Computer Methods and Programs in Biomedicine

Background and objective: Whilst fragility hip fractures commonly affect elderly people, often causing permanent disability or death, they are rarely addressed in advance through preventive techniques. Quan-tiﬁcation of bone strength can help to identify subjects at risk, thus reducing the incidence of fractures in the population. In recent years, researchers have shown that ﬁnite element models (FEMs) of the hip joint, derived from computed tomography (CT) images, can predict bone strength more accurately than other techniques currently used in the clinic. The specialised hardware and trained personnel required to perform such analyses, however, limits the widespread adoption of FEMs in clinical contexts. In this manuscript we present CT2S (Computed Tomography To Strength), a system developed in collaboration between The University of Sheﬃeld and Sheﬃeld Teaching Hospitals, designed to streamline access to this complex workﬂow for clinical end-users. Methods: The system relies on XNAT and makes use of custom apps based on open source software. Available through a website, it allows doctors in the healthcare environment to beneﬁt from FE based bone strength estimation without being exposed to the technical aspects, which are concealed behind a user-friendly interface. Clinicians request the analysis of CT scans of a patient through the website. Using XNAT functionality, the anonymised images are automatically transferred to the University research facility, where an operator processes them and estimates the bone strength through FEM using a combination of open source and commercial software. Following the analysis, the doctor is provided with the results in a structured report. Results: The platform, currently available for research purposes, has been deployed and fully tested in Sheﬃeld, UK. The entire analysis requires processing times ranging from 3.5 to 8 h, depending on the available computational power. Conclusions: The short processing time makes the system compatible with current clinical workﬂows. The use of open source software and the accurate description of the workﬂow given here facilitates the deployment in other centres. © 2021 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ )


Introduction
The constant improvement of computational capabilities has led to a surge of clinical and biological applications of computer mod-ware and software, trained personnel and high performance computing (HPC) systems, which are expensive to install and maintain and whose use is challenging for people without specific training. These factors limit the widespread adoption of these technologies in clinical practice.
A solution to this problem is to hide the technical part within a wrapper, thus allowing clinicians to access the computational models without needing to build them. This approach delivers HPC resources to the clinic and improves the clinical translation of biomedical research. A number of platforms have been developed over the years for sharing medical data across institutions (Somnonetz for sharing polysomnographic data [2] , Origa-light for images of the retina [3] ) and for facilitating the retrieval [4] and reconstruction [5] of medical images, but specific platforms for clinical decision support have not seen widespread uptake. Notable examples include systems for detection of heart conditions (VIRTUheart [6] and HeartFlow [7] ), or the use of finite element (FE) modelling for estimating the risk of hip fracture, an application that has recently been approved by the U.S. Food and Drug Administration as a class II medical device (VirtuOst [8] ). In all these cases, clinical staff are required to electronically transfer a set of medical images to operators that use these images as input for computational models.
Fragility hip fractures commonly affect elderly people, especially post-menopausal women [9] , and constitute a significant burden on the healthcare system, with an estimated cost of £1.1 billion in the UK alone [10] . They are usually caused by osteoporosis, a disease which weakens the bones, including the femur, and makes them more prone to fracture [11] . Patients at risk can be identified using dual-energy X-ray absorptiometry imaging to measure the areal bone mineral density (BMD). This can then be related to the bone strength, defined as the force needed to fracture a bone [12] , which is considered a biomarker for the risk of fracture [13,14] . A recent study has shown that this can achieve a predictive accuracy of 75% [15] .
Alternatively, researchers have developed methods to use medical images, typically in DICOM format [16] from quantitative computed tomography (CT), as a starting point for building personalised 3D FE models of the femur [17] and estimating its strength [15,18] . Over the years our group has developed a workflow to predict bone strength using clinically acquired CT images, and validated it on a cohort of postmenopausal women. This approach can reach accuracy above 80% [18] , but is not yet commonly used in the hospitals because it requires a sophisticated set of software, trained operators and HPC resources typically not available in clinical settings.
To address this issue, INSIGNEO Institute for in silico medicine at The University of Sheffield (TUOS) and Sheffield Teaching Hospital (STH) have developed a web service, named "CT to Strength" or CT2S for short, and made available at https://ct2s.insigneo.org/ ct2s/ . Using the system, doctors in hospitals can request the analysis of a set of CT scans and obtain a comprehensive report containing the key predictive information. Overall, the service aims to improve the clinical uptake of FE-based strength estimation without exposing the complexity of the underlying HPC environment, which is shielded from the clinician by a user friendly interface.

Materials and methods
The workflow behind the CT2S service is built over two separate networks, the first one located within the Sheffield Teaching Hospital (STH), referred to as the Hospital network, and the second one within The University of Sheffield (TUOS). The entire workflow can be split into two parts: infrastructural and modelling.
In the next sections we will first present a high level description of the workflow, followed by a more in depth description of the individual components and how they are integrated to provide a complete service. Figure 1 shows the architecture and schematic of the operation of the workflow, which operates over the Hospital (STH) and University (TUOS) networks.

Description of the workflow
The workflow operates upon the cooperation of a number of University developed applications (CT2SWebApp, django-multisim, DicomAnonymiser, DataExchange, AMPQClient), either based on existing open source software or written from scratch. Figure 2 shows a simplified representation of the workflow, while Fig. 3 shows the individual components of the service and their mutual relationship.
A patient reaches the hospital and undergoes a bilateral full femoral CT scan at 10 0 kV. The amperage, between 80 and 200 mA, is chosen according to the patient's weight. This corresponds to an effective radiation dose ranging from 1.5 to 6.2 mSv [19] . The CT machine has been calibrated during the deployment of the workflow using an European Spine Phantom [20] . However, as the calibration is asynchronous, the use of phantom is not required during the scanning procedure. Following scan acquisition, the images are automatically saved into the "Picture Archive and Communication System" (PACS) [21] according to standard clinical practice in UK hospitals. In accordance with the guidelines set by the Information Governance of the hospital, any information related to the patient's identity is removed from the headers of the DICOM images. The system also generates a unique identifier that is associated with the simulation request. The information that links the identifier to the patient's identity, and the specific request for simulation service remains stored safely behind the hospital firewall.
To request a CT2S analysis, firstly a member of clinical staff logs into the Hospital PACS Image Exchange system (PIX) and completes an image transfer request, specifying the fields "Subject ID" and "Subject Label". The PIX system transfers the DICOM files from the Hospital PACS system to the University XNAT. No personal data or identifier are shared across institutions. Secondly, the clinician logs onto the CT2S website and completes a submission form, ensuring that the field "Job Ref." matches either the "Subject ID" or "Subject Label" submitted to PIX.
CT2SWebApp, which manages the CT2S website by extending and overriding the django-multisim library, receives the metadata of the submitted job, validates the submission and updates the job status as the workflow progresses. It is also responsible for locating the images in the database, and coordinates the communication of metadata across the apps django-multisim and DataExchange, as well as the image transfer to ShARC, the Tier 3 HPC system at TUOS [22] , through the app DicomAnonymiser. The images are made available to the operator, who can now perform the FE analysis on the HPC cluster. Results from the analysis are then uploaded on the website and made available to the referring clinician in a PDF document.

XNAT
The image transfer elements of the workflow are provided by XNAT 1.7 [23] , an open source research platform for image-based biomedical research. XNAT allows users to collaborate on projects and share data and metadata using a database environment. For DICOM images most of the metadata is directly inherited from the image itself through their headers, which contain details on the image such as resolution, slice thickness, location and orientation of reference frames, and information on the patient such as name, sex and identification number, specifically "Subject ID" and "Subject Label". During the de-identification step, the clinical personnel generates generic identifiers to replace the metadata "Subject ID" and "Subject Label". The generic identifiers are shared with TUOS, while the mapping between them and the metadata is kept within the STH network. This process ensures that no information allowing identification of the patient leaves the Hospital network at any time.

PIX
The PIX system provides an interface between the Hospital hosted PACS and the University hosted XNAT. Before initiating a job submission, the clinician searches PACS using the patients hospital number to find the imaging studies for the analysis. Before initiating the transfer, the system requires to enter the study ID for the patient on the trial and to specify the destination project, as the XNAT server contains many projects for a wide range of research applications ( Fig. 4 ).
Technically the following steps take place: • The transfer request gets added to the job queue and waits to be started.
• The job starts and a "DICOM Send" request is sent to the PACS system for the desired studies to be transferred to the PIX server. PIX uses the Orthanc project as its DICOM node.
• The images are then anonymised with the requested trial ID and all potentially identifiable data within the DICOM image headers is removed. • The anonymised images are uploaded to the requested XNAT server via REST transactions [24] .
• The images are deleted from the PIX server and the job is flagged as complete.
The PIX service also has a batch mode where CSV configuration files containing the information can be uploaded and thousands of imaging studies can be provisioned automatically.

Components of the workflow: django-multisim, DataExchange, DicomAnonymiser, AMPQClient
The django-multisim (DM) is a TUOS developed app, based on Django [25] and integrated with other services provided by IN-SIGNEO. Django is a free, open source web framework written in Python [26] , which facilitates the creation of database-driven websites providing a variety of services and interface capabilities. DM and CT2SWebApp, which also provide a constantly running daemon (known as "ct2s-main") on the CT2S website virtual machine in order to communicate with RabbitMQ, intervene in all the phases of the workflow. DM validates a submitted job by checking that all the fields in the submission form have been correctly completed using a JSON schema. These fields are job ref. (must match the patient ID supplied to PIX), age, gender, weight, height, project, ethnicity. After the validation phase, DM retrieves the study metadata using the XNAT API and assigns the job to an operator, who is notified by email. Finally, DM uses JavaScript [27] to generate the final PDF report. The clinician is notified by email after the creation of the PDF file.
On the University side, DICOM images are initially stored in the University XNAT database. They are made available to the operator through a series of steps, the first of which is performed by the app DataExchange (DE), developed at TUOS in Python 3.6. Following job validation, DM sends to DE the metadata of the DICOM image needed for the study. After DE locates the study within the University XNAT database, it downloads it to its own virtual machine hosted within the University network. Following the download, DE sends a message to DicomAnonymiser via the AMQP-Client.
DicomAnonymiser (DA) is a TUOS developed utility, written in C# [28] . Despite its name, the app does not perform deidentification, as this is done within the Hospital network. This means that the University does not manage any personal data of the patients and only handles de-identified images. DA is used to receive instructions to transfer DICOM images downloaded by DE to the shared drive hosted on ShARC and notifies CT2WebApp of the successful transfer of the images. Communication between DA and other apps is facilitated using the messaging client AMQP-Client.
AMPQClient is the RabbitMQ [29] client which allows the apps involved in the workflow to send and receive messages. RabbitMQ is open source message-broker software that allows communication between apps using different communication protocols. It is written in Erlang [30] , but allows for integration with clients written in other languages. Exploiting this, the AMPQClient is written in Python and added as a library to the other apps of the workflow.

Components of the workflow: CT2SWebApp
CT2SWebApp, written in Python 3 and based on Django, is central to the entire workflow, as it provides the CT2S web site and allows users to interface with the front end of the service to initiate requests to perform a CT2S analysis. CT2SWebApp interfaces with the other apps and orchestrates their operations using the messaging functionalities provided by AMPQClient. A user account is required for submitting jobs to the platform. To create and manage users, CT2SWebApp extends the DM library: users are classified into three categories (administrator, operator and user), each with different privileges. All the classes can submit jobs, whose validity is assessed by DM by ensuring that all information necessary for the analysis has been provided. Following a job submission, CT2SWebApp, with DM functionality, validates the submission and, following validation, monitors the University XNAT database to locate the images associated with the job. This is done by checking whether the field "Job Ref." in the submission script matches either the "Subject ID" or "Subject Label" in the XNAT metadata. Furthermore, CT2SWebApp communicates via email with the end user, who is notified every time the job changes status. Possible job statuses are: • submitted: waiting for the corresponding study to be detected on the University XNAT service • pending: waiting for job data to be sent to DE after XNAT study metadata is retrieved • processing: job data has been sent to DE • failed: the CT2S analysis was unsuccessful • open: anonymised scans are deposited in the shared drive • done: results of the CT2S analysis are added to the job form • discarded: the job has not failed but CT2S analysis will not be completed for this job. This can happen because of multiple reasons (e.g. the input data is incorrect) After the analysis is complete, the operator submits to the website the data for the creation of the PDF report. CT2SWebApp extends DM to create the PDF report and notifies the end user of the termination of the job.

Storage
The operator does not have direct access to the images, and is not able to download them from the XNAT database. Instead, images are uploaded to a job-specific folder with restricted access rights on ShARC.

ITK-Snap, Bonemat, ICEM, ANSYS and MATLAB
The modelling elements of the workflow focus on providing an estimation of the strength of an individual's femur under a series of loading conditions, using a subject-specific FE model. This step involves the use of ITK-Snap [31] for image segmentation to isolate the bone surface, ICEM CFD 15 (ANSYS Inc, PA, USA) for meshing the segmented bone geometry using tetrahedral elements, Bonemat [32] for personalising the bone material properties, and ANSYS 17 (ANSYS Inc, PA, USA), running on ShARC, for performing the simulations. The material is assumed to be linearly elastic and heterogeneous, with each element being assigned its Young's modulus according to the corresponding attenuation value in the CT image [18] . A total of 28 load simulations are performed to comprehensively investigate the bone response under several fall configurations.The FE model used in CT2S implements the multipoint constraints method to describe the kinematics of the fall, and the contact between the femur and the ground surface is modelled as large sliding frictionless contact. The origin of the coordinate frame is located at the centre of the femoral head, with the axes defined using anatomical landmarks. The maximum principal strain criterion has been used to estimate the failure load [17] . Detailed methodologies have been published in previous papers [15,18] . Each load simulation requires 96 GB of memory shared across three processors in an OpenMP session. USFD has the capability of running the entire batch of 28 simulations simultaneously, but the analysis can also be run serially. Results are post processed in MATLAB 2018a (MathWorks, Natick, MA) with custom written scripts.

Upload interface
The end user interacts with the system through PIX, which is a system internal to the Hospital, and the website https://ct2s. insigneo.org/ct2s/ , which is managed by CT2SWebApp. Following log-in to the CT2S website, the end user has the possibility to submit a new job or to see the details of the jobs already submitted. New jobs are submitted through a dedicated submission platform.
As shown in Fig. 5 , the end user is requested to enter the age, gender, weight and height of the subject. The ethnicity can also be entered, although is an optional field. The fields "Project" and "Ethnicity" are a reference for the end user. The field "Job Ref.", instead, is fundamental for the correct execution of the workflow and must match either the "Subject ID" or "Subject Label" fields in the XNAT database.

PDF report
After downloading the images, building the model and performing the analysis, the operator generates the final report containing the information relevant for clinical assessment of bone strength. Figure 6 shows an example report.
The report contains information about the job, such as its "Job Ref.", the date of submission and the job number, as well as the name of the operator who performed the analysis. Minimum and maximum values of the strength of the femur are reported, together with a graphical representation of the strain field, for both stance and fall scenarios. Table 1 presents the timing of the workflow. The image transfer between the Hospital PACS and University XNAT is managed automatically within the Hospital network initially by PIX, and then by internal XNAT functionality. Following job submission, the CT2SWebApp continuously scans the University XNAT database to locate the scans associated with the requested job. Likewise, ct2s-main (provided by django-multisim and CT2SWebApp) and DataExchange run as daemons to minimise the waiting time associated with the transfer from University XNAT to HPC system (ShARC). Wall clock time for FE analysis is reported for both the parallel and serial runs. Despite most of the time being spent on the semi-automatic part of the workflow, more specifically during the segmentation of bone geometry, the total time for completing the workflow is less than a day, so clinical staff can review the data before the next appointment with the patient.

Discussion
The CT2S workflow has been developed with the clear target of integration within clinical practice, and aiming to provide clinicians with state-of-the-art predictive tools. The workflow has been developed in alignment with General Data Protection Regulations principles, which require that subjects must consent to the collection and processing of their personal data [33] . When patients are scanned for CT2S analyses, their personal data do not leave the Hospital network and the only metadata shared across institutions, "Subject ID" or "Subject Label", do not allow the identification of the patient. Patients also sign a consent form for their anonymised CT scans to be processed at TUOS.
In addition to prediction capabilities, economic considerations are also critical for an effective translation of modelling approaches to clinical practice and for a multicentre deployment of the workflow. Costs associated with the CT2S workflow include the scanning of the patient, the training of the operator, the purchase and maintenance of the required HPC resources and software licenses. The current version of CT2S adopts commercial software for meshing and FE simulations. To reduce costs and encourage a wider diffusion of the workflow it would be possible to replace them with open source meshing and FEA packages, although this could require additional effort in terms of code verification and validation to ensure the accuracy of the whole workflow. The main technical limitation of the workflow is the semi-automatic segmentation pipeline, which relies heavily on human intervention while the rest  of the workflow is automated thanks to existing software packages and scripts that link together the various software components, and weighs considerably on the determination of the cost of the service. The image segmentation is performed using open source software, which has been a deliberate design choice to reduce costs and foster the wider deployment of the platform. Elastic registration algorithms can assist and speed up the segmentation process [34] . These techniques work by warping template meshes, taken from anatomical atlases, to the patient's femur in order to fit relevant anatomical features. Alternatively, recent developments in machine learning have led to tools that can perform accurate segmentation in minutes, and in some cases these tools have been embedded within commercial software such as Simpleware (Synopsis Inc, Mountain View, CAL). Although the adoption of commer- Fig. 6. Snapshot of the PDF report made available to the end user. In the top half, details on the job are given. In the lower half, the predicted strength is reported for stance and falling and, for each configuration, the corresponding deformation field is shown.
cial software for automatic segmentation would certainly reduce the overall processing time by limiting the human intervention to the quality assessment of the generated model, it would also cause an overall increase in the cost of the service. However, in recent years studies have emerged that present state of the art neural networks that are able to produce high quality segmentation of femurs starting from CT images [35] and generate meshes for finite element analysis [36] . Further advancements in the technology will make such tools more abundant in the future and allow an easier integration within the CT2S workflow.
To make the workflow sustainable the costs must be balanced by the price of the service. An analysis recently reported by Viceconti et al. [37] concluded that the CT2S pipeline is economically preferable to traditional BMD analysis in clinical studies aiming at strength estimation, which is the main output of the workflow. This is based on the observation that CT based FE models require half the subjects needed by BMD methods to achieve the same statistical power, which implies a significant reduction of the costs associated with the study that are sustained by the healthcare provider. The pipeline can also be economically viable for osteopenic patients, if used in combination with BMD and if the cost of the simulation service is kept sufficiently low. It is however to acknowledge that CT2S is currently not cost-effective when used in clinical studies aimed at the prediction of the risk of fracture [37] . We recognize that this preliminary health economics analysis is limited to the model established at STH/TUOS, or the UK NHS system, and needs to be further expanded in order to investigate the impact of deploying such a workflow at other UK centres and in other countries. Also, more specific economical consideration related to the use of CT2S in the clinical practice are not possible at the moment as currently it is not recognised as a medical device by any regulatory authority.
Currently, the CT2S service is only available in Sheffield, UK. However, besides the meshing and simulation parts and the PIX system, which is internal to STH, the workflow is based on open source software. The workflow has potential to be deployed in other institutions, and The University of Bologna and Istituto Ortopedico Rizzoli are currently implementing the CT2S workflow in Bologna, Italy. A successful multicentre deployment requires that the participating centres possess the necessary infrastructure for transferring the images from the hospital networks to an appropriate database, as well as the HPC capability to run the FE analysis. HPC systems with the capability of running parallel jobs can guarantee that the results are made available to the clinical personnel in a timeframe compatible with current clinical workflow, but are not strictly indispensable. As long as calibration data are available, the workflow is applicable to images acquired with any type of CT scanner. To ensure consistency of the analysis it is fundamental that the scanning procedures are consistent across the centres where the workflow is deployed. To this end, different calibration procedures can be defined according to the CT scanner and acquisition sequence. Calibration data can be provided either scanning a Mindways phantom (Mindways Inc, Austin, TX) together with the subject, or retrospectively through an European Spine Phantom (ESP). In case an ESP is used, we ensure that the calibration is uniform across different machines by defining the recommended scanning parameters to be used for the acquisition, including the kernel for image reconstruction. Scanning parameters such as voltage, current, slice thickness and pitch are chosen in order to minimise the total radiation exposure as estimated by the ImPACT dosimetry calculator [38] . However, each healthcare provider adopting the CT2S workflow would need to perform a calibration study together with the estimation of the radiation exposure, in order to produce scans of adequate quality while preserving the health of the patient. A previous study by Viceconti and colleagues [37] has shown that, despite the radiation dose associated to a CT2S analysis is higher than the radiation from a BMD study, the patient benefits from an overall reduction of the mortality risk when the additional absorbed radiation is factored together with the reduction in death risk from bone fracture. Machine learning algorithms for scanning optimisation [39] could be used, in future developments, for further reduction of the radiation dose and standardisation of the scanning procedure.
As already mentioned, another service for bone strength estimation exists. VirtuOst is an FDA-cleared software for bone strength estimation from medical images, provided as an online service. It uses as input DICOM images from CT scans. The pipeline requires calibration, which can be performed either through a phantom like in the case of CT2S, or using internal organs and tissues as a reference. Unlike CT2S, whose analysis is limited to the proximal femur, VirtuOst can also process images of vertebras. The resulting FE model of the bone, meshed using 10-node cubic elements, is loaded with a single force evenly distributed to the bone surface by means of a thin layer of plastic [8] . Bone plasticity is also taken into account, leading to a nonlinear FE model. CT2S instead employs a 8-node tetrahedral discretisation, which results in smooth meshes, and estimates the bone strength applying a wide array of loads [18] . Material nonlinearities effects are not considered in the CT2S workflow.
As mentioned above, CT2S is currently not recognised as a medical device by any regulatory authority. In particular, any medical diagnosis tools need to be approved by the UK's Medicines and Healthcare products Regulatory Agency (MHRA), before they can be placed on the market for medical purposes in the UK. Detailed comparison with VirtuOst's cost model is not possible because of the marked differences in healthcare business model between the US (largely owned by private companies) and the UK (publicly funded) Currently the workflow operates with data collected during one scanning session, and estimates femoral bone strength at that given time. The workflow can also be used alongside other predictive tools, such as FRAX [40] , which takes into account patients medical history, or multiscale probabilistic description of the risk of falling and the corresponding forces, in order to provide the current absolute risk of fracture, or ARF0 [41] . Work is currently underway to extend the mathematical model in order to predict the risk of fracture in the next 10 years, or ARF10 [42] , taking into account a statistical model of the bone ageing process for each individual. This could be integrated into the current CT2S workflow to produce a more complete prediction of a patient's risk of fracture in the short to medium term.

Conclusion
The CT2S platform as a proof of concept, is set up and functional. Based on an intuitive and user friendly interface, the CT2S service gives clinical staff access to predictive tools based on engineering solutions, while avoiding the need for them to undergo extensive training to use the backend of the software. The service has clear potential benefits in assessing the risk of fracture with existing methods, and has the potential to provide clinicians with additional quantitative data for the diagnosis and treatment of osteoporotic fracture in the future. The thorough description of the workflow presented here can foster the wider implementation of the workflow in other clinical settings, or its integration within similar patient-specific model-based systems for support to clinical decision.

Declaration of Competing Interest
The authors declare that they have no known competing financial interests or personal relationship that could have appeared to influence the work reported in this paper.