engineers during the development of critical software under emergency.

LBIST for Automotive ICs With Enhanced Test Generation

Contemporary and emergent automotive systems are heavily populated by complex integrated electronics. The number of safety-critical devices used in advanced driver-assistance systems or autonomous vehicles is growing with high-end models containing hundreds of embedded microcontrollers. Achieving functionally safe automotive electronics requires test solutions that might be costly to engineer. Therefore, to address challenges posed by high-quality and long-term reliability requirements, this article presents low-cost test pattern generation schemes for a scan-based hybrid logic BIST of automotive ICs. It may allow one to optimize test coverage and test time during in-system test applications. The first presented technique deploys a seed-flipping PRPG to periodically complement PRPG stages in a methodical tree-traversal manner. The second scheme is based on a seed-sorting approach that allows additional tradeoffs between test data volume and test coverage. As shown in this article, the proposed schemes can be easily integrated with a test compression environment and deployed in different modes of in-system testing, such as key-off, key-on, and periodic (incremental) online tests. Experimental results obtained for automotive designs and reported herein show improvements in test quality over conventional logic BIST schemes.

Learning Fast and Slow: Propedeutica for Real-Time Malware Detection

Existing malware detectors on safety-critical devices have difficulties in runtime detection due to the performance overhead. In this article, we introduce Propedeutica, a framework for efficient and effective real-time malware detection, leveraging the best of conventional machine learning (ML) and deep learning (DL) techniques. In Propedeutica, all software start executions are considered as benign and monitored by a conventional ML classifier for fast detection. If the software receives a borderline classification from the ML detector (e.g., the software is 50% likely to be benign and 50% likely to be malicious), the software will be transferred to a more accurate, yet performance demanding DL detector. To address spatial-temporal dynamics and software execution heterogeneity, we introduce a novel DL architecture (DeepMalware) for Propedeutica with multistream inputs. We evaluated Propedeutica with 9115 malware samples and 1338 benign software from various categories for the Windows OS. With a borderline interval of [30%, 70%], Propedeutica achieves an accuracy of 94.34% and a false-positive rate of 8.75%, with 41.45% of the samples moved for DeepMalwareanalysis. Even using only CPU, Propedeutica can detect malware within less than 0.1 s.

PVP1-The People's Ventilator Project: A fully open, low-cost, pressure-controlled ventilator research platform compatible with adult and pediatric uses.

Mechanical ventilators are safety-critical devices that help patients breathe, commonly found in hospital intensive care units (ICUs)-yet, the high costs and proprietary nature of commercial ventilators inhibit their use as an educational and research platform. We present a fully open ventilator device-The People's Ventilator: PVP1-with complete hardware and software documentation including detailed build instructions and a DIY cost of $1,700 USD. We validate PVP1 against both key performance criteria specified in the U.S. Food and Drug Administration's Emergency Use Authorization for Ventilators, and in a pediatric context against a state-of-the-art commercial ventilator. Notably, PVP1 performs well over a wide range of test conditions and performance stability is demonstrated for a minimum of 75,000 breath cycles over three days with an adult mechanical test lung. As an open project, PVP1 can enable future educational, academic, and clinical developments in the ventilator space.

Fault Diagnosis and Fault-Tolerant Control of PMSM Drives–State of the Art and Future Challenges

The issues of monitoring and fault diagnosis of drives with permanent magnet synchronous motors (PMSM) are currently very topical due to the increasing use of these drives in safety-critical devices. Every year, more and more articles on this subject are published. Therefore, the aim of this article is to update the overview of diagnostic methods and techniques for PMSM drives. Each of the main chapters of the article focuses on a specific element of the drive system (motor, power converter, measuring sensors), with particular emphasis on the components of the motor (stator windings, magnets, bearings, rotor). The main sections on PMSM fault diagnosis are divided according to the type of methods used to obtain the symptoms of the damage. In addition, a review of methods using the analysis of control structure signals for the diagnosis of damage to a vector-controlled motor is presented, as well as the latest achievements of researchers in the field of shallow and deep neural networks for the detection and classification of PMSM drives failures. Based on the presented literature analyses, some development trends and challenges related to the development of diagnostics and fault-tolerant control of PMSM drives are discussed in the conclusion part.

Addressing process safety challenges in downstream industries in Brunei Darussalam

International oil and gas corporations operating in Brunei may apply process safety management (PSM) and analysis techniques, resulting in varying approaches and measures to address process safety issues. Global corporations may have developed their own process safety standards while smaller firms employ established ones. This research compares the local PSM systems and standards with international ones to determine which employers face the most difficulties in implementing or increasing process safety inside their organizations. This study found that Occupational Safety and Health Administration (OSHA) regulations are used by 30% of local users in downstream operations. Common challenges encountered by local users are management/leadership commitment to process safety (11.9%), mechanical integrity and management of safety critical devices (5.3%), management review and intervention for continuous improvement (4.9%), communication amongst workers (3.8%), management of change (3.8%), operational control, permit to work and risk management (3.8%) and incident reporting (3.8%).

Partial gravity compensation of a surgical robot

Surgical robots are safety-critical devices that require multiple domains of safety features. This article focuses on the passive gravity compensation design optimization of a surgical robot. The limits of this optimization are related with the safety features including minimization of the total moving mass/inertia and compactness of the design. The particle swarm optimization method is used as a novel approach for the optimization of a parallel remote-center-of-motion mechanism. A compact design is achieved by partially balancing the mechanism, which also decreases the torque requirements from the actuators.

Medical Devices: Classification and Analysis of Faults Leading to Harms.

Harms from medical devices are important, but have been much less well studied than adverse drug reactions. Information provided to device users is of variable quality. Our aim was to define "medical device fault" and "adverse effect of a medical device"; to establish whether medical device faults arise in design, manufacture, or use; and to consider ways of mitigating the adverse effects of medical devices. We analysed 100 consecutive faults reported by the US Food and Drug Administration (FDA) and 50 faults reported by the UK Medicines and Healthcare products Regulatory Agency (MHRA), and classified faults according to the point at which they occurred. Nearly 70% of reported faults related to devices that entered the body. Over 70% arose at the design stage, a quarter of the faults were associated with manufacture, and less than 5% were primarily caused by faulty use. We defined a medical device fault as an unintended failure in the design, manufacture, or use of a medical device that leads to, or has the potential to lead to, harm to the patient, and an adverse effect of a medical device as an unintended and appreciably harmful effect, caused by a medical device, which demonstrates a hazard of the device and may warrant preventive measures, or a change in the mode of use, or withdrawal of the device. Most faults that generate warnings arise from problems at the design stage, some arise at the manufacturing stage, and a few in usage. Careful assessment of the design of safety-critical devices in the light of previous problems may help to prevent repetition of errors. It would be helpful if, in addition to user manuals, manufacturers were required to produce Summaries of Device Characteristics (SDCs, "labels") that contained a systematically presented set of information about a product.

A unified framework for automated inspection of handheld safety critical devices in production assemblies

Due to portability and ease of usage, handheld devices are widely used in various safety critical industrial applications. A failure in such devices either can endanger life of human(s) or can lead to substantial economic/environmental damage. Therefore, production inspection of handheld safety critical devices requires rigorous verification and validation prior to a field deployment to gain certain level of assurance. The research is aimed at devising a unified inspection framework for automated inspection of hardware, software and mechanical characteristics of handheld safety critical devices in production assemblies for smooth integration of all the required tools and technologies. The framework provides system and process level integration of all the stages of the inspection lifecycle for an end-to-end automated production inspection system. The testbeds are geared towards for reusability, flexibility and configurability of all the resources across various inspection stages. AVI (Automated Visual Inspection) system which exhibit specific characteristics is a core component of the proposed framework. The specific characteristics of the AVI system, a generalized architecture of the handheld safety critical devices for which the proposed framework is applicable. Also an integrated production inspection lifecycle for production assemblies of handheld safety critical devices is presented in this research paper.

Implementing process safety critical roles to reduce risk

In late 2014, Woodside commenced the implementation of the Energy Institute Process Safety Management (PSM) Framework to transform how process safety is managed in the organisation. The framework consists of four focus areas and 20 elements which formed a structure around which a cultural change to a ‘line led, risk based’ approach was made. The transformation focused on four key improvement opportunities: (i) consistent multi-disciplined risk assessments, (ii) efficient management of safety critical devices, (iii) better recognition of excursions beyond integrity limits and (iv) lift and formalise the capability of people to lead and deliver superior process safety performance. The first three focused on tools and methodologies – the PSM ‘system’. The capability workstream considered the people aspect of process safety, so that people understand and are able to execute their role in the overall process safety effort. This paper discusses the capability workstream in Woodside’s PSM Initiative, the ‘how’ of establishing process safety critical roles and implementing cultural change. It then discusses the demonstrable improvements and reduction in risk that were realised and measured, using lagging indicators (Tier 1 and 2 events) and a suite of leading indicators.

Formal Modelling and Verification of the Operational Modes of Pacemaker

Objectives: The importance of error free smooth functioning of the heart pacemaker in providing consistent relief to the heart patients has pushed the researchers to devise highly refined bug free devices. Pacemaker is an important safety critical device that is used to keep the heartbeat uniform in patients with low heartbeat. Since the smooth functioning of the pacemaker is responsible to provide oxygen and nutrients to the whole body of the patient in an appropriate ratio, therefore, any conflict in the device would be life threatening. It is therefore extremely necessary to ensure the error free working of such critical health device. Methods: Previously, different verification methods have been employed to design and verify safety critical devices with varying degree of reliability and reproducibility. Keeping in view the specifications of the pacemaker, this paper presents a model for the verification and validation of a pacemaker system using the SPIN model checker. Findings: The LTL formulas are characterized to handle the uncertainty or any abnormal activity during the process. The system model is designed using SPIN model checker in which different LTL properties are verified. A theoretical description is supported by some experimental results, generated using the existing logics and techniques. Application: This work can be further enhanced for the formal verification of critical medical equipment to ensure their correct functioning.

Mechanism for safe remote activation of networked surgical and PoC devices using dynamic assignable controls.

The number of devices within an operating room (OR) increases continuously as well as the complexity of the complete system. One key enabler to handle the complexity is an interoperable and vendor independent system of networked medical devices. To build up such an interoperable system we use the proposed IEEE 11073 SDC standards (IEEE P11073-10207, -20701, -20702) for networked point-of-care (PoC) and surgical devices. One of the major problems within the OR is that typically every device has its own control unit. This leads to unsatisfying situations like a high number of foot switches that causes operating errors or the problem that the physician cannot reach the control unit of the device where parameters have to be changed or an activation should be triggered. Dynamically assignable controls will solve these problems. This paper describes mechanisms that allow a safe remote activation of safety critical device functionalities based on a potentially unsafe off-the-shelf network with problems like connection loss and jitter. The proposed systems is based on a periodic reactivation of the device functionality and the additional use safety related information that is included into the activate operation command. The main advantage is that all described mechanisms make use of the self-description capability provided by the IEEE 11073 SDC. This enables a real interoperability and plug-and-play functionality because both the medical device and the control client do not need any a priori knowledge about each other.

A Formal Verification Methodology for DDD Mode Pacemaker Control Programs

Pacemakers are safety-critical devices whose faulty behaviors can cause harm or even death. Often these faulty behaviors are caused due to bugs in programs used for digital control of pacemakers. We present a formal verification methodology that can be used to check the correctness of object code programs that implement the safety-critical control functions of DDD mode pacemakers. Our methodology is based on the theory of Well-Founded Equivalence Bisimulation (WEB) refinement, where both formal specifications and implementation are treated as transition systems. We develop a simple and general formal specification for DDD mode pacemakers. We also develop correctness proof obligations that can be applied to validate object code programs used for pacemaker control. Using our methodology, we were able to verify a control program with millions of transitions against the simple specification with only 10 transitions. Our method also found several bugs during the verification process.

Concept of Automatic Usability Evaluation of Safety-Critical Interactive Systems in the Field (Konzept der automatischen Bewertung der Gebrauchstauglichkeit sicherheitskritischer Systeme)

Summary The usability of interactive systems is an important attribute, especially for safety-critical devices like driver information systems. The functional complexity of such devices is increasing. Traditional user testing during development often fails to provide necessary data for an appropriate usability evaluation. In this work an approach for in-the-field usage data collection using the D'PUIS framework and automatic evaluation with the REVISER evaluation tool is introduced.

The relationship between automation complexity and operator error

One of the objectives of process automation is to improve the safety of plant operations. Manual operation, it is often argued, provides too many opportunities for operator error. By this argument, process automation should decrease the risk of accidents caused by operator error. However, some accident theorists have argued that while automation may eliminate some types of operator error, it may create new varieties of error. In this paper we present six case studies of explosions involving operator error in an automated process facility. Taken together, these accidents resulted in six fatalities, 30 injuries and hundreds of millions of dollars in property damage. The case studies are divided into two categories: low and high automation complexity (three case studies each). The nature of the operator error was dependent on the level of automation complexity. For each case study, we also consider the contribution of the existing engineering controls such as safety instrumented systems (SIS) or safety critical devices (SCD) and explore why they were insufficient to prevent, or mitigate, the severity of the explosion.

Safety instrumented systems and safety critical devices: Risk abatement provided by safety instrumented systems may cause remote hazards with higher risks

AbstractA basic law of physics states that for every action there is an equal and opposite reaction. Translating that law into the world of risk analysis, we might state that for every action (even a risk mitigation action) there are consequences—and not all of those consequences are (1) clearly identified, (2) fully understood, and/or (3) good. Even when the initial actions are an effort to mitigate a perceived risk, the range of consequences (that is, reactions) can sometimes create another set of hazards and possibly larger risks than initially addressed.The complexity of safety instrumented systems facilitates the creation of at least four types of new hazards that should be addressed. First, some consequences that may result from the proper functioning of a single safety system may not be desirable. Second, the accumulative and interactive effects when multiple safeguards function properly may cause unexpected and unwanted consequences. Third, unanticipated and sometimes unwanted consequences at seemingly remote locations may occur. Fourth, and finally, because of interactions with other control components, safety instrumented systems can easily create several layers of risk abatement actions cascading from the initiating event, making it virtually impossible for operations personnel to troubleshoot and correct the original anomaly in a timely manner—adding yet another hazard to the operations.This article addresses the potential of creating “downstream” or remote hazards by the installation of safety instrumented systems and then discusses how and when consequence analyses should be expanded to identify these potential new hazards. This is done using the life cycle approach for the design and maintenance of safety instrumented systems discussed in the newly published CCPS book, “Guidelines for Safe and Reliable Instrumented Protective Systems.” It is not possible to delineate every variation of how successful activation of basic process controls and safety instrumented systems might lead to the problems described in this article. Rather, this article is a sampling intended to cause the reader to think more seriously about how successful activation of systems intended to protect the process might, in fact, create new hidden hazards remote from the initiating event. © 2006 American Institute of Chemical Engineers Process Saf Prog, 2007

Formal specifications and analysis of the computer-assisted resuscitation algorithm (CARA) Infusion Pump Control System

Reliability of medical devices such as the CARA Infusion Pump Control System is of extreme importance given that these devices are being used on patients in critical condition. The Infusion Pump Control System includes embedded processors and accompanying embedded software for monitoring as well as controlling sensors and actuators that allow the embedded systems to interact with their environments. This nature of the Infusion Pump Control System adds to the complexity of assuring the reliability of the total system. The traditional methods of developing embedded systems are inadequate for such safety-critical devices. In this paper, we study the application of formal methods to the requirements capture and analysis of the Infusion Pump Control System. Our approach consists of two phases. The first phase is to convert the informal design requirements into a set of reference specifications using a formal system, in this case EFSMs (Extended Finite State Machines). The second phase is to translate the reference specifications to the tools supporting formal analysis, such as SCR and Hermes. This allows us to conclude properties of the reference specifications. Our research goal is to develop a framework and methodology for the integrated use of formal methods in the development of embedded medical systems that require high assurance and confidence .