P. Carayon and K. E. Wood, Patient safety, Inf. Knowl. Syst. Manage, vol.8, issue.1-4, pp.23-46, 2009.

W. H. Maisel, M. Moynahan, B. D. Zuckerman, T. P. Gross, O. H. Tovar et al., Pacemaker and ICD generator malfunctions: Analysis of food and drug administration annual reports, JAMA, vol.295, issue.16, pp.1901-1906, 2006.

, Boston scientific: pacemaker system specification, 2007.

, Dagstuhl seminar 14062: The pacemaker challenge: developing certifiable medical devices, 2014.

J. R. Abrial, Modeling in Event-B: System and Software Engineering, 2010.

M. Leuschel and M. Butler, ProB: A model checker for B, FME 2003, vol.2805, pp.855-874, 2003.

S. S. Barold, R. X. Stroobandt, and A. F. Sinnaeve, Cardiac Pacemakers Step by Step, 2004.

R. Project, Rigorous open development environment for complex systems, 2004.

P. Wang, A. Kramer, N. A. Mark-estes, and D. L. Hayes, Timing cycles for biventricular pacing, Pacing Clin. Electrophysiol, vol.25, pp.62-75, 2002.

H. D. Mills, Stepwise refinement and verification in box-structured systems, IEEE Comput, vol.21, issue.6, pp.23-36, 1988.

H. D. Macedo, P. G. Larsen, and J. S. Fitzgerald, Incremental development of a distributed real-time model of a cardiac pacing system using VDM, FM 2008, vol.5014, pp.181-197, 2008.

A. O. Gomes and M. V. Oliveira, Formal Specification of a cardiac pacing system, FM 2009, vol.5850, pp.692-707, 2009.

Z. Jiang, M. Pajic, S. Moarref, R. Alur, and R. Mangharam, Modeling and verification of a dual chamber implantable pacemaker, TACAS 2012, vol.7214, pp.188-203, 2012.

L. A. Tuan, M. C. Zheng, and Q. T. Tho, Modeling and verification of safety critical systems: A case study on pacemaker, Secure System Integration and Reliability Improvement, pp.23-32, 2010.

N. K. Singh, Using Event-B for Critical Device Software Systems, 2013.

D. Méry and N. K. Singh, Functional behavior of a cardiac pacing system, Int. J. Discrete Event Control Syst, vol.1, issue.2, pp.129-149, 2011.

D. Méry and N. K. Singh, Formalization of Heart Models Based on the Conduction of Electrical Impulses and Cellular Automata, FHIES 2011, vol.7151, pp.140-159, 2012.

D. Méry and N. K. Singh, Automatic code generation from Event-B models, Proceedings of the Second Symposium on Information and Communication Technology, pp.179-188, 2011.