Maria Di Mascolo
email: maria.di-mascolo@g-scop.grenoble-inp.fr

Alexia Gouin
email: alexia.gouin@gipsa-lab.grenoble-inp.fr

A generic simulation model to assess the performance of sterilization services in health establishments

Keywords: Modeling, Discrete Event Simulation, Performance, Process improvement, Comparison, Sterilization service

The work presented here is with a view to improving performance of sterilization services in hospitals. We carried out a survey in a large number of health establishments in the Rhône-Alpes region in France. Based on the results of this survey and a detailed study of a specific service, we have built a generic model. The generic nature of the model relies on a common structure with a high level of detail. This model can be used to improve the performance of a specific sterilization service and / or to dimension its resources. It can also serve for quantitative comparison of performance indicators of various sterilization services.

Introduction

A major challenge facing hospitals is to provide efficient medical services.

In this paper we focus on the organization of sterilization services of health establishments. These services, which have received very limited coverage in the literature, have a great impact on the overall efficiency of the health care system. In France, sterilization has evolved in recent years, moving from an activity performed in the annex of the operating rooms to an activity performed in real hospital specialized medico-technical services.

Sterilization in health establishments

Sterilization consists in eliminating or killing the micro-organisms conveyed by contaminated medical devices. A medical device (or MD) is an instrument, apparatus, appliance, or any other article, which is used for medical purposes on patients in diagnosis, therapy or surgery. We are concerned, in this paper, with MDs which have to be sterilized after utilization, in order to be re-utilized. Sterilization of MDs is an essential activity for proper functioning of care and examinations and is expensive (for example, sterilizing 0.5m 3 of medical devices costs more than 250 euros for our case study).

Sterilization is mainly a manual activity. Indeed, most of the nine steps of this activity, illustrated in Figure 1, are performed manually: utilization, pre-disinfection, checking devices, packing, transfer and storage are always performed manually, while rinsing and washing are sometimes performed manually. Concerning quality and safety aspects, sterilization is subject to numerous requirements. In France, it is both regulated and restricted, particularly by a guide of good practices [START_REF]Bonnes pratiques de pharmacie hospitalière[END_REF]. However, considerable leeway is left with respect to organizational aspects.

In a sterilization process, the largest flow of finished products (consisting of reusable sterile MDs) is re-injected in the process after its utilization in the operating room. When we integrate the utilization step, the sterilization process changes to the sterilization loop given in Figure 1. The utilization step corresponds, for an MD, to its passage through the operating room, and to the opening of the packing that contained it. The pre-disinfection step makes it possible to reduce the population of micro-organisms present on the soiled equipment. The aim of this step is to protect the staff during MDs handling before washing and to facilitate washing (see [START_REF] Standard | Stérilisation des dispositifs médicaux -Guide pour la maîtrise des traitements appliqués aux dispositifs médicaux réutilisables[END_REF] for more details). The rinsing step can be carried out manually or in washers. Washing aims at eliminating stains to obtain a clean medical device. After washing, the MD is checked to ensure that no deterioration is likely to affect its security, integrity or proper operation. Packing represents a barrier impervious to micro-organisms and is carried out as soon as possible after washing. The arrangement of devices in the packing must allow good penetration of the sterilizing agent and aseptic extraction of each sterile medical device. MDs are packed into bags or containers. Several MDs can be placed in the same container. For each surgical operation, the medical staff usually use several bags and containers. In France, sterilization is generally performed by saturated steam in autoclaves. The transfer op-ste 1 , carried out during the pre-disinfection step, corresponds to transfer of soiled MDs from operating rooms down to the sterilization service. The transfer ste-op 2 corresponds to transferring sterile MDs from the sterilization service to the storage area in the vicinity of operating rooms. Some thirty years ago, the guidelines to be complied with in hospitals were to put MDs into sterilizers before reutilization. No procedure, however, was available, and in actual fact some equipment was added to the sterilizer during a sterilization cycle. With the evolution of standards and regulations in France, we changed in the space of a few years from utilization of a machine (sterilizer) to the management of a complex process (sterilization). This activity, which was performed close to each operating room (and thus decentralized) is now performed by a separate service, often centralized, when sterilization is performed by the establishment. The French Department of Health has published a document [START_REF]Bonnes pratiques de pharmacie hospitalière[END_REF] in which it recommends the centralization of this service, taking into account that pooling of resources and expertise ensures quality. The first centralized sterilization service emerged in Europe in the early 1960s [START_REF] Galekop | Sterilization. Past and Future[END_REF].

Our contribution

We are concerned here with improving the organization of a centralized sterilization service, using discrete event sim- 1 op-ste: operating rooms-sterilization service 2 ste-op: sterilization service-operating rooms ulation. Our first contribution is to propose a generic simulation model, able to represent any sterilization service in a French health establishment. This model can be used with detailed or global data. We illustrate these two ways of utilization. The first case is an application of the model to a case study, for which we could collect detailed data; we propose and test some improvements in the organization. The second case concerns a case study for which we could obtain only global data for sterilization services in several hospitals; our model is then used to compare the performance of these sterilization processes.

One of our simulation goals is to quantify, in a global way, the possible improvements obtained by changing some organizational aspects. These changes can be related, for example, to the loading policies for washers or autoclaves, to the staff schedule, or to the opening time of the service. Decision-makers in sterilization services are usually more aware and concerned with quality, safety and traceability aspects than with organizational aspects. Simulation is thus a decision-support tool for these people, who are not particularly aware of production management issues. They can use this assessment improvement as an argument, in discussions with hospital management, or operating room staff. The sterilization activity is so strategic that one cannot afford to try out new organizations without knowing in advance whether or not they will result in improvements. Also, simulation allows us to test several organizations and to analyze the decisive key parameters helping increase efficiency of sterilization services. This paper is organized into six sections including the present introductory section. In Section 2, we give a literature review, while Section 3 deals with the generic model. After explaining what motivates the construction of such a model, we present the structure and the data necessary for its functioning. In Section 4, we use our model to study a real case in detail. We describe modeling and the data used before discussing the identified malfunctions and the proposed solutions. In Section 5 we use our model to compare the performance of several sterilization services, for which we could obtain global data via a survey. After explaining how we validated the generic model, we indicate which data we have obtained, carry out some comparisons, and illustrate the influence of the washer loading policy on the performance of the sterilization service. The last section contains our conclusions and future issues.

2 Literature review 2.1 Use of discrete event simulation in health care literature Simulation is a useful tool for assisting management in evaluating different operational choices. It can be used to improve existing services or to assist in planning or designing new services. Numerous papers have been published in the literature combining organizational problems in health care systems and discrete event simulation, as can be seen in the following review papers [START_REF] Fletcher | What is a 'generic' hospital model? -a comparison of 'generic' and 'specific' hospital models of emergency patient flows[END_REF], [START_REF] Fone | Systematic review of the use and value of computer simulation modelling in population health and health care delivery[END_REF], [START_REF] Jun | Application of discrete-event simulation in health care clinics : A survey[END_REF], [START_REF] Sobolev | Systematic review of the use of computer simulation modeling of patient flow in surgical care[END_REF]. The authors usually study a limited part (or service) of the hospital, and try to evaluate and improve the following parameters: time spent by the patient in the service studied, staff utilization or room utilization, bed occupancy, queue length, etc. Improvements can be obtained by changing staff level, bed number or bed allocation to specialties, the number of operating rooms, the scheduling policies, etc. These reviews comply with different approaches. The paper by Jun et al [START_REF] Jun | Application of discrete-event simulation in health care clinics : A survey[END_REF] classifies papers published from 1979 to 1999, according to the aims of the proposed models, into two categories: patient flow and resource allocation. The paper by Fone et al [START_REF] Fone | Systematic review of the use and value of computer simulation modelling in population health and health care delivery[END_REF], aims at assessing the extent and the quality of papers published from 1980 to 1999 and divides publications into four categories: hospital scheduling and organization, infection and communicable diseases, costs of illness and economic evaluation, and finally screening. Fletcher and Worthington [START_REF] Fletcher | What is a 'generic' hospital model? -a comparison of 'generic' and 'specific' hospital models of emergency patient flows[END_REF], classify papers on emergency patient flow published from 1978 to 2008, according to the kind of models that are presented: generic (this model is developed for multiple use by any providers of the same service) or specific (this model is developed for a particular service and is not necessarily transportable to another provider of the same service). Finally, Sobolev et al [START_REF] Sobolev | Systematic review of the use of computer simulation modeling of patient flow in surgical care[END_REF] studied papers from 1975 to 2009 on simulation models for the flow of surgical patients, with the aim of identifying existing approaches and their usefulness for policy analysis related to the delivery of surgical care.

As we saw above, simulation is widely used in health care, especially for modeling patient flow through different hospital departments. There is a growing list of applied case studies in the literature. We give below some recent examples of such studies.

Fletcher et al. [START_REF] Fletcher | The DH Accident and Emergency Department model: a national generic model used locally[END_REF] and Sinreich and Marmor [START_REF] Sinreich | A simple and intuitive simulation tool for analyzing emergency department operations[END_REF] are concerned with the modeling of emergency department with generic models. Fletcher et al. [START_REF] Fletcher | The DH Accident and Emergency Department model: a national generic model used locally[END_REF] present a generic simulation model for a typical English Accident and Emergency Department developed to understand patients flow. They, then present local application of their model and the obstacles encountered. Sinreich and Marmor [START_REF] Sinreich | A simple and intuitive simulation tool for analyzing emergency department operations[END_REF] want to develop a general simulation tool (that is to say not hospital or setting dependent), which is flexible, intuitive, simple to use and which contains default values for system parameters. Their tool is developed for health care managers. Their aim is to increase management's involvement in developing simulation models in order to increase management's confidence in the models.

VanBerkel and Blake [START_REF] Vanberkel | A comprehensive simulation for wait time reduction and capacity planning applied in general surgery[END_REF] are concerned with surgical settings and consider capacity planning and wait time reductions. Reynolds et al [22] present a discrete event simulation study of the hospital pharmacy for outpatients at two London Hospitals. They conduct three sets of experiments: variations in prescription workload, changes in staffing levels and skill-mix, increasing robot utilization. They study their impact on mean prescription turnaround time and on the percentage of prescriptions completed in at most 45 minutes. Rohleder et al [START_REF] Rohleder | Using simulation modeling to improve patient flow at an outpatient orthopedic clinic[END_REF] use discrete event simulation modeling in order to study and improve patient flow at an outpatient orthopedic clinic in Calgary (Canada). The improvements are a reduction in waiting time and congestion in the clinic, thus lowering patient dissatisfaction and improving staff morale. Another contribution of this paper is to show how their study can help convince decision makers to implement the proposed improvements.

From this literature review, it is apparent that there are many applications of simulation in healthcare. However none of the published papers deals with the simulation of a sterilization service, which is our concern.

Literature on sterilization services

In the sterilization field, papers usually focus on the sterilization process and on the rules to be complied with in order to ensure sterility of MDs, see [START_REF] Rutala | Disinfection and sterilization in health care facilities: What clinicians need to know[END_REF] for example. They may also deal with current practices such as in [START_REF] Smyth | Sterilization and disinfection in general practice in Northern Ireland[END_REF] which presents the results of a survey conducted to assess the level of knowledge of sterilization and disinfection and the use of benchtop sterilizers in general practice in Northern Ireland. Some papers are concerned with organization of the sterilization activity: choice between a centralized or decentralized activity and whether or not to outsource the activity (see [START_REF] Cocquard | Sous-traitance industrielle de l'activité de stérilisation : vraie solution ou fausse alternative ?[END_REF] or [START_REF] Giarraputo | In-house versus off-site sterilization[END_REF] for example). In this paper, we focus on the sterilization activity when it is performed by the hospital in a centralized sterilization service.

Note that very few papers deal with organization of a sterilization service in the literature. We can cite Reymondon and Marcon [START_REF] Reymondon | Optimization of the hospital sterilization costs acting on grouping choices of medical devices into packages using the simulated annealing method[END_REF], who study the improvement in performance of a sterilization service using a packing policy that optimizes the cost of storage and release of MDs. They propose a mixed solution between two extremes, namely "a container for a surgical operation" and "a container for a medical device". Reymondon et al. [START_REF] Reymondon | Optimization of hospital sterilization costs proposing new grouping choices of medical devices into packages[END_REF] propose a new methodology to reduce storage costs. In their opinion the previous methodology is not sufficiently efficient to solve a large problem because its execution time is unacceptable.

They therefore decided to reduce the complexity of the problem and to restrict their study to MDs, which may serve various types of surgical operations and not consider MDs dedicated to a specific type of surgery. Another paper dealing with cost reduction, when redesigning the sterilization process has been published by van de Klundert et al [START_REF] Van De | Optimizing sterilization logistics in hospitals[END_REF]. Authors are concerned with transportation cost, operating room storage cost, and medical device cost, which, in their opinion, are the three major costs when outsourcing sterilization activities. Using ILP, they optimize composition of MD containers, storage capacity, and MD delivery moments in order to reduce cost. Other papers are concerned with optimizing washing resources in the sterilization service. Albert et al. [START_REF] Albert | Analyse de différentes stratégies de remplissage des laveurs dans un service de stérilisation de dispositifs médicaux[END_REF] seek to maximize the efficiency of the washing step by providing different rules for loading washers. Their goal is to minimize both the number of launched cycles and the time spent by MDs before washing. Ozturk et al. [START_REF] Ozturk | Makespan minimization on parallel batch processing machines with non-identical job sizes and release dates[END_REF] aim to minimize the total duration of washing. The problem is studied as a batch scheduling problem where MDs used for a surgical operation are considered as sets which may have different sizes and different release dates. They provide and experiment a mixed integer linear programming model together with some heuristics based on classical bin packing algorithms. In another study [15], they aimed at minimizing the sum of MD set washing completion time, using once again a linear programming model and a heuristic.

One reason why we find so few works on optimization of sterile logistics in literature may be that, in hospitals, for sterile logistics, the focus has always been on the reliability of the process, rather than on cost control. Nowadays hospitals are under pressure to become more effective and to cut costs, resulting in increased attention to optimizing sterile logistics. The literature review above shows that some recent papers have appeared in the literature on this subject. However none of them deals with simulation of the sterilization service, which is the purpose of our paper.

3 Generic model

Motivation and context

Our goal is to build a generic model, which, on the one hand, can be used for several sterilization services and, on the other, can function without requiring lengthy collection of data within a sterilization service. This model can be used to test a variety of choices such as loading policies or number of working posts, or be used to compare performance of several sterilization services. It can also be used for dimensioning the resources of a sterilization service (number of washers, staff, etc.), when not all data are accurately known.

The model we propose belongs to the third level among the four levels defined by Fletcher and Worthington [START_REF] Fletcher | What is a 'generic' hospital model? -a comparison of 'generic' and 'specific' hospital models of emergency patient flows[END_REF], depending on the generic nature of the models and illustrated Fig. 2 Levels of simulation models according to Fletcher and Worthington [START_REF] Fletcher | What is a 'generic' hospital model? -a comparison of 'generic' and 'specific' hospital models of emergency patient flows[END_REF] in Figure 2: the first level, referred to as the "generic principle" is the most generic and can model any system and scenario. The second level, referred to as the "generic framework" is used to model, for the same sector (e.g. the hospital field), different kinds of services for various establishments. The third level of this classification, referred to as the "generic model", is a model designed for a kind of service that can be used by several suppliers, for example the sterilization service for establishments in the Rhône-Alpes region. The fourth level, referred to as the "specific model " is the least generic, as each model is designed for a given system, for example the sterilization service of establishment X.

To build such a model, we conducted a survey in health establishments in the Rhône-Alpes region, France. This survey informed us of what is common to the various services, and what is different. This survey was carried out in 2007 in the 2E2S project, which was conducted by a team of researchers from three research laboratories in the Rhône-Alpes region (LASPI, G-SCOP, GIPSA-Lab) and CERCLH (Center for Research and Skills in Health Care Delivery) (see [START_REF] Reymondon | Etat des lieux des pratiques de stérilisation hospitalière en Rhône-Alpes[END_REF] for details). The survey was based on an on-line questionnaire. This questionnaire was sent to 75 establishments belonging to the categories "public establishments", "private establishments" and "private establishments participating in the public hospital service". Out of the 39 health establishments who answered, only 23 have a centralized sterilization service. In the survey, all the collected information deals with the service activity and organization. This information is provided by answers to yes/no questions, to quantitative questions, to multiple choice questions, or com-ments. The electronic survey is divided into 6 parts, and contains 90 questions:

-Part 1 "Preliminary information": 10 questions concerning general information on the establishment and service (name, address, public or private establishment, number of beds, number of surgical operations, internal or external sterilization, centralized or non centralized sterilization service, etc). -Part 2 "General": 6 questions concerning the general activity (creation date, activity volume, average number of autoclave cycles per year, etc). -Part 3 "Schedules": 7 questions concerning the operating rooms and sterilization service schedules -Part 4 "Material resources" : 22 questions concerning the equipment for all steps in the sterilization process, such as rinsing, washing, packing, and sterilization by autoclave (number of workstations, capacity, etc). -Part 5 "Human resources": 13 questions concerning various aspects of human resources (number, guards, penalties, etc). -Part 6 "Sterilization process": 32 questions concerning the organization of the sterilization process (details on the pre-disinfection step, whether or not rinsing is manual, how MDs are washed, loading rules for washers and autoclaves, estimated duration for the sterilization of a container, for an urgent treatment, state of the non treated MDs at the end of the day, performance goals, etc) .

This survey allowed us to draw up an inventory of the practices implemented in the sterilization services in the Rhône-Alpes region. Reference [START_REF] Reymondon | Etat des lieux des pratiques de stérilisation hospitalière en Rhône-Alpes[END_REF] analyzes the answers given by hospitals which have a centralized sterilization service. We provide hereafter some of the observations that were made. The first observation is that these services use a relatively similar structure for implementing the sterilization process, with some variants. Sterilization services usually have between 2 and 5 washers. The capacity of each washer varies between 4 and 17 DIN baskets (standard volume equivalent to 480x260x50mm). We observed that, for similar volumes of activity, the total capacity of the washers can vary from simple to double. A washing cycle starts with a rinsing stage in 81% of services. 73% of sterilization services also perform manual rinsing of the MDs before placing them in washers. 57% repeat the rinsing process. Washers waiting time can be long. Manual rinsing allows MDs to wait for washing without pointlessly undergoing the corrosive effect of the pre-disinfecting product. The loading policy of washers is not the same for each service. Most try to maximize the washer load (55%). The others use other policies, such as minimizing the upstream work in progress for 35%. This survey also allowed us to obtain quantitative data. Some of these data, which are used in our simulation model, are shown in table 5. Other data, which are compared with simulation results are shown in table 7.

To use our generic model for several sterilization services, a first idea could be to build our generic model with a low level of detail on the structure. In this case, a sufficient number of validation measurements should be performed. We should also be aware that the level of detail must be taken into consideration in the analysis, as stated in [START_REF] Persson | The impact of different levels of detail in manufacturing systems simulation models[END_REF].

The results of the survey, together with our visits to several sterilization services, enabled us to identify the different possible configurations for the sterilization process steps. From there, we could propose a general structure for the services, which includes all these different configurations, and which we denote by "generic structure". In our case, there is no point in building a generic model with a low level of detail on the structure. We thus abandon our initial idea. This general structure will be used in our generic model.

A second idea is then to build our generic model with a high level of detail on the structure, but with a low level of detail on the input.

Our target goal is to model common processes. However, we aim at a model flexible enough to take into account some local process differences through input data. Consequently, our model belongs to level 3B of the second classification proposed by Fletcher and Worthington [START_REF] Fletcher | What is a 'generic' hospital model? -a comparison of 'generic' and 'specific' hospital models of emergency patient flows[END_REF].

In sterilization services a large number of data are computer recorded, but the data recorded are data useful for tracking purposes. However, with these data we cannot acquire the duration of manual steps, which is necessary for our model. Collection of missing data was a very time consuming task for the specific sterilization service that we modeled. Therefore, for our generic model we will include default values for system parameters. Default values will be changed to real values when they are available.

Structure of the model

The model presented here focuses on the actual production of sterile medical devices. Compared to the sterilization loop, we exclude the use of MDs in operating rooms, storage before use, and the transfer ste-op. The checking step is included in the rinsing and packing steps, as was observed in sterilization services. Our model thus contains the main steps of the sterilization loop, namely pre-disinfection, rinsing, washing, packing and sterilization, which take place in the sterilization service. Its structure is given in figure 3.

Note that, in this model, we make the following assumptions as to the MD flow, in order to eliminate some specific cases.

-Assumption 1. We choose to consider only the re-usable flow of MDs because it is clearly the majority (93% of MDs with priority are taken first in the buffer, but their presence does not result in blocking the flow of other MDs. A MD with priority waits in the buffer only until a workstation is available. -Assumption 3. Loading and unloading times of the washers and autoclaves are included in the storage time. -Assumption 4. Pre-sorting, which allows each MD to be re-associated with its packing, before the packing step, is not taken into account because it is in fact marginal. -Assumption 5. We choose to consider only automatic washing (in our investigations, we obtained insufficient information on manual washing).

Once we have defined the different model steps, we have to identify the entity circulating within these steps. To do this, note that several MDs are used for one given surgical operation. After the surgical operation, they are then all transferred to the sterilization service (pre-disinfection and transfer step in figure 3). Thus, all the MDs used for one given surgical operation can be considered to be a set of MDs. At the model input, upstream from the washers, we choose to consider an entity which we call "operation" and which represents the set of containers and bags used for one given surgical operation. The choice of this entity ensures that all the containers and bags used for a given surgical operation are washed together, in the same washer, thus enhancing traceability and facilitating the carrying out of the following steps. After the washing step, the "operations" are divided into containers and bags. Note that we simplify the sterilization step by assuming that we load autoclaves only with containers (we replace the bags by equivalent containers: thanks to the detailed data we were able to obtain for our case study, we can set an equivalence, in terms of volume, between six bags and one container). The entities flowing in the sterilization service can be processed one by one, or by batch, depending on the considered step. An operation is processed in the pre-disinfection and transfer, and rinsing steps; a batch of operations is processed in the washing step; a container (or a bag) is processed in the packing step; and a batch of containers and equivalent containers is processed in the sterilization step (see figure 3).

Buffers are present between the various steps, and their capacity is assumed to be infinite (i.e. large enough to avoid blocking, as was observed in all the sterilization services we visited).

Modeling of local process differences

Rinsing

This step is manual in many services but not in all. Manual rinsing is nevertheless a step in our generic model. To model a process without manual rinsing, we set the number of workstations to 0.

Washing

We have seen that the washers process the entities by batch (operations). The survey and our visits enabled us to observe that the batch building processes, or loading policies, vary from one sterilization service to another. For example, some establishments use rules based on a filling threshold (i.e. they try to maximize machine load, by launching the machine when a given filling threshold is reached), while others use rules based on a waiting time threshold (i.e. they try to minimize the upstream work in progress, by launching the cycle after a given time threshold). In our model we choose to take into account the fact that different rules can be used by the studied service, and we thus consider variable loading policies. We implemented the two simple rules described above, together with one simple variant of the first one. Note that only one rule can be used at a time for each simulation run. These rules are applied in an environment in which the entities (operations) arrive at the washing buffer, at unknown instants, and we try to limit the number of decisions to be made by the operators. The rules are implemented using a VBA (Visual Basic) module in Arena, which is executed only when some given events occur:

when a new entity arrives at the washing buffer when a washer becomes available When executed, the VBA code scans the content of the washing buffer. If some conditions are verified (filling threshold, or waiting time threshold), it chooses the entities to be loaded in the available washer(s), with respect to the capacity of the washer(s), and according to some rules, that are different from a case to another. The created batches are then transfered to the washing area, where the washers are launched. We give below a description of the different implemented rules for the batch creation and for the launching of the washers:

case 1: filling threshold (L) -FIFO

We define a filling threshold equal to a level L%.Then, the washer is loaded and launched as soon as the volume of the waiting entities in the washing buffer reaches L% of the washer capacity (if a washer is available, of course). A FIFO (First In First Out) rule is applied for loading the washer with the waiting entities. In order to avoid blocking, if the filling threshold is not reached, and if the following entity is too big, then the cycle is launched. case 2: waiting time threshold (Tmax) -FIFO

We define a waiting threshold equal to Tmax minutes. Then, as soon as at least one waiting entity has waited for at least Tmax minutes, the washer is loaded with this (or these) entity (ies). Other entities are added using a FIFO rule, and a cycle is launched.

A possible improvement when optimizing the washer load, could be to sort the waiting entities, instead of taking them in the FIFO order. We propose to use a First Fit Decreasing policy on their size, instead of using FIFO policy, which leads to a new case:

case 3: filling threshold (L) -FFD It is the same as in case 1, but the waiting entities are sorted according to their size (in a decreasing order). If the filling threshold is not reached, but the following entity in the list is too big, we consider the next ones, until we find one which fits in the washer.

Our model can thus be used to compare the effect of loading policies on the performance of a given service, as illustrated in section 5.4. Note that we implemented here some simple rules, which can easily be applied by operators, without any computer. Of course, other more sophisticated rules, enabling to optimize given criteria, such as the duration of washing, or the waiting time at washers, could be included in our model.

Autoclave

As the washers, autoclaves process the entities by batch (containers). The same policies as those described above are implemented for the loading of the autoclaves

Required data

In the above section, we proposed a model structure that can be used to assess the performance of various sterilization services, by changing the input data. The data required for this assessment are given in the following list:

-The number of washers, autoclaves, and workstations for pre-disinfection and transfer, rinsing, and packing steps -The capacity of each workstation -The duration of each step -The service discipline for each step -The batch building process for the washers and autoclaves -The arrival process -The staff schedule Out of the above data, the number of workstations for each step and their capacity is usually easy to obtain for the studied services and varies from one service to another.

Concerning duration, we have to determine its average value and its distribution. For the washing and the sterilization steps, which are non manual steps, the duration of a cycle is constant and depends on the studied service. Moreover, machine failures are rare and do not need to be taken into account. We thus consider a deterministic distribution. The other steps are manual, thus possibly leading to some variability in their duration. When we want to apply this model for a given service, we can conduct a statistical study on detailed data to identify the most appropriate distributions for the various durations (as in the case study of section 4). If it is not possible to collect detailed information, we can use the distributions we propose in section 5.

The service discipline used for each step is usually FIFO. Concerning the arrival process, the operations arrive at the sterilization service in batches of variable sizes, at variable times. If we want to apply the model to a given service for which we have enough information, we can use real data (as in the case study of section 4), and we obtain thus a specific model. Otherwise, we can build a profile based on a standard arrival profile obtained from our case study, as illustrated in section 5. A similar arrival profile has been observed in another sterilization service we could also study into details.

With regard to staff planning, it is usually easy to identify the total number of persons working in the service. However it may be difficult to identify the distribution of these persons among process steps during the day, since this usually changes from one day to another. Consequently, for our model, we propose using a constant work potential throughout the day.

Possible uses of our generic model

The model we described above can be used in several ways, according to the kind of data available.

When detailed data, for one or more sterilization services, can be collected, the model becomes a specific model and can be used in order to:

acquire better knowledge of the service(s) behavior, compare the performance of different services, improve the organization of the studied service(s), by testing the impact of different strategies on the performance parameters, determine organization and setting of variables that produce the best values for given performance parameters.

When only some global data, for one or more sterilization services, can be collected, we cannot calculate all the performance parameters, as before. For example, it is not possible to know in detail the buffer level at each moment, or the time spent in each buffer, if we only consider a constant work potential, and not a detailed staff schedule. Bearing in mind these limitations, we can use our model in order to:

compare performance of different services, track improvement trends for organization of the studied service(s)

Finally, it is possible also to use the model to represent a typical sterilization service, rather than a specific one. The data used would then be taken equal to the values that are most frequently encountered in the survey. With this type of model, you can test the influence of the local process differences we have identified in section 3.3.

In the remainder of this paper, we illustrate three of these possible uses on case studies. The first case study, presented in section 4, concerns a specific sterilization service, for which we were able to collect all the data we needed. We were then able to use our model with detailed data. Once validated, this model with detailed data can serve as a reference for the validation of our model instantiated with only few non detailed data. This is what has been carried out in section 5, in which we show how the model presented above can be used for:

comparing several sterilization services for which a survey allowed us to obtain data studying the influence of the implemented loading policies on the performance of one of these sterilization services.

For all the simulation tests, we used ARENA software.

4 Case study 1: one specific sterilization service with detailed data

Modeling

In this section, we are concerned with a given sterilization service (in a private health establishment in France), for which we collected all the data required. The generic model becomes then a specific model and is used to detect some malfunctions in the studied service, and to test some proposals for improving performance. For this purpose, we use a model as similar as possible to the observed organization.We then validate our model according to several criteria, such as the number of washer cycles and the number of autoclave cycles. Finally, we test several scenarios for the input parameters and for the staff schedule, and we compare the model performance obtained for each scenario.

In our case study the use step corresponds to 14 operating rooms. At most only one person is in charge of rinsing the medical devices. At most only one person is in charge of loading the four washers. Several people work in the packing step; the number varies in the course of the day. The MDs are sterilized in one of the three autoclaves. One person is in charge of both bag packing and autoclave loading/unloading.

We could obtain the following quantitative data on the process thanks to the hospital data base (OPTIM software). For each container or bag, we thus know:

the washer used for its washing the washing time the autoclave used for its sterilization the sterilization time the packing duration (including the time spent in the buffer)

For washing and sterilization durations, the values are deterministic. For the packing and rinsing steps, we estimated duration by measuring the time needed by the operators during a few days. We decided to use a deterministic distribution for the rinsing steps (8 minutes by operation) and the bag packing steps (1 minute by operation), plus a normal distribution with positive values for the container packing step (average of 21.1 minutes by container), see [START_REF] Ngo Cong | Etude et amélioration de l'organisation de la production de dispositifs médicaux stériles[END_REF] for details. These values result in a mean sojourn time close to the real one. Sojourn time is defined as the time spent between the beginning of the pre-disinfection step and the end of sterilization in the autoclave.

The data corresponding to the arrival process are not stored in the hospital data base. We collected them by means of "linking" forms: each form is associated with a surgical operation and allows data to be transferred between operating rooms and the sterilization service. The information transmitted in this way is, for each operation, the start time of pre-disinfection, the time of arrival at the sterilization service, and its composition (in bags and containers).

Finally, we obtained complete information on the staff schedule, in terms of who works, at what time, at which workstation, on which day. The schedule for each person changes from one day to another. We decided to define a typical schedule for one day, taking average values. This schedule gives, for each time period within a day, the number of persons available for each step.

The data used are presented in Table 1.

In the morning, during the first opening hours of the service, no operation enters the sterilization service. The work therefore focuses on the packing and sterilization steps of the operations that arrived and were washed the day before. There is thus no rinsing workstation, nor washing workstation in the early morning, which is why the number of workstations may be zero in table 1. Later in the day, when washing is carried out in the service, all four washers are used. Between one and four packing workstations are present during the day. For example, one workstation is present between 9 am and 11 am but four workstations are present between midday and 8 pm.

Validation

To validate our model with detailed data, we check whether it behaves like the real system. To do this, we simulate 100 working days and compare with real data the results obtained by our simulation. The simulation results are obtained within a few minutes. We use two validation criteria: the daily mean number of washer cycles, and the daily mean number of autoclave cycles (see table 2). We note that the simulation results are similar to actual results. When the values are rounded, we obtain the same number of washer cycles and the simulation generates one autoclave cycle less. We consider that our model is accurate enough to be used to study the impact of different parameter changes on the performance of the sterilization service.

Identified malfunctions

The simulation model described above allows us to highlight some malfunctions related to service management (see first line of table 3), and to show improvements that could be obtained by making some modifications, which we propose, to the organization (see table 3). Some of the malfunctions observed are described below:

the pre-disinfection step is too long for almost a third of the operations. The ideal duration of pre-disinfection is about 15 minutes. While the majority of containers have an acceptable pre-disinfection duration, we know that some of the MDs remain in the pre-disinfecting product for more than 50 minutes, which is too long. Such a long pre-disinfection duration should be avoided as the disinfecting product attacks the material, thus causing premature aging; the workload is not regularly distributed over the day.

We will not change the operating room schedule, but we can arrange a more regular input of MDs to limit the arrival of large batches of operations; around 12 % of MDs are sterilized the day after their use. Note that, in the initial situation, the last MDs enter the service between 6 pm and 7 pm. Moreover, the activity stops at 8 pm for the rinsing workstation and for the washing workstation, and at 10 pm for the packing workstation and for the sterilization workstation. Therefore a large proportion of the MDs that arrived at the sterilization service in the late afternoon spend the night in one of the sterilization service buffers (usually in the packing or sterilization buffer).

To improve the performance of the studied service, we are particularly concerned with reducing the pre-disinfection duration and the sojourn time of MDs in the sterilization service. Such improvements can be obtained either by modifying flow creation (action on pre-disinfection duration), or by changing sterilization service management (change of staff schedule).

Proposed improvements

We first focus on the pre-disinfection step. We try to reduce the number of MDs for which the pre-disinfection step is too long, and to smooth the arrival of containers. In the studied sterilization service, the containers enter the sterilization service "randomly". They are transferred when the employee has time, since this is not his/ her main activity and no control policy is applied. The average interarrival time between two successive operations is 17 minutes with a minimum equal to 0 and a maximum equal to 85 minutes. Our idea is to set up a periodic transfer of the trolleys from the operating rooms down to the sterilization service. That is to say, we ask an employee in the operating rooms to move all the trolleys containing dirty MDs down to the sterilization service each x minutes. For simulating that, we considered the real values for the ending time of the operations. We calculated the number of bags and containers utilized within each considered interval, and took these values for our new regular arrival distribution. Here, we chose to use a distribution of exactly x minutes (which is not realistic, but simpler to implement), in order to show that there is an improvement. Note that an extension could be to implement a distribution around x minutes in order to quantify this improvement in a more realistic way. This policy is simulated for four different values of x: 40 minutes, 35 minutes, 30 minutes and 20 minutes. We then present the impact of this policy on the sojourn time (given in minutes), on the duration of the pre-disinfection step (given in minutes) and on the number (and proportion) of operations that are pre-disinfected for more than 50 minutes (see table 3). In table 3 we also assume (see last line) that each trolley is transferred to the sterilization service as soon as the pre-disinfection step starts. Although this is the ideal case, it is rather difficult to set up. Note also that when a trolley enters the sterilization service, it moves to a buffer, and will leave this buffer when the duration of the pre-disinfection step is greater than or equal to 15 minutes and as soon as the person responsible for rinsing is available to rinse it. The first line in table 3 (referred to as the "initial situation") corresponds to a simulation performed with the current organization of the hospital being studied (we use the data in the "linking" forms to know when an operation enters the sterilization service). With a periodic transfer, we see that even if the length of time is great (40 minutes) all the results are improved: for the sojourn time we gain around 30 minutes, while for the pre-disinfection duration we gain around 8 minutes. Also the proportion of operations for which the pre-disinfection step is more than 50 minutes is better, compared to the current situation. The best case is for 20 minutes: the sojourn time of MDs drops by 6% and the number of operations for which the pre-disinfection step is more than 50 minutes drops by 80%. Results are good even when the employee transfers the trolley every 30 minutes since the average duration of the pre-disinfection step drops below 30 minutes.

When we reduce the pre-disinfection duration of an MD, we reduce its premature aging, thereby increasing its life. Since MDs are usually expensive, this approach may allow a significant financial gain. Note that this regular transfer has not been implemented in our case study, since the decision has to be taken by the operating room staff, and for them it is seen only as a constraint, without visible benefits. Such a regular MD transfer has been observed however in other sterilization services.

We then focus on the staff schedule and on the opening period of the sterilization service. Our aim is to reduce the number of MDs that are not sterilized at the end of the day. In our model, the staff schedule corresponds to an average calculated from the initial staff schedule of our case study (note: the schedule changes from one day to another). We try to reduce staff during periods of low activity, and increase staff when activity is highest, as well as to add some people in the evening to improve system performance. Periods of high and low activity are not simultaneous in all process steps. We studied the size of the stocks located immediately before each step at different times of the day to identify peri- ods of low and high activity for these steps. Note that for this new schedule we first prepare shift schedules, in order to obtain a larger opening duration (until 2am instead of 10 pm). This will allow to launch the latest autoclave at midnight (instead of 8 pm). We then carried out to a change in staff distribution over the process steps in order to accommodate the activity level. These changes should have the effect of reducing the number of MDs that are not sterilized at the end of the day. Furthermore, we must maintain continuous 8 hours working periods for staff and comply with a security requirement, namely that a person should never be alone in the service. This means that the minimum team we can implement in the evening consists of two people. The addition of two people in the evening is associated with a staff reduction early in the morning. This is because, by opening the service longer in the evening, we hope to significantly reduce the number of MDs which are not packed or sterilized at the end of the day and which are usually packed and sterilized the next morning. Also we shift the range midday -8 pm to 11 am -7 pm to launch the first autoclave cycle earlier. These shifts allow the presence of more people from 11 am to midday and from 2:30 pm to 3 pm, which is when stocks are higher and when it is important to allow launching of washer cycles to have MDs to process, in the evening, in the packing and the sterilization steps. The simulation results are shown in table 4. The proposed measures concerning the staff schedule and the opening period allow a 52% reduction in the number of MDs that are not sterilized at the end of the day. Another performance with which we are concerned is the sojourn time, which depends in particular on the number of containers remaining over night in the service. Sojourn time, in the case of the new staff schedule, decreases by 37 minutes with regard to the results obtained with the initial staff schedule, that is to say MD sojourn time drops by 7.6%. These simulation results convinced the decision maker of the sterilization service of our case study to implement this new staff planning. He modified slightly the proposed planning, by requiring that the service is closed only once all the MDs are sterilized. Sometimes it closes before 2am, sometimes after 2am, but the average is 2am. The additional costs incurred by having two people at night are considered low compared to the improvements observed (serenity within the sterilization staff and a better relationship with the operating room staff).

Conclusion of case study 1

Even if sterilization is henceforth at the heart of the hospital activity, it is nevertheless regarded by a large number of operating room medical staff as an activity that is necessary but subordinate. When we reduce the number of MDs remaining in the sterilization service over night, we increase the number of MDs present in the storage area of the operating rooms in the beginning of the day. We thus reduce the risk that an MD is not available for a surgical operation, even if there is a change in the planning. It can allow improving the relations between operating rooms and sterilization service.

It also allows obtaining a more serene working atmosphere in the sterilization service. This is how it it was perceived in the sterilization service which implemented the new staff schedule.

5 Case study 2: nine sterilization services with global data

Modeling

We are now going to illustrate how the model described in section 3 can be used for modeling several sterilization services who replied to the survey we conducted in the health establishments of the Rhône-Alpes region. Our aim is to obtain an initial comparison of their performance. The model essentially uses parameters given by the survey. These parameters are less detailed than those used for case study 1.

Out of the 23 establishments with a centralized sterilization service which responded to the survey, we focus on the 9 establishments that answered all the questions and that are of sufficient size. They will be referred to as H1, H2 ... H9 hereafter in the paper. We classified them by decreasing activity volume (autoclave DIN baskets per day) before naming them. H1 is thus the establishment whose activity volume is highest and H9 is the establishment whose activity volume is lowest. The answers collected from this survey and used for our simulation are shown in table 5.

Collected data include the opening and closing times of the service, the number of washers, the activity volume and the loading policy for washers. Some of the unavailable parameters are determined by means of the study we conducted on a particular service, in section 4, such as, for example, the profile of input data for medical devices. Some of them are simplified (for example, the work potential will be considered as constant throughout the day). Table 6 specifies the origin of each parameter. We can also see, in table 6, the kind of data that are necessary for our model. Some parameters are specific to each service. These parameters may be the duration of a step, the number of workstations for a step, or the capacity of a workstation. We consider that these parameters are "variable" because they change from one service to another. Other parameters are said to be "fixed" because they are identical for all the services studied. For example for rinsing, capacity changes according to the presence or absence of manual rinsing, which is 1 or 0. If there is a manual rinsing step, we choose the same rinsing duration for all the services concerned (those used in our study of a particular service), because we do not have any information concerning this duration in the survey. Concerning system input, we only know the number of DIN baskets sterilized per day, and we have no indication as to the distribution of their arrivals during a day. We propose utilization of the arrival profile, defined by means of data collected for our specific service. Our case study enables us to define an arrival profile, giving, hour after hour, the arrival of the operations (expressed in number of operations), the volume of these operations in DIN baskets together with the composition of these operations in containers and bags. In the survey, for a given service, we only know the volume of MDs sterilized per day and the opening hours of the service. We can then build a profile for this service, based on the profile defined for our case study, by taking into account the new activity volume and opening hours. With regard to the staff schedule, we only know the total number of people working in the service, but we do not know how these people are distributed over the process steps during the day. We choose to have a constant work potential throughout the day. From the total number of full time equivalent workers in the sterilization service, and by using an 8 hour work range for each person, we calculate the total number of hours worked each day. Then, for each hour, the number of working people is obtained by dividing the total number of worked hours each day by the opening duration. This gives us the number of people in the service for each hour. We then assign one person to washing, one person to rinsing if rinsing is manual, one person to autoclaves, and the remaining people to packing.

Validation

To ensure confidence in the results provided by our generic simulation model, we validate the latter as follows: since the specific service studied in section 4 has answered our survey (it is H3), we run our generic simulation on 100 days, using data collected for this case study, and compare the results to those provided by the detailed model. The simulation results are obtained within a few minutes, and the 95% confidence interval is around 2% on the length of stay. Our comparison benchmarks are the number of containers remaining in buffers at the end of the day, and the length of stay (or sojourn time), which is cited as a target performance indicator by sterilization services. Results show that the length of stay is increased by 3.16% when using the model with simplified data rather than with detailed data. The number of containers remaining in buffers at the end of the day is increased by 3.63%. We also compare improvement trends between the two models by smoothing MD arrival data and modifying the staff schedule. The results show that, when the model with simplified data is used, smoothing of arrival data reduces the length of stay by 6.25% (compared with 6.67% with detailed data), and modifying the staff schedule reduces the proportion of containers which are not sterilized at the end of the day from 15.63% to 3.13% (compared with a drop from 11.85% to 5.73% with detailed data). The differences between the results provided by both models are small enough to allow us to use the generic model to compare the performance of several sterilization services.

Comparison of the nine sterilization services

In Table 7 we give the survey answers to sterilization service performance (normal text) and simulation results on length of stay and buffers (italics) for the studied establishments.

For a container, the length of stay, including closure, represents the duration between the entry of the container in the model and its exit from the same. The minimum length of stay is the sum of step durations of the sterilization process and does not take into account time spent in buffers. By comparing these two lengths of stay, we can estimate the time that containers spend in the buffers. This time is a means of evaluating whether or not improvements are possible. The remaining containers are the containers that are not sterilized at the end of the day. The number of containers handled indicates the number of containers leaving the generic model. The length of stay excluding closure represents the time between the entry of the container in the model and its exit from the same, but it does not include the closure time of the service. This length of stay excluding closure is calculated as follows: length of stay excluding closure = (length of stay including closure * number of containers handled -closure duration * number of remaining containers at the end of the day) / number of containers handled. Results are illustrated in figure 4 observe, for each health establishment, the length of stay including closure, which is the sum of the minimum length of stay without buffer, and the time spent in the buffer. The percentage of time spent in the buffer compared to length of stay including closure is also shown. Figure 5 gives, for each health establishment, the number of containers that are handled within a day, and those that are not sterilized at the end of the day (which may be in the autoclave buffer, the conditioning buffer or in the washing buffer). The percentage of remaining containers compared to handled containers is also shown.

These results show us that some performance parameters vary considerably. For example, the length of stay including closure varies from 6.4h to 10.3h and the average number of remaining containers from 3.8 to 34.4. The proportion of time spent in buffers compared to the length of stay including closure (which indicates a kind of waste of time) varies from 46% to 68.8%; while the proportion of remaining containers compared to the containers handled, varies from 8.9% to 23.4%. We know that, in sterilization services, decision makers consider that length of stay is a major per- formance criterion. By reducing length of stay, they can more quickly supply sterile MDs for surgical operations in operating rooms. Table 7 shows that our model provides performance parameters that are usually incorrectly estimated. For example, the lengths of stay estimated by decision makers are always less than those obtained by simulation. In many cases, it would appear that they estimate the minimum length of stay without buffers and not the total length of stay. For the example of the H2 hospital, length of stay is estimated at less than 3 hours. This value corresponds to the minimum length of stay without buffers (2.8 h) obtained by simulation, while the length of stay is much greater (8.2 h including closure, or 5.6 h without closure). They also gave their performance goals concerning length of stay, which encourages us to seek improvements so as to minimize this performance criterion. We can also compare simulation results (italics) and replies to survey (normal text), based on performance criteria of buffers at the end of the day. Simulation results inform us of the status of the washing buffer, packing buffer, sterilization buffer and the number of remaining containers, corresponding to the sum of all these buffers. In several cases, decision makers have also noticed containers that were not treated, remaining in these washing, packing and sterilization steps, which corresponds to simulation results.

Finally, we would like now to illustrate how these results and our simulation model can also contribute to improve the performance of a given hospital, through the calculation of the marginal benefit of each unit of resource. For example, we notice in table 7 that H2, H3, and H4 handle the same number of containers (94), but perform differently, since H2 has greater % time spent in buffer and % remaining containers. Looking at table 5, it appears that this hospital has about 50% less staff. Moreover, table 7 shows that the highest buffer at the end of the day is the packing buffer. We thus run a new simulation, by adding one more person to the packing step. We then observe that the packing buffer at the end of the day is divided by 10 (dropping from 13.6 to 1.39). This decrease enables H2 to have around 10% of remaining containers, which is similar to hospitals H3, H4, H5 and H6. Similarly, the length of stay drops from 8.2h to 6.92h, leading to around 30% of time spent in buffers, which is much better than in the other hospitals.

Influence of the washer loading policy on the performance of the sterilization service

We are now going to illustrate how the generic model, used with global data, can show the impact of loading policy on the system performance. H5 is the hospital under study. We choose H5 since, among the hospitals which answered the survey, it is a typical hospital for activity volume and staff. Firstly, we study the results obtained using washing loading policies case 1, case 2, and case 3. For cases 1 and 3, the filling threshold L takes successively the values 20, 30, 40, 50, 60, 70, 80 and 90%. For case 2, the waiting time threshold Tmax takes successively the values 10, 20, 30, 40 and 50 minutes. The evolution of the length of stay, from a simulation to another, with the same case of loading policy, is logical: the more the parameter increases, the more the length of stay increases. For case 1, it increases from 6.87 hours to 8.01 hours. For case 2, it increases from 6.87 hours to 7.80 hours. For case 3, it increases from 6.83 hours to 8.19 hours. Moreover, we observe that with case 3 we obtain slightly the same length of stay than with case 1, with a maximum saving of one washing cycle. These loading policies have the advantage to be simple to implement, but they do not allow to obtain a significant gain on the length of stay. We stay far from the expressed objectives, and it would be necessary to implement more specific loading policies to hope to obtain an interesting gain.

Secondly, we study case 2 into more detail. The notion of waiting time upstream the washing is very important for the sterilization services, in particular for those who use only an automatic rinsing, or for those who intend to make it. If we compare both extreme cases (Tmax = 50 minutes and Tmax = 10 minutes), we notice that we can win more than 50 minutes on the length of stay. It is however made to the detriment of the number of washing cycles (there are 12 more washing cycles within a day, on average). The improvement duration is yet interesting at the level of its distribution: over the gained 55 minutes, 19 minutes would be on the washing waiting time and the 36 other minutes would be on the following steps. By launching washing cycles more frequently, we can smooth the flow in the other steps.

The interest of case 2 is to reduce the washing waiting time. Considering that this waiting time may be long, manual rinsing allows MDs to wait without any risk of corrosion due to the pre-disinfection liquid. This rinsing step could be removed thanks to a loading policy that would ensure a washing waiting time small enough to avoid long pre-disinfection times, even without the manual rinsing. We could then transfer the person initially in charge of it to the packing area, enabling thus to improve the performance of the sterilization service. In order to quantify the possible gain with such a policy, we simulated case 2 with Tmax equal to 5 minutes, with a manual rinsing and without a manual rinsing. Removing the manual rinsing enables to save around 30 minutes on the length of stay, without increasing the number of washing cycles (and with one person less in the staff). When adding one person to the packing area, the length of stay is reduced by 10 more minutes. This policy enables to reduce the washing waiting time, but without ensuring an ideal pre-disinfection time. With a policy that ensures ideal pre-disinfection times, we can hope more significant savings.

Conclusion

Our aim in this paper was to present a generic model enabling assessment of performance evaluation of all French centralized sterilization services. This model was built by means of visits to different sterilization services and via the results of a survey conducted in health establishments in the Rhône-Alpes region in France. This model can be used for testing changes in organization of a given sterilization service, in order to improve its performance, as was illustrated on a case study. It can also help to compare the performance of several sterilization services. We applied this model to assess the performance of 9 sterilization services that answered our questionnaire. The results show the advantage of such a tool in obtaining performance parameters that are difficult to estimate by the sterilization service decision makers. Our future work will consist now in continuing to compare the performance of several sterilization services, acquired due to our generic model, by using ratios and by applying the DEA method. This will enable us to understand why some services are better than others, to suggest improvements for less efficient services, and to quantify the impact of these improvements on the performance of the services studied. Another issue is to use this model to test the impact of more sophisticated loading policies for washers and autoclaves on the performance of the system as a whole.

Fig. 1

 1 Fig. 1 Sterilization loop

Fig. 4 Fig. 5

 45 Fig. 4 Information on length of stay

  Assumption 2. No management of priority between MDs is included in the model: MDs with priority are those used several times in the same day, and which need to be sterilized quickly. They account for a very small proportion of the processed MDs (for our case study, we found that less than 2.5 % of the autoclave cycles contain MDs with priority, which accounts for 8 cycles per month).

	Batch arrival	Variable loading policy (batch building)	Automatic washing		Variable loading policy (batch building)
			Washer	Containers packing
	Pre-disinfection	Rinsing	Washer	Containers packing	Autoclave
	and transfer
			Washer	bags packing	Autoclave
		entity = operation		entity = container or bag	entity = container or	Fig. 3 Structure of a generic
					batch of bags	model representing a steriliza-
						tion process
	the total flow for our case study). One-use MDs are not
	considered.
	-

Table 2

 2 Comparison of observed data and data obtained by simulation

	Washer	Autoclave

Table 1

 1 Data used in the model

		Capacity		Average duration	Number of workstations
	Rinsing	1 operation		8min/op	0 or 1
	Washing	4 operations		60 min/cycle	0 or 4
	Container packing	1 container		Normal distribution	1 to 4
				Average: 21.1 min/cont
				Standard deviation: 3.2
	Bag packing	1 bag		1 min/bag	1
	Sterilization	10 containers or equivalent cont.	105 min/cycle	3
	Table 3 Results 1
		Mean sojourn time	Mean duration of the	Nb operations pre-disinfected	% operations pre-disinfected
		(min)	pre-disinfection step	more than 50 min	more than 50 min
			(min)
	Initial situation	484	45		156	28.5
	Period of 40min	455	37		87	15.9
	Period of 35min	454	33		55	10
	Period of 30min	454	29		39	7.1
	Period of 20min	454	27		31	5.7
	Immediate transfer	454	27		30	5.5

Table 4

 4 Results 2

		Mean sojourn	% of cont. not sterilized
		time (min.)	at the end of the day
	Current situation	484	11.9
	New staff planning	447	5.7

Table 5

 5 Answers to the survey used in our simulation

		H1	H2	H3	H4	H5	H6	H7	H8	H9
	Activity volume (nb of autoclave DIN baskets	235.9	129.7	123.1	112.5	101.3	93.6	74.3	73.6	25.4
	per day)
	Average nb of autoclave cycles per year	4600	4600	4000	3987	4388	4295	2759	4100	1100
	Staff (nb of Full Time Equivalent workers)	25	9	14	13	13.4	13	9.8	12.6	5.5
	Opening time (hours)	14	13	15.5	13.5	13	13.5	15	13	9.6
	Existence of a manual rinsing	Yes	No	Yes	No	Yes	No	Yes	No	No
	Number of washers	5	3	4	2	3	3	3	3	1
	Number of autoclaves	3	3	3	3	3	3	2	3	2
	Total capacity of washers (nb of DIN baskets)	50	24	24	28	30	20	15	26	8
	Total capacity of autoclaves (nb of DIN baskets) 40	22	24	22	18	17	14	14	12
	Average duration of the pre-disinfection step	[15,30] 15	[15,30] [45,50] [15,30] [15,30] [15,30] [15,30] [15,30]
	(minutes)
	Duration of a standard cycle of a washer (hours) 1.5	1	1	1.25	1.17	1	1.09	1.5	1
	Duration of a complete standard cycle of an au-	1.3	1.25	1.75	1.25	1	1.5	1.58	1.5	1.5
	toclave (hours)
	Loading policy for the washers (kind of thresh-	waiting	filling	filling	filling	waiting	filling	filling	filling	filling
	old)	time				time
	Loading policy for the autoclaves (kind of	waiting	filling	filling	waiting	filling	filling	filling	filling	filling
	threshold)	time			time

Table 6

 6 Data used in each step S = from Survey P = from Particular service CS or CSP= from Calculation using Survey data or using Survey and Particular service data operation: expressed in DIN baskets (number of containers and bags known) is not really a workstation of the sterilization service, since it is supported by staff from the operating rooms. In our model, this step is represented as a duration, without associated staff.

		Pre-disinfection and	Rinsing	Washing	Packing	Sterilization
		transfer*
	Nb of workstations		variable (S)	variable (S)	variable (CS)	variable (S)
	Capacity	fixed (P)	variable (S)	variable (S)	fixed (P)	variable (S)
	Duration	variable (S)	fixed (P)	variable (S)	fixed (P)	variable (S)
		uniform distribution deterministic deterministic normal distribution deterministic
	Loading policy			variable (S)		variable (S)
	Entity	operation	operation	operation	container and bag	container and batch of bags
	* this step

Table 7

 7 Comparison of simulation results and answers to the survey Average washing buffer at the end of the day 2: Minimum length of stay without buffer (in hours) 9: Average packing buffer at the end of the day 3: Length of stay in simulation including closure (in hours) 10: Average autoclave buffer at the end of the day 4: Length of stay in simulation except closure (in hours) 11: Average nb of containers remaining at the end of the day 5: % of time in buffer compared to length of stay including closure 12: Nb of containers handled 6: Process duration: what are your performance goals? 13: Percentage of remaining containers vs containers handled 7: Average duration for an urgent treatment?

		H1	H2	H3	H4	H5	H6	H7	H8	H9
	1	[4h, 5h]	≤ 3h		[3h, 4h]	[3h, 4h]	[3h, 4h]	[4h, 5h]	[3h, 4h]	[3h, 4h]
	2	3.7	2.8	3.7	3.5	3.3	3.2	3.6	3.7	3.2
	3	8.2	8.2	7.2	6.5	7.8	6.3	8.6	7.8	10.3
	4	6.4	5.6	6.3	5.5	6.7	5.4	7.1	6.6	7.6
	5	54.4 %	65.2%	48.6 %	46.1 %	58.2 %	49.2%	58.4%	52.5 %	68.8 %
	6	≤ 4h	≤ 3h		Depending on need ≤ 3h	≤ 4h	≤ 4h	≤ 3h	Depending on need
	7	[3h, 4h]	[2h, 3h]		[3h, 4h]	[2h, 3h]	[2h, 3h]	[3h,4h]	[3h,4h]	[2h, 3h]
	8	1.4	3.1	0.4	2.6	2.2	1.0	1.0	1.3	3.8
	9	6.7	13.6	1.4	0.9	3.8	0.3	6.6	2.0	0.0
	10 26.3	5.3	8.4	5.1	1.7	5.7	2.6	4.0	0.0
	11 34.4	22.0	10.3	8.6	7.7	7.1	10.3	7.2	3.8
	12 188	94	94	94	79	79	63	63	21
	13 18.1%	23.4%	10.6%	9.6%	10.1%	8.9%	15.9%	11.1%	19.0%
	1: Normal process duration for a container		8:

Acknowledgements We would like to thank the reviewers for their comments which helped us enrich our study.


Negrichi Khalil

FLAUS D I Mascolo Maria

Maria Di-Mascolo

Risk analysis in sterilization services: A first step towards a generic model of risk

Keywords: Sterilization services, risk analysis, model driven risk analysis, preliminary hazard analysis

Sterilization services are vulnerable to risks, due to the contagious nature of their environment and to the degradation that risks can cause to the safety of patients and staff. In relation to this issue, our work aims to reduce the risk level of these services, in order to improve their toughness and their behavior in degraded mode. We develop here a risk model for sterilization services, using a model driven approach. Then we show the relevance of such an approach by comparing it to the conventional approach. This model represents a first step towards a generic model of risk in different sterilization services.

Introduction

Health services are environments that are very sensible to risks; they have a highly contagious nature as pathogens can easily be transmitted through different channels. Additionally patients are particularly vulnerable because of their low immune system. These services must be equipped with units that can fight against these weaknesses, among them, sterilization services. Sterilization services are the heart of the fight against the transmission of pathogens via blood and other biological fluids through surgical instruments. By definition, sterilization is the technique designed to remove any microbial germ existing on a medical device. Because of the vast majority of pathogens that can be transmitted (bacteria, fungi, viruses, spores, and other microorganisms), and the variety of microorganisms that exists, this process requires different steps to kill them (predisinfection, rinsing, cleaning, drying, packaging and sterilization) [Standard AFNOR, 2005] Because instruments are designed to be reused, they can transmit pathogens if any of the sterilization steps experiences a failure. In addition to their role in prevention, sterilization units must incorporate hospital policies based on economic criteria to optimize the time and expense. These policies make the sterilization services difficult to manage, generate more risks, could compromise the safety and quality of service, and may lead to serious consequences. All these constraints increase the level of risk, hence we need to perform a risk analysis for this kind of facilities to guarantee a stable and secure functionality.

There are only few studies on risk analysis conducted at sterilization services [START_REF] Bernard | Restructuration d'un service de stérilisation dans le cadre d'une démarche qualité[END_REF], [START_REF] Bertrand | RFID dans le secteur de la santé comment réduire les risques[END_REF], [START_REF] Talon | Gestion des risques dans une unité de stérilisation centrale d'un établissement hospitalier: Apport de la traçabilité à l'instrument[END_REF]. These works were based on the use of classical method. The purpose of our work is to perform a risk analysis in sterilization facilities, based on model driven risk analysis method, in order to identify and evaluate the existing risks in sterilization services. This paper is divided into three parts. We start, in section 1, with a short presentation of risk analysis. The second section focuses on the steps followed to perform risk analysis in sterilization services. Finally, in section 3, we highlight the benefit of the obtained risk model.

Presentation of risk analysis

By definition, risk analysis is the process of defining and analyzing the risks that may appear in a system. It aims to improve system security by reducing the risks criticality. It can be either qualitative, when different corrective actions are token, the extent of vulnerabilities are specified, or the security measure are fixed, or quantitative, when probability of an event occurring and its severity are taken into account, which makes it possible to rank events in order to rank risk and to make decisions based upon this ranking [START_REF] Villemeur | Reliability, availability, maintainability and safety assessment[END_REF] Several methods exist to perform risk analysis. They can be divided into two types of methods:

 Classical method such as PHA (Preliminary hazard analysis ), FMECA (Failure Mode, Effects and Criticality Analysis) and HAZOP (HAZard and OPerability) [Villemeur, 1992]  Model driven method such as FIS (Function, Interaction, Structure) and CORAS As explained in [START_REF] Tixier | Review of 62 risk analysis methodologies of industrial plants[END_REF] the main limitation of the classical methods can be summarized in the following points:

 The update takes a lot of time.  The more general the method is, the less it takes into account the specification of the studied case. On the contrary, the more specific the method is, the less it can be transposed to other cases.  The complexity of the method requires a specified training to implement it.  There is a great disconnection between the risk analysis methodology and human factors.

An interesting approach to improve risk analysis efficiency is to use a model based method such as CORAS [Ketil et al, 2002] and FIS [START_REF] Flaus | A model-based approach for systematic risk analysis[END_REF]. We propose here to perform a risk analysis in sterilization services using a model-driven method, and to highlight the advantages of model-driven methods, compared to classical methods. In our work, we lay on the FIS method, because it is simpler to use than CORAS. Furthermore, the FIS method is more suited to production systems, and thus to the case of sterilization services that we aim to analyze here.

The FIS method (Function, Interaction, Structure) was published for the first time in 2008. Then it was applied on various kinds of systems [START_REF] Flaus | Industrial emergency planning modeling: A first step toward a robustness analysis tool[END_REF]. This method allows organizing and structuring the risk information in a model which makes them easier to use later.

The FIS model is based on the decomposition of the installation to analyze as a set of systems. For each system, we identify its functions and resources. According to the FIS model, a system is represented as a box (see Figure 1) that contains resources, functions and interactions between them.

A function is defined as the role of a group of resources, expressed in terms of purpose. Resources can be items, used to conduct the activities of the process; they can be hardware (machines and materials), human (staff) and organizational (operating modes, procedure...). Interactions are presented as the relationships between functions and resources. From a dysfunctional point of view, we can add later the dangerous phenomena and failures to the model. Each dangerous phenomenon and failure is associated with a resource or a function, which are already defined. The model also gives the possibility to indicate that a failure can trigger another one, allowing us to represent the propagation of failures in the system (see Figure 2).

At this point, it is essential to highlight the fact that the organization of information regarding the risks in a model facilitates their use later. For example, from a FIS model, we can automatically generate the results of classical methods such as PHA

Risk analysis of the sterilization facilities with a model driven approach

Structuro-functional modeling of a sterilization service

As mentioned above, the first step in the FIS approach is to build a structuro-functional model to describe the system. To perform the structuro-functional modeling of the sterilization services, we conducted visits to the sterilization service of the university hospital of Grenoble. We also analyzed documents of the French and international standard about the sterilization process, but also medical documents about sterilization good practices, and the conclusions of survey conducted in the Rhône-Alpes region on the practices used in the sterilization services within the region [START_REF] Reymondon | Rapport d'enquête du projet 2E2S -état des lieux des pratiques de stérilisation hospitalière[END_REF]. At the end of these visits and literature review, we were able to define the following functions:

 Pre disinfect and transfer medical devices  Rinse medical devices  Wash medical devices  Dry medical devices  Pack the medical devices To be more accurate, we decided to define sub-functions for each function. Later, we added, to each function and sub-function, the resources that are connected to them. The following table (see table 2) shows the result of our structuro-functional modeling. For each sub-function (example S.01.F01: Prepare Predisinfection baths) we can identify the required resources (input resources) and the impacted one's (output resources). The obtained model was then integrated in X-Risk 1 software.

Dysfunctional modeling of the sterilization service

After completing the structuro-functional modeling of a sterilization service, we proceeded to the definition of dangerous phenomena, and then to the identification of failures.

Identification of dangerous phenomenon

A dangerous phenomenon is characterized by the fact that it generates damage to a target (function or resource). It may appear during normal operation of the service, while manipulating dangerous elements (displacement of dangerous chemicals, presence of high temperature), or appear unexpectedly (explosion, fire ...).

Based on this definition and on the visits that we made to sterilization services, we have identified the various dangerous phenomena that exist. For each dangerous phenomenon, we have identified the degraded function, the source of danger, the causes, the targets and the effects.

1 Software based on the FIS approach

The identified dangerous phenomena's information (degraded function, source of danger, causes, targets and the effects) were then included in the model. The following table shows an extract of the PHA table that is automatically generated using the information related to dangerous phenomena's integrated in our model.

Identification of failures:

A failure is defined as an abnormal state of a resource or a function. This alteration results in an effect which is identified as a failure mode

The identification of all failures in the sterilization service requires a long period of time. This time is necessary to interview the staffs, read technical documents, review working procedure. In order to reduce this time, we used the failures defined in a previously performed risk analysis. To our knowledge the work of [START_REF] Talon | Gestion des risques dans une unité de stérilisation centrale d'un établissement hospitalier: Apport de la traçabilité à l'instrument[END_REF] is the most exhaustive risk analysis in a sterilization service. Talon's work consists in a risk analysis conducted in the sterilization service of the Bichat Hospital in Paris, using the conventional method PHA. This work presents also the advantage of being exhaustive, since it was conducted by a sterilization specialist. We decided to rely on the failures defined in Talon's work.

For integrating the failures in our model, we needed to define, for each identified failure, its cause, the degraded function and the possible path of propagation of this failure in the system. This information was added to the model. Table 3 represents an extract of the FMECA table automatically generated using our FIS model.

Advantage and possible use of the developed FIS model

The main idea behind the model driven method is the formalization of the risk analysis data into a model. This representation in a model form, allows organizing the data in a data base form. This gives more flexibility to add, to use, and to update data, unlike the presentation in a table form offered by classical methods, which becomes difficult to handle as the number of identified failures grows.

The model also ensures the reconstruction of existing cause-effect relationships between events. For example, figure 4 shows that the "staff injuries" can be caused by "transportation accident", which is initiated by "non respect of the transportation recommendations". It can also be caused by "parts projection" which is triggered by "autoclave explosion" that can be caused by "temperature or pressure regulation failure".

This model can accurately describe the reality of occurrence of accidents, where the accident appears as the result of a succession of events. This architecture is very important to implement, in order to view all potential propagation of failures and to highlight the interactions that allowed this propagation.

From a quantitative point of view, the defined cause-effect architecture can be used to calculate the probabilities of occurrence of any event. In fact, the probability of occurrence of an accident is the result of a succession of events, so this probability can be automatically calculated from the probability of its initiating events. For example the probability of occurrence of "staff injuries" accident (see figure 4) depends on the probability of occurrence of its initiating events, which are "transportation accident" and "parts projection". These, in turn, depend on the probability of occurrence of their initiating events which are "non respect of transportation recommendations", "Temperature regulation failure" and "Pressure regulation failure". Therefore by incorporating the probability of occurrence of all initial events, we can automatically calculate the probability of all the resulting events. Note that classical methods only offer probability estimation, which are not very accurate. This leads to a more accurate evaluation of accidents probabilities based on causeeffect relationship.

Furthermore, and as seen in [START_REF] Talon | Gestion des risques dans une unité de stérilisation centrale d'un établissement hospitalier: Apport de la traçabilité à l'instrument[END_REF], risk analysis can be an extremely long process. The formalization of this analysis as done in this work is the first step toward the capitalization of the data. This makes it easy to be reused and updated for future risk analysis. For example, for the resource "autoclaves" used to sterilize the DM, we defined all possible failures in our model. If in another analysis we find the same resource, we can immediately import this resource, with its failure modes from the existing model, rather than defining it another time.

Conclusion

In this work, we conducted a risk analysis in sterilization services, based on a model driven approach. We started the analysis with the development of a structuro-functional model of a sterilization service. Thereafter, we performed a dysfunctional modeling, by integrating dangerous phenomena and failures that may occur in this service, and by adding, for each dangerous phenomena and failure, its related information (degraded function, source of danger, causes, targets and the effects)

Our analysis has shown that model-driven approaches can overcome some of the limitations of conventional methods. They present an important flexibility to manipulate data (add, delete and update) and a good capability to accurately describe the reality of occurrence of accidents (cause-effect relationships, probability computation), which are basic elements for the relevance of risk analysis results.

The risk model can also be used for performance evaluation in a degraded mode. The idea is to use a discrete simulation model in degraded mode using the risk model as a data base to retrieve risk information. Indeed, several works were conducted for improving the performance of sterilization services [Di [START_REF] Mascolo | Organization of the production of sterile medical devices[END_REF]], [START_REF] Mascolo | Comparing the performance of some centralized sterilization services using a generic simulation model[END_REF]], [START_REF] Ngo Cong | Etude et amélioration de l'organisation de la production de dispositifs médicaux stériles[END_REF]. But these studies do not take into account the failures that can occur in the sterilization system. Note that other recent approaches use multi-agent simulation with the FMECA classical method to simulate degraded mode [START_REF] Ben Kahla | Gestion des risques et aide à la décision dans la chaîne logistique hospitalière : cas des blocs opératoires du CHU Sahloul[END_REF]. It would be interesting to combine our risk developed model with a simulation model, in order to be able to simulate the behavior of the sterilization service in a degraded mode.

Figure 1 :

 1 Figure 1: Basic model of a system according to FIS Figure 2: Propagation of failures in an elementary FIS model

Figure 4 :

 4 Figure 4: Extract from the cause-effect chain that leads to staff injuries (from X-Risk software)

Table 1 : Extract of structural-functional view of the sterilization service (from X-Risk software).

 1

Table 2 : Extract of dangerous phenomena (from X-Risk software).

 2

Table 3 : Extract of failures mode table (from X-Risk software).

 3