Surgical robot dependability: propositions and examples Jocelyne Troccaz, Peter Berkelman, Philippe Cinquin, Adriana Vilchis TIMC/IMAG Laboratory Faculté de Médecine - Domaine de la Merci - 38706 La Tronche cedex - France
[email protected]
Abstract Surgical robotics is a domain where the robot has to interact with human beings in order to treat patients in a very constrained working environment; therefore dependability cannot be ignored. In this paper, we discuss some requirements of this specific domain, and based on the “dependability on design” principle, we propose several directions for improving safety, reliability and man/machine interaction. This discussion will be illustrated by several on-going projects.
1. Introductive discussion Computer-Assisted Surgery (CAS) is aimed to help the surgeon in the accurate, safe and efficient realization of minimally invasive interventions. The access reduction to the organs makes the perception of the surgeon more limited and his actions more difficult and less dexterous. This is why sensors and a priori information are introduced for better planning and action monitoring and guiding systems enable the surgeon to transfer an accurate pre-planned strategy to the operating site and to realize it safely and accurately. Classical taxonomies in CAS distinguish three categories of guiding systems : active, passive and semi-active systems.
In this division, the degree of passivity corresponds to the type of interaction between the surgeon and the device. - Passive systems such as [1,2] display information to the surgeon about the position of the surgical tool relative to anatomical data or to a pre-planned strategy. The surgeon is totally responsible for the execution of the surgical action. - Active systems realize a part of the intervention autonomously. A robot may machine a bone, or hold a sensor or a surgical tool without the need for interaction with a human operator who generally supervises the action. See for instance [3]. - A semi-active system involves a combined action with the human operator for the complete realization of the task. Such a system basically constrains the surgeon actions using a dedicated hardware. For instance, a mechanical guide brought in position by a robot [4] or manually [5] may align a linear drilling trajectory that the surgeon will execute. Another type of systems has been introduced more recently : Tele-robotic systems for which the surgeon remotely controls a surgical tool held by a robot (see for instance [6]). These systems are somewhat difficult to classify in the three categories listed below since the master and slave manipulators involve different types of interaction.
Orthopedics is the surgical domain where robots were developed and pushed to the market most rapidly. The typical application is bone machining for cavity preparation when a prosthesis (hip or knee) has to be installed. This type of application is rather close to a manufacturing problem and the idea of using a robot to improve the cavity accuracy came naturally. Industrial robots were therefore modified to fit the domain constraints. However, about two decades after the first demonstrations, robots have not yet invaded the surgical operating rooms as it was predicted at that time. There are probably several reasons for that. First, having products in the medical domain may be very long and expensive as it is for drug introduction to the market. There are several development stages; as in many domains, the robot has to be developed to fit the application requirements and evaluated. The evaluation ranges from laboratory technical experiments quantifying accuracy, robustness, etc. to clinical experiments through a continuum : with phantoms1, isolated organs, cadavers, animals, healthy volunteers (when the application makes it possible) and finally with patients. Clinical evaluation means that the system developers have to prove in close collaboration with clinicians from several hospitals, that the developed system has some clinical added-value and does not result in some extracomplications, accidents, excessive blood-loss or operating time, etc. as compared to conventional reference techniques. This clinical evaluation with patient follow-up for several months up to 1
A phantom is an artificial object reproducing as accurately as possible an organ or a part of the body.
several years is very strictly regulated and requires application to ethical committees (CCPPRB2 in France). [7] is a very interesting reporting of such a product development from the very first research ideas to provisional clinical conclusions and to still open questions about the system clinical added-value. The second reason for a rather limited use of robots in surgery is, from our point of view, related to the real difficulty of introducing a robot in a surgical operating room for everyday clinical practice. This is due to the machine complexity and size, and to its generally limited userfriendliness. Price is also most likely a limiting factor. For many clinical applications, passive systems which are simpler and cheaper that robotic ones, are perfect tools : this also contributed to keep robots out of the operating rooms. The surgical use of robots could probably be amplified by improving robot dependability.
2. Surgical robot dependability Surgical robotics is different from industrial robotics from which it got its inspiration and many of its prototypes, in several points: - Human beings – at least the patient, and most often the medical staff – are in the workspace of the robot. - For some interventions, the risk is potentially very high : for instance when a cutting tool has to be operated by the robot very close to critical structures which damage could have dramatic consequences. 2
Comité de Consultation pour la Protection des Personnes dans la Recherche Biomédicale.
-
The working environment of the robot is not structured and cannot be modeled completely. - However, the robot task is generally well-defined since embedded in a surgical protocol and the required decisional autonomy of the robot is therefore limited. Basic adaptation skills relate to the patient anatomical variations which can be captured by medical sensors and appropriate image processing. - The robot design has to respect several strict constraints (septic constraints, electrical and magnetic compatibility, specific constraints for instance when operating inside MR apparatus where no Ferro-magnetic material can be used, etc.). - The robot is used by non specialists (ideally the medical staff) in a stressful environment where time is counted. The robot has therefore to be safe and user-friendly in many ways. As far as we know, there is no existing work in the domain of medical robotics considering robot dependability as a whole. We think that several action lines have to be considered in order to improve medical robot dependability : - Modeling, - software and hardware design, - man/machine interaction. This list should certainly not be regarded as exhaustive. 2.1 Modeling Dependability requires system behavior predictability and some robustness regarding human errors. As we mentioned previously, one advantage of surgery is that protocols including the surgeon and staff actions are generally very welldefined. Each intervention is codified as
series of elementary surgical actions. This knowledge has been implicit for very long and transmitted through mentoring. Recently some groups undertook to model these protocols for instance using the UML framework (cf. [8]). The aim is to make explicit to the computerized system each step of a surgery and its required resources. This may be used for teaching purpose, for simulation or for monitoring of the computer-assisted intervention. In the same way, each man/machine interaction occurring during the intervention can be explicitly specified (see 2.3) in order to limit as much as possible errors coming from user misunderstanding or misinterpretation of data, from excessive cognitive load or from user unexpected action. 2.2 Software and hardware design Dependability requires software and hardware reliability, error detection and safe recovery. General recommendations were proposed by Davies [9] to improve robot safety but in this area also there exist very few contributions. Concerning products, EC (in Europe) or FDA (in the US) marking, along with ISO9000 certification can make the clinician more confident in the system development quality. But in the area of surgical robotics, specific regulations do not exist yet. Regulations set for other medical equipment are used even if then are not perfectly adequate. Regulations have still to adapt to these new technologies entering the hospital. This is an open issue. Surgery can probably be considered as a critical application. Therefore, critical software development methodology should be to be applied to CAS systems as it is in many other critical applications such as astronautics, aeronautics or
nuclear plant control. Some form of program proving as proposed by [10] may also be a valuable tool for predictability assessment. Hardware design includes mechanical components and control of the robot. Concerning control, real time OS with redundant sensors, watch dogs, dead man switches may improve the robot safety, reliability and ability to detect errors and to react to them rapidly and safely. Specific form of hybrid force/position control [11] may also contribute to safety assessment. But risk analysis as described in [12] may be a very valuable and complementary modeling approach aiming at detecting risks, removing them or proposing technical solutions to detect errors and to safely react to them. We applied this approach to the TER system described below. One specifity of the domain is that the remaining risk, if any, has to be compared to the risk incurred by the patient when operated without computer and robot assistance especially for high morbidity or high mortality interventions in order to decide if this risk is acceptable. The choice of the kinematic architecture may influence the robot safety : scara robots such as RobodocTM [3], AesopTM [13], or PADyC (see below) have a welldefined workspace and the robot weight can be compensated by a simple counterweight while more anthropomorphic robots may be less predictable in terms of motions or gravity compensation when electric power is turned off. Specific architectures with degrees of freedom (DOFs) corresponding to elementary motions of the considered clinical application may improve a lot the robot safety and ease of use whilst limiting the application range of the system. Such an approach has been
successfully applied in AesopTM, in “Remote Center of Motion” robots such as RCM [14] or LARS [15] developed by Taylor and colleagues. A similar principle has been used when designing PER presented below. Soft robots are not often compatible with accuracy requirements of CAS. However, some applications such as assisted endoscopy or assisted echography, where the robot is used to carry a sensor are less demanding in term of precision that some surgical actions. For these applications, original design choices may be done. This is the case of the TER and PER systems which integrate lightweight, compliant robots for which the patient body can be considered as a part of the robot structure (see 3.1 and 3.2). 2.3 Man/machine interaction Dependability is tightly related to the ability to interact with a human. As we explained in section 1, medical robots – active or semi-active ones – have been used for very long with very limited real interaction with the surgeon. More recently, tele-operated robots proposed to surgeons a much higher degree of interaction. The DaVinciTM [6] system is a very good example where the expertise is on the surgeon side whilst the robot can dexterously realize in a completely endoscopic way and much better than the surgeon would do microsurgery interventions remotely controlled by the surgeon from his master workstation. Some years ago, another category of systems, named synergistic systems [16] have been proposed. Davies more recently named them “hands-on devices” [17]. They are intended for direct physical guidance of a surgical tool, a tool that is also held and controlled directly by a surgeon. Under computer control, the
synergistic device may allow the surgeon to have control of some DOFs while the device controls the others. The system filters the motions proposed by the surgeon to keep only those which are compatible with the surgical plan. For instance, during the pre-planning stage, an orthopaedic surgeon selects a cutting plane for machining a bone before placing a knee prosthesis. In such a case, the synergistic system guarantees that the motions of the cutting tool are strictly limited to the pre-planned plane while the surgeon is in charge of the selection of the motions within the plane. These systems, which can be considered as an extension of semi-active systems, keep the surgeon in direct contact with the surgical instrument and fully participating in the on-going operation. This is an important element of safety and psychological acceptance and it gives to the surgeon a very positive feeling of successful tasksharing between him and the robot. An example of synergistic system, named PADyC is presented in section 3.3. In a CAS system, man/machine interaction is much vaster than the only interaction with a robot. The application generally requires several actions from the surgeon in order to manipulate data, to input information to the system and symmetrically, the system outputs information to the surgeon. In front of the variety of the devices and the multiple available data representations, the choice over the amount of available solutions becomes hard to make in order to ensure the usability of the developed system by the surgeon. The questions are : which representation is the best-suited for the clinician in the considered clinical case ? Which devices will be the easiest to use and to smoothly introduce in the surgical procedure ? Etc. Currently most of these decisions are taken arbitrarily, leading to
ad hoc solutions, promoting an exploratory approach rather than a systematic one. Consequently, the resulting systems does not perfectly take into account the different specificities of the clinical or medical context. Therefore, we proposed a modelling formalism for man/machine interaction specification and a methodology for system development based on different properties such as ergonomic ones or more specific constraints from the application domain (see [18,19]). This framework is intended to make more rational system design choices concerning man/machine interaction and to produce re-usable hardware and software components. It has been applied for the design of the man/machine interface in a computerassisted surgery application in cardiac surgery.
3. Examples 3.1 TER: a robot for tele-echography Among many types of medical equipment, ultrasound diagnostic systems are widely used because of their convenience and safety. Performing an ultrasound examination involves good eye-hand coordination and the ability to integrate the acquired information over time and space; the physician has to be able to mentally build 3D information from both the 2D images and the gesture information and to put a diagnosis from these information. Some of these specialized skills may lack in some healthcare centres or for emergency situations. Tele-consultation is therefore an interesting alternative to conventional care. Development of a high performance remote diagnostic system, which enables an expert operator at the hospital to examine a patient at home, in an emergency vehicle or in a remote clinic, may have a very significant added value. Several robot-based echography projects
have been launched worldwide (see [20,21] for instance). The tele-operated TER system [22] allows the expert physician to move by hand a virtual probe in a natural and unconstrained way and safely reproduces this motion on the distant robotic site where the patient is. The physician located in the master site moves the virtual probe placed on a haptic device (a PhantomTM) to control the real echographic probe placed on the slave robot. Two IDSN 128kb/s connections are used for data transfer between the master and slave sites; one is for the Visiophonic data and echographic images and the other one is for the transmission of the control information for the slave-robot.
However in this application, the required precision is not very high and the physician “closes the loop” from the information he gets from the echographic images; thus, robot intrinsic accuracy is no longer an issue. Experiments have been successfully performed on anatomical phantoms and on a voluntary person (see. Figure 2). As already mentioned, in order to improve the system reliability and safety, a risk analysis has been conducted and is reported in [12]. A TER V2 system is under development integrating a slightly modified robot architecture and high transfer rate communication.
One originality of TER lies in its slave robot architecture. It is a lightweight, parallel uncoupled robot placed on the patient body (see figure 1).
Figure 2: Experiments with TER
Figure 1: The TER slave robot It includes two independent parallel structures having two independent groups of pneumatic artificial muscle actuators. Thin and flexible cables are used to position and orient the echographic probe. The cables are connected to the pneumatic artificial muscles which provide natural compliance at some expense of accuracy.
3.2 PER: a robot for endoscopy In conventional minimally invasive surgery, surgeons operate with long, thin instruments through “keyhole” incisions approximately 10 mm in diameter in the abdomen of the patient. An endoscope, a thin optical tube which is inserted through one of the incisions and connected to an external video camera, is used to visualise the internal organ structures and instrument tips. The endoscope video camera image is displayed on a monitor during surgery. Since a single surgeon generally has both hands occupied with surgical instruments (for example, one for
grasping and one for cutting), an assistant is necessary simply to hold the endoscope steady in a desired position. For practical use in an operating room environment, the endoscope manipulator must be unobtrusive, safe, simple to set up and use, and easily sterilizable. Several robot systems such as [13,15] have previously been developed for laparoscopic endoscope manipulation during surgery. Commercially available robotic surgical endoscope manipulators are included in the DaVinciTM [6] system from Intuitive Surgical Systems and AesopTM [13] and ZeusTM from Computer Motion. These manipulators are typically elements of large, heavy, complex and expensive systems and resemble conventional industrial robot manipulators. We have taken a simple, lightweight, low cost approach instead. The positioning mechanism is fixed to the endoscope and strapped to the patient at the incision location, so no rigid base is necessary and the manipulator moves with the patient during breathing, repositioning by the surgeon, motions of other instruments, or any other displacement of the abdomen wall (see figure 3). PER relies on cable actuation; as compared to TER, electrical motors are used instead of pneumatic muscles.
Figure 3: the PER endoscope holder strapped on the patient
In the current prototype version, the surgeon may interact with the system using a joystick. Automatic tracking of surgical tools has also been implemented. In the future, other interaction media such as pedals or voice actuation will be considered. The endoscope manipulator has been demonstrated with a simulated abdomen and with a cadaver and good experimental performance results were obtained [23]. We plan to proceed towards clinical testing and validation. 3.3 PADyC: a passive arm with dynamic constraints The concrete objective for PADyC development was to a build generalpurpose mechanical device to be held by the surgeon's hand and which allow him to feel the virtual world of patient data (including safety regions around anatomical obstacles to be avoided) and of surgical strategies, while moving in the real world. There exist several implementations of the synergistic approach using different technologies PADyC [24] and Cobot [25] are purely passive robots, whilst ACRobot [17] is an actuated robot. The actuation of PADyC comes exclusively from a human operator. This choice of a passive device although it may have some drawbacks was aimed at providing intrinsic safety. In order to filter the tool motions proposed by the surgeon moving the end effector, each joint of PADyC is equipped with two freewheels and a clutching mechanism allowing to control continuously the instantaneous joint velocities. This determines at each instant a region of admissible robot configurations for a given pre-planned task. Different types of constraints (region, trajectory, position, etc.) are implemented with the system depending on the task to be executed. Experiments
on prototypes were very promising. A 6 dof PADyC (see figure 4) for computeraided puncture of the heart is under development [26].
on-going projects laboratory.
in
the
TIMC
These propositions are certainly not exhaustive; specific efforts about standards, benchmarking and regulation have to be made. Dependable surgical robots have still to be invented in order to improve clinical usability whilst keeping development time, system complexity, maintainability and cost reasonable.
References 1.
Figure 4: PADyC 6 DOFs prototype
2.
4. Conclusion Over the last two decades, medical robotics has evolved from the adaptation of industrial robots to medical tasks, to a specific domain of robotics trying to promote man/machine interaction. The objective is to take the best advantage of (1) the robot, its accuracy, force sensing and its computer-based model of the patient and of surgical action, and (2) the surgeon and his knowledge, know-how, sensing capabilities and ability to detect and to react to unexpected or nonmodeled events. Based on our 20 years research experience in the medical field we are definitively convinced that such a cooperation is a key to success. In this paper we proposed several directions for improving surgical robot dependability : by modeling, by improving software and hardware design methodology and by proposing original robot architectures and control paradigms. We illustrated these propositions by a short presentation of
3.
4.
5.
6.
Mosges R. et al. Computer assisted surgery. an innovative surgical technique in clinical routine. In Computer Assisted Radiology, CAR 89, pp. 413-415, H.U. Lemke, editor, Springer-Verlag, 1989 Lavallée S., Sautot P., Troccaz J., Cinquin P. and Merloz P. Computer Assisted Spine Surgery: a technique for accurate transpedicular screw fixation using CT data and a 3D optical localizer. In Proceedings of the First International Symposium on Medical Robotics and Computer Assisted Surgery (MRCAS'94), pp 315-322, Pittsburgh, 1994 Paul H., Bargar W., Mittlestadt B., Musit B., Taylor R., Kazanzides P., Williamson B., Hanson W.. Development of a surgical robot for cementless total hip arthroplasty. In Clinical Orthopaedics and related research, (285) :57-66, December 1992 Lavallée S., et al. Image guided robot: a clinical application in stereotactic neurosurgery. In IEEE Int. Conf. on Robotics and Automation, pp. 618-625, Nice, 1992 Radermacher K., Staudte H.W. and Rau G. "Computer assisted orthopaedic surgery by means of individual templates - aspects and analysis of potential applications". In Proceedings of MRCAS’94, pp 42-48, Pittsburgh Guthart G.S., Salisbury J.K. The IntuitiveTM telesurgery system: overview and application. In Proceedings of IEEE Robotics and Automation Conference, San Francisco, Avril 2000
7.
Bargar W.L., Bauer A., Borner M. Primary and Revision Total Hip Replacement Using the Robodoc System. In Clinical Orthopaedics, septembre 1998, Number354 , pp82-91 8. Jannin P., Raimbault M., Morandi X., and Gibaud B. Modeling surgical procedures for multimodal image-guided neurosurgery. In W.J. Niessen and M.A. Viergever, editors, MICCAI 2001, LNCS Series, volume 2208, p. 565-572. Springer, 2001 9. Davies, B.L. A discussion of safety issues of medical robots. In ComputerIntegrated Surgery, pp 287-296, edited by R.H.Taylor, S.Lavallée, G.C.Burdea, R.Mosges, MIT Press, 1995 10. L. Adhami, D. Bondyfalat, G. Dowek, E. Coste-Manière Formal verification to enforce the safety of robotically assisted surgical interventions. In “Surgetica’2002”, Eds J.Troccaz, P. Merloz, Sauramps Medical, 2002 11. E. Dombre, G. Duchemin, F. Pierrot, P. Poignet. DERMAROB, a robotic assistive device for skin harvesting. In “Surgetica’2002”, Eds J.Troccaz, P.
Merloz, Sauramps Medical, 2002 12. Guiochet J., Vilchis A. Safety analysis of a medical robot for tele-echography, In Proceedings of the IARP Workshop on dependable robots, Toulouse, 2002 13. Sackier J.M., Wang Y. Robotically assisted laparoscopic surgery: from concept to development. In Computer Integrated Surgery: Technology and Clinical Applications, (Taylor, Lavallée, Burdea, Mosges, Eds.), pp577-580, MIT Press, 1995 14. Stoianovici, D., Whitcomb, L.L., Anderson J.H., Taylor R.H., Kavoussi L.R. A Modular Surgical Robotic System for Image Guided Percutaneous Procedures. In Proceeding of MICCAI’1998, LCNS Series, Springer Verlag, 1998 15. Taylor R.H., et al. Telerobotic assistant for laparoscopic surgery. In Computer Integrated Surgery: Technology and Clinical Applications, (Taylor, Lavallée, Burdea, Mosges, Eds.), pp581-592, MIT Press, 1995
16. Troccaz J., Peshkin M., Davies B. Guiding systems for Computer-assisted Surgery (CAS) : introducing synergistic devices and discussing the different approaches. Medical Image Analysis, 2(2), pp101-119, 1998 17. Davies B., Harris S., Jakopec M., Cobb J. A Novel Hands-on Robot for Knee Replacement Surgery. In Proceedings of the CAOS USA '99 Conference on Computer Assisted Orthopaedic Surgery, pp 70-74, UPMC, Shadyside Hospital, Penn. USA June 1999 18. E. Dubois, L. Nigay, J. Troccaz. Assessing continuity and compatibility in augmented reality systems. In UIAS Vol1, pp263-273, Springer, 2002 19. E. Dubois, O. Chavanon, P. Cinquin, L. Nigay, J. Troccaz. Analytical approach for the design of the surgeon’s interaction with a computer assisted surgery system. In “Surgetica’2002”, Eds J.Troccaz, P. Merloz, Sauramps Medical, 2002 20. S. Salcudean, G. Bell, S. Bachmann, W.H. Zhu, P Abolmaesumi and P.D. Lawrence. Robot-assisted diagnostic ultrasound design and feasibility experiments. In Proceedings of MICCAI’99 , pp. 1062-1071LNCS Series, Springer Verlag, 1999 21. K. Masuda, E. Kimura, N. Tateishi and K. Ishihara. Three dimensional motion mechanism of ultrasound probe and its application for tele-echography system. Proceedings of the IEEE/RSJ International Conference on Intelligent Robots and Systems. pp 1112-1116, Maui, Hawaii, USA, Oct 29-Nov 03 2001. 22. A. Vilchis et al. Experiments with the TER tele-echography robot. In Proceedings of MICCAI’2002, LNCS Series, Springer Verlag, 2002 23. Berkelman P., Cinquin P., Troccaz J., Ayoubi J.M., Letoublon C., Bouchard F. A Compact, Compliant Laparoscopic Endoscope Manipulator, Proceedings of the IEEE Conference on Robotics and Automation, 2002 24. Troccaz J., Delnondedieu Y. Semi-active guiding systems in surgery. A two-dof prototype of the passive arm with
dynamic constraints (PADyC). Mechatronics, 6(4):399--421, June 1996 25. Colgate J.E., Peshkin M., Moore C.. Passive robots and haptic displays based on nonholonomic elements. In Proceedings of the IEEE International Conference on Robotics and Automation, 1996 26. Schneider O., Troccaz J. A Six Degree of Freedom Passive Arm with Dynamic Constraints (PADyC) for Cardiac Surgery Application: Preliminary Experiments. In Computer-Aided Surgery, special issue on medical robotics, 6(6), pp340-51, 2001
