Abigail Cauchi

The benefits of formalising design guidelines: a case study on the predictability of drug infusion pumps

A demonstration is presented of how automated reasoning tools can be used to check the predictability of a user interface. Predictability concerns the ability of a user to determine the outcomes of their actions reliably. It is especially important in situations such as a hospital ward where medical devices are assumed to be reliable devices by their expert users (clinicians) who are frequently interrupted and need to quickly and accurately continue a task. There are several forms of predictability. A definition is considered where information is only inferred from the current perceptible output of the system. In this definition, the user is not required to remember the history of actions that led to the current state. Higher-order logic is used to specify predictability, and the Symbolic Analysis Laboratory is used to automatically verify predictability on real interactive number entry systems of two commercial drug infusion pumps—devices used in the healthcare domain to deliver fluids (e.g., medications, nutrients) into a patient’s body in controlled amounts. Areas of unpredictability are precisely identified with the analysis. Verified solutions that make an unpredictable system predictable are presented through design modifications and verified user strategies that mitigate against the identified issues.

Using Medical Device Logs for Improving Medical Device Design

User interfaces that employ the same display and buttons may look the same but can work very differently depending on exactly how they are implemented. In healthcare, it is critical that interfaces that look the same are the same. Hospitals typically have many types of visually similar infusion pumps, but with different software versions and variation between pump behavior, and this may lead to unexpected adverse events. For example, when entering drug doses into infusion pumps different results may arise when pushing identical sequences of buttons. These differences arise as a result of subtle implementation differences and may lead to large errors users do not notice. Previous work has explored different implementations of a 5-key interface for entering numbers using a new analysis technique, Differential Formal Analysis, where predictions relating to the distribution of errors in terms of the size of the error (out by 10, out by 100 and so on) can be made. The analysis described in the paper extends this work with models of use based on many hours of actual clinical use data. Specifically, we draw on 1,362 days of use of number entry systems, from 19 infusion pumps over a 3 year period in a UK hospital. The paper also suggests some improvements to medical device logs, which will help further evidence-based improvement to medical device safety.

Triangulating empirical and analytic techniques for improving number entry user interfaces

Empirical methods and analytic methods have been used independently to analyse and improve number entry system designs. This paper identifies key differences in exploring number entry errors combining laboratory studies and analytic methods and discusses the implications of triangulating methods to more thoroughly analyse safety critical design. Additionally, a previously presented analytic method used to analyse number entry interfaces is generalised to analyse more types of number entry systems. This paper takes number entry to mean interactively entering a numeric value, as opposed to entering a numeric identifier such as a phone number or ISBN. Many applications of number entry are safety critical, and this paper is particularly motivated by user interfaces in healthcare, for instance for specifying drug~dosage.

Differential formal analysis: evaluating safer 5-key number entry user interface designs

Differential Formal Analysis (DFA) is an evaluation method based on stochastic simulation for evaluating safety critical user interfaces with subtle programming differences. This method enforces rigorous science by requiring two or more researchers to perform the analysis which in itself, raises important issues for discussion. This method is demonstrated through a case study on 5-key number entry systems which are a safety critical interface found in various popular commercial medical infusion pumps. The results of the case study are an important contribution of this paper since it provides device manufacturers guidelines to update their device firmware to make their 5 key number entry UIs safer, as well as a method that could be applied to other designs.

Buffer automata: a UI architecture prioritising HCI concerns for interactive devices

We introduce an architectural software formalism, buffer automata, for the specification, implementation and analysis of a particular class of discrete interactive systems and devices. The approach defines a layer between the physical user interface and the application (if any) and provides a clear framework for highlighting a number of interaction design issues, in particular around modes and undo.

Using differential formal analysis for dependable number entry

User interfaces that employ the same display and buttons may look the same but can work very differently depending on how they are implemented. In healthcare, it is critical that interfaces that look the same are the same. Hospitals typically have many types of similar infusion pump, with different software versions, and variation between pump behavior may lead to unexpected adverse events. For example, when entering drug doses into infusion pumps that use the same display and button designs, different results may arise when pushing identical sequences of buttons. These differences arise as a result of subtle implementation differences and may lead to under-dose or over-dose errors. This work explores different implementations of a 5-key interface for entering numbers using a new user interface analysis technique, Differential Formal Analysis. Using Differential Formal Analysis different 5-key interfaces are analysed based on log data collected from 19 infusion pumps over a 3 year period from a UK hospital. The results from this analysis is domain specific to infusion pumps. A comparison is made between domain specific results and generic results from Differential Formal Analysis performed using random data.

MediCHI: safer interaction in medical devices

Medical devices embedded with computer systems have been widely adopted in many healthcare situations with the intention to deliver accurate and effective medication. However, due to the nature of medical devices, usability issues and the complexity of their context of use, designing and evaluating interactive medical devices from a human error management perspective has always being challenging, particularly in high-risk areas. This workshop sets out to bring together international researchers and designers working in relevant fields to discuss, review, compare and demonstrate effective practical approaches that can be adopted to improve the design of medical devices for safer interaction in the future.

Using gherkin to extract tests and monitors for safer medical device interaction design

Number entry systems on medical devices are safety critical and it is important to get them right. Interaction design teams can be multidisciplinary, and in this work we present a process where the requirements of the system are drawn up using a Controlled Natural Language (CNL) that is understandable by non-technical experts or clients. These CNL requirements can also be directly used by the Quality Assurance (QA) team to test the system and monitor whether or not the system runs as it should once deployed. Since commonly, systems are too complex to test all possible execution paths before deployment, monitoring the system at runtime is useful in order to check that the system is running correctly. If at runtime, it is discovered that an anomaly is detected, the relevant personnel is notified through a report in natural language.

Using testing techniques to classify user interface designs

Number entry systems in medical devices such as infusion pumps are used to input drug doses that will be administered to patients. They are safety critical since if the drug dose is too high or too low, this may cause harm to patients. Previous work shows that number entry systems with the same hardware layout can have software that is implemented in different ways. This means that devices with the same hardware layout may lead to different results after the same keystrokes are pressed. Previous work also shows that choosing the best software implementation over the worst can reduce the likelihood of human error eight-fold in directional number entry systems. Determining whether a software implementation abides by the requirements is a time consuming task for regulatory bodies and hospital procurement departments. In this paper we show how software testing techniques can be used to classify various software implementations in order to determine whether the given number entry system satisfies specifications.

Simulation to Evaluate Alternative Approaches to Blocking Use Errors

Background Unnoticed user slips may contribute to adverse events, but medical devices can be designed to help detect and block some slips, thus enabling the user to take corrective action. Obviously different designs achieve this with greater or lesser success [1]. This paper shows how comparison of alternative design features for a “5-key” user interface (figure 1) can help reduce number entry errors. 5-key interfaces are widely-used because they look intuitive and require very little physical space.