Clinical-priority task orchestration and verified safety supervision for a physician-directed ward-rounding robot: a simulation-based feasibility study

Introduction A ward-rounding robot that accepts orders at the level of clinical intent becomes a shared clinical resource: several clinicians may hold outstanding requests of differing urgency, and execution is punctuated by confirmation gates at which the robot waits on a human and by engagement steps that cannot safely be interrupted. This paper formalizes the resulting scheduling problem together with the safety layer that it necessitates. Methods We present (i) a task model in which an intent-level order expands into primitives carrying resource locks, physician confirmation gates, and an explicit interruptibility partition; (ii) the Clinical-Priority Scheduler (CP-Sched), which combines urgency weighting, aging, travel awareness, and class-relative escalation and preempts only at safe interruption points; and (iii) a safety supervisor specified as a network of timed automata and verified exhaustively for a single robot serving one order at a time, with independent reproduction in the TLA+ model checker TLC. All task timings in the 1,590 discrete-event simulation runs are modeling assumptions, not hardware measurements. Results Across 1,080 runs spanning two ward sizes and three utilization levels, CP-Sched reduced the 95th-percentile time for urgent orders to bedside from 347 s to 215 s at moderate utilization, a 38% reduction relative to the strongest of four baselines; all comparisons survived Holm’s correction at p < 0.0001 under both the paired Wilcoxon signed-rank and unpaired Mann–Whitney tests (rank-biserial effect sizes: 0.93–1.00 paired, 0.66–0.93 unpaired). A further 510 runs showed that aging alone cannot bound the waiting time and that escalation at a fixed absolute horizon restores a guarantee only by inflating the urgent tail at saturation. All five clinical invariants hold under the supervisor and each is violable without it, so none is vacuous. Runtime enforcement eliminated all 757 unsafe interruptions observed in the unshielded ablation at a cost of 2.1–35.4 s in the median urgent tail. Discussion The enforcement cost is small but systematic at light and moderate loads and undetectable at saturation, which supports keeping the safety layer independent of the scheduling policy. The formal guarantee covers a single-order model, and absolute timings require calibration on a physical platform.