![](bg5.png)
using formal methods technologies. Ad hoc models
are developed in UPPAAL to translate core parts of
the Simulink models needed for the verification.
Similarly, in (Chen et al., 2014), Math-
Works/Simulink is used in conjunction with
Prism (Kwiatkowska et al., 2011). Ad hoc Prism
models are developed that represent the behaviour of
the pacemaker-heart system and verify pacemaker
properties related to energy consumption.
Differently from the above works, our approach
alleviates the problem of developing and maintain-
ing multiple models by enabling integrated simu-
lation. We demonstrated the approach for Math-
Works/Simulink and PVS, but the approach is gen-
eral and can be used to enable integrated execution of
simulations for other analysis environments.
5 CONCLUSIONS
The construction of a formal model of the device and
the application of formal verification techniques can
help to prove that the device performs the required
functions under all the stated conditions, thus enhanc-
ing patient safety.
We developed a framework that makes possi-
ble both the simulation of the device in conjunction
with Simulink heart models built on medical domain-
specific knowledge, and the verification of invariants
of the device through the theorem proving approach.
In this way, system designers may use simulation re-
sults to validate the system behaviour with the guid-
ance of domain experts, and formal verification to en-
sure the correctness of its design.
Integrated simulation allows software engineers to
demonstrate the functionalities of the pacemaker soft-
ware, and discuss hypotheses about its behaviour for
different physiological parameters of the patient. On
the other hand, the correctness of the pacemaker de-
sign can be formally checked by assume-guarantee
reasoning (Henzinger et al., 2001), i.e., by proving
that the ICP guarantees the desired behaviour of the
ICP-heart system under suitable assumptions on the
heart model. Formalising these assumptions will be
the object of further work.
ACKNOWLEDGEMENTS
We would like to thank Alexandru Mereacre (Uni-
versity of Oxford), who helped us with the
MathWorks/Simulink model of the heart. This
work is supported by EPSRC through CHI+MED
(EP/G059063/1, http://www.chi-med.ac.uk).
REFERENCES
Alur, R. and Dill, D. L. (1994). A theory of timed automata.
Theoretical Computer Science, 126(2):183–235.
Behrmann, G., David, A., Larsen, K., Hakansson, J., Pet-
terson, P., Yi, W., and Hendriks, M. (2006). UPPAAL
4.0. In Third Int. Conf. on Quantitative Evaluation of
Systems (QEST 2006), pages 125–126.
Chen, T., Diciolla, M., Kwiatkowska, M., and Mereacre, A.
(2014). Quantitative verification of implantable car-
diac pacemakers over hybrid heart models. Informa-
tion and Computation, 236(0):87–101.
Hamon, G. and Rushby, J. (2004). An operational semantics
for Stateflow. InFundamental Approaches to Software
Engineering (FASE), volume 2984 of LNCS, pages
229–243. Springer Berlin Heidelberg.
Henzinger, T. A. (1996). The theory of hybrid automata. In
Proc. of the 11th Annual IEEE Symposium on Logic in
Computer Science, LICS ’96, pages 278–292, Wash-
ington, DC, USA. IEEE Computer Society.
Henzinger, T. A., Minea, M., and Prabhu, V. S. (2001).
Assume-guarantee reasoning for hierarchical hybrid
systems. In Benedetto, M. D. D. and Sangiovanni-
Vincentelli, A. L., editors, HSCC, volume 2034 of
LNCS, pages 275–290. Springer.
Jiang, Z., Pajic, M., Connolly, A., Dixit, S., and Mang-
haram, R. (2010). Real-time heart model for im-
plantable cardiac device validation and verification.
In Real-Time Systems (ECRTS), 2010 22nd Euromicro
Conference on, pages 239–248. IEEE.
Jiang, Z., Pajic, M., and Mangharam, R. (2012a). Cyber–
physical modeling of implantable cardiac medical de-
vices. Proc. of the IEEE, 100(1):122–137.
Jiang, Z., Pajic, M., Moarref, S., Alur, R., and Mang-
haram, R. (2012b). Modeling and verification of a
dual chamber implantable pacemaker. In Flanagan, C.
and K¨onig, B., editors, Tools and Algorithms for the
Construction and Analysis of Systems, volume 7214
of LNCS, pages 188–203. Springer Berlin Heidelberg.
Kwiatkowska, M., Norman, G., and Parker, D. (2011).
Prism 4.0: Verification of probabilistic real-time sys-
tems. In Computer aided verification, pages 585–591.
Springer.
Masci, P., Zhang, Y., Jones, P., Oladimeji, P., D’Urso,
E., Bernardeschi, C., Curzon, P., and Thimbleby,
H. (2014). Combining PVSio with stateflow. In
Proc. of the 6th NASA Formal Methods Symposium
(NFM2014), Berlin, Heidelberg. Springer-Verlag.
Masci P. et al. (2014). Modelling a dual chamber im-
plantable cardiac pacemaker in PVS. Technical report,
Queen Mary University of London.
Oladimeji, P., Masci, P., Curzon, P., and Thimbleby, H.
(2013). PVSio-web: a tool for rapid prototyping de-
vice user interfaces in PVS. In FMIS2013, 5th Int.
Workshop on Formal Methods for Interactive Systems.
Owre, S., Rajan, S., Rushby, J., Shankar, N., and Srivas, M.
(1996). PVS: combining specification, proof check-
ing, and model checking. In Alur, R. and Henzinger,
T. A., editors, Computer-Aided Verification, CAV ’96,
number 1102 in LNCS, pages 411–414.
IntegratedSimulationofImplantableCardiacPacemakerSoftwareandHeartModels
59