Industrial/Medical

FDA Outlines Oversight of Mobile Medical Applications

By Peter MacKay

2011 is turning out to be an evolutionary year for the growing mobile healthcare industry.  In 2007, the iPhone, while not the first handheld applications platform, arguably revolutionized the way modern consumers use telephones.  Around this time healthcare visionaries also foresaw the integration of what I call “user space” with medical enterprises, and a general change in the way ‘patients’ interact with providers – or even take charge of their own wellness.  In addition, the Continua Healthcare Alliance was born, a consortium uniting healthcare and technology companies to focus on standardizing connected devices.  I predict this standardization will drive commoditization (as the inverse – utilizing consumer platforms in healthcare – takes hold), and the Android platform has accelerated this movement.

What makes 2011 “evolutionary”?  Clearly there are regulatory implications when healthcare applications co-exist with consumer platforms.  In February, the FDA ‘finalized’ guidance on Medical Device Data Systems (MDDS), an initiative it had started in 2008.  On July 21, the FDA released draft guidance on mobile medical applications, perhaps influenced by the mHealth Regulatory Coalition which was created to work with the FDA to write a guidance document that addresses what gets regulated and what does not. 

While the February ruling defines MDDS and its intended use, the latest guidance further discerns a “mobile” application.  It calls out two categories of applications: an app intended for use with a regulated device, and an application intended to transform a mobile platform into a healthcare platform – with “intended use” claims being the qualifier.  The guidance excludes app stores and their operators, but expects service providers to cooperate with manufacturers in correction or removal actions.

What the FDA is trying to do with this guidance is encompass anything that poses a threat to the safe and effective operation of medical devices, so if you’re in the business of positioning your mobile apps toward healthcare providers, or even patients as end users, it will be important to pay close attention to this regulation and take the necessary steps.  This new guidance is a draft with 90-day commentary period, so if it affects your business act now or forever hold your peace!

When embedded software testing is a life or death issue

By Ido Sarig

When I was in high school, there was a popular TV show called “Moral Dilemma” that aired in my native country. It featured a panel of professionals such asdoctors and lawyers who discussed “life or death” issues related to their daily work:  Would you represent and defend a client charged with murder after he confided in you that he indeed killed his victim? A kidney has become available for transplant – do you operate on the rich, 85-year-old patient who promised to bequeath a million dollars toward the creation of an organ bank at your hospital, or provide the kidney to the teenager who was just accepted into the country’s most prestigious college?

The show portrayed these professions as dealing with the most important moral issues imaginable, and by implication, relegated other professions to a lower rung on the ladder. As someone growing up from a family of engineers, I knew engineers can have significant roles to play and I definitely had respect for other professions not represented on this TV show. However, it did get me to thinking: Were there also life or death issues in software?

Fast forward 30 years, and I know that there are indeed life or death scenarios in the world of engineering and software. Embedded software is a vital element in the majority of today's sophisticated medical devices—and when it fails, disastrous results follow.

The other day, I was reading  about a (yet another!) FDA Class I recall of infusion pumps.  This particular recall was ordered before any malfunction actually impacted a patient, but previous instances were not so fortunate. Problems with infusion pumps have been linked to more than 56,000 reported complications over the past five years, including at least 500 deaths.

The irony (if you can call it that) in this particular recall is that these specific infusion systems feature a wireless radio enabling remote programming that was being marketed as a patient-safety solution to manual programming errors - yet it was precisely this wireless radio component which failed and triggered the recall. According to the FDA, when used in a wireless network environment that utilizes Temporal Key Integrity Protocol (TKIP) authentication, a particular brand of compact flash can potentially induce a memory leak that can cause the Management Processor to become non-responsive. This causes normal operation to stop, preventing the pump from delivering the medicine with no visual error warning to alert the user that the pump is not working.

How does this happen? A key element to consider in this situation could be insufficient medical device testing.  As device software grows in functionality and complexity, the process to test and verify that it works correctly becomes increasingly complex and difficult. Medical devices manufacturers have a nearly endless matrix of combinations that require testing.  Making matters worse, market dynamics force device manufactures to shrink their product development cycles, leaving less time than ever for comprehensive testing programs.

In this case, it would have been critical to test not only the Motorola Compact flash which failed vs. some-other-vendor's flash, but also the use of TKIP vs. other authentication protocols [the device supports at least 4: WEP (40 and 128 bit keys), WPA-PSK or WPA2-PSK), 3 different wireless LAN standards (802.11 a/b/g), and 2 ways of obtaining IP addresses (Static or Dynamic (DHCP)]. So, there are 24 different configurations for each type of compact flash just to test basic wireless connectivity issues, and this is before we even get the functional testing of the various infusion modes, dosage programming modes, error code checking etc…

And this is where the moral issues come into play. Exhaustively testing every possible combination of software and hardware would likely take many months, and would have to be repeated every time a new software version is released by the developers, which happens quite frequently during the development cycle.

The manufacturer does not operate in a vacuum: there will always bemarket pressures and competitors releasing new models as well. But is it right to release a medical device that has not been thoroughly tested in order to better compete? And how do we know enough testing has been done to sufficiently cover all the complex functionality that goes into modern infusion pumps?

Luckily, we can reduce some of this uncertainty by using tools like Wind River Test Management  – which provide us with clear indication of which parts of our code has not been tested at all, help us focus our testing efforts on those risky parts of the code, and provide management with insight into the quality of the device they are about to ship.

I recently discussed some of these issues at a Webinar titled. “Medical Device Software Testing: A Life-and-Death Challenge.” You can view a recording of it here, and learn what you can do today to improve the quality of software in your medical devices.

Strengthening Security for Connected Medical Devices

By Santhosh Nair

Three years ago an article in the New England Journal of Medicine reported that computer hackers could gain wireless access to implanted pacemakers and shut them off, or reprogram defibrillators to deliver fatal jolts of electricity. This generated an avalanche of press worldwide about the hidden risks of medical devices, followed by requisite hand-wringing from politicians and promises of stiffer regulations. For this and other reasons, makers of medical devices have been steadily increasing their focus on security. They realize that the threat is far broader than a hacked ICD. Embedded software is part of everything from CT scanners to imaging systems to intensive-care ventilators. And the fact is, the rapid growth in the number, the intelligence, and the interconnectedness of medical devices has created an upward spiral in security threats. 

Just a few examples:

● Diagnostics, therapy, and imaging devices are connected in the Hospital Imaging System (HIS), and a vulnerability in any one device puts the entire HIS at higher risk.

● In the United States, hackers have been able to glean personal patient data by eavesdropping on signals from wireless radios embedded in implants. 

● Security experts are worried that hackers might go after the medical devices designed to deliver medicine. In 2010, Dr. Tadayoshi Kohno and William Maisel of the Cardiovascular Institute of Beth Israel Deaconess Medical Center in Boston called for the FDA to regulate and work with medical device manufacturers to stop potential security breaches in a wide range of wireless devices.

● In Australia, the computer dispatch system for an ambulance service was infected by a virus, forcing staff to shut it down. As a result, health officials had to revert to coordinating the state’s paramedics and ambulances via a manual paper-based system—putting lives at risk.

Equally alarming, security exploits are being perpetrated by a new breed of hackers. It’s not just smart kids trying to breach a firewall for sport anymore. Professional, well-funded groups—including organized crime, government agencies, and terrorist cells—are attempting to crack into secure networks, access sensitive information, and alter the behavior of critical systems, causing physical harm to equipment and potentially putting lives at risk.

These security concerns have resulted in the formation of the Medical Device Innovation, Safety and Security Consortium (MDISS), a non-profit organization created earlier this year which aims to advance computer risk management practices.  The consortium is focused on optimizing the relationship between the quality of healthcare and the process of assessing and ensuring that devices and systems are secure.

For the developers of medical devices, two things have become crystal clear: first, tackling the emerging security challenges is an urgent imperative; and second, solving security issues can create significant competitive advantages. 

That is why medical device developers are now taking a more holistic approach to device security. Development teams are considering security issues at every layer of the development stack: the hardware platform, the virtualization technology, the operating system, the network stack or other communications middleware, the packets of data being sent across the network, and the applications.

By taking a platform perspective to security, and by harnessing the efficiencies of cyber-security-certified components, medical device developers can cut development costs and timeframes while actually decreasing overall security risks. That signals more than a paradigm shift for embedded developers—it’s a true transformation that will result in more secure medical devices and stronger financial results for development firms and the healthcare industry.

Highlights and hot topics from the Medical Devices Summit

By Santhosh Nair

There were a lot of great takeaways from the Medical Devices Summit that I attended last week in San Diego.  Wind River solutions architect Pete MacKay gave an excellent presentation about medical devices design, cloud and Android that was very well received and Intel ECG presented on embedded security and isolation/protection in medical device design.  Wind River had a booth where Michel Chabroux and Gabriel Quiroz showcased our Atlantis platform for connected medical devices - they demonstrated data traversing from an edge device (a weighing scale), all the way through the aggregator device to the final application.

Throughout the event, the topic that seemed to be on everyone’s mind was compliance.  Not surprisingly, conversations around regulations and compliance overshadowed many of the technology discussions.   Most of these talks centered on how to manage risk in your development process, the importance of having excellent design controls in place, managing suppliers and variance in your supply chain logistics, and how to navigate the regulatory maze and not get caught up in the trivia. 

Medical device manufacturers are focused on managing risk for creating safe and effective devices for the market. Having a solid risk management process, deploying tools and workshops to iron out the risks in product design, development and safety, and mitigating risk are critical to getting a device approved for the market. You may even get to market, but a lack of solid processes and structure will not keep you there for long. So what does that mean for suppliers of software and services?  They need to invest in processes and compliance that help ease the customers’ pain -- this means having a solid software development process and having the ability to provide traceability and artifacts for the software that they provide. 

Overall, a key takeaway from the show is that having a solid compliance story is essential to being a credible player in the industry. In fact, Wind River is doing a lot on the compliance front.  So, stay tuned for more compliance-related breakthroughs for our various platforms – as well as compelling compliance collaborations to develop assurance cases for medical devices.  It’s an exciting time to be in the medical space!

The Dawn of a Paradigm Shift in Embedded Device Software Security

By Marc Brown

The number of connected embedded and mobile devices is increasing exponentially, predicted to be in excess of 50 billion by 2020.  The lion’s share of this growth is expected to come from traditional market segments where there is an increasing push to transform sensing equipment to more autonomous embedded control, real-time telemetry, and proactive diagnostics. We all know website hacking is nothing new, but just imagine having your public water utility meter, your automobile safety functions, our public transportation traffic sensors, or even the national power grid being hacked by organized criminals or nation states.  This tsunami of connectivity and more intelligent control is creating a huge increase in security vulnerabilities that can impact financial profitability, public services and safety, and national defense. 

Many of today’s most advanced embedded control systems are based on a collection of standalone components – embedded operating systems, virtualization technologies, communication stacks, middleware, and application code.  These standalone products, and the companies that create them, lack the integrated security support required in today’s highly connected world, offering overall solutions that are only as safe as the weakest link. 

McAfee and Wind River have formed a strategic partnership to develop and support comprehensive, purpose-built security solutions specifically designed for these next-gen embedded devices.  This partnership will combine the security expertise from both companies, powering security solutions that support all software layers.  It’s our belief, that it’s time to proactively define and accelerate solutions that protect the functions a device is expected to perform and the data that it accepts from the cloud.

Given the huge liabilities and increased security activity, with over 55,000 new unique malware found on a daily basis, all companies developing embedded products will need to have strategies in place to cope with increasing security requirements.  Only Wind River and McAfee can handle the broad types of security vulnerabilities effecting embedded devices today.  By combining Wind River’s core security-certified runtime technologies, with McAfee’s whitelisting, anti-malware and global threat intelligence capabilities, we’ll be able to support a broad array of connected M2M capable devices for industrial automation, energy, medical, networking, consumer electronics, aerospace and defense.

It’s obvious that security and secure embedded solutions have become a necessity.  It’s also known that cyber attacks, global connectivity, and the associated risks are on the rise, accelerating at a near exponential rate.  Wind River and McAfee have defined something fundamental, something new, on the forefront of embedded solutions, which will solve the growing security requirements and aid in its evolution.  We are no longer in a world only concerned about performance, footprint, and connectivity…the world of highly performing secure embedded solutions has arrived.

 

Security is getting more critical every day in embedded software

By Bill Graham

A typical security discussion is usually about hackers getting into corporate IT systems or viruses on home desktops. Embedded systems have not always been the target for malicious attacks but times have changed. Embedded devices are more sophisticated and interconnected and in many cases connected to the Internet. This interconnection and Internet awareness has great benefits for expanding the ubiquity and usefulness of embedded devices in our lives. For example, a home environment monitoring system could monitor your house air quality with half a dozen wireless sensors that use a lower power local area network to your thermostat. Your thermostat could host a small web server on the Internet that lets you login and monitor and control your household temperature and humidity. Sounds great, right? It won't be that great if someone hacks into your system and turns the thermostat to 90 degrees and turns your house into a sauna! This is a trivial case but you can see how this could extend to a sheet metal press in a factory, elevators and escalators, or a chemical control valve in an oil refinery.

We can decide that all safety critical devices are never to be connected to the Internet and that only private wired networks be used (presumably with physical protection as well). This is not practical because there is so much to be gained from having these devices wireless and Internet-connected. The alternative is to attempt to make embedded devices as secure as we can. An important step in doing this is extensive intrusion testing of embedded devices through their network connection - the most likely place for external attacks. One such test suite is the Achilles Certification by Wurldtech that we recently achieved for VxWorks. In fact, VxWorks is the first RTOS to be Achilles certified - a test that throws all sorts of badly formed packets and disruptive network traffic patterns at our network stack. It's important to note that the VxWorks network stack includes a firewall which is critical to intrusion protection but not typically available with RTOS networking software. VxWorks is an extremely configurable RTOS which means our customers can include only the parts of the OS they need for their application. Importantly, it also allows customers to configure more secure versions of the RTOS by excluding debug and other non-critical components. Configuring the system to have just what is needed and to explicitly exclude non-secure components is a critical step before device production.

Why is it important for commercial RTOSs to be certified to standards like Achilles? Because, our customers want to know they are building their systems on reliable and secure platforms. In fact, Achilles certifications are typically done on a system level. By using a pre-certified RTOS like VxWorks means a much higher probability that you pass the test - greatly reducing debug, fix and test cycles. In the end, security and reducing risk, time and effort are main reasons commercial RTOS offer value in the embedded software marketplace.

What else is new in Tilcon Graphics Suite version 5.8?

By Bill Graham

Although adding OpenGL 3D support was an important part of the recent Tilcon 5.8 update, there's other things to talk about in the new release. It adds other new capabilities such as increased hardware, driver and target OS support, and image rotation capabilities.This is also the first release of the Tilcon Graphics Suite to include source code for customers wanting to tune the Tilcon GUI engine configuration and build.

Tilcon Graphics Suite 5.8 now includes the Wind River Media Library (a.k.a. WindML) which is a graphics and audio framework that provides a high degree of architectural and hardware independence for application code. WindML provides interfaces to (including Tilcon GUI engine) on VxWorks, X.Org, OpenGL (including accelerated 3D support from our partner Presagis) and 2D UGL APIs plus various input devices such as touch screens, pointers and keyboards. WindML provides a common interface for graphics display drivers and acts as the abstraction layer form application to hardware devices. The advantage of this for Tilcon customers is the wide range of available graphics drivers for VxWorks and X.org and the abstraction provided means Tilcon apps don't need modification when switching hardware. Future driver support is simplified due to the WindML abstraction layer and the common driver architecture.

This release reintroduces runtime support for Microsoft Windows CE and XP and continues our support for Wind River Linux and other Linux distributions. Tilcon 5.8 is available for Power Architecture, ARM and Intel Architecture (including Atom) devices. For this release we have introduced support for the following reference platforms:Texas Instruments OMAP 3530, Freescale i.MX 31 Lite and MPC5121e, Portwell Nano, and Intel Navy Pier

Image rotation capabilities are new for version 5.8 and spport 360-degree rotation for raster images using APIs or the Tilcon Interface Design Tool.

Here's another video showing a series of example UIs designed with Tilcon and running on the Tilcon GUI engine:

Tilcon in 3D

By Bill Graham

Today we announced our latest release of Wind River Tilcon Graphics Suite, version 5.8. This is an important release for us for many reasons. One is this addition of OpenGL version 2.1 3D graphics to the Tilcon Graphics Suite (specifically for VxWorks runtime platforms). The need for 3D graphics is growing in embedded devices because User Interfaces (UI) are becoming more and more sophisticated. For medical devices this may mean 3D images of internal organs, joints, etc. For industrial devices it might mean 3D data representation, maps, or orthographic displays. For aerospace and defense, Heads Up Displays (HUD), radar and other display types do or will leverage 3D graphics. For consumer devices 3D graphics are already used for mobile gaming. 

Three dimensional graphics are typically displayed in combination with 2D UIs since 3D libraries such as OpenGL do not have high level widgets for push buttons, dials, menus, etc. Combining 3D with the extensive and flexible 2D capabilities of the Tilcon Graphics Suite provides a perfect combination.

In the Tilcon Graphics Suite, the OpenGL objects are displayed with a frame and are controllable from the Tilcon application. This makes it easy to incorporate 3D graphics into an new or existing graphics project. We've recorded a nice demonstration of this on YouTube:

In the next post, I'll discuss some of the other enhancements we've done in the Tilcon Graphics Suite version 5.8 release.

VxWorks: helping clean up radioactive waste

By Bill Graham

Our customer, Groupe INTRA (Intervention Robotique sur Accident) in France has developed robotic vehicles for the remote analysis and clean up of radioactive sites. Groupe INTRA is chartered to respond to a nuclear accident within 24hrs for its member organizations. This is a very cool and interesting application of robotics and real-time control to protect operators from deadly radiation. First there is ERASE ( External Reconnaissance, Assistance and Surveillance Robot) designed for rough terrain to analyze and transmit details of the accident site back to operators. ERASE and can be controlled form up to 10km away from the site.

Then there is Engine Benne (EBENNE), a remotely controlled dump truck equipped with cameras, lights and a gamma ray detector.

And finally, ERELT T (Teleoperated Relay Robot) which literally relays control information, video and sound from the other robotic vehicles at the site back to operators. INTRA has an entire fleet of robotic vehicles for a complete cleanup of a nuclear accident site.

What does VxWorks have to do with these nuclear accident workhorses? Well, the control centre and robots run VxWorks on an Intel Pentium, 4 processor. All of the systems needed a reliable, real-time and deterministic operating system. In fact, the system required 100ms response time for control and three channels of high resolution video from the vehicles. We're proud of being chosen for such an important role in France's nuclear accident response program and the fact it has performed so well in the harsh and demanding environment where these vehicles exist. Here's a video of the ERASE vehicle in operation: