ITR: Software Safety Mechanisms for Medical Systems

现代医疗诊断和治疗系统正处于计算机化革命的开端。 机电设备正在被新的、广泛集成的和高度计算机化的系统所取代，在这些系统中，与患者和临床医生的交互由复杂的软件介导。 通过提高精确度和易用性-更不用说全新的干预和诊断形式-这些进步为更有效和更高效的医疗基础设施带来了希望。 与此同时，软件的使用带来了更大的灾难性故障风险，导致生命损失。 该研究项目提供了通过调查用于提高医疗软件系统的安全性和可靠性的新技术来提高部署这些系统所需的软件的安全性的承诺。 该研究是与东北质子治疗中心合作进行的，该中心是该国两个先进的质子治疗中心之一。该项目正在设计技术，以确保软件错误不会导致系统违反基本安全属性。 开发人员识别基本的安全属性，然后设计监控系统的软件联锁，以检测即将发生的违反这些属性的行为。 当检测到即将发生的违规时，联锁装置采取旨在确保属性不被违反的措施。 例如，放射治疗机的安全属性可能规定，在操作员按下紧急停止按钮后，治疗应在一秒内停止。 为了加强这一特性，可以增加一个联锁装置，其唯一的职责是监控主控制软件的动作，如果该控制软件在指定时间内未能这样做，则插入射束停止。 主要挑战包括：监测技术，以检测即将发生的违反安全属性;分析监测结果，以检测不一致的状态，潜在的不安全行为，或缺乏所需的行动;和识别适当的干预，可能会修改系统的内部状态，以恢复其一致性，过滤掉不适当的行动，或插入所需的行动，以确保系统安全执行。

Modern medical diagnosis and treatment systems are at the beginning of a computerization revolution. Electromechanical devices are being replaced with new, extensively integrated and heavily computerized systems in which interactions with both patient and clinician are mediated by complex software. Through increased precision and ease of use - not to mention entirely new forms of intervention and diagnosis -these advances hold promise of a medical infrastructure that is both more effective and more efficient. At the same time, the use of software brings a larger risk of catastrophic failure, resulting in loss of life. This research project offers the promise of improving the safety of the software required to deploy these systems by investigating new techniques for improving the safety and reliability of medical software systems. The research is conducted in collaboration with the Northeast Proton Therapy Center, one of two advanced proton therapy centers in the country.This project is designing techniques to ensure that software errors do not cause a system to violate basic safety properties. The developer identifies the basic safety properties, then designs software interlocks that monitor the system to detect impending violations of these properties. When an impending violation is detected, the interlock takes actions designed to ensure that the property is not violated. For example, a safety property for a radiation therapy machine might state that treatment should stop within one second after an operator presses the emergency stop button. To enforce this property, an interlock might be added whose sole responsibility is to monitor the actions of the main control software and insert a beam stop if this control software fails to do so within the specified time. Key challenges include: monitoring technology to detect impending violations of safety properties; analyses of monitor results to detect inconsistent states, potentially unsafe actions, or the absence of required actions; and identification of appropriate interventions that may modify the internal state of the system to restore it to consistency, filter out inappropriate actions, or insert actions required to ensure that the system executes safely.