Risk Management for the Reliability of Robotic Assisted Treatment of Non-resectable Liver Tumors

Abstract

Hepatic cancers represent an important worldwide health issue where surgery alone in most cases is not a feasible therapeutic solution since most tumors are non-resectable. Despite targeted therapies showing positive results in other areas of cancer treatment, in the case of liver tumors, no low-risk delivery methods have been identified. Based on a risk assessment approach, this paper proposes a technical solution in the form of a robotic system capable of achieving a reliable delivery method for targeted treatment, focusing on the patient safety and therapeutic efficiency. The design of the robotic system starts from the definition of the design constraints with respect to the medical protocol. An analytical hierarchy process is used to prioritize the data correlated with the technical characteristics of a new robotic system, aiming to minimize risks associated with the medical procedure. In a four-phase quality function deployment, the technical solution is evaluated with respect to the quality characteristics, functions, subsystems, and components aiming to achieve a safe and reliable system with high therapeutic efficiency. The results lead to the concept of HeRo, a parallel robotic system for the reliable targeted treatment of non-resectable liver tumors.

1. Introduction

One of the most lethal forms of cancer in the world is hepatocellular carcinoma (HCC), which represents the most common primary malignant liver tumor. HCC represents more than 5% of all cancer localizations on a world scale, being the fifth most common malignant localization in males and the ninth in females [1]. The number of HCC deaths per year is almost equal to the incidence with 0.93/1 lethality index. The best curative options, involving the complete removal of the malignant cells from the body, are surgical resection of the tumor and liver transplant [2]. However, only 20% of patients with HCC can be subjected to one of these procedures due to various reasons related to the disease (localization, size, vascularization, number of tumors, spread) or patient (general state, other associated diseases, i.e., cirrhosis) [1]. When resection and liver transplant are not viable options, there are multiple locoregional treatments (curative or palliative ones) which have been investigated in medical centers all over the world, including TACE (trans-arterial chemoembolization), HDR (high-dosage radiation) brachytherapy, RFA (radiofrequency ablation), and delivery of chemotherapeutic drugs injected directly inside the tumor [3]. According to a team of clinicians from the “Iuliu Hatieganu” University of Medicine and Pharmacy in Cluj-Napoca, the palliative locoregional treatments may increase the survival time of the patient by “down-staging” the disease (and improving the patient condition), allowing them to become liver transplant candidates. With all the recent advancements in nuclear medicine and medicinal chemistry, these targeted approaches have a high potential to increase the patient survivability and quality of life, but they are hindered by a common constraint: the placement accuracy of the therapy delivery tool is critical, with a maximum acceptable positioning error of 2 mm which in most cases cannot be achieved manually [4]. According to [5] the combined positioning error, assuming 1° angular positioning error and 1 mm Cartesian positioning error from the zero compensation position (values that may be exceeded when the needle is inserted manually, leading to worse outcomes), of a needle inserted in the patient body (with zero needle deflection) is approximately 2.5 mm for 50 mm depth and approximately 5 mm at 200 mm depth.

An efficient solution that can overcome the human limitations in such techniques is represented by the use of robotic systems which, based on careful preplanning of the procedure, enable tumor targeting with increased accuracy [6]. The most promising results have been achieved in the treatment of tumors located in the prostate [7], lung [8], or breast [9], but all studies reflected that the procedure difficulty increases as the tumors are located deeper in the body (as the access path is longer and needle orientation errors, especially, multiply) and is more complicated for organs with complex vascular structure. In fact, the therapeutic feasibility of HDR brachytherapy for HCC treatment is not yet proven, mostly due to the lack of accurate technical solutions capable of delivering the therapeutic agent in a reliable manner which facilitates patient safety and decreases the overall risk of the medical procedure.

When considering the development of a technical solution designed to facilitate targeted treatment of HCC, besides accuracy, other characteristics should be considered which are strongly related to the patient safety. The technical solution (e.g., a robotic system) must comply with various technical and medical requirements (e.g., the robot must be able to properly manipulate the medical instruments with minimum risk of causing harm; some critical components must be sterilized and, therefore, modularity is required, etc.). The accuracy and patient safety, considering the robotic assisted medical procedure, should also be enhanced by using a real-time imaging technique. Since the proposed procedure is minimally invasive, a pneumoperitoneum is created beforehand, and most likely, the liver position will change (relative to the position defined preoperatively based on the volumetric data). For the proposed technical solution, another robot will be used to guide an intra-operatory ultrasound probe (I-US) to visualize the tumor and the needle insertion (a robotic solution is desired to have an optimum positioning control between the I-US imaging plane and the needle trajectory). The end result (in the form of a modular robotic system) must be validated by showing that the benefits (of the technical solution) outweigh the risk, i.e., by using the robotic system for the medical procedure, the risk of patient harm must be minimized, whereas the therapeutic efficiency must be maximized. Therefore, to design a robotic system that complies with the safety and therapeutic efficiency needs, the authors identified the risks associated with the medical procedure and designed the robotic system by using engineering tools such as analytical hierarchy process (AHP) and quality function deployment (QFD).

Due to the promising outcomes in some areas of medial robotics (especially in percutaneous procedures [4,6,7,8,9]) some medical experts (from the “Iuliu Hatieganu” University of Medicine and Pharmacy in Cluj-Napoca) believe that future advances in surgery and oncology may come also from the development of technical solutions that help the clinicians in performing the therapies. On the one hand, present advances in nuclear medicine and medicinal chemistry may provide increasingly better therapeutic agents, but on the other hand, technical solutions (e.g., robotic systems) may provide better ways to deliver the therapeutic agents. In fact, there is a tendency of growth in the robotics market towards non-industrial robots, which will attract more than 160 billion USD by 2021 [10]. One major area of non-industrial robotics is healthcare robotics according to The European Commission [11] through the Eurobotics AIBSL forum, which identified three major areas of interest where medical robotics would play an important role and included them in the strategic development agenda for the next five years. The first area is clinical robotics, defined as robotic systems that interact directly with the patient supporting the “care” and “cure” processes. An important category of clinical robots is represented by the surgical ones. Depending on the specifics of the application, the requirements for surgical robots are expressed in terms of safety involving risk analysis and essential performances. The risk and effectiveness should be rigorously specified because a robotic device is a machine that can hurt the operators and the patient, being in close contact with the latter.

This paper is structured as follows: Section 2 presents the risk management strategy for the development of the technical solution. Moreover, by evaluating the associated risks of the procedure, the medical and technical requirements for the proposed technical solution are defined. Section 3 presents an analytical hierarchy process which is introduced subsequently in a four-phase quality function deployment which, in turn, leads to the HeRo conceptual design, showing also the advantages of the design with respect to risk reduction. Section 4 presents the discussion of the obtained results, and finally, Section 5 presents the conclusions and further work.

2. Materials and Methods

For the development of the technical solution (a reliable robotic system to facilitate precision and safety) which may enable the use of HDR brachytherapy in HCC treatment, the ISO 14,971 [12] standard for risk management in healthcare devices was followed. Figure 1 shows a flow chart which describes the risk management for the early stages of device (or technical solution) development (before prototyping).

The general strategy detailed in Figure 1 is to establish the limitations of the medical procedure (as if it was performed manually) by analyzing the risks and to proceed to determine whether the risks can be diminished or not by developing a technical solution design to facilitate the medical procedure. The process starts with the risk assessment, which has three main steps. The first step refers to defining the intended use and the safety characteristics of the medical procedure, which in turn helps to identify all the known and foreseeable hazards (which is the second step in the risk assessment). At this point, it is important to distinguish between risks associated with the HDR brachytherapy procedure (for the HCC therapy) and other health-related risks (e.g., diabetes imposes risks for the surgical procedure but should not be considered in this analysis). The third step is the estimation of the risk of each hazard, which serves at the ground base for the risk reduction in the risk management process. Since HDR brachytherapy is not a feasible therapeutic method for HCC treatment (despite its positive results in treating cancers in other body areas), a strong assumption is made which states that by reducing the current risks associated with the procedure, HDR brachytherapy may become a viable therapeutic tool for HCC; consequently, risk reduction is necessary. Assuming that the risk associated with the medical procedure may be reduced by using a technical solution, the risk reduction process (focused on implementing risk control measures and evaluating thereafter the residual risk) is related to determining the medical and technical characteristics of the emerging technical therapeutic solution. Therefore, a medical protocol for the technical solution (the medical characteristics) and the design constraints (the technical characteristics) must be established. In the later stages of the risk management, the technical solution is evaluated in order to determine if new hazards were introduced or if there exist any modified hazards (hazards which were not eliminated but changed in various aspects). At the end, if the overall residual risks are managed (in acceptable ranges), if the benefits outweigh the residual risks, the risk management process ends with an acceptable medical device as a result.

2.1. Definition of the Medical Task

The first step in the risk management process (see Figure 1) is to define the intended use and safety characteristics, i.e., the medical task. The proposed therapeutic procedure aims to achieve an efficient and reliable treatment (which minimizes the risk) of non-resectable HCC tumors by taking into account all the existing medical and technical constraints, focusing on three targeted treatment options: HDR brachytherapy (using, e.g., a 1.6 mm gauge needle), intratumoral chemotherapy (using, e.g., a 1.6 mm gauge needle), and RFA (using, e.g., a 2 mm gauge needle). All these procedures are performed percutaneously by inserting a specific needle through the skin, on a linear trajectory, inside the tumor. In order to enable safe and accurate needle positioning, the authors propose the use of an intraoperative ultrasound probe that can monitor in real time the needle placement. Thus, the procedure has three main stages:

• Preoperative: the patient is investigated using non-invasive molecular imaging techniques that determine the tumor location and characteristics (size, density, proximity to blood vessels), the most efficient treatment option, and possible safe needle trajectories;
• Intraoperative: the therapy is performed in the operating room, by surgeons, using a total of three medical instruments [13]: (1) an endoscopic camera, guided manually by a surgeon, that enables the fast transfer of the intraoperative ultrasound (I-US) probe in the targeted area of the liver and the continuous evaluation of the surgical field; (2) the I-US probe, guided by a robotic arm, used to locate the tumor and monitor in real time the needle insertion in the liver parenchyma; (3) the therapeutic needle(s), guided by a second robotic arm used to insert the needle on a linear safe trajectory from outside the body into the live tumor;
• Postoperative: the patient evolution is monitored by assessing the procedure results and the patient evolution.

The procedure takes place in an operating room (Figure 2) where the necessary equipment is provided: an operating table adjustable on three axes, a vital signals monitoring system (respiration, cardiac rhythm), and anesthesiology equipment. On the lateral side the laparoscopic tower is positioned, and in its proximity, the ultrasound tower.

2.1.1. Remote Center of Motion Concept for the Guiding of the I-US Probe

In 1995, Russell Taylor [14] introduced the concept of the remote center of motion (RCM), defining it as the point of entrance in the abdominal cavity, a fixed point which should not be displaced during the medical task. In minimally invasive surgery (MIS), it is used for instrument insertion into the body, and for our procedure this concept is used for the manipulation of the I-US probe. Based on Figure 3, it can be stated that with respect to point B (RCM), the instrument can achieve four independent motions:

• In spherical coordinates: two rotations that would position the point E on a surface of a “sphere” with radius BE, one translation along the A-B-E segment or the longitudinal axis of the instrument, and one rotation around the same axis;
• In Cartesian coordinates: three translations which enable the positioning of the point E in space with respect to the point B and one rotation around the longitudinal axis of the instrument.

When it comes to technical solutions based on robotic systems, the RCM can be achieved in two ways: by using the tissue around the insertion point as guidance or by mechanically constraining that point in space. Additionally, a third category of RCM can be added that combines the simplicity of the first with the capabilities of the second, namely, architecturally constrained. The first approach imposes a simple mechanical construction at the anchor point of the instrument to the robotic guiding device (in the form of a 2-DOF, degrees of freedom, passive Cardan joint), but its usability is limited to the manipulation of instruments that do not come in intimate contact with the internal tissues (e.g., a laparoscopic camera). The second approach, where the RCM is mechanically constrained, imposes the use of an active 2-DOF joint at the anchor point of the instrument. This, in turn, determines a much more complicated construction of the robotic device but it enables the manipulation of instruments that come into direct contact with the internal tissues (e.g., the surgical instruments). The third approach imposes the development of the robotic device in such a way that without the addition of any supplementary joint it would keep the location of the RCM fixed. Even though such an approach will impose the use of a positioning mechanism that would adjust the position of the RCM in space, an architectural constraint mechanism can be limited to only 2 DOF. This approach also has an increased safety aspect because after the insertion of the instrument inside the patient, the positioning mechanism will remain fixed, reducing to a minimum the pressure exerted on the tissue walls and eliminating the risk of unwanted motions that could harm the patient.

2.2. Definition of Possible Hazards and Associated Risks

Steps 2 and 3 in the risk management process (see Figure 1) are intended to evaluate all the possible hazards and estimate their occurrence risk. The possible hazards were determined (and detailed in

Table 1. Identified hazards and associated risks for the targeted therapy of hepatocellular carcinoma (HCC).

No.	Hazard	Associated Risk	Severity *	Probability **	Overall Score ***
H1	Needle positioning error beyond acceptable value	Linear positioning error (the error remains constant at any depth)	85	60	150
		Orientation positioning error (the error multiplies with the depth)	90	95	195
		Insertion depth error	80	50	130
H2	I-US (intraoperatory ultrasound) probe positioning error	I-US probe positioning does not respect the predefined trajectory	50	50	100
		I-US probe is pressing too hard on the liver	90	70	160
		I-US cannot reach the targeted area	40	40	80
H3	I-US entry port (RCM) is not preserved	The I-US probe applies pressure on the abdominal wall	100	80	180
		The I-US probe movements are different than intended	90	80	170
H4	The targeted area cannot be reached	Incapability of performing the procedure (the instruments cannot reach the specific liver area)	100	50	150
		Incapability of achieving the necessary orientation for the I-US probe	60	45	105
		Incapability of achieving the necessary orientation for the therapeutic needle	95	45	140
H5	The operating table has to be repositioned to ensure better access to the targeted area of the liver	The relative patient–robot position is changed	100	60	160
H6	The patient state deteriorates during the procedure	The patient cannot be resuscitated in due time	100	40	140
H7	The needle cannot be viewed inside the liver parenchyma	The needle insertion cannot be monitored	90	90	180
H8	Improper sterilization	Infection risk	80	10	90

* Severity scale: (0–29) minor, (30–89) moderate, (90–99) serious, (100) catastrophic; ** Probability scale: (0–29) remote, (30–69) unlikely, (70–99) likely, (100) very Likely; *** Overall score: Severity + Probability.

) with the help of nine clinicians from the “Iuliu Hatieganu” University of Medicine and Pharmacy, Cluj-Napoca. Furthermore, each clinician filled in a questionnaire (see Appendix A) regarding the severity and occurrence probability of each hazard, and the mean values are also presented in Table 1 (in Section 3, the risks associated with the robotic assisted procedure are reevaluated based on the proposed technical solution). The severity and probability scales were derived from a typical risk assessment matrix and the overall score definition was chosen to allow a simple yet comprehensive evaluation of the risks (which was also used in [15]).

2.3. Identifying Risk Control Measures for the Treatment of Non-resectable HCC Tumors

The necessity of a technical solution that enables targeted treatments such as HDR brachytherapy for HCC in a safe manner emerges from the relatively high probabilities of hazards (see Table 1). A parallel robotic system is proposed as the technical solution, and to proceed further into its design, an integrated medical protocol was developed with the aim to achieve the targeted treatment of non-resectable tumors performed in the operating room as a minimally invasive procedure. This also enables the definition of the technical characteristics of the robotic system and the specific motions for the guidance of instruments involved.

The robotic assisted medical protocol for the MIS procedure is as follows:

• Diagnosis and preplanning stage:
  • Diagnostic: This step refers to the patient’s preliminary analysis where it is determined whether or not a hepatic tumor is non-resectable (the inclusion criterion). This step may require various diagnosis methods such as medical imaging, biopsies, etc.;
  • Establishing the optimal treatment: The optimal treatment approach is established, which may be targeted brachytherapy, targeted chemotherapeutic agent delivery, or RFA;
  • Trajectory definition: The coordinate points of interest (e.g., insertion and target points) are established relative to an external system of markers (fixed on bone mark). The relative positioning of the liver and the markers will not change once the carbon dioxide is insufflated. Based on previously obtained imaging data, the I-US probe insertion coordinates are determined together with the insertion coordinates of the needles, the needle trajectories, and the target points. Note: Due to possible displacement of the liver, most likely from the pneumoperitoneum described in point B.2. below (the difference in position from the volumetric information and the position in the real-time procedure), in most of the cases the predefined trajectories are only an idealization (some corrections are required during the actual medical procedure).
• Procedure Preparation stage:
  • Patient and robotic system registration: The patient is positioned on the operating table, the markers are identified, and the robotic system is fixed such that the trajectories of interest are in the central zone of its workspace. The mathematical correlation between the robot coordinate system and the patient coordinate system is determined to achieve patient–robot registration. Note: The robot–patient registration serves only as an initial guideline; during the procedure, the clinician will actively search the tumor using the I-US probe.
  • Pneumoperitoneum creation: The patient is prepared for the intervention by insufflating CO₂ up to a certain pressure that is maintained constant through the whole procedure. The pressure will create an empty volume inside the abdominal cavity, enabling instrument manipulation inside the patient body. The first incision is created to allow the insertion of a 10 mm trocar for the insertion of the laparoscopic camera (manually guided) which will monitor the whole procedure.
• The robotic assisted procedure:
  • Ultrasound probe insertion and tumor location: After the patient is prepared and the laparoscopic camera is introduced, the robotic system guides the tip of the I-US probe such that it touches the patient’s skin. At this point, the surgeons fix a 10 mm trocar, this being registered as the RCM point for the I-US probe guiding module, and the US probe is inserted until it makes contact with the hepatic parenchyma. After contact, the clinician actively searches and locates the tumor, and by knowing the approach plane of the needle trajectory and the tumor depth, the US probe is fixed in the same plane to enable needle monitoring during its insertion into the hepatic tissue.
  • Therapeutic needle insertion: The needle guiding module positions the needle on the defined trajectory (confirmed with possible minor corrections after tumor location with the I-US probe). The needle is then positioned on the desired trajectory above the patient’s skin, but as close as possible to it. After the trajectory validation, the robot will remain in the current position and the needle will be inserted using the insertion module, monitoring in real time the resistive force to avoid needle deflection;
  • Therapeutic needle insertion into the hepatic parenchyma: The needle is inserted continuously up to the proximity of the hepatic parenchyma. When the needle touches it, the trajectory is once more validated and the needle insertion into the hepatic tissue is initiated. From this point on, the needle can be seen by means of the US probe that confirms reaching of the target point.
    • Multiple needle insertion: When the treatment requires the use of multiple needles, those are inserted by following Steps C.2 and C.3 until all the required therapeutic needles are inserted. The insertion order is established such that the I-US probe may be repositioned without affecting the already inserted needles. Note: Since multiple needle insertions increase the risk of hepatorrhagia, further research (in vivo) is intended to determine the maximum number of needles allowed.
  • Delivery of the treatment: After all needles are inserted, their position is confirmed by the medical personnel and the treatment is delivered. For brachytherapy treatment, the patient should be transferred to a controlled room specialized for brachytherapy treatment;
  • Needle extraction and operating field check: After completing the procedure, the needles are extracted either by the robot or manually (depending on the procedure). After extraction, the operating field is checked for eventual hemorrhages;
  • Ultrasound probe extraction: After validating the position of all needles, the US probe is retracted, followed by extracting the laparoscopic camera and suturing the incision points of the two trocars.

The analysis of the possible hazards and their estimated occurrence, together with the procedure protocol, led to the definition of the main design constraints for the new robotic system which should be accounted for and implemented as risk control measures:

• The needle guiding module must operate with high precision, due to the fact that the robot must insert therapeutic needles within the tumors (a maximum error of 2 mm is accepted [3,4]);
• The robot workspace should have no singularities (robot configurations where the mechanism is not well behaved, losing or gaining degrees of freedom). A singularity-free workspace may be achieved through mechanism design;
• Since the medical procedure requires the manipulation of two medical tools (therapeutic needles and I-US) in a distinct manner, the robotic system must have two independent modules. The first module is designed to insert and manipulate the US probe, whereas the second module is designed to insert the therapeutic needles. The relative positioning of the two guiding modules is always known; therefore, while the clinician actively locates the tumor, the needle will also adjust its position such that the needle targets the tumor;
• Because the procedure is to be minimally invasive, the US probe guiding module needs to work based on the RCM concept;
• Based on the liver size and the multiple trajectories that need to be used to target tumors located in all areas of the liver, the robot should have workspace of 500(X) × 300(Y) × 500(Z) and orientation capability of 90° around Y and 150° around Z;
• A low weight is desired since the robot needs to be mounted on the lateral sides of the operating table;
• The robotic system mounting needs to be adapted to the surgical environment as the procedure takes place in an operating room;
• Due to the intimate interaction between the robot and the patient, safety is a critical aspect, including also the required ability to quickly remove the instruments from the patient’s body;
• The robotic system should occupy a volume as small as possible in the operating room.

2.4. Implementing the Risk Control Measures for the New Technical Solution

In order to achieve the design of a safe robotic system for the treatment of non-resectable HCC, a roadmap was developed and is presented in Figure 4. Starting with the design constraints, an AHP (analytic hierarchy process) was performed in order to prioritize the importance of the technical characteristics of the robot (with respect to enhancing safety and decreasing the associated risks).

In a four-phase QFD, an importance analysis of the measurable quality characteristics, functions, technical subsystems, and individual robot components is performed along with the identification of the unique selling points of the proposed solution. The design methods were implemented using Qualica software [16]. Usually there are three scales for the numerical correlations among the analyzed parameters in the QFD (1, 3, 9). However, the authors chose an extended scale (1, 3, 9, 27, 81) to allow a better “resolution” of the analysis. Furthermore, the correlation number was chosen by clinicians and engineers based on their professional experience: for QFD-I, the clinicians attributed the correlation values based on the previously presented risk assessment (Table 1); for QFD-II, -III, and -IV, the engineers attributed correlation values by closely considering fundamental theoretical aspects (from mechanism science, such as kinematics and singularity analysis) and the predefined robotic assisted medical protocol (see Section 2.4).

3. Results

The medical protocol and the design constraints led to the definition of 10 critical technical characteristics of the robotic system which, through adequate implementation, should lead to a reliable technical solution minimizing the risks associated with the medical procedure. An analytical hierarchy process (AHP) analysis was performed to determine the relative importance and criticality of these characteristics with respect to the medical task and is presented in Figure 5.

AHP imposes the completion of a comparison matrix where each of the technical characteristics is compared in terms of importance with the others based on the specific requirements of the procedure. A five-level comparison scale was used, while for the final sorted results, the most important item was made to be 3 (three) times more important than the least important one. The analysis revealed that the procedure accuracy is the most critical characteristic of the robotic system, with weight 15.9% in the final importance (see Figure 6). This is due to the fact that accuracy is actually the main technical challenge of the medical procedure (i.e., the accuracy was the reason for appealing to robotic systems for the medical procedure in the first place). The patient safety is the second most important characteristic, with a weight of 15.1%. Safety is strongly correlated with the accuracy of the robotic system (since high accuracy reduces the risk associated with the needle penetrating unwanted tissue), the mechanical design of the robotic system (e.g., if the mechanism has no singularities, the safety in operation of the robotic system is in turn increased), and the control reliability (e.g., fine-tuned intelligent control may have faster reaction times than a human when anomalies are encountered during the medical procedure). The stiffness of the structure had weight 14.4%, and it is again correlated with the accuracy and safety (a perfectly stiff robotic device will have no parasite motion in its mechanical joints). The motion repeatability of the robotic system had weight 13%, and it is correlated with the robotic system accuracy and stiffness and, in turn, influences the safety in operation. The workspace of the robotic system has a total weight of 10%, and it determines the spectrum of insertion trajectories and RCM manipulation of the medical tools. All other factors (dimensions, number of components, etc.) have less than 10% weight (individually); therefore, in simple terms, the robot design should focus more on attaining the imposed accuracy level and safety rather than reducing its weight to a minimum or having a high degree of universality.

The technical characteristics defined for the robotic system were used as input data in the first QFD matrix (Figure 7) and compared with the quantifiable quality characteristics (CTQs) which are imposed by the design constraints. For a reliable solution, the patient safety, robotic system accuracy, and stiffness have a combined weight of above 50% (in the Phase 1 QFD analysis of relative importance). Following the critical correlations between these three characteristics and the design constraints shows that the development of the robotic system should mostly focus on a kinematic design that ensures the RCM architecturally, a kinematic design that has no singularities in the workspace, a technical solution that ensures stiffness such that the targeting needle positioning error is less than 2 mm, and a fail-safe control to facilitate the robotic system operation.

The next step in the analysis refers to the evaluation of the functions that the robotic system has to achieve with respect to the quantifiable characteristics defined in the first step. The functions are elaborated in

Table 2. Defined functions for the robotic system.

Function	Observations
Mounting on the side of the table	Table mounting is preferred (instead of ground mounting) to maintain a constant position (robot/patient) when the table is moved.
I-US probe attachment to the robot	The commercially available medical tools (I-US probe and therapeutic needles) must be mounted/demounted to/from the robot.
Needle module attachment to the robot
I-US probe positioning and orientation outside the body	Before manipulating the medical tools inside the body during the medical procedure, they must be positioned correctly outside the body for the medical tool insertion.
Needle positioning and orientation outside the body
I-US probe motion inside the body	The I-US must be manipulated using the RCM concept, whereas the needles are always inserted on linear trajectories.
Needle insertion on linear trajectory
Real-time tissue resistance force monitoring	Monitoring the tissue resistance reduces the risk of needle bending during the needle insertion.
Automated safety function	Using an intelligent algorithm which takes multiple real-time parameters as inputs increases the safety of the procedure and allows fast reactions for situations where trauma risk increases.
Decoupled positioning and orientation motions	Decoupling the motions may increase the precision since while the orientation is changed the Cartesian robot is stiff (there are fewer overall errors during the medical instrument manipulation).
Emergency instrument detachment	In case of hemorrhage or other complications, the surgeons must be able to intervene promptly. Easy-to-use elements that allow fast instrument demounting are required.
Sterilization	The components that are in close proximity to the patient must be detachable for sterilization purposes.
Preprocedural positional optimization	The robotic system must allow positional corrections since the target points may change due to errors and tissue elasticity.

to underline their relevance in the robotic system design. The second QFD phase is illustrated in Figure 8, and among the critical functions identified are those associated with the I-US probe motion inside the body (RCM principle) and the needle insertion on linear trajectories (pair of points), followed by decoupled positioning and orientation motions. For the medical procedure, decoupled motions have the advantage that they increase the precision (e.g., while the medical tool is orientated the position of the RCM is fixed, which, in turn, may reduce positioning errors).

The next step in the analysis refers to the evaluation of the functions that the robotic system has to achieve and the technical subsystems of the robotic system.

Table 3. Defined subsystems for the robotic system.

Subsystems	Observations
Operating table mounting solution	The subsystem fixes the robot base to the lateral side of the operation table such that the two modules operate in symmetry to each other.
Modular XYZ positioning subsystem	Due to the decoupled motion, the subsystem positions the insertion point or the RCM point in Cartesian space.
Modular YZ orientation subsystem	Due to the decoupled motion, the subsystem provides the orientation of the medical tool (I-US probe or therapeutic needle).
Instrument mounting subsystem	The subsystem provides the ability to mount the needle or the I-US probe instrument on the robotic system, increasing modularity.
Actuation subsystem	The subsystem provides the motions (the DOFs) of the robotic system.
Sensorial subsystem	The system that allows fine control of the robotic system.

describes the subsystems which compose the robotic system, whereas Figure 9 illustrates the Phase 3 QFD. The technical subsystems which have the most influence in achieving the predefined accuracy and safety aspects are the instrument mounting subsystems and the actuation subsystem, followed closely by the positioning subsystems (for the XYZ positioning and YZ orientation).

The final step in the analysis refers to the evaluation of the technical subsystems of the robotic system and its component parts. Among the most important parts of the robotic structure (see Figure 10) resulting from the analysis are the vertical and horizontal pulley boxes, the linear modules, and the circular rails. All these components are closely related with the robot architecture and they affect the accuracy of the robotic system as a whole.

3.1. HeRo Design Concept

Based on the medical protocol and the design constraints (the main purpose of which was to minimize the risk while increasing the therapeutic efficiency and reliability), a set of QFD analyses was conducted and the design of the HeRo parallel robotic system [17] emerged. Figure 11a illustrates the HeRo concept augmented into the relevant medical environment (in the operating room), whereas Figure 11b illustrates the CAD (computer aided design) of one guiding module. The following components with their technical characteristics are highlighted:

• The parallel robotic system is composed of two modules, Module 1 and Module 2, which are attachable by the operating bed (via modular attaching mechanisms) with each module being capable of guiding the needle instrument or the I-US instrument;
• The main components of each module have a total of 5 DOFs and are composed of two main mechanisms: one gantry mechanism with 3 Cartesian DOFs for the insertion point/RCM positioning (having three linear drives) and one spherical mechanism with 2 orientation DOFs for the needle trajectory or I-US probe manipulation (having two circular drives);
• The characteristics of the main components are defined by reliable motion with low friction due to the 3 linear guides and 2 circular guides (with rails based on bearing balls and carriages) and 5 servo motors with high rotation motion resolution. Each module allows a quick plug/unplug of the medical tools (needles, I-US probe) to facilitate fast intervention times, for the clinicians, in the case of unexpected patient trauma.

3.2. HeRo Concept Residual Risk Estimation

After the HeRo parallel robotic system design, the residual risks were evaluated together with other forms of risk which may be introduced by the robotic system.

Table 4. Residual risk estimation.

No.	Associated Risk	Comments	Severity	Probability	Overall Score
RR1	Linear positioning error	The risk is reduced as the position is achieved using actuators which have known positions, and furthermore, the I-US probe monitors in real time the needle insertion	50	50	100
RR2	Orientation positioning error	As the orientation error increases with depth, the severity is higher	70	60	130
RR3	Insertion depth error	The insertion depth is achieved by a dedicated actuator and monitored with the I-US probe	60	10	70
RR4	I-US probe positioning does not respect the predefined trajectory	The I-US probe positioning is controlled by actuators and can be corrected if needed	30	20	50
RR5	I-US probe is pressing too hard on the liver	The I-US module must use a force sensor to ensure the necessary safety	50	10	60
RR6	I-US cannot reach the targeted area	The robot is attached at the beginning of the procedure in a convenient way with respect to the patient	40	5	45
RR7	The I-US probe applies pressure on the abdominal wall	An efficient solution to ensure the RCM has to be used	100	40	140
RR8	The I-US probe movements are different than intended	This can occur when the RCM is improperly defined	90	30	120
RR9	Incapability of performing the procedure (the instruments cannot reach the specific liver area)	The robot is attached at the beginning of the procedure in a convenient way with respect to the patient	50	20	70
RR10	Incapability of achieving the necessary orientation for the I-US probe	Based on the defined workspace, this risk is eliminated	-	-	-
RR11	Incapability of achieving the necessary orientation for the therapeutic needle	Same as above	-	-	-
RR12	The relative patient–robot position is changed	As the robot is attached to the operating table, this risk is eliminated	-	-	-
RR13	The patient cannot be resuscitated in due time	The robot must have a quick removal protocol	100	10	110
RR14	The needle insertion cannot be monitored	The two modules should use the same controller which ensures that the pose of the two instruments is known	90	10	180
RR15	Infection risk	A robot is generally covered with a sterile plastic sheet, so this risk is eliminated	-	-	-
New identified risks
NR1	The robot has an electrical malfunction	Fail-safe state-of-the-art automation systems are highly reliable and diminish this risk	100	30	130
NR2	The robot has a mechanical malfunction	Periodical optimal maintenance is facilitated by the robotic system’s simple design and implementation	100	50	150
NR3	The robotic system guiding modules may collide	Avoided with an advanced control which is used to correlate the motion between the two modules	80	50	130

defines the risks as well as their severity and probability.

4. Discussion

Since targeted HDR brachytherapy and targeted chemotherapeutic agent delivery do not offer a therapeutic solution by today’s standards, the implementation of a technical solution (which minimizes the drawbacks of the medical procedure) may be valuable for the medical community. Based on the estimated hazards of the medical task and their occurrence risks (see Table 1), the authors proposed the HeRo concept (which resulted from an AHP and a multiphase QFD) and estimated the residual risks thereafter (see Table 4). One question still stands, which is “do the benefits of the medical procedure outweigh the residual risks?” The authors attempt to answer this from a technical point of view (since there are no relevant medical data about the therapeutic index of HDR brachytherapy and targeted chemotherapy for non-resectable HCC, one can only assume that these therapies would do more good than harm due to their positive results in other areas of the body).

The safety aspect regarding HeRo robotic system exploitation refers to the mechanical aspects of the robot and the control of the robot. Since the HeRo robotic system is composed of one gantry mechanism and one spherical mechanism, it follows that the robotic system has no singularities in the workspace. Moreover, throughout the QFD analysis, the correlation between various characteristics (e.g., accuracy, stiffness, etc.) was emphasized. Consequently, choosing technical solutions that increase accuracy (such as linear and circular guides and high-quality actuation solutions) has a positive impact on the safety as well. The mechanical solutions together with state-of-the-art automation solutions and sensors should lead to the development of a reliable experimental model for the HeRo concept.

The two modules of the HeRo parallel robotic system operate “mirrored” relative to each other, a fact that provides multiple advantages. A variety of insertion points and trajectories may be achieved since the insertion instruments (for the needle and I-US probe) may be mounted on either Module 1 or Module 2 of the robotic system. Furthermore, the simple design with decoupled motions has the advantage that it allows optimal technical maintenance of the robotic system since the robot becomes easy to assemble or disassemble.

From the three ways in which RCM manipulation may be achieved (see Section 2.1.1), following the systematic development of HeRo, the authors chose a mechanical constraint using a spherical mechanism which is located outside the patient body. Consequently, the RCM will be fully constrained, and using this approach should imply lower overall errors (with respect to other technical approaches). The errors for this case are correlated with the radius of the sphere. The advantage of a larger radius is that it increases the orientation precision. The disadvantage is that the mechanism may suffer from component elasticity, vibrations, and mechanical stress. However, the circular guides used for the HeRo design are commercially available (well calibrated and with well-known mechanical characteristics), and the elasticity of the material is insignificant.

As previously stated, assuming a 1° angular error and 1 mm linear error results in (combined) errors of 2.5 mm and 5 mm at 50 mm depth and 200 mm depth, respectively (not taking into account any needle deflection) [5], and according to [4], these values are not acceptable for the targeted treatments. Figure 12 illustrates point clouds to show the error distribution for the mentioned values in Cartesian coordinates (where the points within the point clouds are not due to a random distribution but rather computed with incrementally numerical data for the input). To evaluate the accuracy of the gantry mechanism is straightforward since there is a one-to-one dependency between the Cartesian position of the RCM point and the values of the gantry mechanism actuators. Each actuator changes only one coordinate in the Cartesian space; therefore, the error in this case will be mainly due to the quality of the mechanical design of the gantry subsystem. An example of this error propagation is illustrated in Figure 13a, where a 0.7 mm error is assumed (due to high-resolution motors and 2° maximum backlash due to the gearheads) for the actuators of the gantry mechanism. These errors are, however, minimized by using the linear guides in the robotic system design (which are well calibrated). The results are different when the errors of the spherical mechanism are considered. Assuming a maximum ±2° (angular degrees) error as the actuator backlash (which is appropriated for gearheads nowadays—see, for example, gearheads from Maxon Motors [18]) the associated error (using belts and pulleys for the motion of the carriage on the circular guides, which inherently have no backlash) is approximately 0.34 mm (due to a radius of the rails of 200 mm). This, in turn, will translate to an angular error at the center of the sphere of about 0.076° (which, by using the similar triangle rule, may double at a 200 mm insertion depth). Figure 13 shows this error distribution at two insertion depths (100 mm and 200 mm), showing the accuracy of the HeRo parallel robotic system (e.g., at 200 mm depth, the error is less than 1 mm).

An interesting solution for needle insertion was presented in [19], where the authors used US images to determine the target volume for the needle tip directly from the graphical user interface which, in turn, served as input for the robotic system actuators. This strategy is also being considered for the further development of the HeRo robotic system, specifically for the needle insertion, since it may be valuable for the accuracy of the procedure. Consequently, the needle insertion should be automated, as opposed to other medical robotic systems where the insertion of the needle is manual (see, for example, the 7-DOF robotic system found in [20]). Moreover, the authors intend to use robust control solutions (e.g., B&R automation [21]) to ensure high reliability, even though it has been proven in the past that cheaper controlling solutions may also be used (see, for example, the medical robot proposed in [22] which is controlled by a PI controller). It is also important to note that the HeRo is designed to use commercially available medical tools (such as needles and the I-US probe), which were also common in [23]. This approach (in contrast to implementing medical tools directly in the robotic system) has the advantage of reduced development cost and increased modularity (since the robotic system may be designed to work with multiple variants of the medical tools).

5. Conclusions

Due to today’s medical standards, targeted therapies such as HDR brachytherapy and chemotherapeutic agent delivery are not viable for the treatment of non-resectable HCC since the procedure involves large amounts of risks. Through a process of risk management in accordance with the ISO 14,971 standard for healthcare devices, the authors identified the risk associated with the medical procedure and proposed a new technical solution in the form of a parallel robotic system (the HeRo concept) which has the potential to facilitate patient safety during the targeted therapy of HCC. For the design of the HeRo parallel robotic system the medical protocol was defined, which, in turn, helped to establish the design constraints for the new robotic system. By considering the design constraints (with respect to the medical requirements), an AHP analysis was conducted which led to a four-step QFD. The resulting robotic system is composed of two identical independent modules (for needle and I-US probe guidance) both having RCM manipulation imbedded due to the spherical mechanism of the robotic system architecture, which has better precision of insertion (with respect to other modalities of obtaining the RCM which are not fully constrained). Moreover, the robotic system has no singularities and has decoupled motions between the positioning of the RCM and/or insertion point and the orientation of the medical tool, and these two aspects should also contribute to the overall risk reduction. The residual risks introduced by the robotic system were also evaluated, showing a reduction in hazard occurrence and severity which validates the HeRo concept as a possible technical solution for the treatment of un-resectable HCC. Future work aims to develop the first experimental model of HeRo and continue the risk management through risk evaluation (e.g., defining foreseeable sequences of events that lead to hazards) and optimization of the robotic system until it reaches the maturity level of TRL5 (technology readiness level where the prototype is evaluated in relevant environments), which will prepare the technical solution for technological transfer.