Safe design of surgical robots – a systematic approach to comprehensive hazard identification

Introduction

Following IEC 80601-2-78:2019, a surgical robot is a programmed actuated mechanism with a degree of autonomy that moves within its environment to perform intended tasks in a surgical context. Thus, surgical robots are expected to be safe although reported adverse events are numerous. Ferrarese et al. [1] analysed robotic system malfunctions in surgery between 2005 and 2014. 20.9% of which were allocated to the robot arms and instruments. Other categories were console (cart), software and optical tracking. In the US, the number of malfunctions and adverse events due to robotic systems increased between 2004 and 2013 by 2.2% [2]. Ramirez et al. [3] reported that mortality rates in radical hysterectomy were higher in robot-assisted minimally invasive surgery (MIS) than in open abdominal surgery. Regarding the use of robotic-assisted devices for women’s health, the Federal Drug Administration (FDA) published a safety warning [4].

According to the IEEE Robotics & Automation Society, the stage of maturity of medical robots is 40 years behind that of manufacturing robots [5]. Standards and regulations, e.g., for machinery (ISO 12100:2010, ISO 13849-1:2015) and collaborative robots (DIN ISO/TS 15066:2017) as well as for medical devices (Regulation (EU) 2017/745), require intrinsic safety by design as a principle to be preferred over other safety measures. Yet, from the 1980s until now, orthopaedic robots have used oversized arms with oversized power, working volumes and mass inertia [6, 7]. As a response, many solutions of smaller and safer kinematics have been developed, e.g., by Davies et al. [8], Brandt et al. [9], Shoham et al. [10], Plaskos et al. [11], Pott and Schwarz [12], Niggemeyer et al. [13], de la Fuente et al. [14] and Vossel et al. [15]. However, miniaturised robots are rarely represented on the market.

We hypothesize that the lack of safety of today’s surgical robots and the persistence of oversized kinematics is due to deficiencies in (1) hazard identification methods and (2) the regulatory process. We also assume that an integrative approach of combining methods and cataloguing hazards could improve the process of hazard identification.

Methodical background of hazard identification methods

The risk management process for medical devices defined by DIN EN ISO 14971:2020 starts with the identification of hazards. According to the standard, a hazard is a potential source of harm. The probability of occurrence of harm would be a risk. Since risks depend on circumstances, we have focused on the identification of hazards to identify those that can be linked inherently to technical solution principles.

The basis of all hazard identification methods is a process model of how a system works and how it is used. Thereupon, methods are applied to identify malfunctions and failures. A Preliminary Hazard Analysis (PHA) can be done early in product development. Prominent tools that include the identification of hazards are the Failure Mode and Effect Analysis (FMEA), the Fault Tree Analysis (FTA) and the Hazard and Operability Study (HAZOP). The FTA is deductive in terms of breaking down potential failures hierarchically to identify their causes. The FMEA, on the other hand, analyses faulty behaviour inductively so that possible consequential faults can be identified. HAZOP is a procedural approach that assumes deviations from an ideal operation that may cause an accident [16]. Guide words are used to describe the directions and extents of these deviations. Variations of these methods exist, such as Bow-Tie Analysis (based on FTA) and Hazard Identification Analysis (HAZID, based on HAZOP). Eppinger and Browning [17] presented the Technical Risk Design Structure Matrix (TR-DSM) as a tool to identify risks and hazards from interactions. For the identification of hazards in medical human-machine interactions, Janß [18] developed the HiFEM method.

However, safety can be increased if multiple established methods are combined. Potts et al. [19] demonstrated that there is always a systematic gap between two different methods due to the fact that different methods simplify a complex problem differently [20]. An additional gap occurs if emergent effects are neglected. Besides looking at local hazards, hazards that emerge from the combination of tasks must be regarded [16]. A third gap can arise from the limited perspective one may have on a problem. In product development, methods like stakeholder analysis, scenario technique or user stories support the requirements identification process by taking different viewpoints on the product. In hazard analysis workshops, members from different teams are supposed to contribute with viewpoints from different professions, departments, and lifecycle phases. However, since the perspectives of team members are subjective and depend on personal experience, comprehensiveness can further be increased if team members are guided. Predefined viewpoints could be integrated into a multi-perspective approach for hazard identification. Chan et al. [21] applied such an approach to systems of the defence industry. Although the context is different, the problem is similar in terms of addressing complex integrated systems working in a high-risk environment.

Materials and methods

The development process of the catalogue is divided into four stages: First, as many hazards as possible must be identified. Second, a structure of the catalogue must be elaborated. Afterwards, the identified hazards must be integrated into the catalogue structure and finally, the approach must be evaluated. In this paper, we present the first three stages.

As an exemplary use case, we defined a working scenario of a hypothetical surgical robot for laminectomy (spine surgery). For the comprehensive identification of hazards, we used the scenario-based PoV approach by Theisgen et al. [28] which is applicable for all kinds of surgical robots at any stage of the technical lifecycle (based on VDI 2221:2019). Since the approach is comprehensive, it encloses hazards from post-market surveillance and vigilance reporting according to the European Medical Device Regulation (Regulation (EU) 2017/745). To support integrity and be rather redundant than incomplete, the seven perspectives or “points of view” (PoV) overlap, as shown in Figure 1. These predefined perspectives are: PoV1: Conventional, PoV2: Patient, PoV3: Retrospective, PoV4: Standards, PoV5: Inherent, PoV6: Spatial and PoV7: HMI (Human-Machine Interaction).

Figure 1:

The seven perspectives of the PoV approach [28].

For each PoV, different hazard identification methods were used. For PoV1 and PoV2 we identified hazards from literature, open-source videos of surgical procedures and own field observations. Additionally, we used the HiFEM method to identify hazards of human-machine interaction [18]. For retrospection (PoV3), we identified hazards from literature and the Manufacturer and User Facility Device Experience Database (MAUDE) of the FDA. We examined the last 500 entries until January 2020 for all adverse events that were linked to the product code OLO. We then filtered the entries that were associated with surgical robots.

Regarding PoV4, we considered relevant standards for risk management (such as DIN EN ISO 14971:2020), robotics and surgical devices (such as ISO 10218-1:2012, IEC/ISO 80601-2-77:2019, ISO/TR 15066:2017, IEC 60601-1:2012, IEC/TR 60601-4-1:2017, IEC 62304:2016), usability engineering (IEC 62366:2007, IEC 60601-1-6:2016) and sterility management (DIN EN 556-1:2006, EN 27740:1992). The hazards of PoV5 that are intrinsic to mechatronic devices were mainly based on brainstorming, literature and the two databases we investigated for PoV3. For PoV6 (spatial), an environmental analysis was conducted in terms of identifying surrounding devices and persons. To determine the hazards of human-machine interaction, we used the HiFEM method to model the use process and identify and allocate characteristic hazards to the categories of cognition, perception, action and system [18].

The structure of the catalogue of hazards was designed to serve the PoV approach. During the development process of a robotic system, the different PoVs can be applied successively. Thus, the catalogue grew with the detected hazards. When structuring the catalogue, we used the definitions of DIN EN ISO 14971:2020. To be generic and reusable for other developments, the catalogue aims to collect only hazards, which must be transferred to risks using case-specific risk analysis, afterwards. In contrast to the FMEA, where cause, failure and countermeasure focus on a certain level of consideration (e.g., the assembly process), our approach aims to trace back any hazardous situation to original hazards, of which some can be inherently linked to functions or technical solution principles.

Results

The structure and initial content of the CoH were created by applying the PoV approach to laminectomy. As a first step, categories were defined to ease utilisation. For classification, the definition of “hazard” according to DIN EN ISO 14971:2020, which is a potential source of harm, resulted in being too fuzzy and ambiguous. For instance, two persons could describe the same hazard with different words and not see the commonality. The same hazard would then appear twice in the CoH. Furthermore, a consequence of a hazard could be misinterpreted as a hazard itself, overlooking the actual underlying hazard. Accordingly, a derived safety measure would address the consequence of a hazard and not the cause.

As a solution, we used three auxiliary definitions: the hazard object (who or what is directly afffected by the hazard, HO), the hazard subject or carrier (who or what carries the hazard, HC) and the hazardous property (HP) of the carrier. For instance, a “worn burr” can be seen as a hazard according to DIN EN ISO 14971:2020, but also “blunt blades”. The latter contains more information and emphasizes that every tool with blunt blades carries the regarded hazard. By encouraging the user to first define an HC (blade) and then the HP (blunt), specificity is increased. Consequently, the HP is extendable to other HCs as it becomes more independent from the device it is used in. “Blunt blades” is a hazard of burrs, drills, saws and other principles of mechanical cutting. The simple distribution of a hazard into object, carrier and property also eases projecting archived hazards onto new developments and linking them with technical design principles. Another benefit is the possibility of systematically analysing the CoH by filtering, sorting, categorising and refining causes, consequences and affected persons or objects.

In many cases of hazard analyses, not hazards but harm and hazardous situations are identified. As a response, the CoH connects hazards with hazardous situations by going backwards through a chain of actions or states that happen sequentially from hazard to hazardous situation. As we aimed to identify hazards and not resulting situations, it is not important in the first place if the hazardous situations are specific or ambiguous. On the contrary, the possibility to start with different and subjective inputs to result in a specific but widely suitable hazard eases the use of the CoH.

However, through the concretisation and systematisation of hazards, we were able to integrate other associated aspects into the CoH and increase analysability. Following the HiFEM method, we provide the possibility to link each hazard with one of the four categories system, perception, cognition or action. Furthermore, the type of socio-technical safety measures and lessons learned can be linked to a hazard. Nevertheless, we aimed to create as little overhead as possible when cataloguing hazards. Therefore, we provide the presented associated aspects as optional input parameters that can be filled out any time after hazard identification. As mandatory we recommend linking hazards directly to the underlying detection methods (e.g., brainstorming, HiFEM). Thereby these methods can be evaluated and improved at any time.

For the use case of laminectomy, we were able to identify 133 different hazards, associated with 108 different hazardous situations using the PoV approach and the CoH. The distribution of hazards among the PoVs is shown in Figure 2. 34 hazards were found with PoV1, 10 with PoV2, 36 with PoV3, 3 with PoV4, 34 with PoV5, 12 with PoV6 and 40 with PoV7. 26 Hazards of PoV3 were found in literature, 10 in the recalls database and 0 in the MAUDE database.

Figure 2:

Distribution of the identified hazards among the PoVs.

After analysing the MAUDE database for OLO over the last 500 entries (state 01/01/2020), 330 (66%) could be assigned to robotic systems. The entries range from 08/2017 to 12/2019. Named robots were Mazor X (Medtronic PLC, Dublin, IRL), ROSA Spine and Brain (Zimmer Biomet Holdings Inc., Warsaw, US), NAVIO (Smith & Nephew PLC, London, UK) and MAKO (Stryker Corp., Kalamzoo, US). MAKO was sometimes referred to as RIO, the former version. Figure 3 shows the results for the robotic systems. The failure descriptions were too generic to derive concrete hazards for our use case. However, we were able to define eight categories of failures based on keywords that appeared in the descriptions. “Mechanical” includes all failures that contain at least one of the keywords fracture, break, crack, or mechanical. “Precision” comprises inaccuracy and positioning errors.

Figure 3:

Failure categories and consequences of OLO robots according to the MAUDE database.

The analysis of the Medical Device Recalls database for systems of the product code OLO yielded 62 hits, of which 24 (39%) were attributable to the MAKO system. Other referenced robots were Navio, Mazor X, ROSA Spine, TCAT (THINK Surgical Inc., Fremont, US), Cirq (Brainlab AG, Munich, DE), and OMNIBotics (Corin Group PLC, Cirencester, UK). Each of the aforementioned systems accounted for less than 5%. Except for one Class 3 entry (lowest risk), all recalls were Class 2.

Discussion and conclusion

Adverse events of orthopaedic surgical robots are frequent and often address mechanical deficiencies. Severe hazards are inherent to powerful and oversized robotic arms derived from industrial applications. Different methods for hazard identification exist, such as PHA, FTA, FMEA, HAZOP or HiFEM. However, each method has its strengths and perspectives. The presented PoV approach provides an opportunity to objectify and combine those methods and open the view for transferable hazards from literature, standards and databases. The application of the PoV approach to the use case of robotic laminectomy resulted in 133 hazards, mainly coming from HMI analysis, the surgical procedure and literature. Since articles on robotic laminectomy have not yet been published, literature only delivers transferable hazards from similar use cases. Subsequent risk analysis is needed to assess their relevance. We presented the CoH as a means by which identified hazards can be collected and made available for future risk analyses.

We set four main requirements for the CoH and PoV approach. Regarding the first, “applicability at all stages of development” is guaranteed because of the scenario-based approach and the predefined PoVs. While for PoV1-2 the robotic concept can be unknown, it becomes more relevant in PoV3-6. Eventually in PoV7, a concrete user-interaction scenario with the specific concept or even prototype must be assumed. With goal-oriented scenarios that are independent of predecessors, predicate creep is systematically prevented.

Second, “comprehensiveness” is increased since PoVs overlap and hazards appear redundantly. For instance, in PoV1 we detected the loose fixation of an instrument or tracking array as a hazard already occurring in navigated surgery. In PoV3 the same hazard appeared as it was reported for robotic applications. Although hazards could not be derived from the MAUDE database, mechanical issues have been identified as important. Finally, the PoV approach supports the consideration of inner (inherent to the system), outer (environment and stakeholders) and historical (state of development, experiences) factors.

The third aspect, “compatibility” with design methodology, is given, since the division of hazards into HC, HO and HP enables the objective assignment of hazards to technical functions, solution principles and concepts.

The fourth requirement, “simple to use”, must be evaluated with a larger group of users in the future. User satisfaction is highly dependent on the design of the user interface, which has not been implemented, yet.

Further limitations of the presented approach are as follows: The catalogue was developed only on the basis of a theoretical application scenario. A development-accompanying hazard identification up to the manufacturing of a product was not carried out. In addition, only a small group of engineers used the hazard identification methods described.

As a next step, the PoV and CoH approach should be applied during the entire robot development process. Moreover, the number of persons involved in the application of the PoV approach should be increased. Medical professionals should be involved especially in PoV1-2. The utility of the catalogue as a database for performing risk analyses also remains to be evaluated. As mentioned earlier, the structure of the CoH allows linkage to technical solutions. Thus, technical solutions in terms of countermeasures could be integrated into the catalogue. Hazardous situations could further be classified into technical and human-induced situations.

We conclude that the PoV approach and the CoH can sustainably improve the development process of surgical robots and prevent predicate creep. To exploit the full potential of linking hazards to solution principles, a complementary design methodology is being developed at the Chair of Medical Engineering of RWTH Aachen University. Based on surgical reference functions as the lowest common denominator, solution principles of various robotic systems can be linked to the CoH.