Overview
• Protontherapy @ PSI • Controls and Safety
To promote excellency in patient care and innovative proton treatment – Concept – Implementation • Patient Safety System Therapy Control and Patient Safety
Martin Grossmann Centre for Proton Therapy, Paul Scherrer Institute, Villigen, Switzerland
Paul Scherrer Institut • 5232 Villigen PSI
Paul Scherrer Institute PROScan facility at PSI OPTIS2
590 MeV proton cyclotron
SwissFEL
250 MeV proton cyclotron
COMET
Gantry 1 Proton therapy
Synchrotron light source Gantry 2
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
1 Superconducting cyclotron with intensity modulation I Degrader and beam line for energy selection E Cyclotron COMET Varian/Accel Degrader (carbon 250 MeV protons Deflector plate for wedges in vacuum) fast beam current and laminated beam regulation ~ 50 ms line for fast energy changes < 80 ms
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Controls & safety
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
2 PSI’s concept for patient safety #1: NO RADIATION ACCIDENT
• No serious overdose should be delivered to the patient • Serious: >5% of total prescribed dose (60 Gy), i.e. 3 Gy
• Definition of safety goals • Description of technical/operational measures
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
#2: NO ERROR IN THE #3: NO ERROR IN DELIVERED DOSE DOSE POSITION • No incorrect dose should be delivered • The dose must be applied at the correct • Prevent errors (hot/cold spots) in dose position distribution of >2% of planned field dose • Prevent errors in a single spot delivery > ± 1mm in lateral direction and depth
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
3 #4: DELIVERED DOSE AND Controls & Safety Concept POSITION MUST BE KNOWN AT ALL TIMES set check • If treatment is interrupted, the dose and TDS TVS position already applied must be known in order to allow correct continuation after interruption Therapy Delivery supervise Therapy Verification
PaSS Patient Safety
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
The Therapy Control System‘s The Need for Speed... • The TCS Task – Controls the dose delivery • Minimize dead time between spots – Is configured with the Therapy Plan generated by the Therapy Planning – PSI spot scanning: increase of dead-time by only 1 ms increases System the total irradiation time by about 5 %... – Controls and supervises the facility equipment to deliver the dose to the patient according to the plan • In safety relevant control system design, the – Generates a log of what it finally did with the patient speed requirement is normally put behind safety...
BUT
... A perfectly safe but slow scanning control system will be as useless as an unsafe fast one!
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
4 The Need for Speed... The Need for Speed... embedded VME Single Board Computer • Our choices for the control systems: – The irradiation is controlled by embedded VME systems with Motorola PPC running the VxWorks RTOS – Subsystem communication with digital IOs, fast serial links (over optical fibres), reflective memories. Ethernet only when time does not matter – Time critical functions directly implemented in custom FPGA or DSP based subsystems – Linux PCs as operator workstations
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
The Need for Speed... Graphical User Interface VME crate (TVS) with connections to sensors, actuators, ...
– client – server application – implemented in Java
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
5 Spot Scanning Control Loop
• TDS & TVS walk through therapy plan: – TDS sets devices, TVS checks devices – when all devices ready: beam on! – spot termination by dose counter firmware – check correct application after each spot – write logs – proceed to next spot
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
STOP Read spot info Read spot info STOP Spot Scanning: Operator Tools TDS devices ready? TVS STOP Set devices
Check devices STOP Set TDS ready peering into the Set TVS ready STOP All ready? control loop ...
Dose countdown Beam ON
Beam OFF Check devices STOP Dose applied?
End of spot End of spot?
Clear TDS ready Ack end of spot
Check STOP Check dose STOP dose, beam
End of spot ack? Update logs
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
6 Spot Scanning: Operator Tools
Safe Setting – Redundant Checking – Independent Supervision
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Example: Sweeper Magnet Control Magnet Power Supply Control Hardware
• VME board with 4 Industry-Pack Slots and onboard DSP • Industry-Packs with FPGA implementing communication interface to power supply • VME transition module with SET optical transceivers for data transmission to power supply • Digitally controlled power- • The sweeper power supply controller receives target values over an optical link from the TCS, checks data integrity, and controls the power supply for the magnet coils supplies (developped by PSI) • At the same time, the current through the coils is measured and compared in realtime with the target value on a DSP inside the controller, without TCS involvment. Any deviation beyond tolerance triggers a safety interlock
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
7 Magnet Power Supply Control Hardware Example: Sweeper Magnet Measurement
CHECK
• Monitoring channel is measuring the magnetic field with a hall-sensor and triggers an interlock if a deviation beyond tolerance is detected
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Actuation and Monitoring: Implementation
Hall Probe used at PSI Control TDS Actuation Channel TVS Monitoring Channel Function Beam Position Sweeper Magnet controlled by DSP based subsystem. Hall sensor measuring sweeper Continuous monitoring of power supply setting and state magnetic field monitored by TVS. Ionisation strip chamber measuring beam position at exit of nozzle. Monitored by TVS Beam Tune Degrader and beamline control through Machine Control Degrader position and bending System (MCS). MCS implements full actuator magnet hall sensor data supervision continuously monitored by DSP based subsystem Range Control of range-shifter with DSP based subsystem. Redundant optical sensors for each Modulation State of single plates measured with optical sensors single plate. Monitored by TVS supervised continuously
Patient Patient table and Gantry rotation through the Gantry and Absolute position encoders and Position Patient Positioning System (GPPS). GPPS implements end-switches monitored by TVS full actuator supversion as well as collission protection
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
8 Example: Spot Termination Example: Spot Termination
• General method for dose measurement: – Ionisation chambers – Current converted to frequency, fed into counter module – When counter reaches preset value, it triggers beam-off
SUPERVISE
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Example: Gantry 1 Spot Termination Formal Risk Analysis
interlock! • Fault Trees: dose – Start from safety goals fixed limit – Imagine what can go wrong beam interlock off – Define measure to reduce associated risks
nominal + offset • Come up with redundant ways to detect failures and avoid consequences nominal • Technical and Operational Measures (TM, OM) – Estimate risk before and after applying the measures
TDS TVS Watchdog
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
9 Example: Example: Safety Goal #1 – no serious overdose Safety Goal #1 – no serious overdose
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Example: Risk Categorization Safety Goal #1 – no serious overdose Severity
Occurence
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
10 Risk Categorization Risk Evaluation
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Elements of a safety system Patient Safety System PaSS
• Elements of (any) safety system:
sensors logic switch-off
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
11 Example: Elements of a safety system measuring beam position with strip detectors
sensors logic switch-off
beam detectors achieve / maintain safe state Hall-probes (magnetic field) = no beam, no mechanical movement end switches (beam blocker) … kicker magnet beam blocker radio frequency ion source
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Measuring beam position • Local & central final elements • read out strips after local & central logic subsystems each spot • determine position and compare with nominal value • if deviation > tolerance: beam switch-off by PaSS! („interlock“)
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
12 PSI Safety System Hardware PSI Safety System Hardware – Interconnections made via Patch-Pannels – Possibility to bridge signals by hardware
3-wire current loop interface
HYTEC Carrier Board FPGA Moduls Transition Module To/From Sensor Subsystem / Final (Type VICB8003.2) (Based on XILINX Spartan-II) (Type TILK) Element
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Proscan Final Elements
Experiments Optis How do we switch off the beam?
(«Final Elements») Gantry 1
Gantry 1
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
13 Kicker magnet High Frequency Generator – 2 Levels: • Magnet deflects beam out of axis – Reduce power to 20% • Switch-off in < 300 µs – De-energize completely – Switch-off in < 400 µs
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Ion source Fast Mechanical Stoppers – copper block 5 cm – De-energize ion source length – Switch-off in < 20 ms – moved by pressured air & mechanical spring • Switch-off in < 100 ms
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
14 3 Interlock-Levels Slow Mechanical Stoppers
– Graphite blocks up to 25 cm – moved by pressured air & gravity – Switch-off in < 1 s
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Recovery of failing beam switch off The concept of Mastership • Control over central components (degrader, kicker magnet, …) granted to 1 treatment area alone
O P T IS 2
W
W M
Q M F
U
Q M F
Q M F T
M F 7
6
F
5
M
M
B
P
5
/
6
B
M
B
2 Q
Q M
6 M F A F 2 M K 7 1 A M K
M
Q K
M
Q M M 6 K B F A 6 Q M B M M M P 1 M B 5 M 2 1 M / B M Q 1 5 B 4 1 B /2 3 M B C 7 P P A A M 9 1 M X B / 1 M M 1 /1 Q A P 0 a 7 M / F 8
K
B Q M
M Q M B
V
B M B 1
B 2 8 1 8 1 1 A / M M 1 7 Q M
P
A B 3 B 9 M A M P A M M 5
M M
A M B /6 Q Q A 2 M M P
Q 3
M A M /
1 4
A B
1 3 P
2 1
/2
Q
Q M M 2 M A M A 1 A A 1 M M M 1 M P 0 M 2 A M A 5 A P /
M P 2
2 2 6
A 3
P 1 /
1 /2 2
9 2 4
/
2
0
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
15 The concept of Mastership Mastership verification
Central safety system Digital I/O Gantry 1 Gantry 1 MPSSC
Gantry 2 Gantry 2 network
X „Beam Allocator“ BALL server process BALL OPTIS X OPTIS network COMET COMET Beamlines Beamlines
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Mastership verification Mastership verification
Gantry 1 MPSSC Gantry 1 MPSSC
Gantry 2 Gantry 2 ATOT!!!
BALL BALL OPTIS OPTIS
COMET COMET Beamlines Beamlines
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
16 Integration of Gantry 3
• Commercial Gantry including Control System • Still needs access to central elements – Setting beam energy & intensity accelerator & beamline control – Beam on/off control Kicker magnet – Interlocks final elements • Definition & Implementation of Interfaces – Software (network) and Hardware
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
Safety Adapter Control Adapter • HW based on IFC1210 (www.ioxos.ch)
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
17 Safety Adapter Signal Converter Box IFC1210 VARIAN / MPSSC VARIAN / MPSSC Signal Converter Simple HW box, which fits into 19 inch crate PowerPC Signal Converter EPICS Box Interfaces: World LINUX-OS PlugIN Box o 4x high speed optical links – SFP transceivers UDP Slot1 o Interface to FPGA COTS module (e.g. ENCLUSTRA – Like used in PlugIN Network EPICS G2 – MCCS Project MPSSC Slot1 o 6x interface slots for connecting CPT standard PlugIn family. This PaSS SW Application PlugIN family supports several interface standards. Slot2 TCS FPGA DRV Support IC-DSE3 PlugIN Adapter FPGA Slot2 Module PlugIN FPGA FPGA FMC-HW Slot5 Module PlugIN PSI optical Analog FW-Framework 5V TTL LVDS VARIAN Slot5 3-wire +/-10V (TOSCA-II) System • FPGA design supporting HighSpeed optical link communication 4x 4x PlugIN PaSS FW Application Optical Optical and IO communication to PlugIn slots Slot6 4x HighSpeed HighSpeed PlugIN • Supporting VARIAN interface requires additional development of PlugIn Optical Links Link Slot6 boards PaSS specific FW Library HighSpeed Link • Complexity: Simple HW design and medium complex FPGA design
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
If you think proton therapy controls is complicated…
Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI
18