ITR: Software Safety Mechanisms for Medical Systems

现代医疗诊断和治疗系统正处于一场计算机化革命的开端。机电设备正在被新的、广泛集成的、高度计算机化的系统所取代，在这些系统中，与患者和临床医生的交互通过复杂的软件进行调节。通过提高精确度和易用性-更不用说全新的干预和诊断形式-这些进步有望实现更有效和更高效的医疗基础设施。同时，软件的使用带来了更大的灾难性故障风险，造成生命损失。这项研究项目提供了通过研究提高医疗软件系统的安全性和可靠性的新技术来提高部署这些系统所需软件的安全性的前景。这项研究是与东北质子治疗中心合作进行的，东北质子治疗中心是全国两家先进的质子治疗中心之一。该项目正在设计技术，以确保软件错误不会导致系统违反基本安全特性。开发人员确定基本的安全属性，然后设计监控系统的软件联锁，以检测这些属性即将发生的违规行为。当检测到即将发生的违规时，联锁会采取旨在确保不侵犯该属性的操作。例如，放射治疗机的安全属性可能规定，治疗应在操作员按下紧急停止按钮后一秒内停止。为了强制执行这一属性，可能会增加一个联锁装置，其唯一职责是监视主控制软件的动作，并在该控制软件未能在规定的时间内完成的情况下插入横梁止动装置。主要挑战包括：监测技术，以检测即将发生的违反安全属性的行为；分析监测结果，以检测不一致的状态、潜在的不安全行动或缺少必要的行动；以及确定可能修改系统内部状态以使其恢复一致性的适当干预措施，过滤掉不适当的行动，或插入确保系统安全执行所需的行动。

Modern medical diagnosis and treatment systems are at the beginning of a computerization revolution. Electromechanical devices are being replaced with new, extensively integrated and heavily computerized systems in which interactions with both patient and clinician are mediated by complex software. Through increased precision and ease of use - not to mention entirely new forms of intervention and diagnosis -these advances hold promise of a medical infrastructure that is both more effective and more efficient. At the same time, the use of software brings a larger risk of catastrophic failure, resulting in loss of life. This research project offers the promise of improving the safety of the software required to deploy these systems by investigating new techniques for improving the safety and reliability of medical software systems. The research is conducted in collaboration with the Northeast Proton Therapy Center, one of two advanced proton therapy centers in the country.This project is designing techniques to ensure that software errors do not cause a system to violate basic safety properties. The developer identifies the basic safety properties, then designs software interlocks that monitor the system to detect impending violations of these properties. When an impending violation is detected, the interlock takes actions designed to ensure that the property is not violated. For example, a safety property for a radiation therapy machine might state that treatment should stop within one second after an operator presses the emergency stop button. To enforce this property, an interlock might be added whose sole responsibility is to monitor the actions of the main control software and insert a beam stop if this control software fails to do so within the specified time. Key challenges include: monitoring technology to detect impending violations of safety properties; analyses of monitor results to detect inconsistent states, potentially unsafe actions, or the absence of required actions; and identification of appropriate interventions that may modify the internal state of the system to restore it to consistency, filter out inappropriate actions, or insert actions required to ensure that the system executes safely.