Formalizing an Electronic Institution for thedistrib ution of Human Tissues

J.Vazquez-Salceda�, J.A.Padget

�, U.Cortes

�, A. Lopez-Navidad

�,

F. Caballero�

�DepartamentdeLlenguatgesi SistemesInformatics.Universitat Politecnicade

Catalunya.c/ Jordi Girona1-3.E08034Barcelona,Spain.�Departmentof ComputerScience. University of Bath.Bath,BA27AY. UnitedKingdom.�

BancdeTeixits.Hospitaldela SantaCreui SantPau.c/ St.AntoniM. Claret,167.E00025Barcelona,Spain.

Abstract

The useof Multi-Agent Systems(MAS) in health-caredomainsis increasing.SuchAgent-mediatedMedical Systemscan managecomplex tasksand have the potential toadaptgracefully to unexpectedevents.However, in thesekinds of systemsthe issuesofprivacy, securityandtrust areparticularlysensitive in relationto matterssuchasagents’accessto patientrecords,what is acceptablebehaviour for an agentin a particularroleandthedevelopmentof trustbothbetween(heterogeneous)agentsandbetweenusersandagents.

To addresstheseissueswe proposea formal normative framework, deriving from anddevelopingthenotionof anelectronicinstitution.Suchinstitutionsprovidea framework todefineandpolicenormsthatguide,controlandregulatethebehaviour of theheterogeneousagentsthatparticipatein theinstitution.Thesenormsdefinetheacceptableactionsthateachagentmayperformdependingontheroleor rolesit is playing,andclearlyspecifiesthedatait mayaccessand/ormodify in playingthoseroles.

In this paperwe presentthe formalizationof Carrel,a virtual organizationfor thepro-curementof organsand tissuesfor transplantationpurposes,as an electronicinstitutionusingtheISLANDER [15] institutionspecificationlanguageasformalizinglanguages.Wedemonstrateaspectsof the formalizationof suchan institution,examplefragmentsin thelanguageusedfor the textual specification,and how suchformalizationcan be usedasblueprintin theimplementationof thefinal agentarchitecture,throughtechniquessuchasskeletongenerationfrom institutionspecificationsdescribedin [39] and[37].

Key words: AutonomousAgents,Real-Time Systems,Multi-Agent Systems,AgentMediatedInstitutions,Negotiation.

Preprintsubmittedto Elsevier Science 30October2002

1 Intr oduction

Organandtissuetransplantationis a widely-usedtherapy againstlife-threateningdiseases.But thereare two issuesthat make transplantationmanagementa verycomplex issue:(i) scarcity of donors,soit is importantto try to maximizethenum-berof successfultransplants(ii) donor/recipientmatching, becauseof thediversityandmultiplicity of geneticfactorsinvolvedin theresponseto thetransplant.In thispaperwe proposean agent-basedarchitecturefor the tasksinvolved in managingthevastamountof datato beprocessedin carryingout

� recipientselection(e.g.from patientwaiting listsandpatientrecords),� organ/tissueallocation(basedonorganandtissuerecords),� ensuringadherenceto legislation,� following approvedprotocolsand� preparingdeliveryplans(e.g.using,say, train andairline schedules).

Therelativescarcityof donorshasled to thecreationof internationalcoalitionsoftransplantorganizations.This new, moregeographicallydistributed,environmentmakesan even strongercasefor the applicationof distributedsoftwaresystems,but with the addedcomplicationof the necessityto accommodatea complex setof, in somecasesconflicting,nationalandinternationalregulations,legislationandprotocolsgoverningthe exchangeof organsandtissues.It is the last point whichunderpinsour casefor theuseof so-calledelectronic institutionswhosepurposeisto provideover-archingframeworksfor interactionin thesamewayasinstitutions,or equivalently, collectionsof socialnorms,do in thephysicalworld.

As we will explain later, electronicinstitutionswork with explicit norms[12, 4,7, 11]. Expressingall the regulationsand protocolsin the form of computablenorms—insteadof hard-codingthemsothey arescatteredthroughoutthelogic of aprogram—notonly admitsa readierverification,both informal andformal, of ad-herencebut alsoit givesthesystemtheaddedflexibility of behaviour thatit canbeadaptedin thelight of regulatorychanges(aneventthatis notuncommon).

1.1 Institutions

Thefirstquestionto whichweshouldprovideanansweris ”what is aninstitution?”,while asecondquestionis ”why areinstitutionsuseful?”.

Most humaninteractionsaregovernedby conventionsor rulesof somesort,hav-

Email addresses:jvazquez@lsi.upc.es (J.Vazquez-Salceda),jap@cs.bath.ac.uk (J.A.Padget),ia@lsi.upc.es (U.Cortes),alopeznavidad@hsp.santpau.es (A. Lopez-Navidad).

2

ing their origin in society(emergent)or the laws (codificationof emergentrules)that societyhasdeveloped.Thuswe find that all humansocieties,even the leastdevelopedones,have somekind of socialconstraintsupontheir membersin orderto structuretheir relationsandsimplify their interactions.Someof theseconstraintsare quite informal (taboos,customs,traditions)while someothersare formallydefined(written laws, constitutions).Individualsabsorbtheserules into their be-haviour so they becomesecondnature,which is how the customsof oneculturecancreateproblemsin thecontext of anotherculture.However, socialanthropol-ogy is not the subjectof this paper, we are simply drawing attentionto the factthatcollectionsof expectedbehaviouralpatternsareall aroundus,in shops,banks,conversations,lectures,clubsetc..

The economistandNobel laureateDouglasNorth hasanalyzedthe effect of thiscorporaof constraints,that he refersasto institutions, on the behavior of humanorganizations(including humansocieties).North statesin [29] that institutionalconstraintseasehumaninteraction(reducingthecostof this interaction),shapingchoicesand making outcomesforeseeable.By the creationof theseconstraints,eitherthe organizationsandthe interactionsthey requirecangrow in complexitywhile interactioncostscanevenbereduced.Having establishedtheseinstitutionalconstraints,every competentparticipantin the institutionwill beableto act—andexpectothersto act—accordingto a list of rights,duties,andprotocolsof interac-tion.

As normsare in fact the elementsthat characterizeinstitutionsthey arenot onlyusefulasnormsto be followed,but alsothey enablepeopleto recognizeanorga-nization(suchasa particularcompany) asbeingan instanceof a particularkindof institution,andthenusetheseinformationto predictothernormsthatcouldbeapplicable.

Thus,theanswersto thetwo questionswith which thissectionbeganarethat(i) aninstitutionis asetof possiblyinterdependentnorms(ii) usinginstitutionssimplifiesinteractionandcreatesconfidence.

1.2 Electronic Institutions

Not surprisingly, anelectronicinstitutionis themodellingof aninstitutionthroughthespecificationof its normsin somesuitableformalism(s).Thestatementis sim-ple,but thepracticeis lessso,partly becauseof thewide varietyof norms,sothattheform of expression(deonticlogic, temporallogic, modallogic, classicalpredi-catelogic, types,for example)for onelevel is not necessarilysuitableor evenus-ablefor anotherandpartlybecausethisstratificationthenleadsto aneedto demon-stratecoverageandconsistency betweenthelevels(see[31] for afurtherdiscussionof theseideas).Nevertheless,the fact is that theessenceof an institution,through

3

its normsandprotocolscanbecapturedin aprecisemachineprocessableform andthis key ideaformsthecoreof thenascenttopicof institutionalmodelling.

As we observed earlier, typically, many humaninstitutionshave evolved throughmillenniaof interaction,but we arenow startingto seethe inventionof new orga-nizations(typically asbusinessmodels)which are,in effect, humanexperimentswith institutionalstructures.This practiceis now beingtakenup, but with consid-erablymorefreedomof design,in themulti-agentsystemscommunity, whereit issoftwareagentsthatparticipatein theelectronicinstitutionsandwhichgainfrom asimplificationof the interactionprotocolsanda confidencethata transactionwillbeproperlyconcludedaccordingto thenormsof the institution in which they areparticipating.

It is thecapacityof multi-agentsystems(MAS) to distributethework amongsev-eralautonomous,rationalandpro-activeentities(thesoftwareagents)thathasleadthis technologyto be consideredthe bestoption for the implementationof opendistributed systemsin complex domainssuchas electroniccommerceor virtualorganizations.But building a multi-agentsystemsis a very complex process,asits aim is to establisha societyof autonomousagentsthat interactamongthem-selves in order to achieve oneor several goals.One perceived way to tamethatcomplexity, which is largely theresultof unconstrainedinteraction,is to createvir-tual organizations—instancesof institutions—following theprincipleput forwardby North that the performanceof humanorganizationsis improved throughthecreationof institutionalframeworks.

We have perhapsbeena little free with the useof the termsorganizationand in-stitutionandso to clarify our position,we depictour view of their relationshipinfigure 1. This expressesthe idea that thereis a collectionof norms,which maybe fairly abstractdesiresor wishessuchas “f airness”or “equity”, implementedthroughpolicies, suchthat particularsetsof normscharacterizeinstitutionsandthenthatorganizationsmayeitherbe instancesof institutionsor a combinationofa bespokesetof norms.Suchanorganizationalmodelmaythenbecopiedandex-pandedor simplified,while anotherorganizationmayestablishnew normswhichmaybeaddedinto thegeneralcollection.

In conclusion,webelieve institutionsasnormsareadvantageousbecausethey:

� reduceuncertaintyaboutotheragents’behavior insidetheinstitution,� reducemisunderstanding,as thereis a commoncorpusof normsgoverningagentinteraction,� permit agentsto foreseethe outcomeof a certaininteractionamongpartici-pants� simplify the decision-makingprocessinside eachagent,by decreasingthenumberof possibleactions.

Or, to summarizeandtake a morerobust stance,the useof normsmakesagents

4

NORMS P� O

L I� C� I E� S� PO� L� I�CIE�S�P�O�L�I�C�I�E�S�

P�

O�

L�

I C!

I" E#

S$

P% O& L' I( C) I* E+ S, P-

O.

L/ I0

C1 I2 E3 S

4 P

5 O

6 L

7 I8 .9

INSTITUTIONS ORGANIZA TIONS

char

acte

rize

areborrowedby

establish

clone:

restrict/ex

tend

are instantiatedin

inherit from

Fig. 1. Relationshipbetweennorms,institutionsandorganizations

more successfulin the achievementof their goalsdespitetheir having boundedrationality.

1.3 Planof this paper

In : 2 we introducethe readerto the organandtissueallocationproblem,presentananalysisof theproblemandthensketchthedesignof themulti-agentsystemwehaveprototypedto supporttheallocationprocess.

Thecoreof thepaperis : 3, wherewe show theprocessof formalizingtheinstitu-tion, by groupinginteractionstogetherto makeso-calledscenes, linking thescenesto createtheperformativestructure anddefiningthe normsthat carryobligationsacrossscenes,resultingin a preciseandcomprehensive description.: 3.4 presentssomeillustrative fragmentsof the Carrel specificationin the textual representa-tion of ISLANDER andfollowing this in : 3.5wepresenttheresultingmulti-agentsystemarchitecture.A prototypehasbeenimplementedin JADE, but we arealsoinvestigatingotheragenttoolkits andthe useof emerging tools for the automaticverificationandgenerationof agentplatforms[40, 39].

In : 4 weappraisetherelatedliterature,presentsomeconclusionsandpointto futureresearchissues.

2 A casestudy in transplant organization

Modellingthetransplantprocesscannotbedoneeffectivelyasagedankenexercise:it mustberootedin reality becausetherearesomany actors,somany regulations

5

andso many factorsto take into account.It is alsoessentialto talk to the peopleinvolvedto getaproperpictureof theactivities thattakeplace.

Wehavebeenfortunateto work with theSpanishOrganizacionNacionaldeTrans-plantes; (ONT) and the CatalanOrganitzacio CATalanade Transplantaments<(OCATT) transplantorganizations,whicharestatisticallyamongthemosteffectiveanddemonstratethe highestglobal volumeof transplantsper headof population,thanksto the creationandimplementationof a network of well-coordinatedhos-pitalsandtissuebanks,coupledto thedefinitionof clearproceduresfor thedistri-bution of organsandtissuesanda high level of citizen awarenessof the valueofdonation.

Since1980thenumberof requestsfor theapplicationof transplanttechniqueshasrisensomuch= that thehumancoordinators—thepeopleat thehospitalswho actas the interfacesbetweenthe surgeonsinternally and the organand tissuebanksexternally—arefacing significantproblemsin dealingwith the volume of workinvolved in the managementof requestsandpiece> assignmentanddistribution.Transplant-basedtherapiesare the subjectof much investigationand increasingapplication,suchthatdemandfor piecesmay well rise rapidly in the nearfuture.A review of thecoordinator’s role andthedifficultiesfacedis presentedby Lopez-Navidad[23].

Considerationof the factorswe have summarizedabove leadsto the questionofwhethersomekind of automationof theassignationprocessis desirableandif so,whetherit is possible.In the designandconstructionof our prototype,we haveappliedagenttechnologyto developsoftwarewhich mayassistspecialistsin mak-ing someof thesedecisionsandanallocationof piecesthat is acceptableaccord-ing to thelegislativerequirementsandotherproceduresgoverningthetheprocess.To achieve this, theagentshave to begivendomain-specificknowledge(kinds ofpieces,attributesto describethem,etc.)so they canact rationally ? , andtherulesthey shouldfollow, suchaswhichactionscanbedonewhen,whatinformationcanbeaccessedor givenout,etc..

In this kind of medicalapplicationthe useof rules in order to guide the agents’behaviour is mandatory, asamistakecanleadto anunsuccessfultransplantandpo-tentially thedeathof apatient,aswell asthewasteof piecewhichmighthavebetterbenefitedsomeoneelse.A furthercomplicationis thatall theagentactionsmustre-spectlegislationonthedistributionanduseof piecesfor transplantation.Thisneed

; NationalTransplantOrganization< CatalanTransplantOrganization= Thecontinuousraisein requestsis due,amongotherfactors,to theintroductionof newimmunosuppressorswhichhavesignificantlydecreasedrejectionin recipients’clinical evo-lution.> Fromnow onwe will usethetermpieceinsteadof tissueor organ? In thesenseof SimonandNewells’ BoundedRationality[27].

6

for regulationis oneof thereasonswhy we have modelledtheCarrelMulti-AgentSystemasan ElectronicInstitution [8]. And oneof our hopesis that this choicewill helpto clarify theinteractionamongthedifferentnormsandregulationsfromtheverybasic,at hospitallevel, up to nationalandEuropeanlevels.

2.1 Theorganandtissueallocationprocess

We freely admit thatour experienceof practiceis limited (to date)to theSpanishandCatalanorganizations,but thereis little doubtthat they areboth examplesofbestpractice,andsoconstituteviablephysicalinstitutionson which to baseelec-tronicones.TheSpanishorganizationalmodelhastwo levelsof action:

@ intra-hospital: wheretherole of HospitalTransplantCoordinatorwascreatedto improvethecoordinationof all thepeopleworkingatany stepof thedonorprocurement,allocationandtransplantationprocess@ inter-hospital: wherean intermediaryorganization—OCATT for Catalonia,ONT for thewholeof Spain—wascreatedto improvethecommunicationandcoordinationof all theparticipatinghealth-careorganizations,namelyhospi-talsandtissuebanks.

2.1.1 Procurement

In thecaseof organstheprocessstartsat theprocurementstage, whenthemembersof the coordinationteaminsidea certainhospitalare madeaware of a potentialdonor. A donoralarmis thensentto theONT—exceptin Catalonia,whenit is sentto OCATT. This alarmis signalledby telephone,anda humanmemberof thestaffhasto list thebasicattributesof thedonor, includingtheresultsof clinical analysis,andafirst evaluationof theorgansandtissuesthatcouldbeextractedis carriedout.Thisfirst call is doneasearlyaspossible,usuallywhenbraindeathof thepotentialdonoris diagnosed.

2.1.2 Search

The next stepis to searchfor suitablerecipients.The intermediaryorganization(ONT, OCATT) carriesout a recipientsearchfor eachorganthatmaybeavailableby calling all hospitalswith informationaboutthepieces.To speedup this searchprocess,protocolshavebeendefinedsuchas,lookingfirst for recipientsin thesamehospitalasthe donor, thento hospitalsnearby, thenthe samecity, the samearea,andlastlyanywherein thecountry. In thesituationthatthereis nosuitablerecipientin the country, thenan organis offeredto third countries,eitherinsideor outsidetheEU.

7

2.1.3 Emergencies

In Spain,the ONT maintainsa list of urgent casescontainingall the recipientswhoseconditionis life-threatening.If thereis a suitablerecipientfor an organinthis list thenit is accordedhigherpriority in theassignationprocessover all otherrecipients.

2.1.4 Acceptanceanddelivery

Oncethe recipientfor a certainorganhasbeenidentified,a formal offer is thensentto the surgery team,that will implant the organvia the HospitalTransplantCoordinator. The teamcananalyzeall the informationavailableaboutthe organanddecidewhetherthey want to acceptthe organor whetherthey think it is notwell enoughsuitedto their patient.If they accepttheorganthenthedeliverystagestarts,planningall thevehiclesthatwill beneeded(ambulanceor helicopterfromonehospitalto onenearby, to theairportor to atrainstation;planeand/ortrainfromonecity to the other).Thus,delivery plansmust take into accounttransportationsystemschedules.

2.1.5 Timescales

In the caseof organs,time is oneof the key issues,sincethey canonly be keptoutsideahumanbodyfor ashorttime-span(hours),asall thepreservationmethodsonly can delay, but not stop, the decayprocessarising from their not receivingenoughblood(ischaemia).

In the caseof tissues,suchascorneas,skin or bones,they canbe preserved forlongerperiods—days,evenweeks.Suchrelative resiliencepermitsnot only anef-fective preservation process,but alsoallows time for assessingthe quality of thetissuesandestablishingthe absenceof bacteriaandviruses.The consequenceisa searchstagethatworks in theoppositeway to that for organs.With organs,theprocessis triggeredwhena donorappears,whereasin thecaseof tissues,it is theappearanceof a new recipientthat triggersthesearchthroughthetissuebanksfora suitablepiecefor transplant.This searchtoo is doneby meansof several time-consumingtelephonecallsfrom hospitalsto tissuebanks.

2.2 TheCarrel system

For computersystems,medicineis oneof the mostdifficult fields to manage,asit is extremelydifficult to foreseeall theconditionsthatmayoccur, leadingto un-expectedsideeffectswhencertaindecisionsor actionsareperformedin anunan-ticipatedsituation.As Fox & Dasargue in [18], theseare the kind of ill-defined

8

fieldswhichhavehistoricallybeentheconcernof Artificial Intelligence.They alsoidentify softwareagentsashaving many characteristicswhich areappropriatefortheimplementationof medicalapplications.

An Agent is acomputerprogramcapableof takingits own decisionswith noexter-nal control(autonomy), basedon its perceptionsof theenvironmentandtheobjec-tivesit aimsto satisfy[41]. An agentmaytakeactionin responseto changesin theenvironment(reactivity) andalsotake initiatives(pro-activity). A furtherattributeof agentsis theirability to communicatewith otheragents(socialability), notonlyto shareinformation but also to coordinateactionsin order to achieve goalsforwhich agentsdo not have plansthey canfulfill on their own, solving even morecomplex problems.Agentscanalsoexhibit otherusefulattributessuchas learn-ing, rationality, mobility, benevolenceandveracity. A groupof agentsthatinteractamongthemselvesandsharesomecommonobjectivesis calledagency.

It is with thesepointsin mind thatwe proposeto useAgent technologiesto auto-matepartof theallocationprocess,findingsuitablepiecesfor transplantandgivingsupportto the decisionmakingstepsin that process.The over-archinggoal is toimprove theprocessof selectionandprocurement.A key principleof our solutionis to deploy softwareagentsto create,negotiateandcoordinateplansfor theextrac-tion, transferandimplantationof pieces.To do sowe follow thesameschemeaswasdevelopedin Spanish,creatingsolutionsfor inter-hospitaland intra-hospitallevels.In this paperwe focussolelyon thetissueallocationprocedureA nor do weaddressany issuesrelatedto planning.

2.2.1 Theinter-hospitallevel

At theinter-hospitallevel wehavecreatedtheCarrel Institution, anagentplatformwhosebehaviour couldbebriefly describedasanagencythat receivesa piecere-questfrom onehospitalandthentries to allocatethebestpieceavailablefrom alltheknown tissuebanks.In this agency differententities(theagents)play differentrolesthataredeterminedby their goals,rightsandduties.

Figure 2 depictsall the entities that interactwith the Carrel system,whereTBdenotesa tissuebankandUCTx denotesa transplantcoordinationunit. Therearea) thehospitalsthatcreatethepiecerequests,b) theTissueBanks,andc) observerssuchasthe ONT [30] andOCATT. We make it a requirementin our model thatall hospitals,eventheonesthatown atissuebank,will maketheir requeststhroughCarrelin orderto ensureanacceptabledistributionof piecesandto easethetrackingof all piecesfrom extractionto implant, in thesamemannerasONT andOCATTrequirefor organs.

Therole of theCarrelInstitutioncanbesummarizedin termsof following tasks:

A Organallocationis integratedinto Carrelin [38].

9

Fig. 2. TheCarrelSystemenvironment:theCarrelInstitutionandtheUCTx

T1 ensurethatall theagentswhichentertheinstitutionbehaveproperly—whichisto saythey follow thebehaviouralnorms

T2 acquiretimely informationon all theavailablepiecesin thetissuebanksT3 verify thatall thehospitalsandtissuebanksfulfill all thecriteriaspecifiedfor

interactionwith CarrelT4 provide for externalmonitoring of the fulfillment of the commitmentsmade

within CarrelT5 coordinatepiecedelivery from tissuebanksto hospitalsT6 registerall incidentsrelatedto apiece

A hospitalbecomesa memberof the Carrel institution in order to make useoftheservicesprovided.In doingso,they areagreeingto accepttheoutcomesof thenegotiation(assignation)process.Also, theagentsrepresentingthehospitalsmustrespecttheinstitutionalnorms.A hospitalis representedin Carrelby theTransplantCoordinationUnit (UCTx: Unidad de Coordinacionde Transplantes). This agentservesasinterfacebetweenthesurgeonsandCarrel.Whenasurgeonneedsapiecehe makeshis requestthroughthe UCTx system,which analyzesthe informationenteredby thesurgeon,addstheinformationabouttherecipientand,finally, createsaFinderAgent, thatis, theagentthatgoesto Carrellooking for asuitablepiece.

The information requiredby the Finder Agent to look for a piecein Carrel isheld in anelectronicSealedEnvelope. The informationcontainedin theenvelopeis summarizedin Table1. The SelectionFunction is the part of the informationcontainedin theSealedEnvelopethatallows theFinder Agent to performa nego-tiation. It is composedof a setof rules,eachonea constrainton the pieceto be

10

Table1Theenvelopecontents

Urgencylevel thatworksaselectronicpostagestampandsetstheurgency levelof therequest(in Spain:normal,urgency-1 or urgency-0)

Hospitalidentification acertificateissuedby theCertificationAuthority associatedwiththeCarrelinstitution [8], to allow theinstitution to authenticatethe senderof eachrequestandensurethat only Finder Agentswith requestsfrom authorizedhospitalscanenterandnegotiateinsideCarrel.

Pieceinformation type,parameters,etc.

recipientdata age,sex, laboratoryanalysis,etc.

selectionfunction seeTable2

Table2Theselectionfunctionpredicates

piece predicatesthatdescribetheconstraintstheselectedpiecehasto satisfy, suchastheageof thedonoror thedimensionsof thepieceitself.

origin predicatesthatcansetconstraintsaboutthetissuebank(s)preferredby thesurgeonor thehospital

cost predicatesaboutthecostof thepiece,suchasprice.Note: thecostis just thatofextractionandpreservation.Settlementis managedvia aclearinghouse.

selected.Someof theserulesmayoriginatefrom thepolicy of thewholetransplantunit of thehospital,but theothersareintroducedby thesurgeon,who cansettheconstraintsassociatedwith a givenrecipient.Table2 lists thekind of predicatesaSelectionFunctioncaninclude.

2.2.2 Theintra-hospitallevel

Thefunctioningof theTransplantCoordinationUnit mayalsobenefitfrom theuseof agentsto helpcoordinateall thepeoplein thehospitalrelatedto aparticularcase.Hence,our modellingof theUCT representsnot only thesurgeons,but also:

B thehumantransplantcoordinator, whois theoverallcoordinatorandwhomustcoordinateall the tasksto be doneand who must also be informed of anytransplantrelatedeventB any memberof thehospitalstaff whoplaysarole atany stepof thetransplantprocess,from themomentwhenthepiecearrivesto thehospitalto themomentwhenthepiecehasbeenimplantedin therecipient.

The completearchitectureis shown in figure 3. The role of the Finder Agent hasalreadybeendescribedin theprevioussection.

11

Fig. 3. TheTransplantCoordinationUnit Agency

Staff Agent: is a role for therepresentationof any memberof thestaff involvedintransplants,with theexceptionof surgeonsandtheHospitalTransplantCoordi-nator, which aremorespecialized.TheStaff Agenthelpsthepeopleto plantheirdaily tasks,actingastheir electronicdiary andasa messagereceiver for com-municationsfrom theHospitalTransplantCoordinatorthroughtheCoordinatorAgent. The agentimplementingthis role alsogives,for eachperson,accesstotheclinical informationof patientsin their care.

SurgeonAgent: is a role extendingtheStaff Agent functionalitiesfor thepurposeof useby surgeons.It communicateswith thesurgeonsthroughtheSurgeonIn-terfaceto collectandformattherequestsfor piecesfor transplant.Eachrequest,as mentionedin the previous section,hasto include the relevant informationaboutthepatient,therequiredpiece,optionalmedicalandeconomicrestrictionsandtheSelectionFunction. TheSurgeonAgentsendstherequestto theAnalyzerAgent, which thenchecksif all the characteristicsneededhave beensupplied,andif thevaluesareconsistentfollowing agivenprotocol.

CoordinatorAgent: responsiblefor thedistributionandcoordinationof thediffer-enttasksthatmake up thewholeprocess.TheHospitalTransplantCoordinatorin personcancommunicatewith this Agent throughtheCoordinator Interface,

12

andcontrolthebehavior of theagent.DB Agent: verifiesthateachaccessmadeby agentsin UCTxto theclinical datain

theHospitalDatabaseis authorized,following a role-basedaccesspolicy [21].PlannerAgent: is responsiblefor creatingthe transplantplan, that is, finding an

operatingtheatreto matchthearrival timeof thepieceandthesurgeon’savailableschedule.ThePlannerAgentcansendseveralproposalsto thesurgeonandtherestof thestaff involvedandtriesto reachanagreement.

Arrival Agent: is responsiblefor updatingthePlannerAgentabouteventsthatcanchangethe delivery plan, eventsthat canoccurwhile the transportationof thetissueis madefrom thetissuebankto theHospital.

ConsultationAgent: actsasthe interfaceto the institution’s database,andservesto processthedifferenttypesof queriessentby theSurgeonAgent, thePlannerAgentor theCoordinator Agent. This is done,aswith FinderAgents,by goingto theCarrel institution.

For moredetailsabouttheUCTx system,includinga moredetaileddescriptionofeachagentandthespecificationof themessagesused,see[9].

2.3 Securityconsiderations

Transplantinformationis consideredhigh-riskdataasit includessensitiveinforma-tion aboutpeople(donorsandrecipients).So the UCTx andCarrelsystemshaveto observe the local, nationalandEuropeanUnion legislationon transplants(seethereportsof theONT in [10] andtherecommendationsof theTransplantExpertsCommitteein [24]). It alsofollows theEuropeandirectivesandtheSpanishlaw onpersonaldataprotection[22] [13] [32]. In particular, bothhave to ensureconfiden-tiality, privacy andintegrity of patientanddonordata.This is a long-standingissuein healthcarethatacquiresnew facetswith theuseof ElectronicMedicalRecords(EMR). Oneof thebenefitsof usingelectronicrecordsis that it assuresaccessforauthorizedandauthenticatedusersaswell astrackingaccessasdemandedby law.It is importantfor patientanddonortrustthatit canbedemonstratedthattheinfor-mationaboutthemmaynot beusedfor any purposebeyondthat for which it wascollected.

3 Formalizing the Carr el Institution

Wewill focusnow ontheCarrelInstitution,asit is theonethatperformsthemedi-ationamonghospitalsandtissuebanksin thetransplantprocess.

To give a formal descriptionof theCarrelsystemwe will follow the ISLANDERformalismdescribedin [15]. This formalismviewsanagent-basedelectronicinsti-

13

tutionasa typeof dialogical systemwhereall theinteractionsinsidetheinstitutionareacompositionof multipledialogicactivities (messageexchanges).Theseinter-actions(calledillocutions[28]) arestructuredthroughagentgroupmeetingscalledscenesthat follow well-definedprotocols.A secondkey elementof theformalismis thenotionof agentrole. Eachagentcanbeassociatedto oneor moreroles,andtheserolesdefinethescenestheagentcanenterandtheprotocolsit shouldfollow.Thesceneprotocolsaredefinedasmulti-role conversationalpatterns.

3.1 Theperformativestructure

Thescenesandthe connectionsbetweenthemconstitutestheperformativestruc-ture. This is anetwork of scenesthatdefinesthepossiblepathsthateachagentrolemaytake throughtheinstitution.In accordancewith its role,anagentmayor maynotbepermittedto follow aparticularpaththroughtheperformativestructure,andultimately, mayberequiredto leave the institution.Becauseof theneedto modelthesystemaccuratelyandverifiably, weuseformal specificationtechniqueswhichthenpermit theautomaticverificationof propertiesby meansof theorem-proving(futurework) andmodel-checking(work in progress)andfinally leadto automaticgenerationof validatedagentskeletons,representationof ontologiesandtheactualinstitutionalstructure.

In theCarrelSystem,theinteractionamongtheagentsandtheinstitution is struc-turedusingthefollowing scenes:

ReceptionRoom: whereall the external agentsshouldidentify themselvesandwherethey areassignedthe initial rolesthey areauthorizedto play. Any piecerequestscarriedby arriving agentsarevalidatedat this stage.

ExchangeRoom: whereagentscarryingpiecerequestsstartnegotiationwith theinstitutionfor theassignationof apiece.

Confirmation Room: wherethe provisional assignmentsmadein the ExchangeRoomareconfirmedor withdrawn becauseof thearrival of anotherrequestwithhigherpriority. Subsequently, in caseof the confirmedones,a delivery plan isprepared.

Consultation Room: where the institution is updatedabout any event or inci-dentrelatedto a piece.Agentscomingfrom tissuebanksinform the institutionaboutpieceavailability, while agentscoming from hospitalsinform the insti-tution aboutthe receptionof the piece,the transplantand the progressof therecipient.

Thenext stepin theformalizationprocessis to definetherolesthatmaybeplayedin theCarrelsystem.Therearetwo kindsof roles:theexternal roles(rolesfor in-comingagents)andthe institutional roles(rolesfor agentsthatcarryout theman-agementof theinstitution).Theexternalrolesarethefollowing:

14

Consultation

Room

ENTERReception

RoomEXIT

Exchange

Room

Confirmation

Room

[x:rrm] C[y:hf,z:hc,w:tb]D

[x:cfrm] C

[x:crm] C

[x:erm]C[y:hf]

E F GIH

[z:hc,w:tb]J K LNM

[y:hf] D[y:hf] D

[y:hf] O

[z:hc,w:tb]

P

[y:hf]Q[y:hf] R

Fig. 4. TheCarrelInstitutionperformative structure

Hospital Finder Agent(hf): agentssent by hospitalswith piece requeststo beservedby theCarrelsystem.

Hospital ConsultationAgent(hc): agentssentby hospitalsto keeptheCarrelsys-temupdatedaboutany eventrelatedto apiece.They canalsoperformquerieson theCarreldatabaseby meansof theDB agent(seeS 3.5).

TissueBank Notifier (tb): agentssentby tissuebanksin order to updateCarrelaboutpieceavailability.

Theinstitutionalrolesconsistof oneagentto coordinateall thescenerelationships,the Institution Manager (im) and one agentto manageeachscene:ReceptionRoom Manager (rrm) the Exchange Room Manager (erm), the ConfirmationRoomManager(cfrm) andtheConsultationRoomManager(crm)

With all the scenesandroles identified,the performative structurecanbe drawn(seefigure4). Nodesarethesceneslistedaboveplusenterandexit nodesin orderto definebeginningandendingpointsin the diagram.Arcs arelabelledwith tagsof the form [variable:role]TVUWUWXZYZY , wherevariable is an agent[ , role is one of theidentifiedrolesfor theCarrelsystemandaccessis eitherthenumberof instancesof agentsplaying suchrole that canentertogetherinto the scene,or \ meaningthat theagentis theonethatcreatesthescene.Thediagramin figure4 shows, forinstance,that scenemanagersgo directly from the enter point to the scenetheyshouldmanage(the \ means,asmentionedbefore,that they aretheonescreatingthescene),while all theexternalagentsmustproceedthroughtheReceptionRoomscenein orderto be registeredandthenbedirectedto thepropersceneaccordingto their roles.

Theperformativestructureis alsousefulasa blueprintfor thefinal agentarchitec-ture(seesectionS 3.5).

15

3.2 Describingthesceneprotocols

Oncetheperformativestructureis defined,thenext stepis to definetheinteractionsbetweenthe agentswithin the scenes.We do this by meansof a sceneprotocol,which definesthe acceptedsequencesof messagesthat two or more agentscanutter within an scene.The protocol is representedby meansof a directedgraph,whereeachnodeis anstepor stateof theconversation,andarcsareutterances.Foreachillocution thereis anillocution scheme,which definespreciselythenatureofthe utterance,the rolesof the senderandthe receiver(s)of the utteranceandtheinformation that is exchanged.Examplesof suchrepresentationscan be seeninfigures6 to 12.Within theconversationgraph,thegreyedout nodesdenotepointsat which agentsmay join the conversation,thosewith a doublecircle, whereanagentmayleave theconversation,while therestareintermediatenodes.

ReceptionRoom As explainedabove,in theReceptionRoomagentsenterandareregisteredwith theplatformandaccordingto theirrolesaredirectedto theproperroom.Theprotocolfor thissceneis shown in figure6: anagent] makesarequestfor admission(1) thatcanbeaccepted(messages3a,3b,3c)or refused(message2, exit state _ ). Accordingto theroleof theincomingagent] it is directedto theConsultationRoom(exit stateba ) or its requestis validated(messages4 and5,exit statebc ). Thenagent] waitsuntil aninstanceof ExchangeRoomis availablein which to negotiateover the kind of piecesagent] is requesting(messages6and7, exit statebd ).

ExchangeRoom TheExchange Roomis theplacewherenegotiationover piecesis performed.Theprotocolof this sceneis shown in figure8: agent] , a hospitalFinder Agent, asksthescenemanagerfor pieceofferswhich matchtherequire-mentsgiven in their petition. Thenthe scenemanagergivesa list of availablepieces(message9) that is evaluatedby the externalagent] (message10). Withthis informationthe scenemanagercanmake a provisionalassignmentandre-solve the situationof whentwo agentsareinterestedin the samepiece.Whenthisprovisionalassignmentis delivered(message11) thenagent] exits thesceneto go to theConfirmationRoomrepresentedby stateba . Thereis analternativepathfor thecasewhenthereareno availablepiecesmatchingthe requirementsdescribedin thepetition (message9 with null list). In this caseagent] requestsanexit permissionfrom theinstitution(message12,exit state _ ), includingthereasonfor leaving.Thereasonprovidedis recordedin theinstitutionlogsto formanaudittrail for therelevantauthoritiesto inspect.For furtherinformationaboutthis negotiationprocesssee[8].

Confirmation Room In this scene,the provisional assignmentsmadein the Ex-change Roomareeitherconfirmedor withdrawn. Figure10 shows theprotocolof this scene:theagent] cananalyzetheassignedpiecedataandthenacceptorrefuseit (message13). If theagent] acceptsthepieceandno higher-priority re-questsappearduring a certaintime window thenthe provisionalassignmentisconfirmedandadeliveryplanis givento theagent] (message14),andthenit ex-

16

ae af ag ah ai aj

w f wg wh wi

1 3a

3b3c

2

4 5(ok)

5(faulty-void)

6

6

7

Fig. 5. Theconversationgraphfor theReceptionroom

Msgk Illocution

1 (request (?x hf lhc ltb) (?y rrm) (admission ?id agent

?role ?hospital certificate))

2 (deny (!y rrm) (!x hf lhc ltb) (deny ?deny reason))

3a (accept (!y rrm) (!x hf) (accept hf))

3b (accept (!y rrm) (!x hc) (accept hc))

3c (accept (!y rrm) (!x tb) (accept tb))

4 (inform (?x hf) (?y rrm) (petition ?id hospital?urgency level ?time to deliver ?piece type

(?piece parameters) (?info recipient)))

5 (inform (!y rrm) (!x hf) (petition state ?id petition

ok lfaulty))6 (inform (?y rrm) (?x hf) (init exchange ?piece type

?id exchange room))

7 (request (?x hf) (?y rrm) (exchange entrance request

!id exchange room))

Fig. 6. Theillocutionsfor theReceptionroom

its theCarrelsystem(exit statembg ). Whenthereis a requestwith higherprioritythatneedsthepieceprovisionallyassignedto agentn aconflict arises.To resolvethe conflict the scenemanagernotifiesthe agentn that the assignmenthasbeenwithdrawn (message15) andthatit is thenentitledto a freshrequestfor anotherpiece(message16) to benegotiatedagainin theExchangeRoom.

Consultation Room This sceneallows agentscoming from hospitalsor tissuebanksto inform Carrelof thelocationandstatusof known andnew pieces.Notethatweassumethatatissuebankonly participatesin oneinstanceof Carrelatthesametime.Theprotocolof thissceneis shown in figure12.Theincomingagentscanperformnotifications(messages17,18,19) andareinformedif thenotifica-tion is successful(message20). Theagentscomingfrom hospitalsrepresentingtheHospitalTransplantCoordinatorcanalsoperformqueries(message21)about

17

ao ap aq ar

asNt w s wu

8 9(offers) 10

119(nil-void)

12

Fig. 7. Theconversationgraphfor theExchangeroom

Msgv Illocution

8 (query-if (?x hf) (?y erm) (offer list ?id petition))

9 (inform (!y erm) (!x hf) (offer list !id petition(list (?id piece1 ?info piece1) ... (?id piecen

?info piecen)))

10 (inform (?x hf) (?y erm) (weighted list !id petition(list (!id piece1 ?weight) ... (!id piecen ?weight)))

11 (query-if (?y erm) (?x hf) (piece offer (?id petition

?id piece ?cost estimation) wvoid))12 (request (?x hf) (y im) (exit ?exit reason))

Fig. 8. Theillocutionsfor theExchangeroom

historical information,suchasstatisticson, say, successfulcorneatransplanta-tionsoveracertainperiod.Thequeriesareanswered(message22)with thelevelof detail that is permittedfor a certainrole, wherethe permissionsareverifiedaccordingto a Role-BasedAccessModel [21]. Whenthe incomingagentshaveperformedall thequeriesandnotifications,they exit theCarrelsystem(message23).

3.3 Normativerules

Althoughwe ashumansfunction in thecontext of normsin many differentsitua-tionseveryday, wehavebecomesousedto themthatwearenotnecessarilyawareof them.Thepremisebehindour useof electronicinstitutionsis thatwe aretryingto defineandconstructsimilarmechanismsto helpcontrolandsimplify interactionfor agentsin virtual worlds.And theobjectivesandoutcomesremainthesame:togovern the behaviour of agents,establishrights andobligationsandabove all, tocreateanatmosphereof trust.

At a high level normsappearto sayvery a little andconvey no hint of how they

18

axyx axNz wz

axN{ w{

axN| w x

13(accept) 14

15 15

13(refused)

12

16

Fig. 9. Conversationgraphfor theConfirmationroom

Msg} Illocution

12 (request (?x hf) (y im) (exit ?exit reason)

13 (inform (?x hf) (?y cfrm) (piece eval ?id petition

?id piece accepted ~refused))14 (inform (?y cfrm) (?x hf) (piece delivery

?id petition ?id hospital ?id tissue bank

?delivery plan))

15 (inform (?y cfrm) (?x hf) (piece reassigned exception

?id petition ?id piece ?reassignment reason))

16 (query-if (?x hf) (?y cfrm) (another offer list

?id petition))

Fig. 10. Illocutionsfor theConfirmationroom

maybeimplemented:wemightexpressdesiresfor “f airness”or “equity”, but suchnormsareuseless—insteadwe have to inventrulesof behaviour, restrictions,con-straints,requirementsandobligationswhich satisfyus that they supportthemoreabstractnorms.And eventually, this normrefinementprocesscanbeseento bringusright down to thelevel of individualactions,suchasleaving ascene,or individ-ualexpressions,suchastheprotocolsdefinedby theconversationgraphs.Thus,wecanalsofind normsdefinedimplicitly in theperformativestructure:

� inter-sceneconstraints: connectionsamongscenesare, in fact, constraintsabouttheacceptedpathsfor eachagentrole insidethescenenetwork.� intra-sceneconstraints: the sceneprotocolsdefinethe acceptedinteractionsfor eachagentrole (whatcanbesaid,by whom,to whomandwhen).

Theseimplicit normsaremadeexplicit by theagentswhile they arefollowing the

19

a�N� a�N�

a�N� w �

171819

20

2122 23

Fig. 11.Conversationgraphfor theConsultationroom

Msg� Illocution

17 (inform (?x hc) (?y crm) (piece arrival ?id hospital

?id tissue bank ?id piece (?state)))

18 (inform (?x hc) (?y crm) (transplantation eval?id piece ?id recipient ?date

(?info transplantation)))

19 (inform (?x tb) (?y crm) (tissue bank update

?id tissue bank ?id piece (?specifications)))

20 (inform (!y crm) (!x hc �tb) (notification ack

!id piece ok �error))21 (query-if (?x hc) (?y crm) (?query))

22 (inform (!y crm) (!x hc) (query results (?results))

23 (request (?x hc �tb) (?y im) (end))

Fig. 12. Illocutionsfor theConsultationroom

paths.

But thereareothernormsthatarenot yet defined.Thesearenormswhereactionstaken by an agent� inside a certainscenemay have consequencesfor its futureinteractionsoutsidethat scene.An instanceof this kind of situationin Carrel isthe arrival of a high-priority requestin the ReceptionRoomscenehaseffects intheConfirmationRoomscene,asany provisionalassignmentcannotbeconfirmeduntil the high-priority requesthasbeenserved.This canbe expressedinformallyby a rule suchasthefollowing:

if a requesthasarrived in thereceptionroom,andtherequestis high-priority,andtherequestis well-formed,

20

andno piecehasyetbeenassignedto therequest,thentherecanbenoassignmentconfirmationin theConfirmationroom.

Figure13 showsthis rule split into its elements(preconditionsandpostconditions)alongwith a formal specificationof eachelement.

3.4 Thetextual specification

A topic of on-goingwork is the useof model-checkingto establishpropertiesofthe sceneprotocolsandof the performative structure.For this reason,thereis acomplementarytextual presentationof the illocutions,scenes,dialogic frameworkandperformative structure,which is amenableto transformationandanalysisforexactly this purpose.It mustbe emphasizedthat the textual representationis de-signedto capturethe institutional information,ratherthanbeingdirectly suitablefor model-checking.On the otherhand,it is relatively straightforward to extractthetransitionnetworksandthearc labelsfrom thespecificationandthengeneratetextual input for modelcheckerssuchasSpin[20] or nuSMV[5]. Figure14 showspartof thetextualdescriptionof theCarrelsystem.

3.5 Theagentarchitecture

Onceall theabove framework is in place,we arethenableto describethewholemulti-agentsystemandtherelationsamongtheagents.

It is straightforwardto gettheagentarchitecture(figure15) from thePerformativeStructure.First of all, thereis at leastone staff agentfor eachinstitutional role(identifiedin � 3.1): theRR Agent asa receptionroommanager; theCR Agent asa consultationroommanager; anER Agent for eachexchangeroom,actingasanexchangeroommanager; theCfR Agent asaconfirmationroommanager; andtheIM Agent asthe institutionmanager, coordinatingtheotheragents.

In orderto assisttheagentsmentionedabove,two specializedagentsareadded:thePlanner Agent which is a specializedagenttaskedwith carryingout theplanningneededin theConfirmationRoom,andtheDB Agent (anagentspecializedin theaccesscontrolto theDatabase,alsodepictedin thefigure).

Finally we have includedaninterfaceconnectedto the InstitutionManager, to al-low ahumanadministratorto accessthesystem.

A prototypeof thisarchitecturehasbeenimplementedin JADE [2] andit is thereby(mostly!)FIPA compliant[16].

21

done((inform (?x hf)(?y rrm) (petition?id hospital ?urgency level?time to deliver ?piece type(?piece parameters)

(?info recipient))), r-room)

if a requesthasarrived in the receptionroom

�AND

!urgency level � urgency 0 therequestis high-priority�AND

done((inform (!y rrm) (!x hf)(petition state ?id petition

ok)), r-room)

therequestis well-formed

�AND

� done((inform (?z cfrm)(!x hf) (piece delivery!id petition !id hospital?id tissue bank

?delivery plan)), cf-room)

no piecehasyet beenassignedto this re-quest

� THEN

�(w hf): (w �� x)

: � done(((inform(!z cfrm) (!w hf)(piece delivery ?id petition?id hospital ?id tissue bank

?delivery plan)), cf-room)

therecanbe no assignmentconfirmationin theConfirmationroom

Fig. 13.A normlinking actionsin onescenewith consequencesin another

3.6 Formalizingtheinstitutionalagents

At thispointall theinteractionsamonginstitutionalagentsandexternalagentshavebeenmodelled.In factsuchinteractionshave beenspecifiedin a very formal wayby meansof norms. The laststepto completethedefinitionof the institution is todescribethebehavior of theinstitutionalagentsandtheinteractionsbetweenthem.

Following [31] we areworking with theAmbientcalculus(a processalgebrawithlocations[3]) in orderto obtainaprecisedescriptionof theinteractionof theinstitu-

22

(define-performative-structure carr-performative-structurescenes:((root root-scene) ;declare the(r-room reception-room-scene) ;scenescomprising(e-room exchange-room-scene) ;theinstitution(cf-room confirmation-room-scene)(cs-room consultation-room-scene)(output output-scene)

)connections:((root r-room consulter ...))) ;andsetup theconnections

(define-dialogic-framework fm-dialogic-frameworkontology: carr-ontologyrepresentation-language: first-order-logicillocutionary-particles: (......)external-roles: (hf, hc, tb) ;list all therolesinternal-roles: (im, rrm, erm, cfrm, crm) ;thatparticipatingrole-hierarchy: ((im rrm) (im erm) ;agentsmayplay and

(im cfrm) (im crm) ;howtherolesare related) ;to oneanother

role-compatibility: (incompatible: (hf tb) (hc tb) (hf hc)))

(define scene e-room ;describetheconversationgraphroles: (erm hf) ;containedin a particular scenedialogic-framework: e-room-df ;specifyingwhich rolesmayparticipatestates: (a6 a7 a8 a9 a10 w1 w2) ;therestis justa textualinitial-state: a6 ;representationof a finitestatefinal-states: (w1 w2) ;machineaccess-states: ((erm (a6)) (hf (a6 a7)))exit-states: ((erm (w2)) (hf (w1 w2)))agents-per-role: ((erm 1 1) (hf 0 n))transitions: ;transitionlabelsare speech acts((a6 a7 (query-if (?x hf) (?y erm) (offer_list ?id_petition) ))(a7 a8 (inform (!y erm) (!x hf) (offer_list !id_petition(list (?id_piece1 ?info_piece1) ... (?id_piecen ?info_piecen)))))

...(a10 w1 (request (?x hf) (?y im) (exit ?exit_reason) ))

)constraints: ()

)...

(define-norm urgency0-arrival ;definea normin threepartsantecedent:(((r-room

(inform (?x hf) (?y rrm)(petition ?id_hospital ?urgency_level ?time_to_deliver ?piece_type(?piece_parameters) (?info_recipient) ) ) )

(!urgency_level = urgency_0))((r-room(inform (!y rrm) (!x hf) (petition_state ?id_petition ok )) )

(nil)))defeasible-antecedent:((cf-room(inform (?z cfrm) (!x hf)(piece_delivery !id_petition !id_hospital ?id_tissue_bank ?delivery_plan))))

consequent:(forall (w hf) (not (= w x))(obliged !z (not (inform (!z cfrm) (!w hf)(piece_delivery ?id_petition ?id_hospital ?id_tissue_bank ?delivery_plan) ), cf-room)))

)

Fig. 14.Partof theCarrelspecificationin text format

tionalagents.Wedo notpresentany of this aspectof theformalizationhere,partlybecauseof its mathematicalnatureandpartlybecauseof theamountof introductorymaterialthatwouldbeappropriateto assistin its comprehension,but primarily be-causewe regardthefocusof this papernot to beprocessalgebraicmodelling,butratherthe demonstrationof the useof norms—implicit and explicit—to specifysoundsystemsin medicaldomains.

23

Fig. 15.TheCarrelInstitutionAgency

4 Conclusions

Theuseof softwaresolutionsto assistthemedicalstaff in their daily tasksis nota new topic. In fact thereis a significantsub-areaof softwareengineeringcalledMedical Informaticsor Electronic Health-Care aiming to find new ways to useinformationtechnologiesto:

� modelandapplymedicalknowledge� create,storeandretrievepatientrecords� define,selector improvediagnosisandtreatmentguidelines� improvecommunicationamonghealthprofessionals,andalsobetweenhealthprofessionalsandpatients� (re-)organizeandimproveany healthcareservice

In section� 2.2wepresentedtheutility of agentsin medicalapplications.As notedin [18, 35] thestrengthsof AgentTechnologies(mainlypro-activityandautonomy)

24

make suchtechnologieswell-suitedfor medicalapplications.We will summarizehereonly someof theirarguments:

� the capability of agentsto anticipatepro-actively the information needsofusers,� their supportof synchronousandasynchronouscommunicationamongpar-ties,� their suitability to supportdistributeddecisionmaking� their ability to adaptto unpredictedsituations� their capabilityto adapttheHealthCareservicesto thepatientneeds

As a resultof theseabilities, the useof agentsfor medicalapplicationsis rising.[35] providesa comprehensivereview of theuseof Agentsin HealthCare.

A centralaspectsof our work hasbeenformalization.In [18] it is statedthereisa needto develop methodologiesand, if possible,formal designmethodswhenapplyingagentsto the medicaldomain.In their work they presentthePROformaformalism,whichpermitsthedefinitionof guidelinesto befollowedby eachagentin thesystem.For our purposesandfrom thepoint of view of distributedsystems,theproblemis that the formalismdoesnot cover thecommunicationactsandthedependenciesbetweenguidelinesandhencehow thebehaviour of oneagentmayaffectanother.

We have presentedherethesuitability of a generalformalismfor multi-agentsys-temssuchasISLANDER [15], basedontheideaof adialogical framework, appliedin the medicaldomain.We have appliedsuchformalismto the problemof trans-plantpieceallocation,andby doingsowe havebeenableto build a first prototypeof theCarrelsystem.

Most of the work in the field of transplantallocation(suchas EU projectsRE-TRANSPLANT [33] � , TECN [34]) is devotedto the creationof a) standardfor-matsto storeandexchangeinformationaboutpieces,donorsandrecipientsamongorganizations,b) telematicnetworks,or c) distributeddatabases.Theprojectedout-comesof this projectarepotentiallyextremely importantandusefulbecausethedevelopmentof standardontologiesto definethe conceptsof the domainof dis-coursefor agentsis an essentialstageon the way to the effective deploymentofthis technology. ProjectESCULAPE[14] usesconventionalsoftware to help intissuehistocompatibilityby developingHLA � referencingcomputersystemsandsoftwarepackagesto beusedby hospitalsandlaboratoriesasahumantissuetypingtool.

� Unfortunately, there is no information available about the practical resultsof thoseprojectsotherthantheprojectURL.� HumanLeucocyteAntigens.

25

Therearevery few referencesin theliteratureabouttheuseof agentsin thetrans-plantdomain.[36] describesanagentthatusesmulti-criteriadecisiontechniquesintheselectionof thebestreceiver in a transplant,providing theHospitalTransplantCoordinatorwith a resultaccordingto theweightstheuserassignedto eachcrite-ria. [26] describesanhierarchicalmulti-agentsystemwheretheagenton therootnodeplanstransportroutesbetweenhospitalsusingtheinformationobtainedfromthe otheragentsin the hierarchy, removing routesthat will exceedthe maximumavailabletimefor transportationandavoidingpotentialfataldelaysdueto mistakesin coordinationof differentmeansof transport.[25] proposesa multi-agentsys-temarchitectureto coordinatehospitalteamsfor organtransplants.Coordinationisachieved throughagentsthat keeptrack of the personnelschedulesandtheavail-ability of the facilities (both describedas time-tablesdivided into slots of thirtyminutes).Finally [1] presentsan alternative designfor a multi-agentarchitecturefor theSpanishorganallocationprocess.It identifiestheagentsneededto solvetheproblemandorganizesthemin four levels(HospitalLevel, Regional Level, ZonalLevel andNational Level). However, no formalismis usedin the developmentofthearchitecture.

As far aswe know, CARREL is thefirst softwaresystemappliedto thetransplantallocationproblemthatjoins thestrengthsof agentswith theadvantagesof formalspecifications.

As partof our futurework weaimto expandtheformalismpresentedherein orderto describeother issues(suchas the delegationof all non-fulfilled commitmentsof the incomingagentsto thehospitalsthey belongto, which is not currentlyex-pressibleby theformalism),andthecreationof tools to build agentplatformsau-tomaticallyfrom institutionspecifications.A preliminaryreporton thegenerationof institutionsandtheagentsto populatethemappearsin [39], while preliminaryreportson theuseof model-checkingof institutionalmodelsappearsin [40, 6].

Wealsoaimto exploretheextensionof thePROformaformalism[17,19] to includeagentcommunication,sothatit maybeusedto modelsystemswith characteristicslikeCarrel.

References

[1] A. Aldea,B. Lopez,A. Moreno,D. Riano,andA. Valls.A multi-agentsystemfor organtransplantco-ordination. In S. Quaglini,P. Barahona,andS. An-dreassen,editors,Proceedingsof the8th. EuropeanConferenceon ArtificialIntelligencein Medicine, Portugal, 2001, LectureNotes in Artificial Intel-ligence2101:Artificial Intelligencein Medicine,pages413–416.Springer-Verlag,2001.

[2] F. Bellifemine,A. Poggi,andG. Rimassa.JADE : A FIPA compliantagentframe-work. In Proceedingsof Practical Application of Intelligent Agents

26

andMulti-agentSystems, pages97–108,London,1999.PracticalApplicationCompany Ltd.

[3] L. Cardelli. Mobility and security. In F. L. Bauer, editor, Proceedingsofthe NATO AdvancedStudyInstituteon Foundationsof Secure Computation,numberISBN 1 586030159 in NATO ScienceSeries,pages3–37.IOSPress,1999.

[4] C. Castelfranchi,F. Dignum, C. Jonker, andJ. Treur. Deliberatenormativeagents:Principlesand architecture. In Proceedingsof The Sixth Interna-tionalWorkshoponAgentTheories,Architectures,andLanguages(ATAL-99),Orlando,FL, LectureNotesin Artificial Intelligence1757.Springer-Verlag,1999.

[5] A. Cimatti, E. M. Clarke, F. Giunchiglia,andM. Roveri. NuSMV: A newsymbolicmodelchecker. InternationalJournal on Software Tools for Tech-nologyTransfer, 2(4):410–425,2000.

[6] O.Clif fe andJ.Padget.A framework for checkingagentinteractionwithin in-stitutions.In Proceedingsof MOCHARTworkshopat ECAI’02, Lyon,France,2002.

[7] R. Conte and C. Castelfranchi. Are incentives good enough toachieve(info)socialorder? In C. DellarocasandR. Conte,editors,WorkshoponNormsandInstitutionsin Multi-AgentSystems. ACM-AAAI, ACM Press,2000.

[8] U. Cortes,A. Lopez-Navidad,J.Vazquez-Salceda,A. Vazquez,D. Busquets,M. Nicolas,S. Lopes,F. Vazquez,andF. Caballero.Carrel:An agentmedi-atedinstitutionfor theexchangeof humantissuesamonghospitalsfor trans-plantation. In 3�Z� Congres Catala d’Intel.ligenciaArtificial, pages15–22.ACIA, 2000.

[9] U. Cortes,J.Vazquez-Salceda,A. Lopez-Navidad,andF. Caballero.UCTx:A multi-agentsystemto assista transplantcoordinatorunit. In AppliedIntel-ligence:MachineLearningPolicies. 2002.

[10] O. N. deTransplantes,editor. Informesy DocumentosdeConsensopromovi-dospor la Organizacion Nacionalde Transplantesy la Comision de Trans-plantesdel ConsejoInterterritorial del SistemaNacionaldeSalud. EditorialComplutenseS.A., Madrid,Spain,1��� edition,2000.

[11] C. DellarocasandM. Klein. ContractualAgentSocieties:Negotiatedsharedcontext andsocialcontrol in openmulti-agentsystems.In C. DellarocasandR. Conte,editors,Workshopon Normsand Institutionsin Multi-Agent Sys-tems, pages1–11.ACM-AAAI, ACM Press,2000.

[12] F. Dignum. Abstractnormsandelectronicinstitutions. In G. Lindemann,D. Moldt, M. Paolucci,andB. Yu, editors,Int. WorkshoponRegulatedAgent-BasedSocialSystems:Theoriesand Applications(RASTA02), volumeMit-teilung318,pages31–50.U. Hamburg, 2002.

[13] Directive 95/46/CEof theEuropeanParliamentandof theCouncilof 24 oc-tober1995on the protectionof individualswith regardto the processingofpersonaldataandof thefreemovementof suchdata,October1995.

[14] ESCULAPE: Use of computertechniquesfor tissuesmatchingand anal-

27

ysis as an aid to human transplantation. http://dbs.cordis.lu/cordis-cgi/srchidadb?CALLER=EN_CORDIS&QZ_WEBSRCH=E%SCULAPE.

[15] M. Esteva, J. Padget,andC. Sierra. Formalizinga languagefor institutionsandnorms.In J.-J.MeyerandM. Tambe,editors,IntelligentAgentsVIII , vol-ume2333of LectureNotesin Artificial Intelligence, pages348–366.SpringerVerlag,2001. ISBN 3-540-43858-0.

[16] TheFoundationfor IntelligentPhisicalAgents,http://www.fipa.org/repository/fipa2000.html. FIPA Specifications, 2000.

[17] J.Fox andS.Das.SafeandSound. MIT Press,Boston,1��� edition,1999.[18] J. Fox and S. Das. Guardian agents for safety-critical systems. In

V. Shankararaman,editor, Workshopon AutonomousAgentsin HealthCare,pages25–34,Barcelona,Spain,2000.

[19] J. Fox, N. Johns,A. Rahmanzadeh,andR. Thompson.Proforma:A methodandalanguagefor specifyingclinical guidelinesandprotocols.In J.Brender,J.P. Christensen,J.-R.Scherrer, andP. McNair, editors,Medical InformaticsEurope’96, pages516–520.IOSPress,1996.

[20] G. J. Holzmann. The Spin modelchecker. IEEE Transactionson SoftwareEngineering, 23(5):279–95,May 1997.

[21] A. Lin. Integratingpolicy-drivenrole-basedaccesscontrolwith commondatasecutiryarchitecture.TechnicalReportHPL-1999-59,HP LaboratoriesBris-tol, 1999.

[22] Ley Organica15/1999de proteccion de datosde caracterpersonal.BoletınOficial del Estado292,14dediciembre1999.

[23] A. Lopez-Navidad. Professionalcharacteristicsof thetransplantcoordinator.TransplantationProceedings, (23):1607–1613,1997.

[24] R. Matesanz.Meetingthe organshortage:Currentstatusandstrategiesforimprovementof organdonation.NewsletterTransplant, 4(1):5–17,1999.

[25] A. Moreno,A. Valls, andJ. Bocio. Managementof hospitalteamsfor or-gantransplantsusingmulti-agentsystems.In S. Quaglini,P. Barahona,andS. Andreassen,editors,Proceedingsof the8th. EuropeanConferenceon Ar-tificial Intelligencein Medicine, Portugal, 2001, LectureNotesin ArtificialIntelligence2101,pages374–383.Springer-Verlag,2001.

[26] A. Moreno,A. Valls, andA. Ribes. Finding efficient organtransportroutesusingmulti-agentsystems.In IEEE3rd InternationalWorkshoponEnterpriseNetworkingandComputingin HealthCare Industry(Healthcom), L’Aquilla,Italy, 2001.

[27] A. Newell and H. Simon. The knowledge level. Artificial Intelligence,18(1):87–127,1982.

[28] P. Noriega. Agent-MediatedAuctions:TheFishmarket Metaphor. Number8in IIIA MonographSeries.Institut d’Investigacio en Intel.ligenciaArtificial(IIIA), Bellaterra,Spain,1997.PhDThesis.

[29] D. North. Institutions,Instutional Change and EcononomicPerformance.CambridgeUniv. Press,Cambridge,1�Z� edition,1990.

[30] OrganizacionNacionaldeTransplantes.http://www.msc.es/ont.

28

[31] J.Padget.Modelling simplemarket structuresin processalgebraswith loca-tions. Artificial Intelligenceand Simulationof BehaviourJournal, 1(1):87–108,2001. ISSN1476-3036.

[32] RealDecreto994/1999por el queseapruebael reglamentode medidasdeseguridaddelosficherosautomatizadosquecontengandatosdecaracterper-sonal.Boletın Oficial del Estado49,26 deFebrero2000.

[33] REgional and InternationalIntegratedTelemedicineNetwork for MedicalAssistancein End StageDiseasesand Organ TRANSPLANT. http://retransplant.vitamib.com.

[34] TECN : TransplantEuro ComputerNetwork. http://www.ejeisa.com/nectar/t-book/html/health.htm\#TECN.

[35] T. P. V. Shankararaman,V. AmbrosiadouandB. Robinson.Agentsin healthcare.In V. Shankararaman,editor, WorkshoponAutonomousAgentsin HealthCare, pages1–11,Barcelona,Spain,2000.

[36] A. Valls,A. Moreno,andD. Sanchez.A multi-criteriadecisionaid agentap-pliedto theselectionof thebestreceiverin atransplant.In J.Braz,M. Piattini,andJ.Filipe, editors,4��� InternationalConferenceonEnterpriseInformationSystems(ICEIS-2002), CiudadReal,Spain,2002.ICEISPress.

[37] W. Vasconcelos,J.Sabater, C.Sierra,andJ.Querol.Skeleton-basedagentde-velopmentfor electronicinstitutions. In C. CastelfranchiandW. L. Johnson,editors,Proceedingsof the First International Conferenceon AutonomousAgents and Multiagent Systems(AAMAS-02), volume 2, pages696–703.ACM, ACM Press,July2002.

[38] J. Vazquez-Salceda,U. Cortes,A. Lopez-Navidad,F. Caballero,andJ. Pad-get. The organ allocationprocess:a naturalextensionof the Carrel agentmediatedelectronicinstitution. In Proceedingsof Agentsin Healthcarework-shopat ECAI’02, 2002. Revisedversionto appearin AI Communicationsin2002.

[39] O. VickersandJ. Padget. SkeletalJADE Componentsfor the Constructionof Institutions.In J.Padget,D. Parkes,N. Sadeh,O. Shehory, andW. Walsh,editors,Agent MediatedElectronic Commerce IV, volume2531 of LectureNotesin Artificial Intelligence, pages174–192.SpringerVerlag,2002. toappear.

[40] M. Wooldridge,M. Fisher, M.-P. Huget,andS.Parsons.Modelcheckingmul-tiagentsystemswith mable. In C. CastelfranchiandW. L. Johnson,editors,Proceedingsof theFirst InternationalConferenceonAutonomousAgentsandMultiagent Systems(AAMAS-02), volume 2, pages952–959.ACM, ACMPress,July20022002.

[41] M. WooldrigeandN. Jennings.Intelligentagents:Theoryandpractice.TheKnowledgeEngineeringReview, 10(2):115–152,1995.

29