Interlock automation testing method for proton therapy systems and related apparatus

Abstract

The application discloses an interlocking automation test method of a proton therapy system and related equipment, and relates to the technical field of interlocking test, which comprises the following steps: obtaining a current state of an interlocking to be tested; sending a test instruction sequence to the interlocking according to the current state; obtaining a response state of the interlocking after executing each instruction in the test instruction sequence; comparing the response state with a corresponding expected state in a predefined interlocking state confirmation matrix; and controlling the interlocking to return to an initial state before the start of this test after completing the test of the test instruction sequence; and realizing a fundamental change from a traditional mode of manual dependence, low efficiency and easy leakage to an advanced verification mode of full automation, high coverage, intelligence, self-diagnosis and safety recovery.

Description

Technical Field

[0001] This invention relates to the field of interlocking testing technology, and in particular to automated interlocking testing methods and related equipment for proton therapy systems. Background Technology

[0002] Proton therapy, as a core component of precision radiotherapy, is achieved through the coordinated operation of multiple subsystems, including a patient positioning image registration system, a treatment bed and treatment head motion control system, a proton beam generation and acceleration system, a beam delivery system, a dose detection and safety control system, and a main control system. The interlocking system serves as a safety barrier for the proton therapy system. Its core function is to monitor the critical physical parameters of each subsystem. When a parameter exceeds the allowable tolerance range, the system immediately halts its current operation. Simultaneously, if basic safety conditions are not met (such as an unlocked treatment room door or excessive radiation), the system prohibits equipment startup or triggers an emergency stop, thereby ensuring patient safety, personnel protection, and equipment integrity.

[0003] From a system architecture perspective, interlocking in proton therapy systems is divided into local interlocking and global interlocking. Due to the numerous subsystems and complex parameter relationships within a proton therapy system, hundreds of interlocking nodes are typically required, covering all stages of the treatment process. Currently, the implementation of interlocking in proton therapy systems mainly relies on hardwired logic or secure programmable logic controllers (PLCs). This involves collecting key status signals from lower-level devices and defining dependencies between subsystems and between subsystems and the global state. To eliminate the risk of single-point failures, interlocking states need to be cross-verified using multiple signal sources. However, existing technologies still have limitations in the interlocking testing phase: the mainstream interlocking testing methods in the industry are still primarily manual, resulting in low efficiency, incomplete coverage, and insufficient reliability. Manual testing requires building a realistic simulation environment for each interlocking node, making the testing process for hundreds of interlocks time-consuming and labor-intensive. Furthermore, manual operation is prone to missing some interlocking state combinations, especially with insufficient coverage of low-frequency fault scenarios. Test results rely on operator experience, leading to poor objectivity and traceability. Additionally, the lack of an efficient fault diagnosis and repair guidance mechanism results in a long post-test troubleshooting cycle. Summary of the Invention

[0004] Based on the above problems, the purpose of this invention is to provide an automated testing method and related equipment for interlocking proton therapy systems, thereby fundamentally transforming the interlocking testing of proton therapy systems from the traditional mode that relies on manual labor, is inefficient and prone to errors, to an advanced verification mode that is fully automated, has high coverage, is intelligent, and has self-diagnosis and safety recovery capabilities.

[0005] In a first aspect, the present invention provides an automated testing method for interlocks in a proton therapy system, wherein for multiple interlocks in the proton system, the following steps are performed respectively, including: Obtain the current state of the interlock to be tested; Based on the current state, a test command sequence is sent to the interlock; After executing each instruction in the test instruction sequence, obtain the response status of the interlock; The response state is compared with the corresponding expected state in the predefined interlocking state confirmation matrix; and After completing the test of the test instruction sequence, control the interlock to return to the initial state before the start of this test.

[0006] Preferably, the state is defined by a combination of multiple dimensional states; the step of sending a test instruction sequence to the interlock based on the current state includes: Based on the current state, a first instruction subsequence corresponding to the state is sent; each instruction in the first instruction subsequence is configured to perform an inversion operation on the current state of at least one dimension of the interlock; After completing the first instruction subsequence, the second instruction subsequence is sent.

[0007] Preferably, each instruction in the first instruction subsequence and the second instruction subsequence is sent and executed sequentially.

[0008] Preferably, the test instruction sequence is determined from a predefined instruction mapping table based on the current state of the interlock; the instruction mapping table is designed to cover all possible states of the interlock in all dimensions.

[0009] Preferably, the current state and response state of the interlock are defined by a combination of Boolean states in three dimensions: satisfied, latched, and ignored; wherein, The dimension of the interlock indicates whether the physical parameters of the interlock are within the allowable tolerance range; The latch dimension indicates whether the interlock remains locked after the trigger condition is not met; The "ignore dimension" option indicates whether the state of the interlock should be ignored for system testing in non-clinical validation mode.

[0010] Preferably, the interlocking state confirmation matrix is ​​generated based on the interlocking design logic of the proton system, and predefines the correct state that each interlocking should have after receiving a specific instruction under all possible states; The specific instructions include: setting to satisfy, setting to not satisfy, setting to latch, setting not to latch, setting to ignore, and setting not to ignore.

[0011] Preferably, the interlocking status confirmation matrix is ​​associated with a fault diagnosis knowledge base. When the comparison result fails, the following diagnostic process is triggered, including: Extract key features from failed test records, including: the specific instructions that triggered the failure, the three-dimensional deviation pattern between the expected and actual states of the interlock, and the timestamp sequence of instruction execution. The extracted features are matched with a predefined set of fault rules in the knowledge base, which includes at least signal transmission anomalies, logic control unit conflicts, and state transient anomalies. Based on the matched fault type, a vector similarity algorithm is used to search the historical fault case database and output the top N repair solutions with the highest matching degree as recommendations. The system automatically generates diagnostic reports, which include at least the following: fault codes, suspected faulty components, confidence levels, and recommended repair steps.

[0012] Preferably, the diagnostic process further includes: Based on the matched fault type, the proton system context information at the time of the fault is automatically obtained. The proton system context information includes at least the proton system operating mode, the current treatment plan identifier, and the real-time equipment load parameters. Based on the fault type and proton system context information, the risk level is determined, and a risk mitigation strategy is generated and output. The strategy includes immediate handling instructions for the current proton system context.

[0013] In a second aspect, the present invention provides an interlocking automated testing system for a proton therapy system, comprising: The host computer runs the interlocking automation test tool, which is used to import the interlocking status confirmation matrix, control the test process, and output the test results. The lower-level machine contains multiple subsystem interlocking management processes and communicates with the upper-level machine through a data distribution service to provide the current status of the interlocking and receive test commands. The automated testing tool is configured to perform the steps of the interlocked automated testing method for the proton therapy system according to embodiments of the present invention.

[0014] Thirdly, the present invention provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of any of the methods of the present invention or the functions of the system of the present invention.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions, wherein when a computer reads the computer instructions, the computer executes the steps of any of the methods described in the present invention.

[0016] Compared with existing technologies, the beneficial effects of this invention include at least the following: By dynamically generating test sequences and employing a strategy of first sending reverse instruction subsequences and then sending recovery subsequences, the entire state of each interlock can be automatically and comprehensively traversed in a single process. The comprehensive testing of over a hundred interlocks, which originally required manually creating complex physical environments and taking weeks to complete, is compressed into a few hours by the tool, improving efficiency by more than an order of magnitude and significantly shortening the equipment development, verification, and maintenance cycle. Based on a rigorous comparison between the three-dimensional state model and the interlock state confirmation matrix, the logical completeness of the test is ensured, enabling mandatory coverage of rare state combinations that are easily overlooked in manual testing. Combined with a fault diagnosis knowledge base and context-aware risk mitigation strategies, the testing system can not only discover surface faults but also deeply diagnose the root causes of faults and provide intelligent handling solutions for different clinical scenarios, achieving an upgrade from functional testing to intelligent diagnosis and decision support. The entire process is system-driven, eliminating subjective judgment errors, inconsistent operation sequences, and fatigue factors in human operation, ensuring the objectivity and repeatability of test results. The system automatically records complete execution logs, status response sequences, and diagnostic reports, providing a complete electronic traceability chain for the testing process of each interlock, greatly facilitating problem localization, audit review, and quality system compliance certification. The post-test status recovery mechanism ensures that the interlock automatically returns to its initial state after automated testing, effectively avoiding the risk of system chaos and inability to be used clinically due to residual test states, and guaranteeing the immediate availability of the equipment. Intelligent test execution and decision-making capabilities reduce the reliance on operators' in-depth knowledge of proton therapy systems, allowing ordinary technicians to complete comprehensive and in-depth testing, reducing labor costs and training barriers, while automation avoids potential safety risks caused by human error. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the interlocking automated testing method for the proton therapy system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the test instruction execution sequence according to an embodiment of the present invention. Detailed Implementation

[0018] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided to make the invention more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore repeated descriptions of them will be omitted.

[0019] The terms used to express position and direction in this invention are illustrated with reference to the accompanying drawings, but changes can be made as needed, and all such changes are included within the scope of protection of this invention.

[0020] In the use of proton therapy systems, interlocking is used to ensure the effectiveness and safety of the treatment process. Each subsystem needs its own internal local interlocking, while there are global interlocking systems that work together as a whole across subsystems. The local interlocking of each subsystem can be regarded as the "self-protection mechanism" of each subsystem. Examples of interlocking are shown in Table 1.

[0021]

[0022] Global interlocking is more like a whole process, requiring the simultaneous fulfillment of interlocks in multiple subsystems before any operation is permitted. Given the numerous subsystems in a proton therapy system, and the need for interlocking monitoring and protection between them, proton therapy systems typically have hundreds of interlocks to confirm and protect the normal operation of each stage of the treatment process.

[0023] Interlocking is primarily a set of hardwired or safety programmable logic controllers (PLCs) implemented as protection logic, or it may be motion-limiting logic based on the status feedback of related subsystems. It mainly defines the dependencies between subsystems of the proton therapy system or between a subsystem and the global state. These interlocking signals mainly come from the lower-level machine and represent the current critical state of the equipment. To eliminate "single points of failure," prevent any possibility of misjudgment, and prevent situations where certain interlock states fail or temporarily fail and then recover, the interlocking of the proton therapy system needs to be determined from multiple dimensions to jointly ascertain the current state of an interlock.

[0024] The final state of hundreds of interlocks in a proton therapy system (hereinafter referred to as a proton system) is not determined by a simple "yes / no" switch, but by the result of a joint judgment based on multiple pieces of evidence. The ultimate goal of this design is to ensure that in the event of any single component or even multiple failures, the proton system can make the most conservative and safest decision to stop operating and protect the patient.

[0025] Example 1, refer to Appendix Figure 1 After a proton therapy system is operational, the current states of numerous interlocks are all different. To efficiently test all current interlock states and then restore the interlocks to their pre-test states, this embodiment provides an automated testing method for proton therapy system interlocks. The method uses an automated interlock testing tool to perform tests. For multiple interlocks in the proton system, the following steps are executed: Obtain the current state of the interlock to be tested; Based on the current state, a test command sequence is sent to the interlock; After executing each instruction in the test instruction sequence, obtain the response status of the interlock; The response state is compared with the corresponding expected state in the predefined interlocking state confirmation matrix to verify the correctness of the interlocking logic; and After completing the test of the test instruction sequence, control the interlock to return to the initial state before the start of this test.

[0026] In practical applications, an automated interlocking test tool running on a host computer is used. First, the test tool is started and a predefined interlocking status confirmation matrix is ​​imported. This matrix is ​​generated based on the interlocking design logic of the proton therapy system and includes the expected results after receiving commands in each interlocking state. Then, communication with the interlocking management process of the lower-level proton therapy system via the Data Distribution Service (DDS) is used to obtain the current initial state of all interlocks under test (the lower-level interlocking management process covers hard-wired connections, protection logic implemented by a safety programmable logic controller, and subsystem status feedback logic). Next, tests are performed on each interlock: a test command sequence is dynamically sent based on its current state. After each command is executed, the real-time state of the interlock is immediately requested via DDS and compared with the corresponding expected state in the interlocking status confirmation matrix. If they match, "pass" is output; otherwise, "fail" is output. After all commands have been executed, the interlock is restored to its initial state before the test. Finally, after all interlocking tests are completed, a test result file is generated, summarizing the execution records of all interlocks. If all records pass, the test is considered successful; otherwise, the test is considered a failure.

[0027] The effects of the above technical solution are as follows: For the complex scenario of hundreds of interlocks in a proton therapy system, automated tools replace manual testing, eliminating the need to manually build simulation environments for each interlock and enabling batch testing of interlocks, significantly reducing testing time. Due to the numerous and complex interlocks in the proton system, failure to restore the system to its state before testing could lead to a chaotic and unusable state, requiring further investigation. Restoring the system to its state before testing effectively avoids this unknown risk. This eliminates the additional cost of manually checking for anomalies; objective comparison based on a predefined interlock status confirmation matrix avoids subjectivity and oversight in human judgment, ensuring consistency and accuracy of test results; and direct communication with the lower-level interlock management process via DDS covers the status testing of hardwired connections, safety PLCs, and other underlying protection logic, overcoming the limitations of traditional application-layer testing that cannot reach underlying physical signals.

[0028] See attached document Figure 2 In one possible implementation, the state is defined by a combination of multiple dimensional states; the step of sending a test instruction sequence to the interlock based on the current state includes: Based on the current state, a first instruction subsequence corresponding to the state is sent; each instruction in the first instruction subsequence is configured to perform an inversion operation on the current state of at least one dimension of the interlock; After completing the first instruction subsequence, the second instruction subsequence is sent.

[0029] Each instruction in the first instruction subsequence and the second instruction subsequence is sent and executed sequentially.

[0030] The test instruction sequence is designed to cover all possible states of the interlock.

[0031] In one possible implementation, the test instruction sequence is determined from a predefined instruction map, which defines a test instruction sequence covering all possible state combinations for each interlock in the system.

[0032] In one possible implementation, the current state and response state of the interlock are defined by a combination of three Boolean states: satisfied, latched, and ignored; wherein, The dimension of the interlock indicates whether the physical parameters of the interlock are within the allowable tolerance range; The latch dimension indicates whether the interlock remains locked after the trigger condition is not met; The "ignore dimension" option indicates whether the state of the interlock should be ignored for system testing in non-clinical validation mode.

[0033] The interlocking state confirmation matrix is ​​generated based on the interlocking design logic of the proton system, and predefines the correct state that each interlocking should have after receiving a specific instruction under all possible states. The specific instructions include: setting to satisfy, setting to not satisfy, setting to latch, setting not to latch, setting to ignore, and setting not to ignore.

[0034] Specific instructions are stored in the instruction mapping table.

[0035] In one possible implementation, the separate execution is achieved by sequentially traversing each interlock in the list.

[0036] In practical applications, the state of an interlock is generally confirmed by multiple dimensions. For example, the current state of an interlock can be confirmed by three dimensions: ① Satisfy (hereinafter referred to as S), ② Locked (hereinafter referred to as L), and ③ Ignored (hereinafter referred to as I). An interlock will automatically initiate locking (Un-L) after triggering Un-S, and all permissions related to the interlock will become unsatisfied. The purpose of this is that if the interlock encounters a brief failure, even if the conditions are met, it will not be ignored, and a specific user needs to clear the locked state. Different combinations of the three dimensions of the interlock will produce the following eight interlock states, which will be numbered as 0, 1, 2, 3, 4, 5, 6, and 7 in the following text, referring to Table 2.

[0037]

[0038] The dimension for ignoring interlocks depends on the system's mode and version. Generally, clinical versions cannot ignore all interlocks. Due to the numerous subsystems in a proton system, validation during the design and development phase typically involves joint testing at multiple test stations. Since some test stations lack hardware and software unrelated to a particular subsystem, but still require signal transmission and transmission, certain interlocks need to be ignored at some test stations to achieve interlock compliance. If some interlocks are not satisfied, related functions cannot be verified at those test stations. Therefore, validation activities during the design and development phase can use interlock ignoring to verify unrelated functional requirements. However, customer clinical software versions, with complete hardware and software signals, do not require ignoring missing signals to achieve compliance; therefore, customer clinical software versions cannot ignore interlocks.

[0039] The design logic of the proton system interlocking is used to pre-confirm the correct state of the interlocking after receiving different instructions in different states, and correspond to the 8 interlocking states in Table 2. Based on this logic, an interlocking state confirmation matrix is ​​created to confirm the 48 correct results formed by sending 6 instructions in the 8 interlocking states.

[0040] The current states of many interlocks are different. In order to test all the current interlock states most efficiently and then restore the interlock to the state before the test, we first send the instruction opposite to the current state, and then send the remaining instructions. This method can ensure that all 8 states of the interlock are tested, and can also ensure that the interlock is restored to the initial state after the test, without affecting the continued use of the proton system.

[0041] The six specific instructions to be sent are shown in Table 3, which is an instruction mapping table. The following descriptions will use the instructions a, b, c, d, e, and f.

[0042]

[0043] For example: If interlock A is currently in state 0 and does not satisfy (Un-S), is not latched (Un-L), and is not ignored (Un-I), then the instructions b(S), f(L), d(I), a(Un-S), e(Un-L), and c(Un-I) can be sent in sequence.

[0044] The system requests the lower-level machine to obtain the current status of the first interlock through DDS (Data Distribution Service), and dynamically sends instructions based on the current interlock status. After executing the test instructions for the first interlock, it continues to execute the second interlock until all identified system interlocks are executed. After traversing all interlock tests, a test result file is generated, summarizing the execution records of all interlocks. If all interlocks pass, the test is considered successful; otherwise, the test is considered unsuccessful.

[0045] The effects of the above technical solution are as follows: By dynamically generating and executing test instruction sequences through automated tools, the inefficient traditional model of relying on manual creation of test environments and item-by-item recording and verification has been completely transformed.

[0046] The test strategy of sending the opposite instruction first, followed by the remaining instructions, combined with the automatic traversal of all system interlocks, can systematically cover all 8 states and 48 state-instruction combinations of each interlock in a single test process. This reduces the manual testing work that originally required several days or even weeks to be completed in a few hours, improving efficiency by more than an order of magnitude.

[0047] Automated testing based on a three-dimensional (satisfied, latched, ignored) state model and interlock state confirmation matrix ensures comprehensive and thorough testing. The system can forcibly traverse all possible state transition paths for each interlock, including rare state combinations that are difficult to simulate or easily overlooked in manual testing (such as state 7, which is satisfied but latched and ignored), thereby uncovering deeper potential logical flaws.

[0048] The entire testing process is program-driven, completely eliminating errors that may be introduced by human operation, inconsistencies in subjective judgment, and fatigue factors, ensuring the objectivity and fairness of the test results. The test execution process and judgment criteria (interlock status confirmation matrix) are highly consistent, guaranteeing the standardization and repeatability of the test.

[0049] The system automatically generates a complete test report containing details of every interlock and every instruction execution. All operations are logged, providing traceability and facilitating problem localization, auditing, and quality system compliance review.

[0050] The post-test state recovery mechanism ensures that the interlocks automatically return to their initial state before the test after the test is completed. This effectively avoids the risk of system interlock chaos and inability to be put into normal clinical use due to residual test states, and ensures the immediate availability of the equipment after the test.

[0051] Through unprecedented comprehensive and rigorous verification of the interlocking logic, it is ensured that in real clinical treatment, any deviation of any key physical parameter can be accurately and reliably captured by the interlocking system and the preset safety actions (such as triggering latching and stopping irradiation) can be executed, providing a more solid foundation for patient safety and equipment safety.

[0052] In one possible implementation, the logic for ignoring the dimension is jointly determined by a configurable weight parameter and a predefined interlocking safety criticality level. Among them, for interlocks with the highest safety criticality level, ignoring the operation is prohibited by the system.

[0053] Each interlock is predefined with its safety criticality level (e.g., high, medium, low). This level is based on the potential impact on patient dose safety and equipment hardware damage in the event of its failure. For example, a beam dose deviation interlock is at the highest level, while a cabinet temperature overheating interlock might be at a medium or low level.

[0054] The ignore weight parameter represents the acceptable risk tolerance or flexibility for the current testing activity. When attempting to set an interlock to ignore, the system does not execute immediately but initiates arbitration logic. The ignore operation is only allowed to take effect if the currently configured ignore weight parameter is greater than or equal to the value corresponding to the safety criticality level of the interlock.

[0055] As an inviolable red line, all interlocks with the highest safety criticality level are marked as such, and their safety criticality level is considered infinite. Therefore, regardless of the value set for the ignore weight parameter, the arbitration condition cannot be met, thus ensuring that ignoring these core safety interlocks is completely prohibited by the system.

[0056] By solidifying the prohibition of the highest level of security interlocks through hardware or underlying software, the possibility of bypassing core security protection functions due to human error, software bugs, or malicious behavior is fundamentally eliminated, establishing a crucial and tamper-proof electronic insurance for patient and equipment safety.

[0057] In another possible implementation, the test instruction sequence is dynamically generated through an optimization algorithm. The optimization objectives of the algorithm include minimizing the number of test instructions, minimizing the total test time, and minimizing the system's security risk indicators during the test process.

[0058] The optimization algorithm achieves multiple optimization objectives by optimizing the cost function, which is a weighted sum of the number of test instructions, the total test time, and security risk indicators.

[0059] The optimization algorithm dynamically adjusts the weights of each optimization objective in its cost function according to the operating mode of the proton system.

[0060] The operating modes of the proton system include at least a clinical treatment simulation mode and an equipment debugging mode.

[0061] When the proton system is in the clinical treatment simulation mode, the optimization algorithm assigns a first weight W1 to the safety risk index in the cost function; when the proton system is in the equipment debugging mode, it assigns a second weight W2 to the safety risk index; wherein, W1>W2.

[0062] The safety risk index is calculated based on a predefined risk coefficient for different interlocking states, and the risk coefficient is assigned a value according to the degree of impact of the corresponding physical parameter deviation on treatment safety.

[0063] For example, the security risk index R is calculated as follows: R=Σ(B_i×S_i×M_i) in: B_i (base risk value): a predefined static risk value for the i-th interlock in the "unsatisfied" state. This value is quantified based on the potential impact of the corresponding physical parameter deviation on treatment safety. S_i (Severity Coefficient): A dynamic coefficient determined based on the percentage of numerical deviation of the i-th interlock "non-satisfied" state that exceeds the tolerance; M_i (Mode Multiplication Factor): A coefficient related to the operating mode of the proton system. In the clinical treatment simulation mode, the value of M_i for interlocking key subsystems is much higher than that in the equipment commissioning mode.

[0064] For example: The severity coefficient S_i is calculated using a piecewise function: When the deviation rate is ≤5%, S_i=1; When 5% < deviation rate ≤ 20%, S_i = 2; When the deviation rate is greater than 20%, S_i = 4.

[0065] The risk coefficient incorporates a real-time contextual factor, which is related to the real-time physical operating parameters of the treatment system.

[0066] The real-time physical operating parameters include at least one of the beam energy and the real-time load of the treatment bed.

[0067] By using a cost function in the form of a weighted sum, the algorithm can simultaneously optimize three major objectives: the number of test instructions, the time consumption, and the security risk. This avoids the problem of sacrificing security for efficiency or excessive security redundancy caused by optimizing a single objective, and achieves both efficient utilization of test resources and protection of the security baseline.

[0068] The weight adjustment mechanism based on the operation mode enables the algorithm to accurately match the needs of different application scenarios. In the clinical treatment simulation mode, it prioritizes safety and reduces treatment-related risks; in the equipment debugging mode, it improves testing efficiency, shortens equipment maintenance cycles, and enhances the flexibility and practicality of system operation.

[0069] Safety risk indicators combine static basic risks, dynamic deviation severity, pattern factors, and real-time scenario parameters to achieve multi-dimensional and accurate quantification of risks. This quantification method not only intuitively reflects the risk level during the testing process but also dynamically updates the risk assessment results through real-time scenario factors, providing a reliable basis for risk warning and intervention during the testing process.

[0070] Real-time context factors enable the algorithm to respond to changes in dynamic parameters such as beam energy and treatment bed load. For example, in high beam energy scenarios, it can automatically increase the risk weight of associated linkages, thereby enabling real-time adjustment of the testing strategy.

[0071] In the device debugging mode, when the security risk index is lower than a preset security threshold, the optimization algorithm temporarily adjusts the cost function, takes the high-value state combination that has not been tested as a new optimization objective, and assigns it a temporary high weight, so as to prioritize exploring the interlocking state combination that has not been tested.

[0072] The high-value state combination refers to an interlocking state combination that occurs less frequently than a frequency threshold in historical test data and is associated with known persistent or intermittent faults.

[0073] By proactively exploring historically rare but highly correlated state combinations, intermittent faults that are difficult to trigger in routine testing (such as sensor drift that occurs only once a week) can be captured, thereby improving the fault detection rate.

[0074] The temporary high-weighting mechanism ensures that testing resources are concentrated on the most valuable unexplored areas, provided that security risks are under control. For example, in debug mode, 10% of the additional testing time is used to cover 95% of the high-value state combinations, avoiding wasting resources on low-value states.

[0075] The dynamic target expansion mechanism enables the algorithm to make decisions in three dimensions: safety, efficiency, and exploration. It automatically balances routine testing and deep exploration within the safety threshold, ensuring the comprehensiveness of equipment debugging while avoiding efficiency loss caused by over-testing.

[0076] For rare combinations of states strongly associated with persistent faults (such as multi-interlock coordinated failure scenarios), the generation of test instructions driven by high weights can reproduce the fault phenomena and pinpoint the root cause. For example, by simulating a combined scenario of beam energy fluctuation and treatment bed overload, hidden design flaws causing beam deviation can be located.

[0077] The high-value state combinations generated during the exploration process and their test results are automatically fed back into the historical database, dynamically updating the frequency threshold and fault association model, forming a closed loop of test-discovery-update-optimization, enabling the system to increasingly intelligently identify the state space that truly needs to be explored over time.

[0078] In one possible implementation, the interlocking status confirmation matrix is ​​associated with a fault diagnosis knowledge base. When the comparison result fails, the following diagnostic process is triggered, including: Extract key features from failed test records, including: the specific instructions that triggered the failure, the three-dimensional deviation pattern between the expected and actual states of the interlock, and the timestamp sequence of instruction execution. The extracted features are matched with a predefined set of fault rules in the knowledge base, which includes at least signal transmission anomalies, logic control unit conflicts, and state transient anomalies. Based on the matched fault type, a vector similarity algorithm is used to search the historical fault case database and output the top N repair solutions with the highest matching degree as recommendations. The system automatically generates diagnostic reports, which include at least the following: fault codes, suspected faulty components, confidence levels, and recommended repair steps.

[0079] In one possible implementation, the diagnostic process further includes: Based on the matched fault type, the proton system context information at the time of the fault is automatically obtained. The proton system context information includes at least the proton system operating mode, the current treatment plan identifier, and real-time equipment load parameters used to characterize the operating pressure of key system components. Based on the fault type and proton system context information, the risk level is determined; a risk mitigation strategy is generated and output, which includes immediate handling instructions for the current proton system context.

[0080] The risk mitigation strategy includes: The risk level of this failure is determined based on the predefined risk assessment matrix. Based on the risk level, response instructions with different levels of urgency are automatically generated.

[0081] The risk levels include patient safety level, equipment safety level, planned impact level, or maintenance reminder level; If the patient safety level is determined, the generated treatment instructions include automatically sending a pause / stop instruction to the treatment control system; If the device is determined to be at a safety level, the generated handling instructions will include automatically sending a safety stop command.

[0082] The output repair plan automatically links to the spare parts inventory database to indicate the required spare parts and provides estimated repair time based on historical case data.

[0083] Based on the fault type and proton system context information, the risk level is determined, including: Based on the fault type, determine its basic risk level; Based on the proton system context information, the basic risk level is modulated using at least one of the following methods: If the system operation mode is clinical treatment mode and there is a current treatment plan identifier, then the basic risk level will be raised to the patient safety level; If the real-time device load parameters exceed the preset high load threshold, and the fault type belongs to the beam transmission or energy control category, the risk level will be increased by one level. If the system operation mode is the equipment debugging mode, the risk level of non-equipment safety-related faults will be automatically reduced by one level.

[0084] The load sensitivity amplification logic is further configured as follows: A load-fault association table is established, which defines specific fault types that require an increased risk level within different load ranges. When the risk assessment matrix performs modulation, it calls the load-fault association table to determine whether the fault type is a sensitive fault under the current load.

[0085] The above technical solution achieves the following results: by extracting key features and automatically matching fault rule sets, it avoids the reliance on experience and subjectivity of manual diagnosis, and quickly identifies the fault type; combined with historical case retrieval using vector similarity algorithms, it further provides practice-proven repair solutions for complex faults, significantly shortening the diagnosis cycle and improving the accuracy of fault location and repair.

[0086] The dynamic generation mechanism of risk mitigation strategies can automatically trigger corresponding handling instructions based on the fault risk level, such as immediate pause / stop instructions for patient safety level faults and safe shutdown instructions for equipment safety level faults, minimizing the threat of faults to patient safety and equipment safety, and achieving proactive risk prevention and immediate response.

[0087] By establishing a two-tiered assessment model combining basic risk and context modulation, the system can perceive changes in key states such as clinical treatment and equipment load in real time and dynamically adjust risk assessment results. When in clinical treatment mode, it automatically adopts the most stringent safety standards, effectively eliminating patient safety risks caused by misjudgments of faults. A load sensitivity amplification mechanism based on a load-fault correlation table can accurately identify potential risks in critical systems such as beam transmission and energy control under high load conditions, enabling early warning and preventative handling of faults. A mode-adaptive adjustment mechanism reasonably reduces the risk level of non-critical faults in equipment debugging mode, avoiding the impact of overly conservative handling strategies on test progress and achieving optimal test efficiency while ensuring equipment safety.

[0088] The repair plan links the spare parts inventory database and estimated repair time, enabling maintenance personnel to know the availability of spare parts and the time cost of repair in advance, which facilitates the rational allocation of spare parts resources and the arrangement of repair schedules; the standardized diagnostic report standardizes the fault information transmission process, reduces information communication losses, and improves the collaborative efficiency of maintenance work.

[0089] The fault diagnosis process forms a complete closed loop from feature extraction, rule matching, case retrieval to report generation and risk handling. It can not only efficiently solve the current fault, but also supplement the knowledge base and case library with the fault information and repair plan, continuously enrich the diagnostic data, and promote the iterative optimization of the system's diagnostic capabilities.

[0090] Example 2: This example provides an interlocking automated testing system for a proton therapy system, comprising: The host computer runs the interlocking automation test tool, which is used to import the interlocking status confirmation matrix, control the test process, and output the test results. The lower-level machine contains multiple subsystem interlocking management processes and communicates with the upper-level machine through a data distribution service to provide the current status of the interlocking and receive test commands. The automated testing tool is configured to perform the steps of any of the methods described in Embodiment 1.

[0091] The working principle and effect of the above technical solution are the same as the interlocking automated testing method of a proton therapy system in Example 1, and will not be repeated here.

[0092] In one possible implementation, the data distribution service employs a dual-link redundant transmission mechanism, wherein the primary link is used to transmit test instructions and real-time status data, and the backup link synchronously transmits data packets used for verification.

[0093] The dual-link redundant transmission mechanism performs the following steps: Monitor the transmission latency of the main link; When the transmission delay exceeds the delay threshold, a switchover operation from the primary link to the backup link is automatically triggered.

[0094] The delay threshold is dynamically set based on the safety level and real-time operating conditions of the proton therapy subsystem currently in communication; the real-time operating conditions include the subsystem's operating load (e.g., the proportion of radio frequency power output of the beam generation system) and the interlock trigger frequency (the number of non-ignorable interlock triggers in the past 5 minutes).

[0095] For example, when the operating load is greater than 80% or the interlock trigger frequency is greater than 3 times / minute, the threshold is automatically tightened by 20%.

[0096] In one possible implementation, a first delay threshold is set for the beam generation and acceleration system and the beam delivery system, and a second delay threshold is set for the treatment room environment monitoring system; wherein the first delay threshold is less than the second delay threshold; For example, the first delay threshold is 10 milliseconds, and the second delay threshold is 100 milliseconds.

[0097] When the beam generation and acceleration system is in the energy switching phase, the first delay threshold is temporarily tightened to 5 milliseconds, and automatically restored to 10 milliseconds after the switching is completed.

[0098] The automatic triggering switching operation is subject to a safety arbitration mechanism. The safety arbitration mechanism is implemented by the safety programmable logic controller (PLC) and interlock management unit of the proton therapy system. It comprehensively judges the beam status (whether it is in a stable output range), the equipment motion enable signal (whether the treatment bed / treatment head is in a locked state) and the interlock latch status (whether there is an uncleared Un-S latch fault). When the beam is unstable or there is an uncleared latch fault, the switching request is directly rejected and an audible and visual alarm is triggered.

[0099] By dynamically setting delay thresholds based on subsystem safety levels and real-time operating conditions, the communication system is no longer a rigid configuration but has context-aware capabilities. It can identify the extreme communication requirements of critical subsystems (such as beam systems) under high load or high frequency fault warnings, and proactively tighten the delay threshold (e.g., temporarily tightening it from 10ms to 5ms). This achieves precise resource allocation for critical tasks and critical safeguards, fundamentally improving the determinism of test command transmission at the most critical moments.

[0100] Delegating the final decision-making power for link switching to the safe programmable logic controller and the interlocking management unit in collaboration is a manifestation of inherent safety design. This arbitration mechanism comprehensively judges multiple safety signals such as beam status, equipment motion enablement, and interlocking latch status. It can effectively identify and reject switching requests under unsafe conditions (such as unstable beam or unresolved latch faults), preventing the instantaneous disturbance that communication link switching may introduce at inappropriate times. It avoids the risk of causing another more serious problem in order to solve one problem, and adds a crucial hardware-level safety insurance to the system.

[0101] Traditional fixed-threshold redundancy switching is insufficiently adaptable to the complex environment of proton therapy, which involves multi-subsystem collaboration and dynamic load changes. This solution monitors two key operating conditions—operating load and interlocking trigger frequency—to enable the system to detect the trend of increasing communication pressure in advance and proactively adopt stricter communication protection strategies. This allows the communication system to maintain extremely high robustness when facing upcoming data floods or periods of system instability, ensuring the continuity of automated testing and data integrity.

[0102] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in Embodiment 1 of this invention or the functions of the system described in Embodiment 2 of this invention.

[0103] This invention also provides a computer-readable storage medium for storing a computer program. When the computer program is executed, it implements the steps of the method in Embodiment 1 of this invention. The specific implementation method is consistent with the implementation method and the technical effects achieved in the above method embodiments, and some contents will not be repeated.

[0104] In this invention, a readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The program product can take the form of any combination of one or more readable media. A readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0105] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, or any suitable combination thereof. Program code for performing operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on a user computing device, partially on an associated device, as a standalone software package, partially on a user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing devices can be connected to user computing devices via any type of network, including local area networks (LANs) or wide area networks (WANs), or they can be connected to external computing devices (e.g., via the Internet using an Internet service provider).

[0106] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the invention without departing from the principles and spirit of the invention, and all such changes should fall within the protection scope of the claims of the present invention.

Claims

1. An automated testing method for interlocking in a proton therapy system, characterized in that, For multiple interlocks in a proton therapy system, perform the following steps respectively, including: Obtain the current state of the interlock to be tested; Based on the current state, a test command sequence is sent to the interlock; After executing each instruction in the test instruction sequence, obtain the response status of the interlock; The response state is compared with the corresponding expected state in the predefined interlocking state confirmation matrix; and After completing the test of the test instruction sequence, control the interlock to return to the initial state before the start of this test; The state is defined by a combination of multiple dimensional states; the step of sending a test instruction sequence to the interlock based on the current state includes: Based on the current state, a first instruction subsequence corresponding to the state is sent; each instruction in the first instruction subsequence is configured to perform an inversion operation on the current state of at least one dimension of the interlock; After completing the first instruction subsequence, send the second instruction subsequence; Each instruction in the first instruction subsequence and the second instruction subsequence is sent and executed sequentially; The test instruction sequence is determined from a predefined instruction mapping table based on the current state of the interlock; the instruction mapping table is designed to cover all possible states of the interlock in all dimensions. The current state and response state of the interlock are defined by a combination of three Boolean states: satisfied, latched, and ignored; where: The dimension of the interlock indicates whether the physical parameters of the interlock are within the allowable tolerance range; The latch dimension indicates whether the interlock remains locked after the trigger condition is not met; The "ignore dimension" option indicates whether the state of the interlock should be ignored for system testing in non-clinical validation mode. The interlocking status confirmation matrix is ​​generated based on the interlocking design logic of the proton therapy system, and predefines the correct state that each interlocking should have after receiving a specific instruction in all possible states. The specific instructions include: setting to satisfy, setting to not satisfy, setting to latch, setting not to latch, setting to ignore, and setting not to ignore.

2. The interlocking automated testing method according to claim 1, characterized in that, The interlocking status confirmation matrix is ​​associated with the fault diagnosis knowledge base. When the comparison result fails, the following diagnostic process is triggered, including: Extract key features from failed test records, including: the specific instructions that triggered the failure, the three-dimensional deviation pattern between the expected and actual states of the interlock, and the timestamp sequence of instruction execution. The extracted features are matched with a predefined set of fault rules in the knowledge base, which includes at least signal transmission anomalies, logic control unit conflicts, and state transient anomalies. Based on the matched fault type, a vector similarity algorithm is used to search the historical fault case database and output the top N repair solutions with the highest matching degree as recommendations. The system automatically generates diagnostic reports, which include at least the following: fault codes, suspected faulty components, confidence levels, and recommended repair steps.

3. The interlocking automated testing method according to claim 2, characterized in that, The diagnostic process also includes: Based on the matched fault type, the proton therapy system context information at the time of the fault is automatically obtained. The proton therapy system context information includes at least the proton therapy system operation mode, the current treatment plan identifier, and real-time equipment load parameters. Based on the fault type and proton therapy system context information, the risk level is determined, and a risk mitigation strategy is generated and output; the strategy includes immediate handling instructions for the current proton therapy system context.

4. An interlocking automated testing system for a proton therapy system, characterized in that, include: The host computer runs the interlocking automation test tool, which is used to import the interlocking status confirmation matrix, control the test process, and output the test results. The lower-level machine contains multiple subsystem interlocking management processes and communicates with the upper-level machine through a data distribution service to provide the current status of the interlocking and receive test commands. The automated testing tool is configured to perform the steps of the method according to any one of claims 1-3.

5. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method according to any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The storage medium stores computer instructions, and when the computer reads the computer instructions, the computer implements the steps of the method according to any one of claims 1-3.

Images