# Trusted Composition of Internet of Medical Things over Imperfect Networks
## 5 Structural Modeling Using AADL  
The goal of trusted composition of IoMT is to attain a high level of assurance within the system, acknowledging the potential presence of certain components with lower assurance. This goal is pursued by prioritizing high assurance for safety-critical components of the system and then integrating lower assurance components in a manner that upholds the overall system's safety. Figure 2 shows the top-level AADL model of the clinical example use case explained in the previous section. This IoMT-based automated monitoring of opioid infusion, modeled as an AADL system \(\mathtt{SysIoMT}\), is composed of four sub-systems and a communication network. Each system is connected to an imperfect communication network, which is modeled with an AADL virtual bus. A Patient is modeled as an abstract component. Alarms due to patient vital signs (low heart rate, respiration rate, or blood oxygenation) and warnings that assurance has been lost are sent to a \(\mathtt{Nurse\_Station}\) for human intervention. High assurance for the system as a whole is achieved by loop-back communication between formally verified threads. Although any single message will not be assured, when the sender receives a correct copy of its message back, it is assured that these two messages (original and confirmation) have been performed correctly. Pairs of connections using loop-back are shown in red in Figure 2.  
Figure 3 shows the containment hierarchy of all components in the model plus bus access connections. Formally verified components have a light green background color; less-assured components, have a light yellow background. The \(\mathtt{Respiration\_Monitor}\) component models the respiration monitoring system attached to the patient for monitoring the respiration rate. It determines respiration rate from a respiration sensor usually strapped around a patient's chest. If the respiration rate is lower than the minimum respiration rate, \(\mathtt{Respiration\_Monitor}\) sends \(\mathtt{RM\_Alarm}\)(true) to the control application \(\mathtt{Coordinator}\), otherwise it sends \(\mathtt{RM\_Alarm}\)(false). The \(\mathtt{Respiration\_Monitor}\) then waits for message  
Figure 1: A clinical use case of opioid infusion monitoring. confirmation response, either RM_Alarm_Echo(true) or RM_Alarm_Echo(false). If the response is not received within the specified time limit (indicating a delay or data loss) or the received response is different from the sent notification (indicating message corruption), the Respiration_Monitor sends a lost confirmation signal through the Lost_Confirmation outgoing event port to the Nurse_Station. The Respiration_Monitor can also make a sound indicating a low respiration rate alarm or lost confirmation. Figure 3: Component containment hierarchy. Figure 2: Top-level AADL model. The patient's heart rate and blood oxygenation (SpO2) are monitored by the pulse oximeter, which is modeled by the Pulse_Oximeter system component. The Pulse_Oxime-ter receives values of the SpO2 and heart rate from the pulse oximeter sensor attached to the patient body. Through the PO_Alarm outgoing event data port, the Nurse_Station is alerted if any of these two parameters falls below minimum limits. Additionally, the Coordinator also receives the alarm. Next, the Pulse_Oximeter waits at PO_Alarm_Echo incoming event data port for the confirmation response from the Coordinator. Nurse_Station is notified through Lost_Confirmation outgoing event data port if the response is not received within the allotted time limit. The Coordinator system component represents the control application executed by a processor on the network (not shown). The Coordinator notifies the PCA_Pump to reduce infusion to the minimal keep-vein-open (KVO) rate when it receives alarm signals from the Pulse_Oximeter or Respiration_Monitor through PO_Alarm or RM_Alarm, respectively. The acknowledgments are sent to Pulse_Oximeter and Respiration_Monitor through PO_Alarm_Echo and RM_Alarm_Echo ports.