We propose a model driven design and development methodology augmented with formal validation and verification (V&V) for the development of mobile health systems. Systems which deliver healthcare services remotely should be developed using robust and trusted engineering technologies. The methodology instantiates steps in the MDA trajectory using formal methods to verify critical properties of models, to test preservation of those properties in the derived implementations and to effect model transformations by correctness preserving transformations. The methodology is described and some initial modelling is reported

Jones, Val

English

Jones, Valerie M.

NARCIS 

Model Driven Development of m-Health Systems (with a Touch of Formality)

We propose a model driven design and development methodology augmented with formal validation and verification (V&amp;V) for the development of mobile health systems. Systems which deliver healthcare services remotely should be developed using robust and trusted engineering technologies. The methodology instantiates steps in the MDA trajectory using formal methods to verify critical properties of models, to test preservation of those properties in the derived implementations and to effect model transformations by correctness preserving transformations. The methodology is described and some initial modelling is reported

University of Twente Research Information

 This Technical Report is also published in the proceedings of    PerCom 2006, Fourth Annual IEEE International Conference on  Pervasive Computing and Communications, Pisa - Italy, 13-17 March 2006, 1st IEEE International Workshop on Ubiquitous and Pervasive Health Care (UbiCare 2006,) March 13, 2006.   As   V.M. Jones,  Model Driven Development of m-Health Systems (with a Touch of Formality). Model Driven Development of m-Health Systems  (with a Touch of Formality).   V.M. Jones Department of Electrical Engineering, Mathematics, and Computer Science, University of Twente, The Netherlands. v.m.jones@utwente.nl   Abstract  We propose a model driven design and development methodology augmented with formal validation and verification (V&V) for the development of mobile health systems. Systems which deliver healthcare services remotely should be developed using robust and trusted engineering technologies. The methodology instantiates steps in the MDA trajectory using formal methods to verify critical properties of models, to test preservation of those properties in the derived implementations and to effect model transformations by correctness preserving transformations. The methodology is described and some initial modelling is reported.   1. Introduction   Mobile (m-health) health systems enable the healthcare service provider to deliver ubiquitous services to the patient. We propose a methodology for development of such safety critical systems. The methodology applies a model driven design and development approach based on MDA.   We propose to investigate the realization of MDA augmented with formal validation and verification in order to address quality and correctness of both design and implementation, and to support model transformation. The importance of quality and correctness cannot be overemphasized for the sensitive and safety critical application domain of healthcare.  At the University of Twente we are developing m-health systems based on Body Area Networks (BANs). The implementation work began with the European IST project MobiHealth [1, 2, 3] and continues in the Dutch FREEBAND Awareness project and the European eTEN project HealthService24.  In MobiHealth we defined a BAN as a collection a computer network which is worn on the body, and which provided an integrated set of personalised services to the user. One specialization of the generic BAN is the health BAN, which incorporates a set of devices and associated software components to provide some set of health-related services. This mobile healthcare application extends the point of care into the community by bringing services to the patient and by feeding back captured data into the healthcare provider’s enterprise computing system. In MobiHealth the prototype BANs and BAN service platform were engineered by conventional methods. We now propose to revisit the design and development process and develop and apply a more rigorous design and development methodology in order to re-engineer the system for genericity, reliability and reuse. In [4, 5] we floated the concept of using formal methods to support the process of model transformation and to add formal V&V into MDA, and described plans to apply this methodology to the development trajectory for BAN systems. In this paper we report on initial modelling work in applying the new methodology in the applications domain of health Body Area. The methodology is summarized in section 2 below and in Section 3 we describe the health Body Area Network and the distributed system which supports BANs in use in the field. Example models of BAN components are presented to illustrate the modelling approach. This modelling exercise represents only the first phase in the application of the proposed methodology. Section 4 indicates plans for future work.  2. The Methodology  The proposed methodology instantiates steps in the MDA trajectory using formal methods. Formal methods are used to verify critical properties of models, to test preservation of those properties in the derived implementations and to support correctness preserving model transformation. Figure 1 gives a high level view of the methodology, which follows the model-driven approach of MDA.  On the MDA track Platform Independent models (PIMs) are transformed into  Platform Specific Models (PSMs) and from them implementations are derived. The thick arrows in Figure 1 mark this transformation trajectory. The V&V track is indicated by the thin arrows, where the model validation and verification points occur. Two V&V methods used are shown explicitly: the application of model checking and formal testing based on automatic test derivation. The tests are derived from the models but applied to the implementations, thus proving some form of equivalence between models and corresponding implementations. It is also planned to investigate the use of formal methods to address model transformation.   Figure1.  Transformation Path (thick arrows) and Verification/Validation steps  Figure 2 gives a more detailed view of the methodology showing the formal techniques which we plan to apply.  For V&V of models we intend to use model checking. For demonstrating equivalence between models and implementations we will use formal testing. These steps would be realized using particular modelling paradigms and notations (eg. UML, Promela), particular tools (SPIN model checker, TORX test generator) and would aim at a particular target implementation technology (eg. J2ME). Of course, other choices could be made at all steps.  Promela could be used as an (intermediate) modelling notation since it is accepted by the SPIN model checker and TORX test generation tool, which are candidate tools to support the model hecking and formal testing steps. For a more detailed account of the methodology see [4, 5].    The following sections describe the m-health application and illustrate application of part of the methodology, namely initial modelling efforts in relation to the BAN-based mobile healthcare system.   Figure 2.   Example of an application of the methodology  3. Modelling BANs for healthcare  The concept of the Body Area Network originally came from work at MIT and IBM. The concept was developed further by other researchers, for example at Philips, at the University of Twente and at Fraunhofer. In the WWRF Book of Visions, we defined a BAN as “a collection of (inter) communicating devices which are worn on the body, providing an integrated set of personalised services to the user” [6]. Later during MobiHealth we defined a BAN as a computer network which is worn on the body and which moves around with the person. We use this definition in the remainder of this paper. A BAN incorporates a set of devices which perform some specific functions and which also perform intraBAN and possibly extraBAN communication, the latter via a gateway which we call a Mobile Base Unit (MBU). The MBU is also the storage and processing platform. BAN devices may include sensors, actuators, cameras, microphones, audio headsets, media players etc.  In the MobiHealth project a prototype of a health BAN system was developed, together with several specializations of the health BAN for telemonitoring patient groups including cardiology patients, patient with chronic respiratory disease and pregnant mothers. Further specializations of the health BAN are developed within the Awareness and HealthService24 projects, including telemonitoring BANs for epilepsy and teletreatment BANs for patients with chronic pain. Figure 3 shows one of the BAN configurations built and trialled during MobiHealth.  In this case the MBU is implemented by a PDA (an iPAQ). The sensors shown in Figure 3 are Model checker PSM Formal  properties PIM  Requirements  code Auto test generator PIM Validation & Verification PSM Implementation  electrodes and an activity sensor. They are examples of front end supported sensors systems. The blue box is the sensor front end.     Figure 3. One BAN configuration   The concept space encompassing generic BANs, health BANS and specializations of health BANs can be modelled as a class hierarchy. Figure 4 shows such a class hierarchy.  Figure 4 identifies several levels of increasing specialization of BANs.   Figure 4. UML class hierarchy of BANs  The generic BAN can be specialized by domain (health BAN, entertainment BAN, and so forth). We choose to define a Health BAN as characterized not by use of medical devices, but rather as including devices used for medical purposes. By this means we include generic devices such as cameras or GPS positioning systems in a health BAN on the grounds that they are being used for health-related purposes. Health BANs may be further specialized by clinical specialty.  Within one specialty (eg. cardiology) we can distinguish a different set of services for patients with different conditions. Only at this level then can we specify the exact set of set of devices and application components associated with the services required. Examples of services would be ECG monitoring, alarm services, location services, medication reminders, fall detection, loss of consciousness detection and BAN management services. Condition specific BANs should be generic for a class of patients, but may require tailoring to the needs of individual patients. In [5]we raise the issue of customization and personalization of BANs.   3.1 Modelling the Health BAN   The objective of the modelling exercise is to encompass all the existing specializations of the BAN but also to be generic enough to cover future possible instantiations of BANs, including those based on future ambient intelligence technologies, smart sensor networks and nanotechnolgies. There are two main categories of users of the BAN system: the patient users and the professional users. A patient’s BAN provides a set of services, which should vary with the patient’s current set of needs and changing clinical conditions(s). The professional users are the consumers of BAN captured data such as biosignals and alarms. The health professional interacts with his patients’ BANs via a BAN Professional System. Services for professionals include access operations (eg retrieving and viewing biosignals) and BAN management functions such as remotely activating a BAN, or a BAN device, or altering sampling frequencies of sensors. Both patient and professional systems will have different specializations incorporating different functionality sets, hardware and applications. A great many patient BANs may be in operation out in the field at any one time. The patient BANs and health professionals’ access systems are supported by a Jini proxy server which knows about management of BANs and BAN applications and which mediates between the patients and the professional users. We refer to this server as the BAN Back End System BESys. Together these components: BANs, Professional Systems and the BESys comprise a distributed system which we refer to as the BAN system. Figure 5 illustrates the components of a BAN system. The BESys provides, amongst others, the BAN access functions to the healthcare providers’ enterprise computer systems and to health professionals’ mobile systems. Our model identifies the classes of objects involved in a BAN System as seen in Figure 5, provides a mathematical representation of the object class BANSystem and identifies the services it offers, eg. ECG monitoring. These services will be further specified at a lower level of abstraction, BAN Entertainment BAN Internal Medicine BAN Health BAN ? Cardio BAN Neurology BAN CHF BAN LONG QT BAN MI REHAB BAN Generic Domain specific Clinical specialty Single condition/ Disease management Diabetes BAN EPILEPSY BAN  depending on the clinical requirements. ECG monitoring may be specified as 3-lead or 12-lead, for example. At time of instantiation further attributes such as sampling frequency and required mode and quality of presentation can be specified.    Figure 5. Components of the BAN System.  The model shows that a BAN System consists of one Back End System, a number of BANs, a number of BAN Professional Systems.   BANsystem =     tuple(set(BAN), BESys,set(BANProfSystem))    This is a type specification taken from a me too [7] model. The BAN can be modeled as  BAN = pair(MBU, set(BCDS))  where BCDS stands for BAN Connected Device System. The class BCDS covers sensors, actuators or any other devices which may be attached to a BAN. Figure 6 shows the equivalent UML version.     Figure 6. UML model of a BAN.  The different kinds of BCDS can be further specialised as shown in Figure 7.  		 	  	    Figure 7. Class BCDS  We can model the epilepsy BAN as a condition-specific specialisation of some generic “neurology BAN” and only at this point can we specify the BAN devices needed: ECG, activity and positioning (see Figure 8). Now we can construct an instance of an Epilepsy BAN. At this stage we can specify the attribute values as being 3 (for 3-lead ECG) and specify the  Figure 8. Class Epilepsy BAN  desired sampling frequency. Figure 9 shows the instantiation of Epilepsy BAN serial number 1234.     This paper has outlined the approach and given a flavour of initial modelling work, which forms part of the PIM modelling step in our methodology.   Figure 9. Instantiation of an Epilepsy BAN  More detailed models can be found in the Awareness project deliverables.     Patient BANs  Health  Professionals’ mobile systems BAN Back End System (BESys) Health call centre  Hospital MBU                    BAN System                                             Access Systems   BAN = BAN System Interfaces  4. Conclusions and Future work  Healthcare systems for use by patients require high levels of safety, reliability, performance and ease of use and must be based on sound design and development paradigms. High standards are enforced by certification procedures. We have outlined a proposed design and development methodology for m-health systems based on a model driven approach supported by formal verification and  validation. At this early stage the methodology seems promising and we plan to continue to develop and apply it. Here we have described some initial modelling work, but, much work remains to be done to arrive at a first complete application of the methodology. The transformation and V&V steps remain to be worked out in detail. In the future we plan to complete the modelling work for this application and address the other parts of the trajectory, namely transformation based on formal metamodels and verification and validation steps based on model checking and formal testing. Formal methods can also be brought to bear on the question of how to perform safe composition of services and components, including model weaving. This applies for example to the question of how to compose condition specific BANs for patients with co-morbidities. For many health conditions automatic interpretation of biosignals requires development and quality assurance of very sophisticated analysis software. This further reinforces the need for the development and application of sound formally based software engineering methods in order to reach the high levels of confidence in the quality and robustness of designs and of the implementations derived from them.    5. Acknowledgement  This work is part of the Freeband AWARENESS project (http://awareness.freeband.nl)  Freeband is sponsored by the Dutch government under contract BSIK 03025. The BAN development conducted by Awareness and HealthService24 is a further evolution of earlier work of project MobiHealth (IST-2001-36006) (http://www.mobihealth.org) funded by the European Commission. HealthService24 (http://www.healthservice24.com) is funded by the European Commission under the eTEN Programme (eTEN-517352).   6. References  [1] V.M. Jones, R.G.A. Bults, D.M. Konstantas, P.A.M. Vierhout (2001), Healthcare PANs: Personal Area Networks for trauma care and home care, Proceedings Fourth International Symposium on Wireless Personal Multimedia Communications (WPMC), Sept. 9-12, 2001, Aalborg, Denmark, http://wpmc01.org/, ISBN 87-988568-0-4.  [2] A. van Halteren, R.G.A. Bults, I.A. Widya, V.M. Jones, D.M. Konstantas (2003), Mobihealth-Wireless body area networks for healthcare, Proc. New generation of wearable systems for ehealth: towards a revolution of citizens’ health and life style. 11-14 December 2003, Il Ciocco Castelvecchio Pascoli Lucca, Tuscany, Italy. pp. 121-126.  [3] A. van Halteren, R.G.A. Bults, I.A. Widya, V.M. Jones, D.M. Konstantas (2004), "Mobihealth-Wireless body area networks for healthcare", Wearable eHealth Systems for Personalised Health Management: State of the Art and Future Challenges. Volume 108 Studies in Health Technology and Informatics, In A. Lymberis and D. de Rossi (eds.), ISBN: 1 58603 449 9, http://www.iospress.nl/html/boek1143885731.html  [4] V.M. Jones, A. Rensink, T. Ruys, E. Brinksma and A. van Halteren (2004). A formal MDA approach for mobile health systems, Proc. EWMDA-2, Second European Workshop on Model Driven Architecture (MDA) with an emphasis on Methodologies and Transformations, September 2004, Canterbury, England.  [5] Val Jones, Arend Rensink and Ed Brinksma, Modelling mobile health systems: an application of augmented MDA for the extended healthcare enterprise. Proc. Ninth IEEE International EDOC Enterprise Computing Conference (EDOC 2005), pp. 58-69, 19-23 September 2005, Enschede, The Netherlands. IEEE Computer Society, ISBN 0-7695-2441-9, ISSN 1541-7719.  [6] Wireless World Research Forum (2001), The Book of Visions 2001: Visions of the Wireless World, Version 1.0, December 2001; http://www.wireless-world-research.org/   [7] H. Alexander and V.M. Jones (1990).  Software Design and Prototyping using me too.  London: Prentice Hall International. ISBN 0-13-820259-1. 

[6] Wireless World Research Forum

Healthcare PANs: Personal Area Networks for trauma care and home care,

MobihealthWireless body area networks for healthcare, Proc. New generation of wearable systems for ehealth: towards a revolution of citizens’ health and life style.

MobihealthWireless body area networks for healthcare&quot;, Wearable eHealth Systems for Personalised Health Management: State of the Art and Future Challenges.

Modelling mobile health systems: an application of augmented MDA for the extended healthcare enterprise.

http://purl.utwente.nl/publications/66602

Model Driven Development of m-Health Systems (with a Touch of Formality)

Abstract

Similar works

Full text

Available Versions

NARCIS

University of Twente Research Information

University of Twente Research Information