MED. INFORM. JUNE   (        2003)      VOL.   28,   NO. 2, 129134




A mathematical specification of the New Deal on junior
doctors' hours


               B. S. TODD*

               Accident and Emergency Departments, Oxford Radcliffe Hospitals
               NHS Trust


               (Received November 2002)


               Abstract. Objectives: Our objective is to make the New Deal on junior doctors' hours
               sufficiently precise that the definitions may be used as a basis for computer software
               that checks the compliance of rotas or that automatically generates compliant rotas.
               Methods: We formalize the clauses of the New Deal, as relevant to `full shifts', using
               the Z specification language. Results: The mathematical definitions are simple and concise.
               Conclusions: Mathematical specification is a useful way to express constraints on rotas
               unambiguously.


               Keywords: Specification; New Deal; Rota; Formal; Mathematical.


1. Introduction
   In the UK, the New Deal on junior doctors' hours was finalized to control
and reduce the workload imposed on doctors in training [1]. In so far as the
New Deal applies to `full shifts', such as those worked by Accident and Emer-
gency (A&E) Senior House Officers (SHOs), we have the constraints listed be-
low. Each is an affirmation of some property that every rota must possess.
What could be clearer?

  . The maximum average duty per week should not exceed 56 h.
  . The maximum continuous duty period must not exceed 14 h.
  . The minimum period off duty between duty periods is 8 h.
  . The maximum consecutive duty is 13 days.
  . The minimum continuous periods off duty are 62 h and 48 h in 28 days.
  . Annual leave must not be regarded as `off-duty' for these purposes.

Unfortunately, the clarity of natural language is deceptive. For example, consider
each of the following extracts and try to determine whether the respective rota con-
travenes any of the rules.


  (1) At St Lottovnite's Hospital, A&E SHOs work a total of 13 consecutive
         night shifts, each night shift starting at 22:00 h and finishing at 08:00 h
         the following morning. That is to say, on 14 consecutive days, the SHO
         is on duty for some part of the day.
  (2) At Longbreak Infirmary, A&E SHOs have two breaks during each 28 day
         period, one is for an entire week (168 h) and the other is for just 36 h.


*Author for correspondence; The Accident and Emergency Department, The Horton Hospital, Oxford
Road, Banbury, Oxon, OX16 9AL, UK. e-mail: Bryan.Todd@orh.nhs.uk

  Medical Informatics & The Internet in Medicine ISSN 1463-9238 print/ISSN 1464-5238 online # 2003 Taylor and Francis Ltd
                                                http://www.tandf.co.uk/journals
                                             DOI: 10.1080/14639230310001600489

130                                    B. S. Todd


  (3) At Werkermard General Hospital, A&E SHOs work seven consecutive
        night shifts followed immediately by seven consecutive late shifts. The
        night shift starts at 00:00 h and finishes at 08:00 h. The late shift starts at
        16:00 h and finishes at 00:00 h. Thus on the seventh day the SHO works
        two shifts, a night shift followed by a late shift. This entire sequence covers
        13 consecutive days.


None of these hypothetical examples involves the added complication of annual
leave, nevertheless two things are evident:-


  (1) Interpretation of the rules entails subjective judgement; there may be dis-
        agreement about the validity of any given rota.
  (2) The process of validating a rota is non-trivial and ideally requires a compu-
        ter program [2]. This is particularly relevant now that computers are being
        increasingly used to generate rotas for medical staff [3  6].


   Although the rules seem precise, there is a tendency for one person to read them
differently from another. Worse still, interpretation of the rules is subconscious, at
least in part; hence our surprise on encountering challenging examples that illus-
trate alternative interpretations. If the rules are encoded in a computer program,
the programmer too must decide their meaning. Two programs written indepen-
dently are thus likely to conflict as to the validity of some rotas. Rather than embed
the particular interpretation of the rules in lines of programming code, it is prefer-
able to make the meaning of the rules unambiguous and explicit beforehand.
Mathematics offers a solution. In the rest of this document we show how the rules
can be defined rigorously using simple set theory and logic. For clarity we follow
the notational conventions of the `Z' specification language because they are fully
documented elsewhere [7, 8]; a glossary of symbols is included at the end of this
paper to aid the reader who is not familiar with the Z specification language.
The strength of `Z' is that it allows declarative specification. We can therefore focus
on simply saying what the rules are  we are not concerned here with the details of
how to test a given rota against them. Furthermore, the use of `Z' schemas im-
proves the clarity of the document by economizing on symbols.



2. Formalism
   A rota specifies the times at which a given doctor starts and finishes work. For
simplicity, let us regard each whole hour as a single point in time. We represent
time by integers, counting from midnight at the start of a rota; for example, `24'
represents the first hour after midnight (00:00 h to 01:00 h) of the second day. A
time interval is thus a non-empty set of consecutive time points.

                         Interval   fi; j : Z j i 4 j i : : jg


   A rota has three components. Thus period P specifies the interval of time to
which the rota relates; duty D is the set of times for which the doctor is on duty;
and leave L is the set of times for which the doctor is on leave. Clearly duty and
leave must be confined to the duration of the rota, and a doctor cannot be on duty
and on leave simultaneously.

                          New Deal on junior doctors' hours                  131

                                       Rota
                                    P : Interval
                                    D : PZ
                                    L : PZ

                                    D [ L    P
                                    D \ L =


   Let MaxAV be the maximum time on average that a doctor can work in a
week. For example, the requirement that no doctor works more than 56 h on
average is denoted by MaxAV = 56. Let AverageOK represent rotas that are suffi-
ciently light.

                              AverageOK

                          Rota

                          #D 6 168 4 # (P\L) 6 MaxAV



   Let MaxSL be the maximum permissible length of any shift. For example, the
requirement that no shift be longer than 14 h is denoted by MaxSL = 14. Let
ShiftLenOK represent rotas in which the shift lengths comply with the New Deal.
These are precisely the rotas that contain no duty periods greater than MaxSL.

                            ShiftLenOK

                        Rota

                        VJ : Interval J D ) #J 4 MaxSL



   Let MinTO be the minimum time off between shifts. For example, the require-
ment that each doctor has at least 8 h off duty between shifts is denoted by
MinTO = 8. Let TimeOffOK represent rotas in which the time off between shifts
accords with the New Deal. These are precisely the rotas in which every off-duty
interval is contained within another that is at least as great as MinTO.

              TimeOffOK

          Rota

          VJ : Interval | D \ J =
              9K : Interval D \ K =       ^ J     K ^ # (K \ L) 5 MinTO



   Let MaxCD be the maximum permissible period of `consecutive duty', that is to
say a sequence of shifts without an adequate break between them. For example, the
requirement that no doctor works more than 13 days ( = 312 h) in a row without an
adequate break is denoted by MaxCD = 312. Let ConDaysOK represent rotas in
which the number of consecutive duty days complies with the New Deal. These

132                                       B. S. Todd


are precisely the rotas in which any two moments on duty that are more than
MaxCD apart must be separated by a break. For this purpose we regard a `break'
as 48 h off duty. We disregard any annual leave.

                     ConDaysOK

                Rota

                V t0, t1 : D | # ((t0 . . t1)\L) 4 MaxCD
                     9K : Interval K ((t0 . . t1)\D) ^ #(K\L) = 48


    Let MaxCY be the maximum permissible cycle length containing two substan-
tial breaks, one of at least 62 h and the other of at least 48 h. For example, the re-
quirement that the longest such cycle is 28 days ( = 672 h) is denoted by
MaxCY = 672. Let BreaksOK represent rotas that in this regard comply with the
New Deal. Thus if we choose any two moments on duty that are MaxCY or more
apart, ignoring any annual leave, we find that they bound at least two non-overlap-
ping breaks in which the doctor is not on duty. Moreover, the breaks are at least
48 h long, and one of them is at least 62 h long, once any annual leave is deducted.

             BreaksOK

          Rota

          V t0, t1 : D | # ((t0 . . t1)\L) 5 MaxCY
             9K0, K1 : Interval | K0 \ K1 =
               (K0 [ K1) ((t0 . . t1)\D) ^ # (K0\L) = 62 ^ #(K1\L) = 48



    Thus, finally, the set of all rotas that conform to the New Deal is {ValidRota}
where ValidRota is defined as the conjunction of each required property.

                                     ValidRota


                                        AverageOK
                                        ShiftLensOK
                                        TimeOffOK
                                        ConDaysOK
                                        BreaksOK



3. Examples revisited
    In the light of our formal definitions, let us now reconsider each of the three
examples given in the introduction. Firstly, without loss of generality, let us as-
sume that the thirteen consecutive night shifts at St Lottovnite's Hospital comprise
the entire rota. Thus,

              D  22 : : 31 [ 46 : : 55 [ 70 : : 79 : [ : : [ 310 : : 319

    The requirement of ConDaysOK is met because, for any t0, t1 2 D, the predi-
cate in the definition is trivially true since # (t0 .. t1) 4 298.

                             New Deal on junior doctors' hours                              133


    Treating Werkermard General Hospital's rota similarly, we have

         D  0 : : 7 [ 24 : : 31 [ : : [ 144 : : 151 [ 160 : : 167 [ : : [ 304 : : 311

    Therefore, for any t0, t1 2 D, we have that # (t0 .. t1) 4 312, and again the pre-
dicate in the definition of ConDaysOK is trivially true.
    Finally, Longbreak Infirmary satisfies the requirement of BreaksOK because
we simply choose K0 and K1 to be disjoint subsets of the 168 h break contained
within any 28 day period. In summary, therefore, none of the examples contra-
venes the rules as formally defined.



4. Discussion
    Notice that, for simplicity, we have represented time here as whole hours.
Shifts often start or finish on the half-hour, or possibly at other fractions of the
hour. To allow for this we can refine the measure of time to be in minutes rather
than in hours simply by multiplying all constants in the formalism by 60. Further-
more, by way of illustration, we have focused in this paper specifically on `full
shifts'. Our approach is nevertheless general and our methods extend readily to en-
compass `partial shifts' and `on-call' rotas.
    We may disagree with the formal definitions given above; we may feel that one
or more of the examples should indeed be invalid. For example, it has become cus-
tomary to regard a period of 13 consecutive days' duty as a sequence of 13 days in
which a doctor starts a shift at some time during each day. The restriction
ConDaysOK is therefore stronger than the customary informal interpretation of
the rule regarding maximum consecutive duty. However, the informal interpreta-
tion is vague with respect to shifts that start at midnight because according to local
preference such a shift could be alternatively regarded as starting at 24:00 h of the
preceding day or at 00:00 h of the following day. This ambiguity is avoided by the
stronger, formal definition given here.
    Iterative experimentation with examples and revision of the definitions im-
proves our interpretation of the rules. The strength of the formal definitions is that
not only do they avoid any misunderstanding, but the interpretation of the rules is
explicit and readily available for inspection. Furthermore, all computer programs
implementing the rule definitions are guaranteed to be congruent.



Acknowledgement
    I am very grateful to Alison Hill and to Grizelda George for their comments on
earlier drafts of this paper.



References
1. NHS EXECUTIVE, 1998, Reducing Junior Doctors' Hours, Health Service Circular HSC 1998/240.
2. NEW DEAL 2000 Software, (London Region and South East Regional Action Teams, 40 Eastbourne
    Terrace, Paddington, London W2 3QR, UK).
3. SCIPIONE, P., SCIPIONE, D. and BETLACH, T., Optimizing staff scheduling by Monte-Carlo simula-
   tion, (http://www.docs2000.net).
4. IQUS LIMITED, Rota Master, (http://www.iq.uk.com/RotaMaster.htm).
5. TANGIER EMERGENCY PHYSICIAN SCHEDULER, (http://peakesoftware.com/peake/why/why.htm).

134                                      B. S. Todd

6. WEIL, G., HEUS, K. and CHAN, P., GYMNASTE: a nurse planning package in CHIP, (http://
   www.cosytec.com/english/homepag2.htm).
7. SPIVEY, J.M., 1992, The Z Notation: A Reference Manual, 2nd edn (London; Prentice-Hall).
8. WOODCOCK, J.C.P. and DAVIES, J., 1996, Using Z: Specification, Refinement, and Proof, (London:
   Prentice-Hall).




Appendix
    The following list of mathematical symbols should help the reader who is un-
familiar with the Z specification language to follow the formal sections of this docu-
ment.


= =                        Defining equals.
{ x : T | P(x) . tx }      The set of all terms tx where variable x is drawn from set T
                           such that P(x) holds.
                          The empty set.
m . . n                    The set of all integers from m up to n inclusive. (The empty
                           set if n is smaller than m.)
Z                          The set of all integers.
PT                         The power set of T: the set of all subsets of T.
S [ T                      The union of sets S and T: the set of all elements that are in
                           S or in T (or in both).
S \ T                      The intersection of sets S and T: the set of all elements that
                           are in both S and T.
S\T                        Set difference: the set of elements that are in S but not in T.
S T                        Subset relationship: every element of S is also a member of
                           T.
# S                        The cardinality of set S: the number of elements of S.
9x : T . P(x)              Existential quantification: predicate P(x) holds for at least
                           one element x in set T.
Vx : T . P(x)              Universal quantification: predicate P(x) holds for every
                           element x in set T.
Vx :T | P(x) . Q(x)        Guarded universal quantification: predicate Q(x) holds for
                           every element x for which P(x) holds.
p ) q                      Logical entailment: proposition p implies q.
p ^ q                      Logical conjunction: both propositions p and q hold.
  Name                     A named schema that associates one or more variable
  x : T                    declarations (x:T) with a predicate P(x) P(x) that relates the
  P(x)                     variables. If the predicate is universally true then the
                           predicate part of the schema can be omitted. If a schema is
                           included within the declarations of another schema, the two
                           sets of declarations are implicitly merged and the predicates
                           are implicitly conjoined.


