1 Purpose

In recent decades, the field of mobile service robotics has started to emerge as a promising technology for augmenting processes within the hospital to deal with pressing problems such as shortage of qualified personnel, containment of highly contagious diseases, multimorbidity due to overaging, and simply economic challenges. The recent SARS-CoV-2 pandemic and the resulting overload of numerous healthcare systems around the world, provide additional incentive for advancing this technology.

As defined in the ISO 8373 standard (International Organization for Standardization, 2021), an autonomous service robot “performs useful tasks for humans or equipment” and possesses the “ability to perform intended tasks based on current state and sensing, without human intervention”. Among these, mobile self-navigating robotic systems are especially promising for hospital applications, since many use cases require the ability to traverse the environment. In the following, such systems will be referred to as mobile service robots for the hospital (MSRH).

Various approaches and application scenarios for MSRH have been proposed in the last decades. As of yet, the majority of MSRH available on the market and presented in academic work can be categorized as logistical robots, that execute transportation tasks between different points-of-interest within the hospital (Automation, 2022; Bacik et al., 2017; Evans, 1994; Takahashi et al., 2012). According to a case study by Ozkil et al., hospitals can greatly benefit from the application of such systems as a means for automating workflows that are still heavily reliant on manual transportation (Ozkil et al., 2009). Another major application scenario for mobile robotic systems is clinical patient care (Nejat et al., 2009), for which a variety of concepts for the hospital has been presented in scientific literature, including, among others, robots for observing patient conditions (Huang et al., 2022; Sato et al., 2003), guidance of patients (Hasan et al., 2010), cleaning of patient rooms (Baalbaki et al., 2008), patient lifting and transfer (Mukai et al., 2010), and measurement of vital parameters (Broadbent et al., 2015). Further applications of MSRH include autonomous robots for rehabilitation exercises (Gross et al., 2017a), disinfection (Cepolina & Muscolo, 2014) and social assistance (Nejat & Ficocelli, 2008). A completely new field of MSRH application are assistance tasks for the OR wing, as currently investigated by the research project Autonomous Self-Navigating Robotic OR Assistance (AURORA). This project, in which the authors are involved, aims at designing and implementing a robotic circulating nurse, which is envisioned as a self-navigating robotic assistance system for executing tasks within the non-sterile part of surgical operating rooms. A 3D rendering of our current prototype is shown in Fig. 1. The robot consists of a mobile omnidirectional platform and a 7-dof manipulator arm equipped with a specialized end effector. Central use cases are the fetching and handing over of sterile supplies as well as the adjustment of medical devices.

Fig. 1
figure 1

3D rendering of the AURORA robot within an exemplary OR environment

Full size image

Due to their mobility and flexibility, MSRH possess important prerequisites for integrating well with the dynamic and human-driven nature of clinical workflows. However, the introduction of mobile robots into the hospital necessarily leads to overlap in human and robotic spheres of action and influence, both regarding the physical environment (or workspace) and the processes (or workflows) taking place within it. The implications of this are manifold and result in considerable ethical and technological challenges. While numerous MSRH concepts and products have been presented in both academia and industry, the corresponding risks and requirements imposed by the hospital environment have not yet been analyzed, described, and implemented in a structured way. Yet, clinical environments and workflows are associated with quite unique needs, restrictions and objectives, when compared to other domains (e.g. intra-logistics or industrial manufacturing). This includes aspects such as hygiene, workflow complexity, time constraints, confined spaces, interaction with impaired persons, and ethical considerations.

There are various methods and concepts available today for managing the risk of technical systems. General-purpose directives such as ISO 12100 (International Organization for Standardization 2010), ISO 13489-1 (International Organization for Standardization 2015), IEC 62061 (International Electrotechnical Commission, 2013), IEC 61508 (International Electrotechnical Commission, 2010) and Directive 2006/42/EC (European Parliament and Council of the European Union 2006) cover fundamental aspects of safety that technical systems must adhere to. In ISO 12100, risk is defined as a combination of the probability of an adverse event and the severity of the consequences, which offers a formalized notion of the term “risk”. Further domain-specific standards exist, that address safety-related aspects relevant to certain technologies. In the context of mobile robotics, ISO 3691-4 covers the safety requirements and verification of automated guided vehicles (International Organization for Standardization, 2020). In the context of service robotics, ISO 13482 addresses safety requirements for personal care robots (International Organization for Standardization 2014). In the context of medical devices, the European Medical Device Regulation (MDR) (European Parliament and Council of the Eurpoean Union 2017) defines risk classes based on the invasiveness of a given device, with according implications for the certification process. As design tools for the development of technical systems, various risk-related methods exist, such as the Failure Mode and Effects Analysis (FMEA) (Spreafico et al., 2017), the Fault Tree Analysis (FTA) (International Electrotechnical Commission, 2006) or the Hazard and Operability Study (HAZOP) (Kletz, 1997).

While many of the existing standards summarized in the previous are applicable and relevant to MSRH, they only cover general aspects and fail to address characteristics of the hospital, such as hygiene and workflow dynamics. While the MDR already defines different classes for categorizing the invasiveness of medical devices, it is only focused on the interaction between device and patient. Other risk-related aspects, which are introduced by the mobility, autonomy and interaction capabilities of MSRH are not addressed. Design tools, such as FMEA, FTA and HAZOP, focus on the development of a given technical system and do not describe characteristics of hospital environments and workflows. While they are usefully applicable for the development of MSRH, they are closely tied to the design of a specific robot and the risks introduced by it.

To the best of the authors’ knowledge, no work has been published yet providing a framework for describing and managing MSRH-related risk. We believe that this is one reason why, as of yet, clinical translation has only been accomplished for a small subset of proposed MSRH concepts, mostly revolving around logistical off-stage applications, such as (Aethon, 2022; EK Automation, 2022). In the following paper, we will address this knowledge gap by providing a comprehensive risk classification concept, considering multiple risk categories concerning the physical environment, interactions with humans and objects, as well as workflow-related aspects. As a key finding, we show that MSRH-related risk has many dimensions, with individual degrees of risk that may drastically differ among each other depending on the application scenario of a given robot and may not necessarily correlate with the overall criticality of the target environment. This novel risk framework will complement and refine existing methods. It will be useful to various stakeholders and applications, which includes estimating the complexity and effort of planned robotic developments and identifying all risk-related requirements. During later stages, our risk framework is useful for identifying test cases and for ensuring a holistic evaluation. Furthermore, the framework can serve as a foundation for the categorization and classification of MSRH robots in the context of certification, similar to the existing, yet insufficient MDR classes. Lastly, the presented concept is highly relevant for the design of new hospitals since risk may not only be reduced by proper robotic design but also by adapting the environment.

2 Materials and methods

The concepts presented in the following were developed in an interdisciplinary approach with a close involvement of healthcare professionals at a German university hospital. To gain a comprehensive understanding of the status quo, the existing environments and workflows were observed in detail and the unique challenges and constraints were identified. This was partly done in the course of the aforementioned research project AURORA, where detailed requirements for the use of mobile service robots within the operating room wing were gathered during interdisciplinary working sessions involving roboticists and doctors. By involving persons from both domains, misconceptions regarding either of those domains were aimed to be avoided, ensuring the validity of the resulting requirements. While these first sessions were mainly focused on the OR wing scenario, they have provided a foundation for the subsequent extension of the scope to the entire hospital. Based on the feedback of further doctors and nurses from the university hospital, our risk classification concept was iteratively refined, thereby ensuring its completeness and validity with respect to the clinicians’ real-world experience and expertise. While the rather small group size of 5 doctors and 2 nurses is a limitation of our work, the discussions were focused on very fundamental and high-level aspects of clinical work (consider hygiene requirements, for instance). Thus, it is argued that valid information can be gained even from a small expert team and that these truths do not change across hospitals.

For developing our classification framework, we chose a top-down approach starting at the most elementary aspects of any workspace: the nature of the physical environment, as well as the interactions and workflows taking place within it. Clearly, the hospital is comprised of several different environments with quite distinct purposes (ward, OR, storage, laboratories etc.), which results in individual physical characteristics, interactions, and workflows. Therefore, the requirements regarding mobile robots may change significantly with respect to the desired application scenario. It is important to stress that MSRH-related risk is not necessarily correlated with the overall (perceived) risk-level associated with the target environment: A post-operative cleaning robot for the OR wing might be less critical than a robot for repositioning patients in the clinical ward, even though the OR wing is generally associated with higher safety demands. Therefore, we argue that a risk analysis based solely on the target environment is not sensible and needs to be complemented by a consideration of the actual interactions and workflows carried out (or influenced) by the robot within this environment. We chose to reflect this conclusion in our concepts by introducing independent risk categories, which address distinct types of risk. Each risk category can be viewed as a scale ranging from low risk to high risk, where each risk level may impose different requirements on the design of MSRH robots. Consequently, for a given MSRH application scenario, risk levels might be different for each category. By this means, we aim to achieve a holistic and differentiated analysis.

For better structuring and applicability, we organized all categories and associated risk levels into a risk classification matrix. Some categories and levels were based on other concepts, standardizations, and non-normative guidelines (or are related to such), which will be indicated accordingly throughout the following sections. Following an in-depth explanation of our risk classification framework, we describe exemplary application scenarios for MSRH and demonstrate how our concepts can be applied to facilitate a structured and goal-oriented design of mobile clinical robots.

For considerations regarding safety distances (see Sect. 3.2.), a simulation environment was implemented using the 3D engine Unity (Unity Technologies, San Francisco, USA).

3 Risk framework

In the following, we present our risk classification concept consisting of six risk categories, which are each further divided into risk levels. Following an overview of the concept, the categories are described in detail by characterizing each of the associated levels and deriving general implications for MSRH design and clinical integration.

3.1 Risk classification concept

An overview of our proposed risk classification scheme is given in Table 1. The six categories presented in the matrix address independent dimensions of risk, derived from the fundamental aspects regarding physical environment, interaction and workflow.

Table 1 Categories and levels of the proposed risk classification concept for the integration of mobile robotic systems into the hospital. Lowest roman number denotes highest level of risk and vice versa
Full size table

The first two categories address implications by the physical nature of hospital environments. These environments are quite diverse, ranging from OR wings over clinical wards to laboratories and storage facilities. Consequently, quite different requirements might be imposed on MSRH operating within them. We propose to classify risks introduced by the characteristics of the environment itself using two dimensions: The physical complexity of the environment (risk category 1) and its hygienic demands (risk category 2).

Risk categories 3 and 4 are concerned with risks originating from interactions of MSRH with human beings or with objects that are part of the physical environment. While those interactions are central for accomplishing assistive tasks, they can be highly challenging from a robotics perspective, especially in cases where physical contact with humans is required or when sensitive yet important objects need to be handled. Regarding interactions, we structure our risk classification concept into the two main categories interactions with persons (risk category 3) and interactions with objects (risk category 4).

Lastly, risk categories 5 and 6 address risks introduced by the nature of workflows that are taking place within clinical environments. These workflows can be quite complex, which is necessary for providing finely adjustable, patient-specific treatments. At the same time, stakes can be extremely high, since the patient’s life or quality of life may be directly affected by the decision making. Clearly, adapting and integrating MSRH into such complicated processes is a considerable challenge and related to sensitive subjects such as safety and ethics. We propose to structure workflow-related sources of risks into the two categories workflow flexibility (risk category 5) and workflow autonomy (risk category 6).

3.2 Risk category 1: complexity of the physical environment

Clearly, the physical nature of the target environment is essential for designing any mobile robot. It determines the required sensor capabilities for perceiving relevant aspects of the environment and the required actuators for traversing the environment and interacting with it. According to our risk classification concept, we rate the complexity of hospital environments in five levels, which are summarized in Table 2 and explained in the following sections.

Table 2 Levels of risk category I (complexity of the physical environment)
Full size table

The physical complexity of an environment may depend on various factors and is not straight-forward to quantify or measure. For the sake of defining distinct risk levels, we consider the following aspects: available space, presence of persons, presence of moving objects, movement paths, obstacle characteristics, and presence of prohibited zones. However, we do not discriminate between different groups of persons that have access to a given environment (e.g. staff vs. patients), since we believe that the presence of a human being should be associated with the same safety standards across all application scenarios.

Risk level I is associated with extremely complex environments containing persons and objects (e.g., other robots, patient beds, carts etc.), which are moving along arbitrary paths. Static and dynamic obstacles within the environment may have complex and slim shapes (e.g. cables, tubes, infusion stands). Space – and thus freedom of movement – is extremely limited, inevitably requiring maneuvers with a very short safety distance (> 100 mmFootnote 1) in some situations. In order to demonstrate that such a short safety distance is necessary for some hospital environments, we have set up a 3D scene using Unity, which models an OR as well as adjacent storage rooms, based on a real-life OR at a German university hospital. Figure 2a shows the area (brown), which can be traversed by a circular mobile robot (diameter: 0.6 m), while maintaining a safety distance of > 100 mm. In this context, it was assumed that no cables and tubes are present within the traversable area. Figure 2a shows the same setup for a safety distance of > 500 mm, where it can clearly be observed that the robot is no longer able to freely traverse the environment and circumnavigate the sterile surgical area. This demonstrates, alas on a proof-of-concept basis, that the thresholds defined by Table 2, which were based on DIN EN ISO 3691-4, are meaningful in the clinical context. Further such investigations will be made in future work.

Fig. 2
figure 2

a A typical surgical setup is shown within our simulation software. The brown shape marks the traversable area required by a circular mobile robot with a diameter of 0.6 m and a safety distance of 100 mm. The edges of the shape mark the thresholds that may not be crossed by the centroid of the robot’s footprint in order to maintain this distance. As can be observed, it is possible for the robot to approach the sterile surgical area from all sides. b The same setup is shown for a safety distance of 500 mm, where the robot is no longer able to navigate the environment

Full size image

In level I environments, the robot is required to stay clear of sterile zones (e.g. within operating rooms or laboratories), which the robot must reliably avoid for safety- and hygiene-related reasons (except when the robot itself is sterile). This task is an additional challenge for robotic navigation since sterile zones need to be reliably differentiated from the surrounding “normal” environment. This is especially complicated in cases where the boundaries of a sterile zone are not precisely defined and only implied by sterile coverings and the position of sterilely dressed persons. At the same time, a violation of these boundaries can have adverse consequences for the patient’s health (e.g. due to post-operative complications caused by wound infections (Kommission für Krankenhaushygiene & Infektionsprävention, 2018)) or at least delay the workflow considerably since the sterility of the affected area must be restored. Clearly, level I environments are extremely demanding on robotic capabilities. To be able to deal with all the different types of static and arbitrarily moving obstacles, the robot must be equipped with high-resolution sensors paired with ample onboard processing power. Depending on the robot’s dimensions, the ability to move in arbitrary directions, i.e. omnidirectionally, might be required for navigating narrow spaces.

Environments categorized as level II are characterized by identical conditions to level I, except for sterile zones. Thus, conventional methods for collision detection and avoidance are sufficient. A typical example for such an environment within the hospital is the patient ward.

Risk level III is associated with environments that are more spacious and thus allow for wider safety distances (> 500 mm). However, persons may still be present within a level III environment, and their safety must be guaranteed with the same level of confidence. Due to the increase in available space, it is worth considering whether navigation and safety concepts originating from the industrial context are applicable. This may include guidance by lines or markers, the introduction of robot-only zones, the installation of fences and signposts, and other methods (DIN Deutsches Institut für Normung e. V 2020; Verein Deutscher Ingenieure, 2009; VDI 2510). Also, due to the increased freedom of movement, non-holonomic drive concepts become more and more applicable.

Level IV represents highly structured environments that are specially designed for the operation of robots (e.g., clinical storage facilities). Paths of moving objects or other robotic systems are either static or constantly communicated to the MSRH robot. Humans are only present in exceptional cases and only on prior notice or after shutdown of robotic operation. Consequently, there are no relevant differences to common industrial or logistical environments, which are covered by normative documents such as DIN EN ISO 3691-4 (DIN Deutsches Institut für Normung e. V 2020).

Level V represents the low end of the risk spectrum and is associated with completely enveloped MSRH operating within dedicated delimited spaces. Within this space, there are no persons or independently moving objects present. Due to the separation from its surrounding environment, the design and operation of the system can be controlled in its entirety and contained components cannot physically interact with persons or external objects. Consequently, there are no special requirements imposed by the surrounding clinical environment and common industrial standards can be applied.

3.3 Risk category 2: hygiene standards

Though the adherence to hygienic standards is indispensable throughout the hospital, specific needs may vary greatly among different clinical environments. Again, we propose five levels for classifying risk related to hygiene.

Level I represents the upper end of the spectrum and therefore is associated with highest demands regarding hygiene. This includes environments and processes requiring sterility of some or all parts of the robot. This might be necessary due to invasive or non-invasive contact with patients, e.g. during robot-assisted surgical interventions, or due to physical contact with sterile clinical personnel or objects. The implications for robotic design depend on the sterility concept of the system, which is created based on factors such as ease-of-use, costs and reliability. Relevant parts of the robot may either be designed as single-use products or such that they are suited for sterilization (e.g. autoclaving, chemical sterilization), or for sterile covering. Design parameters such as material and geometry may be greatly affected by this, which is why sterility considerations are essential during MSRH development.

Level II denotes contagious environments, where extraordinary measures must be taken to avoid transmission of pathogens, either for the protection of the patient (immunodeficiency) or the personnel (infectious patient). This may include the disinfection of the robot, which imposes design requirements depending on the disinfection method used: For wipe disinfection, gaps and undercuts in the robot’s surface should be avoided. Joints and orifices must be sealed such that disinfection agent cannot intrude and compromise proper functioning. Touchless disinfection methods – such as ultraviolet light, hydrogen peroxide vapor, steam or ozone (Rock et al., 2018) – might even allow for fully automated disinfection processes using disinfection chambers. However, the robot’s materials and sealings must withstand the entire procedure repeatedly. As an alternative to disinfection, sterile covers may be used and frequently changed. In this case, the robot must be designed and operate in such a way that the covers are not damaged by the robot’s own movements or by protruding objects in the environment. Ideally, the robot keeps track of its own contamination state in order to warn approaching persons and requests disinfection or a change of sterile covers, e.g. before moving on to the next patient. Generally, trips between rooms of highly infectious patients and rooms of non-infectious patients, or trips between rooms of patients affected by different pathogens, should be avoided as much as possible. This can be realized by implementing appropriate fleet management strategies, such as assigning a designated robot to each room or bundling the supervision of rooms containing patients affected by the same pathogen.

Hygiene level III is associated with environments or processes that routinely require wipe disinfection as a precautionary hygienic measure (i.e. not directly related to the acute containment of known highly-infectious pathogens). For example, such requirements are commonly associated with clinical ward environments. As remarked in the previous, the robot must be designed to facilitate and withstand the wipe disinfection process.

Level IV denotes environments that require routine cleaning using regular non-germicidal agents, e.g., hospital offices and non-patient related accommodations. Again, the robotic design must allow for thorough cleaning while withstanding the procedure.

Level V represents the low end of the spectrum and indicates no special requirements regarding hygiene. Similar conditions might be found in non-clinical public infrastructure or industrial manufacturing environments (e.g., train stations, assembly lines).

3.4 Risk category 3: interaction with persons

Depending on the application scenario, MSRH robots may need to interact with different groups of human beings within the hospital, including clinicians, patients and visitors. Furthermore, different types of interactions may take place, most notably physical contact and social interaction. Depending on the interaction type and target group, special requirements regarding the robot’s social capabilities, precision and hygiene are imposed. According to our risk classification concept, we define five risk levels related to interactions between MSRH and persons.

Level I is associated with robot-initiated invasive interactions, which, for diagnostic or therapeutic purposes, either violate the bodily integrity of patients or involve the access of natural orifices.Footnote 2 Clearly, designing MSRH robots capable of level I type interactions poses highest challenges regarding patient safety. This includes strict requirements regarding sterility, which have been addressed in the previous section. Furthermore, extraordinary capabilities regarding robustness and precision of the robot’s manipulations are required, such that the patient is not harmed beyond the amount of trauma necessary for conducting the medical procedure. From a robotic design standpoint, this mainly affects required sensor modalities, sensor resolution, algorithms and actuator precision. The robot must be capable of precisely planning trajectories and moving along them, while avoiding deviations and the injuring of risk structures. Clearly, the safe execution of such autonomous robotic manipulations is extraordinarily challenging and, for the most part, far beyond the current state-of-the-art. In situations where the patient is fully conscious during an invasive procedure performed by a robot, we also argue that social features are required for informing the patient about subsequent robotic actions, asking for permission and calming the patient. Imagine an MSRH for blood sampling: If the robot moves closely towards the patient without a proper explanation of its behavior, the patient may feel confused or even threatened. Sensors for monitoring the patient’s emotions and vital parameters during critical steps might be necessary as well (e.g. for prevention of fainting).

Risk level II addresses non-invasive robot-initiated physical interactions with persons (usually patients). Clearly, some requirements of level I apply here as well, especially regarding precise trajectory planning and patient monitoring capabilities. However, margins for inaccuracies might be slightly higher and hygienic requirements are more relaxed since strict sterility is no longer required.

Risk level III denotes interactions required for communication between MSRH and untrained persons (usually patients, visitors, or other externals). This may include touchless interaction (e.g. via voice control) or user-initiated physical interaction (e.g. via touch-interfaces or buttons). For that, the following essential aspects should be considered: Firstly, the robotic system and the interaction with it might be completely unfamiliar to the user. Therefore, the interaction needs to be self-explanatory, which is facilitated by the use of natural language or simple graphical user interfaces. Secondly, the user might be physically impaired (limited dexterity, hearing problems, weakness etc.) or in a sensitive emotional/mental state, which must be taken into account when designing the interfaces. As a fallback, the robot should have the ability to call a human staff member for help at any time., if the user is having troubles interacting with the robotic system. For some use cases, it might be beneficial to trigger this call automatically, which requires a recognition of the current emotional state of the user. Regarding the incorporation of social capabilities into MSRH robots, we argue that such features can cut both ways. On the one hand, they facilitate that robots are not perceived as alien objects, but rather as members of the clinical team that contribute to the healing process and act in the patients’ best interest. Features for simple everyday interactions, such as greetings or small talk can go a long way for improving patient experience. On the other hand, the face-to-face interaction with doctors, nurses and other members of the clinical staff is central to the patient well-being and has been shown to have a positive impact on the healing process in some scenarios (Arora, 2003; Jackson, 2005; Stewart, 1995). It is important to the patient to have the feeling to be perceived and to be in good hands. Therefore, we argue that certain pivotal parts of the treatment process should always be handled by humans, since they require social skills like empathy and tact. Examples for this are tasks such as welcoming the patient, communication of diagnoses or preoperative preparation talks.

Level IV denotes interactions with trained and authorized clinical personnel. In this case, persons interacting with the robot know what to expect from the system, e.g. regarding its behavior in certain situations, how to operate it and how to communicate with it.Though still being beneficial, requirements regarding an intuitive and self-explanatory use can be reduced in this case since the appropriate interactions are learned during training. This allows for shifting the focus more towards efficiency to achieve smooth workflow integration. Again, the appropriate incorporation of social robotic capabilities is challenging: As shown by Mutlu et al. for the hospital context, it very much depends on the particular use case and clinical department whether such functionalities are perceived as a hindrance or contribute to acceptance and thus a more seamless integration of the system (Mutlu & Forlizzi, 2008). It must be stressed that level IV is only applicable when the robot must not interact with any untrained persons. This may not be the case for application scenarios where the robot is designed for exclusively assisting trained professionals, but other persons are present within the environment (e.g., in a ward environment). Here, the robot may be required to interact with these persons in some situations, even though this is not related to its primary use cases.

Level V is associated with application scenarios where the robot does not interact with human beings at all, as for example in some logistical scenarios. Therefore, the only interactions allowed here are those with inanimate parts of the environment (even though human beings might be present within the immediate surroundings).

3.5 Risk category 4: interaction with objects

Within their target environment, MSRH may not only need to interact with persons but also with objects of the surrounding. In this context, risk level I is associated with objects that are directly related to acute patient treatment and are important means for therapy. Lack, damaging or misuse of these objects leads to an immediate threat to the patient’s health or life. This poses highest requirements regarding the robot’s reliability when handling such objects. Firstly, the robot needs robust capabilities for recognizing an object of interest (and relevant parts of it), which is mainly a sensor-related problem. Secondly, the robot needs to have a clear understanding of how to use the object, which is a problem related to information storage and modelling. Thirdly, the robot must be able to physically interact with object in a proper way, which is a control- and actuator-related problem. If the robot does not reliably master all these skills – e.g. if the object cannot be found, or if it is confused with another one, or if it is improperly used – the workflow might be delayed and, at worst, there might be adverse consequences for the patient.

Risk level II is associated with objects relevant for patient care. Patient experience and satisfaction might suffer considerably, in case of lack, damaging or misuse of these objects. However, in order to be categorized as level II, there may not be any immediate consequences for the patient’s health. Care-related objects that do have an impact on this, shall be categorized into level I.

Risk level III denotes objects that are not directly patient-related, but relevant for the smooth operation of the hospital. Thus, they might have an indirect influence on patient experience, e.g. by causing delays in the workflow. Again, in cases where the patient’s health is impacted by this, the object shall be categorized as level I.

Level IV denotes interaction with peripheral objects that are not directly linked to patient health or experience (e.g., doors or light switches within non-patient environments, such as storage facilities, laboratories or offices). While lack, damaging or misuse of such objects must be avoided, there are no consequences beyond inconvenience and costs of repair.

Level V is associated with application scenarios where the MSRH is not interacting with any objects. Therefore, according capabilities are not required. However, the reliable avoidance of physical contact, i.e. collision avoidance, is necessary nonetheless.

3.6 Risk category 5: workflow flexibility

Although clinical workflows are planned in advance as much as possible, they are inherently subject to change. This is due to the occurrence of unexpected or unplannable events, such as the collapse of a patient, the necessity of emergency surgery or the outbreak of a viral infection among staff members. When integrating mobile robotic systems into clinical workflows, ways need to be found to deal with such uncertainty. However, depending on the application scenario, different degrees of flexibility may be required. Again, we propose five levels as part of our risk classification concept.

Level I denotes scenarios with highly dynamic workflows, where goals may change within a very short amount of time, i.e. minutes or even seconds. If the MSRH is not able to adapt properly and timely, adverse consequences for the patient’s health or life might arise. Such requirements are especially relevant for the robot’s mission planning, which can happen in a stand-alone fashion (i.e. decoupled from other robots and their individual goals) or when orchestrating an entire fleet of MSRH robots. In case of stand-alone mission planning, a change of goals mainly pertains to coordinating the safe abortion of the current task and an immediate planning and execution of the new, more urgent task. However, it may not always be straightforward to abort a task safely, e.g. imagine that an MSRH is transporting an object from storage to OR 1, while it is urgently requested by OR 2 to assist during a critical situation. The MSRH therefore needs to return the object or find a place to safely store it in the immediate surrounding, before being able to move on to OR 2. Additional complexity is introduced in case that the MSRH has to adapt its current configuration in order to be equipped for the new task, e.g. if a different end effector is necessary. To fulfill level I requirements, the MSRH must be able to execute such a reconfiguration in a rapid fashion. Reacting to sudden changes is also highly challenging for fleet management systems. Since new high-priority tasks may enter the system at arbitrary times, the MSRH fleet’s schedule must be adapted to the new situation immediately. Consequently, an updated schedule must be available within a very short amount of time, which is algorithmically demanding due to the NP-hardness of the underlying mathematical problems. There are several choices for addressing this problem: Firstly, if the problem instance can be kept small (i.e. small numbers of tasks and robots etc.), an optimal solution of the problem is attainable in reasonable time, as demonstrated by Kumar et al. (2018). Secondly, the computing power can be increased, which allows for faster optimal solving of more complex optimization problems. However, this approach would be costly and still has limits regarding problem complexity. Thirdly, approximation can be used to yield close-to-optimal (i.e., sub-optimal) solutions within reasonable time. This has been successfully demonstrated by Balbaaki et al. (2010) and is arguably the most practical approach as of yet, since complex problem instances can be tackled in short amounts of time. It is also import to remark that highly dynamic workflows have a stronger tendency to create situations where robotic systems are perceived as hindrances, as described by Mutlu and Forlizzi, (2008). This emphasizes the importance of a fast, reliable and context-appropriate behavior of the MSRH to avoid a decline in staff acceptance.

Risk level II is associated with scenarios where a change of goals may occur on a regular basis, however, there is significantly more time (i.e. hours) available for adapting to the new situation. This leaves more room for finishing or aborting the current task, as well as for reconfiguring the robot. Regarding fleet management, there is more time for updating the schedule, which allows for larger problem instances, less computing power or algorithms that are more computationally complex.

Level III denotes static workflows that are planned on a short-term basis, e.g. for the upcoming day or shift. This allows for a more precise preplanning and preparation with regard to fleet size, fleet composition and robot configurations. Also, there is more time for assembling the schedule, which may allow for using optimal solution algorithms even for larger problem instances.

Level IV denotes static workflows with long-term planning cycles, i.e. for several days, weeks or even months, which further benefits the use of optimal scheduling algorithms and allows for precise planning and preparation of the fleet composition and robot configuration.

Level V is associated with static workflows that are repeated periodically without major changes. In this case, the same schedule can be used repeatedly, and fleet size or composition is only compromised in case of malfunction. To prepare for such failures, redundancy can be included into the fleet, such that continuous smooth operation is guaranteed.

3.7 Risk category 6: workflow autonomy

Depending on the application scenario, different levels of autonomy may need to be granted to MSRH robots. Clearly, this quickly introduces ethical and legal dilemmas that, in similar form, are well-known from other applications of AI, such as self-driving cars. As soon as MSRH robots (or MSRH management systems) start to make autonomous decisions regarding the patient’s wellbeing or even need to prioritize between patients in situations of high demand, the responsibility and liability for adverse consequences is not clearly defined. Sometimes, the consequences of a medical method cannot be fully predicted, or it is up to individual beliefs, whether those consequences are deemed acceptable or not. Moreover, the facts to be considered for such decision-making can be multi-faceted and originate from various sources and perspectives, such as patient will, patient condition, patient history, regulations or family members. Even for healthcare professionals, collecting and analyzing all relevant aspects in order to make an ethical decision can be extremely challenging. As of now, the technological means of deciding such delicate matters in an automated way is extremely limited and difficult to reconcile with regulatory requirements. Therefore, we strongly advocate that this kind of decisions should never be made in an autonomous fashion, but by deliberately involving authorized clinicians and receiving explicit clearance before execution. However, there may be less critical tasks, which are not directly related to patient well-being and where it may be acceptable to yield some autonomy to the robot. Regarding this, ISO 13482 defines that personal assistance robots designed for autonomous decision-making and actions must be designed in a way that erroneous decisions or actions will not lead to unacceptable risk of harm (DIN Deutsches Institut für Normung e. V. 2014).

While we are aware of the fact, that various notions and dimensions of autonomy exist (Beer et al., 2014), we define autonomy as the degree to which an MSRH is independent from human assistance during task execution. With increasing independence from human supervision, overall risk increases as well, since unintended or erroneous robotic behavior might not be corrected, stopped, mitigated, or even observed by human supervisors.

Level I denotes fully-autonomous robots, in the sense that an assigned task is carried out without any assistance by humans, as long as fundamental constraints do not change. As soon as patient-related goals need to be reevaluated (e.g. due to an emergency situation) and ethical challenges arise, human decision-making is mandatory. This risk level demands strictest requirements concerning quality and robustness of task execution as well as regarding safety, which in turn can relate to numerous aspects of robotic operation, such as perception, navigation, and manipulation. Depending on the application scenario, this may influence requirements regarding sensor resolution, manipulation accuracy and real-time processing capabilities.

Level II is associated with systems that generally operate autonomously (in the sense of level I) but require an explicit clearance by an authorized clinician for some critical parts of the task execution. After clearance has been obtained, execution is continued autonomously, and clinicians are not required to supervise the process. Due to the introduction of this explicit clearance mechanism, the robot is not responsible for deciding whether current circumstances allow for initiating critical parts of the task. Determining this can be highly complex and may depend on various external parameters such as patient status (vital parameters, position, anesthetic condition) or the finalization of previous workflow steps (precedence relation).

Level III is associated with systems that partly operate autonomously, while requiring continuous supervision or input by an authorized clinician for extended parts of the task execution. This allows for a controlled execution of safety–critical or highly complex actions, where execution can be stopped or corrected at any time by the human operator. For example, a system might be able to navigate autonomously to the place of action, however, is then guided by a clinician while executing tasks in close proximity to the patient.

Level IV denotes MSRH that are tele-operated and thus are depending on constant input by humans. As soon as this input ceases, the robot stops. However, minor modification of the input signal might be made, such as motion scaling or tremor reduction.

As a natural extension of this scale, we propose an additional level V, which denotes the execution of the task by a human, not a robot. While this is not relevant for the requirements analysis of single robotic systems, it may be sensible from a fleet management perspective to not execute a given task robotically but by a qualified person in some situations. Reasons for this may be that robotic resources are currently overburdened or that the task is inherently better suited for human execution, even though robotic execution is possible.

4 Case studies

In the following, we demonstrate and discuss our concepts with regard to four exemplary use cases of MSRH. Case study 1 considers a robotic circulating nurse for the non-sterile part of the surgical OR (Table 3). Case study 2 considers a mobile robot for guiding patients and visitors within the clinical ward or other public spaces within the hospital (Table 4). Case study 3 considers a teleoperated robot for the examination of isolated patients (Table 5). Lastly, case study 4 considers a robot for the automation of hospital laboratories (Table 6).

Table 3 Result of risk classification for case study 1 (robotic circulating nurse for the OR wing)
Full size table
Table 4 Result of risk classification for case study 2 (robotic guide for the clinical ward)
Full size table
Table 5 Result of risk classification for use case 3 (teleoperated robot for the examination of isolated patients)
Full size table
Table 6 Result of risk classification for use case 4 (mobile robot for laboratory)
Full size table

4.1 Case study 1: robotic circulator for the OR wing

As currently explored in the course of the AURORA project, which the authors are involved in, the intraoperative execution of non-sterile assistance tasks is a promising application of MSRH technology. We envision the robot to be capable of core tasks of circulating nurses, including the handing over of sterilely packaged material to the surgical team and the adjustment of medical device parameters (electrocauterizer, insufflator, laparoscopic camera module, suction/irrigation device etc.).

The operating room, where the AURORA robot is meant to be utilized, is a highly dynamic environment with high safety standards and very limited space, due to the presence of surgical devices, instrument tables, patient table, anesthesia workstation and the surgical team. Oftentimes, cables and tubes run through the air or on the ground and effectively block passageways. The layout of the objects within the room may change at any time, e.g. due to a reconfiguration of the OR table, the unplanned usage of a medical device or the movement of persons. To make matters even more complex, some areas, such as the sterile area around the OR table must be completely avoided by unsterile robots. For these reasons, risk level I is clearly indicated regarding the environmental complexity which the AURORA robot must deal with (risk category 1). We aim at tackling these challenges by using an omnidirectional drive concept, which minimizes the space required for maneuvering, and with a sophisticated navigation system based on different sensor modalities (LIDAR, depth cameras, RGB cameras) combined with additional external cues (markers, codes).

Since the AURORA robot is limited to the non-sterile part of the operating room, it is not required to be sterile or partly sterile. The handing over of materials to sterilely dressed members of the surgical team follows a clearly defined routine, based on the methods used by human circulating nurses to ensure a hygienic exchange of sterile materials. Thus, regular wipe disinfection suffices, which indicates that level III is applicable regarding risk category 2 (hygiene standards). To facilitate wipe disinfection, the AURORA robot is designed to have smooth surfaces with few gaps and indentations.

During task execution, the AURORA robot is exclusively interacting with trained surgical personnel. Since there is no contact to patients or external persons, a rather low risk level IV is indicated regarding risk category 3 (interaction with persons). This is in contrast to the interaction with objects where most of the handled objects are highly relevant for the treatment of the patient. Also, risk of confusion can be high, e.g. when dealing with surgical suturing material, which comes in many shapes and forms. Consequently, a classification as risk level I is indicated for category 4 (interaction with objects). We aim at addressing these challenges by introducing a specialized shelving and using the imprinted bar codes for reliable identification.

OR workflows can be highly dynamic since many surgical procedures require a different approach for every patient. Also, the entire setup might need to be transformed rapidly in case of an adverse advent that requires conversion from minimally-invasive to open surgery. This clearly indicates a classification as risk level I for category 5 (workflow flexibility). Furthermore, the AURORA robot is envisioned to be autonomous to a certain extent, in the sense that minimal supervision is required for the execution of tasks assigned by humans. However, for the most critical phases of task execution, e.g. in close proximity to the sterile area of the OR, we are implementing an explicit clearance routine that can be carried out by authorized members of the surgical team. Therefore, risk level II is applicable for category 6 (workflow autonomy).

4.2 Case study 2: robotic guide for the clinical ward

As proposed by Hasan et al. (2010) and Cremer et al. (2016), a further promising application for MSRH technology is the realization of a robotic guide for helping patients or visitors navigate through the hospital. Such a robotic system is intended to operate within the ward environment and other public spaces within the building (hallways, waiting rooms, stores etc.).

Compared to the OR environment, patient wards tend to be more spacious, which is beneficial for robotic navigation and collision avoidance. Typical ward facilities are designed for frequent passage of patient beds and wheelchairs that have similar or even larger geometrical footprints than most MSRH presented in industry and academia. However, ward environments can be rather crowded with in-patients, clinicians and visitors, and there are objects of different sizes moving (or being moved) on arbitrary paths, such as patient beds, carts, medical devices etc. It is argued that MSRH must be able to operate with safety distances below 500 mm to integrate well into such an environment without being unreasonably slow or a hindrance to others. Therefore, a classification as level II regarding risk category 1 (environmental complexity) is indicated. To address these challenges, robotic systems need to have robust human recognition capabilities and collision avoidance mechanisms. Examples for the successful implementation of such features for different MSRH application scenarios can be found in contributions by Takahashi et al. (2009) and Gross et al. (2017b)).

From a hygienic standpoint, the ward and public spaces within the hospital are subject to less strict requirements than the OR environment. There are no sterile areas that must be avoided, and, for the sake of this example, we assume that the robotic guide is not exposed to patients that are known to be highly infectious. Therefore, regular wipe disinfection is sufficient as a preventive hygienic measure and level III is indicated regarding risk category 2 (hygiene standards). Again, the robot must be designed in a way that allows for conducting the required disinfection procedures.

Interactions between humans and robotic guide mainly revolve around social interactions (greetings, small talk) and receiving the intent of the user. This indicates level III regarding risk category 3 (interaction with persons). Human–robot interaction could be achieved by means of haptic controls (e.g., touch-based graphical user interface, buttons), which require a user-initiated physical interaction, or via a voice control interface, which would enable a completely touchless interaction. If we assume that an automatic wireless door opening system has been installed, there are no interactions taking place between robotic guide and objects of the environment, which indicates the lowest level V regarding risk category 4 (interaction with objects).

Assuming that the robot is not intended for guiding patients in emergency situations or other circumstances directly related to patient health, a classification as level V is indicated regarding risk category 5 (workflow flexibility). In this scenario, the robot repeats the same task repeatedly, i.e., guiding a person from point A to point B. This can be seen as a static, periodical behavior without any changes beyond the locations of points A and B. Incoming requests are executed one after the other and thus the scheduler must not be able to flexibly cancel, preempt or reschedule tasks. No difficult decisions must be made regarding the priority of a given task with reference to other current requests. However, if we extend the use case to include emergency guidance (e.g., from the hospital entrance to the correct emergency admission), a categorization as workflow flexibility level I is indicated, since the workflow can become significantly more dynamic, with a need for prioritization of missions instead of a first-come-first-serve approach. Even though we clearly advocate that such a prioritization should only be done by an authorized clinician, the robot needs to be able to react flexibly and robustly to goal changes. This might include the cancellation of another currently executed mission with lower priority (e.g., a non-emergency mission) and a rapid change of location to the new mission’s starting point. For realizing this, the robot needs to be networked, e.g., by wirelessly connecting it to a fleet management system, which receives prioritizations and dispatches robots accordingly.

Regarding workflow autonomy, the robotic guide needs to be capable of executing guidance tasks without any human supervision to be suitable for its intended purpose. While an assertion routine should be implemented to confirm the intent of the user, the remaining parts of the task execution (i.e., a guidance mission) need to happen completely autonomous. Thus, a classification as level I is indicated regarding risk category 6 (workflow autonomy).

4.3 Case study 3: teleoperated robot for the examination of isolated patients

As described by Fragapane et al. (2020), a further use case for MSRH is the remote examination and care of patients that have been isolated due to hazardous infections. Using a teleoperated mobile robot, the interaction with such patients can be remote-controlled from within a safe distance. Application examples include the performance of examination tasks, such as the measurement of vital signs, or care tasks, such as the delivery of medicine and food.

While the robot is navigating within an isolated part of the patient ward (as opposed to case study 2), level II is still indicated with regard to risk category 1 (environmental complexity) due to the presence of one or multiple patients. However, since the environment is potentially contagious, level II is now indicated regarding category 2 (hygiene standards). Assuming that the robot is only used to perform non-invasive examination tasks, such as the measurement of blood pressure or oxygen concentration, level II is indicated regarding risk category 3 (interaction with persons). This would change to level I in case invasive measures are performed, such as blood sampling. Since the robot may interact with therapy-related objects, such as medicine or devices for measuring vital signs, the highest level I is indicated regarding risk category 4 (interaction with objects). Since the robot is teleoperated, it must not be able to react to sudden goal changes since this responsibility is shifted to the human teleoperator. Thus, level V is indicated regarding risk category 5 (workflow flexibility). Accordingly, level II is indicated regarding risk category 6 (workflow autonomy) since, again, the robot is fully teleoperated.

4.4 Case study 4: mobile robot for laboratory automation

A further promising use case for MSRH is the automation of hospital laboratories, such as microbiology or histology labs (Fragapane et al., 2020). Here, typical tasks of the robot include the handling of samples as well as the loading and operation of laboratory devices. MSRH-based solutions for very similar lab automation problems have been presented in the context of biotechnology plants (Knoll et al., 2004).

For the sake of this example, it is assumed that the robot is acting within a closed-off hospital laboratory environment alongside other MSRH, but without the presence of human beings. This indicates level IV regarding risk category 1 (complexity of environment). In case that neither persons nor mobile robots are present, the environment of the robot is fully enveloped, indicating level V. Some types of hospital laboratories, such as the microbiology lab, require cleanroom hygiene for appropriately handling the probes. Since this may not be compromised by the robotic system, the highest level I is indicated regarding risk category 2 (hygiene standards). Since the robot does not need to interact with persons, level V is indicated regarding risk category 3 (interaction with persons). On the contrary, the robot handles samples, the evaluation of which impacts therapeutic measures of patients, which indicates level I regarding risk category 4 (interaction with objects). Since the robot follows repetitive routines, the lowest level V is indicated regarding risk category 5 (workflow flexibility). This changes to level I in case emergency-related samples must be spontaneously evaluated with priority over other tasks. Regarding risk category 6 (workflow autonomy), the highest level I is indicated, since the entire process is fully automated and unsupervised.

4.5 Further remarks

As can be seen from the case studies above, the appropriate risk levels for a given use case can vary greatly among different categories. For example, while the risk imposed by interactions with humans is comparably low for case study 1 (robotic OR circulator), the highest risk level is indicated regarding workflow flexibility. Similarly, the amount of risk introduced by interactions with objects is very low for case study 2 (robotic guide), while the high amount of self-sufficiency introduces a high risk level regarding workflow autonomy.

This affirms our proposition that risk of MSRH operation and resulting requirements should not be generalized by tying them directly to the clinical target environment and its perceived overall level of criticality. Instead, our concepts provide a more differentiated and holistic view on risks introduced by different implications of a given use case, covering environmental aspects as well as aspects related to workflows and interactions.

Our presented approach enables a structured analysis of MSRH-related risk and can serve as a direct starting point for a more detailed application-specific analysis based on the risk levels that have been identified for a given use case. The development of strategies for dealing with these risks will result in more detailed requirements, for which technical solutions need to be implemented. It is important to remark that these solutions do not need to be installed completely in-robot, but that the clinical environments, interactions, and workflows can and should be altered to a certain degree, to be better suited for MSRH integration. In the context of surgery and biomedical engineering we refer to this way of thinking as surgineering (Feussner et al., 2019), the core idea of which can also be applied outside the OR wing. However, determining the degree to which modifications are reasonable and possible, remains to be addressed by future work.

5 Conclusion

While the concept of MSRH is a promising technology for boosting hospital efficiency and alleviating pressing problems like shortage of staff, rising patient numbers, and economic challenges, the actual real-world application of mobile robotics has been quite limited so far. Beyond being technologically involved, we believe that this is also due to a lack of investigating and addressing unique needs of clinical environments. As discussed in the previous, these needs can have a considerable impact on robotic design, while varying significantly across different parts of the hospital with respect to environmental complexity, interactions, and workflows. Therefore, a holistic analysis of such requirements is necessary to produce robotic systems that are suitable for actual real-life application. To provide a framework for structured and targeted analysis of MSRH-related risk, we presented a classification concept consisting of six categories, each defining multiple risk levels, ranging from low to high risk. After explaining the motivation behind each category as well as describing the subdivision into distinct levels, we introduced four MSRH use cases to demonstrate the application of our concepts. Based on that, we concluded that our approach facilitates a holistic and differentiated consideration of risks introduced by the application of MSRH robots. In future work, we aim at expanding our work by focusing on reasonable modifications to hospital environments in order to facilitate MSRH integration.