IEEE Technology and Society Magazine - March 2017 - 56

such is not the case for many systems including some
medical implants. Additionally, existing risk analyses
(applied to heterogeneous systems), consider such systems a complex single-whole. Such analyses assume
that a brainstorming process for identifying all possible
hazards will suffice. We posit that the proposed analysis
of "exposure" is valuable for all such cases, since consideration is given to the nature and number of the interdependencies among component parts of rather than
adopting the assumption that these interactions should
be represented by hazard statistical distribution.

Representative Case Question
For the specific ICD case, we propose to answer the following question: how can design decisions influencing
end user exposure to system failures be informed
beyond current risk assessment practice?

The Exposure of Medical Implants

We consider a typical (representative) implanted medical device (see Figure 4), and the exposure metric that
is proposed to inform design decisions. As a precursor
to developing such a metric, we define the service and a
service level for the medical device and examine the conditions/events that will cause the
device to either "fail" or "not-fail" to meet the
service-level. We observe that every risk must
be associated with a vulnerability (as a point
of exposure) within the device, and therefore
points of failure within the physical system
must be identified before any valid vulnerability metric is developed.
We define performance of a medical
device by a Boolean variable (service and service level achieved/not-achieved), we propose
that acceptable output is produced if and only
if a final process (sub-system output) operates
and the inputs to that process or subsystem
(at certain service levels) are available. Each
input to the final process can be assumed to
be an externally available input or the output
of another process. Applied recursively, the
entire technological system (implant) can then
be described by a Boolean expression.
Combinations of input values to the components of the Boolean expression are tested, and measures obtained of the number of
single (E1), double (E2), triple (E3), etc., failures that will cause output failure. These are
represented using a composite exposure
metric {E1, E2, E3 ... En} that describes the
level of exposure of the device, and end-user
vulnerability contribution. This approach
also allows quantification of the effect, upon
end-user vulnerability, of contributory subsystems. The proposed metric is based solely
on the configuration and components of a
target system rather than on subjective identification of vulnerabilities or subjective
assessments of current or future threat probabilities [12].
An implanted medical device under consideration supplies a service to the user; "firing" when and only when required. To obtain
a measure of added vulnerability contributFigure 4. Presents figures from the original 1991 ICD Patent demonstrating
the complexity of a medical implant [10], [11], and associated logic.
ed enables the assessment of cur rent

IEEE Technology and Society Magazine

∕

march 2017

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2017