Formal systems engineering methods have been adopted by many industries including medical device manufacturing. In particular, the approach is used in pacemaker development.
Revo MRI Pacemaker
Courtesy of Medtronic
According to a paper from Carnegie Mellon University, “Formal methods are system design techniques that use rigorously specified mathematical models to build software and hardware systems. In contrast to other design systems, formal methods use mathematical proof as a complement to system testing to ensure correct behavior. As systems become more complicated and safety becomes a more important issue, the formal approach to system design offers another level of insurance.”1
Often, a design will be based on an existing device for which a great deal of performance data is available. If major faults have been observed, these alone may be sufficient justification to undertake the new development. However, there are several other possible reasons not linked to poor performance.
For Medtronic, a manufacturer of implantable pacemakers and defibrillators, the goal was to develop a pacemaker that allowed a user to undergo MRI scanning. Until the company’s Revo MRI™ Pacing System was introduced this year, pacemaker wearers took a chance if they had an MRI performed. Because the devices were not designed for use in a high magnetic field environment, many patients were advised to opt for other types of imaging that invariably lacked the clarity of an MRI.
The Revo MRI is based on the earlier EnRhythm™ Pacemaker System. Through several years of modeling, simulation, and testing, Medtronic identified and enhanced those aspects of the system most affected by MR scans.
The modified product is classified as MR Conditional by the FDA, indicating that certain restrictions apply to the product and the way in which the MRI is performed. To distinguish the modified version of the EnRhythm device from the original, the enhanced device was renamed the Revo MRI.
Pacemaker Operation
A healthy heart generates about 60 beats per minute (bpm) when at rest and 120 bpm or more during strenuous activity. The heart’s contraction is complex, originating as an electrical nerve impulse in the right atrium at the sinoatrial (SA) node and progressing in a wave-like manner to the ventricles. The right ventricle pumps blood to the lungs to gain oxygen. From the lungs, blood enters the left atrium and then is pumped to the rest of the body by the left ventricle.
If the SA node does not initiate the contraction, the atrioventricular (AV) node between the right atrium and ventricle can cause contractions but at a slower rate. Medical conditions that affect the SA node or the propagation of the contraction signal to the ventricles are the types of heart problems for which a pacemaker may be appropriate. Technically, a pacemaker is a cardiac rhythm management device.
Pacemakers are about 2″ in diameter and 3/8″ thick, regardless of manufacturer. They are implanted in the pectoral area and connected to the heart by one or more flexible leads. The lead design is critical because it must withstand flexing inside the patient’s body while remaining securely attached inside the heart. The life of a pacemaker and lead system is limited to about seven years, generally because the pacemaker battery becomes depleted.
Unipolar leads contain one conductor, and the circuit is completed between it and the titanium case of the pacemaker. Bipolar leads often have a coaxial construction with the inner conductor extended about one centimeter farther than the outer one. The voltage pulse is developed between the inner and outer conductors. The lead also serves to sense the voltage developed at the ventricle or atrium when the SA node is operating normally.
Rather than generating pulses at a fixed rate and amplitude, modern pacemakers feature adaptive pacing. They monitor the SA node activity to ensure it is neither too fast (tachycardia) nor too slow (bradycardia) and only administer pacing pulses if the SA node has not done so within a certain time. Also, the output pulse level and width can be programmed to ensure capture. That is, the pulse will be large enough to guarantee that a heartbeat is initiated but not so big that battery power is wasted.
A number of medical conditions can be treated with pacemakers by varying their application as well as basic design. The columns in Table 12 list the factors that differentiate one pacemaker from another. The dual (A+V), dual (A+V), dual (T+I), rate modulation (DDDR) designation is becoming popular because it can be used in place of more application-specific designs. However, it also is more expensive. The last column helps to describe applications such as biventricular pacing in which the two ventricles are paced at appropriate times to optimize heart pumping efficiency, for example by a ventricle, ventricle, inhibited, rate modulation, ventricle (VVIRV) device.
Table 1. The Revised NASPE/BPEG Generic Code for Antibradycardia Pacing
I
II
III
IV
V
Chamber(s)
Paced
Chamber(s)
Sensed
Response to
Sensing
Rate
Modulation
Multisite Pacing
O = None
O = None
O = None
O = None
O = None
A = Atrium
A = Atrium
T = Triggered
R = Rate Modulation
A = Atrium
V = Ventricle
V = Ventricle
I = Inhibited
V = Ventricle
D = Dual (A+V)
D = Dual (A+V)
D = Dual (T+I)
D = Dual (A+V)
Pacemaker Development
The formal systems engineering approach that underpins pacemaker development emphasizes integrated simulation and test throughout the project.
J. Max Cortner, director of test engineering at Boston Scientific, a pacemaker manufacturer, described the process. “Prior to approval of a product, multiple types of tiered testing are performed to confirm proper integration of new and legacy components and features within the system. Using a hierarchical model of component-to-subsystem-to-system assembly, testing occurs at each component and integration level. A component entity can be either hardware or software,” he continued. “At the lowest tier of product integration, thorough testing of individual software and hardware components is performed.
“Design verification of the implanted device behavior uses Model As Oracle Verification. A validated executable model simulates the system behavior that is implemented in a combination of hardware and software,” Mr. Cortner explained. “As new feature requirements are added to the system, the model is extended to reflect the new behaviors. Actual devices are compared to the model to verify implementation. Tens of millions of comparisons are performed with this verification.
“The highest level of hierarchical system integration occurs at the interface of the implanted pacemaker or defibrillator and the external device setup and monitoring equipment with which it communicates. Thorough system engineering principles are employed to determine focus areas for system integration testing at this level,” he concluded. “Hazard mitigations visible at the system level, feature interactions visible at this level, and signals exchanged between the implanted device and the external device are thoroughly tested.”
The types of tests cover a wide range of categories:
- Verification of system requirements.
- The software/electronic/communications interface between the implanted device and external equipment.
- Simulated real-world use.
- The use of recorded heart signals as actual inputs into the implantable device to validate that the device recognizes them and responds appropriately to each individual signature.
- Environmental noise of the implantable-device-system in a hospital environment with ambient equipment interference.
- Interaction of the implantable-device-system with equipment like an external defibrillator and an electrocautery machine in a saline environment simulating the human body.
- A test device implanted in a live animal and subsequently monitoring and performing follow-up tests on the animal.
At the beginning of a project, the broad objectives are clear, but many of the details are not known. As described in the transcript of Medtronic’s Revo MRI presentation before the Circulatory System Devices Panel, a large amount of data had to be gathered and analyzed before the MR risk could be understood and the appropriate tests developed.
Sandy Wixon, MRI technology group leader at Medtronic, explained that the strengths of the fields produced by MR scanners are limited by human physiology. The field levels stated in IEC 60601-2-33 Particular Requirements for the Safety of Magnetic Resonance Equipment for Medical Diagnosis reflect these limits.
Two effects caused the greatest concern. A high MR gradient field results in peripheral nerve stimulation, and an increase in body temperature is associated with the RF field. For a pacemaker patient, peripheral nerve stimulation could allow the MRI machine to control the pacing rate. Increased body temperature could manifest itself as localized heating at the tip of the pacing lead with an associated increase in the capture threshold. In other words, the pacemaker pulse might no longer be large enough to control heartbeat initiation.3
MRI Development
To address these concerns, the development program used a three-stage approach: analyzing the MRI environment, designing the Revo MRI Pacing System, and testing the system to confirm safety when used according to the labeling. Many MRI scanners were tested, some as old as 15 years. The gradient field strength varied by a factor of 4:1 among the scanners tested.
“Medtronic created a library of 22 human-body models spanning the 2nd to 97th percentile of the adult population,” Mr. Wixon said. “Each tissue type has a different electrical parameter such as conductivity assigned to it. When an RF simulation is performed, the electrical parameters for each tissue ensure an accurate 3-D representation of the electric field in the body. The electric field in the vicinity of the pacing lead determines the amount of energy and the amount of power that will reach the tip-to-tissue interface.”
In addition, the company modeled 100 lead paths from the typical left or right pectoral implant sites to the heart. Mr. Wixon described the extensive simulation performed before any animal or human testing. “The power delivered to the tip-to-tissue interface is determined for each lead path in each human-body model as the body is moved through the relevant positions in the scanner bore. The result is a probability distribution of power delivered to the tip-to-tissue interface resulting from an MRI scan,” he explained. The analysis included more than 400,000 simulations.4
A series of in vivo tests involving six canines and 18 leads was defined based on the simulation results. Lead-tip heating was investigated at a range of directly injected RF power from 130 mW, considered the highest practical clinical level, to 390 mW. No change in the capture threshold was observed at 130 mW, and only a temporary increase occurred at 390 mW. No cumulative effect was noted following multiple scans—a specific question the FDA had posed.
To mitigate the danger of peripheral nerve stimulation, a two-prong approach was used. The pacing generator is susceptible to signals picked up by the lead. The pacemaker input capacitance was optimized and the circuitry modified to ensure that RF entering the device would not be rectified to appear at the output as narrow pacing pulses. In addition, the Revo MRI main PCB is isolated from the case. Only bipolar leads are used with this device to minimize the lead path loop area and RF pickup.
The lead also was modified to reduce RF pickup and the associated temperature and capture threshold increases at the implanted tip. The earlier Model 5076 lead construction featured a quad-filar outer conductor. According to Mr. Wixon, the number of filars was reduced from four to two. Decreasing the number of filars increased the number of turns and the inductance, reducing the amount of RF power that can propagate to the lead tip.5
The diameters of both the wire and the coil were increased to achieve the same strength and reliability as the previous quad-filar lead. Engineering analysis performed on the new Model 5086 lead, flexed at a standard test radius, found it to have 50,000-psi stress compared to 66,000 for the 5076.6 Based on the simulations and actual test results, sufficient confidence existed to conduct a clinical trial to confirm those results.
Dr. Bruce Wilkoff, director of cardiac pacing and tachyarrhythmia devices at Cleveland Clinic and a paid consultant for Medtronic, explained how the trial was organized. “This was a prospective, randomized, multicenter clinical trial. There were 464 patients implanted at 42 international centers. The patients were randomized at implant to receive an MR scan or not to receive an MR scan. Enrollment was between February 2007 and July 2008, and follow-up continued through November 2008 for an average of 11.2 months,” he said.
Of those implanted, 258 patients were selected for scans but only 211 actually underwent scanning. There were no MRI-related complications.7
Interestingly, during the initial Medtronic presentation to the Circulatory System Devices Panel and the subsequent FDA presentation, a great deal of time was spent analyzing and discussing the 47 patients not scanned. Dr. Terri Johnson, an FDA statistician, delved into the design of the clinical test and how well its three primary and seven secondary objectives had been met. In particular, she assessed the importance of incomplete or missing data.8
Anticipating eventual FDA approval and encouraged by the successful smaller clinical test, Medtronic proposed a post-approval, large-scale, long-term clinical trial. It would involve 1,810 patients and extend over more than five years.
The primary objectives, as described by Daniel Canos, an FDA epidemiologist, were to demonstrate that the MRI-related complication proportion would be less than 2% and that the complication-free survival probability for the Model 5086 MRI lead placed in the right atrium or right ventricle would be greater than 92.5% at five years.9
Pacemaker Production Testing
Pacemaker test cannot be exhaustive. Nothing can be done during test that causes excessive current drain from the battery or the device life will be shortened. On the other hand, the correct operation of all the features must be verified.
Starting at the circuit board assembly, traditional stuck-at logic tests, shorts and opens, algorithmic memory tests, and IDDQ current tests are applied. Because of the high reliability required in pacemakers, Boston Scientific’s Mr. Cortner explained, “thousands of test results for each part are uploaded to a central database. Using this data, process trends are monitored and statistical outliers are rejected.”
A modern pacemaker does a lot more than just regulate the heart rate. In addition, most contain an RF communications channel through which trained personnel can program the device as well as download performance data from it. IC BIST testing augments the basic PCB testing as does analog boundary-scan tests that include small resistors and capacitors. As much as possible is tested before sealing the case.
Mr. Cortner picked up the test description after the case has been sealed. “Only the heart connections and telemetry are available. Most tests are functional with the equipment simulating heart waveforms and programming the device, then measuring the response waveforms. Data from earlier tests is used to trim the device for optimum performance,” he said. “Sensitivity to heart inputs is confirmed as well as pacing output voltage, timing, and current. Each defibrillator is instructed to execute rescue therapy, and the multiple shocks are absorbed by the test loads as they are measured for energy and timing.
“Although testing is functional, the selection of scenarios assures that all critical functions operate,” Mr. Cortner explained. “Since modern pacemakers and defibrillators have a large array of possible program settings, exhaustively testing all settings is left to design verification. Test data, including measured parameters and pass-fail results, is uploaded to a secure part 11-compliant database during the manufacturing test. This data is mined and analyzed in real time to alert production about process trends and test equipment malfunctions. Even when the results are passing, an unusual distribution of results may suggest the need to perform preventive maintenance on a particular piece of test equipment that is performing statistically differently than the rest.”
The comment about a secure part 11-compliant database refers to the Code of Federal Regulations Title 21 Food and Drugs, Chapter 1, FDA Department of Health and Human Services, Subchapter A, Part 11, which governs electronic records and electronic signatures. Data stored in a database that complies with Part 11 may be submitted to the FDA in lieu of written records.
Testing After Deployment
When you have a pacemaker implanted, you join a group of approximately 1.5 million people in the United States who already have one. Your health, the health of your pacemaker, and any problems encountered in its use periodically are entered into a large database that each pacemaker manufacturer maintains. The manufacturers regularly publish material based on that data.
Sometimes the information is educational. For example, in a recent Medtronic Cardiac Rhythm Disease Management (CRDM) Product Performance Report, the 2.6-V plateau characteristic of partial discharge in the company’s lithium/silver vanadium oxide battery chemistry is highlighted. Unless a practitioner was familiar with the discharge behavior, he might confuse the 2.6-V plateau reached at the middle of a pacemaker’s life with the 2.55-V level that indicates the elective replacement interval has been reached, typically much closer to the end of device life.10
However, most of the information in the detailed reports relates to pacemaker and lead reliability. Jon Mace, senior director of quality assurance in the cardiac rhythm management division at St. Jude Medical, a pacemaker manufacturer, said part of his job is to try to figure out what has happened when a problem is reported.
“Our newer models feature remote monitoring follow-up. While a patient sleeps, the device downloads data to a small bedside transmitter that communicates through the telephone network to a large database and the patient’s physician. The pacemaker devices are very reliable, but often something occurs, and we need to determine if it is a real problem or not. We will try to address that either on a single case basis, or we’ll attempt something that will improve the product’s performance.”
Mr. Mace said that all pacemaker companies are required to publish product performance reports. In his experience, physicians and even St. Jude Medical’s own representatives welcomed the information because they could be certain of how a particular product was performing in actual use.
The telemetry capability operates in both directions. Data downloaded includes information such as measured lead impedance, battery voltage, and the programmable settings. Mr. Mace explained that the range of data might give a physician insight into how a patient’s heart was behaving because the pacemaker responds in a certain way to the patient’s heart condition. For example, if a patient complains that he feels sluggish and the pacemaker has been set to a fixed 60 bpm, perhaps the physician will decide to reprogram it.
Regularly scheduled follow-up visits provide the physician opportunities to review how the patient and the device are getting along. There are so many possible combinations of settings that Mr. Mace commented each device may be programmed slightly differently. Depending on the programming, the battery capacity can be used more quickly. Alternatively, a patient’s characteristics may change with time and affect battery life.
Summary
St. Jude’s Mr. Mace confirmed that pacemakers have become a mature technology. There are few major breakthroughs anticipated, but a large number of small improvements are being made based on real field data. In addition, research continues in the background to better understand how future requirements might affect the product. For example, lead-free solder is not required to be used in implanted medical devices today, but it probably will be in the future. A group at St. Jude is determining its effect.
As new devices with enhanced capabilities enter production, even more information will be accumulated under different operating conditions. As part of the ongoing formal systems engineering approach, the device models will be extended to reflect the new features and used for numerous simulations. In some cases, large-scale clinical post-approval trials will gather data to verify the models.
References
1. Collins, M., “Formal Methods,” Carnegie Mellon University, 1998, http://www.ece.cmu.edu/~koopman/des_s99/formal_methods/
2. Bernstein, A. D., et al, “The Revised NASPE/BPEG Generic Code for Antibradycardia, Adaptive-Rate, and Multisite Pacing,” Journal of Pacing and Clinical Electrophysiology, Vol. 25, No. 2, February 2002, p. 261.
3. Circulatory System Devices Panel, Center for Devices and Radiological Health Medical Devices Advisory Committee, U.S. Department of Health and Human Services Food and Drug Administration, March 19, 2010, p. 7.
4. Circulatory System Devices Panel, p. 8.
5. Circulatory System Devices Panel, p. 10.
6. Circulatory System Devices Panel, p. 19.
7. Circulatory System Devices Panel, p. 11.
8. Circulatory System Devices Panel, pp. 25-28.
9. Circulatory System Devices Panel, pp. 28-29.
10. “CRDM Product Performance Report,” Medtronic, April 2011, p. 156.