Safety and Control System for the GSI Therapy Project
E. Badura, H. Eickhoff, H. Essel, Th. Haberer, J. Hoffmann, U. Krause, W. Ott, K. Poppensieker,
M. Richter, D. Schardt, R. Steiner, B. Voss
Gesellschaft für Schwerionenforschung, Planckstr. 1, 64291 Darmstadt, Germany
Abstract
This talk describes briefly the ideas of the tumor
treatment with heavy ions, using the raster scanningtechnique. It gives a survey of the energy loss of heavy ionsin matter (Bragg peak) as well as the biological efficiencyof the heavy ions. A description of the concepts of theraster scanning technique follows. The physical parameters
involved (energy, focus, intensity) will be discussed. The
next section deals with the technical realization of the rasterscanner control system. It is concerned with thecommunication with the GSI accelerator SIS and with thehandling of the process data stipulated by the treatment
planning. These data are: the position of the beam within
the tumor, the applied dose for a single pixel, the scanner
magnet settings and the beam request mechanism. Inaddition the control system handles other technicalparameters like high voltage, pressure and temperature of
the ionization chamber detectors, the position of the patient
couch, vacuum valves, etc. An important part of the control
system is the beam shut off system. Another subsystem ofmajor concern is the interlock system. This system takes
care for the safety of the patient and manages the correct
execution of the treatment. The last paragraph describes themeans of cross checking and overall system monitoring.

the beam. This results in a biological efficiency shown in
Fig.: 2.

1 Basic concepts of the GSI therapy project
The energy loss of heavy ions in matter is characterized
by a sharp “Bragg Peak”. The penetration depth depends onthe energy of the beam.
Fig.: 2 Biological efficiency

Fig.: 1 Energy Loss of Heavy Ions in Matter
Varying the energy of the beam and its intensity, leads to asuperposition of “Bragg Peaks” which yields to a dose
distribution shown in Fig.: 1. Therefore the dose ismainly deposited in a region defined by the energy range ofThis behavior of heavy ions led Th. Haberer et. al. [1] tothe design of the intensity controlled raster scan treatment
method. Fig.: 3 shows the principles of this method. The
volume of the tumor is divided into slices irradiated withconstant energy. Irradiation starts with the highest energy
Emax and ends with the lowest energy Emin. Each of theseslices (Iso Energy Planes IES) contains a number of pixels
depending on the shape of the tumor. Two dipole magnets
deflect the beam to the first pixel. The beam remains at thispixel as long as the stipulated number of particles for thecurrent pixel is reached. After that, the beam isdeflected to the next pixel. This process lasts as long as thelast pixel of the IES is irradiated. At the end of theirradiation of one IES, the control system stops the beam,
requests the next energy and starts with the firstpixel of the next IES.
The process stops when the last pixel of the last IES isirradiated.

The real time VME system is the heart of the safety andcontrol system. It handles the process data and controls theperipheral electronics, like beam request control, scanner
magnet control, position measurement, and intensity
measurement. Further parts of the safety and control
system are: the spill abort system, an independent intensity
measurement control, the patient couch, a laser system for
positioning of the patient, a mask to fix the patient on thepatient couch, a X-ray device to control the position of thepatient, ionization chambers (IC1 - IC3) and two multi wire
proportional chambers (MWPC1, MWPC2) with theaccording high voltage supplies and gas distribution
system. The medical operator console performs all actions
done by authorized staff; like start and stop of theirradiation, etc.

Synchronisation, Next Pixel, Next PlaneDSP LinksChargetoFrequency
Converter

SAMS

SAMI 2SAMI 1

ASRSAMO 2

SAMO 1

to SlowControl

WatchdogTimer

IC 3
to Intensity Measurement Control

X / Y Scanner Magnets
Gain Control

Ethernet

Intensity 2
Intensity 1

Current Amplifier 1
Current Amplifier 2

Position 2

MWPC 2

Position 1

MWPC 1

IC 2
IC 1

Beam Request
toSIS Control

Fig.: 5 Real Time Control VME System Overview

3 Control system overview
The Treatment- and Technical Control RoomTechnicalControlRoom

3.1 The real time control VME system

SAMD

The safety and control system has to deal with thefollowing physical parameters:• Heavy ions used for the therapy project: (12C6+)• Energy range: 80 - 400 MeV/u in 253 steps• Focus of the beam: 7 steps• Intensity of the beam (particles / spill): 15 steps• Position of the beam in the tumor• Size of the beam at this position in the tumor• Number of particles at this position in the tumor.
These parameters are defined and stipulated by thetreatment planning.

SAMP

2 The physical parametersser. I/O

Fig.: 3 The Principles of the Raster Scan Method

Therapy Operating
ComputerSlow Control VME

BeamRequestControl

Real Time Control VME

Laser

The real time control VME system consists of acommunication controller ASR and several dedicated DSP
based controllers connected to the peripheral electronics.
DSP links on the P2 connector of the VME cratesynchronize these controllers.

Patient Couch
MedicalOperator
ConsolScannerMagnetControl

Position
Measurement(MWPC 1,2)

X - Ray

Gas Distribution
High Voltage

3.2 Scanner magnet control
Mask

Intensity
Measurement(IC 1,2)Intensity
Measurement
Control (IC3)To
Spill Abort
SystemThe controller SAMS drives the current of the verticaland horizontal magnets. It verifies the setting and observes
the settling time.

To
Spill Abort
SystemInterlock Unit

Fig.: 4 Treatment- and Technical Control Room•••••The Therapy Operating Computer
handles the treatment plan,
prepares the data to be processed,
loads and verifies these data,
displays status information,
performs the graphical user interface (Factory Link).

The slow control VME system communicates with thetherapy operating computer and the real time VME system.
It receives status information about the current irradiation,
particularly information about interlocks. Also the slow
control VME system performs the control of temperatureand pressure of the detectors.

3.3 Intensity measurement
The intensity measurement is redundant. Eachbranch consists of an ionization chamber (IC), a current
amplifier, a digitizing unit, and a DSP controller SAMI. A
serial I/O controller sets the gain of the current amplifier.
Method: The current of the IC, which is proportional to thebeam current, is amplified and converted into a voltage.
This voltage is digitized by an ADC each 12.7 µs andsummed up. This sum is constantly compared with thevalue stipulated by the intensity value for the current pixel.
If this value is reached, the beam is deflected to the nextpixel. The two branches are controlled for equal operation.
3.4 Position measurement system
The position measurement is also redundant. Each branch
consists of a multi wire proportional chamber, a3.5 Beam request control
The beam control system consists of electronics forcommunication with the accelerator control system and a
DSP controller SAMP. The system requests thecorresponding energy step, the focus of the beam, and thenumber of particles per spill for each IES.
3.6 Intensity measurement control
The intensity measurement control consists of a thirdionizationchamber (IC3), a charge to frequency
converter, and three preset counters. This independent
system performs a maximum dose per pixel cut off, amaximum dose per IES cut off, and a maximum dose per
total irradiation cut off.
3.7 Communication with therapy operating computer
A dedicated DSP controller SAMD sends all relevant
data and status information of the real time control system
to the therapy operating computer. This computer with its
graphical user interface informs the operators about thestatus and progress of the irradiation of the patient.

5 Safety considerations
In case of a failure or an error the extraction of the beam
must be stopped within 1 ms. This is done by deactivating afast quadrupol and a bending magnet in the beam line. At
the end of an IES only the quadrupol is deactivated.
In case of an irradiation of a patient this spill abort system
is solely controlled by the safety and control system. It can
not be influenced by other activities at GSI.
The spill can be aborted by the interlock unit (ILE) andthe intensity measurement control system.
The failure or error information (30 inputs) is stored in
the error register of the ILE. The signal to the spill abortsystem is the logical or of the outputs of this register. Only
an intervention at the medical operator console by anauthorized person clears and enables the ILE. The ILE also
reserves the spill abort system for therapy irradiation. If
this reservation fails no extraction of beam is possible.
5.1 Hardware•Scanner magnet breakdown or failure

Interlock SAMO 1

Hardware Interlock High Voltage

Interlock SAMO 2

Hardware Interlock Scanner Magnet (horizontal)

Interlock SAMI 1

Hardware Interlock Scanner Magnet (vertical)

Interlock SAMI 2

Hardware Interlock Position 1, Position 2

Interlock SAMS

Hardware Interlock Intensity 1, Intensity 2

Interlock SAMP

Hardware Interlock Beam Request

Interlock SAMDInterlock Watchdog

3.8 Software time-out

Hardware Interlock Gasdistribution
Hardware Interlock Vacuum, Valves etc.
Hardware Interlock Patient CouchControl from MBDKAll DSP based controllers must send a periodical signal
to a watchdog timer to insure proper operation of thesoftware running in the controllers.

ILE

digitizing readout electronic, and a DSP controller SAMO.
The task of this system is to measure the position and thewidth of the beam at the current pixel. This measured
values are compared with the stipulated process data of thebeam position. The method of this system is described in[2].

Spill Reservation
for Therapy

Hardware Interlock Mask
Hardware Interlocks Intensity Monitor

Signal to Spill Abort
System

3.9 Synchronization
All DSP controllers communicate with each other via aring of DSP links. If one controller runs out of phase inprocessing of the data, the irradiation is stopped.

Fig.: 6 Interlock Unit ILE

4 Data to be processed by the control system••••

The physical parameters derived from the treatment
planing are transformed in the following data used by thecontrol system:• number of IES,
• number of pixels per IES,
• energy step (1 - 253) for each IES,
• intensity step for each IES,
• focus or each IES,
• Current of the scanner magnets for each pixel including
tolerances and settling time,• position and size of the beam per pixel,• intensity per pixel,• maximum intensity per pixel, per IES, and per total
irradiation,• high voltage of the detectors,• gas flow, pressure , and temperature of the detectors,• position of the patient.

Two groups of signals cause an interlock:••••High voltage is out of order,
Gas distribution fails (no gas),
MWP readout electronic fails,
Digitizing electronic of the intensity measurement fails(ADC time-out, data overrun ,etc.),
The beam request electronic fails (wrong energy step,e.g.),
A valve in the beam line is closed or the vacuum is bad,
The patient couch has moved during irradiation,
The patient has opened the mask,• The intensity measurement control detects toomuch radiation. This interlock is independently
routed to the spill abort system.
5.2 Software
Each DSP based Controller is capable of sending aninterlock signal to the ILE.

••
••

•
•

The position measurement (SAMO1 or SAMO2)
detects a wrong position or a wrong spot size of thebeam,
The intensity measurement controllers (SAM1 orSAMI1) detect an error (overshoot) in the intensity.
The scanner magnet controller (SAMS) detects a
failure in the current settings of these magnets ordetects a time-out, e.g. too fast movement of the beam,
The beam request controller (SAMP) detects an error in
the communication with the SIS control system, e.g.
the requested energy step is not correctly executed by
the accelerator.
An interlock is also generated if the communication
with the therapy operating computer fails (SAMD).
A software time-out of any controller leads to aninterlock (watchdog timer).

6 Conclusion
All acceptance tests have been passed and the first
patients will be treated at the beginning of December thisyear.
Acknowledgments
We would like to thank Prof. Dr. G. Kraft and his
group for bringing up this project.
References[1] Th. Haberer et. al., NIM A330 (1993) 296 - 305[2] E. Badura, H. Essel et. al., Real-Time Beam Intensity
and Position Control System, GSI, Workshop, August
1995.