Towards Dependable Number Entry for Medical Devices
Contents
1. chi med making medical devices safer EPSRC Programme Grant EP G059063 1 Public Paper no 19 Towards Dependable Number Entry for Medical Devices Abigail Cauchi Paul Curzon Parisa Eslambolchilar Andy Gimblett Huayi Huang Paul Lee Yungiu Li Paolo Masci Patrick Oladimeji Rimvydas Ruksenas amp Harold Thimbleby Proceedings of EICS4Med First International Workshop on Engineering Interactive Computing Systems for Medicine and Health Care PP release date 25 May 2011 file WP019 pdf UCL UCLIC wW Swansea University Prifysgol Abertawe a A EPSRC YQ Queen Mary ko CITY UNIVERSITY University of London Engineering and Physical Sciences Research Council Towards Dependable Number Entry for Medical Devices Abigail Cauchi Paul Curzon Parisa Eslambolchilar Andy Gimblett Huayi Huang Paul Lee Yungiu Li Paolo Masci Patrick Oladimeji Rimvydas Ruk nas Harold Thimbleby 1 Swansea University 2 Queen Mary University of London 3 Singleton Hospital Swansea CHI MED Computer Human Interaction for Medical Devices www chi med ac uk ABSTRACT Number entry is an ubiquitous task in medical devices but is implemented in many different ways from deci mal keypads to seemingly simple up down buttons Op erator manuals often do not give clear and complete ex planations and all approaches have subtle variations with details varying from device to device This paper explores the design i2. E g then a leads to JE o EEE similarly then leads to o iF This is a fairly natural behaviour easy to program and conceptually clear once discovered how ever as it throws information away it could be annoying to users In the face of annoyed users a natural exten sion is stateful clamping where some state is introduced allowing accidental clamping operations to be undone Here then a gives but an imme date restores EJ EI without state we would get B ENB anything other than Y throws away the state and disallows the undo This is how VTBI entry on the B Braun operates for example In decade style a and Y are inverses of each other and it s always possible to undo the last change easily This is lost with absolute clamping even with state e g then 4 4 7 gives not J Wey An extension which seeks to fix this without introducing wraparound is to make all successful oper ations invertible Here if an operation would take the value beyond its maximum or minimum it doesn t hap pen and this is indicated to the user via a beep say Now then 4 leaves the value unchanged but the user is alerted that this is the case The more gen eral rule is any operation that does not have an inverse has no effect other than a warning such as a beep now the user knows if they hear a beep the normal inverse behaviour doesn t apply otherwise they know without looking that they c
3. a range of resources to the workshop Simulations We have implemented a variety of user interfaces for entering numbers closely based on real in fusion pumps specifically those described above These simulations allow detailed exploration of the properties of the devices number entry systems and comparisons between different designs there are many possible vari ations to experiment with as described in more detail in the next section In particular several variants of the B Braun Infusomat Space VTBI number entry interface have been implemented Workshop annotation mechanism We also in troduce the concept of state annotation as a research tool to enhance collaborative critique of an interactive system Members of this session will be able to add annotations to any states in the interactive simulations to identify or mark issues regarding the usability safety or design of the system being evaluated Annotations will be automatically saved with information about the current state of the system as well as the user interac tions that led to that state starting from power up and are automatically shared among all clients connected to the simulation Number entry techniques Serial entry Incremental entry Decade Arithmetic Figure 3 Number entry basic classification Commercial simulations We have some commer cial simulations intended for hospital training purposes including for versions C and D of t
4. displayed number n depend ing solely on the cursor position or they beep and otherwise do nothing if 10 would have resulted in overflow e The design generalises readily for instance to times by using different bases for each digit i e base 10 10 6 10 respectively with an upper bound of 2359 e If the application requires a movable decimal point then gt pressed when the cursor is in the right most column and the left most digit is Bj then the decimal point will move left and conversely for lt This behaviour ensures no significant figures are ever lost and that the decimal point is always shown within the display Again the precision is limited by bounds and if the decimal point cannot move then the key beeps Starting with the example on the left in figure 5 press ing gt beeps and otherwise does nothing then lt 4 obtains the view on the left in figure 5 Notice number carry moved cursor and changed decimal point style 7 DISCUSSION AND FUTURE WORK Our aim here is to start debate and exploration of these issues future work is to continue that systematically Here we identify some key challenges and opportunities A problem with work of this sort is that seemingly sen sible design properties have unexpected impacts on how users behave Therefore the workshop must help iden tify issues for empirically based research Consider for example the undo design heuri
5. linked to number entry is varied and little has been applied specifically in the medical domain For example Hourizi and Johnson 2 consider a number entry error that resulted from a mode error and which led to the crash of an A320 airliner with loss of life They argue that this should not be seen as a perception or knowledge error but rather as due to an inadequate communication protocol between pilot and autopilot a variation on the design based on this hypothesis was found to eliminate the error in simple user tests Brumby et al 1 investigated trade offs between effi ciency of entering mobile phone numbers vs avoiding er rors in driving Their analysis suggests that interleaving number entry at chunk boundaries efficiently trades the time given up to dialling with that of ensuring enough attention is paid to driving to avoid drifting It is well known that device design can encourage cer tain number entry errors in medicine For example Zhang et al 7 report an incident where a nurse in tending to program a pump at 130 1ml1 h inadvertently programmed the pump at 1301ml1 h a rate 10 times larger than the intended rate Unknown to the nurse the decimal point on the interface of the pump only works for numbers up to 99 9 Thimbleby and Cairns 6 show that out by 10 errors in number entry systems like the one described above can be halved with better interaction design focussing Figure 1 Screenshot of intera
6. an undo the last operation The third general area of interest we identify is that of digit visibility around which there are several re lated issues First consider a decade style system im plemented in hardware a physical device with one Figure 5 An improved number entry interface in action wheel per digit spinning the wheel naturally wraps around modulo 10 indeed we obtain the name decade system from such devices which have one wheel per decade to be entered On such a system every digit is always visible which can lead to SS a exam ple it can be hard to distinguish from RW We are aware of TEE m mit igating this blanking leading trailing zeros and hiding digits entirely The first strategy is obvious only show significant digits There are at least two questions to ask what to display for blank a space an un derscore and whether to follow the cursor filling in zeros prospectively e g do you display or W Mey the cognitive implications of either choice remain uninvestigated On some systems we also see use of a second strategy where digits are shown hidden depending on the magnitude of the value being en tered usually on grounds of semantic relevance For example and in particular for VTBI mL entry the B Braun hides the hundredths and then tenths digits if the hundreds and thousands digits respectively are non blank including while following the cursor as de
7. any user driven motivation for implementing this feature though we note that 0 is not an allowed value for VTBI the button doesn t work when the display is 0 Assuming we know what the maximum and minimum ought to be how should a device behave at those val ues For the decade interface this issue can be ignored the interface wraps round naturally one could in fact apply the following strategies in that context instead but doing so breaks the conceptual model badly Arithmetic entry can also wrap round between min max values but now we are wrapping on the total value not individual digits Consider on a display with boundaries at 0 and 9999 followed by Y this subtracts 100 taking us to EB o RR Then 4 un does this adding 100 with wraparound returning to Minimum maximum value handling Wraparound Clamped Absolute Stateful Invertible Figure 4 Number entry boundary value handling Wo ey This retains a clean conceptual model but with the danger of allowing large numbers to be easily entered accidentally a single Y takes us from an ini tial and safe ST to EWE though at least this is easy to undo More commonly arithmetic interfaces restrict clamp numbers to the boundaries Here we identify three approaches which we call absolute clamping stateful clamping and invertible see figure 4 In absolute clamping an attempt to move the value be yond a limit stops at the limit
8. ctive Alaris GP simulation on error management 3 EXAMPLE DEVICES We have investigated and simulated a number of med ical devices in order to explore their behaviour and re lated HCI issues in this section we introduce the two particular devices both infusion pumps whose num ber entry behaviour is both typical and interesting and around which the rest of this paper is built The Alaris GP infusion pump figure 1 exemplifies a number entry interface style found on a variety of sy ringe and infusion pumps two pairs of buttons change the displayed value one pair increases the value the other decreases it In each pair one of the buttons causes a bigger change than the other Each button can also be held down to increase the rate of change of the number on the screen The B Braun Infusomat Space pump figure 2 has three distinct number entry systems used for different tasks all based around a set of lt 4 v buttons it exhibits a number of interesting behaviours It is a good exam ple of the way in which number entry is widely perceived as unproblematic and trivial while in fact harbouring potential for surprises and difficult Its user manual has very little to say on the topic When editing pa rameters switch digits levels using lt White back ground indicates current digit level Use a or to change current setting Elsewhere in the manual the arrows are described as Arrow u
9. d v modify values Re peating the previous example in arithmetic style leads to a display of with the increment in the tens column being carried to the hundreds It is un clear if or when this would be preferable to users though one can imagine that for fine adjustments around some value it is easier and would involve less actions Either of these starting points may be implemented using little code and with very simple logic See our example simulations They each provide a clear con ceptual model of the interface which users ought to be able to fathom completely with very little experimenta tion Edge cases are often where problems arise thus what happens around the maximum and minimum val ues There are a number of subtleties not immediately obvious First what are the maximum and minimum values Either might be a function of what we can fit in the display which might change over time see below or some semantically relevant value The minimum could be the negative of the maximum or more often zero or something else For VTBI en try on the B Braun the minimum is either 1 or 0 1 depending on digit visibility see below and can only be zeroed by an exact operation Thus for example followed by leads to min imum value whereas followed by leads to B SH true zero This leads to some strange behaviour and a messy conceptual model and we are presently unable to imagine
10. ehaviour through inter action with the devices themselves and by existing con ventions how can devices be designed to optimise this learning process guiding users to the golden path This paper has mainly described incremental interfaces serial entry of course also needs to be explored The re lated task of time entry is also critical and worthy of attention For example in the B Braun most of the in terface principles of the VTBI and Rate number entry interface are found in the time entry interface pre set maximums and minimums jumping to the minimum if the edited number is less than the minimum for exam ple Interestingly if the VTBI is set to 99999 and we try to set the time when we press a on any position the time jumps up to 83 20 we remain unable to explain this behaviour 8 CONCLUSIONS Interactive number entry is deceptively complex and particularly for dependable applications medicine and healthcare must be done well on the basis of a thor ough analysis of requirements This paper has therefore explored the related design issues and principles and through case studies and analysis developed potentially more dependable approaches Ideally after appropri ate empirical testing particularly in real environments and iterative design this work will lead to a definitive approach for dependable number entry 9 ACKNOWLEDGMENTS Funded as part of the CHI MED Multidisciplinary Computer Human Int
11. eraction research for the design and safe use of interactive medical devices project EP SRC Grant Number EP G059063 1 and Formally based tools for user interface analysis and design EPSRC Grant Number EP F020031 1 10 REFERENCES 1 D P Brumby D D Salvucci and A Howes Focus on driving how cognitive constraints shape the adaptation of strategy when dialing while driving In Proceedings of the 27th international conference on Human factors in computing systems CHI 09 pages 1629 1638 New York NY USA 2009 ACM 2 R Hourizi and P Johnson Unmasking mode errors A new application of task knowledge principles to the knowledge gaps in cockpit design In Proceedings of Interact 2001 8th IFIP TC Conf on Human Computer Interaction IOS Press 2001 3 Institute for Safe Medication Practices List of error prone abbreviations symbols and dose designations www ismp org tools abbreviations 2006 4 J Nielsen Usability Engineering Morgan Kaufmann Publishers Inc San Francisco CA USA 1993 5 J Reason Human error models and management BMJ 320 7237 768 770 March 2000 6 H Thimbleby and P Cairns Reducing number entry errors Solving a widespread serious problem Journal Royal Society Interface 7 51 1429 1439 2010 7 J Zhang V L Patel T R Johnson and E H Shortliffe A cognitive taxonomy of medical errors J of Biomedical Informatics 37 193 204 June 2004
12. he B Braun our phys ical pump is version E The simulation diverges from observed behaviour at least in that it does not clamp to a minimum value as described above but rather to 0 This suggests that the defaulting minimum value is introduced in version E Physical devices and manuals Finally we will bring some real physical devices together with their op erator manuals for comparison with our and the com mercial simulations 5 A TAXONOMY FOR NUMBER ENTRY In order to support discussion in the workshop in this section we propose an initial taxonomy of features and behaviours of number entry interfaces particularly con sidering some of the behaviours described above We hope that further debate will refine and augment this list As we describe the taxonomy we make some obser vations and speculations about relevance to usability simplicity of conceptual models etc but our main pur pose in this paper is to ask questions and so promote discussion not provide answers specifically most of this space remains intellectually unexplored At the top level we distinguish between serial and incre mental entry Serial entry involves entering the number as a String usually via a numeric keypad consider en tering a number into a desktop calculator for example Conversely incremental entry involves making a series of incremental changes to some displayed value in order to obtain the desired value often but not nece
13. ional studies have suggested that nurses may fre quently make minor mistakes in entering numbers for example not following the golden path that is the most efficient way of entering a particular number but that these errors are caught and corrected Thus it might be argued that number entry is not a particularly se vere safety critical problem however efficiency remains an important concern in a busy ward Therefore a de vice where such mistakes do not need to be constantly corrected or where the golden path is most often the one naturally followed would provide significant bene fit given the number of times such devices need to be set Furthermore work in resilience engineering sug gests that single mistakes rarely lead to disasters It is when a range of different causes combine If a large number of trivial and normally unproblematic errors are being made then this increases the potential for other rarer causes to interact with them and lead to a critical incident as in Reason s swiss cheese model 5 If a patient is given an incorrect drug dose perhaps ten times higher than intended the patient may die or have some other adverse outcome It is therefore cru cial that number entry is dependable that there are no design defects no mismatches between user conceptual models and device behaviour and that users can so far as reasonably possible detect and correct their errors This paper shows that this pr
14. oblem is more intricate than might appear at first sight that many medical de vices and their operator manuals fall short and that better solutions are possible Our goal is to identify a set of properties that pro erammers of medical devices should implement or if we cannot do that to recommend a set of key prop erties to consider before implementation to minimize error rates specifically for number entry It is not obvi ous how to do this as it involves a variety of tradeofts and thus we propose a debate within the EICS4Med workshop to explore the issues We bring to the de bate prepared material and a variety of demonstration resources to explore ideas In this paper we highlight the issues involved to promote that debate 1 1 Typographic conventions We render arrow keys pressed by users as lt a We represent number displays with a box around each visible digit some of which might be empty For ex ample shows a six digit display with two decimal places showing the number 209 4 with the cursor in the tens column if the display were reduced to only one decimal place we d write it as 2 PRIOR WORK There is much prior work on user interface design prin ciples in general such as Nielsen s Usability Engineer ing 4 but they are very vague for programmers For example undo which Nielsen recommends can be im plemented in many ways Work on human computer interaction specifically
15. owing good practice leading and trailing zeroes are suppressed shown as Mj However they behave exactly like J in how they are controlled by 4 vy e The number has upper and lower bounds for the 5 digit example shown below the bounds must be within 0 to 999 99 e There is no hidden state The behaviour of the inter face is predictable from the display alone e Sometimes keys cannot work as shown the cannot move the cursor further right or if the display showed no digit could be incremented and so on Whenever a key is pressed that cannot do any thing the interface beeps and otherwise does nothing Thus adding 1 to 999 00 does not increase it to the maximum value 999 99 e Always a key beeps or its effect can be cancelled by pressing the opposite key thus always gt and the other 3 pairs do nothing unless the first key pressed causes a beep in which case the second key behaves normally e The rule above can be followed with the arithmetic style of interaction or with decade style We prefer the arithmetic style since after pressing 4 or the number is always changed by 10 or 0 if the key beeps With the decade style there can be a beep if the number would hit a limit or the number may change either by 10 most often or at most 9x10 about 1 in 10 times this behaviour is much less predictable e Hence a Y work on arithmetic that is they al ways add 10 to the
16. p and down Scroll though menus change setting of numbers from 0 9 an swer Yes No questions Arrow left and right Select data from a scale and switch between digits when num bers are entered Open a function while pump is run ning or stopped with the left arrow key This description is inadequate for example it suggests Figure 2 Screenshot of interactive B Braun simulation that if the display is say and 4 is pressed then the display will become In fact it becomes PRY o WF i c an arithmetic operation was performed 9 1 More concerningly if the display is and Y is pressed it becomes J o RE The arith metic operation performed in this case was 10 100 10 which result was then clamped to a minimum value 0 1 It is easy to imagine scenarios in which this behaviour leads to an underdose perhaps harmfully The pump has similarly surprising and inconsistent be haviour around the maximum value These issues are described further in the next section For a new user the infusion pump is likely to behave un predictably though we do not know what implications this unpredictability has on safety in medical scenarios The lack of symmetry between minimum and maximum behaviour might have an impact on usability as do the arithmetic operations particularly when subtracting a value which results in a number less than 0 4 RESOURCES FOR DEBATE In order to support debate around these issues we will bring
17. scribed above Similarly ten thousands is only shown if tenths is hidden This is semantically sensible but slightly disorienting to the user as the display is always right aligned so sometimes one digit disappears an other disappears and the whole thing shifts to the right Related to this is the decimal point visible if no frac tional digits are filled in Canada s Institute for Safe Medication Practices ISMP says it should not be and also mandates reducing the size of fractional digits to more clearly distinguish 5 0 from 50 say changing colour may also be a worthwhile tactic here 3 On the B Braun the decimal point is visible while the tenths column is visible whether it is empty or not We ve identified a large design space for the apparently simple question of incremental number entry the task remains to identify the trade offs each of these choices involves and how they affect the conceptual mappings users build between their actions and their effects 6 A SAMPLE BETTER INTERFACE Figure 5 shows a working mock up of a potentially bet ter user interface to be operated by 4 gt a Y keys as on the B Braun It has several interesting features e The cursor shown on the right most digit position and the decimal point are highly salient e Digits to the right of the decimal point are high lighted and smaller The decimal point remains but is dimmed when the decimal digits are zero e Foll
18. ssar ily on a digit by digit basis As incremental entry can be implemented using just a few keys typically a v 4 gt which may already be present for navigational purposes it is a common style on the kinds of medi cal devices we are interested in As such and as it is used by each of our example devices we concentrate on issues surrounding this style though serial entry is still interesting and appropriate further exploration are questions as to which style is preferable in general and in particular situations and why Focusing on incremental number entry we identify three major aspects of interest basic behaviour decade vs arithmetic see figure 3 behaviour at minimum and maximum values see figure 4 and digit visibility First we consider basic behaviour which may be decade or arithmetic style In decade style each digit is edited independently and typically subject to wraparound at 0 and 9 For example given a display of JR gt EIFS if the user hits 4 the new value is Ey o the 9 increased by 1 modulo 10 wrapping round to 0 and all other digits are unaffected In this style the number really must be dialled in one digit at a time In arithmetic style user actions cause arithmetic modi fications to the value displayed add 1 subtract 10 etc On the Alaris GP there are dedicated up down buttons of differing magnitude on the B Braun lt and gt nav igate between digits and a an
19. ssues critiques designs and shows that methods have advantages and disadvantages par ticularly in terms of undetected error rates Author Keywords Medical devices modelling formal methods HCI health care number entry Note This is a working paper that we will develop further through interactive workshop participation We will engage additional authors as necessary for contin ued work to progress towards a high quality journal pa ver fully covering the relationship of all relevant medi cal manufacturing and computing factors It is an im portant topic that we want to get right 1 INTRODUCTION There are many applications where numbers have to be entered into computer systems from setting alarm clocks to programming infusion pumps In most appli cations the consequences of mistakes are limited but in many cases in particular with medical devices they are potentially critical Mistakes in entering numbers Corresponding author Submission to EICS4Med Workshop at EICS 2011 into infusion and syringe pumps could lead to incorrect doses being delivered causing harm There are several inter related properties of importance in a safety critical number entry system efficiency in entering numbers the likelihood that errors are made and the efficiency of recovery from error 1 In a hos pital it is vital that nurses can use pumps efficiently as they are very busy and multitasking is the norm Ob servat
20. stic recommended by Nielsen 4 How might we arrive at a more detailed set of properties for programmers of medical devices Let us suppose we start by asking the following two re search questions 1 Is the undo heuristic a significant affector for both serial and incremental number entry in terms of error rates 2 Are error rates on systems in the same class effected in similar ways by the level of undo offered Formally guided experimental investiga tion could help answer these questions To avoid empir ical experimentation on every possible variant of num ber entry we might identify a set of distinct centroid cases specific variants representative of some cluster of similar variants by preliminary exploration via a formal model of human device interaction this process could also produce a suitable feature set for classify ing different kinds of number entry system formalising and completing the taxonomy suggested above The re sults from experimental investigation following the for mal modelling step would give a more precise descrip tion of the trends seen for these determining features of keypads with respect to undo and error rate The question of how users mental models of number en try systems develop and relate to the developers models and the code they write is of particular interest We propose that users of medical devices largely develop their mental models of device b
Download Pdf Manuals
Related Search