Your Mobility can be Injurious to Your Health:Analyzing Pervasive Health Monitoring Systems

under Dynamic Context Changes

Ayan Banerjee and Sandeep K.S. GuptaIMPACT LAB: http://impact.asu.edu

Arizona State UniversityEmail: abanerj3@asu.edu, sandeep.gupta@asu.edu

Pervasive Health Monitoring (PHM)

Camera

SpO2

EKG

EEG

BPGPS

Mp3PDA/phoneGateway

Motion Sensor

Use Pervasive Computing for day-to-day healthcare management to enable real-time, continuous patient monitoring

BodyAreaNetwork

Features Utilize in-vivo and in-vitro medical sensors

Physical presence of caregivers required only during emergencies

Mobile patients. No time & space restrictions for health monitoring

Better quality of care and reduced medical errors

Early detection of ailments and actuation through automated health data analysis

Nano-scale BloodGlucose level detectorDeveloped @ UIUC

Medical Tele-sensorCan measure and transmitBody temperature Developed @ Oak Ridge NationalLaboratory

Lifeshirt non-invasive monitoringDeveloped @ Vivometrics

Sports Health Management

Home-based Care

Disaster Relief Management

Medical Facility Management

Applications

Healthcare “anywhere” and “anytime”

PHM System (PHMS): Characteristics, Requirements, and Challenges

Characteristics:• Diverse set of devices• Limited energy sources• Co operation of medical devices

with human physiology• Pervasive implies aware of user

context changesRequirements:• Strict requirements on safety (ISSO

60601) and long term operation• Long term operation or

sustainability

Challenge: How to design PHMSes which satisfy requirements given this diverse choices and dynamic user contexts?

Model based analysis for PHMSes

Model SimulateSystem

Change model parameters

Verify requirements

Analysis

Implement

Design

Architectural models [Vibha 2007], Formal models [Coleri 2002, Arney 2007], Behavioral models [Banerjee 10]

Test case simulations, reachability analysis [Arney 09, Jetley 06]

Experimental verification of system properties [Wada 94]

Static assumptions on the user environment

Dynamic context changes not considered

Contribution: Model based analysis of PHMSes under dynamic context changes

Dynamic contexts

• Mobility dependent– Home or hospital

• The devices in the PHMS might vary• Commercial sensors to medical devices.

– Indoors or outdoors• Environmental changes such wireless channel properties

– Activity• Exercising or sleeping, decides the form of energy scavenging to be used• Ambulation or respiration or body heat

• Physiological contexts– Occurrence of emergencies may cause increase in computational load in the sensor– Epileptic seizure or arrhythmia

How do dynamic contexts affect requirements verification?

Example: Infusion Pump Drug Safety

• Wearable infusion pump controlled by smart phone

PPG

ECG

Wearable infusion pump

Glucosemeter

Mobile phone

Pharmacokinetic ModelInput: infusion rate dB(t)

Output: drug concentration map d(t)

Wireless channel

Errors in the wireless channel may lead to loss in control information

Packet delivery ratio (PDR ) depends on properties of the environment

Mobility models• Random way point – most commonly used mobility model• Levy walk closely fits average human mobility[Rhee 08]

Indoor Outdoor

Probability of staying indoors and outdoors are sameBoth satisfy a normal

distribution

Indoor Outdoor

Probability of staying indoors and outdoors are not the same

The locations satisfy a Levy distribution

The human preference to visit a certain location more frequently can be modeled using Levy walk

Random way point Levy walk

Effect of mobility on drug overdose safety

• Indoor PDR is greater than the outdoor PDR [Natarajan 09].• Outdoor excursions increase the chance of packet drop.• Upon loss of control information, the pump retains previous infusion rate.

0 1 2 3 4 50

500

1000

1500

Time in minutes

Dru

g c

onc

ent

ratio

n in

ug

/l

Random Way PointLevy Walk 1 Levy Walk 2

Conclusion on safety depends on models of mobility

Model parameters may vary for individuals

Indoor PDR = 0.8Outdoor PDR = 0.4

Probability of outdoor excursions = 0.7

Context change sequence

• Different context change sequences have different effects• Markovian approach to simulate context changes will not

work

0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 50

500

1000

1500

Time in minutes

Dru

g c

on

cen

tra

tion

ug

/l

Sequence 1 (Indoor, Outdoor, Indoor)Sequence 2 (Outdoor, Outdoor, Indoor)

Indoor Outdoor

Pi

Po

Every possible context sequence have to be simulated

Renders the analysis of dynamic contexts intractable

Effects observed in other domains

• Harmful effects of physiological contexts– Occurrence of epilepsy may induce more computation in

sensors– Result in higher heat dissipation, which may cause burns

• Beneficial effects of mobility– Ambulation increases chance of energy scavenging– Power supply to the medical devices maybe replenished– Increases time of operation of the devices and makes them

sustainable.

Models of contexts work in cooperation with models of human physiology and affect system properties

Problem

• Goal: To analyze PHMSes against requirements under dynamic context changes– Requirements: Safety and sustainability

• Problems posed by dynamic contexts

Which models of context to use?

How to model context changes in a formal framework?

How to analyze PHMSes in a tractable way under dynamic contexts?

Contributions

• Model based analysis of PHMSes under dynamic contexts– Identify effects of context changes on verification– Specification framework for PHMSes under dynamic contexts

• Architecture Analysis and Design Language (AADL) was used• Developed an AADL based specification framework

– Tractable technique for simulating PHMSes under dynamic contexts

• Developed an Eclipse plug-in that can parse AADL models and analyze PHMSes

• Used the developed tool on the three case studies

Solution Approach• Four stage process

AADL Specification Language

• High level architecture specification language• Custom constructs for specifying embedded systems• Hierarchical specification in terms of systems and

subcomponents• No support for specification of human body models

– Typically differential equations

• Provides an extensible simulation analysis framework (OSATE)– Custom plug-ins can be written, we developed CPSAnnex for human

body specification

Forms the core of the proposed specification and simulation framework for PHMSes

Context Specification• Finite state automata specification

– Locations or activities can be states– Events have probabilities associated with them– Probabilities depend on the user activity profile,

mobility models etc.

• Behavior annex in AADL can be used to specify ContextFSM

• Events causing state transitions are derived from context models

system implementation ContextFSMmodes Home: initial mode; Roaming: mode; Inactive: mode; Hospital: mode; Home: -[ P0.RoamingActive ] ! Roaming; Roaming: -[ P0.AtHome ] ! Home; Home: -[ P0.DeActivate ] ! Inactive; Roaming: -[ P0.DeActivate ] ! Inactive; Inactive: -[ P0.Activate ] ! Home; Home: -[ P0.Emergency ] ! Hospital; Roaming: -[ P0.Emergency ] ! Hospital; Hospital: -[ P0.Mitigate ] ! Home;end ContextFSM.imp;

Context models have to be generative in nature

GInput

Parameters

Time

Out

put e

vent

s

…

R

TP

Q Q

R

SP

Context change generator models

• Mobility Models– Random way point model– Levy walk model

• Physiological models– Heart models

– Signal models• Each wave represented with a Gaussian

• Energy scavenging models– Markov chain based models Energy

availableEnergy not available

1-P

P

Windkessel models

ECGSYN model

Model outputs cause events which trigger context changes

Models of PHMS to be analyzed

• PHMS have three components– Medical devices– Device Controllers– Energy sources– Human body

• Models of medical devices are computational models– AADL has custom constructs

• Device controllers need algorithm specification– State based models using modes

• Energy sources as Markov chains

PHMS Specification

• PHMS computing units – Embedded System Constructs– system – sensors nodes in PHMS– subcomponents – sensor components

(e.g. radio, processor, display device etc.)– threads – application specific processes

(e.g. FFT computation for signal processing applications

– property sets • computing properties (e.g. operating

frequency of processor)• physical properties (e.g. power dissipation

of subcomponents or threads)

system PHMS subcomponents P1: process SignalProcApp.impl; C1: system Radio.impl;end PHMS;

system implementation Radio.impl properties ComputingProperty::current => 18 mA;end Radio.impl

process implementation SignalProcApp.impl subcomponents FFT: thread FFT_algorithm.imp1;end SignalProcApp.impl;

thread implementation FFT_algorithm.imp1 modes RadioOn: initial mode ; RadioOff: mode ;properties ComputingProperty::current => 19.56 mA in modes (RadioOn); ComputingProperty::current => 1.0 mA in modes (RadioOff);end FFT_algorithm.imp1;

Out 1

1

TransportDelay 2

TransportDelay 1

TransportDelay

Step State -Space 1

x' = Ax+Bu y = Cx+Du

State -Space

x' = Ax+Bu y = Cx+Du

Gain

-K-

Models of human body

• Penne’s bioheat equation for thermal model

• Pharmaco kinetic model for drug diffusion in blood– Partial differential equation representation– Simulink diagram shown below

Heat Accumulated

Heat Transfer by conduction

Heat Transfer by Radiation

Heat Transfer by convection

Powercircuitry

Metabolism

Specifying human body parameters

• CPSAnnex was implemented• Enhances AADL with capabilities

to specify differential equations• Grammar based specification• Constructs defined

– Deli for ith order differential– Pdeli<X><Y>, defined for ith order

partial differentials of X with respect to Y

system implementation HumanBody.skin properties SpecificHeat => 1.6 J/(Kg.K);. . . annex Del1<Temperature><Time> = K(Pdel2<Temperature><x>+Pdel2<Temperature><y> +

Pdel2<Temperature><z>) + …..end HumanBody.skin;

Simulation Methodology1. Generator models of contexts are simulated to get context change events.2. The ContextFSM is then executed (event based execution)3. For each state in the ContextFSM there are different PHMS specifications4. In each state, the PHMS specification is analyzed using OSATE plug-ins and

properties are checked against requirements

1 2 3 4

Example Scenario

• Infusion pump drug overdose safety– Control information maybe dropped– Overshoots may occur

• Pulse oximeter thermal runaway– Detection of seizure may increase computational workload– Increased heat dissipation may cause burns

• Energy scavenging– Daily routines maybe used to advantage to scavenge and store energy– Long term operation of medical devices can be achieved

Mobility may cause drug overdose

• Change in channel properties with mobility• Levy walk model fits average human excursions• With increasing outdoor excursions, overshoots increase• Levy walk shows more overshoots than Random walk

Epilepsy may cause burns• Epileptic seizure detection using a pulse oximeter

- Perform peak detection on ECG signal to calculate RR intervals. - Intervals are converted to FFT coefficients and sent to the gateway device.

• Fingertip Pulse-oximeter (from Smithsoem) deployed on index finger

– Eight hours continuous operation– Sampling rate = 60 samples/sec

Exercise is good for medical devices

• Four energy scavenging sources were considered– Body Heat, Ambulation, Respiration and Sun Light

• The BSNBench was run on sensor platforms– Platforms used – TelosB, BSN v3, Shimmer, and Intel Atom based sensor prototype

• Three design strategies were used– No power management (NP-NM)– Radio sleep scheduling (NP-M)– Both processor and radio sleep (PM)

Scavenging Source Available Power (W) Scavenge Time (Hrs)

Body Heat 0.1 – 0.15 24

Ambulation 1.5 2

Respiration 0.42 6

Sun Light 0.1 3

Scavenge time is a function of user activity

Conclusion and Future Works• Mobility and physiological contexts may affect results of requirements

verification• Avoidance of such effects require merging models of contexts with PHMS

models• Potential applications is in online verification.

• Future Works:– How to implement a PHMS that satisfies requirements under dynamic

contexts?– How to provide formal guarantees on PHMS properties under dynamic

environmental changes?

• Ongoing Work: – Health-Dev: A tool for converting PHMS models satisfying requirements into validated

implementations, to appear in BSN 2012

Thank You

References• [Vibha 2007] P. Vibha, T. Yan, P. Jayachandran, Z. Li, S. H. Son, J. A. Stankovic, J. Hansson, and T. Abdelzaher. Andes: An analysis-

based design tool for wireless sensor networks. In Real-Time Systems Symposium, RTSS 2007. 28th IEEE International, pages 203–213.

• [Coleri 2002] Sinem Coleri, Mustafa Ergen, and T. John Koo. Lifetime analysis of a sensor network with hybrid automata modelling. In WSNA ’02: Proceedings of the 1st ACM international workshop on Wireless sensor networks and applications, pages 98–104, New York, NY, USA, 2002. ACM.

• [Arney 2007] David Arney, Raoul Jetley, Paul Jones, Insup Lee, and Oleg Sokolsky. Formal methods based development of a pca infusion pump reference model: Generic infusion pump (gip) project. In HCMDSSMDPNP ’07: Proceedings of the 2007 JointWorkshop on High Confidence Medical Devices, Software,and Systems and Medical Device Plug-and-Play Interoperability, pages 23–33,Washington, DC, USA, 2007. IEEE Computer Society.

• [Banerjee 10] Ayan Banerjee, Sailesh Kandula, Tridib Mukherjee, and Sandeep K.S. Gupta. BAND-AiDe: A tool for cyber-physical oriented analysis and design of body area networks and devices. ACM Transactions on Embedded Computing Systems (TECS), Special issue on Wireless Health Systems 2009 (Accepted for publication), 2010.

• [Arney 09] D. E. Arney, R. Jetley, P. Jones, I. Lee, A. Ray, O. Sokolsky, and Y. Zhang, “Generic infusion pump hazard analysis and safety requirements version 1.0,” 2009. [Online]. Available: http://repository.upenn.edu/cis reports/893

• [Jetley 06] R. Jetley, S. P. Iyer, and P. L. Jones, “A formal methods approach to medical device review,” Computer, vol. 39, no. 4, pp. 61–67, 2006.

• [Wada 94] D. Wada and D. Ward, “The hybrid model: a new pharmacokinetic model for computercontrolled infusion pumps,” Biomedical Engineering, IEEE Transactions on, vol. 41, no. 2, pp. 134 –142, feb. 1994

• [Rhee 08] I. Rhee, M. Shin, S. Hong, K. Lee, and S. Chong. On the levy-walk nature of human mobility. In INFOCOM 2008. The 27th Conference on Computer Communications. IEEE, pages 924 –932, april 2008.

• [Natarajan 09] A. Natarajan, B. de Silva, K.-K. Yap, and M. Motani. To hop or not to hop: Network architecture for body sensor networks. In Sensor, Mesh and Ad Hoc Communications and Networks, SECON ’09. 6th Annual IEEE Communications Society Conference on, pages 1 –9, june.