Digital Twins in Healthcare: An Architectural Proposal and Its Application in a Social Distancing Case Study

The digital transformation process fostered by the development of Industry 4.0 technologies has largely affected the health sector, increasing diagnostic capabilities and improving drug effectiveness and treatment delivery. The Digital Twin (DT) technology, based on the virtualization of physical assets/processes and on a bidirectional communication between the digital and physical space for data exchange, is considered a game changer in modern health systems. Digital Twin applications in healthcare are various, ranging from virtualization of hospitals' physical spaces/organizational processes to individuals' physiological/genetic/lifestyle characteristics replication, and include the modeling of public health-related processes for monitoring, optimization and planning purposes. In this paper, motivated by the current COVID-19 pandemic, we focus on the application of the Digital Twin technology for virus containment on the workplace through social distancing. The contribution of this paper is three-fold: i) we review the existing literature on the adoption of the Digital Twin technology in the healthcare domain, and propose a classification of DT applications into four categories; ii) we propose a generalized Digital Twin architecture that can be used as reference to identify the main functional components of a Digital Twin system; iii) we present CanTwin, a real-life industrial case study developed by Hitachi and representing the Digital Twin of a canteen service serving 1100 workers, set up for social distancing monitoring, queue inspection, people counting and tracking, table occupancy supervision.

increasing [1].In modern medicine, digital services help patients and physicians with data collection, facilitate clinical communication, increase diagnostic capabilities, and enable to improve drug effectiveness and treatment delivery.
The digital transformation process that currently affects all sectors including health has begun in 2013 with the Industrie 4.0 initiative.It lies its foundation on the massive exploitation of innovative information and communication technologies including Internet of Things (IoT), cloud/edge computing, Artificial Intelligence (AI) and Big Data Analytics.Based on the above technologies and used primarily by industrial and engineering companies, the Digital Twin (DT) paradigm is considered a pro-medical breakthrough to improve clinical outcomes and public health management.Digital Twins consist of a digital representation of physical assets, characterized by a bidirectional communication that allows real-time data sharing between the digital and physical space.By leveraging such data, a Digital Twin can perform many functions, e.g., monitoring and controlling the physical twin or predicting its future behavior [6].
During the last decade, several applications of the DT technology to the healthcare sector have been proposed, ranging from the virtualization of hospitals' physical spaces or organizational processes for optimization purposes, to the modeling of clinical processes or of individuals' physiological/genetic/lifestyle characteristics to improve illness treatment and enable personalized medicine.In this regard, one of the most impressive applications of the DT technology is represented by the so-called Human Digital Twin (HDT), which has the ambition to virtually replicate aspects related to human anatomy, physiology (including human body organs or body micro-structures), genetics, and/or lifestyle.However, despite few examples in the cardiology field [12], [13], [15], the development of human Digital Twins is still in its infancy and their concrete application on a wider scale to improve individuals' health is still far.On the contrary, DTs can be successfully used to improve population-level health when integrated in public health management processes, thanks to their monitoring, optimization and planning capabilities.
Nevertheless, the scientific literature remains largely focused on the use of DT technology in disease treatments and preventive interventions, often cutting out other potential health-related applications (e.g., surgery).Furthermore, academia provides high-level descriptions on how to realize a Digital Twin, so it is quite difficult to find out a generic solution for the implementation of a Digital Twin.In contrast, successful real applications This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
(e.g., "SIMULIA Living Heart") do not provide sufficient detail to meet this objective.
Since early 2020, the world has been facing the COVID-19 pandemic that required governments and public health organizations to put an extraordinary effort both into the patients' medical treatment and into the infection tracking and containment.In such a critical situation, the management of mass processes such as screening and vaccination, the tracking of infects, and the implementation of virus containment measures have been and are of uttermost importance, comparable to the development of new vaccines and treatments.In this paper, in particular, we focus on the application of the DT technology for virus containment on the workplace through social distancing, which has been demonstrated to be an effective strategy to slow down the spread of the virus.While Digital Twins have been used to analyze the impact of social distancing in both academic [32] and professional [33] contexts, no details on the implementation architecture are available, which is a common issue in the existing literature on Digital Twins.In fact, although few researchers have focused on the necessary elements for the creation of a Digital Twin [5], [36], a reference architecture is still lacking.
The contribution of this paper is three-fold: r we review the existing literature on the adoption of the Digital Twin technology in the healthcare domain.In contrast to existing studies mainly focused on Digital Twin use for preventive medicine, we propose a classification of the wide range of DT applications into four categories, also taking into account further potential uses of Digital Twins, such as surgery; r we propose a generalized Digital Twin architecture that can be used as reference for the realization of DT-based applications.In particular, we integrate the Digital Twin functional components in a six-layer architecture that enables not only the seamless bi-directional flow between physical and digital world, but also presents the opportunity of implementing a range of services achieved through the capabilities of the Digital Twin; r we present CanTwin, a real-life industrial case study de- veloped by Hitachi Rail and representing the Digital Twin of a canteen service serving 1100 workers.Implemented in accordance with the proposed architecture, CanTwin provides not only social distancing monitoring, but also queue inspection, people counting and tracking, table occupancy supervision.This is the first application of the Digital Twin in an actual working environment, developed with a generalized architectural approach, in order to ensure, after the pandemic, a safe return to the workplace.The paper is organized as follows.Section II briefly introduces a formal definition of a Digital Twin and provides a review of the state of the art of the healthcare-related Digital Twin literature and industrial implementations based on a case study-oriented classification.Section III discusses a reference architecture for Digital Twin systems.Finally, Section IV illustrates the CanTwin industrial case study, providing several details on its development, on the technologies used for its implementation and on its features.To conclude, Section V draws our conclusions and future directions.

II. DIGITAL TWINS AND THEIR ADOPTION IN THE HEALTHCARE SECTOR
A Digital Twin (DT) can be defined as "a dynamic and self-evolving virtual representation of a real world entity and it is characterized by a bi-directional communication that allows real-time data sharing between physical and digital equivalents" [6].According to Tao et al. [34], a DT can be formalized as the following quintuple: where i) the Physical Space (PS) consists of real entities (i.e., processes, plants, systems, humans), and their internal and external interactions [2]; ii) the Virtual Space (VS) contains the digital replicas, fed with real-time data obtained from the physical world combined with historical data; iii) the DT Data (DD) are Digital Twin fuel, gained from domain experts, the physical world and/or generated through virtual models and DT-based services [34]; iv) the Services (Ss) offered through the DT technology are simulation, real-time monitoring, control, optimization of new or existing assets, prediction of future states; v) finally, there are the Connections (CN) that enable the cooperation between the four parties.
In the remainder of this section, we delve into the literature related to the adoption of the Digital Twin technology in the healthcare sector, proposing a classification into four categories based on the application purpose, namely (i) improving individual patient treatment, (ii) training and supporting surgeons and physicians for invasive clinical procedures, (iii) improving pharmaceutical processes, and (iv) improving public health management.

A. DTs for Patient Treatment
A growing and emerging approach to healthcare is the socalled predictive, preventive, personalized and participative medicine (P4 medicine).It is aimed at offering predictive, preventive and personalized treatments to individual patients and is capable, thanks to the participatory component, of maximizing the efficiency of medical systems by bringing its application from hospitals and clinics to homes, workplaces and schools.In fact, it is designed to solve health problems by providing disease treatments and preventive interventions adapted to variables such as genetic heritage, lifestyle and environmental factors, that make every patient unique [1].P4 medicine is sustained by the growing ability to acquire comprehensive data on the pathophysiology of the patient, but also by digital health industry data integration, i.e., lifestyle data (e.g., data about activity levels, sleep and nutrition) and clinical institutions data (e.g., clinical records) [10], [9].P4 medicine requires not only better and more detailed data, but also an increasing computing capability to analyze, integrate and exploit these data [10].
The Digital Twin technology applied to P4 medicine expands the Digital Twin concept used in engineering industries.For example, the Swedish Digital Twin Consortium (SDTC) is working on a personalized medicine strategy based on Human Digital Twin (HDT), the digital representation of human body organs or body micro-structures.These models can be expanded to incorporate external factors, including the environment surrounding individual and social interactions over the observed periods.Various types of human Digital Twins can be developed, such as twins of the entire human body, or of a single body system or body function (e.g., digestive system/function), of a single body organ (e.g., liver, heart or brain), or finer body component levels (e.g., cellular, sub-cellular or molecular levels) [6].A digital replica can also be created for a specific illness or condition (e.g., a diseased body organ or liver with nonalcoholic hepatic steatosis) or for other relevant organisms (e.g., a virus) [6].Aggregated Digital Twins (DTA) integrate two or more of the above types.Rivera et al. [30] defined an HDT as a set of interrelated and virtual anatomical structures (AS) and propose a two level preliminary reference architecture for its implementation.
An HDT will follow each individual life-cycle by exploiting data collected from wearable sensors, lifestyle information and evidences obtained from clinical institutions, moving the clinical approach towards preventive healthcare.In fact, the HDT potential lies not only in the construction of unlimited twins of individual patients, but also in the possibility to treat these DTs with different drugs, to identify the best performing drug and the correct treatment of the patient with this medicine (Fig. 1).The HDT applications are not restricted to medical situations.For example, Löcklin et al. [29] proposed a conceptual architecture to create a human Digital Twin of the "Operator 4.0", with the aim of creating human-centered Cyber-Physical Systems that improve workers' skills.
A promising research area of DT application for patient treatment is precision cardiology, which aims to develop the DT of the human body cardiovascular subsystem.The "SIMULIA Living Heart" project, a five-year collaborative research of Dassault Systémes and the Food and Drug Administration (FDA), is the first study to specifically use Digital Twin technology to observe the body's interaction with drugs [13].Educators, cardiovascular scientists, medical device developers, physicians and numerous institutions are working together to create the model.With computer simulation, physicians have the chance to see what they are normally unable to see because of the heart tissue mobility and to investigate the heart complex structure by experimenting with the same organ model [12], [13].Moreover, Martinez Velazquez et al. [8] presented "Cardio Twin" architecture of a heart Digital Twin running on the edge to support Ischemic Heart Disease (IHD) event detection.
According to [10] and [14], it is necessary to model human heart with his characteristics using mechanistic and statistical models.Mechanistic models include our knowledge of physiology and fundamental laws to integrate and expand experimental and clinical data to identify mechanisms and/or predict outcomes.Heartflow FFRCT Analysis (Heartflow, USA) and CardioInsight (Medtronic, USA) use patient-specific mechanistic models for noninvasive calculation of clinically relevant diagnostic evidence: Heartflow generates a custom 3D model of the patient's coronary arteries and simulates blood flow to forecast fractional flow reserve; the CardioInsight Mapping System generates a customized model of the patient's heart and torso, and then simulates electrical activity on the cardiac surface based on body surface potential records [15].

B. DTs for Physicians and Surgeons Training and Practice
Most applications of the Digital Twin concept to the medical domain focus on improving patient treatment, as we have seen in Section II-A.However, it is worth mentioning an emerging class of DT applications focused on improving surgical practice [16].In fact, a real-time replica of a patient can improve surgical training for residents and assist physicians in surgical practice.
Aubert et al. [17] presented a Digital Twin-based approach for constructing personalized models of bone trauma, in order to quantify the bio-mechanical interest of stabilization variants at different stages of bone healing.The Digital Twin is composed of geometric models of bone fragments, material properties and specific morphological load of patient, i.e., maximum load during walk activity.Hagmann et al. [18] provided a training approach for Minimally Invasive Robotic Surgery (MIRS) that retrieves background information from the Digital Twin to speed up the competent use of the robotic system for junior surgeons.In this way, it is possible to increase surgeon performance thanks to tactile assistance, but also to reduce the necessary skill level and cognitive load of a surgeon performing MIRS.
The physician David Hoganson of the Department of Cardiac Surgery of Boston Children's Hospital, in collaboration with Dassault Systémes, treated an 18-year-old patient with an enlarged right atrium (which made Fontan's circulation very inefficient) with a special bracelet that creates a smooth transition from the canal to the native pulmonary arteries (Fig. 2) [19].Using 3D modeling and flow simulation, it was possible to design the perfect bracelet to reach the desired flow.
Although there are few examples of Digital Twin applications in the surgical sector, it is possible to appreciate their great potential in this area.For example, the DT technology may be used to simulate invasive clinical procedures, in order to predict the outcome before the therapy is selected, increase intervention success, and reduce patient risks.

C. DTs in the Pharmaceutical Industry
The pharmaceutical industry is going through a paradigm shift with the advent of Industry 4.0, taking part in the digitization movement referred to as Pharma 4.0 [20].Although the FDA promotes an agile, efficient and flexible view of the pharmaceutical industry, industry's preparation for this digitization remains unsatisfactory [22].Most pharmaceutical and biopharmaceutical processes rely on quality controls, laboratory testing and standards for product quality, while process data and models are less impactful [20].Drug companies lack knowledge and familiarity with the new digital movement and that hinders the introduction of these technologies.
Pharma 4.0 Digital Twin applications can be grouped into the following two categories: r Pharmaceutical production process: the Digital Twin technology has the potential to support smart manufacturing at various stages of pharmaceutical product development.In the design stage of product development process, applying the Digital Twin technology can accelerate the process of selecting a production path and its unitary operations, as it is possible to represent physical parts with different models that are simulated enabling product quality prediction, higher productivity, reduction of physical experiments time and cost [20].In the operational phase, real-time process performance can be monitored and displayed at any time and the DT can constantly analyze the system to provide process control and optimization information.This category also includes the bio-pharmaceutical production process, the development of large molecule-based products in heterogeneous mixtures, which can be used for the treatment of cancer, inflammatory and microbiological diseases.To comply with FDA standards and obtain safe products, biopharmaceutical operations must be strictly controlled and operate in a sterilized process environment [20].Therefore, bio-pharmaceutical production can be supported in product development and risk analysis by using the Digital Twins through the integration of physical plant models with collected and analyzed data.
r Drug discovery and development: these activities require efforts in biology, chemistry and production and are characterized by a low likelihood of success.Modeling of genomic and cellular bio-processes has been actively supported by funding organizations such as DARPA, NSF, DOE in the US and has led to high-profile projects like Biospice [21].Subramanian [21] proposed a top-down approach for creating a DT that integrates information from a variety of scientific and clinical sources in order to present complex and dynamic relationships within biological networks.In this way, predictive methodologies can be applied to drug discovery and research, bio-markers identification, test development, screening and clinical trial optimization [21].The Digital Twin is the result of a close integration between the physical world and the digital world, which is also one of its core problems along with the need for interconnected data communication channels.Despite the high attention of industries, Digital Twin application to pharmaceutical and biopharmaceutical production is still lagging behind.

D. DTs in Public Health Management
Public health concerns the interactions between individuals, the health status of patients within a community and the factors that affect health at population level.Public health is focused on promoting the population well-being, as well as monitoring, controlling and preventing outbreaks.The COVID-19 pandemic has brought to light the need to actuate the transition from public health to digital public health that includes use of technology (e.g. the Digital Twins), new types of data and new ways of working for people's well-being [31].
First of all, Digital Twin applications in public health are mass processes monitoring, optimization and planning.Pilati et al. [25] designed a Digital Twin of a walk-in vaccination center to fight COVID-19.By simulating the vaccination process in real time and collecting real-time data, the Digital Twin aims to find the ideal setup for the clinic and improve its planning an adaptive manner.Mason et al. [32] analyzed the impact of social distancing in an immersive environment by making use of the virtual reality technology in order to create the digital replica of the University of Derby.Mukhopadhyay et al. [33] created a Digital Twin of an existing laboratory space for remote monitoring of room occupancy and automatically detecting violation of social distancing.
Moreover, after the lesson learned from COVID-19 pandemic, the interest in the use of Digital Twins for viral infections evolution prediction has increased: Laubenbacher et al. [26] explored the potential of the DT technology to fight future pandemics, combining mechanistic models, observational data, historical medical data and the power of artificial intelligence.However, a Digital Twin which can continually reproduce the complexity of infection and immune responses well enough to guide individual therapy is currently out of reach [26].
The Digital Twin technology has also been used to build a virtual replica of a hospital.Siemens Healthineers undertook a study to improve hospital processes due to high patient demand, increased wait times, etc.: a Digital Twin of the radiology department was created (Fig. 3), supplied with real data; based on the information provided by the Digital Twin, modifications were made to the planning and organization of the hospital radiology department [27], [12].
Karakra et al. [28] provided a framework for developing a hospital's Digital Twin (HospiT'win) to help healthcare providers track patients, monitor their behaviors and predict future medical outcomes.This solution enables the transition from traditional to information technology-based hospitals that respond to the provision of "right care in the right place at the right time".This application category also includes smart healthy cities: smart cities based on Digital Twins have broad perspectives for economic transformation, smart urban management and smart public services [23].Derent et al. [23] introduced a virtual system, integrated in a smart city, to track and manage outbreaks based on experience in managing COVID-19 pandemics in China.Instead, EL Azzaoui et al. [24] implemented a decentralized system using people's smartphones Digital Twins, integrated with blockchain technology that records any data (suggestive symptoms of COVID-19 or test results) in the shared database, for the management of the COVID-19 pandemic (and other pandemics) at city level (population) [1].
There are also the Virtual Singapore, which uses the state Singapore Digital Twin to create a smart city in order to help people with reduced mobility, and the city of Boston Digital Twin that helps planners visualize proposed buildings, especially high-rise ones, and their impact on the health of living and working conditions in surrounding neighborhoods.

A. DT Architectures: An Overview
Software architectures (SAs) are mainly characterized by software components, inter-relationship and their properties and strongly influence the ability of software systems to meet functional and quality requirements.Therefore, SAs are cornerstones for the engineering and development of complex softwareintensive systems such as Digital Twins [37].However, despite their remarkable adoption in different domains and their strategic relevance, there are still several open issues and challenges related to the set-up and engineering of Digital Twins (DTs) that must be further investigated.Among them, the lack of a reference architecture for DT implementation urges particular attention.
In order to cope with this issue, we analyzed the recent DT literature, paying special attention to the healthcare context.Our aims are to identify the main architectural solutions adopted for DT implementation, and to spot the adoption of specific architectural patterns.In particular, we analyzed all the articles cited in Section II, which propose specific DT solutions in the healthcare domain, and extracted from them available architectural information.Table I reports the results of this analysis, which was focused on determining (i) whether the paper explicitly mentioned architectural aspects related to the proposed solution, (ii) if yes, which pattern was used, (iii) what kind of models was leveraged by the DT solution, (iv) what data were processed, (v) what kind of services were offered.Moreover, we also collected information regarding the (vi) validation methodology used and the (vii) quality attributes evaluated.
As it clearly appears from the table, most of reviewed articles do not include a clear reference to architectural aspects (ND).Instead, they focus on the description of the modeling approach adopted to solve the specific problem.This way, they essentially confuse a DT with a model, while it is much more than this.It is therefore hard to identify the different components involved in DT operation and their functionalities, and this contributes to increasing a general ambiguity and vagueness around the DT concept.However, according to the recent survey of existing software architectural solutions for DTs [37] and as also shown in Table I, the most recurring architectural pattern is the layered one.The reason for this orientation is that a layered architecture enables to manage the inherent complexity of a DT system, consolidating syntax and semantics of different perspectives.Layers may refer to the separation between the physical and virtual worlds, to the different capabilities/functionalities involved, or even to the technological aspects (i.e., the computing platforms and paradigm such as IoT, edge and cloud computing).In general, the layered pattern usage increases modularity and flexibility [37], [38].Another remarkable solution is represented by the combination of the layered pattern with the Service-Oriented Architecture (SOA), because the latter makes it possible to provide a platform and devices-independent system supporting inter-operable machine-to-machine interaction on a network.In this context, some micro-services-based solutions have been proposed justified by their flexibility in building data-intensive applications [37].
To conclude the overview on the results of our analysis, it is worth noting that most of the existing architecture proposals are validated by means of examples and from a qualitative point of view by analyzing their functional suitability and, in a few cases, with qualitative metrics related to performance.Instead,  most of the articles do not even mention (NM) how software architectures are validated and consequently neither what kind of quality attributes (QAs) they aim to address.These results confirm that architectural solutions for DTs are still maturing, and that the testing on real systems is still limited.

B. A Reference DT Architecture Proposal
Based on the information gathered from the above mentioned articles and on the analysis of the literature extended to other contexts, we propose a Digital Twin conceptual architecture that may be used as a reference to identify the main functionalities that must/may be found in a DT solution.In line with the general 5D model proposed by Tao et al. [34] and with existing approaches, the conceptual DT architecture, depicted in Fig. 4, is structured into four horizontal and two vertical layers.Precisely, each dimension identified in [34] corresponds in our proposal to a layer of functionalities that will be implemented through one or more components.In addition, a Security layer has been devised to cope with the inherent security threats to which every level is subject.
The Physical Twin layer consists of objects, resources, products, equipment, systems, processes, generally the entities of the physical world and their complex internal and external interactions.From a functional point of view, this level includes sensing, actuating and control & configuration capabilities to respectively capture events or changes, respond to the set of inputs and control physical entity behavior.
The Data layer must manage data persistence, in order to enable the Digital Twin to store various types of data.Their multi-temporal, multi-dimensional, multi-source and heterogeneous nature requires the presence of suitable elaboration capabilities (e.g., pre-processing, filtering, aggregation) [34].Finally, data are usually made available to end-users through suitable presentation interfaces.
The Digital Twin layer includes both the actual physical entity replica and the engine that enforces the closed-loop connection between the physical and digital worlds.It provides modeling functionalities, reasoning on data for knowledge extraction and feedback generation capabilities, and it also enables direct interaction with end-users via a suitable human-machine interface (HMI).
The Physical Twin layer, the Data layer and the Digital Twin layer represent the architecture core, which will be further detailed in the next subsection.The functionalities offered by the core are leveraged by the Service layer to build specific applications.The full range of services that can be offered via Digital Twin technology represents a recent research focus of DT literature [4], since Digital Twins can offer an extensive spectrum of already existing services enhanced with data and DT capabilities or new ones.In fact, recently Tao et al. [39] identified 18 different services that leverage upon DT technology: the primary services are depicted in the Service layer in Fig. 4, i.e., simulation, real-time monitoring, remote control, optimization of new or existing products/processes, prediction of future states and significant changes, such as faults, in the product's life cycle [4], [39].For example, as shown in column services of Table I, Corral-Acero et al. [10] discuss the application of DT technology for precision cardiology in order to increase clinical interpretability and realize accurate predictions of the underlying causes of a disease.However, the DT concept has been expanded to education, management (e.g., guidance of COVID-19 pandemic at city level [24]), detection, virtual commission, assessment and so forth [39].
The Connectivity layer enables real-time data exchange so that the Digital Twin does not merely reflect physical entities' dynamics in the virtual world, but it is also able to control them using model analysis results.Luan et al. [35] identify two types of communication: intra-twin communication that allows the exchange of data collected by different sensors (from the physical to the digital level) and of information processed by model analysis (from the digital to the physical level); inter-twin communication that occurs when digitally replicated physical entities communicate with one another.For this reason, physical and Digital Twins must be equipped with network devices to allow seamless connection and data exchange through direct physical communications or cloud-based indirect links.In this regard, the Edge Computing paradigm has facilitated the development of DTs by distributing processing capabilities closer to data sources and enabling low-latency communications with processing systems.On the other hand, advanced networking capabilities providing reliable, high-performance communication links enable to transfer data onto cloud-based platforms for storage and analytics purposes.The level of connectivity is shown vertically because it does not simply achieve the two-way flow between the physical and digital world but it also enables the communication between the other levels, allowing data storage and pre-processing and the services exploitation through the Data and Service layers respectively.
The Digital Twin, as any cyber-physical system, may contain vulnerabilities at different levels of the architecture, which is why, like the connectivity layer, the Security layer is represented in vertical.At the physical level there may be attacks targeting devices such as damage, replacement or even theft.Consequently, device identity and access management capabilities guaranteeing authentication and authorization are necessary to ensure that deployed sensors are not altered and that the data produced are reliable.Attacks may also affect communications by disrupting service delivery (denial of service attacks) or by altering exchanged data (via packet injection or hijacking and spoofing) [7].
To protect these data, the transmissions should be secured by means of encryption measures, and suitable intrusion detection systems should be deployed to protect the system from both internal and external attacks.Hacking personal, confidential or valuable information could adversely affect all sources involved in the physical environment; in particular for DT technology applications in medicine and health, security and also privacy must be taken into account [3].
In the following subsection, we will illustrate more in detail the physical, data and digital layers, by describing the main logical components providing the functionalities introduced above and their mutual interactions, as described in Fig. 5.We will not examine the connectivity, security and service layers in depth since they heavily depend on the involved technologies and on the physical system, on how it is instrumented and the objectives to be pursued by implementing applications based on Digital Twin technology.
C. The DT Architecture Core 1) Physical Twin Layer: According to Qi et al. [34], the digitization of physical entities requires a knowledge of the physical world working dynamics and perception of related data.Consequently, it requires parameters measurement (size, shape, etc.), real-time data collection (vibration, temperature, humidity, etc.) and actuator control to perform specific actions.These functions can be accomplished by means of specific devices commonly referred to as sensors and actuators.Sensors, suitably deployed in the physical assets, measure essential inputs to the physical process and the surrounding environment.They generate signals, appropriately transformed into digital messages, that enable the virtual counterpart to acquire real-world operational data relative to the physical performance criteria of the asset (e.g.tensile strength) and environmental data that affect how the physical object works (e.g.ambient temperature).There are conventional sensors that are electronic devices that can measure position, temperature, light and so on; smartphones incorporate some of them, like GPS, gyroscope, accelerometer, camera, microphone, light, proximity, heart rate.In some contexts, also social networks can be regarded as sensors, because they are now part of our lives and therefore, information such as the level of social interaction can be derived or user behavior can be analyzed [8].In the healthcare context, commonly used sensors are able to monitor physiological signs and activities including hearth and respiratory rate, oxygen consumption, blood pressure, blood glucose, body temperature etc.Once the parameters are collected, certain decisions may be taken locally to control suitable Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
actuators based on specific algorithms [2], which typically are run by controllers (either integrated within the sensing/actuating unit or external).
Sensing, actuation and control&configuration capabilities are represented in our proposed architecture by means of the Sensor, Actuator and Controller components, respectively.Both Sensor and Actuator have a dependency relationship with Controller, who is responsible for their specification and that acts as interface for (i) transmitting collected physical data to the upper layer, by invoking the PhyDataTransmission-API offered by the Connectivity layer; (ii) accepting commands from the Digital Twin layer through its ControlAPI and forwarding them to Actuators; (iii) configuring Sensors and Actuators with parameters specified by human operators through the ConfigurationAPI, in order to possibly implement self-adaptive behaviors [7].
2) Data Layer: All data generated by the Physical Twin layer are concentrated in the Data layer, devoted to storing and elaborating them, and responsible for their presentation to end-users.Apart from data captured by sensors, this level also manages information coming from the digital world (i.e., data generated by virtual models) and from the service layer.As these data have a significant size (Volume), are produced at very high-speed, ideally real-time (Velocity) and are heterogeneous (Variety), the Data Layer is essentially responsible for managing Big Digital Twin Data (BDTD) [40], [41].This does not just affect the technologies used to build-up this layer of data-related functions, but also how these data must be processed in order to extract useful information (see subsubsection III-C3).
Persistence is guaranteed by the DataStorageUnit component, which is responsible for ensuring access to several types of data, namely environmental, operational and historical data.These data are directly managed by three dedicated components (EnvironmentalData, OperationaData, Histori-calData), by means of the DataAccessAPI.As discussed in [2], data repositories can be of two kinds: data lakes, such as SQL/NoSQL databases or cloud storage (Amazon S3, Google Cloud Storage, etc.), which are ideal for the quick storage of a large amount of data as they easily extend at a low cost, and data warehouses, which aggregate data from many sources, such as Azure SQL Data Warehouse or Google Big Query.
Data generated by the Physical layer and transmitted by means of the PhyDataTransmissionAPI offered by the Connectivity layer are received (thanks to the same API) by the DataMan-agementUnit component, which typically performs some pre-processing.In addition to filtering and aggregation, this component may be also responsible for formatting data in order to fit certain standards (e.g., in the medical field the IEEE x73 standard can be used [8]).After elaboration, the DataManage-mentUnit invokes the DataAccessAPI offered by the DataS-torageUnit component to store data persistently according to their type.Moreover, the DataManagementUnit is also responsible for collecting information from the Digital Twin layer, such as events and commands, which are received by using the DTDataTransmissionAPI offered by the Connectivity layer.Even in this case, received data will be stored by invoking the DataAccessAPI offered by the DataStorageUnit.Finally, the DataPresentationUnit is responsible for presenting data stored and managed in the Data Layer to end-users.
3) Digital Twin Layer: The Digital Twin layer is characterized by the elements that Schroeder et al. [5], [36] have identified as necessary to create and manage a Digital Twin: r models, created during the different phases of physical asset life-cycle.Qi et al. [34] highlighted different usable models: geometric models for describing structure and topology, mathematical models that describe the physical entity using a set of equations.There are also the behavioral models (how the physical entity behaves) and the rule-based models that extract rules from prior data and experts knowledge.The two main modeling techniques are the followings: i) simulation techniques depend on the nature of the physical system, therefore require detailed knowledge of the real system functioning; ii) data-driven techniques characterize a system and find input-output relationships from data.Some of these models are executable and usually interoperable [29], so we need to figure out how to integrate all of them [5].In fact, in our architecture, the different types of involved models are managed by dedicated components (PhysicalModel, RuleModel, Be-havioralModel, GeometricModel), which are included in a composite entity named DTModelUnit offering a ModelAccessAPI to expose models' parameters and features.
r data, including both the information representing the knowledge extracted by observing the physical world and the data generated by the models, i.e. simulation results or models changes performed in real time.In our architecture, these two types of data are managed by dedicated components (PhysicalTwinData and ModelData, respectively) that, in turn, are orchestrated by the DTDataPro-cessingUnit, which offers the DTDataProcessingAPI for data access.
r knowledge extraction algorithms (e.g., AI) that make it possible to process large quantities of data and to extract the so-called "right data" [3].In our architecture, reasoning capabilities are offered by the CognitiveUnit, responsible for extracting knowledge from data coming from the physical layer and pre-processed by the Data layer (collected by using the DTDataTransmissionAPI offered by the Connectivity layer).So, the CognitiveUnit is characterized by big data analytics, i.e., process that analyzes big data and converts them to valuable information, using state-of-the-art mathematical, statistical, probabilistic or artificial intelligence models [40], [41].During the entire process, various big data processing tools may be utilized: one of most popular big data management tools is Hadoop that offers parallel processing capabilities with multiple compute nodes [40], but there are also others developed such as Cassandra, Storm, S4, Spark, etc.The CognitiveUnit generates the data that will be managed by the PhysicalTwinData component introduced previously.For example, Martinez-Velazquez et al. [8] realize the Digital Twin of heart, Cardio Twin, that uses Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
Tensor flow Lite models to classify physical world data and discover new information regarding the physical twin that can be useful to the representation of the heart Digital Twin.
r events, generated to indicate that something has happened or a given condition has been met [5].Events, including commands for the physical layer, are managed by the EventSourceUnit, a decision-making component that takes as an input the information generated by the CognitiveUnit and managed by the DTDataPro-cessingUnit, and generates commands for the Physical layer by invoking the ControlAPI exposed by the Controller component [8].
r a Human Machine Interface (HMI), important to repre- sent information in a way that makes sense to end-users.Our architecture includes a dedicated component (DTH-MIUnit), which uses the DTDataProcessingAPI and the ModelAccessAPI to provide information to all types of users and all stakeholders involved over its life-cycle, not only subject-matter experts who interact and operate with the Digital Twin.Therefore, the human-machine interface for the DT should be well designed [5].Finally, as shown in Fig. 5, all the components that act as interface with end-users use the AccessControlAPI offered by the Security layer.As anticipated, the Security layer is responsible for lot more than access control, but we included this API in the architecture to remark the need for authentication and authorization at least in the interactions with users via the Internet.
To conclude, according to Schroeder et al. [5], external applications and systems should access the DT functionalities via a well-defined protocol.Therefore, we include the DTServiceAPI interface exposed by the Digital Twin, where API stands for a set of specifications that provide access to externally available features.For example, the API can be used to query the Digital Twin on the actual state of the physical counterpart or to trigger the start of a simulation [5].

IV. CASE STUDY
As anticipated, in addition to reviewing and classifying Digital Twin applications in the healthcare domain, and proposing a generalized architecture for DT implementation, in this paper we also discuss a case study related to the adoption of the DT technology to manage health-related processes involving large communities of people.
CanTwin, this is the name of the presented case study, is an example of DT application in digital public health management (see Section II-D), developed to ensure a safe return to work of employees during the COVID-19 pandemic.More precisely, CanTwin is the Digital Twin of the canteen service of the industrial establishment "Hitachi Rail" located in Naples, set up to manage people flow during the two periods in which the food service is open (from 11:40 am to 2:00 pm and from 7:00 pm to 7:30 pm).The canteen serves around 1000 hot meals plus 100 cold meals per day during the first shift, with 350 people being simultaneously present at full capacity, therefore the company had to take specific containment measures to comply to COVID-19-related regulations, mainly related to social distancing monitoring.Despite its apparent simplicity, the canteen is a very good case study to experiment the design and implementation of an intelligent congestion rate monitoring system with the simulation and prediction functionalities offered by a Digital Twin.The system can be profitably used to test and optimize mitigation strategies and solutions in presence of different congestion conditions and to predict future congestion based on real-time data elaboration.In the following, we will detail the design of the CanTwin system by discussing its components with reference to the proposed DT architecture.

A. CanTwin Architecture
An architectural view of the CanTwin case study is represented in Fig. 6, which shows the main assets involved at the different architectural layers.
As previously discussed, the Physical layer consists of the real system, i.e., the canteen along with the employees present in it, and of all the sensors and actuators deployed to collect data from the real system and to provide feedback to it.In our case, the CanTwin system must primarily acquire information on the position of people inside the canteen area.To this aim, we adopted a set of stereoscopic 3D sensors by Xovis, 1 which allow people counting and tracking in real-time, and that are also able to recognize whether a person is wearing a face mask or not thanks to integrated AI firmware.To comply with privacy regulations, each tracked person is modeled as a point in a threedimensional space, and each point is assigned a unique identifier to track its movement through the area.Moreover, Xovis sensors enable us to assign different labels to tracked employees in order to distinguish between those who are in the canteen for lunch and those who are engaged in serving food or cleaning the canteen.
Overall, 53 Xovis sensors were installed in the area, whose structure is schematically depicted in Fig. 7.As shown, the structure is characterized by two external spaces, one for access to the tables and one for takeaway service.The external area for takeaway is covered by 3 stereoscopic sensors, while the other one is covered by 7 sensors.The internal zone is covered by 43 sensors, 39 of which frame the dining tables.The canteen is characterized by four food lines grouped into two pairs: the first pair is traditional1-pizza, the second pair is traditional2-easy.Both pairs have a common starting line, from the entrance to the orange box in Fig. 7.
Finally, the canteen has also been equipped with a set of monitors to provide general information related to the current level of congestion and occupation of the tables and to display warnings and alarms to the staff.In particular, four different screens have been installed: r D0 is located at the entrance to the canteen and indicates the total number of authorized people with a changing background color.Red indicates that no other person is allowed into the room, while yellow suggests that the canteen is almost full.There are places available if the color is green.As already mentioned, transmitted data do not contain personal identification information, while they only include anonymous people identifiers, spatial coordinates of each person and alarms eventually generated (e.g., when two or more people are very close to each other for a period in excess of a predetermined time threshold).Within the Data layer, a custom DataManage-mentUnit component collects data coming from the Physical Twin layer and stores it into the DataStorageUnit, represented by a non-relational MongoDB database.In order to ensure security requirements, all communications use the HTTPS protocol, and the data stored in the Data layer are accessible only to personnel authorized by the company by using appropriate access control mechanisms.
These data are then retrieved and processed by the Digital Twin layer via the DTDataProcessingUnit component, which in turn feeds the DTModelUnit component that manages a geometric model of the canteen enriched with the points that represent the people inside the canteen, derived from sensors' data.The data retrieved from the Data layer are also directly used to feed the DTHMIUnit component, represented by a dashboard that enables to visualize the current situation and interact with the physical system (see Fig. 8).The CanTwin CognitiveUnit component elaborates the coordinates of the points representing the employees present in the canteen and computes the respective distances.It also computes the average time spent by an individual in a queue in a given time frame and extracts various information on the general occupancy of the different areas.Finally, the EventSourceUnit component is responsible for forwarding messages and alarms to the Physical Twin layer (for example if pre-defined levels for interpersonal distance are exceeded).
Alarms are generated by a specific Social Distancing Monitoring application that logically belongs to the Service layer.Social distancing monitoring, however, is only one of the services offered on top of CanTwin, which also provide Real-time Visualization of the total number of people present at that time in the canteen, the take-away area and around the cafeteria, tables occupancy (free, partially occupied, full and to be sanitized) and conveyor status, and Predictive Analysis.In particular, we currently use a simple analytical model built by registering the travel times of the different queues in a given (configurable) time interval to predict the level of congestion in the near future (within a 3-hours time horizon).This information could be very useful to optimize space utilization and tables distribution and to improve the overall quality and efficiency of the offered service.
The activity diagram in Fig. 9 describes the canteen service process.When an employee enters the canteen, there's first a temperature check (Entry control activity): if the temperature is higher than 37.5 • C, the employee must leave the structure and act in accordance with the measures provided (Exit due to temperature activity), otherwise he/she is allowed to enter the canteen area.Once inside, the employee must check the availability of free seats (Check occupancy activity), which is constantly displayed on the screen located at the entrance (D0).In case the canteen is full, the employee must exit the area and wait until some seats become available (Exit and try later activity).If the canteen is not full, the employee can access the first section of the common queue for both groups (Get in common line activity), select the preferred menu and get in line on the right side (Choose menu activity).Once the turn comes, he/she is served by food service personnel (Serve food and drinks activity) and can finally choose a seat among those marked as free on the D2 display, occupy it and consume the meal (Choose a free seat and Eat activities).When the meal is over, the tray must be removed from the table and placed on the conveyor, it is therefore necessary to consult the D3 display to check the conveyor belt status in order to prevent gatherings (Check conveyor status activity).Finally, the employee can exit the canteen after having left the tray on the conveyor.

B. Evaluation and Future Developments
On a qualitative level, the discussed case study demonstrates that the proposed architecture is effective in guiding the design and implementation of a Digital Twin, by identifying the different functionalities that must be offered to implement generic services with high flexibility and modularity.
From a quantitative point of view, it is interesting to evaluate the performance of CanTwin when the number of people inside the canteen increases, taking into account the constraints related to the canteen maximum allowed capacity and to the minimum possible physical distance between any two people.Each sensor, placed at a height of 3.5 meters, covers a fixed 5, 65m × 3.19m area.Each sensor generates 4 frames per second, but the backend application updates people positions only once per second, since there is no need to have a greater resolution.We conducted several experiments by increasing the number of people present simultaneously in the area covered by a sensor (we started with one person and ended with 30 persons -2 pax/sqm) and found that the latency between a social distancing violation event and its visualization on the display after the elaboration from the back-end is pretty much constant and equal to 4 seconds.The on-board elaboration carried out by the sensors is not influenced by the framed number of people, while a negligible impact is registered on the refresh rate, which is limited enough to avoid any issue.Therefore, we can conclude that CanTwin has good scalability features.
To conclude our discussion, it is worth remarking that the experience with the canteen may be extended to different contexts: for example, when we consider the railway sector, the flow of people entering and leaving the canteen can be assimilated to that related to a station, as well as queues for different food lines can be equated to line-ups for ATM machines and table occupancy may be equated with seat occupancy on a train.In such a context, the availability of a more detailed model of the system, able to capture behavioral aspects in addition to geometric ones, would sensibly improve the benefits of adopting the DT paradigm.With regard to CanTwin, the integration of a behavioral model would make it possible to simulate alternative scenarios in order to find optimal solutions in terms of table layout, menu lines distribution, and service/cleaning staff employment, in order to reduce waiting times and avoid congestion.A discrete-event simulation model (formalized for example as a Stochastic Petri Net) that represents the process depicted in Fig. 9 may be built and the data collected by available sensors may be used to feed the model in real-time.A similar approach has been proposed in 2020 by Pilati et al. [25], who modeled the COVID-19 vaccination process to simulate different scenarios and find the optimal solution in order to minimize patient waiting times.Real-time simulation could allow to dynamically manage different operating scenarios, for example by activating a meal service extra line for a particularly crowded time span and deactivating it after eliminating congestion.

V. CONCLUSION
The Digital Twins in healthcare context are the most ambitious and complex applications of this emerging Industry 4.0 technology.Despite the increasing interest from the research community and the great potentiality, a standardized definition and a reference architecture are still lacking.
In our work, we first analyzed the scientific literature on health-related Digital Twin applications.We identified four major categories: i) DTs for patient treatment, ii) DTs for physicians and surgeons training and practice, iii) DTs in the pharmaceutical industry, iv) DTs in public health management.Based on the information gathered from existing literature, we proposed a Digital Twin conceptual architecture, characterized by the Physical Twin, Data, Digital Twin, Service, Security and Connectivity layers.Based on the identified architecture, we implemented CanTwin, the Digital Twin of the canteen service of an industrial establishment owned by Hitachi Rail, set up to manage people flow and to monitor social distancing in the context of COVID-19 pandemic.
In our future work, we plan to look for a generalization of connectivity and security levels.In addition, we need to move towards concrete solutions that solve security, privacy and take into account the ethical and legal implications.Finally, we plan to integrate a behavioral model into CanTwin for process optimization by simulating alternative scenarios and finding better solutions.

Fig. 1 . 2 . 3 .
Fig. 1.Human Digital Twin for personalized medicine (based on [6], [11]): 1.There is a local sign of disease (red) in an individual patient.2. Digital Twin instances of the same person are constructed, based on computational network models of thousands of disease-relevant variables.3.Each twin is computationally treated with one or more of the thousand medicines to figure out which option will work best for that particular person.This results in a patient being digitally cured (green).4. The drug that most affects the Digital Twin is chosen for the patient's treatment.

Fig. 2 .
Fig. 2. Digital Twin for surgery: computer modeling shows the position of the designed bracelet with 3D modeling and flow simulation [19].

Fig. 3 .
Fig. 3.The Digital Twin technology application for public eHealth: 3D animation of radiology department of Mater Private Hospital, made by Siemens Healthineers [27].

Fig. 4 .
Fig. 4. Conceptual Digital Twin Architecture: the diagram shows a high-level layered architectural view of a Digital Twin and outlines the main functionalities offered by each layer.

Fig. 5 .
Fig. 5.A low-level architectural view of the components belonging to the Digital Twin layer, the Data layer and the Physical Twin layer and of the involved APIs.

Fig. 6 .
Fig. 6.CanTwin architectural view: main components and services and respective architectural layers.

Fig. 7 .
Fig. 7. 2D map of the canteen with an indication of the position of sensors and monitors installed in external and internal areas.

r
D1 indicates the level of congestion of each food line and the corresponding average waiting time.r D2 shows the disposition of the canteen and reports in real time the occupation of the tables.r D3 allows the visualization of information about the oc- cupation state of the conveyor.Within the Physical layer, sensor data are first transmitted to an aggregator component connected to the sensors by means of a set of PoE + switches.The aggregator forwards the data to the Data layer through the Connectivity layer, not displayed in Fig. 6, which basically consists of bi-directional HTTPS connections.

Fig. 8 .
Fig.8.Dashboard screen displaying the geometric structure of the canteen, points which shape the people presently in the canteen and different colors to distinguish different situations, e.g., free/ busy/to clean tables.

Fig. 9 .
Fig.9.Activity diagram of food service process: temperature check, line up if available seats number is not zero, menu and seat selection, tray placement on the conveyor.

TABLE I ARCHITECTURAL
REFERENCES IN HEALTHCARE DIGITAL TWIN LITERATURE