Elements of answer. Yes. People use verbal specifications, no matter how simplistic, and learn from concrete examples. In addition domain specific notations can also be used, especially FMEA. With this respect during the enhanced deployment, an integration of FMEA into the development flow could take place (see section 6). On-‐going work [RD29] shows progress on the extraction a formal specification of error detection and recovery procedures from FMEA.
Elements of answer. Yes and no. The activities suggested in the clarification of the question can take advantage of formal models but are still related to creation of confidence and therefore are not really beyond guaranteeing certain properties. In the spirit of exploiting models, SSF is for example considering the mapping to times automata, however it requires to carefully consider the semantic mapping between formalisms.
Elements of answer. Yes and no. Work towards Event-‐B models has resulted in findings that have been used for improvement of specifications. However, all the findings have been due to inspection and analysis that could well have been done without any formal modelling. The benefit of the formalisation is the ability to drive that inspection in a more systematic way than in a more “traditional” inspection.
Elements of answer. Recalling the answer to EM-‐EA-‐3, it is perhaps best to consider potential impacts. Then it is clear that usage of formal methods (especially model checking that has not been used much in the SSF deployment) improves detectability of design errors. The phase does not affect the detectability, though ideally all design errors should be caught and eliminated during design phases.
Elements of answer. Yes, though Rodin Platform does not well support automation of more than certain trivial proof reuse strategies.
Elements of answer. The report [RD21] written by the two engineers mentioned in section 4.6 is a valuable piece of evidence that gives objective numbers to answer this question.
Elements of answer. It is still uncertain whether useful in vitro or alternative models for long-term toxicity testing can be developed, this is a problem for the testing of conventional substances as well. The reason is that the possible long-term effects are diverse and may include multiple tissues and organs, while in vitro models only encompass one small part of the human body. Additionally, in vitro tests have not been able to stay viable for longer than a week until recently, disabling exposure of longer duration. 3D models and organs-on-a chip, with the possibility to couple multiple tissues into possibly a human-on-a-chip are promising in alleviating these barriers. The development of these models thus deserves priority. • Accumulation in mammals has been observed for some low-dissolving NPs, information about accumulation in the environment and food chain is scarce, but does not indicate a concern so far. • The accumulation, and other kinetic features, is nano-specific, as the accumulation takes place in vesicles of macrophages, in tissues with high levels of monocytes (i.e. macrophages in tissues), with dissolution as the only known clearance pathway. In contrast, molecular (bulk/conventional) substances mainly accumulate due to high lipophilicity (leading to accumulation in fat tissue) or strong binding to cellular components in any cell. • Because of the seen accumulation in mammals, long-term toxicity testing is relevant, as well as a precise kinetics assessment. • Coatings and surface modifications can highly impact the kinetics, as this impacts e.g. the protein corona. The kinetics, such as absorption into the body, can subsequently impact the toxic effects caused by the MNM. The ultimate degradability is, however, not expected to change, as for ultimate degradation, the core will need to be degraded as well, and this is not affected by the coating. • In dissolution testing especially dissolution rate is important. When reporting dissolution analysis, the protocol used must be reported in detail, including all experimental conditions in which the data were collected To address the safety of MNM properly, at the current state of science, these findings underscore the necessity for: • Determination of accumulation potential (incl. methods for this), • Subchronic and chronic in vivo studies (incl. immunotoxicity), and • Kinetic modelling for animal study-lifetime extrapolation. Recommendations to improve assessments in the future: • Invest in the development of ch...
