Analyzing Medical Processes - UMass Amherst: …laser.cs.umass.edu/techreports/07-51slides.pdf · According to a 1999 IOM study, ... Notify_Bloodbank Pick_Up_Blood Notify_Bloodbank

Analyzing MedicalProcesses

Bin Chen, George S. Avrunin, Lori A. Clarke, Leon J. OsterweilDepartment of Computer Science, University of Massachusetts, Amherst

Elizabeth A. HennemanSchool of Nursing, University of Massachusetts, Amherst

Philip L. HennemanTufts-Baystate Medical Center, Springfield, MA

2Department of Computer Science

Problem: Medical Errors

According to a 1999 IOM study, medical errors are aleading cause of death in the U.S.• 5 years after the original study, no substantial reduction

Resulted in many efforts to mandate and/or model criticalprocesses• Guildelines

• In English, with imprecise and ambiguous terminology• Usually incomplete

• E.g. no indication of how to handle unusual situations• Modeling notations

• Data flow diagrams• Also, UML, Petri Nets, finite-state machines• Again, no indication on how to handle unusual situations

• Some of these notations lack semantics for specifying them


Goal: Detecting and Reducing Medical Errors

Hypothesis: Finite-state verification can be usedto help detect defects in medical processes thatare modeled using a semantically rich, rigorouslydefined process-definition language• And to verify that efforts to remove the defects have

(or have not) been successful


Approach

Create detailed models of medical processes• using the Little-JIL process definition language

Represent medical guidelines as property specifications• using the Propel property specification system

Use finite-state verification techniques to detect violationsof these properties by the process definitions• Using FLAVERS and SPIN

Working with medical professionals, modify the processesand reapply finite-state verification

An approach toContinuous Process Improvement

for complex, human-intensive processes


Desiderata for a Process Definition Language

Well-defined semantics• Support analysis• Support execution

Rich set of constructs for supporting (e.g.)• Hierarchy• Abstraction• Scoping• Exception handling• Concurrency (synchronous and asynchronous)• Iteration and conditionals• Resource utilization• Human-desired flexibility (E.g., choice operators)

Facilities for elaboration of details Sufficient clarity to facilitate validation of process

definitions by domain experts


Little-JIL Process Definition Language

• Three major components• artifact specification• resource specification• coordination specification

Visual Representation Supported by an Environment with capabilities for

• Editing• Execution• Analysis

• Static (e.g. FSV, FTA)• Dynamic (e.g. discrete event simulation)


Coordination Diagram

Cardinality and artifact flow

Artifact flow via channels


An Example Little-JIL Process


An Example Property; Defined with Propel

• Example property: Once the nurse notifies theblood bank to prepare the blood product,thenurse will eventually pick up the blood product

Notify_Bloodbank Pick_Up_Blood

Notify_Bloodbank

About 60 such were properties derived from requirements stated in standard nursing text.


Overview of our Verification Approach

Construct a finite model that represents allsequences of events, relevant to the property tobe evaluated, that can arise during system’sexecution

Use reasoning methods (e.g., model checking,data flow analysis) to determine whether theproperty holds for all executions• Used FLAVERS and SPIN

• represent distinct modeling and reasoningapproaches

• Could build on our existing technology toautomatically generate the models needed by them


The Verification Process

Two-stage translation approach• Little-JIL process definition → Bandera Internal Representation (BIR)• BIR → Input representations of FSV tools

& Optimizations


Optimizations

Little-JIL process definitions yield large BIR models• Optimizations needed

Optimizations on BIR applicable to models derivedfrom BIR

Take advantage of the scoping rules of Little-JIL Optimizations include

• Alphabet refinement• Abstraction• Partial order reduction

…

Resulting BIR model• Usually a significant reduction in size• Conservative wrt the property


Evaluation Based on Case Studies

Process definition: Computer Scientists, workingwith teams of medical professionals, defineprocesses in Little-JIL

Process definition validation: Iterative review andrefinement of definitions until full “buy-in”

Medical Process Domains• In-Patient Blood Transfusion Administration• Breast Cancer Chemotherapy Administration• Emergency Room Patient Treatment


The Process to be Verified (Top Level)


Elaboration of Nurse’s Process

take from bloodbank status channel


Now Elaborate on Blood Bank Process


Example Blood Transfusion Process (Bloodbank)


Error! In “obtain

blood product from bloodbank" step the nurse couldrepeatedly check the “bloodbank status" channel for a“blood product ready"message

Property: Once the nurse notifies the blood bank to prepare the blood product,the nurse will eventually pick up the blood product


“Obtain Blood Product from Blood Bank”

Obtain Blood Product from Blood Bank

Look at Blood Bank Status Channel

Blood Product Is Ready

Get Blood Product

X

Wait

Read From Blood Bank Status Channel


Improving the Process

When the patient's type and screen are not available, the bloodbank is unable to prepare the blood

Check List and Process Model assumed type and screen obtainedprior to the transfusion order• But this is not always true

In real process, nurse eventually notices that the blood unit is stillnot available and calls the blood bank. Then the nurse does thetype and screen and re-issues the blood unit request• Nurses knew this problem sometimes arose, but did not know why• Problems like this are one reason why the average wait time in an

emergency room is 6 hours!


New “Obtain Blood Product from Blood Bank”Obtain Blood Product from Blood Bank

Look at Blood Bank Status Channel

Blood Product Is Ready

Get Blood Product

X

Get Status

React

O_

Look at Blood Bank Status Channel Notify Blood Bank To Prepare BloodType and Screen

Reorder

Blood Product Not Ready

Blood Type and Screen Unknown

Read From Blood Bank Status Channel


The rest of the story

Medical professionals proposed a fix for the error:• require the nurse to check for “blood type and screen

unknown" message and respond by drawing a blood specimenfor determining type and screen and sending this as part of anew request to the blood bank

Modified process introduced another problem in theprocess definition• Sample for type and screen might not be drawn until after all

of the other preparations for the transfusion have taken place,resulting in a (possibly life threatening) long delay for thepatient

Analysis found this problem• But this might not be the best way to deal with this situation


Elaboration of Nurse’s Process


Verify blood type


The happy ending

Second proposed modification:• require the nurse check for the availability of the type and

screen before notifying the blood bank of the transfusionorder and, if necessary,draw the specimen at that time

Second modification consistent with all the properties(created so far)• >60 properties

Just one example of a real error in a real process• Paper describes another related property

Demonstrates systematic support for process improvement


Observations about the analysis

Rarely have a false positive• Process definitions are primarily control-based• No aliasing or interactions with complex data structures

Optimizations crucial for the feasibility of thisapproach• Use small configuration sizes

Have encountered very few properties that cannot be easily represented in Propel• Apply the usual tricks (e.g. decompose the property,

represent timing and state concerns as events, etc. )


Related Work

Process Modeling and Definition Property Specification Finite State Verification Improving Medical Processes

• Asbru language (Shahar et.al), then KIV theorem prover(tenTeije et.al.)

• Asbru language, then SMV (Baumler, et.al.)• GLARE language; Promela then SPIN (Molino, et.al.)• Baysean Belief Networks, then Discrete Event Simulation

(van der Gaag, et.al.)


Conclusions

Current process definitions used to definemedical processes are inadequate for• Capturing important details• Supporting rigorous analysis about safety problems

Processes (and process models) too complex tobe well understood• Esp. with concurrency, indeterminacy, and exceptional

behavior

Detailed process model plus FSV can beeffectively used to:• Validate the model• Find process problems• Evaluate proposed process improvements

Documents

Analyzing Medical Processes - UMass Amherst: …laser.cs.umass.edu/techreports/07-51slides.pdf · According to a 1999 IOM study, ... Notify_Bloodbank Pick_Up_Blood Notify_Bloodbank