PRE2019 4 Group5

MediGO

Group members

Name	Student number	Study
Danielle Paige Gillam	1227637	Psychology & Technology (ICT)
Lucia Kalkman	1335529	Electrical Engineering
Annemijn Cissy van der Lande	1239822	Psychology & Technology (Robotics)
Dajt Mullaj	1286722	Computer Science
Fabiènne Pascalle van der Weide	1004980	Psychology & Technology (ICT)

Introduction

Nowadays, more and more automated technology in the vehicles industry is making its entrance in society. With the current situation of COVID-19, people are forced to live in social distancing societies , which results for some social groups in major challenges to continue living in a normal and healthy way. One of the major issues society is facing is maintaining the health of people who have to stay home, but still need to receive their medicines. Delivery robots could give an outcome in this situation and might give perspectives for after the COVID-19 influenced society. These robots are already in use, in several situations, environments and forms. Furthermore, they are currently experimenting with these delivery robots for multiple purposes.

Problem Statement

MediGO logo

This project will explore how to implement a system of autonomous robots for the delivery of medicine and goods to the elderly and sick people. The system could then be used in hospitals to help the staff with intensive care units and for deliveries from pharmacies directly to houses or elderly homes. To sustain an efficient delivery scheme the project will develop a prototype for a multi compartment robot. Each compartment will contain medicine for a specific delivery, so that in a single trip the robot will visit multiple houses or contain all the drugs for each elder of an elderly home. The prototype will consist in demonstrating the robot’s multi compartment system. To do that an app will be developed and hardware representing a robot with more compartments will be assembled. The app will have an option to log in as a user or as a pharmacist/caretaker. The robot will simulate compartments opening or closing and it will have a board to take inputs. As a user you will be able to order medicine through the app, which in turn will display a password to type on the robot’s board. When such action is performed the correct compartment containing the requested medicine will open. The system, as specified before, could also be used to perform deliveries within the hospital's ground in order to prevent the spread of infectious diseases among the healthcare staff.
The system, furthermore, will be designed and implemented to specifically perform deliveries of prescription's drugs. Because of its purpose the system has been called MediGO, and a logo for it has been developed. The logo will appear on the different parts of the prototype, to characterize the project. The logo has been designed to resemble the green cross symbol that is used as a pharmaceutical sign in numerous nations.

Objectives

• Research the state of the art of the current autonomous delivery robots.
• Understand the requirements for delivery robots in the medical field.
• Design and implement a multi compartment system that can lock each compartment by means of a password and communicates with an external application to set said passwords.
• Test the system to understand its limitations and improve its functionalities.

State of the Art

Delivery robots for medicine

The types of robot forms that are currently under study and first use, can be subdivided into two areas: vehicles at the ground and in the air. The great advantage of using air-based delivery robots, like drones, is the reduced amount of interaction. However, traffic regulations are currently undefined. For the ground-based vehicles, both aspects named before are the opposite in here.
Another distinction that can be made, is the environment in which the delivery robot will perform. Currently, there are view hospitals in which robots are used to transport medicines to the patients. This is an example of inside transportation, minimizing path planning and the amount of traffic, but maximizing its demand for room recognition. Also one aptheker has used delivery robots as an experiment by transporting the medicines to care-units where nurses took over the packages. The overall attitude towards this user experience was fine, but is influenced by the fact that both stakeholders had to minimally interact and were not involved in the technical liability issue. This is an example in the field of an outside environment where the robots had to face a lot of traffic and path planning, but less on room-recognition, since it delivered a package to one care unit.
Furthermore, the purpose of transport can vary a lot. At the moment, drones and ground vehicles are mostly transporting goods like food and medicines, both giving an outcome for people who have transport difficulties or are not able to go outside because of their health. In Wuhan for example, the delivery robots are both already in experimenting use. For food, real-time and path planning are really important. Another important aspect is its capacity of carrying a large amount of goods. It is therefore more common that riding vehicles carry these goods, whereas medicines are in smaller amounts but are more often carried by drones due to safety reasons. Time plays a role in this as well, for instance: warm food needs to be delivered fast and vital donor organs need to be brought fast in war areas. We can conclude that the goal of the service provided can therefore play an important role in the design choices.
Lastly, the types of technique can be distinguished, since this varies a lot per delivery robot. We will discuss this by looking at path planning, coördination & recognition, mechanics and AI in general.

Path planning/scheduling

Finding a feasible route of movement can be challenging for autonomous vehicles. Multiple algorithms are therefore proposed to improve its efficiency and safety on their path. These algorithms differ for robots that are returning or non-returning . Also the use of GPS systems is a common tool in scheduling. Furthermore, a newer tool has been designed by making use of pedestrian flow, in which it adapts to the pedestrian potential equation based on the route estimation model . When making a path planning outside, often a SLAM system is used, helping the robot to deal with the huge maps of city centers. It provides a large map of the surrounding environment . This system takes the type of roads into account, traversability and provides a method for localization in dynamic environments . Lastly, there are also central systems already that can map where all other robots are currently located, to generate as a pick up / order system, solving many problems in the communication between robots implementation on a larger scale .

Coördination & object recognition

A method for coordination is iGPS, this is working with ceiling cameras . Another commonly used technique combination for coördination and object recognition is making use of artificial intelligence, ultrasonic sensors and cameras . An example of this is the FedEx SameDay Bot — which looks like a cooler on wheels — is designed to travel on sidewalks and along roadsides to deliver small orders to homes and businesses . This type of robot successfully passes objects on their way, like trash cans, skateboards etc. Moreover, another example is Amazon Scout devices; also using cameras and sensors for its planning and cöordination . Furthermore, there are also robots that are capable of recognizing and distinguishing between rooms , making use of intelligent machine vision .

Mechanics

First of all, when looking at the ground vehicles, they have to face several problems on the road, so good mechanics are essential. At the moment, a wheel and track hybrid robot platform exists which is highly applicable to various urban environments. The developed robot platform has all advantages of track and wheel. Furthermore, this hybrid concept is highly energy-efficient because of its less-friction using wheels only on navigating flatland . Moreover, new developments in the technologies of drone delivery are aircraft design, battery improvements, and control software. They could transform this industry and, consequently, society as a whole .

Finally, we should not forget to look at the current attitude people have towards this upcoming innovation. This is dependent on the perspective we look at. Current studies show this broadly, by making a distinction in the type of stakeholder. Random people in traffic for example will have different attitudes towards the robot than the receivers of the good . Also the environmental footprint raises discussions: drones are a relatively sustainable transportation method, but the production is not. However, one thing that is universal is that the delivery robot should be in balance with safety, ease of use, environment, goal and efficiency. Dependent on the welfare of the society, attitudes towards robots might differ.

Lock Systems

DHL/PostNL Lockers

In 2017, the first DHL Lockers could be seen in the Netherlands . Instead of a delivery at your home, you can choose to let your package be delivered in one of their yellow lockers. In the Netherlands, there are 3000 DHL Locker points, so there is always one close to your house and they're accessible day and night. If you've sent your parcel to a locker, a unique code will be texted or emailed to you. With this code, you can open your locker. PostNL has a comparable service. Their orange lockers can also be used to send or receive parcels and can also be opened with a unique code (that gets send to you by email or SMS).

Pharmacies with machine for "take-out"

BENU is one of the leading healthcare providers in the Netherlands. One service BENU pharmacies provides is the take out machine for all kinds of medication . The service is free, you don't have to wait in line when picking up medication and in most pharmacies it is possible to pick up medicine 24/7 when using this machine. The medicine can be achieved by entering a unique code (sent to you by SMS or e-mail) and your birth date for veryfication. Multiple examples of these machines exist.

A number of companies specialized in digital locks for doors, vaults and other property . Add eleboration

Limitations and issues

There are multiple problems before autonomous delivery robots can be fully used. In the following part the major issues will be stated that are currently holding back the implementation of delivery robots. One of the main problems is the attitude of society about automated vehicles. There are concerns about the safety of the transport, such things as hacking could cause problems. However, there are other concerns people have. For example whether more people will get unemployed when delivery robots are widely spread. People are also wondering whether a robot can reach every location, climbing stairs or entering a building could be difficult. People also think that for example a sidewalk robot should not hinder pedestrians, which causes even more things to take care of when designing the robot.
Another problem are all the technical issues. Is it possible for a robot to reach a higher efficiency, improve time and reduce cost and energy consumption. Will a robot be as reliable as a human? It should be able to deliver something within the same time and guarantee that the product arrives. The biggest technical issue is the navigation and the interaction with the environment. This means the robot should always know where it is and where it’s goal is, but also what happens around him. What are possible dangers and what is the best possible way to get where it should be. Especially with a lot of individuals who don’t follow the same paths it can be difficult for a sidewalk robot to avoid them all. The current technology is still struggling with this.
The final issues are the regulations. For UAV’s there are special regulations, and they are not allowed to fly everywhere, however, self-driving cars counter the same issues. They are not allowed on the road because of many ethical issues and some technical liabilities. The last option are sidewalk robots, which don’t have to meet as many regulations, but they are also difficult because pedestrians are hard to model and follow less strict paths. All the different regulations in different countries and all the parts that are still very vague make it difficult to really develop delivery robots. Also questions like who is responsible for the robots mistakes make it less attractive to start working on delivery robots.

Stakeholders analysis

There are a number of different stakeholders when it comes to the field of medical delivery robots. Here the main stakeholders within the scopes of users, society and enterprise will be presented and discussed. Furthermore an ethical analysis will be performed in order to evaluate the different ethical issues that the stakeholders might have regarding the MediGO delivery system and how those issues affect the design choices of the system.

USE perspectives

Users

The primary users of medical delivery robots are those who directly interact with the robot. Therefore sick or elderly people who require medicine deliveries will fall into this category. These patients will have to have sufficient understanding of how to interact with the robots and respective applications. Pharmacists and nurses will also be considered primary users as they will have to interact with the robot in order to fill it with sufficient supplies for respective patients and understand the operation of the application and robot. These users will be considered the most in the design process as they will use the robot for it's purpose, and so interface design choices as well as technical design choices will be made in order to best accommodate these users.

Society

Within society there are a number of stakeholders, the first being the Government. The Government are responsible for laws and regulations regarding the medical delivery robots, this includes traffic regulations as well as ethical laws.

The second stakeholder that is a part of the societal perspective is nurses caretakers and doctors. As well as being direct users of the robots in terms of stocking them with medicine, the medical delivery robots impact them in a less direct manner too. For example in the midst of a pandemic or an outbreak of disease, the fact that these health care workers are able to send a delivery robot to infected patients means that they reduce the risk of being infected themselves. Hospitals themselves are also stakeholders and due to the fact that hospitals are commonly hotspots for these outbreaks the reduction of infection of their staff will help prevent understaffing. The reduction of the spread of disease will additionally help society as a whole as well as reducing stress on governments.

The final societal stakeholders are people who encounter the medical delivery robots on the streets while they are performing their delivery or pick-up tasks. These individuals play an important role in the fabrication of laws and regulations as their lives will be affected by the robots without any direct gain from them. For example the possibility of disruption in pedestrian traffic or even the vandalisation of the robots will motivate respective regulations. In order to gain this stakeholder perspective a survey will be performed in order to gain insight from these stakeholders and their attitudes towards delivery robots.

Enterprise

Within the scope of Enterprise the main stakeholders are the technical companies which are developing the medical delivery robots as well as the hospitals and pharmacies with which they are partnered.

Ethical Analysis

There are many ethical considerations that come with the use of autonomous robots, especially within the medical world.

This ethical analysis will be loosely based upon the Beauchamp and Childress model which uses the following core principles for considering ethical issues :

• Beneficence
• Nonmaleficence
• Autonomy
• Justice

The most obvious and direct risk of any assistive technology, is the potential of physical harm. However there are also more issues that may be less obvious. In a study conducted on a delivery robot used in multiple departments of a hospital, Mutlu and Forlizzi discovered that different patient groups had different emotional reactions to the robot. Cancer units were not accepting the robot, finding it annoying, while postpartum units were accepting the robot and calling it delightful.

The results of this study suggest that different user populations can have completely different views or experiences with the same robot. These opinions could be due to a number of social or cognitive reasons. Because of the wide variety of possible reactions to robots in these situations it is important to take into consideration a wide range of user perspectives. According to previous experiments , it has also been demonstrated that some users form emotional attachments to robots that they were interacting with, some even having the impression that a robot would miss them when they were gone, which is beyond the capabilities of modern robots. Humans have a strong tendency to anthropomorphise objects with human-like features like a face or eyes. Such personification may be unintentional, occurring because a caregiver refers to the robot as ‘him’ or ‘her’. This anthropomorphism assigns greater intelligence to the robot than it truly has. The same can be said for robots that communicate via a natural human voice. These emotional attachments are misleading and could be seen as a form of deception and lead to too much trust in the robot which is unethical.

Autonomous car presenting anthropomorphic features

In order to mitigate this deception as best as possible, in the case of our robot technology, it must be made clear from the instance that any user sees the robot that its main purpose is delivery and not communication or medical advice. However other studies have found how in the car industry a certain degree of anthropomorphism can increase user's trust in autonomous vehicles . Keeping both view points in mind, the MediGO delivery robot will be designed without real human features such as a face, realistic eyes or a human voice, but will present basic aspects of anthropomorphism, like the headlights of a car. In addition to this, before any technology is deployed, it is critical to explain to all users involved what the capabilities of the technology are as well as possible. However, this can be unrealistic in the scope of delivery robots as uninformed bystanders (for example people on the streets that encounter the robots) will be exposed to them often, full disclosure can be difficult in these situations.

The risk of further isolation due to decreased human contact due to replacement with robots is also an ethical consideration. Particularly for populations that are known to suffer from isolation, including the elderly. However, in this case the costs of the medical delivery robots outweigh the benefits especially for those who are unable to collect their medication alone due to mobility or cognitive reasons. Here there is a tradeoff between getting vital, possibly life saving medication via an autonomous robot and the risk of further isolating a user and it is clear that the former is too important to disregard the use of these delivery robots.

Another ethical issue with delivery robots that arises is in terms of privacy. These robots will have access to sensitive information about a patient such as their home address and the medication which they take regularly. Because this information also needs to be shared with the pharmacist and in some cases caretakers, it is important in this case for the users to sign an informed consent to understand exactly which information of theirs is accessed. For instance, a user might not realize that the robot’s camera could record video, the camera should therefore be an obvious feature of the robot so that everyone who sees it understands that it has this feature. Furthermore, it is very important to make sure that the capabilities of a robot are sufficiently explained beforehand so that a user has been as well informed of a model of the robot’s abilities as possible.

Another justice-related issue when discussing robotics in socially assistive settings is the notion of responsibility: Who should be held responsible if or when things go wrong? Error in robot functioning could occur due to user error, or an error of the robot itself. The difference is not always clear between these and so there is a blurry line of moral responsibility. For example the user error could be a result of poor instructions or false expectations due to the aforementioned deception. In this case it is difficult to say who should be held responsible if something does not go to plan. In the case of robot error, the problem could be in the design, hardware, or software of the robot, meaning that the responsibility belongs to the designer, programmer, manufacturer, distributor, or retailer. However this is difficult as most software licenses explicitly absolve the software developer of responsibility, and the same goes for most manufacturers. Therefore the role of responsibility is difficult to ascribe to one particular party. However there are more tangible errors that have clear links to responsibility. For example, if the wrong medication is loaded into one of the robots compartments for a particular patient, it is clear that this responsibility belongs to the pharmacist who loaded the robot.

Requirement analysis

During the requirement analysis phase of the project three main steps were undertaken. During the first step the stakeholders needs were collected. To do that several one to one interviews were conducted by the team members. The second step consisted in creating measurable requirements from the gathered needs. During the third step, instead, several security requirements were defined. Finally, at the end of this section, an overview of the system at this stage of the development processes is presented.

Collecting the stakeholders needs

To identify current problems and needs regarding the delivery of medicine using robot, interviews with the different stakeholders were conducted. Specifically the primary users (elderly), as well as pharmacists, and caretakers were interviewed. For each one of these groups a set of questions was created to be used during the interviews. According to Griffin and Hauser (1993) in order to gather 90% of the users needs between 20 to 30 interviews must be conducted. In this regard our team managed to interview a total of 20 stakeholders. The questions that were asked and the transcripts of the responses can be found here. Below are reported the needs that were gathered from the different interviews with the stakeholders. The needs are presented within the user segment they were collected from.

Elderly needs

1.	The robot needs to be user-friendly and understandable for elderly, every action should be intuitive.
2.	A human-like feature (face / eyes) would be nice, but functionality is more important, a voice would be nice.
3.	We need to have a lock system that gets opened by a password/code/app/card that somehow identifies the user.
4.	The password is set up with the pharmacist and is delivered in a written format (letter).
5.	The password should be easy to input in the robot, preferably with a simple keyboard.
6.	Deliver on certain, known time slots.
7.	The robot should be able to notify the user that it is at the door.
8.	The robot needs to alarm someone if it expects something is wrong (door doesn’t get opened for example).
9.	The robot (either drone or walking/driving) should be recognizable as belonging to the pharmacy.
10.	The compartments (or at least one/some) should be cooled, since some medication need that.
11.	Don’t let the robot drop the medicine on the doormat (dangerous for pets).
12.	The robot could carry also some indication about the medicines from the pharmacist inside the compartment, in form of a written note for example.

Caretakers needs

13.	It should be "tested" if someone is still clear-headed and independent enough (also physically) to use our delivery system (or decide the person responsible for this).
14.	(In a care home) The robot should have a way to monitor if people actually correctly took their medicine.
15.	The elderly can entrust the caretaker to keep track of the deliveries, which the caretaker will schedule and set with an app.
16.	Set protocol for “not normal situations”, meaning for example a precise set of action the pharmacist will do to inform the caretaker if some information needed for the delivery are missing before attempting the delivery.
17.	If the password is lost can be resent via sms or letter or notified on the caretaker app.
18.	Ability to plan in advance which medicines must be delivered on which day.
19.	Possibility to subscribe to the delivery service directly at any pharmacy.
20.	A smart system to decide the delivery routes and moments is needed.

Pharmacists needs

21.	Separate sachets or clear labels are necessary to not accidentally swap medicine.
22.	People need to be at home during delivery. Smart route planning / notifications for the users are useful.
23.	Cooled compartments for medication that needs to be kept cold.
24.	Option to offer counselling.
25.	Easy to understand application.
26.	QR codes to offer extra info for the patient.
27.	Tracked deliveries.
28.	Option for patients to give feedback.
29.	Database to keep track of the prescription medicines that still have to be delivered or have been already delivered to a certain patient.

Requirements engineering

Using the stakeholder’s needs that were gathered during the interviews a set of system requirements was constructed. The requirements are semi-formal and are written following the syntax defined in the ISO 29148 standard . When defining such requirements it was ensured that they were consistent, complete and practically feasible. They are therefore directly traceable to the stakeholder’s needs.

The delivery system, to parallel the different users segments, was divided into three subsystems: a "tool" used by the pharmacist, a "tool" used by the elderly or the caretaker, and the robot’s compartment system. At this stage of the development processes what precisely is meant by tool is not yet specified. Indeed based on the subsequent requirements, during the next development processes, the specification, it will be decided which technology will be better suited to fulfill said requirements (a desktop application over a phone application for example). For each one of previously stated subsystems different requirements were defined.

Pharmacist’s Tool

The system in this case is the pharmacist’s tool. The tool should be able to communicate with a database containing the customer's details and medication’s needs to retrieve the required information and reserve a compartment of the robot for a specific customer.

To clarify the actors that are involved with the system we include a list of actors with their goal:

• Pharmacist: fill the robot’s compartment with the correct medicines.
• Patients database: hold the details and medication’s list for each patient.
• Delivery Robot: reserve a compartment for a specific patient.

To define precisely the requirements is helpful to also identify the inputs and outputs. We use the interpretation that inputs are received from the actors and outputs are sent to the actors.

Inputs				Outputs
ID	Name	Rational		ID	Name	Rational
IN-P01	inPatientID	Receive patient details identifiers from pharmacist		OUT-P01	outQuerySend	Query the database for the patient details.
IN-P02	inQueryResponse	Receive patient details from database		OUT-P02	outAvailable	Message to the robot asking which compartments are still available.
IN-P03	inAvailableP	Receive request to display available compartments from pharmacist.		OUT-P03	outReserve	Send a message containing the patient information and the desired compartment to the robot for a compartment reservation.
IN-P04	inAvailableR	Receive a list of the available compartments from the robot.		OUT-P04	outOpen	Send a request to open a compartment to the robot.
IN-P05	inReserve	Receive request to reserve a compartment for a specific user from the pharmacist.		OUT-P05	outClose	Send a request to close a compartment to the robot.
IN-P06	inOpen	Receive request to open a compartment from the pharmacist.		OUT-P06	outDepart	Send a request to start the delivery to the robot.
IN-P07	inClose	Receive request to close a compartment from the pharmacist.		OUT-P07	outUpdate	Send a message to the database containing the updated customer information (which medicines have been delivered for example).
IN-P08	inDepart	Receive request to start the delivery from the pharmacist.		OUT-P08	outPatientDelivery	Send patient details update regarding the delivery date and time to the database.
IN-P09	inCompleted	Receive signal indicating the completion of a delivery from the robot.		OUT-P09	outLock	Send a request to lock a compartment to the robot.
IN-P10	inPatientDelivery	Receive patient details update regarding the delivery date and time from the pharmacist.		OUT-P10	outUnlock	Send a request to unlock a compartment to the robot.

Following are the requirements for this system, which are identified by a unique identifier. Furthermore each requirement has a source indicating from which need it originated.

• R-P1 The application shall display a list of the patients subscribed to the delivery service which is ordered by the date the patient must receive the delivery
  Source: Needs 6, 18, 19, 25, 29.
• R-P2 When inPatientID is received from the pharmacist, the tool shall send outQuerySend to the database within 0.2 s.
  Source: Needs 29.
• R-P3 When inQueryResponse is received from the database, the tool shall display the patient’s details within 0.2 s.
  Source: Needs 29.
• R-P4 When inAvailableP is received from the pharmacist, the tool shall send the message outAvailable to the robot within 0.2 s.
  Source: Needs 21.
• R-P5 When inAvailableR is received from the robot, the tool shall display the available compartments within 0.2 s.
  Source: Needs 21, 25.
• R-P6 When inReserve is received from the pharmacist, the tool shall send the message outReserve to the robot within 0.2 s.
  Source: Needs 3, 21.
• R-P7 When inOpen is received from the pharmacist, the tool shall send the signal outOpen to the robot within 0.2 s.
  Source: Needs 3, 21, 25.
• R-P8 When inClose is received from the pharmacist, the tool shall send the signal outClose to the robot within 0.2 s.
  Source: Needs 3, 21, 25.
• R-P9 When inDepart is received from the pharmacist, the tool shall send the signal outDepart to the robot within 0.2 s.
  Source: Needs 6, 22, 25, 27.
• R-P10 When inCompleted is received from the robot, the tool shall send the message outUpdate to the database within 0.2 s.
  Source: Needs 27, 29.
• R-P11 When inPatientDelivery is received from the pharmacist, the tool shall send outPatientDelivery to the database within 0.2 s.
  Source: Needs 6, 18, 20, 22.
• R-P12 When the pharmacist requests to lock a compartment, the tool shall send outLock to the robot within 0.2 s.
  Source: Needs 3.
• R-P13 When the pharmacist requests to unlock a compartment, the tool shall send outUnlock to the robot within 0.2 s.
  Source: Needs 3.
• R-P14 When the pharmacist requests to lock a compartment, the tool shall generate a compartment's password within 0.2 s.
  Source: Needs 3.
• R-P15 When the pharmacist locks a compartment, the tool shall send the compartment's password to the elderly/caretaker's tool within 0.2 s.
  Source: Needs 3.

Elderly and Caretaker’s Tool

The system in this case is the elderly and caretaker’s tool. The tool should be able to communicate with a database containing the customer's details and medication’s needs to update specific information, like desired time for the delivery and notify the elderly or caretaker when the robot arrived at destination.

Actors with their goal:

• Elderly/Caretaker: track the delivery and add patient delivery details.
• Patients database: hold the details and medication’s list for each patient.
• Delivery robot: deliver the medicine to the patient.
• Pharmacist: make sure that the elderly is able to retrieve the medication.

Following are the requirements for this system, which are identified by a unique identifier. Furthermore each requirement has a source indicating from which need it originated.

• R-C1 When the elderly/caretaker updates the delivery date and time, the tool shall send a message to the database to update its information only if the current delivery has terminated or does not start for at least two hours.
  Source: Needs 15, 18, 20, 22, 27.
• R-C2 When the caretaker requests to visualize the patient details, the tool shall display the patient information, containing which prescriptions have been already delivered for the current period and which not, within 0.2 s.
  Source: Needs 14, 29.
• R-C3 When the robot arrives at the patient’s home, the tool shall display a notification indicating the arrival within 0.2 s.
  Source: Needs 7.
• R-C4 When the robot departs from the pharmacy, the tool shall display a notification indicating the departure and the content of the delivery within 0.2 s.
  Source: Needs 7.
• R-C5 If the elderly/caretaker wants to know the compartment's password, the tool shall display the password within 0.2 s.
  Source: Needs 17.

Robot’s compartment system

The system in this case is the robot’s compartment system. This part represents the delivery robot, more specifically its delivery method. Further on the robot’s compartment system will be simply referred to as the robot. It is therefore important to remember that the requirements here specified only address the behavior of the delivery method, not of the complete functionality of a delivery robot (like route planning or autonomous driving). The robot should be able to communicate with the tool of the pharmacist to retrieve patient’s details and reserve compartments and with the tool of the elderly/caretaker to track the delivery.

The list of actors with their goal is extended to include sensors and other hardware components:

• Pharmacist: fill the robot’s compartment with the correct medicines.
• Patients: elderly that needs to retrieve their prescription medicine.
• Elderly/Caretaker: track the delivery for a specific patient.
• Position sensor: detects when the robot arrived at a delivery destination. Because we are not interested in developing a moving robot the position sensor is simply a time sensor that sends an input (signaling the arrival to a destination) after a set amount of time from the delivery departure.
• Memory: keep track of which compartment is assigned to which patient and the details needed for the authentication.
• Keyboard: collect the password of a compartment from the environment (patients).
• Device communicator: send and receive signals from the pharmacist’s and elderly/caretaker’s tool, which are running on another device.
• Bell: device used to notify the elderly of the arrival of the robot.
• Compartment: can open, close and lock the compartment.
• Compartment sensor: checks if the compartment is empty.

In this case it is again necessary to also identify the inputs and outputs. We use the interpretation that inputs are received from the actors and outputs are sent to the actors.

Inputs				Outputs
ID	Name	Rational		ID	Name	Rational
IN-R01	inAvailable	Corresponding to OUT-P02, is a message received by the device communicator requesting which compartments are still available.		OUT-R01	outAvailable	Corresponding to IN-P04, is a message sent by the device communicator indicating which compartments are still available.
IN-R02	inReserve	Corresponding to OUT-P03, is a message received by the device communicator requesting to reserve a compartment and containing the patient’s details.		OUT-R02	outOpen	Send a message to a compartment requesting to open the compartment.
IN-R03	inOpen	Corresponding to OUT-P04, is a message received by the device communicator requesting to open a compartment.		OUT-R03	outClose	Send a message to a compartment requesting to close the compartment.
IN-R04	inClose	Corresponding to OUT-P05, is a message received by the device communicator requesting to close a compartment.		OUT-R04	outDepart	Send a message to the device communicator to indicate to the elderly/caretaker that the delivery departed.
IN-R05	inDepart	Corresponding to OUT-P06, is a message received by the device communicator requesting to start the delivery.		OUT-R05	outArrived	Send a message to the device communicator to indicate to the caretaker that the delivery arrived.
IN-R06	inArrived	Receives a signal from the position sensor indicating the robot arrived at the delivery destination.		OUT-R06	outDest	Send a message to the memory indicating that the medicine has been delivered at the current destination.
IN-R07	inDest	Receives a message from the memory indicating which is the next destination.		OUT-R07	outBell	Send a signal to the bell to notify the patient of the arrival of the robot.
IN-R08	inPasswod	Receives an input from the keyboard indicating which password has been imputed by the patient.		OUT-R08	outLock	Send a message to a compartment requesting to lock the compartment.
IN-R09	inLock	Corresponding to OUT-P09, is a message received by the device communicator requesting to lock a compartment.		OUT-R09	outUnlock	Send a message to a compartment requesting to unlock the compartment.
IN-R10	inUnlock	Corresponding to OUT-P10, is a message received by the device communicator requesting to unlock a compartment.
IN-R11	inNoResponse	Is a message received by the position sensor (remember the latter is really only a time sensor) when the robot has arrived at the destination but no password has been tried for five minutes.
IN-R12	inEmpty	Signal received from the compartment sensor indicating the compartment is empty.

Following are the requirements for this system, which are identified by a unique identifier. Furthermore each requirement has a source indicating from which need it originated.

• R-R1 The compartment on the robot shall be each identified by a different number and a different color.
  Source: Needs 21.
• R-R2 When a medicinine is placed in a compartment, the robot shall ensure that the medicine does not gain or lose more than a 1℃ for at least 5 hours.
  Source: Needs 10, 23.
• R-R3 When inAvailable is received from the device communicator, the robot shall send outAvailable to the device communicator within 0.2 s.
  Source: Needs 21.
• R-R4 When inReserve is received from the device communicator, the robot shall save in the memory the details of the patient and the assigned compartment within 0.2 s.
  Source: Needs 3, 21.
• R-R5 When inOpen is received from the device communicator, the robot shall send outOpen to the requested compartment within 0.2 s.
  Source: Needs 3, 21.
• R-R6 When inClose is received from the device communicator, the robot shall send outClose to the requested compartment within 0.2 s.
  Source: Needs 3, 21.
• R-R7 When inLock is received from the device communicator, the robot shall send outLock to the requested compartment within 0.2 s.
  Source: Needs 3, 21.
• R-R8 When inUnlock is received from the device communicator, the robot shall send outUnlock to the requested compartment within 0.2 s.
  Source: Needs 3, 21.
• R-R9 When inDepart is received from the device communicator, the robot shall send outDepart to the device communicator within 0.2 s.
  Source: Needs 6, 15, 22, 27.
• R-R10 When inArrived is received from the position sensor, the robot shall send outArrived to the device communicator within 0.2 s.
  Source: Needs 6, 15, 22, 27.
• R-R11 When inDest is received from the memory, the robot shall send outDepart to the device communicator within 0.2 s.
  Source: Needs 6, 15, 22, 27.
• R-R12 When inPassword is received from the keyboard, the robot shall send outUnlock and outOpen to the specific compartment only if the password is correct.
  Source: Needs 3, 5.
• R-R13 When inArrived is received from the position sensor, the robot shall send outBell to the bell within 0.2 s.
  Source: Needs 7.
• R-R14 When inEmpty is received from the compartment sensor and the compartment is open, the robot shall send outClose and outLock to the compartment within 0.2 s.
  Source: Needs 1.
• R-R15 When inNoResponse is received from the position sensor, the robot shall send a notification to the pharmacist and the elderly\caretaker (through the device communicator) within 0.2 s.
  Source: Needs 8, 16.
• R-R16 When inPassword has been received from the keyboard and inEmpty has been received from the compartment sensor, the robot shall send outDest to the memory within 0.2 s.
  Source: Needs 20, 27.
• R-R17 The robot shall have drawn the MediGO symbol over its structure.
  Source: Needs 9.

Security Requirements

The security requirements engineering is divided into three main parts. In the first part an access control matrix is defined in order to define which stakeholders can have access to which resource. This way attack's from the inside can be mitigated (a patient cannot change the data regarding another patient for example). During the second part the authentication issues and requirements are defined, trying to mitigated the attack's coming from the outside (how to prove someone is a legitimate user of the delivery system). The third part, instead, defines the requirements of a strong and easy to remember password, to be used when opening the compartments of the robot. Finally the fourth part asses how patients are identified and registered into the system and also treats a security issue that is not related to a cyber attack. Indeed it specifies how a patients will be deemed safe to use the system or when a caretaker must use the system for them.

Access control policy

In order to construct a control matrix, where access to each resource is defined for every stakeholder, an access control policy was defined. The access control policy captures the meaning of the intended high level policy by specifying who (subject) is trusted with which resource (object) to do what (allowed actions). Following are the requirements defined for the access control policy of MediGO.

• The pharmacist maintains a database containing the information about the elderly subscribed to the delivery system (with also the delivery dates and times).
• Doctors can add, remove and modify the information about the elderly subscribed to the system (but not the delivery dates and times).
• The elderly can read only the information about themselves.
• The elderly can modify the delivery times and dates regarding their deliveries.
• The elderly can read their compartment’s password when the delivery departs.
• The pharmacist reads and sets the compartment’s passwords for each delivery.
• The caretaker can read only the information about the elderly they look after.
• The caretaker can modify the delivery times and dates regarding the deliveries of the elderly they look after.
• The caretaker can read the compartment’s password when a delivery for the elderly they look after departs.

Role Based Access Control Matrix

The different high level policies can now be expressed in terms of rights that users within a certain role have. The role based access control matrix, indeed, gives a simple specification of the access control policy. In this matrix there is a row for each role and a column for each resource. This results in a field for each combination of a role and a resource. The rights that that the subject has on that resource, i.e. allowed actions, are filled in this field.

Role \ Resource	Elderly details	Password	Date and time delivery
Pharmacist	Read	Read/Write	Read
Doctor	Read/Write	No access	Read
Elderly	Read	Read	Read/Write
Caretaker	Read	Read	Read/Write

Defining the matrix is fundamental in trying to mitigate malicious or erroneous use of the delivery system by its users. Indeed the implementation will have to respect the matrix's entries, not allowing, for example, a patient to change the type of prescribed medicine without consulting with a doctor first. Furthermore in the matrix is also specified to which degree each action is permitted. Indeed a patient can see the password of only the compartment reserved for him, while a pharmacist can set and see the passwords of every compartment.

Authentication

In the second part of the security requirements we define the authentication requirements, so that an external attacker can not claim the identity of one of the patients.

We previously defined the access control policies with roles different users could take. However a role is just an example of a property (or attribute) of a user, to which we might link a right to. Using the concept of attribute, the NIST (The National Institute of Standards and Technology (NIST), a US federal institute) electronic authentication guide defines an identity as:

An identity is a set of attributes that uniquely describe a person within a given context.

Several preceding studies distinguish three types attributes, or authentication factors, that can uniquely identify an identity::

• Knowledge-based factors (something you know)
• Possession-based factors (something you have)
• Biometric-based factors (something you are)

Some studies also acknowledge a fourth type:

• Somewhere you are / someone you know

We then identify two types of authentications that make use of these authentication factors: single factor authentication and multi-factor authentication.

Single factor authentication

Examples of single factor authentication are possessing an ID card that by swipe technology authorizes access into a facility or the traditional user-password scheme. The latter has the following features:

• Easy to implement
• Requires no special equipment
• Easy to forget
• Can be susceptible to shoulder surfing
• Security based on password strength
• Lack of identity check
• Cost of support increases

However, regarding security, there are some issues with this the single factor authentication. There are a lot of rules and algorithms that can generate strong passwords, but this are generally very difficult to remember. In order to do so people write them down, which makes the system way less secure. Therefore we identified in multi-factor authentication, a better requirement for the authentication processes of MediGO.

Multi-factor authentication

Multi-factor authentication makes use of two or more of the factor categories (and not using multiple examples of the same factor). A well known example is inserting a credit card (something you own) and typing in the pin code (something you know). Another example that is used a lot (in E-banking or investment sectors) is the combination of a password (something you know) and a token (something you own). For our delivery system the patients, to open the compartments will have to authenticate themselves using two authentication factors.

Password

The delivery system will make use of a password to open the different compartments. An important requirement for the security of the system is that:

• The password should remain secret, and only known to the specific patient and the pharmacist.

In order to better specify this requirement is necessary to make use of the concept of entropy, which captures how hard a secret is to guess. If the entropy (expressed in the number of bits needed to represent the hidden information) is n then one needs on average half of 2ⁿ guesses to find the secret. Therefore a more specific password requirement is:

• Achieve an entropy where the attacker, if guessing, must try at least 50000 passwords to open the compartments and 100000 passwords to log in someone else's account within the database.

To combat weak passwords, furthermore, an extra requirement is:

• The password must be randomly generated.

Because the robot needs to check the identity of the users connecting to it, a list of unprotected passwords might have to be stored in. However this makes the robot an attractive target for an attacker, as gaining access to its memory will reveal all the passwords for each compartment. A commonly used solution to protect stored passwords is to only store the hashes of the passwords, not the passwords themselves. Hash functions produce a fixed size output for any length input and are one way (irreversible) and collision resistant (hard to find inputs that give the same output). When a claimant provides a password the robot hashes it and compares it with the hash value stored for the claimed identity. A well chosen hash is collision resistant and therefore this method is just as good as comparing the entry directly with the identity’s password. Therefore the last password requirement is:

• Save the hashes of the passwords in the database, rather than the unprotected passwords, for verification purposes.

Furthermore as specified in the previous section strong passwords are hard to remember. Because the system must be user friendly and target the elderly, a password that is hard to remember is an issue. The solution that we identified is to use shorter passwords but that can be used only one time, an OTP (one time password). This was even if an attacker manages to find out the password only a single delivery is compromised:

• Use a OTP for each delivery.

In order to use an OTP, however, the tool of the pharmacist must communicate with the elderly/caretaker's tool and send the password to the latter each time a delivery is executed. In order to prevent and protect the system from man in the middle attacks the following requirement was defined:

• Passwords must be encrypted by the pharmacist's tool before being sent and must be decrypted by the elderly/caretaker's tool once received to be used.

Classification of the elderly users

The first step in classifying the elderly is to identify them. Indeed while the previous section treated how the patients can authenticate themselves, here will first be treated how they will register into the system and therefore identify themselves. Furthermore it will be treated also according to which metric the elderly patients can be deemed safe to use the MediGO system independently or if they need assistance from a caretaker.

Identification

Because the elderly must first go to the doctor in order to get prescribed the medicine they must assume, it seemed fitting that the doctor would also register them into the delivery system if required. In order to register them into the system the doctor can then also check their identification and also check if they would be able to use it independently applying the metric we defined in the next subsection. However the doctor now needs also to have access to a "tool", like the pharmacist, that communicates with the database in order to add patients to it or remove them. We can then define the last sentence as a new requirement:

• R-D01 When a patient subscribes to the service, the doctor's tool must add the patient's details to the database.

Metric to identify independent users of the system

To develop a metric to identify which users can use the system independently we looked at three other famous metrics: MMSE score, CPS Score and the Netherlands care home codes.

The Mini-Mental State Exam (MMSE) is a brief test of cognitive impairment used widely to screen for dementia. The original test, developed by Folstein et al (1975), includes questions about orientation, attention, recall, and language. Galasko et al (1990) developed a shorter version of the test (Modified MMSE) that is as sensitive as the complete test. A score of 23 out of a possible 30 is recommended as the cut-off score for dementia (Folstein et al 1975).

The CPS scores range from 0 to 6, with 0 indicating intact cognitive function and 6 very severe impairment. The scores are below reported with their respective meaning.

• CPS=1 Borderline intact;
• CPS=2 Mild impairment;
• CPS=3 Moderate impairment;
• CPS=4 Moderately severe impairment;
• CPS=5 Severe impairment;
• CPS=6 Very severe impairment.

To determine if a patient is or is not independent and cognitively capable enough to make use of the delivery service the GP will have to do a MMSE score test or an CPS score test. The GP will then check if the cognitive capacity is lower than 22 as MMSE or lower than 3 as CPS. If this is not the case a patient could show symptoms of dementia. Furthermore the GP needs to screen the patient to test if he or she falls within the code 1 or 2 (independency). If both are the case, the patient will get a personal account for which the details will be posted by a letter from the pharmacist. If both or one of the two is not the case, the patient can still make use of the system if he or she has a caretaker. The caretaker needs to be home to accept the medicines of the delivery robot. Beside those two tests, the GP also needs to determine whether or not the system is necessary for the user. If someone for example has mobility problems or social distancing issues, it is more common to prescribe the delivery service. These criteria are already used in the current delivery service car and are important to keep, due to capacity issues.

System Overview

In this section an overview of the system at this stage of the development processes is given. This is done by means of use case diagrams and by describing a scenario in which examples of different stakeholders of MediGO are described while interacting with the system.

Use case diagrams

The following use case diagram captures the main use cases of the system and the different actors that are involved in each of them.

Use case diagram of the delivery system

The previous use case diagram is shown here again, but this time the different functionalities are grouped depending on which "tool" offers them.

Use case diagram where the subsystems of the delivery system are highlighted inside rectangular boxes.

Personas

To illustrate the needs of the envisioned user group, the following personas were created:

• David and Maria, an elderly couple
• Tom, a home caregiver
• Betty, an old lady
• Samantha, a pharmacist

Below, these personas are combined in a scenario that gives an overview of the system as a whole.

David and Maria

David (76) and Maria (73) are married for almost 50 years and are living together peacefully in their terraced house in a village in the Netherlands. David has some trouble with his heart, for which he needs medication every day and Maria has very painful rheumatism for which she has to inject medicine once every few weeks. They both have a smartphone and luckily, their children and grandchildren helped them understand how to use it. When they want to install a new app, they need to ask for help, but once the app is installed and explained they know how to use it pretty well. David and Maria take a stroll every day to keep active, but during the COVID-19 outbreak, they are more careful when it comes to going outside and seeing other people, and they sometimes find it difficult to enter shops or pharmacies as they are relatively crowded.

Tom

Tom is 36 years old. He works in home care and really likes his job. It really pleases him to know that he can help these people stay at home a bit longer by regularly visiting them and helping them with whatever they need. For some people, he only needs to pick up medication (because they are not mobile enough themselves anymore), but after that, they can use them and do everything else on their own. This takes a lot of time, which he prefers to spend with people that really need his assistance with cleaning, taking medication, washing, or just having a nice conversation.

Betty

90 year old Betty still lives at home. Her husband died 12 years ago, but she refuses to leave their home to go to a care home. She’s got too many memories here. In the last few years, her family really saw her health declining. She needs more and more medicine and has dementia on top of that, so she also regularly forgets to take them. That is why they applied for home care. Now, someone comes to visit Betty every day to check on her and help her with tasks that she cannot do herself anymore. The home care helps with cleaning, picks up medication from the pharmacy, helps with managing Betty’s agenda, makes sure she takes her pill on time and whatever she needs besides that.

Samantha

Samantha (31) works in a pharmacy in Eindhoven, she has worked there for 5 years and loves to interact with her regular customers, who are primarily elderly patients. During the Covid-19 outbreak Samantha is worried about how some of these patients are collecting their medication, as many of them have serious medical conditions. Sometimes family members come in to collect it but some elderly patients do not have any family to help them with this task and so they come to the pharmacy themselves. This is particularly worrying because recently the pharmacies have been extremely full as people have begun to panic and buy more medication than usual, and it is difficult to maintain social distance within the pharmacy, leaving the elderly at a higher risk for infection. Samantha believes that the pharmacies should be decongested, both for her and her colleagues safety and her patients. She is willing to try out new techniques to make this possible.

Scenario (TO EDIT)

In the pharmacy where Samantha works the robot delivery service is used for some time now. At the beginning of her day, Samantha checks the deliveries for today in her app and fills the coloured drawers with the right medication. The information in the database tells her exactly which medication goes in which compartment, such that each customer get the right medicaiton. The best route is also already calculated by an algorithm, so Samantha and her colleagues have nothing to worry about. When all the compartments for the first delivery are filled, she sends robot on its way, so she has plenty of time for other clients in the pharmacy.

Yesterday, David and Maria received a notification on their phone with a reminder that the robot would visit them today with their medicines. An hour ago, they received another message that the robot is on its way and is expected to be there at a certain time. When the robot arrives at David and Maria's house, they get another notification in their app. They like that they have one simple app in which they can find everything they need. A week ago, they used it to place a new order (of which they were reminded by the app) and they could even change their prefered time slot up to 24 hours in advance. Now that the robot is here, they open the door and the robot says “Hello, good morning! I have your delivery for today. Please enter your unique code”. They open the app and press the button for the code. They enter the code, but it turns out to be wrong. A cross appears on the screen and the robot tells them “Sorry, I’m afraid that is not the correct code, please try again”. They enter it again, and this time it is correct. One time, when they filled in the wrong one three times in a row What happens then? Need to decide on that. The correct door automatically opens and they get the drawer out. They retrieve their medication and put the drawer back in the robot. The robot wishes them a good day and leaves.

Tom is going to Betty after he received a message in his app that the robot is on its way. With the track and trace feature, he is sure that he is there on time

• When robot arrives, he gets message and follows all the steps (OTP, password/birth date, retrieve medication)
• He helps Betty take her medication for today
• In his app, he checks if the next delivery is already planned and if all the data is correct
• He changes the time window
• Robot goes back to pharmacy after delivered everything

High Level Specification

Lock system

As explained in the section on security requirements, a two-factor authentication will be used to securely lock the medication lockers of the robot. To find out what kind of authentication this would exactly be, research into existing technologies is done, as well as two rounds of interviews with potential users.

In the interviews with potential users, multiple options for the authentication were mentioned. One idea that a lot of people came up with was a simple password or (4-digit) code. This can be either a personal, static password or another password per delivery (in literature described as OTP). The advantages of one password for each user is that is is always the same and thus easy an not too confusing. On the other hand, it is easy to forget (although a bit less with a 4 digit code) and it is easy to crack and used by other people. An OTP is a lot more secure than a static password and entering it is still easy. It is already used in a lot of existing services and can be used by anyone who has email, a mailbox or a phone (so basically everyone). Drawbacks of an OTP is that an email can sometimes be hard to find, can end up in the spam folder, or can be deleted by accident. Physical mail can get lost or opened by the wrong person. Also, if a person gets a lot of deliveries, all the different messages with different passwords might get confusing.

One suggestion from a participant was to let the delivery robot ask a personal security question. The user could answer this question, which would open the compartment. This seems very easy and intuitive, but turned out not to be preferred by some other interviewees. In addition, speech recognition might be more difficult to implement than other options and it would be a challenge to decide who sets the questions or to check if it’s secure enough.

According to a lot of participants, the use of a keycard for opening something is the easiest method of all. It is possible that someone loses it, but that happens less often than forgetting a password. The action is really simple and understandable for everyone. It is, however, more difficult and perhaps expensive to give every user their own keycard. If only regular clients can use this system, it would not be optimal, but implementing different systems within one robot would also quickly get costly.

Another way of opening secured compartments, currently already used in some delivery robots, is through an app on your smartphone. People had varying responses to this suggestion. Some thought it would be a really good option. Every person always has his phone nearby and even elderly use them quite often and know how to (up to a certain level). Other participants did not really like this idea, because they thought some (older) people really struggle with smartphones and would not be able to use the service optimally. Also, you would have a problem if the battery of your phone just died when the delivery is ready. One great benefit of using an app is that it has a lot more functionality than other options. In addition to having a function to open the compartment, it can contain a possibility to place new orders, to follow your current order, or to gain more information about your medication.

Based on the suggestions in literature in combination with the findings of the user interviews, the decision is made to use a two-factor authentication. Some medication is quite expensive, so it should be transported secure enough. In addition, dangerous situations can occur if certain medication gets delivered to the wrong person. This led to the conclusion that a one-factor authentication is not enough for this type of delivery. The most practical and feasible option (which still satisfies the user's desires) is the combination of a ownership factor (an OTP) and a knowledge factor (a username and password).

User application

After some consideration, 4 different systems were worked out and discussed with potential users. The following were suggested:

• The user receives the password through a simple security token with the size of a keychain. It has one button which has to be pressed to receive the OTP. The same device would ring as a notification that the robot arrived at the house. The user would have to call the pharmacy or visit the website to plan new deliveries.
• The user has a complex security token, which serves as a device to receive the password, notify the user when the robot arrived, see all past and future deliveries and place new orders. It also has a track-and-trace feature.
• The user needs to install an app on their smartphone, that has all the same functionalities as the complex security token, but on their phone instead of a separate device.
• The user receives all the necessary information through SMS. The OTP and the estimated time of arrival are sent to the user. The user has to call the pharmacy or use the website for ordering and asking questions.

The options were explained in more detail than only the password retrieval, because then the interviewees would have a better overview of the entire system. They all explained their preference and rated the options. There were some differences, but overall, the smartphone app was prefered by most. A lot of elderly in the Netherlands have a smartphone nowadays and designing an app is a good way to make use of this fact.

System overview

Overview of MediGO delivery system

Overview of MediGO delivery system communication with a sequence diagram

Low Level Specifications

Lock system

The lock system that is chosen makes use of a two-factor authentication, based on 'something you own' and 'something you know'. These will be a one time password (OPT) and a combination of username and password. The OTP (a 6-digit code to open the correct medication locker) will be communicated to the user through the app that they have to install on their smartphone. The username and password will be used to log in on this app. A letter that contains these details is sent by the pharmacy and they can be changed in the app if wanted.

Is this (the app) secure enough? Or should the user enter a password everytime he/she opens the app? Or even also every time he/she presses the "get code" button?

User application

To interact with the system, the user has to download an application on their smartphone. Depending on how independent and cognitively well the user is, the user him- or herself can download this app, or a caregiver can be responsible for all interaction with the system. The app can be used to place new orders, to change the date of existing orders, to check the expected time of arrival of the current delivery, to get an overview of all medications, and maybe most importantly, to receive a code to open the correct compartment of the robot.

Literature (section not needed, reference if necessary)

Some background theory on "how to design apps for elderly"

https://ieeexplore.ieee.org/abstract/document/8340033

https://link.springer.com/chapter/10.1007/978-3-319-59427-9_17

https://link.springer.com/chapter/10.1007/978-3-319-20892-3_49

Testing of draft design

Based on what was found in the literature, a first draft of the user interface of the app was designed. This draft was printed on paper and tested with a 67 year old woman (who has also been interviewed in previous steps). Although she did not indicate the app as her prefered tool for this project (compared to the other three options we discussed with all interviewees), she really liked how it looked and thought it was quite easy and inuitive. After seeing the design, she said that we might have changed her mind and prefers this app wver the other options after all. She usually does not like challenging, new technologies, but she noticed that this app is really easy to understand and use. She liked the option to get a tutorial after the first login and all functions, buttons and actions make sense to her. However, in the second screen (choosing between user and caregiver), the icons that we used now are somewhat confusing, since one is male and the other is female. But this was just a minor comment. Another aspect we might need to change (again, just a small detail) is the home screen on days that there is no delivery. She liked the fact that there is a message that tells her that there is no delivery and thus no code today. She can imagine that she would mistake the date and might expect a delivery on a day that there is actually none planned, so in that case it is nice to see that and to be able to check the delivery calendar again. However, the second grey button might be unnecessary or even make it confusing. "Why have buttons that I am not allowed to press anyways? A single explanation is enough, the second only causes confusion." Another thing she had some comments about was the fact that she only had to log in once (and could not even log out in the current interface). Especially when the overview of all medications used can be found in this app, she expected at least some kind of password login every time you would open the app. All apps with this kind of sensitive or important information have it (banking app, health insurance app, digiD, etc), so she would really want and expect it for this one as well. It might even be the case, that there is one extra check moment every time the user presses the "get code" button, comparable to the extra code when transferring money in a banking app. Besides this, she did not really have a lot of complaints. She thinks that the help function could look like a quick tutorial of every screen in the app with a small explanation of all the buttons. And for the medication overview, she thinks it could maybe look a bit like a checklist that a lot of patients already receive from the pharmacy now (she will probably send an example picture as soon as she can get hold of one). This would contain a list of all the medicines a user takes, with per pill an explanation of the function and an overview of when to take them (and how many at every exact moment). She knows this checklist is often used in combination with a baxterroll.

Robot (TO EDIT)

Appearance

As explained, the choice is made to develop a driving robot with six wheels (three on both sides). It is 1.20m high, 1.20m long and 0.60m wide. The robot is white, with a red cross on top, because this is clearly associated with healthcare, which makes the robot recognizable. The medication will be transported by this robot is multiple differently colored (and numbered) drawers.

Its only function is to deliver products, so the user should not anthropomorphise the robot too much. This is why the robot won't have real eyes, a real face or other human features. From interviews, however, we know that users like the robot to look somewhat friendly / human-like, which is why the robots headlights will look a little bit like eyes (just like the ones of almost every car) and it will have a mouth-like shape beneath these "eyes" as well.

The robot will communicate with the user through a small lcd (for the code that locks the compartments). As this is maybe the most important feature of the robot, it is very clearly noticable by using colors/lights. Also, the robot will be able to pronounce some simple, pre programmed sentences. When it speaks, the light in its "eyes" and "mouth" will flicker. It will have a robotic voice that will not sound too human-like. If it sounds too much like a human, people (elderly) might get the wrong impression that it has feelings or can communicate with them. It will not be able to have a conversation with the user, but will only talk to them to give them certain instructions.

Size compartments (width x height x depth): 20x22x27cm, 20x10x27cm, 10x11x27cm

Functionality

The user can enter the code that he/she received in the app on the keyboard on top of the robot. The keyboard consists of the numbers 0 to 10, a red "backspace" (if the user wants to remove the last digit) and a green "enter" to submit the code. The system gives feedback by showing the numbers that the user types on an lcd. If the code is not correct, the screen shows the word "incorrect" and the robot tells the user this as well. What happens after 3 times wrong code? When the code is correct, the word "correct" is shown and the robot says this as well. The locker will light up and open (so that the user does not have to touch the door) and the user can get the drawer out of the robot.

I think this is partly appearance, but I did not really know where to draw the line because it is really integrated with each other. Also, we don't really have a section about the robot itself now, only the "compartment system", or should we just put that under "total system overview"

Type and size robot

Explanation why driving robot (not a drone or a walking humanoid)

For the size of the robot, different things have been taken into consideration. An experiment took place in which the attitude towards robot with different heights was measured . They used robots that all had the same width and length and were respectively 0.6m, 1.2m and 1.8m tall. The robots were box shaped (so findings could be different for humanoids, but that is irrelevant for our delivery robot) and approached subjects from 3m at a maximum speed of 0.4 m/s. The participants also filled in some questionnaires. The study and the questionnaires showed that the subjects felt most anxious with the 1.8m robot, but some also were somewhat anxious with the 0.6m robot. 1.2m turns out to be the best height for a box-shaped, driving robot.

The robot should also not be too wide, since it has to fit through doors. The standard width of a door in Europe is 63, 68, 73, 78, 83, 88, or 93 cm so the robot should be at most 60cm wide.

It also has to be able to move easily and make smooth turns, so the length is ? Reseach on length here It is big and heavy enough, such that people will not be able to vandalize it or take it with them.

Size and amount medication lockers

The drawers in the robot should be big enough to be able to transport almost all kinds of medication to the user. A pharmacist said that it is difficult to decide what size the compartments should be, because it really differs per person. Some people only need a small box, but some need an entire bag full. One kind of medication take-out machines, used by a lot of pharmacies, has containers with sizes 130x100x175mm, 150x100x275mm and 250x140x275mm . Multiple pharmacies that use this machine tells their customers that they can't use the machine if the products would not fit in a shoebox .

Our delivery robot has drawers on both the front and the back. Since the total width is 60 cm, the drawers can be a maximum of 27cm long (to leave some space to enclose them).

We still need to decide if all compartments will have the same size, or variable (and depending on this, certain meds cannot be delivered with this system if they are too big). The research on capacity etc will go here

In the lockers, the medication will be delivered just how the user is used to. If the user only has a few and usually gets them at the pharmacy in seperate boxes, the locker will contain these boxes. If the user is already uses to (or prefers) a baxterroll, because he/she has a lot of different pills to take at specific moments, the locker will contain this baxterroll.

Planning and time schedule optimization

The vehicle routing problem is studied a lot by different researchers. Usually, it is represented by weighted simple graph. The nodes are customers and the arcs the shortest paths computed according to a single criterion (like traveling cost, distance or traveling time). An alternative approach exists, which is multigraph representation . This approach takes multiple attributes into account and can thus also plan the optimal route with operational constraints. A popular example of this is the Vehicle Routing Problem with Time Windows (VRPTW). Here, customer requests to deliver within a specific time window are satisfied and still the optimal route is found. This is, for example, really important with perishable products. Some research is also done into path planning with Heterogeneous Multirobot Teams already.

For our delivery robots, the multigraph representation seems to be a good approach. Users need to be able to indicate a prefered time window (just like with DHL/PostNL and other delivery services now), but it is not feasible to guarantee that delivery is at the exact same time every time. Of course the window can be indicated long before the actual delivery, so if it is a regular customer, this window can be the same every time.

Communication, memory and tracking (TO EDIT OR DELETE)

Research into communication robot-app

When looking into wireless communication Bluetooth seems the safest way to easily set the passwords for the compartments, where creating a network gives a lot more safety issues.

Non-wireless options for communication between robot and the app when setting the passwords is the safest way, because it is the fastest and least hackable.

Since using an app would be nice and probably easier to use for the pharmacist the most logical option would then be to use Bluetooth.

Research into memory of the robot

To hold simple password information and combine that to a compartment not much memory is needed and it will most likely not be an issue. For example, for extra memory in your Arduino a microSD card in combination with a breakout board or shield can be used, giving you much more storage. Depending on the chosen authentication methods the needed memory can be determined and the correct storage units can be bought. For building a prototype very little memory is needed, since we will not build many compartments or a full database yet.

Research into planning (navigation / time schedule for deliveries)

It is absolutely possible to create a tracking device without too much difficulty. However, when making a tracking device you should think carefully about who is able to see the information. For the pharmacist and the customers it would be good to see where the robot is, however, do you want the rest of the world to be able to see where the robot is without too much difficulty as well? One of the easiest options to make by yourself is an Arduino with a GPS module and send the information via a GSM module. There are multiple projects which showed that it is possible to send the information to a mobile phone. The difficulty then lies in the programming of the app, to read and show the sent information.

Overall, it seems that there are a lot of possible options for both the password system and the tracking of the robot. Only a risk assessment of the few biggest options would give a solid answer on what to use. For the communication between robot and app at the pharmacy it seems to make sense to use Bluetooth, for a tracking device more research needs to be done on the safety.

Implementation

Robot

The hardware part of the robot consists of multiple parts. This being the microcontroller, a keypad, an LCD screen, the bluetooth to connect to the app and an opening system for the compartments. In this project, multiple communicative devices are used. This means that using multiple serial ports are needed. Normally serial pins 0 and 1 are used for communication with the computer, the rest are used for communication with different devices. In the pieces of code presented below just 'serial' will be used. However, do notice that when really building the robot multiple serials would be used. So for example serial1 would be used for the Bluetooth module and serial2 for the GSM module.

Prototype

In this section all the parts that will be in the prototype are described. AS SOON AS I AM ACTUAL BUILDING I WILL ADD A SECTION THAT LINKS TO THE CODE AND ADD CERTAIN TEST RESULTS AND PICTURES.

Microcontroller

The microcontroller that has the best specs to work with the other components of the robot is the Arduino Mega 2560. This board has 54 digital i/o pins and 16 analog inputs. The second best options was an Arduino Nano, this board is the board with the most pins after the Mega. However, it would still be tight to assemble all the components. This board does not have built in wifi or bluetooth so we will need to use a separate component to make communication possible. Because the robot will need multiple communicative components attached a microcontroller with multiple serials are needed, which also directly points to the Arduino Mega over most other Arduino's.

Keypad

The keypad is used for clients to enter their birthdate and password. The keypad we decided to use is https://www.adafruit.com/product/3845. This because it is not hard to work with and has very clear buttons. We will use the 10 numbers for the password, the left lower corner to go back and the lower right corner to confirm. For the prototype the keypad is used as it is, however, in the design we would want to put different symbols on the lower corners, to make very clear what they are there for. The best library for this keypad is the following.
Keypad Library for Arduino
Authors: Mark Stanley, Alexander Brevig
Contact: mstanley@technologist.com
Contact: alexanderbrevig@gmail.com

The following code can then be used to 'create' the keypad in the code, after which we can use the other functions in the library to read the keypad.

const byte rows = 4; //four rows
const byte cols = 3; //three columns
char keys[rows][cols] = {

 {'1','2','3'},
 {'4','5','6'},
 {'7','8','9'},
 {'#','0','*'}

};
byte rowPins[rows] = {5, 4, 3, 2}; //connect to the row pinouts of the keypad
byte colPins[cols] = {8, 7, 6}; //connect to the column pinouts of the keypad
Keypad keypad = Keypad( makeKeymap(keys), rowPins, colPins, rows, cols );

LCD screen

The keypad does not give feedback to the user. However, since we think it is really important the the user, especially since we are working with elderly. To do this we decided to use an LCD screen. For the prototype that will be the following component https://www.tinytronics.nl/shop/nl/display/lcd/lcd-display-16*2-karakters-met-witte-tekst-en-blauwe-backlight. Deze LCD is te besturen met behulp van de LiquidCrystal library. We are using a differnt Arduino, however, the following figure shows the schematics to connect the LCD.

Bluetooth connection

To make the robot available for the webapp the decision was to use Bluetooth, one component that is usable for this is the hc05, this component can work as either a slave or a master. In our project it weel need to function as a slave. The computer needs to connect to it, and then it is possible to send data to the module. The Arduino needs to register the incoming data. The following picture represents how the hc05 should be attached to the Arduino in the most simple way.

An example project can be found here: https://howtomechatronics.com/tutorials/arduino/arduino-and-hc-05-bluetooth-module-tutorial/.

Theoretical

There are certain parts for which the time is missing to implement. This is a description of how those parts should be implemented.

GPS & Alerts

The way to track the robot and have it to send an alert when it arrives can be done using a GPS and a GSM module. A GPS module works by intercepting the signals transmitted by satelites, it calculated the distance using the time it takes to send a receive messages. With information from multiple satellites it location can be computed. An example is the NEO-6M module, that one uses an antenna to be even more precise. When it has the location the GSM module can be used to send messages to a mobile phone. Connected to an uno it would look like this, the LCD and potmeter can be left out.

The robot would send a text when being close to the coordinates of its goal. To send texts it would use a GSM shield. To use the GSM one would also need to have a SIM card inserted. It can be set up using the following example: https://www.arduino.cc/en/Guide/ArduinoGSMShield, in which the GSM library is used as well.

Approach

To achieve the objectives of the project five main parts of the development process have been defined: research, requirements analysis, specification analysis, implementation and testing. To better tackle each phase regular group meetings every week have been set. During these meetings the tasks for the current development processes phase are assigned to each team member.

Group organization

Each week a different group member occupies the position of chairperson. The responsibility of the chairperson is to establish an agenda before the meeting and mediate the discussion through the topics that are set in the agenda. Furthermore the chairperson must take the minutes of every meeting during that week and act as a representative of the group during the tutor meeting. The chairperson role rotates through the members in the team.

Chairperson Rotation

Week 1	Week 2	Week 3	Week 4	Week 5	Week 6
Mijntje	Dajt	Danielle	Fabiènne	Lucia	Mijntje

Development process

Development Process

The first phase of the development processes of the project is the research. During the latter the literature is consulted to establish the state of the art. Moreover the problem statement is specified and the different stakeholders are analysed. A comprehensive plan is set to fix the deadlines of the other phases.

The second phase is the requirements analysis. This is a fundamental step of the development processes as the requirements will define the functionality of the project. A cost-benefit and risk assessment analysis will cover the requirements for every part of the project. The ethical evaluation will focus on the requirements for the application and the compartment system prototype, while the survey will focus on the requirements for the navigation simulation.

The third phase of the development processes is the specification analysis. During this phase the requirements are formalized using UML diagrams. The design of the user interface of the app is defined and the hypothetical maps that the delivery robots must navigate are designed in NetLogo.

The fourth phase is the implementation. The application code is written in Swift, creating an app compatible with devices supporting iOS, the hardware for the compartment system is assembled and the NetLogo program for the delivery simulation is written.

During the fifth and final phase of the development process the system is tested and a demo is finally created.

Planning

From the approach a plan for the development process was created. The plan is illustrated in the following figure using a Gantt table.

Gantt table of the planning

Task Division

During each development process phase the different task composing it are subdivided between the group members.

Research			Requirements			Specification			Implementation			Testing
Task	Group member		Task	Group member		Task	Group member		Task	Group member		Task	Group member
Determining subject	All		Risk Assessment	...		App Users	...		App User	...		Test system	...
Set up Wiki	Fabiènne		Cost-Benefit Analysis	...		App enterprise	...		App enterprise	...		Make demo video	...
Approach	Dajt, Danielle		Ethical perspective	...		Robot compartment system	...		Robot compartment system	...		Update Wiki	...
Planning	Fabiènne, Dajt		Make survey	...		Navigation	...		Navigation system	...
Literature search	All		Analyse data survey	...		Update Wiki	...		Update Wiki	...
Introduction	Mijntje, Fabiènne, Dajt		Update Wiki	...
State of the Art	Lucia, Mijntje
Stakeholder analysis	Danielle
Update Wiki	Fabiènne, Danielle, Dajt

Milestones

By the end of week 2 the problem statement, introduction, stakeholder analysis and state of the art must be completed. This will conclude the research phase.

By the end of week 3 the survey on people’s attitudes towards our proposal and delivery robots in general, the risk assessment, and different analysis must be completed. This will conclude the requirements phase.

By the end of week 4 the analysis/conclusions of the survey and a semi-formal model of the system must be completed. This will conclude the specification phase.

By the end of week 6 the first implementation of the apps, lock system and navigation system must be completed. This will conclude the implementation phase.

By the end of week 7 the adjusted version of the apps (after testing/interviewing) and a demo video must be completed. This will conclude the testing phase.

Deliverables

The final product will be a system to distribute/deliver medicine to those in need (elderly in most cases), including:

• An application with the choice to log in as a user to order medicine and open the compartments of the delivery robot or as the pharmacist/hospital/doctor/distributor to set the passwords for the compartments and the targets the delivery robot must visit.

• A hardware system to secure and open the compartments, which can communicate with the application.

• A database storing the users data, which can communicate with the application.

Logbook

Week 1

Name	Total hours	Tasks
Danielle	3.5	Introduction lecture [1.5], meeting [0.5], literature research (source 5-11) [1.5]
Lucia	3	Introduction lecture [1.5], meeting [0.5], literature research (source 22-26) [1]
Mijntje	3	Introduction lecture [1.5], meeting [0.5], literature research (source 18-21) [1]
Dajt	3.5	Introduction lecture [1.5], meeting [0.5], literature research (source 14-18) [1.5]
Fabiènne	4	Introduction lecture [1.5], meeting [0.5], literature research (source 1-4, 11-13) [1.5], wiki page [0.5]

Week 2

Name	Total hours	Tasks
Danielle	7.5	Meeting [2], images (Approach/Stakeholder) [1.5], stakeholder analysis [2], update wiki [0.5], tutor meeting [0.5], interview questions [0.5], informed consent editing [0.5]
Lucia	8	Meeting [2], state of the art [5], hardware research [0.5], tutor meeting [0.5]
Mijntje	9.5	Meeting [2], state of the art [7], tutor meeting [0.5]
Dajt	9	Agenda [0.5], meeting [2], approach [2], planning (tables) [2.5], problem statement [0.5], update wiki [1], tutor meeting [0.5]
Fabiènne	8	Meeting [2], literature research (source 27-30) [0.5], planning [0.5], references [1.5], update wiki [2], tutor meeting [0.5], contacting people to interview [0.5], interview questions [0.5], informed consent forms [0]

Week 3

Name	Total hours	Tasks
Danielle	9.5	Contacting pharmacists [1.5], conducting interviews [3.5], transcribing interviews [1.5], update wiki [0.5], meeting [1], tutor meeting [0.5], summarize needs interviews [1]
Lucia	5	Meeting [1], tutor meeting [0.5], conducting interview [1], transcribing interview [0.5], summarize findings [0.5], contacting pharmacists-to-be [0.5], research compartments [1]
Mijntje	1.5	Meeting [1], tutor meeting [0.5], due to illness no other work done
Dajt	9.5	Meeting [1], tutor meeting [0.5], contacting elderly and caretakers [1.5], conducting interviews [5], transcribing interviews [1.5]
Fabiènne	12.5	Preparation interviews [0.5], conducting interviews [2], transcribing interviews [3], update wiki page [2], meeting [1], tutor meeting [0.5], summarize needs interviews [1], research lock system [1.5], research cognitive classification [1]

Week 4

Name	Total hours	Tasks
Danielle	9.5	Tutor meeting [0.5], meeting [1.5], ethical analysis [4], appearance [2], personas [0.5], research [1]
Lucia	10	Tutor meeting [0.5], meeting [1.5], requirements design and hardware engineering [6], research tracking [2]
Mijntje	10.5	Tutor meeting [0.5], meeting [1.5], classification responsibility [3], appearance [1.5], research GP - pharmacist system [2.5], reading others material [1.5]
Dajt	11	Tutor meeting [0.5], meeting [1.5], security research [2], requirements engineering [5], needs [1], update wiki [1]
Fabiènne	10.5	Tutor meeting [0.5], agenda [1], meeting [1.5], personas [0.5], update wiki page [2], lock system [2.5], route planning/optimizations [1.5], scenario [1]

Week 5

Name	Total hours	Tasks
Danielle	12.7	Tutor meeting [0.7], meeting [1], overview decisions [1.5], research into password system [1], research database [3.5], creating database [3], Programming User App [2]
Lucia	9.2	Tutor meeting [0.7], meeting [1], consulting users [1], research lock system [6], meeting with Mijntje about lock system [0.5]
Mijntje	11.7	Tutor meeting [0.7], meeting [1], overview decisions [1], consulting users [1.5], prototypes lock system [1], prototypes complete robot [4], Research Database responsibility [2], meeting with Lucia about lock-system [0.5]
Dajt	12.3	Tutor meeting [0.7], meeting [1], overview decisions [1.5], consulting users [1.5], security [2], user case diagrams [1.5], Programming Pharmacist App [4]
Fabiènne	11	Tutor meeting [0.7], meeting [1], overview opinions [1.3], consulting users [2], research dimensions [2], read other materials [1.5], update wiki [1], user app UI [1.5]

Week 6

Name	Total hours	Tasks
Danielle	2.5	Meeting [2], tutor meeting [0.5]
Lucia	13.7	Meeting [0.7], tutor meeting [0.5], meeting with Ruud vd Bogaert [0.5], hardware [12]
Mijntje	4.5	Meeting [2], tutor meeting [0.5], meeting Fabiènne user app UI [0.5], meeting Fabiènne lay-out wiki [0.5], meeting Fabiènne prototype design [1]
Dajt	2.5	Meeting [2], tutor meeting [0.5]
Fabiènne	15	Meeting [2], tutor meeting [0.5], capacity+size+flats research[1.5], meeting Mijntje user app UI [0.5], user app UI [2], test user app (+ prep) [1.5], meeting Mijntje lay-out wiki [0.5], rewrite and update wiki [3.5], meeting Mijntje prototype design [1], designing prototype [2]

Week 7

Name	Total hours	Tasks
Danielle	...	...
Lucia	...	...
Mijntje	...	...
Dajt	...	...
Fabiènne	...	...

Week 8

Name	Total hours	Tasks
Danielle	...	...
Lucia	...	...
Mijntje	...	...
Dajt	...	...
Fabiènne	...	...

Week 9

Name	Total hours	Tasks
Danielle	...	...
Lucia	...	...
Mijntje	...	...
Dajt	...	...
Fabiènne	...	...