MD Michel Wjm Wouters
email: m.wouters@nki.nl

MD, PhD Marlies Lea Jansen-Landheer

MD, PhD Cornelis Jh Van De Velde

M W J M Wouters

The Quality of Cancer Care Initiative in the Netherlands

Keywords: quality of care, variation, hospital volume, hospital specialization, quality assurance, guideline adherence, medical audit, comprehensive cancer centre

Background: In 2007 the Dutch Cancer Society formed a 'Quality of Cancer Care' taskforce comprising medical specialists, from all disciplines involved in the care for cancer patients. This taskforce was charged with the evaluation of quality of cancer care in the Netherlands and the development of strategies for improvement.

Objective: The experts first focused on the relation between procedural volume and patient outcome and later aimed to identify other factors associated with high and low quality of the care provided in different regions and (types of) hospitals in the Netherlands. The question if cancer care in the Netherlands could be organized differently to assure high quality of care for all patients, was the main subject of investigation.

Methods: An extensive review of the literature on infrastructure, volume and specialization on the one hand and outcome on the other was performed. In addition, a meta-analysis of the volume-outcome relationship for pancreatectomies, bladder, lung, colorectal and breast cancer resections was performed. Finally, variation in quality of cancer care between regions, groups of hospitals and individual hospitals in our country was investigated on data from the Netherlands Cancer Registry.

Results:

In the Netherlands quality of care varies by hospital and region. These differences are not limited to surgical procedures and postoperative mortality, but are also demonstrated in other parts of the care process. Differences are only partly explained by differences in infrastructure, procedural volume and specialization between hospitals. Essential information on differences in case mix between these hospitals are lacking from the Netherlands Cancer Registry. More detailed clinical data are needed to reveal the mechanisms behind the differences in quality of care between Dutch hospitals.

Conclusion:

On a population level, there is potential for improvement of outcome for cancer patients in the Netherlands by reducing variation in optimal treatment rates between hospitals.

Not only treatment of tumours with a low incidence but also other complex or high risk cancer procedures should be provided in a specialized setting, with the right infrastructure, sufficient volume and adequate expertise. In addition, outcomes should be monitored continuously and fed back to individual caregivers.

Introduction

In most European countries quality of care is high on the political agenda. Especially in cancer care future developments force us to re-evaluate the way care is provided for our patients. First the number of cancer patients is rising and will continue to do so. Second, the relative part of elderly cancer patients, with an increased risk of treatment related morbidity and mortality will rise. Moreover, care processes, including diagnostic procedures, multidisciplinary decision making and combined modality treatments, are becoming more and more complex, demanding more specific knowledge, expertise and infrastructure in institutions providing cancer care.

Simultaneously, there is a growing concern about the quality and safety of health care: it harms too frequently and routinely fails to deliver the desired benefits [START_REF]Crossing the Quality Chasm: A New Health System for the 21st Century[END_REF]. A plethora of articles on variation in quality of care delivered by different types of hospitals, has contributed to the concern that the care delivered is not always, the care that should be received [START_REF] Birkmeyer | Hospital Volume and Surgical Mortality in the United States[END_REF][START_REF] Lemmens | Mixed Adherence to Clinical Practice Guidelines for Colorectal Cancer in the Southern Netherlands in 2002[END_REF][START_REF] Li | The Influence of Provider Characteristics on Resection Rates and Survival in Patients With Localized Non-Small Cell Lung Cancer[END_REF].

Authorities as well as the public demand more accountability and transparency in the quality of the care provided. In many countries quality indicators are developed to gain insight in differences in quality of care between institutions. Unfortunately, few quality indicators are validated; have proven their capacity to discriminate between high and low quality of care.

In the Netherlands, under the supervision of the Signaling Committee of the Dutch Cancer Society a 'Quality of Cancer Care' taskforce was formed in 2007, comprising medical specialists, from all disciplines involved in the care for cancer patients, who had expertise in quality of care improvement projects. This taskforce was charged with the evaluation of quality of cancer care in the Netherlands and the development of strategies for improvement. The experts first focused on the relation between procedural volume and patient outcome and later aimed to identify other factors associated with high and low quality of the care provided in different regions and (types of) hospitals in the Netherlands. The question if cancer care in the Netherlands could be organized differently to assure high quality of care for all patients, was the main subject of investigation.

Survival of cancer patients in the Netherlands

In a European perspective the survival of cancer patients in the Netherlands is favourable for the majority of tumours (5;6). Especially, in head and neck tumors survival is highest in Europe, though in other cancer types, like esophageal, gastro-intestinal, liver, pancreatic and ovarian tumours, outcome is less favourable. In addition, recent Dutch studies show marked variation in outcome between different providers. Surgery for ovarian carcinoma by gynaecooncologists in the Netherlands proved to have better outcome than by general gynecologists [START_REF] Engelen | Surgery by Consultant Gynecologic Oncologists Improves Survival in Patients With Ovarian Carcinoma[END_REF]. Morbidity and mortality after esophageal and pancreatic resections for cancer in high volume centers showed to be lower than in low volume center [START_REF] Gouma | Rates of Complications and Death After Pancreaticoduodenectomy: Risk Factors and the Impact of Hospital Volume[END_REF][START_REF] Van Lanschot | Hospital Volume and Hospital Mortality for Esophagectomy[END_REF][START_REF] Wouters | High-Volume Versus Low-Volume for Esophageal Resections for Cancer: The Essential Role of Case-Mix Adjustments Based on Clinical Data[END_REF]. These studies suggest that outcome of low volume cancer surgery could be improved by concentrating procedures at specialized high-volume providers [START_REF] Wouters | Centralization of Esophageal Cancer Surgery: Does It Improve Clinical Outcome?[END_REF]. This is supported by the excellent results in the treatment of head and neck tumours in our country, for which surgery is concentrated in seven specialized centers.

Volume and outcome

Since, Birkmeyer et al published their article on the inverse relationship between hospital volume and mortality after high risk surgical procedures in the New England Journal of Medicine in 2002 (2), there has been a debate about volume and outcome of many cancer procedures in the Netherlands. Despite several publications on excess mortality of patients in who high risk cancer procedures, like esophagectomies and pancreatectomies, were performed in low volume hospitals (12;13), no change in referral patterns was seen during several years [START_REF] Van Heek | Hospital Volume and Mortality After Pancreatic Resection: a Systematic Review and an Evaluation of Intervention in the Netherlands[END_REF]. Therefore, the Netherlands Health Care Inspectorate intervened and banned esophagectomies from hospitals with a mean annual volume less than 10.

Nevertheless, doubts remained about actual improvement in outcome after concentrating these high risk cancer procedures. Selecting future referral centers exclusively on their procedural volume might not lead to actual improvements in outcome on a population level [START_REF] Wouters | Volume-or Outcome-Based Referral to Improve Quality of Care for Esophageal Cancer Surgery in The Netherlands[END_REF]. Moreover, the relationship between volume and outcome could not only be limited to high-risk cancer surgery, but be present in several diagnostic and treatment procedures of different parts of the care process for cancer patients.

Therefore, the 'Quality of Cancer Care' taskforce performed an extensive review of the literature on infrastructure, volume and specialization on the one hand and outcome on the other. Five hundred forty five publications were found and after exclusion of articles on non cancer related subjects and single institution studies 122 articles remained in the study. Most articles reported on surgical procedures, studies investigating other aspects of the care process for cancer patients where found sporadically. Besides, outcome was generally limited to postoperative morbidity and mortality, though some recent studies also report on use of breast conserving therapies, recurrence rates, survival, quality of life and patient satisfaction [START_REF] Hiotis | Predictors of Breast Conservation Therapy: Size Is Not All That Matters[END_REF][START_REF] Rutegard | No Influence of Surgical Volume on Patients' Health-Related Quality of Life After Esophageal Cancer Resection[END_REF][START_REF] Verhoef | Better Survival in Patients With Esophageal Cancer After Surgical Treatment in University Hospitals: a Plea for Performance by Surgical Oncologists[END_REF]. Differences in quality of diagnostic procedures and pathology examinations between providers are certainly underexposed, in literature only a few articles addressing this subject were found [START_REF] Chen | A Comparison of Dermatologists' and Primary Care Physicians' Accuracy in Diagnosing Melanoma: a Systematic Review[END_REF][START_REF] Khan | Accuracy of Choroidal Melanoma Diagnosis by General Ophthalmologists: a Prospective Study[END_REF][START_REF] Lee | An Adequate Level of Training for Technical Competence in Screening and Diagnostic Colonoscopy: a Prospective Multicenter Evaluation of the Learning Curve[END_REF][START_REF] Lemmens | Pathology Practice Patterns Affect Lymph Node Evaluation and Outcome of Colon Cancer: a Population-Based Study[END_REF][START_REF] Van Vliet | Staging of Esophageal Carcinoma in a Low-Volume EUS Center Compared With Reported Results From High-Volume Centers[END_REF][START_REF] Van Vliet | Radiologist Experience and CT Examination Quality Determine Metastasis Detection in Patients With Esophageal or Gastric Cardia Cancer[END_REF][START_REF] Wong | Hospital Lymph Node Examination Rates and Survival After Resection for Colon Cancer[END_REF].

For high risk cancer surgery, like esophagectomies, gastrectomies, pancreatectomies, liver resections, lung and bladder resections mortality proved to be significantly lower in high volume compared to low volume hospitals (Table1). In only a few studies survival was used as endpoint, but proved to be significantly related to hospital volume in most of them. Also the relation between surgeon volume and surgeon specialty on the one hand and mortality on the other was shown in several studies. Though, results of volume-outcome studies in colorectal surgery were less evident. Earlier studies have shown that morbidity in rectum resections is higher than in colon resections, though the risk of dying postoperatively is substantially higher in colon resections. Low hospital volume was found to be a predictive factor for mortality in colon (8 out of 9 studies) but not in rectum resections (1 out of 5). Though, in rectum resections 5 out of 5 studies investigating the relationship between hospital volume and morbidity, were positive. Moreover, several studies on surgeon volume and -specialty were positive for mortality, recurrence rates and survival. For ovarian and breast cancer resections more studies investigating survival with high-and low volume providers were found.

Differences in outcome were more explicit for surgeon related factors, like surgeon volume and specialty, than for hospital characteristics.

Though literature on the volume -outcome relationship in cancer procedures proved to be extensive, the Dutch 'Quality of Cancer Care' taskforce found several impediments translating these results into policy. First, most studies are observational, using data collected for other purposes than the evaluation of quality of care and were performed in health care systems essentially different from that in the Netherlands (for example studies on large insurance companies databases in the United States). Second, important case mix adjustments were frequently omitted. Moreover, cut offs between low-and high volume were very heterogeneous, high volume in one study could be low volume in the other. Therefore the risk of selection and publication bias in these studies is substantial. To anticipate on a number of these objections a meta-analysis was performed for a selection of tumour resections: pancreatic, bladder, colorectal, lung and breast cancer resections. Figures 1 and2 show a summary of the results of the meta-analyses, of which several are published in this same issue of the European Journal of Surgical Oncology. Despite the results of these meta-analyses, the question remained if results from these studies could be extrapolated to the Dutch setting.

Variation in quality of care

To be able to answer the question to what extent variation in quality of cancer care exists between regions, groups of hospitals or individual hospitals in our country, data from the Netherlands Cancer Registry were investigated. In the Netherlands all newly diagnosed malignancies are registered in this nationwide population-based registry. Data are collected from the medical records by specially trained registrars and are coded according to a national manual. Information on patient characteristics, tumour characteristics, treatment, hospital of diagnosis, hospital of treatment and follow-up is recorded. For coding tumour site and morphology the International Classification of Diseases for Oncology (ICD-O) is used [START_REF]International Classification of Diseases for Oncology[END_REF].

Cancers are staged according the TNM classification [START_REF]TNM Atlas[END_REF]. Quality of the data is high and completeness is estimated to be at least 95% (28;29).

For this study 4 tumour types were selected, based on their risk profile (Table 3). Invasive bladder cancer was selected as a low volume tumour type with a high risk on postoperative morbidity and mortality after bladder resection. Non-small cell lung cancer (NSCLC) as an intermediate volume tumour with a high risk on treatment morbidity and an unfavourable survival. Colorectal cancer is a high volume tumour with a high risk on postoperative morbidity, but a fair survival rate at 5 years. Finally, breast cancer was selected as a high volume tumour, with lower treatment related morbidity and a favourable survival. All patients diagnosed with these tumour types in the years 2001 until 2006 were included in the study. For all tumours hospitals were grouped according to structural characteristics like diagnostic and procedural volume, academic and / or teaching status, radiotherapy facilities and their region (affiliation with one of the eight Comprehensive Cancer Centres). Aspects of quality of care to be evaluated in the studies were selected from the evidence-based guidelines valid in the study period.

For bladder cancer important differences in outcome between high and low volume hospitals were revealed. The risk of dying after cystectomy in the 44 low volume hospitals (≤ 5 / year) proved more than five times as high as in the 13 high volume hospitals (> 10/year), respectively 6.4 and 1.2%. In addition, lymph node resections were performed more frequently in academic hospitals compared to hospitals without a teaching status for urologists (OR 2.7, p<0.001) and in high volume compared to low volume hospitals (OR 1.52, p=0.04). During the period under investigation there was only a small trend in centralization of cystectomies.

Patients with stage I and II NSCLC diagnosed in teaching hospitals for thoracic surgeons (OR 1.49, p=0.001) and in hospitals with a diagnostic volume of more than 50/year (OR 1.29, p=0.001) had a higher chance of resection of their tumour. Nevertheless, differences in resection rates between individual hospitals were much more distinct, ranging from less than 50 to more than 90%. Similar differences in the use of chemoradiation (radiotherapy combined with chemotherapy) between individual hospitals were seen, without a significant relation with a hospitals radiotherapy facilities.

In colon carcinoma, patients diagnosed in an academic hospital were more likely to have 10 or more lymph nodes evaluated after resection (OR 2.31, p<001). For patients in hospitals with a volume of more than 100 diagnoses a year the contrary was true (OR 0.69, p<0.001). Again, variation on the level of individual hospitals was much more distinct, varying from less than 20% to more than 70% of patients with 10 or more lymph nodes evaluated. Also the proportion of patients younger than 75 years receiving adjuvant chemotherapy for their stage III colon carcinoma varied by hospital, ranging from less than 60 to more than 90%. For rectal carcinoma the proportion of patients younger than 75 years with clinical stage T2/T3-N0/N1-M0 receiving preoperative radiotherapy varied widely on the individual hospital level, from less than 60 to more than 90%.

Despite the sentinel node procedure (SNP) was introduced in the Netherlands in 1996, the percentage of patients with pT1T2 N0 breast cancer receiving primary axillary lymph node dissection (ALND) varied widely on the individual hospital level during the studied period: 2003-2006. In 10 out of 97 Dutch hospitals 10% or less of the patients received an ALND, while in the same period 9 hospitals had a percentage of more than 40. Especially in nonteaching hospitals a large proportion of node-negative breast cancer patients received ALND.

The differences between hospitals decreased over time, indicating that more and more surgeons use the SNP method instead of ALND. Nevertheless, investigators were surprised with the differences shown between fast and slow adapting hospitals, in the introduction of an operative technique that decreases morbidity substantially for a large number of breast cancer patients.

Based on the results of these studies in bladder-, lung-, colorectal-and breast cancer, the taskforce concluded that variation in quality of care for cancer patients in the Netherlands varies by hospital and / or region. These differences are not limited to surgical procedures and postoperative mortality, but are also demonstrated in other parts of the care process.

Sometimes, the range of variation is disturbingly high. Unfortunately, essential information on differences in case mix between these hospitals are lacking from the Netherlands Cancer Registry. More detailed clinical data are needed to reveal the mechanisms behind the differences in quality of care between Dutch hospitals.

Current strategies for quality improvement

In the Dutch health care system, the choice (and responsibility) to refer a patient needing specialized care to a colleague or hospital with adequate expertise is entirely in the hands of individual medical professionals. During the past 30 years the comprehensive cancer centres (CCCs), non-hospital organizations that serve as platforms for regional and national consultation between professionals, have played an important role in the coherence of cancer care in the Netherlands. Aim of the comprehensive cancer centres is that optimal cancer care is provided to each patient. Main focus groups are caregivers, such as medical specialists and organizations, such as hospitals. In the eighties cancer patients were treated in more than 170 hospitals all over the Netherlands with a wide varying quality. Main emphasis during that period was the sharing of knowledge and multidisciplinary collaboration within hospitals and within regions. For example, weekly multidisciplinary oncology meetings, in which patient-specific issues regarding diagnosis and treatment can be discussed with regional experts, were organized in every hospital in the Netherlands. In addition, the Netherlands cancer registry was founded to get a better view on the incidence of different types of cancer as well as gaining insight in the quality of care provided. In the nineties several regional instruments were developed to encourage further improvements and diminish differences in provided care, such as regional guidelines and methods of self evaluation. The first decade of the millennium was characterized by increasing national collaboration. For example, regional consensus-based guidelines were replaced by national evidence-based. Besides many regional quality improving initiatives were successfully implemented often with the support of data collected by the cancer registry (www.ikcnet.nl).

Only recently, professional organizations like the Association of Surgical Oncologists of the

Netherlands have started to formulate the terms for surgeons to perform specific cancer procedures. Until now, instruments used by professional organizations to improve quality of care were limited to guideline development, educational programs and site-visits. In only 19 of 50 professional guidelines on cancer treatment specific demands regarding infrastructure, procedural volume or referral of patients are mentioned (Table 4). A nationwide outcome registry (medical audit) to reveal differences in treatment patterns and quality of care in individual hospitals has started recently for colorectal cancer in the Dutch Surgical Colorectal Audit. In the first report on data collected on colorectal resections performed in 2009 important information on casemix differences between hospitals in the Netherlands are revealed and several quality issues appealing for improvement, were identified (www.dsca.nl).

Quality assurance, indicators and audits

Knowledge, experience and skills of individual medical specialists (or their teams) providing care for cancer patients might vary in such a way that it leads to variation in outcome. An overwhelming number of evidence-based guidelines were developed in our country to transfer the best available knowledge on cancer care to all physicians treating these patients.

Unfortunately, little is known about the adherence to these guidelines in daily practice and more interestingly: the reasons for non-compliance.

In randomized clinical trials it is recognized that treatment variation could influence the outcome of these trials and therefore should be minimized. Especially when surgery is part of a trial, variability in the skills of participating surgeons leads to irreproducible results. To reduce this variation, surgical quality assurance programs have been added to a number of trials, in which participating surgeons were trained to perform the procedure in an identical way.

However, quality assurance is not necessarily limited to the surgical aspects of treatment, but is a complete set of measures required to achieve a treatment result that meets a certain standard [START_REF] Den | Quality Assurance in Surgical Oncology: the Tale of the Dutch Rectal Cancer TME Trial[END_REF]. For example, quality assurance was integrated in the Dutch TME trial, in which a new surgical technique was used in rectal cancer resections by all participating surgeons. To train these surgeons workshops, videotapes and instructors supervising the first 5 operations were used. Though, also for radiotherapy exact descriptions of dose, volume, fields and simulation techniques were used and for pathology a strict protocol was dictated, which gave the surgeons immediate feedback on their performance. The surgical quality assurance in this trial proved to be very successful: local recurrence rates were reduced by 50% compared to historical data [START_REF] Peeters | The TME Trial After a Median Follow-Up of 6 Years: Increased Local Control but No Survival Benefit in Irradiated Patients With Resectable Rectal Carcinoma[END_REF]. The association between circumferential resection margin (CRM) involvement and outcome (local recurrence, survival) demonstrated the importance of this parameter in evaluating surgical performance, not only in trials, but also in daily practice [START_REF] Peeters | Surgical Quality Assurance in Rectal Cancer Treatment: the Key to Improved Outcome[END_REF].

The question is: should adequate quality control on how diagnostic procedures and treatments are performed be an integrated part of daily medical practice? The positive answer to this question is confirmed by national audit programs performed in several Scandinavian countries and the UK. For example, in Norway in the early 1990s, results for rectal cancer surgery were poor, with a 5-year survival of 55% and local recurrence rates of 28%. In addition, there was wide variation between individual hospitals [START_REF] Van Gijn | Nationwide Outcome Registrations to Improve Quality of Care in Rectal Surgery. An Initiative of the European Society of Surgical Oncology[END_REF]. Therefore, the surgical community started training gastrointestinal surgeons and started monitoring the outcome of rectal cancer resections, in which individual results were fed back to the surgeons, case mix adjusted and in comparison to the national average (benchmarking). The results of this Norwegian Rectal Cancer Registry were remarkable; after 4 years the proportion of TME surgery rose from 78 to 92% and the local recurrence rate dropped from 28 to 7% [START_REF] Norstein | Results of rectal cancer treatment: a national experience[END_REF].

These results of outcome registration and casemix adjusted feedback to individual hospitals are not limited to rectal cancer surgery in which a new technique was introduced. A Dutch regional intervention study on oesophageal cancer surgery showed that timely feedback of results to individual hospitals and surgeons led to voluntarily changes in referral patterns in 2 to 3 years time. Marked improvements in mortality and survival were seen [START_REF] Wouters | Centralization of Esophageal Cancer Surgery: Does It Improve Clinical Outcome?[END_REF]. Also, the National Surgical Quality Improvement Program (NSQIP) that began more than 20 years ago in the Veterans Affairs hospitals in the United States keeps reporting marked reductions in morbidity and mortality in the hospitals participating [START_REF] Berenguer | Improving Surgical Site Infections: Using National Surgical Quality Improvement Program Data to Institute Surgical Care Improvement Project Protocols in Improving Surgical Outcomes[END_REF][START_REF] Khuri | Successful Implementation of the Department of Veterans Affairs' National Surgical Quality Improvement Program in the Private Sector: the Patient Safety in Surgery Study[END_REF][START_REF] Rowell | Use of National Surgical Quality Improvement Program Data As a Catalyst for Quality Improvement[END_REF]. This is accomplished by a peer-controlled program of continuous and timely feedback of case mix adjusted outcomes of surgical care [START_REF] Khuri | The Department of Veterans Affairs' NSQIP: the First National, Validated, Outcome-Based, Risk-Adjusted, and Peer-Controlled Program for the Measurement and Enhancement of the Quality of Surgical Care. National VA Surgical Quality Improvement Program[END_REF]. From these projects, and there are more to mention, we learn that 'mirror-information' works as a catalyst for quality improvement in surgical care.

As mentioned above, in the Netherlands surgical audit programs, like those in the UK, Scandinavian countries and United States have only recently been started by the Association of Surgeons of the Netherlands and only for the surgical treatment of colorectal cancer. These audits are essentially different from the quality indicators that are developed by the Netherlands Health Care Inspectorate and the Ministry of Health. While audits are primarily an instrument for caregivers to improve the care they provide, the primary purpose of quality indicators is the public disclosure of the quality of health care. Unfortunately, quality indicators lack important case mix adjustments and their capacity to discriminate high from low quality of care is seldom proven. Audit programs have the potential to provide patients and payers with valid case mix adjusted quality information, protecting physicians and hospitals from an unjust appraisal of their performance.

International perspective

The first population based colorectal audits were set up in the mid nineties in the Scandinavian countries. More recently, similar colorectal audit initiatives were introduced in the UK, Belgium, the Netherlands, Spain, Germany and Poland. Other European countries started regional initiatives.

Despite all these quality efforts, still considerable differences in survival rates between European countries exist. For instance, 5 year relative survival after colorectal cancer varies between 32% and 64% [eurocare-4]. To reduce those differences and generate the best care for colorectal cancer in the whole of Europe, a deep and broad insight in the results of colorectal cancer treatment is needed in all its nations. The inevitable conclusion is that a European audit registration is needed to ameliorate the treatment of rectal cancer even further and decrease variation in the quality of care.

Urged by these arguments, the European Society of Surgical Oncology (ESSO) initiated an international multidisciplinary outcome-based quality Improvement project: 'European Registration of Cancer Care' (EURECCA). This initiative has been fully embraced by the European Cancer Organization (ECCO). EURECCA's goal is to create a multidisciplinary European registration structure of patient, tumour and treatment characteristics linked to outcome registration (morbidity, mortality, loco-regional control, and survival). The registration will be used for benchmarking and internal feedback among participants and hereby further improvements in quality and efficiency of cancer care. Nine European audits from 11 European countries decided to collaborate closely within the EURECCA project.

Together with the European Society for Therapeutic Radiology and Oncologists (ESTRO) and the European Organisation of Research and Treatment of Cancer (EORTC), the project will speed up identification and dissemination of best practice around the continent. Furthermore, countries that don't have surgical audits can be helped in setting up one, making use of the available knowledge and experience. Finally, the size of the pooled project will generate enough statistical power to allow research on patient groups that are usually excluded from clinical trials, such as elderly or patients with much comorbidity. More information about this project can be found on the webpage (www.canceraudit.eu).

Conclusions

In the opinion of the medical professionals participating in the quality of cancer care taskforce of the Dutch Cancer Society, overall quality of care for cancer patients treated in the Netherlands is high. Nevertheless, there is potential for further improvement of outcome on a population level by reducing variation in optimal treatment rates between hospitals. This opinion is based on an extensive review of the literature and evaluation of the best available data on the performance of individual hospitals in our country. Care processes for the diagnosis and treatment of cancer patients are getting more and more complex, demanding more and more experience, expertise and skills of individual medical specialists and their teams. This should have consequences for the way cancer care is provided in the near future.

Not only treatment of tumours with a low incidence but also other complex or high risk cancer procedures should be provided in a specialized setting, with the right infrastructure, sufficient volume and adequate expertise. In addition, outcomes should be monitored continuously and fed back to individual caregivers (and their hospitals) accompanied with actable information to improve quality of care.

The taskforce has the following recommendations to improve quality of cancer care in the Netherlands:

• Essential information on variation in patterns and outcome of cancer care between providers should come available to reduce variation and improve outcome on a population level.

•

Research projects aiming to reveal the mechanisms behind variation in quality of care and to identify best practices should be facilitated financially.

• Concentration of complex cancer care is necessary and should be based on criteria concerning infrastructure, procedural volume, specific expertise and the outcomes of the care provided.

• Professional organisations should take their responsibility to make adequate evaluation of the care provided by their members possible.

• Valid information on (differences in) quality of care should be made available for the public, payers and individual patients,

• Regional and multidisciplinary cooperation and referral of patients for specific cancer treatments between hospitals and physicians should be stimulated.

• Next to monodisciplinary quality initiatives more multidisciplinary collaboration in improving quality of care should be initiated,

• Coordination of multidisciplinary quality initiatives could be provided by the Comprehensive Cancer Centres collaborating in a national organisation.

• Valid case mix adjusted outcome information should be collected in national audit programs and fed back to individual hospitals and physicians continuously.

• Professionals should determine which information is essential to assess the quality of care provided to each patient.

• These 'minimal datasets' should be integrated unambiguously in the Electronic Health Records of each hospital in the Netherlands.

• Long term outcome information (recurrences, survival) can be added to the in-hospital information collected by medical audits by the Netherlands Cancer Registry.

• Next to information on the outcome of the care process in individual hospitals, the evaluation of patient satisfaction is equally important.

WORD COUNT: 4086


Henry Bukola

Duncan Sharp

Maria Marti Villalba

James Davis
email: james.davis@ntu.ac.uk

Laser anodised carbon fibre -Coupled activation and patterning of sensor substrates

Keywords: Electronic materials, polymers, interfaces, microstructure, electrochemical properties

The use of laser ablation as a method through which the simultaneous patterning and activation of carbon fibre electrodes can be achieved has been investigated. Laser induced exfoliation of the carbon fibre substrates was observed leading to creation of edge plane sites that enhance electrode performance. The laser mediated surface modification is compared to that attainable using conventional surface anodisation using electrochemical means.

A c c e p t e d m a n u s c r i p t A c c e p t e d m a n u s c r i p t 1.0 Introduction

The large variety of physical forms that carbon can take allows for considerable versatility in the design of the sensor substrates used in electroanalytical applications. Glassy carbon, aerogels, fibre, graphitic felts and pastes are but a few of the more common [1]. Highly orientated pyrolytic graphite (HOPG) offering edge plane (eppg) and basal plane (bppg) morphologies are frequently used to explore the more fundamental side of electron transfer processes but have found increasing application in analytical contexts. The basal and edge plane possess different properties with the latter tending to exhibit considerably faster electrode kinetics and, as a consequence, possesses the potential for greater detection sensitivities [2][3][4][5]. The aim of the present communication has been to investigate a method through which the surface reactivity of a conventional carbon fibre electrode can be enhanced through laser patterning of the substrate.

The surface of carbon can be modified by mechanical [4][5][6], electrochemical [7][8][9][10][11][12][13][14], chemical [14][15][16][17][18][19][20][21] or thermal [22] means. There are typically three different levels of surface modification: alteration of the functionalities already present on the surface; the covalent attachment of hitherto exogenous species onto the electrode surface and, in the last level, the intercalation of species between the graphene layers of the base substrate. Altering the surface composition is amongst the more facile and can usually be achieved through the electrochemical pre-treatment/fracturing of the carbon substrate [7,12,17] as indicated in Figure 1. This typically involves the electro-oxidation of the carbon surface by applying a fixed anodic or cyclic potential.

The oxidation increases the proportion of oxygen species such as hydroxyl, carbonyl, carboxyl and quinones at the electrode surface [14]. These are well known to influence the wettability, surface reactivity, porosity and conductivity of the electrode [1,7,8,10]. It can also have the beneficial effect of increasing the availability of edge sites as a consequence of exfoliation / fracturing process that can, as with eppg electrodes, serve to increase electrode sensitivity towards particular analytes.

Laser patterning of carbon encapsulated composites have been shown to provide a quick and versatile method of producing electrode sensor assemblies but the ability of the laser to positively influence the surface characteristics of the underlying fibre has yet to be evaluated. The adoption of the electrochemical anodisation approach requires the introduction of a separate/discrete step in the construction of the electrode sensor and it is clear that combining the patterning/activation process would represent a considerable simplification in the development process. In the present investigation, the use of laser ablation as a means of removing protective polymer encapsulants to expose and activate the sensor surface in a single step is assessed.

Experimental Details

Electrochemical measurements were conducted using a µAutolab type III computer controlled potentiostat (Eco-Chemie, Utrecht, The Netherlands) using a three electrode configuration consisting of a glassy carbon working electrode (3mm diameter, BAS Technicol, UK), a platinum wire counter electrode and a 3 M NaCl Ag | AgCl half cell reference electrode (BAS Technicol, UK). Modification of carbon fibre electrodes was investigated using a 30W CO 2 air-cooled computer controlled laser-cutter (FB400 series CadCam Technology Ltd, Nottingham, UK). Directional control over the laser, raster/vector speed and output power was achieved by means of the proprietary software (ApS-Ethos). The resolution of the laser beam is 25 µm.

Electrochemical anodisation of carbon fibres was conducted using the procedures described previously [START_REF] Sharp | Electrochemistry Communications[END_REF][START_REF] Dutt | [END_REF] and typically involved amperometric oxidation (+2V, minutes) in 0.1M sodium hydroxide solution.

Results and Discussion

Carbon fibres were encapsulated within a polyester resin laminate as described in previous work by the authors [START_REF] Sharp | Electrochemistry Communications[END_REF][START_REF] Dutt | [END_REF]. An electrode window was then created by rastering the laser across a pre-selected area of the polymer-fibre composite. This has the effect of removing the polymer and exposing the fibre which can, in principle, be with previous work where electrochemical anodisation has been shown to aid both the resolution and the sensitivity of voltammetric processes [START_REF] Sharp | Electrochemistry Communications[END_REF][START_REF] Dutt | [END_REF]. The key question, however, is whether a similar effect could be achieved simply as a consequence of exposing the carbon surface to the laser.

Cyclic voltammograms highlighting the response of the laser etched composite structure towards urate (2 mM, pH 7, 50 mV/s) are detailed in Figure 3. In all cases, the area of polymer (0.03 cm 2 ) removed is the same -the only difference between the scans is the power applied to that defined area. The greater the laser intensity -the greater the magnitude of the apparent surface activation. The capacitive background current observed with the laser etched system is however significantly smaller than that obtained with the electrochemical pre-treatment and may reflect a greater propensity of the latter to introduce surface charge to the fibre through the generation of greater numbers of oxygen species.

Application of the more extreme laser settings can however have a deleterious effect on the electrode surface and there is a sustained decrease in the peak height where maximum power is applied or where multiple passes are used. This effect was further investigated with ferrocyanide as the model analyte. Cyclic voltammograms detailing the response of the various laser anodised (60 and 100%) fibres to ferrrocyanide (2 mM, 50 mV/s) are compared in Figure 4. It can be seen that the unmodified fibre exhibits little response to the redox probe. Laser activation provides a superior response but the definition of the peak processes can be seen to degrade at the higher power setting with an increase in noise observed on the voltammetric trace.

It is clear that the response of the laser activated surface is similar to that observed after electrochemical anodisation and clearly provides an enhancement in performance over that attainable at the unmodified carbon. Scanning electron micrographs of the carbon fibre before and after laser treatment are detailed in Figure 5A and 5B. Exfoliation of the laser treated fibre can be observed even at moderate power settings (60%) and can be seen as striations along the fibre which will lead to a substantial increase in the electrode surface area -especially as a consequence of the nanofracturing at the surface. This is seen more clearly in Figure 5C where laser induced damage to the core fibre is observed at maximum power.

A c c e p t e d m a n u s c r i p t 5

It is important to note that the enhancement in peak resolution, however, is not simply a result of the increased area -as increasing the exposed and hence the "nominally active" area of the unmodified fibre did not lead to the behaviour exhibited by the either electrochemical or laser ablated fibres shown in Figures 2 and3. The main difference between native and modified fibre lies in the relative population of the edge plane sites and oxygen functionalities. It is the increase in both these feature that would lead to the increase in electrode sensitivity and it can be seen from both the electrochemical and morphological characterisations that the laser option provides a viable alternative to the electrochemical process.

Conclusions

It is clear that carbon possesses considerable flexibility in its ability to be modified and effectively tailored to specific applications. In most cases however, acquiring sufficient sensitivity towards particular analytes has often required surface modifications that increase the complexity of the construction method. The approach advocated here highlights the possible replacement of the (electro) chemical anodisation stage with a reagentless instrumental process. The results between the different approaches are comparable but in adopting the latter -greater simplicity and control could be introduced to the sensor assembly process.

  used as the working electrode in a sensor assembly. Cyclic voltammograms detailing the response of unmodified and electrochemically anodised carbon fibres (of similar geometrical area) towards uric acid (2 mM, pH 7, 50 mV/s) are detailed in Figure2.It can be seen that the oxidation of the purine (I→II, Inset Figure2) at the unmodified fibre is barely visible and is characteristic of poor electron transfer substrate that is largely basal plane in structure. The voltammogram recorded at the anodised fibre, in contrast, displays a well defined and easily quantifiable oxidation process. The change in profile is dramatic but is in keeping

Figure 1 .

 1 Figure 1.Schematic of the anodisation process

Figure 2 .Figure 3 .Figure 4 .Figure 5 .Figure 6 .Figure 1 .Figure 2 .Figure 3 .Figure 4 .Figure 5 .Figure 6 .

 23456123456 Figure 2. Cyclic voltammograms detailing the response of untreated and electrochemically anodised fibres towards 2mM uric acid (Inset). Scan rate: 50mV/s Figure 3. Linear sweep voltammograms detailing the influence of laser exposure on the activation (anodisation) of carbon fibre. Response to urate oxidation (2mM). Scan rate: 50mV/s Figure 4. Cyclic voltammograms detailing the response of unmodified and laser anodised carbon fibres towards ferrocyanide (2 mM). Scan rate: 50mV/s Figure 5. Scanning electron micrographs detailing the surface morphology of (A) untreated and (B) laser (power: 60%) anodised carbon fibres Figure 6. Scanning electron micrograph of carbon fibre after repeated exposure (2 passes) to the laser at full power


Hehua Zhang

Yu Jiang

William N N Hung

Xiaoyu Song

Ming Gu

Domain-driven Probabilistic Analysis of Programmable Logic Controllers

Keywords: PLC, Hidden Markov Model, Probabilistic Analysis

) harnessing probabilistic model checking to analyze properties on the resultant Markov Model. The framework provides expected performance measures of the PLC systems by automated analytical means without expensive simulations. Case studies on an industrial automated system are performed to demonstrate the effectiveness of our approach.

INTRODUCTION

Programmable Logic Controllers are widely used in industry. Many PLC applications are safety critical. There are a lot of studies on the modeling and verification of PLC programs. Most of them transfer PLC programs to automata [START_REF] Canet | Towards the automatic verification of PLC programs written in instruction list[END_REF][START_REF] Willems | Compact timed automata for PLC programs[END_REF][START_REF] Bauer | Verification of PLC Programs Given as Sequential Function Charts[END_REF] or Petri nets [START_REF] Hanisch | Modeling of PLC behaviour by means of timed net condition/event systems[END_REF]. Formal methods [START_REF] Younis | Formalization of existing PLC programs: A survey[END_REF][START_REF] Frey | Formal methods in PLC programming[END_REF][START_REF] Rausch | Formal verification of PLC programs[END_REF]are also proposed for analysis. Most of these methods consider the static individual PLC program that is isolated from its operating environment and verify some functional properties based on traversing the transferred model. The existent deterministic analysis of PLC programs are valuable, but the uncertain errors caused by noise, environment, or hardware should not be neglected [START_REF] Johnson | Improving automation software dependability: A role for formal methods?[END_REF].

In this paper, we present a symbolic framework for the formal analysis of PLC system. 5 We develop a probabilistic method to model the inherent uncertainty property of the PLC system. Then, we abstract the PLC system as a Hidden Markov Model, and generalize the Baum-Welch algorithm to solve the Hidden Markov Model using domain knowledge of its dedicated operating environment. After that, we combine the solved Hidden Markov Model with uncertainty characterization of the PLC system to form an integrated Markov model. We harness probabilistic model checking to analyze properties on the regular Markov Model through PRISM [START_REF] Hinton | PRISM: A tool for automatic verification of probabilistic systems[END_REF]. Our framework also allows us to obtain some performance measures of the PLC system, such as the reliability and some other time related properties. Case studies demonstrate the effectiveness of our approaches.

Preliminaries

Ladder diagram (LD) is a widely used graphical programming language for PLCs. The language itself can be seen as a set of connections between logical checkers (contacts) and actuators (coils). If a path can be traced between the left side of the rung and the output, through asserted contacts, the rung is true and the output coil storage bit is asserted true. If no path can be traced, then the output coil storage bit is asserted false. Fig. 1 shows a simple ladder program with some common instructions. It is made up of four ladder rungs.

The symbol -| |-is a normal open contact, representing a primary input. When the value of SW 1 is 1, the contact stays in the closed state, and the current flows through the contact. The symbol -|/|-is a normal close contact. When the value of SW 3 is 0, the contact stays in the closed state, and the current flows through the contact. -| | -| |-represents a serial connection of two kinds of contacts. Similarly, in the third rung, b 1 and V 3 are connected in parallel. When at least one value of them is 1, the current can flow through the trace. There is also a timer instruction in Fig. 1. More details can be found in [START_REF]IEC 61131-3 Standard (PLC Programming Languages)[END_REF]. The simplest Markov model is the Markov chain which is a random process with the property that the next state depends only on the current state. It models the state of a system with a random variable that changes over time. A discrete time Markov model can be defined as a tuple S, π, A, L , where

• S = {S 1 • • • S N }
is a set of states. We use q t to denote the state of the system at time t(t ∈ N + ).

• π = {π 1 • • • π N } is the initial state distribution, where π i = P r[q 1 = S i ] is
the probability that the system state at time unit 1 is S i . • A = {a ij }(∀i, j ∈ N ) is the state transition probability matrix for the system and a ij = P r[q t+1 = S j |q t = S i ]. • L is a set of atomic propositions labeling states and transitions.

In a regular Markov model, the state is directly visible to the observer, and therefore the state transition probabilities are the only parameters. This model is too restrictive to be applicable to many problems of interest. Here, we extend the concept of Markov model to include the case where the observation is a probabilistic function of the state. In a Hidden Markov Model, the state is not directly visible, but the output, dependent on the state, is visible. Each state has a probability distribution over the possible output observations. Hence the sequence of observations generated by a hidden Markov model gives certain information about the sequence of states.

Formally, a Hidden Markov Model is defined as a tuple M = S, O, π, A, B, L . The items S, π, A and L are defined as above. The remaining two items of the tuple are defined as:

• O = {O 1 • • • O M }
is a set of observations that the system can generate. We use v t to denote the observation generated by the system at time t(t ∈ N + ). • B = {b ik } is the observation state probability matrix of the system:

b ik = P r[v t = O k |q t = S i ](∀S i ∈ S, ∀O k ∈ O)
, which means the probability that the system generates observation O k in state S i .

Given an observation sequence

Q o = O 1 O 2 • • • O t ,
in our framework, we need to consider the following problem:

• How to adjust the model parameters A, B to maximize P r(Q o |M ).

The problem has been solved by an iterative procedure such as the Baum-Welch method [START_REF] Baum | Growth transformations for functions on manifolds[END_REF][START_REF] Ephraim | A minimum discrimination information approach for hidden Markov modeling[END_REF] and equivalently the EM method [START_REF] Dempster | Maximum likelihood from incomplete data via the EM algorithm[END_REF] or gradient techniques [START_REF] Levinson | An introduction to the application of the theory of probabilistic functions of a Markov process to automatic speech recognition[END_REF]. In this paper, we generalize Baum-Welch method with additional weights.

SYMBOLIC FRAMEWORK

We present a symbolic framework for the formal analysis of PLC systems. The framework is applicable from the implementation process to the deployment process of the system. It contains three main procedures: (1) Uncertainty characterization of a PLC ladder program, which can reflect the inner quality of the system. (2) Hidden Markov Model construction and its solution, which can reflect the actual operating environment of the PLC system. (3) Reward based probabilistic model checking to analyze the performance properties of the system on the integrated Markov model. The components of the framework are shown in Fig. 2.

Modeling Uncertainty of PLC systems

In a PLC, the program is executed through periodic scanning. In each cycle, the inputs are first sampled and read. Then, the program instructions are executed. Finally, the outputs are updated and sent to the actuators. The uncertainty characterization calculation refers to evaluating the effects of errors caused by input sampling and program execution. The sampling error happens when the actual input is 1 (or 0), but the sensor samples a 0 (or 1). Program execution error happens when the output of each ladder logic is 1 (or 0), mainly for the AN D logic (a ∧ b) and OR logic (a ∨ b), but the actual output of the logic execution turns out to be 0 (or 1). The probability of these two kinds of errors depends on noise, environment, hardware, etc.

The uncertainty calculation can be divided into three steps. We first define the output of each rung on the logic checkers and the output of instructions such as timer and counter. They are connected by ladder logic (a ∧ b, a ∨ b). Then, we build an abstract syntax tree (AST) for the output expression, with which we can give a topological sort for each ladder logic (∧(a, b), ∨(a, b)). Finally, we can use the third algorithm presented in the technical report [START_REF] Zhang | On the uncertainty characterization of programmable logic controllers[END_REF] to process each node in the abstract tree, until we arrive at the root node. The uncertainty characterization of this ladder rung can be described as follows:

f (o) = P 0 o P ε (0 → 1) + P 1 o P ε (1 → 0)
The first factor denotes the probability that the output of this ladder rung should be 0 (denoted by P 0 o ), but the root node of the abstract syntax tree propagates a P ε (0 → 1) error. The second factor is similar. An example is shown in Fig. 3. Because each ladder logic diagram may have many ladder rungs, we can get the following theorem: Theorem 1. The uncertainty characterization of the whole PLC system f is

f = 1 - i=n i=1 (1 -f (o) n )
Where f (o) n means the uncertainty characterization of the n-th ladder rung.

Construction of Hidden Markov Model

Unlike the previous methods which consider an individual PLC program that is isolated from its operating environment, we construct a Hidden Markov Model (HMM) to reflect the control principle of the whole PLC system. Our model manifests the dynamic characteristics of all the possible execution paths of the PLC system. The HMM depicts how the PLC system transfers from one state to another with a hidden probability.

As mentioned in Section 2, a HMM can be defined as a tuple S, O, π, A, B, L . We abstract the PLC system as a tuple. S is the set of normal states of the PLC system. Each state of the PLC system is composed of the states of the physical devices which are actuated by the PLC ladder program. Then, each state of the PLC system can be identified by the primary outputs of the PLC ladder rungs. O contains the observations corresponding to the state set S. It is a probabilistic function of the state and can be abstracted from basic functional requirements and from events corresponding to the physical outputs of the system. L is a set of atomic propositions {L} labeling states and transitions. Since the PLC works in a periodic scanning manner and there may be timer instructions in the ladder logic diagram, we extend the label with time attribute to reflect the time property of the PLC system. The recursive syntax of the label is defined as:

L → I|T |O; I → I0|I1|0|1; T → n ∈ N +
It is composed of three components. The first component I is the sequence of the primary inputs of the PLC ladder program. The sequence will determine the outgoing transitions of each state. The second component T is the time attribute related to the timer instructions in the ladder program, which means the corresponding state S i transfers to state S j with a time delay T . The value of T is a positive integer N + . O is the set of observations that the primary input will trigger in the dedicated state S j of the transition.

Solving the Hidden Markov Model

After we obtain the knowledge about the PLC systems' observations, states, and transitions among those states, we need to solve the unknown parameters of the HMM, especially for the parameters of the state transition probability A. We give two methods to solve the HMM by using three kinds of domain knowledge. If the domain knowledge is from a domain expert or the runtime monitoring method, the problem can be addressed by the extended Baum-Welch algorithm.

Extended Baum-Welch Method The extended Baum-Welch algorithm is based on two kinds of domain knowledge. The first kind of knowledge relies on domain expert. In a particular application, this can be done by asking the domain expert to directly provide a set of sequences of the PLC system's observations. The observation sequences are representative of the expert's knowledge of the PLC system's actual operating environment. The second kind of domain knowledge is from runtime monitoring. If the PLC has been deployed on the system, the system is already in use, we can observe the execution of the system many times to attain the observations.

After we get the observation sequence

O(O 1 O 2 • • • O t O t+1 O t+2 • • • O T )
of the HMM from time unit 1 to T , we need to adjust the model parameters M (A, B, π) to maximize the probability of the observation sequence. The Baum-Welch algorithm applies a dynamic programming technique to estimate the parameters. It makes use of a forward-backward procedure based on two variables:

α t (i) = P (O 1 O 2 • • • O t , q t = S i |M ) β t (i) = P (O t+1 O t+2 • • • O T |q t = S i , M ) α t (i) is the probability of the partial observation sequence O 1 O 2 • • • O t ,
and system model is in state S i at time unit t, and β t (i) is the probability of the partial observation sequence from t + 1 to the end, given state S i at time unit t and the model M . We compute the parameter a ij as follows:

γ t (i) = P (q t = S i |O, M ) = α t (i)β t (i) N i=1 α t (i)β t (i) γ t (i)
is the probability of the system in state S i at time t, given the observation sequence O and the model M .

ξ t (i, j) = P (q t = S i , q t+1 = S j |O, M ) = α t (i)a ij b j (O t+1 )β t+1 (j) N i=1 N j=1 α t (i)a ij b j (O t+1 )β t+1 (j)
ξ t (i, j) is the probability of the system in state S i at time t and in state S j at time t+1, respectively, with M and O. b j (O t+1 ) denotes the probability that the system is in state j, and the observations is O t+1 . Then, the expected number of all the transitions from S i and the transitions from S i to S j can be defined as

T -1 t=1 γ t (i) and
T -1 t=1 ξ t (i, j), respectively. The expected number of observing observation O k in state S i can be defined as T t=1,vt=O k γ t (i). For a single observation sequence, the iterative calculation formulas for state transition and observation probabilities can be defined as:

a ij = T -1 t=1 ξ t (i, j) T -1 t=1 γ ( t i) b ij = T t=1,vt=Oj γ t (i) T t=1 γ t (i)
The numerator of a ij denotes the expected number of transitions from state S i to S j , the denominator of a ij denotes the expected number of transitions going out of state S i . The numerator of b ij denotes expected number of times in state S i and observing symbol O j , the denominator of b ij denotes the expected number of times in state S i .

For different observation sequences

Os = [O 1 , O 2 • • • , O s ], where O k = [O k 1 , O k 2 • • • O k T ]
is the k th observation sequence, the other symbols are similar. We need to adjust the model parameter of model M to maximize P (Os|M ). We extend the method presented in [START_REF] Rabiner | A tutorial on hidden Markov models and selected applications in speech recognition[END_REF] with a weight W k for each O k . W k is the frequency of the sequence O k . We define P k = P (O k |M ) and P (Os|M ) = k k=1 P k W k . Then, the iterative calculation formulas for state transition and observation probabilities can be changed to:

a ij = k k=1 1 P k W k T -1 t=1 ξ k t (i, j) k k=1 1 P k W k T -1 t=1 γ k t (i) b ij = k k=1 1 P k W k T t=1,vt=Oj γ k t (i) k k=1 1 P k W k T t=1 γ k t (i)
The meaning of the numerator and denominator of the extended formulas are the same with the original formula described above. Then, we can choose an initial model M = (A, B, π) and use the initial model to compute the right side of the iterative calculation formulas. Once we get the new model M = (A, B, π), we can use M to replace M and repeat this procedure until the probability of observation sequence P (Os|M ) and P (Os|M ) are equal or |P (Os|M )-P (Os|M )| < θ, θ is the precision limit you want.

With these two methods, we can build the solved HMM to show the real operating environment in an particular application. We can get value of the state transition matrix, each element a ij is also identified with a label L, L → I/T /O.

Construction of Combined Regular Markov Model

The uncertainty characterization of the PLC system itself shows the inherent behaviors of the system, which evaluates the effects of the errors from input sampling and the errors from program execution. The solved HMM shows the operating environment of the system in a particular application with the use of normal states and the transitions. Then, we construct a new Markov model to combine these two properties.

The first step is to add the abnormal state caused by the uncertainty characterization. Since the system would go into an abnormal state from any normal states, we build an abnormal state (U ) for all normal states (S n ). When a normal state transits to an abnormal state, it can be recovered by the system itself or by human intervention, and reset to the initial state. We also need to add these two kinds of transitions into the solved HMM. Then, we can get all the nodes and transitions of the new Markov model M .

The second step is to initiate the transition matrix of the new model M . We need to assign values to different transitions. The probability of a normal state transmitting to the abnormal state depends on the value of the uncertainty calculation. The recovering transitions depends on the design of the system or the workers. After we add these states and transitions to the matrix A, the value of a ij based on operating environment needs to be adjusted, by multiplying with a coefficient. The matrix A and A are given by:

A =     a00 a01 . . . a0n a10 a11 . . . a1n . . . . . . . . . . . . an0 an1 . . . ann     A =       a00(1 -f ) a01(1 -f ) . . . a0n(1 -f ) f a10(1 -f ) a11(1 -f ) . . . a1n(1 -f ) f . . . . . . . . . . . . an0(1 -f ) an2(1 -f ) . . . ann(1 -f ) f rU0 0 . . . 0 1 -rU0      
In the new matrix, the last row and the last column are for the abnormal state U , the remaining rows and columns are for the normal states S n . The probability from the normal states to the abnormal state is f , which is the value of the uncertainty characterization. We know that the error probability is the same for all the normal states, because uncertainty characterization f is the inner quality of the PLC ladder program. The recovering transition probability from abnormal state U to the initial state is r U 0 , The system will remain in the abnormal state with a probability 1 -r U 0 in case of some uncertainty that can-not be recovered by the system or the operators. The transition probability between the normal states is a ij (1 -f ). a ij is the transition probability between the normal states when the system is without uncertainty. The result of a ij multiplied by the coefficient 1 -f is the transition probability combined with the uncertainty characterization.

Theorem 2. The new transition matrix A satisfies the property of regular Markov model

Proof. According to the solved HMM's matrix A:a 00 + a 01 + • • • + a 0n = 1

a 00 + a 01 + • • • + a 0n = a 00 (1 -f ) + a 01 (1 -f ) + • • • + a 0n (1 -f ) + f = a 00 + a 01 • • • + a 0n -(a 00 + a 01 • • • + a 0n )f + f = 1 + f -f = 1
The new Markov model combines the inherent property and the operating environment of the PLC system. It closely mimics the actual execution of the PLC in real life applications. Based on this model, we can analyze the runtime properties of the PLC system using model-checking technology.

Property Analysis with PRISM

After building the integrated Markov model, we can perform probabilistic model checking using PRISM [START_REF] Hinton | PRISM: A tool for automatic verification of probabilistic systems[END_REF]. First, we need to specify the Markov model in PRISM modeling language. Second, the rewards used to specify additional quantitative measures of interest should be added into the model. Finally, we specify the properties about the PLC system.

A PRISM model comprises a set of modules which represent different aspects of the system. The behavior of the PRISM model is specified by guarded commands. Synchronization between different modules can be implemented by augmenting guarded commands with action labels. We now describe the combined Markov model S , π , A , L in PRISM manner. The module is derived from the transition matrix A of the model. We declare a variable S, whose value range from [0, n+1]. Then, we build a label command for each arrow of the matrix A on this variable.

[L i ]S = i → (a i0 : S = 0) + (a i1 : S = 1) + . . . (a in : S = n) + (f : S = n + 1)
Then, we focus on extending the model with rewards. There are two kinds of rewards and the structure is:

rewards "reward name" component endrewards

The component for state rewards is guard : reward and the component for transitions is [Label] guard : reward. The guard is a predicate over the state variables, Label is the command label in each module, and the reward is a realvalued expression that will assign quantitative measures we care about the states and the transitions that are satisfied with the guard.

In the domain of PLC system, the main properties we care about are the timing and the reliability of the system. So, we define two representative rewards for the model. The first is about the time property. It can be derived from the element T of the transition label L. We add a reward component [L i ] true : T for each transition into the reward. The reward reflects the elapsed time of each transition in the model. The other is a state reward. We associate a number 1 to all the normal states with the reward component S : 1. These can be used to get the long-run availability of the system. We can also define other kinds of reward, such as power consumption of each transition and state.

After we describe the probabilistic model and rewards in PRISM manner, we can analyze some properties of the model. We can specify the properties in PRISM's specification language. We can use the P and S operator to specify quantitative time instant or long-run properties respectively. For example, we can use the following specification to describe the execution state of the PLC system in the long-run (U denote the abnormal state of the system, S denote the normal state of the system):

Property 1: S =? [!U ], the probability that the PLC system is not in failure in the long-run.

We can extend the above property with bounded variant of time. The following two properties specifications describe the reliability of the PLC system in a time period: ,t] !U ], the probability that the PLC system has no error during t time units.

Property 2: P =? [G [0
We can also use the R operator to get the expected value defined in terms of a reward structure. We can get many performance measures of the system. Based on the two rewards defined above, we specify two properties about time: Property 3: R "S"=? [C ≤t ], the cumulative time of the system being in normal states during the t time units. Property 4: R "T "=? [F U ] : the cumulative time of the system passed before the first uncertainty state happens.

CASE STUDIES

We apply our framework to an actual industrial PLC system which was originally published in [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF]. The system is shown in Fig. 4. It consists of three pistons (A, B, C) which are operated by solenoid valves (V 1 , V 2 , V 3 ). Each piston has two corresponding normally open limit sensor contacts. Three push buttons are provided to start the system (switch SW 1), to stop the system normally (switch SW 2) and to stop the system immediately in emergency (switch SW 3). In a manufacturing facility [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF], such piston systems can be used to load/unload parts from a machine table, or to extend/retract a cutting tool spindle, etc.

Piston A is controlled by valve V 1 . When the value of V 1 is 1 and the piston is at the left side, the piston will move from left to the right, and the movement is denoted by A + . When the value of V 1 is 0 and the piston is at the right side, the piston will move back to the left side, and the movement is denoted by A -. We can see that the movement of A will affect the value of sensors (a 0 , a 1 ). Initially, piston A is at the left side and the normally open sensor contact a 0 is closed. Hence, the value of a 0 is 1, a 1 is 0. When V 1 turns out to be 1 at this time, the piston will move to the right side (A + ). Then, the open sensor contact a 0 will break and the sensor contact a 1 will close. Hence, the value of a 0 changes to 0 and a 1 changes to 1, automatically. We can use this property to design ladder programs to control the system.

There are many PLC ladder programs that can be used to control this system. Let us see the example in Fig. 1. The ladder program is the same as the third ladder diagram in [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF]. It contains four ladder rungs, which includes 8 primary Fig. 4. Industrial automated system originally published in [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF] input contacts (SW 1, SW 3, a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ). SW 1 and SW 3 are changed by human operation, the others are automatically changed by movements of the pistons. We can construct an automata model for the operating principle of the PLC system. The state is denoted by the outputs of the ladder. The system has six normal states (S 0 , S 1 , S 2 , S 3 , S 4 , S 5 ), and an uncertainty state corresponding to the all kinds of failure caused by the uncertainty characterization. The six normal states are the states of the Hidden Markov Model. In the Fig. 5, each normal state has some corresponding observations linked by dotted line. In this system, the four states have only one corresponding observation and state S 5 has 3 corresponding observations. The transitions are labeled with the primary input sequences. The time unit for each transition is 1 time unit except that the transition between state S 3 and S 4 is 6 time units. We introduce the control theory of the model with more detail below.

At first, the system is in a blank state named S 0 . In this state, the pistons stay at the left side. So, the values of (a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ) are (1, 0, 1, 0, 1, 0). In the first execution cycle of the PLC system, when the worker press the start switch(SW 1), the system is activated. The values of (V 1 , V 2 , V 3 , T ) are (1, 0, 0, 0). The piston A will move to the right side(A + ). The values of (a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ) change to (0, 1, 1, 0, 1, 0). The second execution cycle, the values of (V 1 , V 2 , V 3 , T ) are (1, 1, 0, 0). The piston B will move to the right side(B + ). The values of (a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ) changes to (0, 1, 0, 1, 1, 0). The third execution cycle, the values of (V 1 , V 2 , V 3 , T ) are (0, 1, 1, 0). The piston A will move back to the left and the piston C will move to the right side simultaneously (A -C + ). The values of (a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ) changes to (1, 0, 1, 0, 0, 1). If we press SW 3, the pistons B and A will move to the left side (A -B -). The fourth execution cycle, since the value of c 1 and a 0 are 1, the timer instruction is activated. In the next five time units, the value for output (V 1 , V 2 , V 3 , T ) will not change. Then, the system will keep static for five time units. At the sixth time units, the values of (V 1 , V 2 , V 3 , T ) are (0, 0, 0, 1). Then, Pistons B and C will move to the left side (B -C -). The values of (a 0 , a 1 , b 0 , b 1 , c 0 , c 1 ) changes to (1, 0, 1, 0, 1, 0). We can build the Hidden Markov Model for the PLC system using the operating principle presented in Fig. 5. The states of the Hidden Markov Model are the normal states in the automata. The transition Label L between two hidden states is also derived from the figure. Element I is the eight primary inputs on the automata label. Element T is the time for each state transition of the original automata. The set of Observations is composed of the content in the rectangle of the Fig. 5. Hence, we can get the matrix A, B for the hidden markov model:

A =         S0 S1 S2 S3 S4 S5
S0 a00 a01 a02 a03 a04 a05 S1 a10 a11 a12 a13 a14 a15 S2 a20 a21 a22 a23 a24 a25 S3 a30 a31 a32 a33 a34 a35 S4 a40 a41 a42 a43 a44 a45 S5 a50 a51 a52 a53 a54 a55

        B =         A + B + C + A -B -C -A -B -A - S0 b00 b01 b02
b03 b04 b05 S1 b10 b11 b12 b13 b14 b15 S2 b20 b21 b22 b23 b24 b25 S3 b30 b31 b32 b33 b34 b35 S4 b40 b41 b32 b43 b44 b45 S5 b50 b51 b52 b53 b54 b55

       
The element a 23 means the probability that the state S 2 transmit to state S 3 . The element b 10 means the probability that we can observe that piston A moves to the right when the system is in state S 1 . The semantic of the other elements are the same.

There is a real-life application that the operating environment of the system is representative of one movement sequence O:

[A + , B + , C + A -, B -C -]
. Hence, we need to solve the matrix A and B using the Baum-Welch algorithm or by simulation to get a maximum P (O|M ). Then, we need to combine the solved Hidden Markov Model M with the uncertainty state caused by the uncertainty characterization. We assume that the sampling error for each primary input contacts is 0.05, and the execution error for each ladder logic unit is 0.3. Using the method in Section 3.1, the uncertainty characterization of the PLC system is 9.80%. That means the system will go into an uncertainty state with probability 0.098 from any normal states. The system will recover to the initial state with probability 0.9 from the uncertainty state. The combined matrix is as follows:

A =         S0 S1 S2 S3 S4 U S0 0
O 3 are [A + , A -], [A + , B + , B -A -] and [A + , B + , A -C + , B -C -]
, respectively. In one thousand observations, O 1 appear 200 times, O 2 appear 200 times, and O 3 about 600 times. Then, we use the Baum-Welch algorithm for multiple observation sequences described in Section 3.3 and combined it with uncertainty characterization as follows:

A =           S0 S1 S2 S3 S4 S5 U S0 0
         
We can describe the model of this example in PRISM as described in Section 3.5. We extend the model with rewards to help us analyze the system. The time property is derived from the time element T of the Markov model transition label L. In addition, we present a reward power for each state. The reward denote the power consumption for valid piston movements in each state.

At last, we can initiate some properties that we care about the system model. The first property is based on the reward oper, and denote the long term availability of the system. The second property is based on the reward time, and denote the first time that it is in failure. The third property is based on the reward power, and denote the valid power consumption during 1000 time units.

-S =? [S < 6] R {"time"}=? [F S = 6] R {"power"}=? [C ≤1000 ]
We can do more experiments on the system presented in [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF]. There are four ladder programs presented in that paper. Although the four PLC programs have the same sampling error and execution error probability, their inner property are different due to different arrangements of primary inputs and logic executions. We set the input sampling error probability to 0.05 and change the value of execution error probability, denoted by ε. Using the method presented in Section 3.1, we can obtain the uncertainty characterization for the four ladder programs in Table 1.

Table 1. Uncertainty Characterization ladder ε = 0.01 ε = 0.05 ε = 0.1 ε = 0.15 ε = 0.2 ε = 0.25 ε = 0.3 ladder1 0.67% 16.87% 13.67% 12.54% 10.23% 8.69% 5.51% ladder2 0.70% 17.63% 13.89% 13.21% 11.82% 10.57% 6.62% ladder3 1.08% 28.04% 25.36% 24.57% 22.03% 21.18% 9.80% ladder4 1.15% 30.13% 26.51% 25.82% 24.65% 22.83% 10.94%

We have also devised random simulations to confirm the correctness of the uncertainty characterization. The values get by random simulations is presented in Table 2. A more visual representation for ladder3 is shown in Fig. 6. In the following, we will show how operating environment affect the performance of one PLC system. We use the example described in Fig. 1, which is also the same as the third ladder diagram in [START_REF] Venkatesh | Comparing ladder logic diagrams and petri nets for sequence controller design through a discrete manufacturing system[END_REF]. We have described two operating environment examples above, which are denoted by two sets of observation sequences. We compare the three properties in these two operating environment with the help of PRISM. The results are shown in Table 3. From Table 3, we can see the long term availability for the second example (env=2) is always better than the first example. The first failure time for the second example come faster than the first one. The total number of valid piston movements for the first operating environment is bigger than the second. A more visual representation is shown in Fig. 7,8,9 (the green line is for the second application environment). We can come to the conclusion that: for the same PLC system, properties of the system are different in different application operating environment.

Conclusion

This paper presents a symbolic framework for the formal analysis of PLC systems. The framework is based on the uncertainty calculation of the PLC system itself and the Hidden Markov Model of the whole PLC system. We solve the Hidden Markov Model by extending the Baum-Welch algorithm or simulation to reflect the particular operating environment of the system's application. With the help of PRISM we can perform probabilistic model checking on the combined Markov Model. The techniques used in our framework allows us to obtain expected performance measures of the PLC system, which are more accurate and closer to the real-world run-time state, by automated analytical means. We can compare the performance of different PLC system designs for an particular application. Our future effort focus on the automatic techniques that transfer PLC into Hidden Markov Model and a more accurate calculation of the uncertainty characterization of PLC.

Fig. 1 .

 1 Fig. 1. A simple ladder

Fig. 2 .

 2 Fig. 2. Validation Process

Fig. 3 .

 3 Fig. 3. Uncertainty Calculation

Fig. 5 .

 5 Fig. 5. work theory

  For a more complex example, whose operating environment is representative of three kinds of observation sequences. The observation sequences O 1 , O 2 , and

Fig. 6 .Fig. 8 . 9 .

 689 Fig. 6. uncertainty simulation Fig. 7. Long-term availability

Table 2 .

 2 Uncertainty Characterization By Random Simulation ladder ε = 0.01 ε = 0.05 ε = 0.1 ε = 0.15 ε = 0.2 ε = 0.25 ε = 0.3 ladder1 0.69% 17.02% 13.82% 12.66% 10.29% 8.75% 5.54% ladder2 0.74% 17.82% 14.05% 13.35% 11.91% 10.63% 6.67% ladder3 1.12% 28.22% 25.51% 24.71% 22.14% 21.27% 9.89% ladder4 1.21% 30.37% 26.68% 25.98% 24.78% 22.95% 11.16%

Table 3 .

 3 Property Results

	property env U=0.01 U=0.03 U=0.05 U=0.07 U=0.09 U=0.1 U=0.15 U=0.2 U=0.25
	oper	1 0.989 0.968 0.947 0.928 0.909 0.900 0.857 0.818 0.783
	oper	2 0.990 0.971 0.952 0.934 0.917 0.908 0.868 0.830 0.795
	time	1	233	98	43	32	27	21	18	8	6
	time	2	198	73	38	30	23	21	13	9	7
	power 1 1462	1391	1325	1261	1200 1171 1032	908	797
	power 2 1234	1181	1130	1081	1034 1011	903	804	714

5 This research is sponsored in part by NSFC Program (No.91018015, No.60811130468) and 973 Program (No.2010CB328003) of China.