Resilience-Oriented Approach to the Control of Ventricular Assist Devices ()
1. Introduction
Heart failure (HF) stands out among cardiovascular diseases (CVDs) with high morbidity and mortality worldwide. The prevalence of HF is increasing, being the leading cause of hospitalizations in the United States and a growing concern in Brazil, with an expected 46% increase in the next 15 years. HF is a complex syndrome resulting from structural or functional cardiac disorders compromising tissue perfusion. It involves systolic and diastolic dysfunction, making diagnosis and treatment challenging, especially due to pathophysiological heterogeneity [1]. While clinical trials have demonstrated efficacy in treating HF with reduced ejection fraction (HFrEF), the management of HF with preserved (HFpEF) or intermediate (HFmrEF) ejection fraction is limited to relieving symptoms and treating comorbidities. For advanced HF cases, heart transplantation is a crucial option, especially when conventional therapies fail, highlighting the importance of early intervention to avoid irreversible complications and improve patient survival [1, 2].
Transplantation is an effective therapeutic intervention for irreversible organ dysfunctions such as heart, kidney, liver, lungs, and pancreas. While other conditions such as renal failure and diabetes can be managed with dialysis and insulin administration, respectively, patients in end-stage heart, liver, or lung failure have organ replacement as their only option [3, 4]. Since the first heart transplant in 1967, advances in surgery, perioperative care, and immunosuppressive medications have significantly improved the survival of transplant recipients [1, 5, 6]. However, the quantity of heart transplants does not meet the growing demand, highlighting the need for therapeutic alternatives, such as ventricular assist devices (VADs), for patients on the waiting list or ineligible for transplantation [4, 6, 7]. Mechanical circulatory support (MCS), including VADs, plays a vital role in maintaining cardiac function in patients with advanced heart failure [8]. These devices offer partial or total support to cardiac function and are classified as temporary or long-term, depending on the duration of treatment [8-10]. The implantation of VADs has been successful as a supportive therapy for patients with advanced heart failure, offering various operating options and classifications to meet individual patient needs [4, 6]. The development of reliable ventricular assist devices (VADs) has revolutionized the treatment of heart failure (HF), with continuous improvements, especially in continuous-flow devices [11]. However, adverse events (AEs) persist in this therapy, defined as unwanted complications not attributed to the natural progression of the disease [10]. Affecting about 10% of hospital admissions, AEs represent a significant challenge for healthcare quality, with 50% to 60% of them being considered avoidable [12]. With advances in mechanical circulatory support, regulatory agencies now consider not only survival but also major adverse event-free survival, such as the need for reoperation for pump replacement [11].
This research project aims primarily to understand the Ventricular Assist Device (VAD) as a critical system, as it is intrinsically linked to the heart, providing vital support to patients with advanced heart failure. Secondly, in the context of this hybrid VAD and heart system, the VAD is addressed as a Discrete Event System (DES), where potential failures can compromise its desired functionality. Therefore, adverse events, such as VAD malfunction and thromboembolism, are directly associated with the device, affecting its functional reliability. In this perspective, the VAD and the heart are considered interrelated subsystems, highlighting the importance of VAD resilience for patient survival.
Based on the issues presented, this work aims to develop a system capable of tracking, diagnosing, and treating adverse events, including subclinical ones, in patients with Ventricular Assist Devices (VADs), aiming to improve their health. The proposed approach aims to understand the cause-and-effect relationships in the complex interaction that influences the function and reliability of VADs, considering the evolution of adverse events over time. The hypotheses to be tested are: 1) Applying resilience to VADs can prevent pathogenic accidents and 2) Risk management can predict the occurrence of adverse events during the Patient-VAD system lifecycle. Aligned with the criteria of the US FDA, the objectives of this work include proposing a method to develop a resilient control system for VADs, through risk analysis and dynamic strategies, aiming to prevent, regenerate, and degenerate adverse events in a dynamic reality. Specific objectives include characterizing resilience concepts, pathogenic accidents, and physiological control systems, defining a logical control architecture, and proposing a formal method for its representation, as well as selecting application examples to verify the proposal.
2. Literature Review
In this chapter, we will present the basic concepts that relate failures, defects, and accidents to adverse events (AEs) and the malfunctioning of a ventricular assist device (VAD). Understanding these concepts guides the approaches in the subsequent chapters. Additionally, we discuss the increasingly constant need for information to make decisions and the challenge of providing diagnosis and prognosis in the healthcare field in a dynamic environment of change.
2.1. Systems, Behavior, Undesirable Events, and Homeostasis
Considering a critical organic/mechatronic system, several definitions have been compiled to understand what a system is. Essentially, a system is an integrated set of interrelated and interdependent elements, whether concrete or abstract, that contribute to a common objective [13-15]. Establishing the required functions is fundamental in engineering to build a system [16]. In the context of engineering, the system’s behavior is described by the evolution of states over time. If the transition between these states occurs through discrete events, such as the occurrence of defects or failures, the system is classified as a Discrete Event System (DES) [17]. Defects represent deviations from requirements, while failures indicate the loss of a system component’s ability to perform its function (ABNT, 2020). Both, when critical, can result in hazardous conditions, material damage, or other unacceptable consequences [16]. Regarding the resilience and adaptation of the system in many areas of knowledge, undesired events are seen as disturbances or threats, highlighting the system’s ability to anticipate and predict these events [18, 19]. Each system has its own normal state and operating limits, with biological organisms demonstrating customization in this context [20, 21]. When a system varies within these normal limits, it is in a homeostatic state, where undesired events do not cause accidents. However, events that exceed these limits require allostatic and resilient actions, with the system adapting to return to a normal state, potentially becoming even more resilient and adaptive [22].
2.2. Understanding Adverse Events in Ventricular Assist Devices (VADs)
When exploring adverse events (AEs) in ventricular assist devices (VADs), it is crucial to revisit their definition, highlighting that, in the context of VADs, an AE is defined as a malfunction or failure of the device, as proposed by the STS National Database [23]. Specifically, a malfunction occurs when any component of the VAD system directly or indirectly causes death or an inadequate circulatory support state, including failure to operate as intended [24]. This concept encompasses a variety of complications, from pump thrombosis to mechanical or electrical failures.
The comprehensive definition of device malfunction by INTERMACS involves a series of VAD-related complications, such as mechanical failures, electrical malfunctions, device disconnections, and leaks in the connection system [24]. It is important to note that pump thrombosis is included in this definition, classified as suspected or confirmed based on clinical, biochemical, or hemodynamic criteria [24]. Thus, understanding these definitions becomes important for identifying and dealing with AEs effectively in patients with implanted VADs.
2.3. Failure, Defect, and Accident
When addressing the concept of Adverse Event (AE) in the engineering context, it is necessary to distinguish between an AE resulting from undesired complications of a clinical treatment and an AE originating from a malfunction of the Ventricular Assist Device (VAD). According to the Brazilian Standard NBR-5462 [16], a malfunction can arise from a failure or defect, both of which can lead to accidents manifested in conditions such as pump thrombosis, urgent need for transplantation, or pump replacement, among other eventualities.
Considering the criticality of the accident, since both a defect and a critical failure can result in significant material damage, hazardous conditions for individuals, or other unacceptable consequences, as established by Standard NBR-5462 [16].
2.4. Diagnosis and Prognosis in an Environment of Constant Changes
Healthcare professionals face the challenge of providing quality care to patients, a task that requires accurate responses to questions such as diagnosis, prognosis, and risk assessment. Historically, medicine has relied on the individual experience of physicians to provide these answers, but this approach can be limited and prone to errors [25]. Diagnosis is a complex process that involves identifying the cause of a disorder and proposing appropriate treatments to restore the function of the affected system [1, 25]. However, the natural progression of the disease, therapeutic interventions, and scientific discoveries introduce constant changes, challenging the accuracy of traditional clinical diagnosis.
Evidence-based medicine (EBM) has emerged as an approach to improve the quality of diagnosis and treatment, using rigorous scientific evidence to guide clinical decisions [26]. However, the limitations of randomized controlled trials may compromise their applicability in certain clinical contexts, such as detecting rare adverse effects or in complex ethical situations [27]. Furthermore, the need to consider individual patient characteristics often makes it difficult to generalize the conclusions of these studies to clinical practice [28]. In this scenario, the possibility of subclinical adverse events is a concern, highlighting the importance of developing and implementing technological tools that can support clinical decisions and minimize these occurrences.
2.5. Physiological Systems and Control Systems
The study of physiology aims to understand the normal functioning of organisms, encompassing molecular, physical, and chemical processes. This discipline, dating back to the times of Aristotle, encompasses not only the human body but also nature itself [29, 30]. Concurrently, anatomy investigates the structure and organization of living beings, involving the detailed analysis of the parts that compose them [29, 31], both being applicable to systems and organisms. In the study of physiology, it is crucial to distinguish between function and mechanism. While function answers the “why” of an adaptive behavior, mechanism explores the “how” this process occurs [30]. Understanding how the components of an organism integrate to perform their functions is an ongoing challenge, especially in complex systems like physiological control systems, where homeostatic regulation is fundamental to maintaining physiological variables within acceptable limits (Patient-DAV). These systems, represented by the patient’s life cycle with assistive devices, provide the necessary knowledge base for health decision-making, leveraging Health 4.0 technologies to create a real-time information environment that allows adjustments to devices, patient care, and medication decisions [32-34]. This integration of data and technologies is crucial for optimizing patient care and improving clinical outcomes.
2.6. Detection of Adverse Events in the Context of Physiological and Control Systems
The detection of adverse events (AEs) in ventricular assist devices (VADs) is crucial for patient safety, requiring an effective monitoring strategy of relevant parameters to early identify any malfunction or occurrence of adverse events. In this discussion, essential parameters such as Blood Flow, Arterial Pressure, Pump Speed, and Energy Performance are addressed, highlighting their interrelation and the importance of considering them collectively. Regular monitoring of these parameters allows for early detection of issues in VADs, ensuring prompt and appropriate intervention (Reference [35-37]). Non-invasive measurement of these parameters provides a safe and efficient way to monitor VAD operation, enabling continuous and accurate assessment of patient health. Furthermore, access to these parameters’ values non-invasively allows for quick intervention in case of abnormal variations, ensuring high-quality assistance and minimizing risks for the patient [35-37].
2.7. Resilience
The detection of adverse events (AEs) in ventricular assist devices (VADs) is crucial for patient safety, requiring an effective monitoring strategy of relevant parameters to identify any malfunction or occurrence of adverse events early. In this discussion, essential parameters such as Blood Flow, Arterial Pressure, Pump Speed, and Energy Performance are addressed, highlighting their interrelation and the importance of considering them collectively [19, 38, 39].
The application of resilience in this study requires an understanding of the fundamental concepts and how they can contribute to mitigating adverse effects in patients with ventricular assist devices. Although resilience has various definitions in different areas of knowledge, it generally reflects the ability of a system to recover to its normal state or function after a disturbance [19, 38, 39]. To apply these concepts, it is crucial to understand terms such as disturbance, adaptation, and the underlying principles of resilience. The Term “Resilience” The origin of the term “resilience” dates back to physics and engineering in the 19th century when Thomas Young introduced it to describe the ability of a material to regain its shape after deformation. In the current context, resilience can be seen as an inherent property of a system, standing out in three main aspects: the ability to prevent something bad from happening, to recover after an adverse event, and to prevent a bad situation from worsening further [21, 38]. Furthermore, resilience varies depending on the type of threat faced, whether it is regular, unexpected, or unique, requiring different response and adaptation strategies.
The Concepts of Resilience
The resilience approach encompasses various concepts, including recovery, robustness, gradual extensibility, and sustained adaptability. Each of these concepts reflects specific aspects of a system’s ability to deal with disturbances and perturbations, whether through the recovery of its normal functions, resistance to environmental variations, gradual expansion of its limits, or sustaining its adaptability over time. The application of these concepts requires a deep understanding of how they manifest in different contexts and systems, as well as the ability to balance inevitable trade-offs [18, 38, 40].
The fundamental principles of resilience can be summarized in four key points, according to Hollnagel and Nemeth [38], each essential for strengthening a system’s capacity to face challenges and adversities:
Flexibility: This principle refers to the system’s ability to adapt to changes or disturbances effectively, allowing adjustments and reconfigurations as necessary.
Controllability: Involves the ability to manage and mitigate risks proactively by implementing preventive and corrective measures to ensure system safety and stability.
Early Detection: This principle concerns the system’s ability to identify and respond quickly to threats or failures, enabling prompt and efficient intervention to minimize damage.
Failure Minimization and Effect Limitation: Consists of the system’s ability to reduce the impact of a failure or interruption, either by isolating it to prevent its spread to other parts of the system or by reducing its negative effects.
In addition to these principles, resilience also depends on factors such as connectivity, redundancy, and the crucial role of human factors in decision-making and managing adverse situations. These combined elements provide a solid foundation for building resilient systems and projects capable of maintaining functionality in the face of significant challenges.
2.8. Safety Management with “Safety-I” and “Safety-II”
Safety management, as represented by the “Safety-I” approach, traditionally focuses on minimizing adverse outcomes such as accidents and incidents, seeking to keep their occurrence as low as possible [41, 42]. This model is reactive, responding to events that have gone wrong, and aims to identify and treat their causes to prevent future occurrences. Definitions of safety vary, ranging from the absence of accidental harm to the reduction of harm to acceptable levels through the identification and continuous management of risks [43, 44]. In the context of healthcare, safety is measured by the quantity of adverse outcomes, a perspective that emphasizes responding to failures that have already occurred [42].
However, the “Safety-I” approach reveals its weaknesses when the frequency of adverse events increases, requiring a response capability that may exceed the system’s limits and become inadequate in the face of complex and rapidly evolving challenges in society [42, 45]. Faced with these limitations, there arises the need for a new definition of safety, focused not only on responding to failures but on the ability to achieve desirable outcomes in variable conditions, characterizing the “Safety-II” approach [42, 45].
The Importance of Resilience in Safety Management
The “Safety-II” proposes a proactive approach to safety management, aiming to ensure that everything functions well and not merely reacting to adverse events after their occurrence. This entails anticipating and continuously adapting to the variable and unpredictable conditions of the environment [38, 40]. In this approach, resilience plays a crucial role, enabling systems to adjust and maintain their desired performance in the face of unexpected challenges. Resilience is not confined to responding to adverse events but also involves the ability to learn and adapt constantly [38, 40]. Thus, by applying resilience concepts in safety management, a more robust and adaptable approach is created, which not only responds to adverse events but also reduces their probability of occurrence, promoting a safer and more effective environment in the face of unforeseen challenges.
2.9. Risk Management
Risk management, as defined by the ABNT NBR 31000/2009 standard [46], comprises coordinated activities to direct and control an organization concerning risks, which are the effects of uncertainty on objectives, representing positive or negative deviations from expected outcomes [46]. These risks can be expressed by the combination of event consequences and their likelihood of occurrence. To implement risk management, it is essential to develop a plan that includes approach strategies, necessary resources, risk identification, and monitoring, which can be applied in various contexts, from specific products to entire organizations [46, 47].
Risk Management: Reactive, Proactive, and Predictive
Safety management, encompassing asset protection against risks, begins with asset identification and the development of programs to safeguard them, maintaining these programs over time, with risk management being an essential practice in this context. The reactive approach deals with adverse events after their occurrence, aiming to mitigate their severity and minimize damage, while proactive management anticipates these events, identifying behaviors and root causes before they occur, requiring complex data treatment and a mature safety culture [44, 48]. Predictive management, on the other hand, seeks to forecast potential risks based on patterns identified in operational data, complementing reactive and proactive strategies and aligning with “Safety-I” and “Safety-II” approaches, underscoring the growing importance of technological information solutions to handle ever-increasing volumes of data.
2.10. Modeling of Dynamic Systems and Tools
The term “dynamics” refers to phenomena that produce patterns that change over time, while a dynamic system is one in which at least one of its state variables is temporal [49]. In engineering, the construction of systems only occurs when there is relative certainty about their operation, which requires the use of models to predict their behavior. This study employs dynamic models of discrete event systems (DES), resorting to tools such as Petri Nets (PN) and successive refinement techniques, such as the Production Flow Schema (PFS) [50].
2.10.1. Production Flow Schema (PFS)
The PFS is an interpretation of RdP that represents a conceptual level of abstraction of a system, focusing on essential elements without considering its dynamics but emphasizing sequencing and flow of operations [51]. By postponing the inclusion of dynamic rules, the PFS avoids compromising the model, allowing for the progressive insertion of process details as desired behavior, through refinement in successive abstraction levels, following a “Top-Down” approach [52]. The structure of the PFS, while contributing to various applications of discrete systems, needs to be adjusted to maintain correspondence with the original structuring, especially when there are deviations representing abnormal situations [53]. The construction of models to represent the flow of operations may vary in structural configurations, including sequential operations, coexistence of pathways, and process repetition. For instance, sequential operations are represented by distinct sections, whereas the coexistence of pathways implies conditional structures, and process repetition requires a specific structure [51].
2.10.2. Petri Nets
Petri Nets are a mathematical formalism used in the modeling and simulation of discrete event systems, featuring characteristics such as concurrency, asynchrony, distribution, and parallelism [54, 55]. A Petri Net is represented by a quadruple, involving sets of places, transitions, and input and output functions, being essential for representing complex systems clearly and precisely [56].
3. Proposed Method
This chapter outlines a method for introducing resilience into an existing VAD control system, which may also provide insights for projects aimed at resilience. The method is grounded in the concepts and principles identified in the literature review on resilience presented in the previous chapter. A central consideration in developing this proposal is the implementation of formal procedures to handle the variability of device behavior over time. Additionally, it is recognized that latent failures, learned from accidents in other devices, can be incorporated to enhance resilience. Thus, the method relies on an approach that defines procedures for resilience assessment and provision, integrated into a product development lifecycle. For the development of the Applied Resilience Method (ARM), a conception of control architecture model with resilient characteristics was adopted, which was refined from principles of resilient systems engineering, resulting in the Resilient Collaborative Control Architecture applied to VADs. To meet the resilience requirements of this architecture, the premises of ARM and the product-oriented lifecycle, based on the unified general model of Rozenfeld, were applied, given that the focus is on embedded control of VADs in patients with heart failure.
3.1. Resilience and Failures
Resilience can be enhanced in a project through dynamic risk analysis, where a conceptual model linking resilience and failure is established. For this work, which addresses the patient with a VAD as the control object, it is crucial to understand the established fundamentals: resilience is the system’s ability to recover from a failure; failure, as per reliability, is an occurrence within a specified period, known as Mean Time Between Failures (MTBF); and reliability is measured by the occurrence of events within a specific time period (1/MTBF). Quantitative risk analysis is necessary for this, using tools such as Fault Tree Analysis, Event Tree Analysis, or Bow-tie, which provide a “top-down” view of the probability of failure of the main event based on the failure of each branching. The Bow-tie tool, in particular, allows associating the failure frequency of a main event with the probability of success or failure of system safety barriers, resulting in the final events and their probabilities of occurrence [57].
3.2. Control Architecture with Resilience Features
A control system architecture for a Ventricular Assist Device (VAD) is a structured design that outlines how the control of the VAD is conceived, implemented, and managed to ensure its effective and safe operation. This architecture delineates the components of the control system, their interactions and responsibilities, as well as the principles that guide their behavior in response to different conditions and events.
Figure 1 presents a collaborative control architecture for a resilient system, aiming at the detection and interaction with adverse events before, during, or after their occurrence, integrating anticipatory, regenerative, or degenerative mechanisms. The key elements of the architecture include interface with the patient and medical team, decision-making, resilient behavior, and continuous monitoring of relevant variables, such as blood pressure and pump speed, ensuring patient safety. Moreover, the architecture should allow for post-analysis to detect issues, recording data and event histories, as well as incorporating principles of resilience engineering, such as redundancy of critical components and the ability to operate in adverse situations, to integrate with other hospital systems and share information with the medical team and medical devices. These requirements should be assessed and integrated into the architecture in line with resilience concepts.
![]()
Figure 1. Conceptual diagram of the collaborative control architecture of the resilient system.
3.3. Identification of Resilience Engineering Principles
For the advancement of this research, a structural model composed of a set of resilience engineering principles was outlined, aimed at developing a method for verification and synthesis of resilient systems, as depicted in Figure 2. This model is subdivided into four layers, each responsible for providing resilient behavior to the system. In the first layer, three distinct moments are identified in which resilient actions should occur in response to a disturbance (before, during, or after). The second layer delineates the system’s ability to respond, anticipate, monitor, or learn during each moment of disturbance, while the third
Figure 2. Identification of resilience engineering principles.
layer specifies the necessary dimensions to sustain these resilient capabilities: resist, recover, avoid, and adapt. Finally, in the fourth layer, resilience engineering principles that should be present in the resilient system are highlighted, such as physical redundancy and reorganization, categorized according to their origin and mode of execution. Figure 2 also illustrates three contexts of control actions: anticipatory, regenerative, and degenerative, aligned with the moments before, during, and after a disturbance, respectively. The system must be capable of processing the control logic necessary to deal with various disturbances of different types and possibly simultaneous, acting to prevent, resist, recover, and regenerate, even amidst conflicting and parallel events.
3.4. Applied Resilience Method (MRA)
One of the fundamental premises of this study was to base itself on the product conception related to the system constituted by the patient with VAD. However, traditional product development processes, such as those described by Ulrich, Eppinger, Yang [58], Cooper [59], Crawford and Benedetto [60], and Rozenfeld [61], lack the application of resilience concepts, resulting in final products devoid of resilient behavior. These design models typically start from functional and non-functional requirements, linked to the Pre-development phase, without a layer that relates resilience principles to requirements, resulting in functional but non-resilient products (Figure 3).
Figure 3. Applied Resilience Method (ARM) inserted into Rozenfeld’s Unified Product Development Process Model (UPDPM).
To address this gap, a study was conducted to develop a method capable of embedding this resilient behavior into a medical product related to a specific patient, as shown in Figure 3. This method, called the Applied Resilience Method (ARM), consists of two main processes: Dynamic Risk Management (DRM) and Resilience Need Assessment (RNA), along with a future outlook for resilience application in design. While DRM monitors risks during system operation, RNA collects information during the design phase to assess the need for resilience and, when necessary, adjust the ongoing design (Figure 4).
Figure 4. Applied Resilience Method (ARM) inserted into Rozenfeld’s Unified Product Development Process Model (UPDPM).
The processes of ARM are integrated into Rozenfeld’s Unified Product Development Process Model (UPDPM), represented in BPMN in Figure 4. In DRM, dynamic risks are monitored to provide preliminary hazard information and prioritized recommendations, while in RNA, functional resilience requirements are defined, transforming principles into concrete actions during product design. These processes generate artifacts, that are essential for effective risk management and integration of resilience into the developing product.
3.5. Managing Dynamic Risks (GRiD)
Dynamic risk management is a fundamental process to ensure the safety and reliability of critical Organic/Mechatronic systems, such as the Patient-VAD. This process aims to identify, assess, and mitigate risks that arise during the operation of these systems, considering situations where risks are variable over time and may be unknown or unpredictable. It involves a systematic approach, based on specific techniques, divided into subprocesses such as Dynamic Risk Management (DRM), which includes Dynamic Risk Analysis (DRA) and Resilient Control System Modeling (RCSM).
In the DRA process, events threatening the controlled system are analyzed, such as changes in patient behavior, VAD component failures, alterations in performance requirements, among others. This analysis provides a basis for the development of the system’s control model, which is validated in the VaReS process. The outputs of this process direct the execution of a dynamic risk management cycle, which may result in system acceptance, alert status, or the need to restart the resilience needs assessment process (Figure 5).
In structuring the resilient control system model (RCSM), steps are defined for building the system’s dynamic behavior, such as preparing the context, defining monitoring logic, and diagnosing the type of resilient behavior. This model is tested and evaluated to verify its resilience against failures and adverse events, using tools such as Petri Nets. Resilience validation considers whether the system meets the criteria established initially, potentially returning to the risk analysis or resilience needs assessment process, as needed.
Figure 5. Subprocesses of the Dynamic Risk Management (DRM) process.
3.6. Assessing the Need for Resilience (AvNRe)
The main objective of this process is the identification of which functional requirements, linked to the resilience principles identified in Figure 2, must be present in the product to achieve the desired resilience. The process of assessing resilience needs utilizes an understanding of the product’s functions and links these functions to others necessary for the dynamic and resilient behavior of the product. Once the functions of dynamic and resilient behavior of the product are identified, it is necessary to identify the product’s functional requirements. This process is divided into three main parts: Classify Resilience Level (CNiRe), Analyze Hazards and Provide Recommendations (AnPPR), and Verify Functional Requirements and Resilience Principles (VeRFPRe). The measures taken in this process, as indicated in the recommendations, act on the treatment (reduction, elimination, etc.) of the severity of the disturbance caused to the system. The frequency is addressed in the “2. Analyze Risks” process.
Figure 6 uses BPMN notation to represent these two processes of MRAPDPR. Resilience Level Classification (CNiRe) evaluates the functional requirements of a project, determining the level of resilience present in the system. Hazard Analysis and Providing Recommendations (AnPPR) assesses the causes of effects and existing controls in the system, allowing recommendations to mitigate the effects of the event on the system. Subsequently, a refinement to achieve the recommendations is carried out, linking functional requirements to resilience principles.
The process of Verifying Functional Requirements and Resilience Principles (VeRFPRe) seeks existing functional requirements in the project and links them to resilience principles. The result of this process is the balancing between resilience principles and existing and necessary functional requirements to achieve the developed recommendations. This information is used in resilience testing in the “4. Test Resilience” process and in risk analysis in the “2. Analyze Risks” process.
Figure 6. Resilience need assessment process (AvNRe).
3.7. Structuring the Resilient Control System Model (EMSCRe)
Figure 7 presents the proposal of a model, through a method represented in Production Flow Schema (PFS), for describing the dynamic behavior associated with the different dimensions of resilience proposed in the collaborative architecture for building a resilient system applied to a VAD (Figure 7).
Figure 7. PFS diagram.
This model represents the synthesis process of control logic consistent with the dimensions of resilience that can be implemented, i.e., which allow for supervising a patient with an implanted VAD considering anticipatory, regenerative, or degenerative actions in the face of potential adverse events that may occur. The execution of Process “1. Prepare Context” involves structuring information through a database with variables necessary for monitoring control parameters and enables actions according to anticipatory (4), regenerative (5), or degenerative (6) control logic. The execution of Process “2. Define Monitoring Logic” presents a monitoring logic, continuously reading variables in real-time for comparison with reference values and alarm limits. Deviations are recorded for later analysis, ensuring effective control of system operations. As for Process “3. Diagnose Behavior Type,” it determines the system’s response to potential adverse events based on the analysis of information collected during continuous monitoring of relevant variables. Scenario analysis and event history are crucial for identifying the appropriate behavior: anticipatory, regenerative, or degenerative. These processes are essential to ensure the resilience of the VAD/Patient system in different situations.
4. Results
This chapter addresses the application of the Applied Resilience Method (ARM) in a specific context, selecting a Ventricular Assistance Device (VAD) control system as described by Cavalheiro (2013) and Cavalheiro et al. (2023). The case study allows for the assessment of resilience levels in Mechanical Circulatory Support Devices (MCSDs), focusing on VADs, treated as mechatronic systems. The method’s application occurs in two main stages: conducting the Resilience Need Assessment (AvNRe) and developing a resilient control system.
In the first stage, the Resilience Need Assessment, initiated with the classification of the resilience level present in the VAD control system, identified the functional requirements and evaluated them using the ARM. The resulting classification and completion of the APPR form for each identified hazard, including their causes, existing controls, and recommendations for resilience improvement. Then, a summary of the resilience characteristics observed in the system is elaborated, considering its anticipative, regenerative, and degenerative capacities. The analysis reveals the need for improvements to prevent or mitigate subclinical adverse events, such as pump thrombosis formation. These considerations underpin the application of the Structuring of the Resilient Control System Model (EMSCRe), as described in the subsequent sections, detailing the context preparation and identification of prioritized Adverse Events, such as pump thrombosis formation, providing a structured and comprehensive approach to ensure the resilience of the VAD control system.
4.1. Prepare Context
In the “Prepare Context” activity of the Resilient Control System Structuring Method (EMSCRe), the aim is to identify the variables associated with relevant Adverse Events (AEs) to the Ventricular Assist Device (VAD). This stage is subdivided into two phases: identifying the variables and AEs, and defining criteria for disturbances. In the first phase, AEs are prioritized based on the previous section, and then the variables associated with each AE are identified, including arterial pressure, blood flow, and pump speed, crucial for detecting thrombus formation.
4.2. Define Monitoring Logic
Early detection of thrombus formation in the pump of a Ventricular Assist Device (VAD) is crucial for ensuring patient safety. The detection strategy for this formation requires constant monitoring of key variables such as arterial pressure, blood flow, and pump speed, defined according to the prioritization of Adverse Events (AEs). The main elements of this strategy are outlined, including establishing reference limits for each variable, continuously checking pump speed, and monitoring arterial pressure and blood flow. Early identification of these adverse events allows for immediate medical interventions, reducing the risk of serious complications. In addition to the monitored variables, clinical analysis of the patient is also essential for timely detection and treatment of pump thrombus formation in the VAD. Algorithms for thrombus identification, based on this strategy, are detailed in Figures 8-10.
4.3. Diagnose Resilient Behavior Type
This process brings together a set of different techniques. For trend assessments, focusing on anticipatory
Figure 8. Predictive thrombus formation verification algorithm in a LVAD pump.
Figure 9. Thrombus formation presence verification algorithm in LVAD pump.
behavior, nonlinear regression rules were applied using the “Decision Tree” technique. This method, a form of machine learning, divides data into groups based on simple rules, which can be used to identify factors more strongly associated with pump thrombus formation. While there are other options such as neural networks, etc. For regenerative and degenerative assessments, comparative techniques were used between observed values and set limits. For all the techniques presented, a verification algorithm was used to integrate them in the execution of this process, as shown in Figure 11.
Figure 10. Degenerative thrombus formation verification algorithm in LVAD pump.
Figure 11. Deviations verification algorithm.
4.4. Anticipatory Behavior
Once the trend of adverse event (EA) occurrence is identified, a logic of actions is implemented, guided by the relationship of prioritized EAs with resilient behavior, providing recommendations for control. The definition of action logic (Anticipatory) for pump thrombus formation mainly consists of issuing alerts to the medical team, which may also include actions such as adjusting the pump speed. During the execution of the control logic, the actions indicated in the logic definition process are followed, along with verification of deviations and alarms indicated in the algorithms. All details of the executed actions, including type, specific parameters, and date/time, are recorded. After executing the actions and observing the results in the state of the VAD, the system returns to the initial cycle for further adjustments. All issued alerts are recorded for activation of the medical team and necessary measures (Figure 12).
Figure 12. Algorithm for anticipatory behavior action logic.
5. ConclusionS
This study has made several significant contributions. Firstly, it has provided a comprehensive definition of resilience, especially in VAD control systems, highlighting its nuances such as resilience, robustness and adaptability. In addition, it identified and described the principles of resilience engineering applicable to critical systems such as the Patient/DAV, highlighting their importance in building resilient systems. An innovative approach was taken by emphasizing proactive safety management, exploring strategies such as “Safety-II” in contrast to the traditional “Safety-I”, which is essential for dealing with complex systems.
Another disruptive aspect was the application of resilience in AED control systems, suggesting improvements in the safety and performance of these devices, mainly through the identification of research gaps in this type of study, such as the lack of quantitative studies in the area, thus filling an important space.
As for the proposed objectives, such as the development of a method for analyzing risks and levels of resilience in VADs, these were achieved through the development of the Applied Resilience Method (ARM), identification of specific hazards and preventive recommendations, demonstrating a proactive approach to preventing adverse effects. This method proposes, for example, for the early detection of thrombosis (one of the adverse events), constant monitoring of variables such as: i) blood pressure, ii) blood flow and iii) pump speed. Reference limits for these variables and a monitoring algorithm are established, as well as clinical analysis of the patient, as a way of detecting and treating this adverse event in good time.
This method can be used in a number of situations, including a) assessing the system’s ability to recover from adverse events, such as pump thrombosis, mechanical or electrical failures and other potential problems; b) identifying specific functional requirements to ensure the safe and effective operation of the VAD; c) developing resilient control systems that are able to anticipate, regenerate or deal with adverse events efficiently; d) analysis and continuous improvement of system resilience, through the identification and implementation of preventive and corrective measures; e) integration of resilience engineering principles into the design, operation and maintenance of VAD systems, with the aim of improving their robustness, adaptability and recovery capacity.
Another important issue highlighted in this article concerns the prevention and mitigation of subclinical adverse events in VADs, through a proactive approach focused on patient safety. Some strategies include: i) Continuous monitoring: proposed for the patient’s vital parameters and for the functioning of the VAD as essential for the early detection of any sign of deterioration or device failure. ii) Definition of reference limits: established for the monitored parameters, such as blood pressure, blood flow and pump speed, allowing the identification of significant deviations that may indicate the occurrence of adverse events. iii) Early detection algorithms: developed to identify adverse events early, such as thrombus formation in the VAD pump, can help to take preventative measures before serious complications occur. iv) Regular reviews: to monitor the functioning of the VAD and the monitoring records to identify trends or patterns that may indicate an increased risk of adverse events, allowing proactive adjustments to the treatment plan.
Timely medical interventions and education and training, observed in the principles that form the basis of the ARM method, are present as preventive and proactive measures that can significantly reduce the risk of subclinical adverse events in patients with VADs, thus ensuring greater safety and quality of life for these individuals. In short, the resilience method applied to VADs can be used at all stages of the system’s life cycle, from design to operation, to ensure its ability to deal with adverse events and guarantee the safety and efficacy of patient treatment.
Acknowledgements
The authors thanks FAPESP, CNPQ e CAPES for supporting this research.