Mitigating bit flips or single event upsets in epilepsy neurostimulators.

OBJECTIVES: The objective of this study was to review software errors known as single event upsets (SEUs) or bit flips due to cosmic rays in epilepsy neurostimulators.
MATERIALS AND METHODS: A case report of a single event upset or bit flip is discussed; device manufacturers and publicly available data were queried for both incidence and types of error as well as strategies of software error mitigation.
RESULTS: Neurostimulators, like other implanted devices such as pacemakers, are prone to single event upsets. Strategies for SEU mitigation are reviewed.
CONCLUSIONS: Cosmic radiation can threaten RAM and settings of neurostimulators; neuromodulation teams and device designers need to take this threat into account when designing multifunctional neuromodulation systems.

Introduction

Cosmic rays are charged particles that bombard us constantly; they originate in space from high-energy sources such as galactic events or stars like the sun [1]. Most of the time, and as far as we know, there is little consequence of that energy exposure because most charged particles are easily deflected or shielded by the earth’s atmosphere or magnetic field. Neutrons, however, are more tenacious and can pass through meters of material. Within microprocessors reliant on small voltage surges, a neutron on a very exact trajectory, passing through random access memory (RAM), may leave voltage ripples or wakes [2]. That transient charge disruption may be capable of reprogramming software code, or bits, from ones to zeroes and zeroes to ones [2]. These are called single event upsets (SEUs) or, alternatively, bit flips and can occur in any software-containing electronic device. Because of that code change, functions in an electronic device such as an electric car, a smart phone, a cardiac pacemaker, or a neurostimulator may not work as intended. Epilepsy providers who work with neurostimulators need to be aware of this device threat.

The cardiac literature shows progressive understanding of SEUs since pacemaker and defibrillator devices were adopted [1], [3], [4]. Given that a SEU in a pacer or defibrillator device could prove immediately fatal (either failure to pace or unintended/inappropriate stimulus), hardware installed on cardiac devices allows SEU detection with regression to a presumably safe default mode and later mitigation of the SEU through device reprogramming without device removal [3], [4]. For instance, a pacemaker might default to a single chamber rate of 50 bpm, and tachycardia detections may be turned off or set for a maximum ventricular rate in one chamber only before defibrillation. In this review, we examine a case of unexpected SEU occurrence (the patient consented to use of their data in this literature report). In addition, through publicly available resources, we review the incidence of SEUs as well as strategies of design and mitigation for SEUs in contemporary stimulators.

Materials and methods

With informed patient consent, patient data were abstracted from the medical record. To provide contextual background, the United States Food and Drug Administration's manufacturer and user facility device experience (MAUDE) was searched for neurostimulator device issues [5]. “Single Event Upset” used as search terms revealed numerous and irrelevant entries unrelated to software errors. The search terms instead used were “Bit Flips” which is synonymous with SEUs.

Results

A 39-year-old male with posttraumatic medically intractable epilepsy underwent intracranial monitoring in June 2006 which confirmed bitemporal hippocampal seizure onsets. During that monitoring, a convulsive seizure triggered ictal asystole. The patient fully recovered, though a cardiac pacemaker was later placed. In 2008, the patient enrolled in a clinical trial and underwent placement of a responsive neurostimulator device (RNS® System, NeuroPace, California, USA) with hopes of altering the burden of refractory complex partial seizures with secondary generalization. Detection and stimulation electrodes were placed in his hippocampi, both of which were atrophic on MRI, while the neurostimulator was placed within the parietal bone (Fig. 1, Fig. 2). The neurostimulator was programmed to detect early seizure onsets and stimulate zones of onset to prevent seizure propagation. In clinical trials, the RNS System was shown to significantly reduce seizure frequencies in patients with medically intractable partial epilepsy, an outcome this patient shared [6].

Fig. 1

Coronal T2 MRI showing bilateral left > right hippocampal atrophy.

Fig. 2

Lateral skull films showing RNS device and 4 contact depth electrodes over left and right hippocampi.

While uploading data from the neurostimulator to his interrogation computer, a SEU error was noted on June 18, 2015. A total of 1215 bits stored to the random access memory (RAM) of his device switched from either a 0 to 1 or a 1 to 0. In the week leading up to the bit flip, the patient was not exposed to high levels of electromagnetic radiation such as cautery or MRI and had not traveled in a commercial jet, which can amplify exposure to terrestrial cosmic radiation [1]. The RNS System device performed as designed in the event of SEU; it reset to a default or safe mode where stimulation was not enabled, and when the device data were next uploaded by the patient from home to a centralized data server, this SEU was apparent and triggered alerts to our treating team. At our request, the patient returned to clinic to have the neurostimulator interrogated, and during this process, the neurostimulator automatically reprogrammed to settings prior to the day of the SEU. No seizures or other adverse events were noted during this SEU. The patient's cardiac pacemaker was not affected during this time period. The neurostimulator remains implanted and continues to perform as intended.

The neutron monitor at the University of Oulu, Finland recorded high levels of cosmic radiation in the northern hemisphere during June of 2015; in that week, the Aurora Borealis could be seen from the mountains that surround Seattle, the area of the patient's residence [7]. Unfortunately, we do not have more accurate levels specific for Seattle during that same time, though in general, higher latitudes and higher altitudes are risk factors for increased exposures to cosmic radiation [1]. Seattle remains the most northern US city where RNS Systems are currently in regular use. During June of 2015, there were no other RNS Systems that had similar bit flips (personal communication). Similarly, we are unaware of vagus nerve stimulator (VNS) SEU issues seen in our epilepsy clinic during this time. In this patient, chance, positioning, differing device manufacture, and software complexity may explain why the patient's neurostimulator and not cardiac pacemaker was affected.

Discussion

In advanced read and record semiconductor devices such as the RNS System, alpha particles and high-energy neutrons are the main radiation sources known to cause SEUs [2]. In the 1970s, most software errors in electronic devices were caused by alpha particles emitted from packing contaminants [8]. With improved shielding design and testing standards, device susceptibility to alpha particles declined. On the other hand, high-energy neutrons can penetrate through dense materials such as concrete, which are not easily shielded [1]. This vulnerability is generally understood by stimulation device manufacturers and supposes that device design must account for possible neutron disruptions.

Cardiac devices exposed in a controlled environment to high-density neutron beams showed a variety of responses and varied by manufacturer [4]. Single event upset risks include component thickness, battery preservation strategies, and perhaps most importantly, read and record memory functions [4]. The rate of a bit flip is a function of the device's operating voltage, semiconductor composition (wafer process), and level of exposure to radiation. The lower the voltage used to code memory, the higher the incidence of SEUs [9].

We tabulated reports of SEUs pertinent to this review from a search of the MAUDE database (Table 1, Table 2). One hundred ninety-six SEUs are reported in devices since 2009. Of those SEUs, 10 occurred in neurological devices (Table 1) [5]. And Of those reported SEUs in neurological devices, 8 were explanted or removed, 4 VNS, 2 spinal stimulators, and 2 infusion pumps, most citing SEUs as the reason for explanation (Table 2) [5]. These reports from the MAUDE database likely undercount the true incidence of SEUs, in part, as there is no agreed upon standard of either naming an event a bit flip or a SEU, and if the device performed as designed – i.e., restore to default mode – it may not be reported [1]. Also, SEUs may be transient and time limited to the neutron's passing. Finally, we speculate that it may be in a company's interest to not report a SEU because of perceived competitive advantages.

Table 1

Comparison of reported SEU rates in implantable medical devices (Maude database 2009–2015) [9].

Reported SEU for medical devices (Maude database 2009–2015)
	Neuro	Nonneuro	All devices
# of SEUs reported	10	186	196
% explanted due to SEU	80	11	14
% reprogrammed after SEU	83	87	87
% reported patient consequences due to SEU	20	4	5

Table 2

Comparison of neurodevices with SEUs (Maude database 2009–2015) [9].

Explanation of neurodevices with SEUs (Maude database 2009–2015)
Type of device	Company	# SEU	# explanted	Reason for removal
VNS	Cyberonics	4	4	3 due to bit flip, 1 due to end of service
Spinal	Medtronic	4	2	2 due to bit flip
Infusion pump	Medtronic	2	2	2 due to bit flip

Through both literature search and direct correspondence to major manufacturers of neuromodulation devices, we were able to better describe the current approaches to bit flips or SEU (Table 3). While not all companies were willing to report SEU rates or issues to us, most were willing to discuss SEU safety strategies as they overlap with mitigation strategies for more obvious exposures to energy fields like MRI, CT, radiation treatments from nuclear medicine, and cautery.

Table 3

Mitigation of software errors among selected medical devices.

Mitigating software error strategies
Type of stimulator	Cortical	Deep brain	Spinal	VNS	Cardiac
Device/company	RNS NeuroPace	Medtronic Activa Sc, Rc, PC, Medtronic, Soletra Kinetra	Medtronic RestoreBoston Scientific (Precision, Spectra)	Cyberonics VNS	Multiple
Memory	Read/write volatile	Nonvolatile on ActivaVolatile on soletra, kinetra	Nonvolatile memory	Volatile	Varies across device
Response to SEU	Safe mode, no stimulation	Soletra, kinetra will default to off safe mode (no longer on market)Activa SC will internally reset to prior settings	Defaults to no stimulation	Unknown, company would not clarify	Varies by device, in general default to single chamber minimum rate pacing without defibrillation abilities
Inform	Error reports to NeuroPace servers, patient contacted by attending team	Error reports to patient on remote use, SC model may internally reprogram without reporting	With remote or device regulator, an error is reported	No informing	May have audible alarm
Reprogramming	90% of time with patient interrogation10% with clinic interrogation	Internal in SC model otherwise with reprogramming	Both companies’ devices try and internally restore and if unable, restores with remote	Unknown, company would not clarify	Mostly with clinic interrogation
Other	N/A	Rechargeable devices will not automatically reset to prior settings with charging and need remote interaction to do so	Rechargeable devices will not automatically reset to prior settings with charging and need remote interaction to do so	N/A	N/A
Explant due to SEU	None reported	None reported	2	4	19
Estimate SEU rate	1 event every 91 device years	None reported	4 events since 2009	4 events since 2009	1 event every 35 device years
Patient consequences	None reported	None reported	Worsening back pain	None reported	Worsening CHF
References	Personal communication	Personal communication	Personal communication[5]	[5]	[3], [5]

Independent of device engineering, epilepsy providers using responsive neurostimulators can help reduce the potential frustration and clinical impact among patients who have SEUs. At a very minimum, the neurostimulation team needs to be aware that all software-containing devices are susceptible to SEUs, and just as the end of battery service can provoke marked symptomatic change, devices need to be checked if symptom changes are unexpectedly seen. It is also necessary to educate patients on the risk factors for terrestrial cosmic radiation and promote caution. At higher altitudes, particularly commercial air travel, there is an increased amount of cosmic radiation, making SEUs in air travel up to 20% more likely [1], [4]. Similarly, higher latitudes may place a patient at a higher risk [1]. Regular device interrogations can permit checks and warnings if soft errors are detected and, dependent on the complexity of the device reset, offer abilities to reprogram the device without device removal.

Conflict of interest

This paper had no financial support. Dr. Caylor has no disclosures. Dr. Doherty has no disclosures. Alice Dong has no disclosures. Dr. Gwinn has consulted for Boston Scientific and NeuroPace. Nicole Fortier has consulted for NeuroPace.