Spot-scanning is a highly dynamic treatment method in proton therapy, tailored to each tumor shape individually. By superimposing many single spots in all three spatial axes, a prescribed dose is applied to the tumor volume. To minimize dose inhomogeneity across this volume, tight constraints on the beam position accuracy apply: for a dose inhomogeneity below 1%, a longitudinal beam position accuracy of the order of 1 mm is necessary, whereas in the lateral plane, the accuracy needs to be roughly one order of magnitude better. Longitudinal position control is achieved through selecting the beam energy; laterally, this is achieved by two sweeper magnets, allowing position changes within milliseconds. Such dynamics and accuracy constraints require an online measurement of the beam position to enable and maintain high treatment quality assurance. Gantry 2 at the Center for Proton Therapy at PSI operates a plane parallel strip ionization chamber for this purpose as the final beamline element before the patient. The foil-based detector design is optimized for an in-situ placement in the beam axis and keeps beam disturbance at a minimum. A strip pitch of 2 mm allows to reconstruct the Gaussian shape beam profile with the desired accuracy. These beam profiles are analyzed (and verified) during a treatment on a spot-by-spot basis, before the next spot is applied, introducing a dead time after every spot. Applying 50, 000 spots in a treatment introduces the challenge to data acquisition and - processing in terms of keeping treatment times reasonable. Data pileup and long dead times are mitigated by optimized front-end electronics and early-stage data processing, without compromising data quality and the accuracy of the measured beam position.

At the Centre for Proton Therapy at the Paul Scherrer Institute cancer patients are treated with a fixed beamline and in two gantries for ocular and non-ocular malignancies, respectively. For the installation of a third gantry a new patient safety system (PaSS) was developed and is sequentially being rolled out to update the existing areas. The aim of PaSS is to interrupt the treatment whenever any sub-system detects a hazardous condition. To ensure correct treatment delivery, this system needs to be thoroughly tested as part of the regular quality assurance (QA) protocols as well as after any upgrade. In the legacy safety systems, unit testing required an extensive use of resources: two weeks of work per area in the laboratory in addition to QA beam time. In order to significantly reduce the time, an automated PaSS test stand for unit testing was developed based on a PXI chassis with virtually unlimited IOs that are synchronously stimulated or sampled at 1 MHz. It can emulate the rest of the facility using adapters to connect each type of interface. With it PaSS can be tested under arbitrary conditions. A VHDL-based formal language was developed to describe stimuli, expected behaviour and specific measurements, interpreted by a LabView runtime environment. This article describes the tools and methodology being applied for unit testing and QA release tests for the new PaSS. It shows how automation and formalization made possible an increase in test coverage while significantly cutting down the laboratory testing time and facility's beam usage.

The step-and-shoot method of pencil beam scanning delivers the dose on a 3D grid in the target volume, with one dimension defined by the proton energy. While the dose per pencil beam may vary substantially within an iso-energy layer, the beam current typically remains constant. In this static operation mode, the inherent latency of the beam switch-off mechanism results in a lower limit for the deliverable spot dose, which may prevent the application of some of the low-weighted spots prescribed by the treatment planning system. To overcome this limitation, we introduced dynamic beam current control at the PSI Gantry 2, an innovative new approach successfully commissioned and in clinical operation since fall 2017. The control system was enhanced with a direct link to the vertical deflector located at the centre of the cyclotron. This connection allows much faster beam current changes (~0.1 ms) and hence opens up the possibility of dynamically reducing the current for individual low-dose spots. We demonstrate that with this new dynamic operation mode, all spots are delivered as planned without compromising treatment time. We show by two independent and complementary methods that the delivered dose distribution is improved.

At the Paul Scherrer Institute (PSI) in Switzerland, cancer patients are treated with protons. The PSI Gantries work with Pencil Beam Scanning (PBS) technology. For beam profile characterization, a new 2-D planar pixel detector based on Printed Circuit Board technology was developed. The main challenge of the design was the limited amount of 256 readout channels while several thousands of detector signals had to be processed. With PBS, only a few pixels will be hit by the proton beam and give a significant signal, while most of them will not capture any signal. On the detector design, the active area was divided into pixel arrays with equal size, while one array is such big to cover the whole size of the proton beam. By a so-called channel recycling technique, the same pixel number of all pixel arrays were connected together to one readout channel. The proof of concept was verified with a small detector. In the next step, the design was changed such, getting a full-scale detector for Gantry 2. The readout electronics board itself is also a development performed at PSI. A core component of the design is the ADAS1128 chip from ANALOG Devices featuring 128 input channels. The pixel detector is fully integrated into the therapy control system (TCS) through readout electronics with a field-programmable gate array (FPGA) technology. The FPGA technology allows to readout the detector synchronized to the beam delivery. This paper summarizes the features of the pixel detector design, the readout electronics, and shows the first experimental results.

At the Centre for Proton Therapy at the Paul Scherrer Institute, a cyclotron, two gantries and a fixed beamline are being used to treat tumours. In order to prevent nonoptimal beam delivery, an interlock patient safety system (PaSS) was implemented that interrupts the treatment if any sub-system reports an error. To ensure correct treatment, the PaSS needs to be thoroughly tested as part of the regular quality assurance as well as after each change. This typically required weeks of work, extensive beam usage and could not always cover all possible failure modes. With the opportunity of the installation of a new gantry, an automated PaSS test stand was developed that can emulate the rest of the facility. It consists of a NI PXI chassis with virtually unlimited IOs that are synchronously stimulated or sampled at 1MHz, a set of adapters to connect each type of interfaced signal and a runtime environment. We have also developed a VHDL based formal language to describe stimuli, assertions and specific measurements. We present the use of our test stand in the verification and validation of the PaSS, showing how its full quality assurance, including report generation was reduced to minutes. INTRODUCTION At the Paul Scherrer Institut (PSI) cancer patients are being treated using proton therapy for a number of indications. The facility currently includes a fixed beam line for eye cancer treatment, operating clinically since 2010, and Gantries 1 and 2 operating since 1996 and 2013 respectively [1, 2]. A dedicated 250 MeV cyclotron is used to provide beam for all the treatment areas. Recently a new Gantry 3 has been installed and is being commissioned. Both the latter Gantry and the accelerator are commercial products from the company Varian Medical Systems [3]. The rest of the treatment areas were designed in house. Each for the treatment areas designed at PSI, as well as the adapter used for the integration of Gantry 3 include a Patient Safety System. PaSS is the system responsible to monitor the status of the different elements involved in the treatment and to stop the beam to avoid personal harm whenever any potentially unsafe condition is detected. The Patient Safety System needs to be thoroughly tested in order to ensure correct treatment. The quality assurance first includes testing the monitors and final elements connected to it. This is typically part of the commissioning process and regularly scheduled QA tests [4]. Secondly the hardware undergoes unit testing. This involves a preparation phase, when a risk analysis is performed and a test specification based on the design specifications are written, and an execution phase. The execution is both performed as a simulation, and later physically tested in the lab with a test stand that stimulates all inputs and monitors all outputs and checks that the response is as expected. Thirdly an integration test in the facility is performed, when all supervision functions and all final elements are checked for correctness, and errors are injected to monitor the PaSS response. It is important to note that being executed in a clinical facility, not all cases can be covered in this last step. UNIT TESTING CONCEPT The unit testing consists of a series of test steps applied to the PaSS system to emulate real life conditions at the interface level. Each of the unit tests are derived from different aspects of the design specifications and specify both a stimulus to be applied to the input signals and an expected behaviour of the output signals. They are described in a document that describes the test using and timed signal diagrams. With the introduction of Gantry 3, a new unit testing methodology was introduced and it is now also being gradually applied to the other treatment areas. The unit tests are specified in a formal language that was developed for this task and which will be detailed in the following section. This reduces the amount of manual work, removes the ambiguities of natural language and therefore minimizes the possibility of errors. Also, thanks to the technical progress of instrumentation hardware with a high count of fast digital IOs, such as National Instruments ́ PXI crates, it is now possible to synchronously all input signals and sample all output signals instead of sequentially testing small subsets of signals, as was the case in our former unit testing setup. The three main aspects described in the unit tests are the stimuli, expected reaction and time measurements. Stimuli can be both realistic as well as physically impossible in the real facility. The expected and forbidden reactions are described as logic assertions. A number of time measurements can be programmed to evaluate the performance of the hardware and its logic. UNIT TEST FORMAL DESCRIPTION After an investigation of different existing languages to describe tests and assertions, nothing was found that was both compact and close enough to natural language as to be able to replace the textual description in the unit test 16th Int. Conf. on Accelerator and Large Experimental Control Systems ICALEPCS2017, Barcelona, Spain JACoW Publishing ISBN: 978-3-95450-193-9 doi:10.18429/JACoW-ICALEPCS2017-THPHA098

When treating cancerous tissues with protons beams, many centers make use of a step-and-shoot irradiation technique, in which the beam is steered to discrete grid points in the tumor volume. For safety reasons, the irradiation is supervised by an independent monitoring system validating cyclically that the correct amount of protons has been delivered to the correct position in the patient. Whenever unacceptable inaccuracies are detected, the irradiation can be interrupted to reinforce a high degree of radiation protection. At the Paul Scherrer Institute, we plan to irradiate tumors continuously. By giving up the idea of discrete grid points, we aim to be faster and more flexible in the irradiation. But the increase in speed and dynamics necessitates a highly responsive monitoring system to guarantee the same level of patient safety as for conventional step-and-shoot irradiations. Hence, we developed and implemented real-time monitoring of the proton beam current and position. As such, we read out diagnostic devices with 100 kHz and compare their signals against safety tolerances in an FPGA. In this paper, we report on necessary software and firmware enhancements of our control system and test their functionality based on three exemplary error scenarios. We demonstrate successful implementation of real-time beam monitoring and, consequently, compliance with international patient safety regulations.

The Center for Proton Therapy of the Paul Scherrer Institute has a long history of technical innovation and development in the field of proton therapy and related quality assurance (QA). The second proton pencil beam scanning gantry built at the CPT, Gantry 2, is a state-of-the-art system. The unique integration of QA equipment and detectors within the control system of the gantry allows for fast and detailed measurements. Here we present our latest developments in detection systems, their performance for QA and research capabilities in comparison with their commercial equivalent. The QA equipment developed for proton range measurement at Gantry 2 consists of a multi-layer ionization chamber (MLIC). The extensive integration of our detectors with the control system allows fast spot-based measurement. Including the energy change, we can achieve a proton range evaluation within 125 ms. Consequently, our device can measure the proton range alteration caused by material samples for hundreds of energies within less than a minute. This allows us to measure the stopping power of compound material within minutes. We compare the stopping power evaluation using the MLIC against three other techniques. The results show the strong points of the equipment developed in-house, such as the consistency, the reliability and the innovation possibilities.

Line scanning represents a faster and potentially more flexible form of pencil beam scanning than conventional step-and-shoot irradiations. It seeks to minimize dead times in beam delivery whilst preserving the possibility of modulating the dose at any point in the target volume. Our second generation proton gantry features irradiations in line scanning mode, but it still lacks a dedicated monitoring and validation system that guarantees patient safety throughout the irradiation. We report on its design and implementation in this paper. In line scanning, we steer the proton beam continuously along straight lines while adapting the speed and/or current frequently to modulate the delivered dose. We intend to prevent delivery errors that could be clinically relevant through a two-stage system: safety level 1 monitors the beam current and position every 10 μs. We demonstrate that direct readings from ionization chambers in the gantry nozzle and Hall probes in the scanner magnets provide required information on current and position, respectively. Interlocks will be raised when measured signals exceed their predefined tolerance bands. Even in case of an erroneous delivery, safety level 1 restricts hot and cold spots of the physically delivered fraction dose to  ±36 mGy (±2% of 2 Gy biologically). In safety level 2—an additional, partly redundant validation step—we compare the integral line profile measured with a strip monitor in the nozzle to a forward-calculated prediction. The comparison is performed between two line applications to detect amplifying inaccuracies in speed and current modulation. This level can be regarded as an online quality assurance of the machine. Both safety levels use devices and functionalities already installed along the beamline. Hence, the presented monitoring and validation system preserves full compatibility of discrete and continuous delivery mode on a single gantry, with the possibility of switching between modes during the application of a single field.

At the Paul Scherrer Institute (PSI) in Switzerland, cancer patients are treated with protons. Proton therapy at PSI has a long history and started in the 1980s. More than 30 years later, a new gantry has recently been installed in the existing facility. This new machine has been delivered by an industry partner. A big challenge is the integration of the vendor's safety system into the existing PSI environment. Different interface standards and the complexity of the system made it necessary to find a technical solution connecting an industry system to the existing PSI infrastructure. A novel very flexible distributed IO system based on field-programmable gate array (FPGA) technology was developed, supporting many different IO interface standards and high-speed communication links connecting the device to a PSI standard versa module eurocard-bus input output controller. This paper summarizes the features of the hardware technology, the FPGA framework with its high-speed communication link protocol, and presents our first measurement results.

Paul Scherrer Institute currently extends its PROSCAN facility with a third gantry treatment room - Gantry 3, which is realized in a research collaboration with Varian Medical Systems. The main research goals at the PROSCAN facility include further development of precise spot scanning and optimized beam delivery with low dead-time for treatment of moving targets. Consequently Gantry 3 is designed to feature advanced pencil beam scanning technology with a large scan field size of 30x40cm, integrated cone beam CT functionality and will in the future allow fast energy layer switching. The main challenge in realizing Gantry 3 is the integration of the Varian Gantry into the existing PROSCAN control system environment, allowing seamless beam operation. Installation of the additional treatment room has started in summer 2015 followed by the integration and technical commissioning phases of the Gantry in 2016, all during full operation of the existing treatment areas at our facility. We report about the special challenges and achieved performance results during commissioning of the Varian Gantry system in combination with the PSI PROSCAN facility.

Purpose: The main focus of the present study is to investigate dose enhancement effects in presence of gold nanoparticles (AuNPs) in proton delivery site of the ocular melanoma by the use of fixed pencil beam method associated with the Harvard ocular nozzle in a series of Monte Carlo simulations.Moreover, this paper also aims to present a comparison of the obtained results between the actual eye model, consisting of all sections of the eye and realistic compositions in the presence of AuNPs, and in the exact same organ, albeit in privation of the mentioned material.Materials and Methods: Previous Monte-Carlo simulations have strained to acquire the same results obtained through latest experiments that have considered dose enhancement effects of proton treatments with existence of AuNPs, but to no avail; thus, multiple simulation codes such as MCNP, GEANT4, and FLUKA have been taken into account to insure the least possible deviation from in vivo findings.Rigorous libraries and models have been used, and all physical processes involved have been accounted for.Furthermore, for the sake of accuracy, the production of the most probable secondary particles due to interactions with matter has also been examined.Contribution to dose enhancement effects are due to stopping losses, coulomb interactions, and elastic and non-elastic collisions of proton itself, as well as from secondary particles that are produced in mentioned processes.Results and Conclusions: The attempt of such paper is to shed light on the endless possibilities of escalating the efficiency of medical endeavors through interdisciplinary methods which combine various aspects of science and technology to attain desired results.

Purpose or Objective: In proton therapy, anatomical changes may cause considerable deterioration of the delivered dose distributions. Transmission-based treatment verification is generally not possible, making three-dimensional (3D) dosimetry a promising tool for verification of the delivered dose. However, solid state 3D detectors have significant problems related to linear-energy-transfer dependent quenching in particle beams – an under-response of the signal in the Bragg peak. A new deformable, silicone-based, radiochromic 3D dosimeter has recently been developed by our group. The aim of this study was to perform the first proton beam experiments with this detector. Special attention was given to the quenching and dose-rate dependencies in general, relating these effects to the chemical composition of the dosimeter.

A new gantry for cancer treatment is being installed at the Proton Therapy Centre in the Paul Scherrer Institut (PSI), where already two gantries and a fix line operate. A protection system is required to ensure the safety of patients, requiring stricter redundancy, verification and quality assurance measures than other accelerators. It supervises the Therapy System, sensors, monitors and operator interface and can actuate magnets and beam blockers. We built a reusable framework to increase the maintainability of the system using the commercial IFC1210 VME controller, developed for other PSI facilities. It features a FPGA implementing all the safety logic and two processors, one dedicated to debugging and the other to integrating in the facility's EPICS environment. The framework permitted us to reduce the design and test time by an estimated 40% thanks to a modular approach. It will also allow a future renovation of other areas with minimum effort. Additionally it provides built-in diagnostics such as time measurement statistics, interlock analysis and internal visibility. The automation of several tasks reduces the burden of QA in an environment with tight time constraints. INTRODUCTION The Paul Scherrer Institut (PSI) was a pioneer in the field of proton therapy for cancer treatment by being the first centre to implement spot scanning for dose delivery back in 1996. Nowadays there exist many centres using such technology and several vendors offering commercial products. In order to increase the number of patients being treated it was the decided to buy a scanning gantry from Varian Medical Systems [1], while keeping research and development in the existing in-house engineered areas. The current facilities of the CPT consist of a fixed beam line for eye cancer treatment, operating clinically since 2010, and Gantries 1 and 2 operating since 1996 and 2013 respectively [2] [3]. The beam is provided by a dedicated 250 MeV cyclotron from the company Varian Medical Systems. There are several systems required to allow for a safe and accurate delivery of the prescribed dose to the patient. The most relevant ones are the Patient Safety System (PaSS), to prevent accidents and the Therapy Control System (TCS), to deliver dose and to verify the correctness of the delivery. Other systems working independently but interconnected are the Beam Tuning Verification System (BTVS), the Machine Control System (MCS), the Run Permit System (RPS) and the Main Patient Safety Switch and Controller (MPSSC). Finally there is a number of Dose and Beam Position Monitors and a set of final elements such as a kicker magnet and beam blockers. In order to integrate the commercial gantry in the existing facility it was necessary to develop two adapters: The TCS adapter interfaces the vendor specific control system commands (such as setting energy and beam current values) to the appropriate facility resources. The PaSS adapter autonomously takes care of preventing accidents, and also actuates some final elements on request of the gantry. Figure 1 shows an overview of all the systems to which the PaSS is connected. PSI Therapy Control System Main Patient Safety Switch and Controller Beam Blockers Operator Console Patient Gating System Vendor’s Gantry Therapy Control System Beam Tuning Verification System Beam Blockers Beam Monitors Patient Safety System Signal Converter Box Signal Converter Box Cyclotron Graphical User Interface Figure 1: System overview of the integration of the new gantry’s Patient Safety System This document describes in detail the new Patient Safety System developed for the installation of the new gantry. Also the experience of conceiving and designing it as a reusable framework, comparing it to previous designs is presented. Final tests for regulatory approval and clinical commissioning will take place during 2016 and patient treatment will start later in the year. PATIENT SAFETY SYSTEM CONCEPT The main goal of the patient irradiation for CPT is that each dose spot is delivered at the correct position and with the correct dose quantity. According to the International Commission on Radiation Units and Measurements (ICRU) [4], the aim in intensity modulated radiation therapy is to achieve an accuracy of 5% of the . Proceedings of ICALEPCS2015, Melbourne, Australia TUC3O04 Personnel Safety and Machine Protection ISBN 978-3-95450-148-9 549 C op yr ig ht © 20 15 C C -B Y3. 0 an d by th e re sp ec tiv e au th or s total treatment dose. CPT adheres to the following safety goals [5]: 1. “No radiation accident”, considering a worst case local 5% dose excess. 2. “No error in the delivered dose”, avoiding dose distribution errors ≥ 2% of the planned field dose. 3. “No error in dose position”, aiming at ± 1mm in lateral and depth direction 4. “Delivered dose and dose position must be know at all times” so irradiation can be interrupted and resumed safely. The systems verifying that the previously defined goals are achieved are the Patient Safety System and the Therapy Control System, working independently. The PaSS collects information from several sensors and can actuate on certain final elements. Internally it has a hierarchical structure with ready signals and three levels of interlocks, from low to high severity as detailed in Table 1. Each level has a success supervision system and in case it fails, it escalates to the next level. All the logic inside PaSS is hard wired either in a Field Programmable Gate Array (FPGA) or with relays. This is required to maximize stability, predictability and minimize response time. Physically the interconnection lines are based on redundant three wire logic cables. All the information is sent together with its inverse using current loops that allow for detection of short or open circuits. Table 1: Interlock system levels Severity Measures to prevent beam ALOK Close local beam blocker and activate deflector magnet ATOT Close main blockers, stop the proton acceleration in the cyclotron, plus all final elements actions of ALOK ETOT Switch off the cyclotron’s acceleration system, the ion source and all final elements actions of ALOK and ATOT There are two modes of operation, one for therapy and one for experiments and development. The operation mode has to be consistently selected by a physical key at the operator console and by the TCS. Patients can only be treated in Therapy mode and in this mode the PaSS cannot be configured or altered. In Experiment mode it is possible to “bridge” certain interlock values or to overwrite some configuration parameters. SYSTEM ARCHITECTURE The main two constraints at the beginning of the project were restricted manpower and limited specifications. For that reason, a modular architecture was chosen, reusing as many elements as possible. Hardware The platform used was IFC1210, a commercial Versa Module Europa (VME) Input Output Controller (IOC) from IOxOS Technologies [6]. It features a user programmable Virtex 6 FPGA and two PowerPC Central Unit Processors (CPU), both running SMP Linux. An EPICS kernel driver running on Linux implements the Ethernet-based Channel Access protocol and enables access to the registers inside the FPGA fabric. There are also two FPGA Mezzanine Card (FMC) bays, which were populated with Small Form-factor Pluggable (SFP) optical transceivers. The safety logic was implemented in the user FPGA and is totally autonomous after boot. There were 98 interlock signals to be distributed to and from other systems in the facility. The connectivity was achieved with the Signal Converter Boxes, which are basically multiplexers. They are outsourced custom designed electronics, highly configurable with an Artix-7 FPGA, several SFP optical transceivers and ten generic plugin ports. The plugin ports are SMC mezzanine connectors to place application specific cards. In this way the platform has been defined to be flexible if the number or type of signals interfacing to the new gantry changed during the design phase. Already existing three wire logic plugins were used to interface with CPT systems, and three new types of plugins had to be developed according to specifications from Varian. Firmware IFC1210 provides a powerful firmware infrastructure with a Network on Chip (NoC) to which resources are connected. There are central resources such as FMC support or memory, and also user defined blocks. A user block was coded in VHDL language. In order to increase reusability the design was divided into a platform independent PaSS Framework, and an application specific IFC1210 code. The framework consists of a package and generic building block definitions, such as timers, interlock trackers or input debounce elements. The application specific code includes the safety logic, which is a Mealy state machine defining the configuration of the final elements based on present and past inputs, in addition to the specific memory interface, interconnection logic and instantiation of user configurable debug and visualization blocks. Software Many PaSS logic status and configuration variables are mapped via the on-board connectivity mesh in the IFC1210 to the EPICS driver and then exported through Ethernet to a local area network (LAN). A Graphical User Interface (GUI) was developed to set and get all 7000 published EPICS registers. It is organised in tabs; an overview is shown in Figure 2. With the user interface one can visualise hardware and logical states of input, output and internal signals, display detailed information or bridge logical states of allowed signals. Also some statistic or debug information is displayed, like a chronological list of events, counters and timing statistics. TUC3O04 Proceedings of ICALEPCS2015, Melbourne, Australia ISBN 978-3-95450-148-9 550 C op yr ig ht © 20 15 C C -B Y3. 0 an d by th e re sp ec tiv e au th or s Personnel Safety and Machine Protection Figure 2: Interlock overview tab of PaSS GUI The GUI was programmed in Java using Apache C