Safety Analysis of a Medical Robot for Tele-echography

Among many types of medical equipment, ultrasound diagnostic systems are widely used because of their convenience and safety. Performing an ultrasound examination involves good eye-hand coordination and the ability to integrate the acquired information over time and space. Some of these specialized skills may lack in some healthcare centers or for emergency situations. Tele-consultation is therefore an interesting alternative to conventional care. Development of a high performance remote diagnostic system, which enables an expert operator at the hospital to examine a patient at home, in an emergency vehicle or in a remote clinic, may have a very significant added value. Therefore a robotic tele-ultrasound system is proposed in order to realize the examination in small towns or cities without needing highly qualified medical staff. This system for Robotic Tele-Echography (TER) is designed and developed by a French consortium composed of universities, hospitals and industrials companies [28]. Medical robots belong to safety critical systems. In such systems, the robot shares its working area with operators (doctors or assistants), and has a close interaction with the patient. Safety, defined for industrial robots as the prevention of damage to the robot itself and its environment, and particularly the human component [5], can now be defined as the property of a medical robot to be "free from unacceptable risk" [13]. Therefore it is necessary to reduce the risk to an acceptable level with a complete risk management activity (see the norm [12]). Safety is also provided by the evidence of safe functionality (completeness of safety requirements and validation of several checks). Those activities are based on a system model. Ideally, the system definition is modelled formally, but the use of formal methods in industrial development of safe systems is still rare. A significant barrier is that many formal languages and formal analysis techniques are unfamiliar and difficult to understand and to apply for engineers. Developers must also integrate medical specialists requirements, and explain them the whole system definition. For these reasons, existing techniques must be considered. UML (Unified Modelling Language) notation fulfill these claims, and is now a standard in system and software engineering. It is also well adapted to robotic systems [4]. In this presentation we will focus on risk analysis (which is a part of risk management [12]) and also on the importance of the human factors. The integration of human factors in this activity is still in work [10, 3]. But it is obvious that the interaction between the human and the technology in a medical robotic system, plays a major role in safety and therefore in risk management. In scope of the TER project, we have studied the relationships between the main activities of risk management including human factors and system definition in UML. First, we present an overview of the tele-ultrasound system. Second, the risk analysis of the TER slave site is detailed in three points. A first step is to present general concepts of risk management. A second step concerns system definition, and human factors studies as task analysis and function allocation. Finally, risk assessment is presented with the use of an analytical method, Failure Modes Effects and Critically Analysis (FMECA).