Overview • Protontherapy @ PSI • Controls and Safety To promote excellency in patient care and innovative proton treatment – Concept – Implementation • Patient Safety System Therapy Control and Patient Safety Martin Grossmann Centre for Proton Therapy, Paul Scherrer Institute, Villigen, Switzerland Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institute PROScan facility at PSI OPTIS2 590 MeV proton cyclotron SwissFEL 250 MeV proton cyclotron COMET Gantry 1 Proton therapy Synchrotron light source Gantry 2 Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 1 Superconducting cyclotron with intensity modulation I Degrader and beam line for energy selection E Cyclotron COMET Varian/Accel Degrader (carbon 250 MeV protons Deflector plate for wedges in vacuum) fast beam current and laminated beam regulation ~ 50 ms line for fast energy changes < 80 ms Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Controls & safety Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 2 PSI’s concept for patient safety #1: NO RADIATION ACCIDENT • No serious overdose should be delivered to the patient • Serious: >5% of total prescribed dose (60 Gy), i.e. 3 Gy • Definition of safety goals • Description of technical/operational measures Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI #2: NO ERROR IN THE #3: NO ERROR IN DELIVERED DOSE DOSE POSITION • No incorrect dose should be delivered • The dose must be applied at the correct • Prevent errors (hot/cold spots) in dose position distribution of >2% of planned field dose • Prevent errors in a single spot delivery > ± 1mm in lateral direction and depth Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 3 #4: DELIVERED DOSE AND Controls & Safety Concept POSITION MUST BE KNOWN AT ALL TIMES set check • If treatment is interrupted, the dose and TDS TVS position already applied must be known in order to allow correct continuation after interruption Therapy Delivery supervise Therapy Verification PaSS Patient Safety Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI The Therapy Control System‘s The Need for Speed... • The TCS Task – Controls the dose delivery • Minimize dead time between spots – Is configured with the Therapy Plan generated by the Therapy Planning – PSI spot scanning: increase of dead-time by only 1 ms increases System the total irradiation time by about 5 %... – Controls and supervises the facility equipment to deliver the dose to the patient according to the plan • In safety relevant control system design, the – Generates a log of what it finally did with the patient speed requirement is normally put behind safety... BUT ... A perfectly safe but slow scanning control system will be as useless as an unsafe fast one! Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 4 The Need for Speed... The Need for Speed... embedded VME Single Board Computer • Our choices for the control systems: – The irradiation is controlled by embedded VME systems with Motorola PPC running the VxWorks RTOS – Subsystem communication with digital IOs, fast serial links (over optical fibres), reflective memories. Ethernet only when time does not matter – Time critical functions directly implemented in custom FPGA or DSP based subsystems – Linux PCs as operator workstations Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI The Need for Speed... Graphical User Interface VME crate (TVS) with connections to sensors, actuators, ... – client – server application – implemented in Java Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 5 Spot Scanning Control Loop • TDS & TVS walk through therapy plan: – TDS sets devices, TVS checks devices – when all devices ready: beam on! – spot termination by dose counter firmware – check correct application after each spot – write logs – proceed to next spot Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI STOP Read spot info Read spot info STOP Spot Scanning: Operator Tools TDS devices ready? TVS STOP Set devices Check devices STOP Set TDS ready peering into the Set TVS ready STOP All ready? control loop ... Dose countdown Beam ON Beam OFF Check devices STOP Dose applied? End of spot End of spot? Clear TDS ready Ack end of spot Check STOP Check dose STOP dose, beam End of spot ack? Update logs Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 6 Spot Scanning: Operator Tools Safe Setting – Redundant Checking – Independent Supervision Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Example: Sweeper Magnet Control Magnet Power Supply Control Hardware • VME board with 4 Industry-Pack Slots and onboard DSP • Industry-Packs with FPGA implementing communication interface to power supply • VME transition module with SET optical transceivers for data transmission to power supply • Digitally controlled power- • The sweeper power supply controller receives target values over an optical link from the TCS, checks data integrity, and controls the power supply for the magnet coils supplies (developped by PSI) • At the same time, the current through the coils is measured and compared in realtime with the target value on a DSP inside the controller, without TCS involvment. Any deviation beyond tolerance triggers a safety interlock Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 7 Magnet Power Supply Control Hardware Example: Sweeper Magnet Measurement CHECK • Monitoring channel is measuring the magnetic field with a hall-sensor and triggers an interlock if a deviation beyond tolerance is detected Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Actuation and Monitoring: Implementation Hall Probe used at PSI Control TDS Actuation Channel TVS Monitoring Channel Function Beam Position Sweeper Magnet controlled by DSP based subsystem. Hall sensor measuring sweeper Continuous monitoring of power supply setting and state magnetic field monitored by TVS. Ionisation strip chamber measuring beam position at exit of nozzle. Monitored by TVS Beam Tune Degrader and beamline control through Machine Control Degrader position and bending System (MCS). MCS implements full actuator magnet hall sensor data supervision continuously monitored by DSP based subsystem Range Control of range-shifter with DSP based subsystem. Redundant optical sensors for each Modulation State of single plates measured with optical sensors single plate. Monitored by TVS supervised continuously Patient Patient table and Gantry rotation through the Gantry and Absolute position encoders and Position Patient Positioning System (GPPS). GPPS implements end-switches monitored by TVS full actuator supversion as well as collission protection Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 8 Example: Spot Termination Example: Spot Termination • General method for dose measurement: – Ionisation chambers – Current converted to frequency, fed into counter module – When counter reaches preset value, it triggers beam-off SUPERVISE Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Example: Gantry 1 Spot Termination Formal Risk Analysis interlock! • Fault Trees: dose – Start from safety goals fixed limit – Imagine what can go wrong beam interlock off – Define measure to reduce associated risks nominal + offset • Come up with redundant ways to detect failures and avoid consequences nominal • Technical and Operational Measures (TM, OM) – Estimate risk before and after applying the measures TDS TVS Watchdog Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 9 Example: Example: Safety Goal #1 – no serious overdose Safety Goal #1 – no serious overdose Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Example: Risk Categorization Safety Goal #1 – no serious overdose Severity Occurence Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 10 Risk Categorization Risk Evaluation Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Elements of a safety system Patient Safety System PaSS • Elements of (any) safety system: sensors logic switch-off Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 11 Example: Elements of a safety system measuring beam position with strip detectors sensors logic switch-off beam detectors achieve / maintain safe state Hall-probes (magnetic field) = no beam, no mechanical movement end switches (beam blocker) … kicker magnet beam blocker radio frequency ion source Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI Measuring beam position • Local & central final elements • read out strips after local & central logic subsystems each spot • determine position and compare with nominal value • if deviation > tolerance: beam switch-off by PaSS! („interlock“) Paul Scherrer Institut • 5232 Villigen PSI Paul Scherrer Institut • 5232 Villigen PSI 12 PSI Safety System Hardware PSI Safety System Hardware – Interconnections made via Patch-Pannels – Possibility to bridge signals by hardware 3-wire current loop interface HYTEC Carrier Board FPGA Moduls Transition Module To/From