Significant acceleration of development by automating quality assurance of a medical particle accelerator safety system using a formal language driven test stand

At the Centre for Proton Therapy at the Paul Scherrer Institute cancer patients are treated with a fixed beamline and in two gantries for ocular and non-ocular malignancies, respectively. For the installation of a third gantry a new patient safety system (PaSS) was developed and is sequentially being rolled out to update the existing areas. The aim of PaSS is to interrupt the treatment whenever any sub-system detects a hazardous condition. To ensure correct treatment delivery, this system needs to be thoroughly tested as part of the regular quality assurance (QA) protocols as well as after any upgrade. In the legacy safety systems, unit testing required an extensive use of resources: two weeks of work per area in the laboratory in addition to QA beam time. In order to significantly reduce the time, an automated PaSS test stand for unit testing was developed based on a PXI chassis with virtually unlimited IOs that are synchronously stimulated or sampled at 1 MHz. It can emulate the rest of the facility using adapters to connect each type of interface. With it PaSS can be tested under arbitrary conditions. A VHDL-based formal language was developed to describe stimuli, expected behaviour and specific measurements, interpreted by a LabView runtime environment. This article describes the tools and methodology being applied for unit testing and QA release tests for the new PaSS. It shows how automation and formalization made possible an increase in test coverage while significantly cutting down the laboratory testing time and facility’s beam usage.

💡 Research Summary

The paper presents a comprehensive solution for accelerating the development, verification, and quality assurance (QA) of the Patient Safety System (PaSS) used in proton therapy at the Paul Scherrer Institute (PSI). With the commissioning of a third gantry and upgrades to existing treatment areas, a new, monolithic, synchronous PaSS hardware was introduced. Traditional unit testing of the legacy safety system relied on National Instruments CompactRIO modules, manual waveform generation, and extensive documentation, consuming roughly two weeks of laboratory effort per treatment area plus additional beam time.

To overcome these limitations, the authors designed an automated test stand built on a PXI chassis capable of hosting up to eighteen cards (fast e‑6535 for 1 MHz I/O and slower 6509 for control tasks). The system provides virtually unlimited I/O (≈400 channels) synchronized at a 1 µs base period. A custom 19‑inch backplane board with 90° connectors and a suite of plug‑in adapters (optical, 24 V digital, three‑wire current loops, etc.) allows the test stand to emulate every sensor, actuator, and control signal present in the accelerator facility.

The software framework runs in LabVIEW and introduces a VHDL‑like formal language for test description. This language extends standard VHDL with three key constructs:

1. Macros – reusable code blocks for common initializations or constant definitions.
2. Loop‑Tag structures – enable parameterised expansion of test cases, automatically generating combinatorial test suites from a compact script.
3. Time‑measurement statements – `measure