Seaa2014 treatment validation protocol

A Treatment Validation Protocol for Medical Cyber-Physical-Human Systems

Po-Liang Wu, Dhashrath Raguraman, Lui Sha (Computer Science, UIUC)

Richard B. Berlin Jr. (College of Medicine/ Computer Science, UIUC)

Julian M. Goldman (Massachusetts General Hospital/ CIMIT) To appear In EUROMICRO Software Engineering and Advanced

Applications (SEAA), 2014.

1

Outline §  Introduction §  System Architecture and Models §  Treatment Validation Protocol §  UPPAAL Model and Verification §  Conclusion and Future Work

2

Introduction §  Statistics indicates that preventable medical error rate is highest in

Intensive Care Unit (ICU) as compared to other hospital units. §  Many preventable medical errors are result from unintended deviation

from the best practice medical guidelines §  Timely and correctly perform treatments while monitoring potential side

effects of performed treatments is critical for patient safety. §  Treatment Validation:

•  Preconditions »  If any precondition is not satisfied, a corrective treatment should be performed.

•  Potential side effects »  The side effects of a treatment may adversely affect other treatments.

•  Expected physiological responses »  The effectiveness of a treatment is non-deterministic.

§  The purpose of this work is to assist physicians to correctly perform treatments rather than automatically performing treatments.

3

Motivating Example: Cardiac Arrest Resuscitation

§  Cardiac arrest is the abrupt loss of heart function and can lead to death within minutes.

§  American Heart Association (AHA) provided resuscitation guidelines for the urgent treatment of cardiac arrest

§  An epinephrine example for cardiac arrest resuscitation •  Epinephrine is a commonly used drug for improving patient’s cardiac output. •  Epinephrine may not be effective if patient’s blood pH value < 7.4 •  Epinephrine may adversely raise patient’s blood pressure.

§  Preventable medical errors: •  Shock a patient when the EKG shows an un-shockable rhythm. •  Sodium bicarbonate is injected with calcium chloride •  etc

4

Cardiac Arrest Resuscitation Practice

5 From http://images.google.com

Technical Challenges §  The preconditions and corrective treatments may cause a cascade effect §  Potential side effects are dynamic and may interfere with other treatments

or invalidate the preconditions. §  The effectiveness of the treatments are non-deterministic,

6

Ac#vateDefibrillator

Rhythm == Shockable

InjectEPI

BloodPH > 7 . 4

UrineFlow > 12 mL / s

Inject -‐ SodiumBicarbonate

Airway & Breathing

Treatment

Preconditions We propose a Treatment Precondition and Correction (TPC) tree to structure treatments and preconditions.



7


Rhythm == Shockable

InjectEPI

BloodPH > 7 . 4



Airway & Breathing

AssistedVen#la#on

The side effect of bicarbonate may adversely affect patient’s breathing.

Urine flow rate may become lower than 12 due to kidney function degradation.

IncreaseIVFluid



8


Rhythm == Shockable

InjectEPI

BloodPH > 7 . 4



Airway & Breathing

AssistedVen#la#on

The side effect of bicarbonate may adversely affect patient’s breathing.

Urine flow rate may become lower than 12 due to kidney function degradation.

IncreaseIVFluid Unlike traditional cyber validation mechanisms, the system cannot fully control, lock or rollback, the physical components, such as patient conditions.

System Architecture §  Medical Device Plug and Play

(MDPnP) is a centralized supervisory framework for integrating networked medical devices.

§  The proposed Treatment validation protocol gathers physiological information and command medical devices through MDPnP controller.

Treatment Valida,on Protocol

MDPnP Controller

User Interface Medical Staff

Pa#ents

Treatment Request

Pa#ent condi#ons and system states

Treatment Ac#ons

Pa#ent condi#ons and devices states

EKG Monitor Adapter

Defibrillator Adapter

Lab Value Monitor Adapter

Infusion Pump

Adapter HR / BP Sensor Adapter

9

Physical Models and Definitions §  PhysiologicalCondition (PC) is defined as a tuple < Checker, PM, Operator, RV

>, where •  Checker is the entity capable of checking the, Checker ∈{System, MedicalStaff}, •  PM (physiological measurement) ∈ {EKGRhyhtm, HeartRate, BloodPressure...}, •  Operator ∈ {>, <, =, ≤, ≥}, •  RV is the reference value, which can be threshold, trend, or pattern of the

physiological measurements. §  A treatment is defined as a tuple < Agent, Action, PS, SS, ES >, where

•  Agent is the entity that performs the treatment, Agent ∈ {MedicalDevices, MedicalStaff},

•  Action is the set of executable instructions, •  PS is a set of preconditions that must be satisfied before preforming the Action •  SS is a set of potential side effects •  ES is a set of expected responses after performing the treatment

10

A Treatment Validation Protocol §  The proposed treatment validation protocol consists of three phases

•  Treatment precondition and collection tree construction phase »  Check preconditions and request medical staff to specify a corrective

treatment if any precondition is not satisfied •  Executing and monitoring phase

»  Send requests to medical devices to perform the treatment »  Monitor the potential side effects

•  Checking expected responses phase »  Check if the patient’s response is as expected and adjust the treatments

accordingly.

11

Supervisory System

User Interface

Defibrillator

Airway Breathing

Rhythm Shockable

1. Ac#vate defibrillator

2. Check Airway & EKG Rhythm

12

Supervisory System

User Interface

Defibrillator

Airway Breathing

Rhythm Shockable



Epinephrine

BloodPH > 7.4

Urine > 12 mL/s

3. Inject epinephrine

4-‐a. Check precondi#ons 4-‐b. Request correc#ve treatments

13

Supervisory System

User Interface

Defibrillator

Airway Breathing

Rhythm Shockable



Epinephrine

BloodPH > 7.4

Urine > 12 mL/s



Sodium Bicarbonate

No Calcium Chloride

Increase IV Fluid

5. Sodium bicarbonate & Increase IV

14

Supervisory System

User Interface

Defibrillator

Airway Breathing

Rhythm Shockable



Epinephrine

BloodPH > 7.4

Urine > 12 mL/s



Performing Treatments Sodium Bicarbonate

6. Post order execu#on

Sodium Bicarbonate

No Calcium Chloride

Increase IV Fluid


15

Supervisory System

User Interface

Defibrillator

Airway Breathing

Rhythm Shockable



Epinephrine

BloodPH > 7.4

Urine > 12 mL/s



Performing Treatments Sodium Bicarbonate

6. Post order execu#on

Sodium Bicarbonate

No Calcium Chloride

Increase IV Fluid


Airway Breathing

BloodPH > 7.4

Sodium Bicarbonate

No Calcium Chloride

7. Side effects adversely affect precondi#ons

8. Pa#ent responses not as expected

9. Excep#ons 10. Alterna#ve Treatment

Assisted Ven#la#on

16

Correctness §  Theorem 1. (Preconditions satisfaction) Under the proposed

protocol, a treatment is performed only if all preconditions of the treatment are satisfied.

§  Definition: A tree is well-formed if each unsatisfied precondition have a tree node for correcting it.

§  Theorem 2. (Tree Traversal) The root node of a well-formed tree is reachable if the corrective treatments are effective and the preconditions are not invalidated by the side effects.

§  Theorem 3. (Dynamic adaptability) Suppose side effects of a treatment invalidate any precondition and make the tree become non-well-formed. The protocol updates the tree to be well-formed if the medical staff correctly specifies the corrective treatments.

17

Verification §  We model the proposed protocol in UPPAAL to verify both safety

and correctness properties. §  The reason we choose UPPAAL is that it provides nice user

interface for the physicians to review the developed models. §  The medical devices send the patient’s physiological

measurements, which are modeled as non-deterministic transitions, to the validation protocol.

§  In addition, the medical devices also receive the treatment requests from the protocol and change the states accordingly.

18

UPPAAL Model: Treatment Validation Protocol

19

Check preconditions and construct a tree

Check expected responses

Verification

Medical safety properties

P1: Defibrillator is activated only if the rhythm is shockable and airway and breathing is under control. P2: Epinephrine is injected only if the blood pH value is larger than 7.4 and urine flow rate is higher than 12 mL/s. P3: If the side effect of sodium bicarbonate adversely affects the breathing, the tree is updated with a new treatment node for assisted ventilation.

Protocol correct ness properties

P4: There is no deadlock in the system.

P5: A treatment is performed only if all its preconditions are satisfied.

P6: If side effect does not occur, the root node of the tree is added to the executing list P7: If side effects invalidate a precondition, the tree is updated to be well-formed.

20

Conclusion and Future Work §  In order to reduce medical errors, a validation protocol is proposed to

•  Check preconditions •  Monitor potential side effects •  Check expected responses

§  We use a model checking tool to verify both safety and correctness properties.

§  Human computer interaction (HCI) and situation awareness is an important aspect for developing supervisory medical systems with human in the loop.

§  We are implementing a resuscitation assistant system and evaluate medical staff’s mental workload using a trace-driven simulation.

§  In the future, we will check the applicability of the proposed architecture to various medical scenario.

21

22

23

Drug guidelines

Treatment workflow

Physical Models and Definitions §  PhysiologicalCondition (PC) is defined as a tuple < Checker, PM, Operator, RV

>, where •  Checker is the entity capable of checking the, Checker ∈{System, MedicalStaff}, •  PM (physiological measurement) ∈ {EKGRhyhtm, HeartRate, BloodPressure...}, •  Operator ∈ {>, <, =, ≤, ≥}, •  RV is the reference value, which can be threshold, trend, or pattern of the

physiological measurements. §  A treatment is defined as a tuple < Agent, Action, PS, SS, ES, L >, where

•  Agent is the entity that performs the treatment, Agent ∈ {MedicalDevices, MedicalStaff},

•  Action is the set of executable instructions, •  PS is a set of preconditions that must be satisfied before preforming the Action •  SS is a set of potential side effects •  ES is a set of expected responses after performing the treatment •  L is the life cycle, which specifies the time interval between the treatment being

performed and the treatment has no further effect on the patient

24

Health & Medicine

Seaa2014 treatment validation protocol