Overview

• Protontherapy @ PSI • Controls and Safety

To promote excellency in patient care and innovative proton treatment – Concept – Implementation • Patient Safety System Therapy Control and Patient Safety

Martin Grossmann Centre for , Institute, Villigen,

Paul Scherrer Institut • 5232 Villigen PSI

Paul Scherrer Institute PROScan facility at PSI OPTIS2

590 MeV proton

SwissFEL 

250 MeV proton cyclotron

COMET

Gantry 1 Proton therapy

Synchrotron light source Gantry 2

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

1 Superconducting cyclotron with intensity modulation I Degrader and beam line for energy selection E Cyclotron COMET Varian/Accel Degrader ( 250 MeV protons Deflector plate for wedges in vacuum) fast beam current and laminated beam regulation ~ 50 ms line for fast energy changes < 80 ms

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Controls & safety

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

2 PSI’s concept for patient safety #1: NO RADIATION ACCIDENT

• No serious overdose should be delivered to the patient • Serious: >5% of total prescribed dose (60 Gy), i.e. 3 Gy

• Definition of safety goals • Description of technical/operational measures

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

#2: NO ERROR IN THE #3: NO ERROR IN DELIVERED DOSE DOSE POSITION • No incorrect dose should be delivered • The dose must be applied at the correct • Prevent errors (hot/cold spots) in dose position distribution of >2% of planned field dose • Prevent errors in a single spot delivery > ± 1mm in lateral direction and depth

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

3 #4: DELIVERED DOSE AND Controls & Safety Concept POSITION MUST BE KNOWN AT ALL TIMES set check • If treatment is interrupted, the dose and TDS TVS position already applied must be known in order to allow correct continuation after interruption Therapy Delivery supervise Therapy Verification

PaSS Patient Safety

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

The Therapy Control System‘s The Need for Speed... • The TCS Task – Controls the dose delivery • Minimize dead time between spots – Is configured with the Therapy Plan generated by the Therapy Planning – PSI spot scanning: increase of dead-time by only 1 ms increases System the total irradiation time by about 5 %... – Controls and supervises the facility equipment to deliver the dose to the patient according to the plan • In safety relevant control system design, the – Generates a log of what it finally did with the patient speed requirement is normally put behind safety...

BUT

... A perfectly safe but slow scanning control system will be as useless as an unsafe fast one!

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

4 The Need for Speed... The Need for Speed... embedded VME Single Board Computer • Our choices for the control systems: – The irradiation is controlled by embedded VME systems with Motorola PPC running the VxWorks RTOS – Subsystem communication with digital IOs, fast serial links (over optical fibres), reflective memories. Ethernet only when time does not matter – Time critical functions directly implemented in custom FPGA or DSP based subsystems – Linux PCs as operator workstations

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

The Need for Speed... Graphical User Interface VME crate (TVS) with connections to sensors, actuators, ...

– client – server application – implemented in Java

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

5 Spot Scanning Control Loop

• TDS & TVS walk through therapy plan: – TDS sets devices, TVS checks devices – when all devices ready: beam on! – spot termination by dose counter firmware – check correct application after each spot – write logs – proceed to next spot

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

STOP Read spot info Read spot info STOP Spot Scanning: Operator Tools TDS devices ready? TVS STOP Set devices

Check devices STOP Set TDS ready peering into the Set TVS ready STOP All ready? control loop ...

Dose countdown Beam ON

Beam OFF Check devices STOP Dose applied?

End of spot End of spot?

Clear TDS ready Ack end of spot

Check STOP Check dose STOP dose, beam

End of spot ack? Update logs

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

6 Spot Scanning: Operator Tools

Safe Setting – Redundant Checking – Independent Supervision

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Example: Sweeper Magnet Control Magnet Power Supply Control Hardware

• VME board with 4 Industry-Pack Slots and onboard DSP • Industry-Packs with FPGA implementing communication interface to power supply • VME transition module with SET optical transceivers for data transmission to power supply • Digitally controlled power- • The sweeper power supply controller receives target values over an optical link from the TCS, checks data integrity, and controls the power supply for the magnet coils supplies (developped by PSI) • At the same time, the current through the coils is measured and compared in realtime with the target value on a DSP inside the controller, without TCS involvment. Any deviation beyond tolerance triggers a safety interlock

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

7 Magnet Power Supply Control Hardware Example: Sweeper Magnet Measurement

CHECK

• Monitoring channel is measuring the magnetic field with a hall-sensor and triggers an interlock if a deviation beyond tolerance is detected

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Actuation and Monitoring: Implementation

Hall Probe used at PSI Control TDS Actuation Channel TVS Monitoring Channel Function Beam Position Sweeper Magnet controlled by DSP based subsystem. Hall sensor measuring sweeper Continuous monitoring of power supply setting and state magnetic field monitored by TVS. Ionisation strip chamber measuring beam position at exit of nozzle. Monitored by TVS Beam Tune Degrader and control through Machine Control Degrader position and bending System (MCS). MCS implements full actuator magnet hall sensor data supervision continuously monitored by DSP based subsystem Range Control of range-shifter with DSP based subsystem. Redundant optical sensors for each Modulation State of single plates measured with optical sensors single plate. Monitored by TVS supervised continuously

Patient Patient table and Gantry rotation through the Gantry and Absolute position encoders and Position Patient Positioning System (GPPS). GPPS implements end-switches monitored by TVS full actuator supversion as well as collission protection

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

8 Example: Spot Termination Example: Spot Termination

• General method for dose measurement: – Ionisation chambers – Current converted to frequency, fed into counter module – When counter reaches preset value, it triggers beam-off

SUPERVISE

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Example: Gantry 1 Spot Termination Formal Risk Analysis

interlock! • Fault Trees: dose – Start from safety goals fixed limit – Imagine what can go wrong beam interlock off – Define measure to reduce associated risks

nominal + offset • Come up with redundant ways to detect failures and avoid consequences nominal • Technical and Operational Measures (TM, OM) – Estimate risk before and after applying the measures

TDS TVS Watchdog

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

9 Example: Example: Safety Goal #1 – no serious overdose Safety Goal #1 – no serious overdose

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Example: Risk Categorization Safety Goal #1 – no serious overdose Severity

Occurence

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

10 Risk Categorization Risk Evaluation

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Elements of a safety system Patient Safety System PaSS

• Elements of (any) safety system:

sensors logic switch-off

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

11 Example: Elements of a safety system measuring beam position with strip detectors

sensors logic switch-off

beam detectors achieve / maintain safe state Hall-probes (magnetic field) = no beam, no mechanical movement end switches (beam blocker) … kicker magnet beam blocker radio frequency ion source

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Measuring beam position • Local & central final elements • read out strips after  local & central logic subsystems each spot • determine position and compare with nominal value • if deviation > tolerance: beam switch-off by PaSS! („interlock“)

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

12 PSI Safety System Hardware PSI Safety System Hardware – Interconnections made via Patch-Pannels – Possibility to bridge signals by hardware

3-wire current loop interface

HYTEC Carrier Board FPGA Moduls Transition Module To/From Sensor Subsystem / Final (Type VICB8003.2) (Based on XILINX Spartan-II) (Type TILK) Element

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Proscan Final Elements

Experiments Optis How do we switch off the beam?

(«Final Elements») Gantry 1

Gantry 1

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

13 Kicker magnet High Frequency Generator – 2 Levels: • Magnet deflects beam out of axis – Reduce power to 20% • Switch-off in < 300 µs – De-energize completely – Switch-off in < 400 µs

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Ion source Fast Mechanical Stoppers – copper block 5 cm – De-energize ion source length – Switch-off in < 20 ms – moved by pressured air & mechanical spring • Switch-off in < 100 ms

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

14 3 Interlock-Levels Slow Mechanical Stoppers

– Graphite blocks up to 25 cm – moved by pressured air & gravity – Switch-off in < 1 s

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Recovery of failing beam switch off The concept of Mastership • Control over central components (degrader, kicker magnet, …) granted to 1 treatment area alone

O P T IS 2

W

W M

Q M F

U

Q M F

Q M F T

M F 7

6

F

5

M

M

B

P

5

/

6

B

M

B

2 Q

Q M

6 M F A F 2 M K 7 1 A M K

M

Q K

M

Q M M 6 K B F A 6 Q M B M M M P 1 M B 5 M 2 1 M / B M Q 1 5 B 4 1 B /2 3 M B C 7 P P A A M 9 1 M X B / 1 M M 1 /1 Q A P 0 a 7 M / F 8

K

B Q M

M Q M B

V

B M B 1

B 2 8 1 8 1 1 A / M M 1 7 Q M

P

A B 3 B 9 M A M P A M M 5

M M

A M B /6 Q Q A 2 M M P

Q 3

M A M /

1 4

A B

1 3 P

2 1

/2

Q

Q M M 2 M A M A 1 A A 1 M M M 1 M P 0 M 2 A M A 5 A P /

M P 2

2 2 6

A 3

P 1 /

1 /2 2

9 2 4

/

2

0

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

15 The concept of Mastership Mastership verification

Central safety system Digital I/O Gantry 1 Gantry 1 MPSSC

Gantry 2 Gantry 2 network

X „Beam Allocator“ BALL server process BALL OPTIS X OPTIS network COMET COMET Beamlines

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Mastership verification Mastership verification

Gantry 1 MPSSC Gantry 1 MPSSC

Gantry 2 Gantry 2 ATOT!!!

BALL BALL OPTIS OPTIS

COMET COMET Beamlines Beamlines

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

16 Integration of Gantry 3

• Commercial Gantry including Control System • Still needs access to central elements – Setting beam energy & intensity  accelerator & beamline control – Beam on/off control  Kicker magnet – Interlocks  final elements • Definition & Implementation of Interfaces – Software (network) and Hardware

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

Safety Adapter Control Adapter • HW based on IFC1210 (www.ioxos.ch)

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

17 Safety Adapter Signal Converter Box IFC1210 VARIAN / MPSSC VARIAN / MPSSC Signal Converter Simple HW box, which fits into 19 inch crate PowerPC Signal Converter EPICS Box Interfaces: World LINUX-OS PlugIN Box o 4x high speed optical links – SFP transceivers UDP Slot1 o Interface to FPGA COTS module (e.g. ENCLUSTRA – Like used in PlugIN Network EPICS G2 – MCCS Project MPSSC Slot1 o 6x interface slots for connecting CPT standard PlugIn family. This PaSS SW Application PlugIN family supports several interface standards. Slot2 TCS FPGA DRV Support IC-DSE3 PlugIN Adapter FPGA Slot2 Module PlugIN FPGA FPGA FMC-HW Slot5 Module PlugIN PSI optical Analog FW-Framework 5V TTL LVDS VARIAN Slot5 3-wire +/-10V (TOSCA-II) System • FPGA design supporting HighSpeed optical link communication 4x 4x PlugIN PaSS FW Application Optical Optical and IO communication to PlugIn slots Slot6 4x HighSpeed HighSpeed PlugIN • Supporting VARIAN interface requires additional development of PlugIn Optical Links Link Slot6 boards PaSS specific FW Library HighSpeed Link • Complexity: Simple HW design and medium complex FPGA design

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

If you think proton therapy controls is complicated…

Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI

18