CodeBlue: An Ad Hoc Sensor Network Infrastructure for Emergency Medical Care
David Malan† , Thaddeus Fulford-Jones† , Matt Welsh† , and Steve Moulton‡
†

Division of Engineering and Applied Sciences Harvard University

‡

School of Medicine Boston University

Abstract
Sensor devices integrating embedded processors, low-power, lowbandwidth radios, and a modest amount of storage have the potential to enhance emergency medical care. Wearable vital sign sensors can track patient status and location, while simultaneously operating as active tags. We introduce CodeBlue, a wireless infrastructure intended for deployment in emergency medical care, integrating low-power, wireless vital sign sensors, PDAs, and PC-class systems. CodeBlue will enhance first responders’ ability to assess patients on scene, ensure seamless transfer of data among caregivers, and facilitate efficient allocation of hospital resources. Intended to scale to very dense networks with thousands of devices and extremely volatile network conditions, this infrastructure will support reliable, ad hoc data delivery, a flexible naming and discovery scheme, and a decentralized security model. This paper introduces our architecture and highlights research challenges being addressed by the CodeBlue development effort.

2 Potential for impact
Wireless sensing and communication have the potential for broad applications in medicine. Today, it is possible to obtain measurements of heart rate, oxygen saturation, endtidal CO2 , and serum chemistries, including serum glucose, with small, non-invasive sensors; we expect that, over time, an increasing array of sensors with sophisticated capabilities will become available. Companies such as Nonin [3] and Numed [4] have developed wireless vital sign sensors based on Bluetooth technology, while Radianse [5] has developed an RF-based location-tracking system for use in hospitals. Other research projects include the European Commission’s wide-ranging MobiHealth Project, which aims to provide continuous monitoring of patients outside the hospital environment by developing the concept of a 3G-enabled “Body-Area Network” [13]. The potential applications will save lives, create valuable data for medical research, and cut the cost of medical services. In light of heightened risks of civilian-targeted terrorist activity, MCEs have become an increasingly important concern for the medical community. Specifically, a large number of casualties within a small area can overwhelm emergency field personnel and hospital staff. Without appropriate resource allocation and management, such situations can lead to farreaching systems failures and a breakdown of the caregiving process. Sensor networks provide the technology to bridge the gap between patient load and available resources. When faced with a large number of casualties, the goal is to first care for those patients who will benefit the most from trauma care and rapid surgical intervention. To accomplish this, EMTs can deploy wireless, low-power vital sign sensors to monitor severely injured patients. Using sensors, triage in the field and triage at the hospital can be made interactive by continuously feeding patient capacity information from a sensor network to a decision support system. Such an infrastructure would allow efficient matching of out-of-hospital caseload to critical, hospital-based trauma facilities and resources. For example, field personnel could be alerted to locate more quickly those victims who were initially physiologically stable, but who subsequently deteriorate. The same sensor network would track stable patients from triage, through treatment, to their final hospital destination, all the while conveying vital sign and location data to the host system.

1

Introduction

Wireless sensor networks are an emerging technology consisting of small, low-power, and low-cost devices that integrate limited computation, sensing, and radio communication capabilities. This technology has the potential to have enormous impact on many aspects of emergency medical care. Sensor devices can be used to capture continuous, real-time vital signs from a large number of patients, relaying the data to handheld computers carried by emergency medical technicians (EMTs), physicians, and nurses. Wearable sensor nodes can store patient data such as identification, history, and treatments, supplementing the use of back-end storage systems and paper charts. In a mass casualty event (MCE), sensor networks can greatly improve the ability of first responders to triage and treat multiple patients equipped with wearable wireless monitors. Such an approach has clear benefits for patient care but raises challenges in terms of reliability and complexity. While there have been many recent advances in biomedical sensors [16, 1, 2], low-power radio communications [15, 6, 10], and embedded computation [8, 9], there does not yet exist a flexible, robust communication infrastructure to integrate these devices into an emergency care setting. We are developing CodeBlue, an efficient wireless communication substrate for medical devices that addresses ad hoc network formation, naming and discovery, security and authentication, as well as filtration and aggregation of vital sign data. CodeBlue is designed to operate across a wide range of devices, including low-power “motes,” PDAs, and PCs, and addresses the special robustness and security requirements of medical care settings.

3 Technologies
A number of new technologies are now becoming viable for introduction into pre-hospital and in-hospital settings. Wireless sensor devices, such as the Berkeley MICA “mote,” con-

Vital sign sensors and active tags Location beacons

Antenna Pulse oximetry interface board Mote with processor and radio

CodeBlue Information Plane
Naming Discovery Authentication Encryption Event Delivery Filtering Aggregation Handoff

Finger sensor

Wirless PDAs and fixed terminals

m

Other hospital information systems

Ambulance MDTs

(a) nying patient triage application.

(b)

Figure 2: The CodeBlue communication substrate. the MICA2 mote in full operation, and is small enough to integrate into a compact package. The device transmits periodic packets containing heart rate, SpO2 (blood oxygen saturation), and plethysmogram waveform data. We are also developing a mote-based two-lead ECG, and believe a range of other vital sign sensors can be readily developed using this platform. Vital sign data from multiple patients can be relayed using an adaptive, multi-hop routing scheme either to a wired base station (such as a PC or laptop) or directly to multiple handheld PDA devices carried by EMTs, physicians, or nurses. Figure 1(b) shows our patient triage application, based on the .NET Compact Framework [12], running on an iPAQ PDA with Windows CE. In addition to collecting a constant stream of vital signs from each patient, the application can integrate the data with an electronic patient care record using an application such as 10Blade’s iRevive [7].

Figure 1: (a) Our mote-based pulse oximeter. (b) The accompa-

sist of an embedded microcontroller, low-power radio, and a modest amount of local storage in a small (5.7 cm × 3.2 cm × 2.2 cm) package, powered by 2 AA batteries. The device consumes roughly 20 mA when active, resulting in a battery lifetime of 5–6 days if continuously running. The device can drop to a very low power sleep state of 10µA, increasing lifetime to over 20 years, albeit without any activity. In general, applications will employ duty-cycling to achieve good lifetimes with reasonable communication and computation rates. These devices run a specialized operating system, called TinyOS [9], that specifically addresses the concurrency and resource management needs of sensor nodes. The radio transceivers used in these devices differ substantially from existing commercial wireless technologies, such as 802.11b and Bluetooth. The current MICA platform uses a single-chip radio, the Chipcon CC1000, operating at 433 or 916 MHz, with a maximum data rate of 76.8 kbps. The practical indoor range is approximately 20–30 m. The limited bandwidth and computational capabilities of these devices precludes the use of Internet-based protocols and such services as TCP/IP, DNS, and ARP. The next generation, which will be available in a matter of months, incorporates a radio conforming to the new IEEE 802.15.4 standard [10], operating at 2.4 GHz with 250 kbps bandwidth. This standard is being pushed by industry as the next generation technology for ultra-low-power, limited range wireless communications and will be well-suited for a number of novel industrial applications. We are interested in understanding the security and reliability of this technology for medical applications. The devices are capable of operating as active tags, storing information on a patient’s identity, status, history, and interventions, thereby obviating the need for back-end storage systems or paper charts. Moreover, the devices are significantly smaller than existing portable monitors, operate for months on a single pair of alkaline batteries, and completely eliminate wires. In addition, it is possible to track the location of these devices down to meter-level accuracy using ultrasoundranging or RF-localization strategies. As a demonstration of wireless vital sign monitoring using sensor network devices, we have developed a mote-based pulse oximeter, shown in Figure 1(a). The device consists of a MICA2 mote with a pulse oximetry signal-processing module designed by BCI, Inc. The pulse oximetry board consumes only 6.6 mA, in addition to the 20 mA consumed by

4 CodeBlue: A Wireless Infrastructure for Emergency Response
Integration of low-power wireless devices into medical settings raises a number of novel challenges. Current demonstration systems operate with a small number of devices under fairly static conditions. Scaling up to handle a mass casualty scenario and ensuring robust operation with a high degree of mobility and minimal packet loss poses a number of open problems. We do not wish to assume an existing wireless infrastructure; the system must work in an ad hoc manner. We are developing CodeBlue, a wireless communications infrastructure for critical care environments. CodeBlue is designed to provide routing, naming, discovery, and security for wireless medical sensors, PDAs, PCs, and other devices that may be used to monitor and treat patients in a range of medical settings. CodeBlue is designed to scale across a wide range of network densities, ranging from sparse clinic and hospital deployments to very dense, ad hoc deployments at a mass casualty site. CodeBlue must also operate on a range of wireless devices, from resource-constrained motes to more powerful PDA and PC-class systems. We are in the early design and prototyping stages of CodeBlue’s development; the discussion that follows outlines our current design goals and the research challenges that emerge in this environment.

4.1 CodeBlue Architecture
CodeBlue (depicted in Figure 2) offers a scalable, robust “information plane” for coordination and communication across wireless medical devices. CodeBlue provides protocols and

services for node naming, discovery, any-to-any ad hoc routing, authentication, and encryption. CodeBlue is based on a publish/subscribe model for data delivery, allowing sensing nodes to publish streams of vital signs, locations, and identities to which PDAs or PCs accessed by physicians and nurses can subscribe. To avoid network congestion and information overload, CodeBlue will support filtration and aggregation of events as they flow through the network. For example, physicians may specify that they should receive a full stream of data from a particular patient, but only critical changes in status for other patients on their watch. The use of ad hoc networking will allow the “mesh” of connectivity to extend across an entire building or between multiple, adjacent facilities. Additional coverage, if necessary, will be possible with placement of fixed nodes in hallways, rooms, or other areas. No matter the topology, the network will be self-organizing: loss of a given node or network link can be rapidly detected and data re-routed accordingly. CodeBlue will also provide for reliable transmission of critical data through content-specific prioritization and dynamic scaling of transmission power. CodeBlue will support a flexible security model allowing a range of policies to be implemented. For example, it is necessary that EMTs who require access to patient data be authenticated by the network before they are able to receive all patient information. One EMT must also be able to hand off access rights to another, as when a new rescue team arrives on the scene of a disaster. Authentication must be performed transparently as the patient is transported from disaster site to hospital, or transferred between hospitals. Access control must be decentralized to avoid reliance on a single authoritative system. CodeBlue will simplify application development by providing a rich infrastructure for connectivity of medical devices. In the hospital, data collected from wireless sensors can be relayed to fixed, wired terminals and integrated with patient records in existing hospital information systems. At a mass casualty site, an ambulance-based system can record extensive data streams from each wireless sensor or PDA to support audits and billing.

Computational challenges: Sensor nodes have very limited computational power, and traditional security and encryption techniques are not well-suited to this domain. While secret-key cryptographic systems have been demonstrated on motes, there is currently no practical means of establishing encryption keys. We are exploring the use of efficient, integer-based elliptic curve cryptography which has the potential to allow rapid rekeying among groups of sensors. Our system must allow physicians, nurses, and others to assign quickly access rights to patient data and to determine handoff credentials when a patient is transferred to another unit or hospital. Existing authentication systems are extremely rigid in this regard. Programming challenges: Finally, coordination of a diverse array of sensors, active tags, handheld computers, and fixed terminals requires a cohesive communication and programming model to underlie the system’s operation. Existing software for sensor nodes is very low-level and does not provide higher-level services such as discovery, naming, security, and data delivery within a common framework. Our goal is to develop a flexible protocol suite for integrating a range of wireless devices in a critical care setting.

5 Current Status
We have completed an initial design of CodeBlue and prototypes of several of the components described herein. The pulse oximetry mote has been completed and development of an ECG mote is currently underway. We have explored the use of an adaptive spanning-tree multi-hop routing algorithm, based on the TinyOS Surge protocol [15], and we have incorporated dynamic transmission power scaling to minimize interference. A lightweight public key infrastructure based on elliptic curve cryptography [11] is currently being tested. A sophisticated programming model using abstract regions for routing, data sharing, and aggregation has also been developed [14]. We believe that deploying low-power wireless devices in emergency and disaster response pushes the envelope on a number of important research challenges. With CodeBlue, we are attempting to bring these together into a coherent system to provide routing, addressing, security, and prioritization of data. Such an infrastructure is necessary to realize the benefits of these next-generation wireless devices.

4.2

Research Challenges

We have identified a number of critical challenges in our early work on CodeBlue. We intend to explore these problems in our design efforts. To achieve the level of robustness required for medical telemetry, significant research must be undertaken to design communication protocols, energymanagement schemes, and encryption algorithms appropriate to this domain. Communication challenges: The first challenge is secure, reliable, ad hoc communication among groups of sensors and mobile, handheld devices. Unlike 802.11 networks, sensor networks are entirely self-organizing and operate with extremely limited energy and computational resources. To limit energy consumption it is desirable for nodes to minimize their transmit power to achieve acceptable connectivity without inducing network interference. In addition, the network must prioritize the transmission of critical data, such as a sudden change in patient status. Existing wireless networks provide only “best effort” service and do not explicitly provide for prioritized traffic, which is critical for medical applications.

References
[1] GMP Wireless Medicine, Inc. http://www.wirelessecg.com/. [2] HealthFrontier, Inc. http://www.healthfrontier.com/ Products/. [3] Nonin Medical, Inc. http://www.nonin.com/. [4] Numed Holdings Ltd. http://www.numed.co.uk/. [5] Radianse, Inc. http://www.radianse.com/. [6] Telos corporation. http://www.telos.com/. [7] 10Blade, Inc. iRevive. http://www.10blade.com/irevive.htm.

[8] Inc. Crossbow Technology. Motes, smart dust sensors, wireless sensor networks. http://www.xbow. com/Products/productsdetails.aspx? sid=3. [9] Jason Hill, Robert Szewczyk, Alec Woo, Seth Hollar, David E. Culler, and Kristofer S. J. Pister. System architecture directions for networked sensors. In Architectural Support for Programming Languages and Operating Systems, pages 93–104, 2000. [10] Institute of Electrical and Electronics Engineers, Inc. IEEE 802.15.4. draft standard. http://grouper. ieee.org/groups/802/15/pub/TG4.html. [11] David Malan. Crypto for tiny objects. Technical Report TR-04-04, Harvard University, January 2004. [12] Microsoft Corporation. Microsoft .NET Compact Framework. http://msdn.microsoft. com/mobility/prodtechinfo/devtools/ netcf/. [13] The MobiHealth Project. Innovative gprs/umts mobile services for applications in healthcare. http://www. mobihealth.org/. [14] Matt Welsh and Geoff Mainland. Programming sensor networks using abstract regions. In the First USENIX/ACM Symposium on Networked Systems Design and Implementation (NSDI ’04), March 2004. [15] Alec Woo, Terence Tong, and David Culler. Taming the underlying challenges of reliable multihop routing in sensor networks. In the First ACM Conference on Embedded Networked Sensor Systems (SenSys 2003), November 2003. [16] Boo-Ho Yang and Sokwoo Rhee. Development of the ring sensor for healthcare automation. Robotics and Autonomous Systems, (30):273–281, 2000.