Ayan Banerjee and Sandeep K.S. Gupta IMPACT LAB: impact.asu Arizona State University

1. Your Mobility can be Injurious to Your Health:Analyzing Pervasive Health Monitoring Systemsunder Dynamic Context Changes Ayan Banerjee and Sandeep K.S. Gupta IMPACT LAB: http://impact.asu.edu Arizona State University Email: abanerj3@asu.edu, sandeep.gupta@asu.edu

2. Camera EEG EKG BP SpO2 GPS Mp3 PDA/phone Gateway Lifeshirt non-invasive monitoring Developed @ Vivometrics Medical Tele-sensor Can measure and transmit Body temperature Developed @ Oak Ridge National Laboratory Nano-scale Blood Glucose level detector Developed @ UIUC Motion Sensor Pervasive Health Monitoring (PHM) Use Pervasive Computing for day-to-day healthcare management to enable real-time, continuous patient monitoring • Features • Utilize in-vivo and in-vitro medical sensors • Physical presence of caregivers required only during emergencies • Mobile patients. No time & space restrictions for health monitoring • Better quality of care and reduced medical errors • Early detection of ailments and actuation through automated health data analysis Body Area Network Applications Home-based Care Sports Health Management Disaster Relief Management Medical Facility Management Healthcare “anywhere” and “anytime”

3. PHM System (PHMS): Characteristics, Requirements, and Challenges Characteristics: • Diverse set of devices • Limited energy sources • Co operation of medical devices with human physiology • Pervasive implies aware of user context changes Requirements: • Strict requirements on safety (ISSO 60601) and long term operation • Long term operation or sustainability Challenge: How to design PHMSes which satisfy requirements given this diverse choices and dynamic user contexts?

4. Model based analysis for PHMSes Test case simulations, reachability analysis [Arney 09, Jetley 06] • Architectural models [Vibha 2007], Formal models [Coleri 2002, Arney 2007], Behavioral models [Banerjee 10] Experimental verification of system properties [Wada 94] Analysis System Model Simulate Verify requirements Contribution: Model based analysis of PHMSes under dynamic context changes Change model parameters Implement Design Static assumptions on the user environment Dynamic context changes not considered

5. Dynamic contexts • Mobility dependent • Home or hospital • The devices in the PHMS might vary • Commercial sensors to medical devices. • Indoors or outdoors • Environmental changes such wireless channel properties • Activity • Exercising or sleeping, decides the form of energy scavenging to be used • Ambulation or respiration or body heat • Physiological contexts • Occurrence of emergencies may cause increase in computational load in the sensor • Epileptic seizure or arrhythmia How do dynamic contexts affect requirements verification?

6. Example: Infusion Pump Drug Safety • Wearable infusion pump controlled by smart phone ECG Glucosemeter Wearable infusion pump PPG Mobile phone Wireless channel Errors in the wireless channel may lead to loss in control information Pharmacokinetic Model Input: infusion rate dB(t) Output: drug concentration map d(t) Packet delivery ratio (PDR ) depends on properties of the environment

7. Mobility models • Random way point – most commonly used mobility model • Levy walk closely fits average human mobility[Rhee 08] Random way point Levy walk Indoor Outdoor Indoor Outdoor Probability of staying indoors and outdoors are same Probability of staying indoors and outdoors are not the same The human preference to visit a certain location more frequently can be modeled using Levy walk Both satisfy a normal distribution The locations satisfy a Levy distribution

8. Effect of mobility on drug overdose safety • Indoor PDR is greater than the outdoor PDR [Natarajan 09]. • Outdoor excursions increase the chance of packet drop. • Upon loss of control information, the pump retains previous infusion rate. Indoor PDR = 0.8 1500 Levy Walk 1 Levy Walk 2 Outdoor PDR = 0.4 Random Way Point Probability of outdoor excursions = 0.7 1000 Drug concentration in ug/l 500 0 0 1 2 3 4 5 Time in minutes Conclusion on safety depends on models of mobility Model parameters may vary for individuals

9. Context change sequence • Different context change sequences have different effects • Markovian approach to simulate context changes will not work Po 1500 Sequence 1 (Indoor, Outdoor, Indoor) Sequence 2 (Outdoor, Outdoor, Indoor) Indoor Outdoor 1000 Drug concentration ug/l 500 0 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Time in minutes Pi Every possible context sequence have to be simulated Renders the analysis of dynamic contexts intractable

10. Effects observed in other domains • Harmful effects of physiological contexts • Occurrence of epilepsy may induce more computation in sensors • Result in higher heat dissipation, which may cause burns • Beneficial effects of mobility • Ambulation increases chance of energy scavenging • Power supply to the medical devices maybe replenished • Increases time of operation of the devices and makes them sustainable. Models of contexts work in cooperation with models of human physiology and affect system properties

11. Problem • Goal: To analyze PHMSes against requirements under dynamic context changes • Requirements: Safety and sustainability • Problems posed by dynamic contexts Which models of context to use? How to model context changes in a formal framework? How to analyze PHMSes in a tractable way under dynamic contexts?

12. Contributions • Model based analysis of PHMSes under dynamic contexts • Identify effects of context changes on verification • Specification framework for PHMSes under dynamic contexts • Architecture Analysis and Design Language (AADL) was used • Developed an AADL based specification framework • Tractable technique for simulating PHMSes under dynamic contexts • Developed an Eclipse plug-in that can parse AADL models and analyze PHMSes • Used the developed tool on the three case studies

13. Solution Approach • Four stage process

14. AADL Specification Language • High level architecture specification language • Custom constructs for specifying embedded systems • Hierarchical specification in terms of systems and subcomponents • No support for specification of human body models • Typically differential equations • Provides an extensible simulation analysis framework (OSATE) • Custom plug-ins can be written, we developed CPSAnnex for human body specification Forms the core of the proposed specification and simulation framework for PHMSes

15. Context Specification • Finite state automata specification • Locations or activities can be states • Events have probabilities associated with them • Probabilities depend on the user activity profile, mobility models etc. • Behavior annex in AADL can be used to specify ContextFSM • Events causing state transitions are derived from context models G Input Parameters Output events Time system implementation ContextFSM modes Home: initial mode; Roaming: mode; Inactive: mode; Hospital: mode; Home: -[ P0.RoamingActive ] ! Roaming; Roaming: -[ P0.AtHome ] ! Home; Home: -[ P0.DeActivate ] ! Inactive; Roaming: -[ P0.DeActivate ] ! Inactive; Inactive: -[ P0.Activate ] ! Home; Home: -[ P0.Emergency ] ! Hospital; Roaming: -[ P0.Emergency ] ! Hospital; Hospital: -[ P0.Mitigate ] ! Home; end ContextFSM.imp; Context models have to be generative in nature …

16. Context change generator models • Mobility Models • Random way point model • Levy walk model • Physiological models • Heart models • Signal models • Each wave represented with a Gaussian • Energy scavenging models • Markov chain based models R R T Windkessel models P P Q Q S ECGSYN model P Energy available Energy not available Model outputs cause events which trigger context changes 1-P

17. Models of PHMS to be analyzed • PHMS have three components • Medical devices • Device Controllers • Energy sources • Human body • Models of medical devices are computational models • AADL has custom constructs • Device controllers need algorithm specification • State based models using modes • Energy sources as Markov chains

18. PHMS Specification • PHMS computing units – Embedded System Constructs • system – sensors nodes in PHMS • subcomponents – sensor components (e.g. radio, processor, display device etc.) • threads – application specific processes (e.g. FFT computation for signal processing applications • property sets • computing properties (e.g. operating frequency of processor) • physical properties (e.g. power dissipation of subcomponents or threads) systemPHMS subcomponents P1: processSignalProcApp.impl; C1: systemRadio.impl; endPHMS; system implementation Radio.impl properties ComputingProperty::current => 18 mA; end Radio.impl processimplementationSignalProcApp.impl subcomponents FFT: thread FFT_algorithm.imp1; endSignalProcApp.impl; threadimplementation FFT_algorithm.imp1 modes RadioOn: initialmode ; RadioOff: mode ; properties ComputingProperty::current => 19.56 mA inmodes (RadioOn); ComputingProperty::current => 1.0 mA inmodes (RadioOff); end FFT_algorithm.imp1;

19. Models of human body • Penne’s bioheat equation for thermal model • Pharmaco kinetic model for drug diffusion in blood • Partial differential equation representation • Simulink diagram shown below Heat Transfer by Radiation Heat Transfer by conduction Heat Transfer by convection Metabolism Power circuitry Heat Accumulated

20. Specifying human body parameters • CPSAnnex was implemented • Enhances AADL with capabilities to specify differential equations • Grammar based specification • Constructs defined • Deli for ith order differential • Pdeli<X><Y>, defined for ith order partial differentials of X with respect to Y system implementation HumanBody.skin properties SpecificHeat => 1.6 J/(Kg.K);. . . annex Del1<Temperature><Time> = K(Pdel2<Temperature><x>+Pdel2<Temperature><y> + Pdel2<Temperature><z>) + ….. endHumanBody.skin;

21. Simulation Methodology • Generator models of contexts are simulated to get context change events. • The ContextFSM is then executed (event based execution) • For each state in the ContextFSM there are different PHMS specifications • In each state, the PHMS specification is analyzed using OSATE plug-ins and properties are checked against requirements 1 2 3 4

22. Example Scenario • Infusion pump drug overdose safety • Control information maybe dropped • Overshoots may occur • Pulse oximeter thermal runaway • Detection of seizure may increase computational workload • Increased heat dissipation may cause burns • Energy scavenging • Daily routines maybe used to advantage to scavenge and store energy • Long term operation of medical devices can be achieved

23. Mobility may cause drug overdose • Change in channel properties with mobility • Levy walk model fits average human excursions • With increasing outdoor excursions, overshoots increase • Levy walk shows more overshoots than Random walk

24. Epilepsy may cause burns • Epileptic seizure detection using a pulse oximeter • Perform peak detection on ECG signal to calculate RR intervals. • Intervals are converted to FFT coefficients and sent to the gateway device. • Fingertip Pulse-oximeter (from Smithsoem) deployed on index finger • Eight hours continuous operation • Sampling rate = 60 samples/sec

25. Exercise is good for medical devices • Four energy scavenging sources were considered • Body Heat, Ambulation, Respiration and Sun Light • The BSNBench was run on sensor platforms • Platforms used – TelosB, BSN v3, Shimmer, and Intel Atom based sensor prototype • Three design strategies were used • No power management (NP-NM) • Radio sleep scheduling (NP-M) • Both processor and radio sleep (PM) Scavenge time is a function of user activity

26. Conclusion and Future Works • Mobility and physiological contexts may affect results of requirements verification • Avoidance of such effects require merging models of contexts with PHMS models • Potential applications is in online verification. • Future Works: • How to implement a PHMS that satisfies requirements under dynamic contexts? • How to provide formal guarantees on PHMS properties under dynamic environmental changes? • Ongoing Work: • Health-Dev: A tool for converting PHMS models satisfying requirements into validated implementations, to appear in BSN 2012

27. Thank You

28. References • [Vibha 2007] P. Vibha, T. Yan, P. Jayachandran, Z. Li, S. H. Son, J. A. Stankovic, J. Hansson, and T. Abdelzaher. Andes: An analysis-based design tool for wireless sensor networks. In Real-Time Systems Symposium, RTSS 2007. 28th IEEE International, pages 203–213. • [Coleri 2002] SinemColeri, Mustafa Ergen, and T. John Koo. Lifetime analysis of a sensor network with hybrid automata modelling. In WSNA ’02: Proceedings of the 1st ACM international workshop on Wireless sensor networks and applications, pages 98–104, New York, NY, USA, 2002. ACM. • [Arney 2007] David Arney, RaoulJetley, Paul Jones, Insup Lee, and Oleg Sokolsky. Formal methods based development of a pca infusion pump reference model: Generic infusion pump (gip) project. In HCMDSSMDPNP ’07: Proceedings of the 2007 JointWorkshop on High Confidence Medical Devices, Software,and Systems and Medical Device Plug-and-Play Interoperability, pages 23–33,Washington, DC, USA, 2007. IEEE Computer Society. • [Banerjee 10] AyanBanerjee, SaileshKandula, TridibMukherjee, and Sandeep K.S. Gupta. BAND-AiDe: A tool for cyber-physical oriented analysis and design of body area networks and devices. ACM Transactions on Embedded Computing Systems (TECS), Special issue on Wireless Health Systems 2009 (Accepted for publication), 2010. • [Arney 09] D. E. Arney, R. Jetley, P. Jones, I. Lee, A. Ray, O. Sokolsky, and Y. Zhang, “Generic infusion pump hazard analysis and safety requirements version 1.0,” 2009. [Online]. Available: http://repository.upenn.edu/cis reports/893 • [Jetley 06] R. Jetley, S. P. Iyer, and P. L. Jones, “A formal methods approach to medical device review,” Computer, vol. 39, no. 4, pp. 61–67, 2006. • [Wada 94] D. Wada and D. Ward, “The hybrid model: a new pharmacokinetic model for computercontrolled infusion pumps,” Biomedical Engineering, IEEE Transactions on, vol. 41, no. 2, pp. 134 –142, feb. 1994 • [Rhee 08] I. Rhee, M. Shin, S. Hong, K. Lee, and S. Chong. On the levy-walk nature of human mobility. In INFOCOM 2008. The 27th Conference on Computer Communications. IEEE, pages 924 –932, april 2008. • [Natarajan 09] A. Natarajan, B. de Silva, K.-K. Yap, and M. Motani. To hop or not to hop: Network architecture for body sensor networks. In Sensor, Mesh and Ad Hoc Communications and Networks, SECON ’09. 6th Annual IEEE Communications Society Conference on, pages 1 –9, june.