Generic PCA Infusion Pump
Oleg Sokolsky
PRECISE Center
Department of Computer and Information Science
University of Pennsylvania
AS-2C Committee Meeting
June 6, 2011
Collaborative Effort
• FDA CDRH
– Paul Jones
– Raoul Jetley
– Yi Zhang
• Penn
– Insup Lee
– David Arney
– BaekGyu Kim
• Goal: develop a collection
of artifacts
– Guidance to manufacturers
– Inform approval process
• Phases:
– Requirements definition
• Joint
– “Reference model”
• Mostly FDA
– “Reference implementation”
• Penn, ongoing
6/6/2011
GPCA Project Overview
2
History
• Infusion pumps: Class II category
– Controlled delivery of medication or nutrients to patients
– Significant source of “adverse events”
• Baxter infusion pump recall (over 200,000 units)
– Have been trying to correct defects since 1999
– June 2006: Permanent injunction to stop manufacturing
and distributing until defects are fixed
– April 2010: All pumps ordered to be destroyed
• Generic Infusion Pump started summer 2005
– Concentrated on PCA from 2007
• April 2010: Infusion Pump Improvement Initiative
6/6/2011
GPCA Project Overview
3
GPCA Documents
• PCA: Patient-Controlled Analgesia
– Delivery of pain control medication upon patient request
• Hazard analysis
– Table categorizing the hazards, with references to
safety requirements
• Safety requirements
– Natural-language statements
• Reference model
– State-machine description of state controller and alarm
detection
– Simulink/STATEFLOW implementation of the model
6/6/2011
GPCA Project Overview
4
Model Architecture
• Model captures
– Alarm detection
– Controller state
changes
• Platform: a set
of boolean
conditions
– Sensor values
– Predicates
• UI: also boolean
conditions
6/6/2011
GPCA Project Overview
5
GPCA Implementation
• On-going work
–
–
–
–
Modeling of the state controller in UPPAAL
Formalization of safety properties
Verification
UPPAAL code generation
• Pump platform
– Hospira infusion pump mechanism
• Microcontroller drives the motor
– Beagle Board runs pump controller
• Serial connection to the microcontroller
– Android-based UI / test harness
6/6/2011
GPCA Project Overview
6
AADL Model – Top Level
• Top level follows the reference architecture
6/6/2011
GPCA Project Overview
7
AADL Model – Pump controller
• Beagle board and
controller
software
6/6/2011
GPCA Project Overview
8
AADL Model – Controller software
6/6/2011
GPCA Project Overview
9
AADL Model – Pump platform
• Platform model represents sensors and actuators
– We don’t have all the sensors in place yet
• Microcontroller software:
– PWM for pump motor
– Sensor
inputs
6/6/2011
GPCA Project Overview
10
Possible AADL-centric efforts
• Requirements traceability
– Associate safety requirements with components
• Error modeling
– ???
• Behavior modeling
– BA modeling of state controller
• Code generation
– Enhance functional code generation by using
architectural information
• Anything else
6/6/2011
GPCA Project Overview
11
Reference to the Case Study
• http://rtg.cis.upenn.edu/gip.php3
6/6/2011
GPCA Project Overview
12