Thepurposeofahospitalinformationsystem(HIS)istomanagetheinformationthathealth

Transcription

1 FederatedDatabaseSystemsforReplicatingInformationin UniversityofDortmund,DepartmentofComputerScience,Informatik10 ExtendingtheSchemaArchitectureof HospitalInformationSystems D-44221Dortmund,Germany W.Hasselbring 1Introduction informationwhenchangesoccur. subsystemswithinhospitalsarediscussed.thepresentedextendedschemaarchitecturefor federateddatabasesystemsisthebasisforalgorithmsthatrestoretheintegrityofreplicated Someproblemsandsolutionsforpropagationofinformationupdatesacrossheterogeneous Abstract professionalsneedtoperformtheirjobseectivelyandeciently[spfw90].integratedsystemswhichsatisfyallrequirementsoninformationprocessinginhospitalsarenotavailable; evenifsomevendorspromisethis.also,fromaneconomicalperspective,itisdesirableto installanumberofapplications,whicheectivelysupportthespecicneedsoftheindividual organizationalunitsofahospital.typicalexamplesaresystemsforpatientregistration,admission,dischargeandtransfer,appointmentscheduling,managementoflaboratorytestsaswellas decisionsupportformedicaltreatment.thissituationnaturallyleadstoacollectionofhetero- andinconsistenciesamonginformationthatisstoredindierentsubsystems.integrationisa geneoussubsystemsscatteredacrossthehospital.toeectivelysupporttheworkinhospitals, decisivefactorforthesuccessfuloperationofacomputer-basedhis[esp92].theintegration ofdatafromvarioussourcesinthehospitalproducesarichdatabasesupportinghealthprofes- itisnecessarytointegratethesesubsystemsavoidingmultipleentryofthesameinformation sionalswiththeirwork.amodularsystemofinteroperableandcooperatingsubsystems,which alltheinformationthatisrelevantforthehospital,buttointegratetheoverlappingareas.the retaintheirautonomyasfarasreasonable,isrequired. basicpatientdatasuchasnameandbirthdayareintheoverlappingareaofallsystems,but Itisimportanttonotethatitisnotthegoaltoprovideaccessfromallplacesinthehospitalsto individualsubsystemsinhospitalsforalaboratory,aradiologyandanadministrationsubsystem. thatthesizesoftheareasinfigure1arenotproportional;onlythestructuralsegmentationis illustrated. insuranceinformationandtherapyresultsareonlyrelevanttosomesubsystems.note,however, Asasmallportion,Figure1illustratestheoverlappingareasofinformationrelevantfor Thepurposeofahospitalinformationsystem(HIS)istomanagetheinformationthathealth dierenttimes,bydierentvendorsandwithdierenttechnologies.anopenfederationof storedamongdierentandheterogeneousapplications,eveniftheyhavebeendevelopedat autonomousbutinterworkingsystemsshouldprovideoptimizedsupporttothespecicneedsof theuserstoselectthemosteectivesolutionsfortheirneeds. theindividualunitsbyenablingdierentvendorstooerspecializedapplicationsandallowing AmajorneedofHISsis,therefore,theintegrationoftheoverlappingareasofinformation

2 administration radiology forglobalapplicationstoinformationthatisstoredinseveraldissimilarsystems.another concernisintegritymaintenanceacrossautonomoussystems[ct95].inhospitals,replicating informationamongseveralautonomoussubsystemsisacentralissue. However,mostcurrentworkonfederateddatabasesystemsisconcernedwithoeringaccess Figure1:Theoverlappingareasofinformationstoredamongsubsystemsinhospitals. relevant within the formationupdatesacrossheterogeneoussubsystemswithinhospitals.thegeneralstructureof ourpresentedarchitectureisbasedonthereferencearchitectureforfederateddatabasesystems [SL90]andadaptedtothespecicdemandsonintegrationofreplicatedinformation.Thisarchitectureisthebasisforalgorithmsthatrestoretheintegrityofreplicatedinformationwhen Thepurposeofthispaperistostudysomeproblemsandsolutionsofpropagationofin- laboratory andsection5drawssomeconclusions. informationwithinhospitalsispresentedinsection3.section4discussessomerelatedwork tionserversisdiscussedinsection2andoursoftwarearchitectureforintegrationofreplicated changesoccur. 2Currentstateoftheart:connectingsubsystemswithinhospitalsthroughcommunicationservers Thecurrentstateoftheartinconnectingsubsystemswithinhospitalsthroughcommunica- Toconnectheterogeneoussubsystemsinhospitals,communicationserversareoftendeployed [PD95].Figure2displaysanexamplecongurationofaHISwithacentralcommunication apharmacyapplicationareconnectedbytheserver.thecommunicationserverenablesthe server.inthisconguration,alaboratory,aradiology,twowards,anadministration,and subsystemstosendmessagetoeachother.eachsubsystemisconnectedtothecommunication serverandsendsmessagesonlytothisserver.thecommunicationserverdeterminesthereceiver andforwardsthemessage.hospitalcommunicationserversusuallysupportstandardprotocols bemetatthelowlevelofinterconnectivityoratthehigherlevelofinteroperability[pbe95]. suchashl7[ham93]andthetranslationacrossdierentprotocolswhenforwardingmessages. Therequirementforbuildingcomplexsystemsthatcombineheterogeneoussubsystemscan

3 Figure2:ApossiblecongurationfortheintegrationofadistributedHISthroughacommunicationserver. Interconnectivitysimplysupportssystemcommunication,whileinteroperabilityadditionally supportssystemstocooperateinthejointexecutionoftasks.acommunicationserveronly laboratory administration radiology communication supportsinterconnectivity:thesubsystemsthemselves ward 1 server musttaketheinitiativetoupdatereplicasandsendmessagesforthispurpose,and needtoknowwheretosendwhichmessages, pharmacy ward 2 Withanintegrationthatisbasedonacommunicationserver,itisnotknownattheintegration nicationserverdoesnotknowwhetherdataisreplicatedorjustneededtemporarilybyaclient levelatwhichsitesdataactuallyisstored.itisonlyknownthatdataisexchanged.acommu- mustbeawaretoreceivemessagesfromothersystemsandstorethemessagecontents ofschemaintegration,thefederationlayeriscapableofsupportingsubsystemstointeroperate. foransweringauserquery. Withatightlycoupledfederateddatabasesystemwhosedataintegrationisonthebasis appropriatelyintheirlocaldatastores. insubsystemsbythefederationlayeraswillbediscussedinsection3. exchange,theexchangeofinformationcanbeaccomplishedthroughupdatesofreplicateddata 3Afederatedsoftwarearchitectureforintegritymaintenance Insteadofenablingthesubsystemswithacommunicationservertosendmessagesforinformation someextenttoparticipateinthefederation.globalapplicationscanaccessmultiplelocaldbss thatitmanages.inafederateddbs,bothglobalapplicationsandlocalapplicationsaresupported[sl90].thelocalapplicationsremainautonomous,butmustrestricttheirautonomyto Adatabasesystem(DBS)consistsofadatabasemanagementsystemandoneormoredatabases ofreplicatedinformation throughthefederationlayer.thefederationlayercanalsocontrolglobalintegrityconstraints suchasdatavaluedependenciesacrossmultiplecomponentdbss. tothespecicrequirementsofintegratingreplicatedinformationamongheterogeneoushiss. Thefollowingsubsectionspresentanextendedschemaarchitectureandtheassociatedalgorithms thatrestoretheintegrityofreplicatedinformationwhenchangesoccur. Thissectionpresentsourfederatedsoftwarearchitecturewhichhasbeendesignedaccording

4 aresurveyed.thediagraminfigure3displaysthisschemaarchitecturewhichpresents,apart fromthedotsthatindicaterepetition,onepossiblecongurationofafederateddatabasesystem. tosupportthedimensionsofdistribution,heterogeneity,andautonomy.thegenerallyaccepted ForfederatedDBSs,thetraditionalthree-levelschemaarchitecture[Dat95]mustbeextended referencearchitectureforschemasintightlycoupledfederateddbssispresentedin[sl90]and, inthesameform,in[pbe95]whereapproachestoobject-orientationinmultidatabasesystems 3.1Theschemaarchitecture TheedgesbetweentheschemasinFigure3correspondtosoftwareprocessorsasindicatedin therighthandcolumnoffigure3. able,someofwhichare: Anynumberofexternalschemascanbedened,eachwithitsownlteringprocessor. Anynumberoffederatedschemascanbedened,eachwithitsownconstructingprocessor. Asdiscussedin[SL90],severaloptionsintheschemaandprocessingarchitectureareavail- AtightlycoupledfederatedDBSwithmultiplefederationsallowsthetailoringoftheuse ofthefederateddbswithrespecttomultipleclassesoffederationuserswithdierent Note,thataschemaarchitecturewhichconsistsofjustonefederatedschemaandsomelocal Schemasonalllevels,exceptthelocalandfederatedschemas,areoptionalandmaybe AcomponentDBScanparticipateinmorethanonefederationandcontinuetheoperation dataaccessrequirements. combinedintoasingleschemaofanotherlevel. tightlycoupledfederateddbsarchitecturewillbepresentedinasemi-formalwaybymeansof anobject-orientedmodelingtechnique. schemasconcurswiththe5-levelschemaarchitectureof[sl90].theotherlevelscontainno schemasinthiscase. Theseconstraintsarenotdenedformallyin[SL90].Below,anextendedmodelforour oflocalapplications. diagrams[rsc97].inthismodel,someoftheconstraintsandoptionsforthearchitectureare denedbymeansofthecardinalitiesattheassociations.thedistinctclassesofpublicschemas chitectureforfederateddbssusingtheuniedmodelinglanguage(uml)notationforclass supportglobalaccesstothecomponentdbss,onlysecondarilytosupportintegritycontrol. Therefore,weextendthereferenceschemaarchitectureof[SL90]withimport,exportandimport/exportdistinctionforpublicschemastoadequatelysupportthealgorithmsforchanging replicatedinformation.figure4displaysagenericmetamodelforthisextendedschemaar- Itisratherobviousthatthereferenceschemaarchitecturehasbeendesignedprimarilyto replacetheexportschemasinthereferencearchitectureof[sl90]. forthecorrespondingdata.exportschemasspecifydatatobeexportedtoothersystems. Import/exportschemasdenedatatobebothimportedandexported.Theschematypes determinethechangealgorithmsforintegrationofreplicatedinformationaswillbediscussed below. Specifyinganimportschemainourarchitectureisasubscriptiontochangenotications theunlimitednon-negativeintegerrange(zeroormore).thearrowsattachedtotheassociation cardinalitiesforassociationsarespeciedthroughnumericalrangesattheassociationlinks.the namesindicatethedirectionforreadingthenameswhichareannotationstoassociations(called namedirection)[rsc97]. defaultcardinalityis1.ifthecardinalityspecicationcomprisesasinglestar,thenitdenotes eachcomponentschemaistransformedfromexactlyonelocalschema,buteachlocalschema ToexplainthediagraminFigure4:RectanglesaretheUMLsymbolsforclasses.InUML, TheassociationbetweenlocalschemaandcomponentschemainFigure4speciesthat

5 External schema Any Data Model External schema Any Data Model... External schema Any Data Model Filtering Processors Figure3:The5-levelschemaarchitectureaspresentedin[SL90]andannotatedwiththecorrespondingprocessortypes. transformed Federated Schema... Federated Schema Export Schema Component Schema Local Schema Native Data Model Export Schema Export Schema Component Schema Local Schema Native Data Model Constructing Processors Filtering Processors Tansforming Processors filtered and into External schema filtered and integrated into Federated Schema {or} Export Schema Public Schema Figure4:Modelingtheextended5-levelschemaarchitectureasaUMLclassdiagram[RSC97]. {abstract} Import Schema {at least one} Import/Export Schema Component Schema Local Schema transformed into filtered into integrated into transformed and filtered into filtered, transformed and integrated into filtered and transformed into

6 canbetransformedintomultiplecomponentschemaswhenthecorrespondingcomponentdbs toamodelelementsyntacticallyenclosedinbraces.thepredenedor-constraintsindicatesituationsinwhichonlyoneofseveralpotentialassociationsmaybeinstantiatedatonetimefotionswhichmustbemaintained[rsc97].aconstraintrepresentssemanticinformationattached participatesinmorethanonefederation. issimplyaparticularuseoftheconstraintnotation. anysingleobject.thisisshownasadashedlineconnectingtwoormoreassociations,allof whichmusthaveaclassincommon,withtheconstraintforglabelingthedashedline.any instanceoftheclassmayonlyparticipateinatmostoneoftheassociationsatonetime.this AconstraintinUMLisasemanticrelationshipamongmodelelementsthatspeciescondi- usedforlocalapplications. oronelocalschema,etc.externalschemaswhicharedirectlyderivedfromlocalschemasare withalargehollowtriangleattheendofthepathwhereitmeetsthesuper-class[rsc97].in intoexactlyonefederatedschema.eachexternalschemaisderivedfromeitheronefederated Figure4,PublicSchemaisanabstractclass[Mey88].TheconcreteclassesExportSchema, ImportSchema,andImport/ExportSchemainheritallassociationsfromPublicSchema.There InheritanceisshowninUMLasasolid-linepathfromthesub-classtothesuper-class, EachPublicSchemaislteredfromatleastonecomponentorlocalschemaandintegrated willbenoinstances(schemas)oftheabstractclasspublicschemainaninstantiatedschema architecture. mationwhenchangesoccur.forgenerality,weusethetermchangeforinsertion,deletionand aninstanceofthemodelinfigure4.themodelinfigure4isametamodelforschemasand theirassociations. 3.2Changealgorithms Ourschemaarchitectureisthebasisforalgorithmsthatrestoretheintegrityofreplicatedinfor- ThediagraminFigure3(apartfromthedotsthatindicaterepetition)canberegardedas updateofdata.below,achangealgorithmwithonemastercopyfordataitemsandachange algorithmwithmultiplemastercopiesfordataitemsaremotivatedanddiscussed.inthesequel, thespecicationofchangepropagationandthedetectionofchangesarediscussed Changealgorithmwithonemastercopyfordataitems multipleplaces(replica),butchangesmustbehandledthroughthemasterwhoforwardsthe onlyonesystemisthemasterforaparticulardatum.adatummaybeallowedtoresidein however,thatsuchamaster(server)cancooperatewithmultipleclientsthatintendtomodify thedatum.therestrictiontoonemastercopydoesnotimplyarestrictionfordataentryfrom Asdiscussedin[SWG+92],eachdatuminadistributedDBSforelectronicmedicalrecords(and, consequently,inahis)shouldhaveonlyonemastercopyatwhichchangesareallowed.note, changestoallplaceswherecopiesofthisdatumexist. justonelocationwithinahospital. adatumthroughanexportschema.dataaboutthesamerealworldphenomenonisstoredin componentdbss2,3and4.thelatterthreecomponentdbssimportthisdatumthrough someimportschemas.componentdbss2and3sharethesameimportschema.tointegrate Figure5illustratesanexamplescenarioforchangingreplicas.ComponentDBS1exports Asystemthatistheclientinonesituationmaybetheserverinanothersituationprovided thesemanticreplicationofthesamerealworldphenomenon,thefederatedschemarelatesthe correspondingpartsofexportschema1tothecorrespondingpartsofimportschemas2and3. AchangeeventincomponentDBS1onanexporteddataitemtriggerscorrespondingchange linesillustratethedataow. operationsofthereplicaswhichareimportedbytheotherthreecomponentdbss.thedotted

7 federated schema export schema import schema import schema component component component component eachelementrelatesexactlyoneexportelementtooneormoreimportelements.thisconstraint Figure5:Anexamplescenarioforchangingreplicas.ThemodelinFigure4isthemetamodel fortheschemasandtheirassociationsinthisscenario.thedottedlinesillustratethedataow event change change change Thereexiststheneedtointegratepre-existinglegacydatabaseandlesystemsintoHISs.Typically,theselegacyinformationsystemshaveevolvedovermanyyearsandplayacrucialrolein shouldbeenforcedbytheintegrationtools. Thefederatedschemarelateselementsofexportandimportschemastoeachother,inwhich 3.2.2Changealgorithmwithmultiplemastercopiesfordataitems CDBS 1 CDBS 2 CDBS 3 CDBS 4 local local local local virtuallyimpossibletorewrite. thegradualmigrationofthesystemstonewplatformsandarchitectures.asmoothmigration theday-to-dayinformationprocessingofthehospital.theyareoftendiculttomodifyand lockedinsidethesesystemsfromnewersystems,butalsoforprovidingastrategywhichallows fromlegacysystemstomoderninformationsystemscanbeaccomplishedwithfederateddbss [RS95]. onemastercopyforeachdatumexistsatwhichchangesareallowed,becauselegacysystems usuallystorethedataintheirownrepositorieswherethedataitemsmustbeconsideredas Thereis,therefore,aneedtoprovidetechniquesnotonlyforaccessingthedatawhichis mastercopies.toincorporatesuchsituationsinwhichmultiplemastercopiesforspecicdata changedbythefederationlayerdoesnottriggeradditionalchangestobepropagatedbythe itemsareneeded,theimport/exportschemascanbeusedinourarchitecture.animport/export schemaspeciesthatthecorrespondingdataitemsareimportedaswellasexported. Tointegratereplicatedinformationacrosslegacysystems,itcannotbeexpectedthatonly federationlayer.onlychangesbylocalapplicationstriggerchangeeventstobepropagatedby mationisexportedaswellasimportedbymultiplecomponentdbss.however,import/export thefederationlayer. Thedierencetoacombinationofanimportwithanexportschemaisthatdatawhichis Thismechanismavoidsendlessloopsofchangesbythefederationlayerwhenthesameinfor-

8 federation layer kernel local local application active active application Forimport/exportschemaswedonothavetheconstraintthatonlyonedatasourceisallowed. schemasshouldonlybeusedwhenmultiplemastercopiesforspecicdataitemsarerequired. buttheycouldbeconnectedtothefederationlayer. Figure6:Activeagentsinourarchitecture.Globalapplicationsarenotdisplayedinthisgure, component database component database... management system management system activedbsisanextendedconventionaldbswhichhasthecapabilitytomonitorpredened 3.2.3Specicationofchangepropagation situations(situationsofinterest)andtoreactwithdenedactions[wc96].suchre-active behaviorisgenerallyexpressedbytheso-calledevent-condition-actionrules(ecarules)which agentsaslocalapplications. agents.thelocaldatabasemanagementsystemsofthecomponentdbssconsidertheactive troducedasactivedbss[wc96].figure6illustratesthisdivisionoflaborbetweenkerneland Forthespecicationofchangemechanisms,agentsconnectedtothecomponentDBSsarein- [CT95].Theactiverulemechanismcanbeconsideredasacommunicationmechanismbetween denewhattodoifacertainsituationoccursinthedbs.ecarulesareapromisingprinciple notonlyforintegrityenforcementinsingle,centralizeddbss,butalsoforfederateddbss thecomponentdbssandthefederationlayer.therefore,itisratherstraightforwardtouse Thisway,thekernelofthefederationlayerseesthecomponentDBSsasactiveDBSs.An importschemasandimexschemasdenotethesetofimport/exportschemas.thechangemechanismsforourarchitecturearespeciedasfollows: caseofpotentialintegrityviolations. ECArulestospecifyintegrityconstraintsforreplicasandactionswhichhavetobeexecutedin 8ES:ExportSchemas[ImExSchemas: if9is:importschemas[imexschemasjdependence(es,is) onevent(es) then--changedependentvalues: LetExportSchemasdenotethesetofexportschemas,ImportSchemasdenotethesetof 8IS2ImportSchemas[ImExSchemasjdependence(ES,IS):change(IS)

9 Note,however,thatthisisonlyasupercialspecicationofthegeneralmechanisms.Fora detailedspecication,itwouldbenecessarytospecifythestructureoftheschemasandthe mustnotraiseeventsonimexschemas.adetailedandexhaustiveformalspecicationisbeyond functionsevent,dependenceandchangewhichoperateontheschemas.thechangefunction Thesetransactionsarecalledtriggeredtransactionswhereasthetransactioninwhichtheevent yieldstrue,thesecondphase,whichistheexecutionoftheactionpartoftherule,isstarted. mechanismsoftheassociatedalgorithms. occursiscalledtriggeringtransaction.couplingmodesbetweentriggeringandtriggeredtransactionsdeterminewhenthetriggeredtransactionsareexecuted[wc96].forourapproach,the decoupledmodeismostreasonable,asweshouldnotrestricttheautonomyofcomponentdbss Both,conditionevaluationandactionexecution,areperformedintransactionboundaries. Theexecutionofrulesconsistsoftwophases.Intherstphase,whichistriggeredbythe occurrenceofthecorrespondingevent,theconditionoftheruleisevaluated.iftheevaluation thescopeofthepresentpaperwhichfocusesontheoverallsystemarchitectureandthegeneral morethannecessary. informationoccurveryseldom.therefore,aweakerconsistencycriterionisacceptable:you insertedinformationlateron.therefore,itisreasonabletoexecutethechangeoperationsin rarelyseeoutdatedinformationthathasbeenupdatedsomewhereelse.youonlyseenew separatetransactionsinthisenvironment.furthermore,immediateanddeferredcouplingwould restricttheautonomysubstantially. Ingeneral,itisanundecidableproblemtodetermineinadvancewhetherrulesareguaranteedto InHIS,thereoccurpredominantlyinsertionsofnewinformation;modicationsofexisting prohibitionofcyclesindependenciesamongimportandexportschemasviacomponentand whenloopingispossible[ahw95].apreventionagainstinniteloopsinourarchitectureisthe federatedschemas. terminate,althoughconservativealgorithmshavebeenproposedthatwarntheruleprogrammer Ruleprocessingissubjecttoinniteloops,thatis,rulesmaytriggeroneanotherindenitely Detectingchangesbytheactiveagents autonomyandintegrationmustbefound.someapproachesare: Howdotheagentsndoutaboutchangestodata?Tosolvethisproblem,abalancebetween SomeDBSsoeractivemechanismssuchastriggerstodetectandannouncechanges IfacomponentDBSdoesnotsupportsuchdetectingtechniques,pollingtechniquescan [WC96].Withtheavailabilityofactivemechanisms,localapplicationsdonothavetobe changed:triggersareassignedtomonitorchangesofexporteddata. bedeployed: {Theevaluationofsystemdatacanbeusedtodetectthespecicoperations.For IfthecomponentDBSisanobject-orientedDBS,thestoredobjectscanbemodiedbyan Inclient/serversystems,aninterfacebetweenapplicationandservercanbeusedtoanalyze theclientrequestsandannouncedetectedchanges[klb96]. {Changescanbedetectedbycomparingdatasnapshots.Keyscanbeusedtoeciently computethechanges,asdescribedin[lgm96]. instance,thetransactionsloglecanbemonitored[ek91]. However,apromisingapproachinahospitalsettingisthefollowing: sincethelocalapplicationsarechanged. overridingtechnique[ss95].anycriticalmethodwillhavetoberenedbyaddingoperationsthatannouncechanges.thisapproachrestrictstheautonomyoflocalapplications,

10 AHL7messageisastring,whichcontainsmandatoryandoptionalsegments[Ham93].These segmentsconsistofseveralelds.thesyntaxofversion2.2ofhl7messagesisdenedinformally in[hlg94].togainaninsightintothestructureofthehl7messagetypes,weanalyzedthe structureofhl7messages[hk95].thismodelcanbeusedasthebasisforthecomponent informaldescriptionofhl7from[hlg94]anddenedanobject-orientedmodeledforthedata WrappingHL7-messages.HL7isade-factostandardfordataexchangebetweencommercialsystemsforhospitals[McD95]. schemaofthecorrespondingcomponentdbs,whichcouldbespeciedusing,e.g.,theobject messagesfromthesubsystemandannouncechangeswhentheyaredetected.theforthcoming version3ofhl7willbeaccompaniedwithanobject-orienteddatamodel[rq96].thiswill simplifythetaskofwrappinghl7-messages. 4Relatedwork denitionlanguageofodmg-93[cat96].thecorrespondingagentwouldinterceptthehl7 In[RHC+96],thetechniquesforfederatedDBSsarebeingdeployedintheapplicationdomain ofhiss,wherebythemanagementofchangestothestructureoffederateddbssisdiscussed. However,thisapproachdoesnotdiscussintegritycontrolforreplicatedinformation. mance:multiplecopiesofsomedataitemsaremaintained,typicallyonseparatesites,sothat thedataitemcanberetrievedevenifsomecopiesofthedataitemcannotbeaccesseddueto systemfailures.however,thisbenetofdataavailabilityisonlyrealizedatthecostofelaborate algorithmsthathidetheunderlyingcomplexityofmaintainingmultiplecopiesofasingledata item.thedicultyliesinkeepingthecopiesconsistentwitheachotherwhileatthesame timemaximizingthedataavailabilityandperformance.thealgorithmswhichaddressthese problemsarecalledreplicacontrolalgorithms[bhg87]. ReplicateddataisemployedindistributedDBSstoenhancedataavailabilityandperfor- whichisunacceptableinpractice.hencethewrite-allapproachcanbemodiedtowriteall copiesavailabletothetransactioncoordinator.unavailablereplicasreceivechangesonadeferred basis.themostcommonlyknownprotocolofthisgenreistheprimarycopyprotocol.a consistentviewofthereplicasincethechangesarenotexecutedintransactionboundaries. toourchangealgorithmwithonemastercopyfordataitems,butwedonotguaranteea two-phasedcommitprotocolisrequiredtoguaranteeaconsistentviewofthereplica(1-copyserializability[bhg87]).tosomeextent,thebasicprincipleofthisprotocolcanbecompared Withfailures,however,writingallcopieswithinatransactioncancauseindeniteblocking, canonlybeachievedbyweakeningtheautonomyrequirementsofcomponentdbss.therefore, autonomytoomuch.ourapproachpreservesahighdegreeoflocalautonomybyapplying awayhastobefoundforintroducingglobalintegritymaintenancewithoutrestrictinglocal -serializabilitytoallowasynchronousupdates[pl91].temporaryinconsistenciesinreplicas Also,fordistributedDBSsithasbeensuggestedtoreplacethe1-copy-serializabilitywith,e.g., maybeseenbyquerieswiththisasynchronousapproach. triggeredandtriggeringtransactions. mechanismsofactivedatabasesonthegloballevelofintegritymaintenancethroughdecoupling Theintegrationofreplicatedinformationacrossautonomoussubsystemswithinhospitals theupdatingtransactioncommitsarelessdeadlockpronethaneagerreplicationalgorithmsthat propagatereplicachangesbeforetheupdatingtransactioncommits,becausethetransactions haveshorterduration[ghos96]. becausethereinpredominantlyinsertionsofnewinformationoccur:yourarelyseeoutdated on.therefore,theweakerconsistencyisacceptableinthisenvironment.additionally,lazy informationthathasbeenupdatedsomewhereelse,youonlyseenewinsertedinformationlater replicationalgorithmsthatasynchronouslypropagatereplicachangestoothersubsystemsafter DecouplingoftriggeredandtriggeringtransactionofchangeoperationsisreasonableinHISs,

11 indissimilarandautonomoussubsystems. tointegratethereplicasofinformationaboutthesamerealworldphenomenonwhicharestored 5Conclusions AHISisacomplexsystemofsystemswhichrequiresawelldesignedorganizationatthesoftware architecturelevel.fordigitalinformationthatisneededinhospitals,itisamajorrequirement ordeadlocks. presented.thisarchitectureisthebasisforassociatedalgorithmsthatrestoretheintegrityof replicatedinformationwhenchangesoccur.thechangealgorithmsarebasedontheschema architecture.thisapproachkeepsthesealgorithmssimpleandtheanalysisofthedependencies withintheschemaarchitecturecanbeusedtodetectpossiblyinniteloopsofchangepropagation systems[sl90]andadaptedtothespecicdemandsonintegrationofreplicatedinformationis hospitals.anarchitecturewhichisbasedonthereferencearchitectureforfederateddatabase Thispaperpresentsourapproachtofederatedintegrationofreplicatedinformationwithin mastercopiesfordataitems.multiplemastercopiesfordataitemsshouldbeavoided[swg+92, GHOS96],butsometimeslegacysystemshavetobeintegratedwhichstorethedataintheirown tomoderninformationsystemswhichdonotrequiremultiplemastercopies. repositories.however,afederatedarchitecturesupportsasmoothmigrationfromlegacysystems Theschemaarchitectureisextendedtosupportchangealgorithmswithoneormultiple owwithinhospitals. communicationservers,atightlycoupledfederateddbswhosedataintegrationisonthebasis knowsthedependenciesamongreplicas.thisapproachallowstoanalyzeandoptimizethedata complishedthroughupdatesofreplicateddatainsubsystemsbythefederationlayer,which ofschemaintegrationiscapableofsupportingsubsystemstointeroperate.insteadofenabling thesubsystemstosendmessagesforinformationexchange,theexchangeofinformationisac- Incontrasttothecurrentstateoftheartinconnectingsubsystemswithinhospitalsthrough References [AHW95]A.Aiken,J.M.Hellerstein,andJ.Widom.Staticanalysistechniquesforpredictingthe [BHG87]P.A.Bernstein,V.Hadzilacos,andN.Goodman.Concurrencycontrolandrecoveryin [Cat96]R.Cattell,editor.TheObjectDatabaseStandard:ODMG-93,Release1.2.MorganKaufman, [CT95]S.ConradandC.Turker.ActiveIntegrityMaintenanceinFederatedDatabaseSystems databasesystems.addison-wesley, behaviorofactivedatabaserules.acmtransactionsondatabasesystems,20(1):3{41,march [EK91]F.EliassenandR.Karlsen.Interoperabilityandobjectidentity.ACMSIGMODRecord, [Dat95]C.J.Date.Anintroductiontodatabasesystems.Addison-Wesley,6thedition,1995. [ESP92]C.-Th.Ehlers,H.Schillings,andP.M.Pietrzyk.HISandintegration.InA.R.Bakker,C.-Th. 20(4):25{29,December1991. PreprintNr.9,ITI,UniversityofMagdeburg,November1995. [GHOS96]J.Gray,P.Helland,P.O'Neil,andD.Shasha.Thedangersofreplicationandasolution. [Ham93]W.E.Hammond.HealthLevel7:Aprotocolfortheinterchangeofhealthcaredata.In Design{Architecture,pages49{56.North-Holland,1992. Ehlers,J.R.Bryant,andW.E.Hammond,editors,HospitalInformationSystems:Scope{ onmanagementofdata). SIGMODRecord,25(2):173{182,June1996.(Proc.ACMSIGMODInternationalConference G.J.E.DeMoor,C.J.McDonald,andJ.N.vanGoor,editors,ProgressinStandardizationin HealthCareInformatics,pages144{148.IOSPress,1993.

12 [HLG94]HL7Group.Healthlevelseven:anapplicationprotocolforelectronicdataexchangein [HK95]W.HasselbringandA.Krober.RequirementsanalysisonacongurableHL7-basedcommuni- [KLB96]T.Kudrass,A.Loew,andA.P.Buchmann.Activeobject-relationalmediators.InProc.First (ingerman). agementverteilteranwendungssysteme,pages31{40,munster,october1995.krehl-verlag. healthcareenvironments,version2.2.technicalreport,healthlevelseven,inc.,annarbor, cationserverwithomtandexecutablemodels.inh.krumm,editor,entwicklungundman- [LGM96]W.J.LabioandH.Garcia-Molina.Ecientsnapshotdierentialalgorithmsfordatawarehousing.InProc.22thInternationalConferenceonVeryLargeDataBases,pages63{74, 239,Brussels,Belgium,June1996.IEEECSPress. IFCISInternationalConferenceonCooperativeInformationSystems(CoopIS'96),pages228{ USA,December1994. [McD95]C.J.McDonald.NewsonU.S.healthinformaticsstandards.M.D.Computing,12(3):180{186, [Mey88]B.Meyer.Object-orientedSoftwareConstruction.PrenticeHall,1988. [PBE95]E.Pitoura,O.Bukhres,andA.Elmagarmid.Objectorientationinmultidatabasesystems Bombay,India,September1996.MorganKaufmann. [PL91]C.PuandA.Le.Replicacontrolindistributedsystems:anasynchronousapproach.ACM [RSC97]RationalSoftwareCorporation.TheUniedModelingLanguage.DocumentationSetVersion [PD95]H.U.ProkoschandJ.Dudeck,editors.HospitalInformationSystems:DesignandDevelopmentCharacteristics;ImpactandFutureArchitecture.Elsevier,1995. ACMComputingSurveys,27(2):141{195,June1995. SIGMODRecord,20(2):377{386,June ,SantaClara,CA,January1997.(availablefromwww.rational.com). [RHC+96]M.Roantree,P.Hickey,A.Crilly,J.Cardi,andJ.Murphy.Metadatamodellingforhealthcareapplicationsinafederateddatabasesystem.InO.Spaniol,C.Linnho-Popien,and [RS95]E.RadekeandM.H.Scholl.Functionalityforobjectmigrationamongdistributed,heterogeneous,autonomousdatabasesystems.InProc.5thInternationalWorkshoponResearch B.Meyer,editors,TrendsinDistributedSystems:CORBAandBeyond,InternationalWork- [RQ96]W.RishelandJ.Quinn.Softwarecomponents,theclinicalworkstationandhealthcarenetworks:HowHL7ishelpingyougetthere.InProc.HealthcareInformationandManagement SystemsSociety'sAnnualConference,Atlanta,Georgia,March1996. Germany,October1996.Springer-Verlag. shoptreds'96,volume1161oflecturenotesincomputerscience,pages71{83,aachen, [SL90]A.ShethandJ.Larson.Federateddatabasesystemsformanagingdistributed,heterogeneous, [SPFW90]E.H.Shortlie,L.E.Perreault,L.M.Fagan,andG.Wiederhold,editors.Medicalinformatics: [SS95]I.SchmittandG.Saake.ManagingObjectIdentityinFederatedDatabaseSystems.In IssuesinDataEngineering:DistributedObjectManagement(RIDE-DOM'95),pages58{66, M.Papazoglou,editor,Proc.14thInternationalConferenceonObject-OrientedandEntity- computerapplicationsinhealthcare.addison-wesley,1990. Taipei,Taiwan,March1995.IEEEComputerSocietyPress. RelationshipModeling(OOER'95),volume1021ofLectureNotesinComputerScience,pages 400{411,GoldCoast,Australia,1995.Springer-Verlag. andautonomousdatabases.acmcomputingsurveys,22(3):183{236,1990. [WC96]J.WidomandS.Ceri,editors.ActiveDatabaseSystems{TriggersandRulesForAdvanced [SWG+92]W.W.Stead,G.Wiederhold,R.Gardner,W.E.Hammond,andD.Margolies.Database systemsforcomputer-basedpatientrecords.inm.j.ballandm.f.collen,editors,aspects ofthecomputer-basedpatientrecord,pages83{98.springer-verlag,1992. DatabaseProcessing.MorganKaufmannPublishers,SanFrancisco,1996.