The value of virtual modeling in the healthcare industry : application of model-based engineering to the development of complex medical devices

(1)

The Amsterdam MBA

The Value of Virtual Modeling in the Healthcare Industry

Application of Model-Based Engineering to the development of Complex

Medical Devices

Author: Sasa Marinkovic (1140728) sasa.marinko@gmail.com Supervisor: Dr. Jeroen Kraaijenbrink Date of Submission: 15/08/2018

(2)

Executive summary

The current approach to the product development of safety-critical systems is based on mature standards defined for the specific domain. The most used methodology relies on the classic V-Model, and the certification process of the products is based on hardly evolving test cases and on well-described test conditions executed on physical devices.

The complexities and challenges introduced by new typologies of “Cyber-Physical Systems” and the consequent formation of large-scale “System of Systems”, increases dramatically security and safety risks that need to be considered during the system development, leading to extremely long and expensive Verification and Validation efforts.

This research describes an alternative approach to the development of complex and highly automated medical devices, based on the adoption of concepts derived from the Mode-Based

Engineering. It describes the application of the framework proposed by the ENABLE-S3

initiative to the specific case of Interventional X-Ray Systems, highlighting the business opportunities and limitations of adopting Virtual Testing Platforms during the Verification and Validation activities of new product introductions.

Keywords: Medical Devices, Cyber-Physical Systems, Interventional X-Ray Systems,

Model-Based Engineering, System of Systems Engineering, Model-Model-Based Validation and Verification, Product Development, Virtual Prototypes.

(3)

I. Introduction

Medical devices manufacturers must assure compliance with stringent regulatory processes and quality systems requirements in all the markets they serve. New products introductions must follow rigorous approval processes, governed by the main authorities in the field such as the FDA in the United States, the CFDA in China, the CFIA in Canada and the corresponding national authorities in the European Union. This means that companies must notify the regulatory bodies about their intention to introduce new products to the market proving that they meet all the requirements regarding quality, safety, efficacy, and performance.

Whenever a new product or its variation is introduced to the market, an extensive Verification and Validation (V&V) effort is essential for showing compliance with the existing regulations and assuring the desired level of quality. At the same time, this process is quite long and intensive even in case of minor modifications to existing products in the field.

Furthermore, the vast diversity of regulatory bodies and in some instances the absence of globally accepted standard procedures adds complexity to the approval process, delaying the product introduction to the market and increasing the overall product development costs. The company project will study the application and implementation of simulated models and virtual platforms during the Verification and Validation phase of new product introductions for the medical device industry, with the objective of highlighting the benefits of this approach compared to traditional methods based on physical components.

The research was conducted within the Image Guided Treatment and Therapy business unit (IGT) of the Dutch multinational Royal Philips, which is commercializing Interventional X-Ray Systems and Solutions. The activity was part of a broader European initiative called ENABLE-S3, developing cross-domain frameworks and tools for the certification of complex and highly automated systems (Cyber-Physical Systems).

The next session briefly gives an overview of the Philips Company, presenting its current strategic focus and the relevant business segments for this research, will then provide the context of the ENABLE-S3 initiative and will introduce the research objective and approach.

(6)

A. The current strategic focus at Philips

The company, founded in Eindhoven in 1891 by Gerard Philips and his father Frederik Philips, was one of the largest technology conglomerates of the 20th_{century. During its long history,} the company developed a highly innovative portfolio of product offerings ranging from lighting, industrial and consumer electronics, appliances, medical devices, and software. Being always at the edge of technological and process innovation was one the main factors of its success and allowed the company to introduce to the market some of the most innovative and impactful innovations of the recent history. We can recall innovations such as broadcast Radio and Television, Compact Audio Cassettes, Magnetic Resonance Imaging (MRI), X-Ray imaging, silicon process technology, digital optical storage devices (DVD and Blue-Ray) and LED-based lighting systems (Royal Philips, 2018).

Following the performance decline during the period of 2000-2010, the company initiated a process of transformation that involved a strong reorganization and refocus of its activities, with the aim of creating synergies across the increasingly complex matrix organization. This resulted in the spun off some of its historical activities such as the semiconductors, TV, Audio and more recently the lighting businesses and a strong pivot toward digital innovations and the Healthcare industry.

Since 2011, the company started to identify ways of moving away from the traditional product offering and thinking in terms of systems and solutions, addressing more complex and variable customer needs in the Healthcare domain. The new digital strategy called for the creation of standard components that could be reconfigured and reused by the different providers in order to create a broad portfolio of integrated solutions that could be reconfigured to offer specific value propositions.

In 2017, the company announced solid fiscal results, with a clear purpose and reasonable progress toward becoming a focused leader in Health Technology. The company continued its disinvestment in Philips Lighting and at the end of the year posted sales of EUR 17.8 billion and employed approximately 74,000 employees globally, divided into four main divisions: Personal Health, Diagnosis & Treatment and Connected Care, Health Informatics and HealthTech Other (Royal Philips, 2017).

(7)

As stated in all the official communications channels, the primary strategic focus of the company is “Addressing Healthcare challenges through innovation” and the company is guided and inspired by the vision of “Making the world healthier and more sustainable

through innovation. With the goal of improving the lives of three billion people a year by 2025”.

However, the current healthcare challenges such as the increasingly growing population (reached nearly 7.6 billion in 2017), the aging of the population (with 65+ expected to reach 22% of the total by 2050), the rise of chronic disease (expected to increase to 57% by 2020) and the overall global resources constraints, are adding enormous pressure to the worldwide Healthcare providers (United Nations, 2017).

At the same time, the digital transformation in the domain is allowing citizens to take control of their own health records and take ownership of their own well-being, shifting value toward the companies capable of offering services and software solutions.

Philips, with its strong leadership position in both the personal health and professional care domains, has the unique opportunity to provide innovative solutions across the whole

Healthcare continuum and to work with the key stakeholders of the industry for transforming

the current way health care is delivered, leading to more efficient solutions and better patient outcomes. This is why at the center of the current strategy there is an integrated approach of offering solutions through the whole healthcare journey.

The overall end-to-end approach is represented in Figure 1.

(8)

The main strategic direction of the company is to unlock value in data across the healthcare continuum, where the increasingly connected devices will allow the convergence of information from consumer and professional products leading to more efficient and personalized care. In this way, the company is looking at creating gains and efficiencies capable of enhancing the “customer experience, improving health outcomes, lowering the

cost of care and improving the work life of care providers”.

In this direction, the company is increasing its partnership with hospitals adopting long-term multi-year agreements that allows understanding of their evolving needs better and provide integrated solutions that improve productivity and the quality of care. This is also done by implementing new business models based on “Product as a service” and “Software as a

service”. (Royal Philips, 2017).

The Diagnosis and Treatment business segment is one of the best examples of the Philips capacity to create meaningful innovations and is the current core element of its health technology strategy. The value proposition is composed by various suites of solutions focusing on non-invasive techniques to represent anatomical structures of the human body, designed to meet the specific needs of the different medical disciplines and adopting different imaging modalities such as Ultrasound, Magnetic Resonance Imaging, Computed Tomography, X-Rays, Molecular Imaging, etc.

The Image Guided Treatment and Therapy (IGT) business unit is part of the Diagnosis and Treatment business segment and offers solutions for minimally invasive clinical procedures. Recently, the company reinforced its leadership position in the filed by introducing a new interventional imaging platform Azurion that helps the physician to execute procedures more consistently and efficiently. This was enabled by a product development focused on customer experience and workflow optimization, in addition, the system is equipped with an extensive package of software tools (Interventional Tools) that help the physicians to reduce procedure time and expand into new clinical applications. The attractive IGT market space, composed of complex robotics platforms and different types of therapeutic devices is enjoying high growth, and reasonable gross margins and Philips is currently busy with raising its shares in this field by offering integrated solutions (Royal Philips, 2017).

(9)

Figure 2 - Azurion - The next generation image-guided therapy platform (Source: Royal Philips website) Furthermore, during the recent years, Philips made some significant acquisitions in this domain, strengthening and broadening its portfolio and making it the only company in the field able to combine image-guided devices with imaging systems. The addition of Volcano added coronary pressure and flow sensors to the offering and the company made its entrance into the device business segment (Royal Philips, 2015). The acquisition of Spectratnectics added solutions such as coronary laser catheters laser and scoring balloon catheters (Royal Philips, 2017). Finally, the addition of EPD Solutions added a unique and novel imaging technology for the diagnosis and treatment of cardiac arrhythmias (Royal Philips, 2018). This could open a way to the introduction of integrated offerings that have the potential of reshaping the way current interventions are performed and could facilitate the introduction subscription-based business models such as monitoring-as-a-service and outcome-based

models, where the payment is based on the clinical outcome (Royal Philips, 2017).

In conclusion, leveraging the extensive clinical knowledge in combination with a broad portfolio of integrated technologies has the potential of becoming the main Competitive

(10)

B. The ENABLE S3 initiative

The research project was conducted under the ENABLE S3 initiative, a running European cross-industry project composed of 74 partners from 15 countries. The goal of the initiative is to develop innovative solutions capable of combining virtual simulations with the real-world testing and to assure that complex behavior of highly automated and autonomous systems (Cyber-Physical Systems) is correct, reliable and in line with safety and domain-specific regulations.

The ENABLE S3 initiative covers six industrial domains (automotive, aerospace, rail, maritime,

health, farming) and starts by the consideration that pure simulation has some practical

limitations because of limited computation power and sophisticated modeling, on the other hand executing real-world testing is becoming more and more costly and time-consuming. Furthermore, during testing and operations, some field operators could be exposed to potentially dangerous situations (explosions, collisions, ionizing radiation) limiting the applicability of the current techniques. The intention is therefore to develop a cross-domain framework capable of overcoming the main challenges and enabling cost-efficient verification and validation of highly complex systems (ENABLE-S3, 2017).

Philips participates in the initiative with its Image Guided Therapy (IGT) business as a representative of the Health domain.

(11)

C. Thesis research objective

The objective of the company project was to study the applicability of the developed tools and methods during the ENABLE S3 initiative for the Verification and Validation of new product introductions within the Image-Guided Therapy business group, more specifically for the IAC department and the Interventional Tools development. This means analyzing the current V&V process and understanding, which stages could benefit from the adoption of virtualization, and modeling, reducing, therefore, the amount of traditional testing based on physical assets and manual work. With this approach, the expectation is to raise the dependability of the complete systems, minimize the risk of flows in the design while at the same reducing the costs of the product development and allowing more agility for future product offerings. Therefore the question that this research will answer are:

1) What are the drivers for adopting Virtual Testing Platforms and MBE within IAC? 2) How to adopt the current methodology developed within the ENABLE S3 initiative for

the IAC use case and thus for the development of Interventional Tools?

3) What are the expected benefits of Virtual Testing Platforms and how to quantify them? 4) What are the current limitations of this approach and what should be taken into

account to include it into the standard Way of Working?

The following main deliverables are expected from the company project:

1) Definition of an instance of the Virtual Platform applicable to the Interventional Tools development, taking as an input the reference architecture and methodologies developed during the ENABLE-S3 initiative.

2) Definition of the Key Performance Indicators (KPIs) useful for quantifying the benefits of the adoption of virtual systems compared to the standard approach to Verification and Validation activities.

3) Identification of the limitations and the applicability of the Virtual Platform, together with the activities that need to be performed for adopting it as a tool as a standard way of working and therefore for regulatory submissions.

This research will apply the framework developed by the ENABLE-S3 initiative, will then combine them with the information retrieved from secondary research and the research interviews conducted within the organization.

(12)

D. Thesis research methodology

The following sources of information and data have been used during the study:

- ENABLE-S3 reports and deliverables, providing the developed methodology, tools and examples of applications to different industrial domains (the framework).

- Theoretical articles, providing the necessary background information on the main technological building blocks that have been considered, together with opportunities and challenges.

- Industrial standards and regulatory guidance, providing background information on the current state-of-the-art in the field, as well as directions for the future.

- Internal reports, providing information on related research conducted over the last years within the organization.

- Internal processes and procedures, necessary for mapping the current Way of

Working and connecting it to the proposed methodology.

- Research interviews, providing qualitative data necessary for identifying the current pain points during the V&V activities and the opportunities for adopting virtual testing platforms.

- Company internal reporting tools and databases, providing quantitative data necessary for identifying relevant KPIs and deriving the current reference measures. 1. The secondary research:

Considering the broad scope of the study, which is touching several technologies and methodologies, the secondary research helps in getting an overall picture quickly and deriving the logical connection between apparently independent topics. There are a number of inherent complexities that will be highlighted in the next sections and should be considered when developing the systems considered in this study (Cyber-Physical Systems). The secondary research helps in isolating the reoccurring challenges and issues giving a direction for further investigations. As mentioned, the analysis used both company internal reports and previous studies, as well as external sources such as academic publications, technical publication, and industrial research. As it will be presented mainly in the Literature Review/Underlying Theory, section the secondary research cover the following topics:

(13)

- Definition, characteristics, and trends of Cyber-Physical Systems including applications in the Health domain.

- The current state of the art of the Product Development of medical devices and systems, including the applicable regulations and standards.

- Theoretical background of Model-Based Engineering and its benefits. - Current trends and applications of Virtual Environments (AR/VR). 2. The qualitative research:

The qualitative research in this study was done adopting a semi-structured approach with the identified stakeholder, building upon personal knowledge of the field and the industry. The predefined questions were tailored to the specific field of expertise of the participant, leaving space however to brainstorming according to his response. The interview involved two different types of groups and within each group several profiles, as described below. One group was composed of those members who were already part of ENABLE-S3 initiative and had already a historical knowledge of the performed activities, this had the objective of getting familiar with the achieved results, the developed reference architecture and highlighting the main challenges, allowing gaining more profound insights into the filed compared to the used secondary research input. The other group was composed of those members working on the Interventional Applications development and still unaware, or with limited knowledge, of the methods developed within the ENABLE S3 initiative. This group provided insights regarding the current Way of Working at the IAC department, the current issues and challenges encountered during the product development process, giving the input for defining the needs of the proposed Virtual Platform and opportunities in this direction. The following professional figures within the Philips IGT business units were approached during the research, representing the main stakeholders touched by the proposed solution:

- Department managers / directors - Project managers

- System Designers & System Architects - Verification & Validation leads

- Quality and Regulatory experts - Products Developers & testers

(14)

3. The quantitative research:

The quantitative research was conducted mainly to identify the current performance of the product development process. Historical data from recent Interventional Tools development projects were collected and analyzed in order to highlight the impact of the V&V activities on the overall product development lead-time, effort, and cost. This was necessary first for identifying those Key Performance Indicators (KPIs) connected to the objective of this research, and second for deriving the baseline zero measurements that could be used for comparing the benefits once the Virtual Platform is adopted.

Data was gathered from different Philips IGT internal databases and tracking systems, containing details on recent projects scope, lead-time for each milestone, employees’ allocation to projects, time spent on development activities, time spent on testing activities and quality related attributes of the development process. More details about how those sources have been used will be given in the KPI related section: Defining metrics and measurements (KPIs). The overall summary of the company research projects, highlighting the different sources of information and the main deliverables is shown below:

Secondary Research

Quantitative research

IAC Virtual CathLab Semi-structured

Interviews

Reference

Architecture _{& Standards}Regulations

KPIs Standard Way of Working Requirements Definition Management recommendations

(15)

II. Literature Review/Underlying Theory

This chapter will present the current state-of-the-art in product development of highly automated and safety-critical systems (Cyber-Physical Systems), highlighting some of the existing challenges encountered when applying traditional development processes and methodologies. The theoretical review focuses on the development of complex medical system. However, the introduced concepts could be easily extended to other domains presenting a similar level of complexity, regulatory constraints and requiring a similar effort in proving safety and effectiveness of the developed products.

The section starts with on the overview of the industry-wide adopted V-Model describing the reasons why this type of approach is not suitable anymore for the development of complex and evolving Cyber-Physical Systems. An alternative approach based on Model-Based Engineering, Virtual prototypes and Model-Based V&V are than presented.

Those concepts represent the theoretical background of the methodology that will be applied in section III to the specific use case (IAC Virtual CathLab) considered in this study. Although it is a broad overview of apparently different disciplines, at the end everything follows under the same umbrella and has a direct connection with this research.

A. Current State-of-the-art in Product Development

The Product Life Cycle curve in Figure 5 summarizes the different stages of the product’s lifetime. Investments in the initial phase (Innovation Phase) are followed by a Growth Phase and finally by a Maturity Phase. The Maturity Phase is particularly important when taking into consideration Medical Devices and complex systems, as their lifespan is relatively long compared to consumer products and can easily reach more than one decade. This doesn’t mean the product is immutable, on the contrary, maintenance and service agreements typical of the medical domain can extend its life sometime well beyond the initial estimation. The security end safety-related issue, the implementation of new features on existing platforms, the adoption of new business models (e.g., subscription-based and product as a service) could require updates and upgrades of the current field base.

At the same time, new environmental and social constraints are more and more pushing for a circular economy, where existing products are shared, re-used, refurbished and repackaged

(16)

into new value proposition targeting new geographies (e.g., developing countries) or new customer segments (e.g., bottom of the pyramid). The product development process, therefore, needs to have in mind and facilitate both the current innovation and the maintenance of existing solutions.

Figure 5 - Product life cycle on the market “S-curve” (Source: Source: Current trends in product development, J. Persson, 2016)

Although there is some variation depending on the specific industry, when it comes to new product introduction, the development process based on the classic “V-Model” is the state-of-the-art for all the major safety-critical applications (e.g., Automotive, Avionics, Health, etc.) and therefore applicable to the Interventional X-Ray Systems described in this research. The V-model is an evolution of the older “Waterfall” model initially introduced for the software development, adds additional emphasis on the testing, and connects the testing steps to the corresponding system design steps. It mainly describes a sequential process based on a clear distinction between the development and testing activities. As it can be seen from Figure 6, all the main development activities, regarding What needs to be developed and How is going to be developed take place on the left side of the V, while the different levels of integration and testing activities take place on the right side of the V once the development is completed.

(17)

Figure 6 - The V-Model (Source: Current trends in product development, J. Persson, 2016)

The relation between the two side of the V is used to check if the related development stage is completed correctly, this means that whenever a problem occurs during a specific testing phase (right side), the related left side of the V needs to be revised and the process needs to be repeated. As evident, this results in a strictly sequential and plan-driven approach to product development. Making it difficult to change requirements on the way as it will trigger an update of several documents and could potentially invalidate all the testing done until that moment, adding additional costs to projects. At the same time, defining all the requirements clearly upfront is quite a challenging task for the development team.

Over the time, the V-model and its minor adaptations proved to be the best fit with regulatory requirements defined for the medical devices both for the software development and more in general for the system development. The adopted processes in the industry are stressing the importance of traceability and testing of usability, essential requirements and safety-related features. It is therefore quite clear which activities need to be performed in order to be compliant with regulatory requirements, but there is at the same time flexibility on the methods and tools. Thought this flexibility, the leading industrial players are quite conservative, and the traditional V-model is the most adopted (F. McCaffery, 2005).

However, as mentioned earlier medical devices manufacturers are struggling with the overhead introduced by regulatory controls, making it difficult to add new changes once the development is initiated and release small incremental changes to existing products.

(18)

One recent trend in the industry is to combine the standard approach to agile methodologies originated in the non-regulated software industry and move away from the classical plan-driven approach. The well-documented benefits of adopting Agile techniques such as reduced cost, increased software quality and reduced time to market, however, present some challenges in meeting the stringent regulatory requirements of the medical industry, limiting its current adoption. In a recent study, it was shown that several agile practices are already in use in the medical industry and a hybrid Agile V-model overcoming those limitations is presented. This model identifies 13 agile practices that could successfully be applied to medical devices product development (M. McHugh, 2013) and still meet the regulatory requirements.

Agile practices help in reducing the costs of the development process and bringing agility in a

historically rigid domain, but alone they do not solve all the issue encountered by today’s medical systems and the sequential approach imposed by the V-model. The main challenges faced during the product development are presented in the next sections.

Figure 7 - The Agile V-Model (Source: An Agile V-Model for Medical Device Software Development to Overcome the Challenges with Plan-Driven Software Development Lifecycles, M. McHugh, 2013)

(19)

B. Cyber-Physical Systems and Systems of Systems

Several recent trends such as miniaturized and low-cost sensors, increased communication speed and improved energetic efficiency allowed an increased number of objects to embed advanced computing and communication capabilities. This, in turn, is enabling the formation of large-scale system of systems that are becoming capable of operating independently. Those systems are being adopted in the implementation of critical functions in a wide range of sectors such as healthcare, transportation, environmental control and various industrial controls (Rajkumar, 2010). In this context, the term Cyber-Physical Systems refers to the generation of systems where collaborating computational entities are in intensively connected with the surrounding physical world and its ongoing processes (Monostori, 2014). The main characteristics of those systems are represented by their capability of recording, storing and evaluating different types of physical data using smart sensors, influencing physical processes, connecting to global networks and implementing various kinds of human-machine interfaces. CPS are seen as the enabling technologies that are allowing several innovations and are expected to facilitate new value propositions that could help to solve some of the critical challenges of our society such as climate change, energy supply & use, traffic management & mobility, personalized healthcare, and urbanization. At the same time, they are reshaping and having a disruptive effect on those industries, because of their impact on current manufacturing processes. As an example, the automotive industry is already profoundly affected by Cyber-Physical Systems, current vehicles are profoundly connected with a number of devices both internally and externally, and networks of autonomous connected cars are a reality. (Acatech Position Paper, 2011).

Considering that the CPS definition and architecture originated in the industrial world, there isn’t an extensive coverage of the term in the business-oriented literature. The concept, however, is tightly correlated with several emerging technologies such as Autonomous

Vehicles, Smart Robots, Internet of Things, Virtual and Augmented Reality, Machine Learning

and Digital Twins that are currently moving through the hype cycle (Gartner, 2017).

In particular, the ideas behind the Industrial Internet or Internet of Things (IoT) are similar to the Cyber-Physical Systems (CPS), and they have overlapping concepts, it can be therefore assumed that overall approach with dealing with CPS can be readily applied to the IoT as well.

(20)

The concept also has profound implication with the future of manufacturing and is the theoretical basis of the Industry 4.0 initiative, characterized by the horizontal integration across the entire value creation network, end-to-end engineering across the product lifecycle and vertical integration of networked manufacturing systems (T. Stock, 2016).

Considering the broad scope of CPS, the Cyber-Physical Systems Public Working Group (NIST) defined a framework that can be used as a guide for designing, building and verifying complex CPS (Cyber Physical Systems Public Working Group, 2016).

In their work, they highlight the following crucial characteristic when describing CPS: - CPS are frequently systems of systems

- CPS should be characterized by well-defined components - CPS should support application and domain flexibility - CPS frequently perform critical applications

- Security is a necessary feature of the CPS architecture - Data exchange is a prominent dimension of CPS operation

- Components should have an awareness of physical location and time - CPS architectures should support legacy component integration

As can be inferred the resulting complex inter-connections between the different subsystems operating in a coordinated manner, the interaction between the physical and virtual components, their possibility to evolve during the time and assume different configurations at run-time, increases dramatically the security and safety risks that need to be considered during the system development.

Similarly to other industries, the Healthcare industry is experiencing the connectivity of previously isolated devices, aggregation of different sources of data and live monitoring. Those elements are driving the creation of new Systems of Systems, enabling new forms of offerings and new clinical procedures capable of controlling simultaneously multiple aspects of the patient’s physiology.

The following main technological trends in the healthcare industry are influencing the development of Medical Cyber-Physical Systems:

(21)

- Advanced software-enabled functionalities: Implementation of new functionality into existent products or the design of entirely new offerings is increasingly dependent on software-based features.

- Increased connectivity and cloud computing: Different types of network interfaces are embedded in recent devices, allowing the creation of large-scale distributed medical systems, mainly in the area of patient monitoring and electronic health records management. Although the majority of communication capabilities still relies on proprietary communication protocols and interfaces, there is an ongoing effort toward more open interoperability.

- Continuous Monitoring and Care: The interest in remote and mobile monitoring increased tremendously, allowed by more sophisticated and cheap body sensors, coupled with improved connectivity.

- Physiologically closed-loop systems: The traditional scenario of having a human caregiver in the loop, proved several times to be a risk to the patient safety. The reliance instead on automated functionalities enabled by smart devices in a closed control loop is gaining traction. This is connected with the creation of increasingly complex physiological models.

- Adoption of AI-based technologies: Although far from being widely accepted, Artificial Intelligence-based solutions are gaining tractions, and promising more effective treatments and precise medicine.

Considering the trends described above and the unique cross-discipline elements of Medical

Cyber-Physical System (MCPS) covering different engineering and life science domains, there

are some unique challenges and opportunities in this domain (Insup Lee, 2010):

- Executable clinical workflows: Dynamic and custom clinical scenarios set challenges for patient safety, imposing careful and precise modeling of the clinical workflow. - Model-based Development: Modeling and requirements need to consider different

clinical scenarios before building the devices or systems.

- Physiological close-loop control: Complexity of the automatic controls, taking into consideration simultaneous treatments or complicated physiological conditions. - Patient Modeling and Simulation: Complex and comprehensive physiological models

(22)

- Adaptive Patient-Specific Algorithms: Overcoming the design and optimization based on “average” patients or population groups and moving toward personalized behaviors.

- User-Centered Design: increasing the attention toward usability in order to reduce errors that could lead to adverse events.

- Infrastructure for Medical-Device Integration and Interoperation: Increase the interoperability of devices between different manufacturers.

- Compositionality: Predict possible unexpected interaction between different devices. - Security and Privacy: Increased network capabilities open the door to external attacks. - Verification, Validation, and Certification: Current state-of-the-art practices plan the

verification and certification steps at the end of the design cycle.

In conclusion, the development of CPS and in particular MCPS will require new product design, verification, and validation techniques because of their increased size and complexity. In this direction, the Model-based Development should play a significant role, and at the same time, new regulatory procedures to approve their use are necessary as the traditional process-based regime accepted by international regulatory bodies is becoming too expensive and lengthy. This paper will provide an example of the application of Model-Based Engineering concepts to the development and validation of complex medical systems.

C. Model-Based Engineering

The complexity of today’s Cyber-Physical Systems is increasing the risks during development and leading to longer development time, with significant impact on the business case and innovation capabilities. Traditional engineering design methods are failing to keep the pace with the complexity and variability of today’s applications. At the same time, the significant number of components parts of today’s CPS is creating interdependences that need to be identified and verified during the system integration phase, increasing the cost of the overall system development.

Model-Based Engineering (MBE) is promising to solve some of the issues encountered when

developing complex systems of systems by reducing time, costs and risks by placing models at the center of the development process; it is therefore expected to become the standard

(23)

Although different definitions of MBE exist in literature, the discipline describes an engineering approach that focuses on a formal use of models for requirements elicitation, analysis, design, implementation and verification & validation (V&V) activities, throughout all the lifecycle of the system. Both the technical risk, concerning the uncertainties connected to the adoption of new technologies in a system, and the programming risk, concerning the impact on the development costs and scheduling, can be mitigated by adopting a model-based approach. Analysis of projects from the aerospace industry confirms that the primary source of delays is caused by requirements related issues found only during system integration, aggravated by the increased system complexity, the same is valid systems developed for the Healthcare domain. The main reason is that the currently adopted frameworks and tools for system design and verification, are mainly derived from the traditional “Waterfall” and “V-model” practices, which are unable to cope with the current complexity (refer to Current State-of-the-art in Product Development for more details about the V-model and the standard approach to V&V for medical device).

In contrast, the MDB approach is described as a top-down development process, that requires simulation and modeling at different abstraction levels and adopting a different viewpoint, the different levels are then linked together in order to enable the verification of each level against another and connecting the final system to the original requirements.

Adopting an MDB approach allows still to be compliant with the “V-Model”, but instead of focusing first on decomposing the different components (left side of the V-model) and then integrating them (right side of the V-model) at the end, the MDE approach allows a more iterative and incremental development and integration. It allows testing virtually at each step the system against the latest knowledge about it, without waiting for the hardware to be developed.

This increase the confidence that what is being developed meets the user requirements and that important safety and compatibility features are not overlooked, allowing more quick design activities (NDIA, 2011).

One approach to MDE is the SPES framework (K. Pohl, 2016). It relies on the principle of

“Separation of Concerns” and it useful for the incorporation of different stakeholders view

when developing complex systems, allowing at the same time the application of formal methods for the Validation and Verification process. According to the SPES modeling

(24)

framework, a system can be described by adopting different viewpoints and different degree

of granularity. Four main viewpoints are defined: Requirements viewpoint, Functional

viewpoint, Logical viewpoint and Technical viewpoint. Each of them can have multiple levels of requirements, functions and components description depending on the complexity, allowing for a stepwise approach during the building of the system model.

In the MBD view, the model becomes the sole source of truth, as it is able to incorporate the knowledge from different domains, reflecting the current state of the system development. The approach tries to overcome the issues that are encountered when the knowledge about the system is scattered, and multiple models are adopted by the different engineering disciplines often resulting in inconsistent and wrong assumptions. The developed model can help in the communication with the various stakeholders of the system lifecycle, as well as with highlighting the interconnections of different sub-module. It facilitates both the development and the manufacturing processes, by ad example propagating design changes automatically, allowing for a smoother consistency checking and error identification and avoiding building wrong and costly features because of wrong initial problem statements (A. M. Madni, 2018).

D. Virtual Prototypes and Model-Based V&V

According to the V-Model, the system validation activities assure that user needs have been covered, therefore that the system behaves as expected, while the system verification activities ensure that the system has been built correctly and in compliance with requirements. The clear disadvantage of this approach is that errors made during requirements definition or their decomposition are not discovered until the late system integration testing after all the subcomponents have been already developed.

As it can be easily inferred, the cost of correcting wrong requirements increases exponentially moving toward the end of the product development. Altering specifications in a late stage of the product development (e.g., during system integration) could have a domino effect because of all the different dependencies on the various sub-components. A generally accepted rule is that the cost increases by a factor of 10x at every stage of the product development. This is also aggravated by the tendency of having a more decentralized

(25)

the possibility to test requirements and their implementation in the early phase and more often compared to the traditional approach becomes trivial. (NDIA, 2011)

Figure 8 - Cost of a design change (Source: Use of a Model-Based Approach to Minimize System Development Risk and Time-to-Field for New Systems, NDIA Systems Engineering Conference, October 2010) In order to improve the development process, the MBE approach allows for early system verification and validation adopting Virtual Prototypes and Model-Based Testing.

This has several advantages. First, it allows checking if the developed component is behaving as expected (therefore according to specifications). Second, it allows checking if the component has been developed implementing the different system interfaces correctly and thus the whole system operates as intended. Finally, it enables to reduce the number of uncertainties and unknown specifications that generally increase the development risk. Adopting a model-based V&V, the full V&V activities can be potentially executed on the on the system’s model in an iterative way. At each iteration, the model becomes a more and more accurate description of the system, while the model verification assures that the model represents the system. Furthermore, all the testing methods that are defined when testing the model can be at the end applied to the physical system as well. (A. M. Madni, 2018). Virtual prototypes proved to be more efficient in evaluating the usability of the products compared to traditional methods based on physical prototypes, reducing the development costs and time (F. Faust, 2012). Furthermore, Virtual prototypes can be developed faster and cheaper compared to physical prototypes, and sophisticated features can be easily communicated to customers.

(26)

As shown in Figure 9 the envisioned methodology enables early validation of the user needs and the derived system level requirements thanks to the adoption of Virtual Prototypes. This allows identifying and correcting those specification defects that would otherwise propagate through the design until the late system integration and verification testing. On the unit level, Domain Specific Language (DSL) can be used to generate models and to test them during the product development sprints, allowing the software development to run in parallel to the hardware development and breaking the constraints of the classical V-Model sequential approach. Unit defects are therefore fixed quickly by the developers during each sprint, the resulting cost per defect is reduced by at least one order of magnitude.

Figure 9 - Development process adopting Virtual Prototypes (Source: SASG Presentations 61 - Virtual CathLab, Philips Healthcare, 2017)

As already inferred, the Virtual Prototype is composed not only by the graphic representation of the product but also by more complex functional and behavioral features such as Kinematics, Dynamics, and Stress. The Virtual Prototype, therefore, needs to implement various types of models and design artifacts developed by the different engineering disciplines (mechanical, electrical, software, physics, etc.), that in turn can allow the company to collect customer’s preferences among various options and implementation possibilities (K. Backhaus, 2014).

(27)

III. Framework/Tool

This section will briefly give an overview of the central concepts and constituents the proposed framework focusing on the application to the Health domain. Building upon the existing work done within the IGT organization, the ENABLE-S3 framework was applied for the definition of a dedicated virtual testing environment tailored to the specific needs of

Interventional Tools development. The rest of the chapter will explore the defined Key Performance Indicators (KPIs) for measuring the business impact, and will present the current

regulatory challenges together with some recent activities from the regulatory bodies that need to be taken into account for the formal adoption of the proposed virtual environment.

A. The ENABLE-S3 framework

This company research will apply the cross-industry framework developed within the ENABLE-S3 consortium for the certification of complex Cyber-Physical Systems. The objective of the ENABLE-S3 initiative is to develop technologies and methods that could substitute today inefficient and time-consuming product development techniques by promoting the adoption of virtual platforms and simulated models. At the same time, the novel testing techniques have the objective to improve the test coverage end cover a broader set of testing scenario necessary for validations today CPS.

A common practice during the traditional Product Development is to develop different types of models and representations of the desired behaviors of a system. However, every engineering discipline involved in the conceptualization of the product use its own and disconnected models (e.g., 2D/3D CAD representations, electrical wiring diagrams or electric circuit simulation, programming modeling techniques, etc.).What is currently missing is an integrated approach that represents the full knowledge about the built system, and that could be reused, shared and maintained easily over time, enabling faster development cycles. In order to overcome those limitations, the ENABLE S3 initiative is developing the missing technological component that would allow the adoption of simulated models during the validation and verification steps of the product development process.

The main parts of this novel methodology are the scenario based verification and validation, the adoption of virtual and semi-virtual environments, the adoption of modeling at different levels of the development and an integrated approach to safety and security. The theoretical

(28)

foundations of this approach are connected to the Model-Based Engineering concepts described in this study and are leveraging technologies and methods described in the Virtual Prototypes and Model-Based V&V section.

The below figure highlights the main constituent blocks of the proposed framework:

Figure 10 - Enable S3 V&V framework (Source: ENABLE S3 Abstract, ENABLE-S3, 2107)

The framework suggests the adoption of a reference architecture independent from the specific domain that consists of the following three main elements:

- V&V management: Covering the common aspects valid for the different testing phases and reusable for testing various products.

- Test management: Responsible for definition and control of test cases, the quantification of the results and the release of the system.

- Test platform: Representing the System Under Test and all the relevant environmental and infrastructure connections. The platform combines virtual and physical systems and can support different levels of abstraction.

(29)

The reference architecture is shown in Figure 11 below:

Figure 11 - Enable S3 Generic Testing Architecture (Source: D3.2.2 v1 V&V Methodology, ENABLE-S3, 2017) Considering its generic nature, applicable to any type of Automated Cyber-Physical Systems, the General Testing Architecture needs to be instantiated according to the specific use case. This is done by replacing the generic components with the particular “real” or “modeled” parts of the application, defining the specific tools used for the V&V and defining/mapping the requirements to each element. What is suggested is the use of formalized best practices that can be adopted in a multitude of situations and applicable to different products. The final step of the process is combining the defined testing architecture to the specific workflow that is used for the particular V&V activities.

The main logical elements of the Virtual Environment proposed for the health domain during the ENABLE-S3 project are presented in Appendix I – High-level overview of the Virtual CathLab. The CathLab Simulation is the actual modeling of the system, the Clinical Workflow is the modeling of the test scenarios based on real usage of the system in the clinical environment, and the Model Management is the necessary infrastructure for managing the different models and the various configurations of the Virtual System.

(30)

B. The drivers for the adoption of Virtual Testing Platforms within IAC

Before applying the ENABLE-S3 framework, it is important to clarify the motivations behind the choice of exploring the adoption of Virtual Testing Platform and Model-Based Engineering concepts within the IAC department.

This section will highlight those motivations and therefore answer the first question of this research: “What are the drivers for adopting Virtual Testing Platforms and MBE within IAC?” In order to provide a better understanding of the context, Figure 12 provides an example of a complete Interventional X-Ray system and represents the platform to which the

Interventional Tools are connected. The actual system delivered to the clinical user is however

highly customizable and adaptable to specific user needs, increasing the number of variables that need to be taken into account during the V&V activities. During this research, a Virtual Environment replacing the existing physical system is taken into consideration.

Figure 12 - Example of an Interventional X-Ray System (Source: Royal Philips website)

There are different motivations behind adopting Virtual Testing Platforms instead of physical systems within the IAC department. First, some functionalities of the Interventional X-Ray system could cause adverse events; it is well known that X-Rays are a potential source of harm to the human body and only allowed if there is a clinical need. Therefore, during the testing

(31)

access to those systems both in the hospital environment and during product realization is strictly restricted. Furthermore, the necessary infrastructure elements needed for protecting operators from a potential source of harm are quite complex and costly (e.g., lead walls, glass, etc.) limiting the number of systems available for testing during product development, those safety-related concerns became irrelevant with virtual systems as well as a significant decrease in costs for the installation and maintenance of new systems.

Second, the possible configurations of the Interventional X-Ray System are consistent; there are several types of options, accessories, and surrounding third-party equipment connected to it making every system unique. Tasting all those possible combinations becomes more and more difficult as the system evolves over the time. In addition testing the system in its final environment is usually limited by the availability of testing time at the customer site, the virtual clinical environment overcomes those limitations allowing for an easy switch between different configurations and options.

Third, new functionalities such as new robotics movements or new patient tables could be tested already at the early stage of development when the first virtual prototypes are available well before a physical prototype is developed. Helping therefore in building more correct implementations (e.g., early integration testing, early usability testing) and allowing a more iterative product design, resulting in shorter overall product development time.

Fourth, the set-up time and the cost of physical Interventional X-Ray system is consistent, limiting the number of available systems for testing. Usually, those systems are shared across different projects, and this requires careful scheduling of the testing activities. In turn, this creates undesirable complexities, increases the testing effort and the testing lead-time. In order to connect the above drivers to the specific requirements that will be described in the next section, the following objectives are therefore defined for the AIC use case:

- Increase the safety of operators by removing the risk of exposure to X-Rays - Reduce the test execution effort compared to conventional testing

- Reduce the test environment setup compared to traditional testing - Reduce the test environment footprint and operational costs

- Reduce the calendar duration of testing activities necessary for a product release - Enable an early detection of defects during the product development

(32)

C. The IAC Virtual CathLab instantiation

This section describes the activities performed during the company research project for the definition of the IAC Virtual CathLab instance tailored to the specific needs of Interventional

Tools development. It is hence answering the research question: “How to adopt the current methodology developed within the ENABLE S3 initiative within the IAC use case and thus for the development of Interventional Tools?”

For the specific instance applicable to the IAC use case the first step was to define the System

Under Test (SUT) that is going to be tested during the project, including the SUT architecture

and the set of activates that could be performed on it. This was done by combining the knowledge about the current Product Development at the IAC department process with the information derived from the semi-structured interviews with the primary stakeholders, as described in the Thesis research objective section.

As a result, the following activities have been identified as the one that could benefit from the Virtual Platforms within the IAC use case:

- Informal Software Integration Tests, addressing the integration of Interventional Tools with the whole Interventional X-Ray system.

- Informal Feature Tests, testing specific features of the system by using Virtual Prototypes of the Interventional X-Ray system.

- Software Unit Tests, allowing the test of individual software components.

- Usability Tests, addressing the usability of the system by clinical users without the need of having a physical system.

- Early Validation Tests, addressing the correct capture of clinical user needs.

The specific instance of the testing platform for the IAC use case was derived from the reference architecture presented in Appendix II – Detailed architecture of CathLab Simulation. Any of the shown building blocks can be a real component of the actual system in production or a model of it tailored to the specific application, with different level of abstractions. This means that there is the possibility to create different versions of the virtual platform while maintaining the same overall logic and governance around it and adopting the instance to the specific use case.

(33)

The next step was then to define the relative Test System Requirements derived from the specific use case objectives and linked therefore to the central question of this research project. One important concept to keep in mind when defining requirements is the separation between the Problem Space that covers the requirements specification and the Solution

Space that includes the technological components (Technology Bricks) developed for fulfilling

the requirements. Furthermore, each requirement should be traceable to a specific stakeholder need, including the defined use case objectives (upward traceability), and to the lower level specification (downwards traceability). The final step for defining requirements is to identify their acceptance criteria and to formulate them in a SMART way. This means that the requirements should be: Specific, Measurable, Attainable, Realizable and Traceable. The requirement definition process and the relations relevant to the requirements management are illustrated in Figure 13.

Stakeholder Needs Technical Core Requirements Technical Requirements Technical Items Technology Bricks

Problem Space Solution Space

Req u ir eme n ts Ma n ag eme n t

Figure 13 - Requirements definition process

After the Technical Core Requirements (high-level requirements), detailed Technical

Requirements (requirements for system functionalities) have been specified for each of the

modeled components. The specific technical requirements cover aspects such as X-ray System Geometry, X-ray System ACPS Control, User Interfaces and Test Machinery. The necessary

(34)

leveraged from already running projects within the different departments, although some adaptation was needed in order to fulfill the IAC use case.

The following four categories of Technical Core Requirements have been investigated, for each group one example of a requirement is given in Appendix III – Example of Technical Core Requirements. For the sake of brevity and their very technical nature, Technical Requirements and Technology Bricks are not discussed in this report.

1) Hospital Environment:

This category of requirements describes the interfaces with the hospital information system to which the Interventional X-Ray system is connected. It covers aspects such as storing and retrieving patient data and X-Ray images.

2) X-Ray System:

This category of requirements describes the proprieties that the virtual system should have in order to substitute the physical components and replacing real mechanics and real X-Ray radiation. It covers aspects such as system behavior, reaction time, interfaces, required User Interface, and required infrastructure conditions.

3) Room:

This category of requirements describes the relevant aspects of the hospital room in which the system operates and the interactions with the staff regarding the specific clinical workflow scenarios.

4) Plug & Play:

This category of requirements describes the capability of the system to evolve over the time, to support different configurations of simulated and real components and different types of models at various stages of the development process.

The proposed Virtual CathLab maintains the majority of the “real” behaviors of the

Interventional X-Ray System allowing an extensive integration testing of the Interventional Tools with it. Furthermore, it is possible to test the system both in normal conditions and in

simulated fault conditions; this is obtained by simulating external stimuli to the system or collisions with the external environment.

(35)

- Motion Control & System Dynamics, describing the motion behavior of the Interventional X-Ray system.

- X-Ray Imaging, implementing the X-Ray generation/detection and propagation through different media, as well as anatomical characteristics of the patient.

- 3D Visualization, converting existing 3D models of the system and extending them with 3D modeling of the room, clinical staff and external equipment.

The choice about what to model is also dependent on the underlying physics that is going to be included; it is essential to clarify once more that an exhaustive model for this type of application is not merely a 3D representation of the part or a simple feedback loop on the interface. As an example, the real-time X-Ray simulation required the development of a dedicated physical model based on Philips owned technology.

In order to obtain an immersive experience, the behavior of the system should be closed as much as possible to the real one, this means that the user interface (including the tactical, visual and acoustic feedback) should be modeled carefully and precisely, this is a crucial point for the usage of the virtual environment during the usability testing. The choice for the AIC use case was to adopt the Perspective Display option presented in Figure 14, which includes interfaces form the “real” system and a projected virtual geometry on the wall capable of changing perspective according to the user’s position. This solution enables a more realistic perception during the usability testing, and it does not require wearing additional accessories such as Virtual Reality Helmet-Mounted displays or Augmented Reality glasses.

(36)

D. Defining metrics and measurements (KPIs)

This section describes the activities performed for the quantification of the benefits of adopting Virtual Platforms for the development of Interventional Tools. It is hence answering the research question: “What are the expected benefits and how to quantify them?”

In order to understand the impact of adopting Virtual Platform within the IAC department, there is the need for an appropriate method to measure and evaluate the process improvements. During the research project, a set of metrics were identified and will be used for comparing the results obtained after adopting the Virtual CathLab with the current baseline. The specific set of KPIs was defined and connected to the relevant requirements introduced in the previous section; every requirement can be therefore traced back to a particular stakeholder need maintaining once again the parent-child structure introduced earlier. The developed KPIs are consequently grouped into different categories according to their relation to the different requirements resulting in the following four categories: Testing

effort, Testing duration, Cost, and Quality.

For each type, KPIs obtainable both from direct and indirect measures where considered, some examples are given later in this chapter. The following approach was adopted for the definition of the KPIs:

Objectives Definition Technical Core Requirements Technical Requirements Requirements Management Develop KPIs Identify available data measurement process & methodology KPIs Definition

Figure 15 - KPIs definition process

(37)

performance as described in (V. Popova, 2010). In order to define the relevant KPIs, a four-step approach was adopted, and it is presented below:

1) Establishing the goal of the proposed KPI considering appropriate stakeholders. 2) Defining formally the KPI.

3) Validating the actual measurability considering proprieties such as Quantifiability, Sensitivity, Linearity, Semantic reliability, Efficiency, and Improvement-orientation. 4) Defining conditions for deploying the KPI in the standard environment.

Before jumping to implementation, it is important to note that the preference should be given to those KPIs that are easy to adopt and do not require additional manual steps for their collection, limiting hence the introduced burden of measuring them.

Furthermore, existing operational data that is collected for a different purpose could be not always usable, as it could contain polluted or imprecise quantification of the defined quantity. The validation step of the actual measurability is therefore fundamental for selecting robust and appropriate KPIs.

Appling the above four-step process, the following KPIs have been defined considering the motivations driving the adoption of the IAC Virtual CathLab.

Category KPI description Rationale

Testing effort dKPI1: Average duration of the testing activities per FTE

The virtual environment requires less operator time compared to the physical system

dKPI2: Average duration of the testing environment setup

The virtual environment requires less time for setup compared to the physical system

Testing duration tKPI1: Calendar duration of the

testing activities

The virtual environment allows shorter duration of testing activates (including testing planning and management )

tKPI2: Calendar duration of the testing environment setup

The virtual environment requires lees infrastructures compared to the physical system

Costs cKPI1: Decrease in number of

persons required for testing

The virtual environment allows for higher automation, therefore, fewer operators

The value of virtual modeling in the healthcare industry : application of model-based engineering to the development of complex medical devices

The Amsterdam MBA