Date post: | 12-Jan-2016 |
Category: |
Documents |
Upload: | frederick-daniels |
View: | 212 times |
Download: | 0 times |
Your Mobility can be Injurious to Your Health:Analyzing Pervasive Health Monitoring Systems
under Dynamic Context Changes
Ayan Banerjee and Sandeep K.S. GuptaIMPACT LAB: http://impact.asu.edu
Arizona State UniversityEmail: [email protected], [email protected]
Pervasive Health Monitoring (PHM)
Camera
SpO2
EKG
EEG
BPGPS
Mp3PDA/phoneGateway
Motion Sensor
Use Pervasive Computing for day-to-day healthcare management to enable real-time, continuous patient monitoring
BodyAreaNetwork
Features Utilize in-vivo and in-vitro medical sensors
Physical presence of caregivers required only during emergencies
Mobile patients. No time & space restrictions for health monitoring
Better quality of care and reduced medical errors
Early detection of ailments and actuation through automated health data analysis
Nano-scale BloodGlucose level detectorDeveloped @ UIUC
Medical Tele-sensorCan measure and transmitBody temperature Developed @ Oak Ridge NationalLaboratory
Lifeshirt non-invasive monitoringDeveloped @ Vivometrics
Sports Health Management
Home-based Care
Disaster Relief Management
Medical Facility Management
Applications
Healthcare “anywhere” and “anytime”
PHM System (PHMS): Characteristics, Requirements, and Challenges
Characteristics:• Diverse set of devices• Limited energy sources• Co operation of medical devices
with human physiology• Pervasive implies aware of user
context changesRequirements:• Strict requirements on safety (ISSO
60601) and long term operation• Long term operation or
sustainability
Challenge: How to design PHMSes which satisfy requirements given this diverse choices and dynamic user contexts?
Model based analysis for PHMSes
Model SimulateSystem
Change model parameters
Verify requirements
Analysis
Implement
Design
Architectural models [Vibha 2007], Formal models [Coleri 2002, Arney 2007], Behavioral models [Banerjee 10]
Test case simulations, reachability analysis [Arney 09, Jetley 06]
Experimental verification of system properties [Wada 94]
Static assumptions on the user environment
Dynamic context changes not considered
Contribution: Model based analysis of PHMSes under dynamic context changes
Dynamic contexts
• Mobility dependent– Home or hospital
• The devices in the PHMS might vary• Commercial sensors to medical devices.
– Indoors or outdoors• Environmental changes such wireless channel properties
– Activity• Exercising or sleeping, decides the form of energy scavenging to be used• Ambulation or respiration or body heat
• Physiological contexts– Occurrence of emergencies may cause increase in computational load in the sensor– Epileptic seizure or arrhythmia
How do dynamic contexts affect requirements verification?
Example: Infusion Pump Drug Safety
• Wearable infusion pump controlled by smart phone
PPG
ECG
Wearable infusion pump
Glucosemeter
Mobile phone
Pharmacokinetic ModelInput: infusion rate dB(t)
Output: drug concentration map d(t)
Wireless channel
Errors in the wireless channel may lead to loss in control information
Packet delivery ratio (PDR ) depends on properties of the environment
Mobility models• Random way point – most commonly used mobility model• Levy walk closely fits average human mobility[Rhee 08]
Indoor Outdoor
Probability of staying indoors and outdoors are sameBoth satisfy a normal
distribution
Indoor Outdoor
Probability of staying indoors and outdoors are not the same
The locations satisfy a Levy distribution
The human preference to visit a certain location more frequently can be modeled using Levy walk
Random way point Levy walk
Effect of mobility on drug overdose safety
• Indoor PDR is greater than the outdoor PDR [Natarajan 09].• Outdoor excursions increase the chance of packet drop.• Upon loss of control information, the pump retains previous infusion rate.
0 1 2 3 4 50
500
1000
1500
Time in minutes
Dru
g c
onc
ent
ratio
n in
ug
/l
Random Way PointLevy Walk 1 Levy Walk 2
Conclusion on safety depends on models of mobility
Model parameters may vary for individuals
Indoor PDR = 0.8Outdoor PDR = 0.4
Probability of outdoor excursions = 0.7
Context change sequence
• Different context change sequences have different effects• Markovian approach to simulate context changes will not
work
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 50
500
1000
1500
Time in minutes
Dru
g c
on
cen
tra
tion
ug
/l
Sequence 1 (Indoor, Outdoor, Indoor)Sequence 2 (Outdoor, Outdoor, Indoor)
Indoor Outdoor
Pi
Po
Every possible context sequence have to be simulated
Renders the analysis of dynamic contexts intractable
Effects observed in other domains
• Harmful effects of physiological contexts– Occurrence of epilepsy may induce more computation in
sensors– Result in higher heat dissipation, which may cause burns
• Beneficial effects of mobility– Ambulation increases chance of energy scavenging– Power supply to the medical devices maybe replenished– Increases time of operation of the devices and makes them
sustainable.
Models of contexts work in cooperation with models of human physiology and affect system properties
Problem
• Goal: To analyze PHMSes against requirements under dynamic context changes– Requirements: Safety and sustainability
• Problems posed by dynamic contexts
Which models of context to use?
How to model context changes in a formal framework?
How to analyze PHMSes in a tractable way under dynamic contexts?
Contributions
• Model based analysis of PHMSes under dynamic contexts– Identify effects of context changes on verification– Specification framework for PHMSes under dynamic contexts
• Architecture Analysis and Design Language (AADL) was used• Developed an AADL based specification framework
– Tractable technique for simulating PHMSes under dynamic contexts
• Developed an Eclipse plug-in that can parse AADL models and analyze PHMSes
• Used the developed tool on the three case studies
Solution Approach• Four stage process
AADL Specification Language
• High level architecture specification language• Custom constructs for specifying embedded systems• Hierarchical specification in terms of systems and
subcomponents• No support for specification of human body models
– Typically differential equations
• Provides an extensible simulation analysis framework (OSATE)– Custom plug-ins can be written, we developed CPSAnnex for human
body specification
Forms the core of the proposed specification and simulation framework for PHMSes
Context Specification• Finite state automata specification
– Locations or activities can be states– Events have probabilities associated with them– Probabilities depend on the user activity profile,
mobility models etc.
• Behavior annex in AADL can be used to specify ContextFSM
• Events causing state transitions are derived from context models
system implementation ContextFSMmodes Home: initial mode; Roaming: mode; Inactive: mode; Hospital: mode; Home: -[ P0.RoamingActive ] ! Roaming; Roaming: -[ P0.AtHome ] ! Home; Home: -[ P0.DeActivate ] ! Inactive; Roaming: -[ P0.DeActivate ] ! Inactive; Inactive: -[ P0.Activate ] ! Home; Home: -[ P0.Emergency ] ! Hospital; Roaming: -[ P0.Emergency ] ! Hospital; Hospital: -[ P0.Mitigate ] ! Home;end ContextFSM.imp;
Context models have to be generative in nature
GInput
Parameters
Time
Out
put e
vent
s
…
R
TP
Q Q
R
SP
Context change generator models
• Mobility Models– Random way point model– Levy walk model
• Physiological models– Heart models
– Signal models• Each wave represented with a Gaussian
• Energy scavenging models– Markov chain based models Energy
availableEnergy not available
1-P
P
Windkessel models
ECGSYN model
Model outputs cause events which trigger context changes
Models of PHMS to be analyzed
• PHMS have three components– Medical devices– Device Controllers– Energy sources– Human body
• Models of medical devices are computational models– AADL has custom constructs
• Device controllers need algorithm specification– State based models using modes
• Energy sources as Markov chains
PHMS Specification
• PHMS computing units – Embedded System Constructs– system – sensors nodes in PHMS– subcomponents – sensor components
(e.g. radio, processor, display device etc.)– threads – application specific processes
(e.g. FFT computation for signal processing applications
– property sets • computing properties (e.g. operating
frequency of processor)• physical properties (e.g. power dissipation
of subcomponents or threads)
system PHMS subcomponents P1: process SignalProcApp.impl; C1: system Radio.impl;end PHMS;
system implementation Radio.impl properties ComputingProperty::current => 18 mA;end Radio.impl
process implementation SignalProcApp.impl subcomponents FFT: thread FFT_algorithm.imp1;end SignalProcApp.impl;
thread implementation FFT_algorithm.imp1 modes RadioOn: initial mode ; RadioOff: mode ;properties ComputingProperty::current => 19.56 mA in modes (RadioOn); ComputingProperty::current => 1.0 mA in modes (RadioOff);end FFT_algorithm.imp1;
Out 1
1
TransportDelay 2
TransportDelay 1
TransportDelay
Step State -Space 1
x' = Ax+Bu y = Cx+Du
State -Space
x' = Ax+Bu y = Cx+Du
Gain
-K-
Models of human body
• Penne’s bioheat equation for thermal model
• Pharmaco kinetic model for drug diffusion in blood– Partial differential equation representation– Simulink diagram shown below
Heat Accumulated
Heat Transfer by conduction
Heat Transfer by Radiation
Heat Transfer by convection
Powercircuitry
Metabolism
Specifying human body parameters
• CPSAnnex was implemented• Enhances AADL with capabilities
to specify differential equations• Grammar based specification• Constructs defined
– Deli for ith order differential– Pdeli<X><Y>, defined for ith order
partial differentials of X with respect to Y
system implementation HumanBody.skin properties SpecificHeat => 1.6 J/(Kg.K);. . . annex Del1<Temperature><Time> = K(Pdel2<Temperature><x>+Pdel2<Temperature><y> +
Pdel2<Temperature><z>) + …..end HumanBody.skin;
Simulation Methodology1. Generator models of contexts are simulated to get context change events.2. The ContextFSM is then executed (event based execution)3. For each state in the ContextFSM there are different PHMS specifications4. In each state, the PHMS specification is analyzed using OSATE plug-ins and
properties are checked against requirements
1 2 3 4
Example Scenario
• Infusion pump drug overdose safety– Control information maybe dropped– Overshoots may occur
• Pulse oximeter thermal runaway– Detection of seizure may increase computational workload– Increased heat dissipation may cause burns
• Energy scavenging– Daily routines maybe used to advantage to scavenge and store energy– Long term operation of medical devices can be achieved
Mobility may cause drug overdose
• Change in channel properties with mobility• Levy walk model fits average human excursions• With increasing outdoor excursions, overshoots increase• Levy walk shows more overshoots than Random walk
Epilepsy may cause burns• Epileptic seizure detection using a pulse oximeter
- Perform peak detection on ECG signal to calculate RR intervals. - Intervals are converted to FFT coefficients and sent to the gateway device.
• Fingertip Pulse-oximeter (from Smithsoem) deployed on index finger
– Eight hours continuous operation– Sampling rate = 60 samples/sec
Exercise is good for medical devices
• Four energy scavenging sources were considered– Body Heat, Ambulation, Respiration and Sun Light
• The BSNBench was run on sensor platforms– Platforms used – TelosB, BSN v3, Shimmer, and Intel Atom based sensor prototype
• Three design strategies were used– No power management (NP-NM)– Radio sleep scheduling (NP-M)– Both processor and radio sleep (PM)
Scavenging Source Available Power (W) Scavenge Time (Hrs)
Body Heat 0.1 – 0.15 24
Ambulation 1.5 2
Respiration 0.42 6
Sun Light 0.1 3
Scavenge time is a function of user activity
Conclusion and Future Works• Mobility and physiological contexts may affect results of requirements
verification• Avoidance of such effects require merging models of contexts with PHMS
models• Potential applications is in online verification.
• Future Works:– How to implement a PHMS that satisfies requirements under dynamic
contexts?– How to provide formal guarantees on PHMS properties under dynamic
environmental changes?
• Ongoing Work: – Health-Dev: A tool for converting PHMS models satisfying requirements into validated
implementations, to appear in BSN 2012
Thank You
References• [Vibha 2007] P. Vibha, T. Yan, P. Jayachandran, Z. Li, S. H. Son, J. A. Stankovic, J. Hansson, and T. Abdelzaher. Andes: An analysis-
based design tool for wireless sensor networks. In Real-Time Systems Symposium, RTSS 2007. 28th IEEE International, pages 203–213.
• [Coleri 2002] Sinem Coleri, Mustafa Ergen, and T. John Koo. Lifetime analysis of a sensor network with hybrid automata modelling. In WSNA ’02: Proceedings of the 1st ACM international workshop on Wireless sensor networks and applications, pages 98–104, New York, NY, USA, 2002. ACM.
• [Arney 2007] David Arney, Raoul Jetley, Paul Jones, Insup Lee, and Oleg Sokolsky. Formal methods based development of a pca infusion pump reference model: Generic infusion pump (gip) project. In HCMDSSMDPNP ’07: Proceedings of the 2007 JointWorkshop on High Confidence Medical Devices, Software,and Systems and Medical Device Plug-and-Play Interoperability, pages 23–33,Washington, DC, USA, 2007. IEEE Computer Society.
• [Banerjee 10] Ayan Banerjee, Sailesh Kandula, Tridib Mukherjee, and Sandeep K.S. Gupta. BAND-AiDe: A tool for cyber-physical oriented analysis and design of body area networks and devices. ACM Transactions on Embedded Computing Systems (TECS), Special issue on Wireless Health Systems 2009 (Accepted for publication), 2010.
• [Arney 09] D. E. Arney, R. Jetley, P. Jones, I. Lee, A. Ray, O. Sokolsky, and Y. Zhang, “Generic infusion pump hazard analysis and safety requirements version 1.0,” 2009. [Online]. Available: http://repository.upenn.edu/cis reports/893
• [Jetley 06] R. Jetley, S. P. Iyer, and P. L. Jones, “A formal methods approach to medical device review,” Computer, vol. 39, no. 4, pp. 61–67, 2006.
• [Wada 94] D. Wada and D. Ward, “The hybrid model: a new pharmacokinetic model for computercontrolled infusion pumps,” Biomedical Engineering, IEEE Transactions on, vol. 41, no. 2, pp. 134 –142, feb. 1994
• [Rhee 08] I. Rhee, M. Shin, S. Hong, K. Lee, and S. Chong. On the levy-walk nature of human mobility. In INFOCOM 2008. The 27th Conference on Computer Communications. IEEE, pages 924 –932, april 2008.
• [Natarajan 09] A. Natarajan, B. de Silva, K.-K. Yap, and M. Motani. To hop or not to hop: Network architecture for body sensor networks. In Sensor, Mesh and Ad Hoc Communications and Networks, SECON ’09. 6th Annual IEEE Communications Society Conference on, pages 1 –9, june.