Operational and design aspects of accelerators for medical applications

Originally, the typical particle accelerators as well as their associated beam transport equipment were designed for particle and nuclear physics research and applications in isotope production. In the past few decades, such accelerators and related equipment have also been applied for medical use. This can be in the original physics laboratory environment, but for the past 20 years also in hospital-based or purely clinical environments for particle therapy. The most important specific requirements of accelerators for radiation therapy with protons or ions will be discussed. The focus will be on accelerator design, operational, and formal aspects. We will discuss the special requirements to reach a high reliability for patient treatments as well as an accurate delivery of the dose at the correct position in the patient using modern techniques like pencil beam scanning. It will be shown that the technical requirements, safety aspects, and required reliability of the accelerated beam differ substantially from those in a nuclear physics laboratory. It will be shown that this difference has significant implications on the safety and interlock systems. The operation of such a medical facility should be possible by nonaccelerator specialists at different operating sites (treatment rooms). The organization and role of the control and interlock systems can be considered as being the most crucially important issue, and therefore a special, dedicated design is absolutely necessary in a facility providing particle therapy.


I. INTRODUCTION
After the start of particle therapy, mostly accelerators in (nuclear) physics laboratories were used. The first treatments were performed with accelerators built for physics research in Berkeley (USA) in 1954 [1] and in Uppsala (Sweden) in 1957 [2]. Typically, the types of accelerators used for therapy were cyclotrons and synchrocyclotrons. Originally, synchrocyclotrons were the typical choice for acceleration to energies of 150-200 MeV, needed for treatment of tumors at 10-20 cm depth.
Usually, part of the existing accelerator facility was adapted to run a medical program at a dedicated beam line to a treatment room, next to the (nuclear) physics research programs at the other beam lines. But some became completely dedicated to proton therapy, such as the cyclotron at the Harvard Cyclotron Laboratory [3].
In the 1990s, the first hospital-based proton therapy facility came into operation in Loma Linda, California [4], using a synchrotron as a proton accelerator for therapy for the first time. The beam from the synchrotron was used in either of four treatment rooms.
At the end of the previous century, particle therapy slowly got more interest of commercial companies to produce the equipment. Because of these commercial enterprises, the number of hospital-based or dedicated medical facilities has increased from 15 in 2000 to 49 in 2014 [5].
Already during the initial phase of proton therapy, it was clear that the requirements for the accelerators and the beam transport to the patient were different from those for the usual physics applications. Apart from the technological differences, also the way of operating such machines had to change. Routine patient treatment requires a simple, fast, safe, and accurate reproducibility of the beam delivery, without the typical habits in physics experiments to tune, make a first test, and improve the machine setting. Another big difference is that measurements related to position in the patient and dose delivery must be correct in the absolute sense. This is in contrast to many physics experiments, where one can rely on relative measurements.
Apart from the accelerator, also the beam delivery at the patient requires dedicated equipment and well-documented procedures. Usually, the beam has to be aimed from several directions at a tumor in a patient lying on a treatment couch. This is done by a beam rotation device, a gantry. These large and heavy devices, with a diameter of typically 6-12 m and a weight of 100-200 tons (protons), require special attention with respect to mechanical accuracy, accessibility, presence of medical imaging equipment, and beam optics. Here a lot of effort is ongoing to reduce the size and weight while keeping the pointing precision and other important clinical parameters at their required values. Such clinical requirements include the maximum field size (the area that can be irradiated without shifting the patient), the positioning accuracy of the beam with respect to the patient, and the time it takes to perform an irradiation treatment. In this respect, it is important to realize that long treatment times may lead to inaccuracies in the dose delivery due to a higher risk of patient motions.
A technical overview of equipment in a particle therapy facility can be found, e.g., in Ref. [6]. In a hospital-based facility, one usually has one accelerator and a beam transport system coupled to multiple (2-5) treatment rooms, each with either a gantry or one or two fixed beam lines. Although alternatives are being investigated, one can direct the beam to only one room at a time until now.
Apart from the technical and operational differences, it should also be realized that the legal aspects allowing operation of a medical facility for treatments have quite serious consequences. The equipment used, the procedures followed to treat a patient, the quality control (QA) procedures, and the maintenance are subject to specific rules imposed by the certification of the equipment or of the facility. The goal of such a certification (e.g., CE or FDA) is to increase the quality of the treatment and the safety for the patient. Depending on the national laws, this certification can be obligatory. For a hospital-based facility, this will be a procedure with a strong analogy to that of conventional radiation therapy equipment. But for a facility in a physics lab, this may be quite complicated due to the nonstandardized way the treatment facility is connected and matched to the existing accelerator. Changes in favor of the physics program of course should not compromise the treatments. Technically, that can be taken care of. However, regulations may not permit certain changes to the accelerator. Because of the increasing interest in proton therapy, the number of (planned and realized) facilities has increased dramatically in the past years: from less than 20 before the year 2000 to more than 50 in 2014 [7]. One can observe a shift from facilities set up by typical research groups to facilities having a more routine character. However, experience shows that accelerator laboratory-based facilities remain, playing an essential role in further technological developments, and are a critical but essential partner of industry.

II. SERVICE
Compared to a machine for physics experiments, sudden changes in the beam schedule are much more difficult to organize, since treatments are planned every working day. Rescheduling of patients would be a major inconvenience. But also there is much less time for regular service: typically, one evening a week, some nights, and some weekends. A shutdown of a week or longer is usually not acceptable in a hospital, even when planned well ahead. This is due to the fractionation of an irradiation treatment of cancer. As with conventional photon treatments, the total dose to be delivered by protons is split into typically 30 daily fractions of about 2 Gy to allow recovery of healthy tissue that is inevitably also being irradiated. (The dose given by ions, e.g., 12 C ions, has a different biological effect, which makes fractionation not so useful.) An interruption of one week or more during a treatment course cannot be accepted, since this could lead to a reduced cure probability. Therefore, if a shutdown is planned, no new treatments can start in the ∼6 weeks preceding this long shutdown. Furthermore, the logistics is usually not capable of starting all new treatments in the first week after such a shutdown. Therefore, an accelerator shutdown of one week effectively yields a capacity reduction of 8-10 weeks. Apart from disappointed patients, this will also result in a significant income reduction for such a facility.
When service must be confined to short periods, this has implications for the design of the equipment. Of course, a lot of attention is given to optimizing the lifetime and to reducing the wear of components such as the ion source, components in the rf system, and cooling systems. Easy access, precise and reliable diagnostics, a modular design, easy exchange of components, and a not too high radiation level due to activation are essential design requirements but not always easily achieved.
Here it is also good to distinguish the situation between a treatment facility in a physics laboratory and the situation in most hospitals. In physics laboratories, the number of qualified experts, tools, and spare parts and the presence of machine shops are usually not a problem. In a hospital or dedicated medical facility, the technical support is supplied via a maintenance contract with a company. Also, the equipment and procedures are usually under the rules of a certification as mentioned before. Although such a certification has the advantage of preventing uncontrolled, undocumented, or erroneous actions, it certainly leads to less flexible operation and service.

III. BEAM PROPERTIES FOR DOSE DELIVERY
To deliver a radiation dose in a tumor, use is made of the so-called Bragg peak: the dose increase at the end of the range of hadrons stopping in matter. To shift this Bragg peak to the desired depth, the range is adjusted by a corresponding change of beam energy. Energy changes occur in two categories: i. Range shifting sets the maximum depth needed at a certain incident beam direction. This may take several seconds, since it often coincides with gantry rotation. ii. Energy modulation moves the Bragg peak position over the tumor thickness typically by changing the beam energy with steps of approximately 2%, which correspond to a shift of approximately 5 mm in water. This process needs to be very fast to limit the treatment time. Since the treatment of a tumor requires 10-20 energy steps, ideally it should take < 0.2 s to perform a step.
For both energy-change categories, their accuracy is of utmost importance, since this determines the accuracy of the penetration depth of the protons in the patient.
In synchrotrons, the energy of the beam sent to the treatment room can be set by acceleration until any desired extraction energy. Although developments to change the extracted energy within a synchrotron spill are in progress [8], in most synchrotron facilities the energy change is typically done by choosing the new energy at the next spill. These changes thus imply the slow range shifting process. In (synchro)cyclotrons, the protons are extracted at a fixed, machine-dependent, energy. Currently, (synchro)cyclotrons are used for therapy with protons only. But for a few years developments of cyclotrons for carbon ions have been in progress [9]. After extraction, the protons are slowed down to the desired energy in an adjustable amount of material, a degrader. This can be done just after the extraction from the cyclotron, with a synchronous corresponding field change of all following beam line magnets, or just before the patient in the nozzle or treatment head, the last part of the beam delivery device. The latter method can be rather fast, so this is the method used for both range shifting and energy modulation.
The typical diameter of a beam from an accelerator is 1-2 cm. To cover typical tumor diameters of several centimeters up to 30-40 cm, a lateral beam spreading system is needed. The most commonly used method is passive scattering [10]. In this method, the beam is broadened by multiple scattering of the protons when crossing a (set of) foil(s). Just before the patient, the broad beam is collimated to match to the lateral shape of the tumor. The beam requirements are rather simple in this case: use a small beam diameter to hit the foils in the center and have submillimeter beam position stability. The passive scattering technique is usually combined with an energy modulation by means of a rotating wheel with an azimuthally varying thickness, located in the nozzle [10].
The best coverage of the tumor is obtained when a fast lateral adjustment of a narrow (< centimeter diameter) beam is combined with fast energy changes: the pencil beam scanning technique. Here fast scanning magnets are used to aim the beam laterally at volume elements (voxels) in the tumor volume. For each energy, a layer of voxels is irradiated. In each voxel, a specific dose is deposited. This can be done in a discrete voxel grid (spot scanning) by using a "step and shoot" method [11] or by moving the pencil beam in a continuous way along a certain trajectory within the target volume (continuous scanning) [12]. Apart from aiming at the prescribed voxels with submillimeter accuracy and within a millisecond, the main accelerator specifications are rather relaxed for spot scanning and concentrate on sufficient intensity, correct switching the beam on and off, and a fixed shape of the beam cross section. Continuous scanning techniques, however, require either very precise and quickly adjustable beam intensity or a very constant intensity and fast reacting, accurate scanning magnets. Currently, in most commercial systems spot scanning is replacing passive scattering. Continuous scanning is still in development.

IV. TECHNICAL CONDITIONS
The beam transport system needs to be reliable, reproducible, and stable. The specifications on the beam transport components, such as the magnets, are not so special. Only in the case of application of the scanning technique with a (synchro)cyclotron should one explicitly specify the speed by which magnets can change their field strength. Then an energy change by means of a variation of the degrader setting can be followed synchronously by the beam transport magnets within a fraction of a second. Then not too much time is lost due to energy changes in the scanning technique. Beam losses must be localized to specific areas, such as in collimators and in slit systems.
To be independent of their rotation, it is convenient to have a symmetric beam phase space and no dispersion at the entrance of the gantries. Especially when using beams from a synchrotron, which may have a very asymmetric phase space, this may require dedicated matching sections in the beam transport.
Important recurring events are "beam off" and "beam on." These requests may originate from the treatment area or from the accelerator or beam line, for example, due to a machine interlock. One has to make an automated decision on what action should follow such a request: to insert a beam stopper or to switch off the accelerator and the beam lines. In this respect, it makes sense to have different switch-off scenarios that depend on the reason for the beam-off request as well as on the expected time until restart. For example, there can be a short beam off following an interruption due to patient motion or because the treatment of a patient has finished. But for a service one typically needs a longer beam-off period. The shorter the beam off should last, the fewer devices should be switched off to allow fast recovery. In the case of a short beam off, the facility must be in a kind of "stand-by" mode, in which the beam can be switched on again by a simple action. For these short beam-off phases, one should also take into account that devices need different switch-on procedures. Depending on the magnet types, a fixed current ramping sequence must be performed during start-up and between patients. In the case of energy changes during a treatment, as is the case when using pencil beam scanning, hysteresis should be taken care of. The easiest strategy is to change energy into one direction, e.g., from high to low, so that one always uses the same relation between the magnetic field and magnet current. Magnet current ramping could conveniently be performed in between two treatments or in between different beam directions (gantry angles). After a service or a beam off that took a day, some hours may be needed to reach (temperature) stability in bending magnets or in the rf system of a cyclotron to stabilize the characteristics of the extracted beam.
The dose to the patient is measured with a dedicated dose monitor. This is typically a large parallel air-filled ionization chamber, including a position-sensitive segment, traversed by the beam and mounted in the nozzle, just before the patient. These monitors give a signal to switch the beam off when the planned dose has been delivered or in case of faults like a too high or too low beam intensity or a wrong position of the scanning beam. Therefore, and since each treatment fraction must be done with an absolute dose accuracy of a few percent, stability and reproducibility of the beam parameter emittance, position, and intensity are extremely important. Apart from frequent dedicated measurements between the treatments and performed in a standardized and well-documented QA program, also many on-line measurements must be made with dedicated equipment, such as beam intensity monitors, beam loss monitors, hall probes, or separate current measurements in bending magnets and logging of many parameters at the beam delivery side as well as at the dosimetry side. Such logging can be very helpful in predicting services and decisions on preventive maintenance. However, it is important that these dedicated devices are not used for machine operation control, such as, for example, in a feedback loop for beam intensity control. In that case, this must be done by dedicated monitors in the beam transport system. In general, a separation of "responsibility fields" is recommended: do not mix machine operation with patient safety.
Measurements with interceptive beam diagnostics can influence the beam characteristics due to beam-material interactions. This may have consequences on beam energy and emittance due to energy loss and multiple scattering in wires or foils. Therefore, strict procedures must be followed when inserting beam diagnostics. One could decide that no devices belonging to "machine operation" are allowed to be inserted during treatments or that a certain group of devices always has to be in the beam. Of course, the devices performing beam measurements related to the dose delivery and patient safety always have to be in the beam during treatments.
Although there are no special requirements on the vacuum system, one should realize that one needs thin vacuum windows at the end of each beam line. This location is rather close to the patient. Here one has to make a compromise between reducing multiple scattering of the beam by employing a thin foil and a sufficient safety margin to reduce the chance (and noise) of a foil break, which would cause a long interruption.

V. OPERATION AND CONTROL CONCEPTS
To obtain a safe and reliable system, redundancy is an often-implemented concept. Beam-off requests typically must invoke some parallel or sequential actions to intercept the beam. But also critical measurements of beam characteristics or machine status should be performed with redundant methods. For example, to verify the beam energy as obtained with a degrader behind a cyclotron, checks are made of the degrader thickness crossed by the beam, in combination with measurements of the currents in the following dipole magnets that analyze the beam. Redundancy can be implemented at a low level. One could compare the outcomes of two different measurements in a local comparator and send the resulting status signal to a safety control system. But also comparisons or more complex calculations performed in the control system could act as a redundant check of the machine status. However, usually these higher level checks are not accepted in patient-safety systems, since there can be an unknown time delay in the signal processing and software. Also, regulations may impose that signals of certain systems must be sent via "hard-wired" connections.
The control system of the machine plays an important role in the safety of the patient but also in a high availability of the system [13]. These two goals can be achieved when several requirements are fulfilled: a clear diagnostics of the situation, well-documented and tested changes only under supervision of dedicated staff, and a clear concept of "who is allowed to do what" during treatments. Especially this last issue is of importance, since usually the machine can be operated from different locations: from workstations at each treatment room, in a service room near the accelerator vault, and in a main control room. Therefore, a kind of mastership concept within the control system(s) can be helpful, to have a unique definition of who is running the machine [14]. This scheme allows one to switch the mastership between a control room for direct control of the accelerator itself and the medical operator in a specific treatment room. Unwanted parallel actions are prohibited in this way. The actual granting of the mastership must be done via a clear procedure. One can easily link each mastership to a dedicated list of allowed actions that may be taken by that master.
In addition to a mastership, well-defined operation modes of the facility are needed to limit the allowed actions in each situation. In service mode, almost all normal accelerator and beam line actions are allowed and treatments are forbidden. In treatment mode, a set of specifically allowed actions is available, such as setting the gantry angle, loading the treatment steering file for automatic performance of energy changes and scanning procedures, and "start" and "stop" the treatment. But tuning the beam optics to improve the beam quality is not allowed in this mode. That would require a service mode.
In most facilities, machine operators perform the start-up of the accelerator and beam lines early in the morning. Then the operators perform machine-specific tests and collect relevant data of the machine status. For the rest of the day, the operators monitor the operation and are available to assist in case of problems. After this daily machine setup, mastership is handed over to the treatment rooms, where a series of standard QA tests are performed under the responsibility of the medical physics personnel. After a positive result of these checks, patient treatment can start. The person responsible for the execution of the treatment is present in the control room of the selected treatment room (the "master"). Usually, these persons are not accelerator experts. Therefore, they need clear overviews of the relevant parameters and statuses and unique instructions from their local work stations. For standard situations, the control system should provide them with a simple interface to allow the operation without deep knowledge of the accelerator. In case of technical problems, they will need information from the machine operator. Since speed is extremely important to limit the waiting time during a treatment, these persons must be in a position to perform a "reset" action after "trivial" interlocks. Decisions on what type of interlocks can be considered as trivial strongly depend on the background of the personnel and their ability to assess the situation. Often, faults due to noise exceeding a threshold or due to motion of the patient are considered as trivial. In a hospital-based environment, this can be quite different in comparison to the situation in a laboratory. Last but not least, a comprehensive logging of the events is extremely important to recognize oftenrecurring problems. In some cases, this is also required by regulations and considered as mandatory documentation of the treatment.

VI. INTERLOCK AND SAFETY SYSTEMS
Compared to a typical accelerator for physics research, the most complex dedicated feature in a medical irradiation facility is the interlock systems for patient safety. There are many reasons for stopping a running irradiation: for example, a wrong value of a machine parameter, an outof-range reading in a monitor, a problem in the dose delivery, or an undesired motion of the patient. The roles of the interlock and safety system are the interpretation of the relevant signals and the initiation of the necessary beam-off actions (interlocks). The sensitivity to initiate such an interlock strongly depends on the system in which the failure occurs and on the possible consequences. For patient safety, the highest sensitivity is desirable. However, if the error margins are too small, or if the noise in the signal is too large, this yields unnecessary beam offs and longer treatment times, which increases the chance of failures.
Consider, for example, a dose monitor in a treatment room, which should generate an alarm when a signal is detected in a situation where no beam is supposed to be present in that treatment room. This is a necessary safety measure to interrupt beam in an area that is supposed to be safe and allowed to be entered. However, when its detection threshold has been set so low that it could react to acoustic noise in the room during preparation of the patient for the next treatment, it could cause an interruption of the treatment in the other room.
Thus, the design of the interlock system also includes the definition of reasonable alarm thresholds. In Tables 1 and 2, patient-safety-related interlock signals at PSI and their hierarchy are shown as an example.
There are different reasons for stopping the irradiation. A normal (or routine) beam-off request happens at the end of each treatment when the requested dose has been reached. In the PSI system, the beam is then kicked into a beam dump. But a detected error needs a more reliable and redundant shutoff. At PSI an ALOC signal ("local alarm"; see Table 1) causes the beam to be kicked into a beam dump, and in parallel a beam stopper is closed (Table 2). Again, one has to balance between safety and availability. On one hand, it must be ensured that the beam is switched off, but, on the other hand, one has to consider the time it will take to get the beam back in good conditions. Because of temperature and other effects, it may occur that the characteristics of the extracted beam have changed. To prevent this, an "ATOT" alarm at PSI (see Table 2) does not cause a switch off of the cyclotron rf, but it causes a reduction of the rf power to approximately 80%. Then the beam cannot be accelerated to extraction, but the temperature of the rf system remains more or less the same.
Another aspect to be considered is the impact of frequent on-off switching on the lifetime of certain components in the accelerator. For example, the internal ion sources in cyclotrons are known to be very sensitive to sudden power changes.
The prevention of unnecessary downtime due to such effects is the main reason to use these different interlock levels, all according to the type, severity, and possible consequences of the failure. Each interlock should act specifically on certain subsystems. Also, and in any case, the action caused by an interlock must be verified: if a switch-off action has failed, immediately a next level must be activated and a more rigorous action must lead to a guaranteed beam off.
In defining these hierarchies in interlock levels and redundancies, one has to consider that the reaction times will vary when different systems are utilized for safety purposes. For example, the time it takes to reduce the beam intensity to zero by kicking the beam into a beam dump is much (10-100×) faster and a simpler action than switching off an ion source.
The complete interlock and safety systems should be set up in a logical and modular way. This is important for proper understanding, but also to assign the responsibilities in a clear way. At PSI it has been organized into three independent systems: 1. Machine interlocks react when accelerator and beam line devices are technically not working well. For example, checks on cooling water and checks on the response of a power supply. 2. Patient-safety interlocks react when dose delivery signals are outside their tolerance region. For example, the beam position, the dose per spot, and the beam energy during beam scanning. 3. Area and access supervision reacts when the door of an area is opened when the beam is supposed to be present in that area. For example, it checks doors, emergency buttons, and radiation levels.
Each system decides on the necessary level of switching off and sends the so-derived beam-off signal directly to the involved components. This has been illustrated in Tables 1  and 2 for the patient-safety interlocks at PSI. The machineinterlock system in a facility for medical treatments is conceptually more or less similar to the one at any accelerator facility. The patient-safety system, however, is of course specifically dedicated to medical applications. The area and access supervision is partly similar to the one in physics laboratories but is adapted to patient access and configured such that it allows quick entry of medical staff. In addition, it usually also prevents unwanted exposure by x rays during medical imaging of the patient in the treatment room.
In practice, the most important aspect of an interlock or safety system is the explicit presentation of the switch-off cause(s) to the (medical) operator. The information given by the control system must allow the operators in the control room as well as in the treatment room to react immediately and efficiently when a failure occurs. If one only detects the interception of the beam and has no idea of its cause, it will affect not only the availability but also the working pressure, the alertness, and the motivation.

VII. CONCLUSIONS
An accelerator facility for particle therapy implements a variety of technical measures to ensure an accurate and reproducible dose delivery to patients. The technical specifications differ mostly in relation to reliability of the equipment and that certain measurements need to be performed such that absolute values are obtained with an accuracy of a few percent. In comparison to an accelerator for physics research, a medical irradiation facility necessarily implements a complex interlock system for patient safety, monitoring a large number of parameters. Furthermore, the safety measures related to the irradiation treatment impose a stringent discipline on the operation, documentation, and service of an accelerator facility.
Of course, if one has to perform work on the accelerator, beam line, or other treatment-related equipment, one has to comply to strict prescriptions at all levels and patient safety must always be guaranteed after such an activity. But, especially in a facility where technological developments of the accelerator system are part of the program, such regulations are limiting the possibilities of such developments. This is especially difficult when such activities are in conflict with a desired high availability of the machine for treatments.
This deals with a very complex balance between safety and availability. Compared to physics facilities, the safety aspect must play a much bigger role, of course. Availability, however, has an immediate impact on the number of patients to be treated, thereby potentially causing financial consequences. Many interruptions during a treatment will also increase the inaccuracy of the treatment and could thus have negative consequences on the success of the treatment. Especially in the past 15 years, particle therapy has grown out of the accelerator laboratory status of "interesting experimental application." More than 120 000 patients have been treated worldwide with particle therapy. Nowadays, most new clinical facilities are built as separate institutes or within a hospital. However, facilities in accelerator laboratories remain essential to guide and perform the technological developments to make the systems cheaper without a loss of quality.