Evaluation of STPA in the Safety Analysis of the Gantry 2 Proton Radiation Therapy System Martin Rejzek, Paul Scherrer Institute, Switzerland 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 1
Agenda Proton Therapy at the Paul Scherrer Institute, Switzerland Evaluation of STPA for the Advanced Scanning Technique Scope of the Project Examples Conclusions 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 2
Proton Therapy at the Paul Scherrer Institute, Switzerland 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 3
PSI Center for Proton Therapy 250 MeV Proton accelerator (superconducting cyclotron) Beamlines to 4 user areas OPTIS Gantry 1 Gantry 2 Experimental area 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 4
Gantry 1 Sweeper magnet (1 dimension) Beam enters rotating Gantry Dose monitoring Range shifter 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 5
Gantry 1 Spot Scanning Technique Elements of spot scanning: Beam on/off 50 µs Sweeper magnet 5 ms/step Range shifter 30 ms Patient table 1 cm/s 10 000 spots to treat 1 liter volume 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 6
Gantry 2 Beam enters rotating Gantry Sweeper magnets (2 dimensions) Dose monitoring 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 7
Gantry 2 Advanced Scanning Technique Advanced scanning: Increased speed Increased flexibility New treatment modalities 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 8
Evaluation of STPA for the Advanced Scanning Technique 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 9
Scope of this Project Safety analysis done with classical methods Evaluation of STPA as supplementary method for advanced scanning explored different approaches considered different parts of whole facility Few examples: 1) STPA during workshops 2) How to model controllers that can insert veto 3) What is the reference for inadequate timing and the Thomas process Treatment Facility Irradiation Patient Treatment Operator Nurse 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 10
Evaluation of STPA for the Advanced Scanning Technique 1) Performing STPA during workshops 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 11
Recipe for a STPA Workshop Step 1 Performing STPA analysis during workshop with engineers Preparation: Hierarchical control structure / high-level hazards Table with guidewords 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 12
Recipe for a STPA Workshop Step 2 Performing STPA analysis during workshop with engineers Preparation: Hierarchical control structure / high-level hazards Table with guidewords Reduced process loop Influence1 Influence2... Controller (1) Control Algorithm (relevant part) Var1 Var2... Param1 Param2... (3) Sensor 1 (2) Controller / Actuator Param1 Param2... Var1 Var2... Var1 Var2... Param1 Param2... (3) Sensor 2 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 13
Recipe for a STPA Workshop Classification Work in progress! UCA = Unsafe Control Action PV = Process Variable 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 14
Evaluation of STPA for the Advanced Scanning Technique 2) How to model controllers which can insert veto 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 15
Controllers that can insert Veto Typical Situation: One Treatment Delivery System (TDS) Treatment Delivery System In Proton Therapy: One source of beam for all treatment areas Intensity Controller Dose Controller various actuators and sensors Patient Treatment 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 16
Controllers that can insert Veto First approach: Second approach: Beam Allocator Other Areas Treatment Delivery System Req. Master Set Intensity Set Intensity Other Areas Treatment Delivery System Beam Allocator Dose Controller Intensity Controller Intensity Controller Dose Controller various actuators and sensors various actuators and sensors Patient Treatment Patient Treatment 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 17
Evaluation of STPA for the Advanced Scanning Technique 3) What is the reference for inadequate timing 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 18
Reference for Inadequate Timing Dose Beam Patient Personnel Start null off Personnel brings patient and installs him null off Personnel leaves room null off Turn beam on Pres. dose reached? accumulating on yes Turn beam off prescribed dose reached prescribed off Personnel enters room prescribed off Personnel takes patient out prescribed off End 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 19
Reference for Inadequate Timing too early Dose Beam Patient Personnel Start null off Personnel brings patient and installs him Personnel leaves room Turn beam on null off accumulating on X accumulating on Turn beam on Pres. dose reached? accumulating on yes Turn beam off prescribed dose reached prescribed off Personnel enters room prescribed off Personnel takes patient out prescribed off End too late 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 20
Conclusions STPA is a very useful method Results achievable in straitforward way and rather short time Feasible to perform with non safety experts Discussion points raised for components not yet developed Next steps Finish this project Compare Results with those of existing safety analysis hopefully continue with STPA method 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 21
Acknowledgments Prof. Dr. Nancy Leveson Blandine Antoine Massachusetts Institute of Technology, US Prof. Dr. Christian Hilbes Zurich University of Applied Sciences, CH Dr. Martin Grossmann Dr. David Meer Center for Proton Therapy Paul Scherrer Institute, CH Contacts: Dipl. el. Ing. FH Martin Rejzek E-mail: martin.rejzek@psi.ch Prof. Dr. Nancy Leveson E-mail: leveson@mit.edu Blandine Antoine E-mail: blandine@mit.edu Dr. Christian Hilbes E-mail: christian.hilbes@zhaw.ch Dr. Martin Grossmann E-mail: martin.grossmann@psi.ch Dr. David Meer E-mail: david.meer@psi.ch 11.04.2012 STAMP/STPA Workshop - Massachusetts Institute of Technology - April 17-19, 2012 - (c) copyright by PSI, 2012 Page 22