Cosylab delivers Controls and Safety for the HITRIplus Project
Turning advanced heavy-ion beams into everyday care
Heavy-ion therapy promises highly precise cancer treatment, but only when control and safety systems work seamlessly around the beam.
Cosylab’s task in HITRIplus (Heavy Ion Therapy Research Integration plus) project was to take the most advanced accelerator ideas in the world and make them usable, safe and maintainable in a clinical setting.
Cosylab as leader of Work Package 9 (Controls and Safety), and in close collaboration with MedAustron, SEEIIST and the Jožef Stefan Institute (IJS), set out to define how treatment excellence looks like for modern therapy rooms, accelerators and patient safety. Cosylab had to describe, in practical terms, how to build radiation treatment control systems that are ready for the next decade of innovation.
This blog describes what we studied, designed and learnt, and how this picture of the state of the art can help clinical facilities plan new capabilities or upgrade existing ones.
Where HITRIplus meets the clinic
HITRIplus brings together the European community working on heavy-ion cancer treatment, comprising major physics laboratories, ion therapy centres, research institutions, universities, and innovative companies.
The programme looks beyond particular subsystems and components, and considers how the entire system fits together, from beam generation to patient treatment.
Cosylab examined the three areas that determine whether a therapy centre operates safely and efficiently on a daily basis.
First, the Treatment Control System (TCS). It is the software environment of the radiotherapy clinician that helps identify the patient, verify the plan, prepare the treatment room, perform checks, and approve and execute the irradiation.
When the session ends, the same system creates the treatment records and provides the clinical team with the necessary evidence for clinical review and regulatory traceability.
The Accelerator Control System (ACS) delivers the specified beam at the right instant and in the exact location (placement).
It coordinates timing, machine states, diagnostics and protection interfaces of a complex assembly of equipment. When new capabilities arrive, such as multi-energy extraction or compact superconducting gantries, the ACS must evolve with the upgrades without issues.
The Patient Safety System (PSS) provides independent protective layers that safeguard patients, staff, and equipment.
In Europe, for example, particle therapy accelerators and their safety control elements fall under the Medical Device Regulation (MDR) 2017/745, which defines how the system is engineered, tested and maintained.
Cosylab’s assignment in HITRIplus was simple on paper, yet demanding to execute. We had to document the state of the art in the mentioned three areas, then produce design studies that are technically credible, clinically coherent and ready for adoption.
What we delivered, and when
We released our work in four primary outputs during the project timeline. In March 2022, we published an Intermediate State-of-the-Art Report, which established a shared baseline and a common vocabulary among HITRIplus partners.
It describes how treatment, accelerator functionality, and safety systems are typically built today, how they interact, and what problems may occur at the intersection of clinical requirements, regulatory obligations, and innovative techniques.
In September 2022, we produced a forward-looking Design Study on Treatment Room Control Systems, which modelled the real clinical workflow, reduced the cognitive load at critical moments, and made the system change-proof.
Rather than treating Plan QA, Simulation and Treatment as separate worlds, we analysed their common structure and identified a single workflow backbone with clear bounds.
We proposed separating the workflow logic, device coordination, and presentation to the operator, so that the most safety-critical system parts could be thoroughly tested and reused with confidence.
In January 2025, we finalised a Design Study on Accelerator Control Systems. Namely, HITRIplus explores novel hardware concepts, such as upright patient positioning, multi-ion operation, faster cycling with multi-energy extraction, and new gantry designs.
These place new demands on timing, synchronisation and control of the system.
The study set out the requirements and a reference architecture that keeps fast control loops close to the hardware, exposes capabilities through clear interfaces, and allows higher-level orchestration to remain stable as system features evolve.
Finally, in July 2025, we delivered a Design Study on Patient Safety Systems. In it, we defined how the system that monitors key beam parameters and terminates delivery in case of anomalies acts independently and decisively, even when other subsystems misbehave.
We framed requirements so that they can be verified, with explicit timing bounds, detection thresholds and failure modes.
We also treated usability as part of safety, emphasising the use of unambiguous workflows for recovery and escalation – without cryptic alarms, unclear responsibilities and inconsistent messages that lead to mistakes in a stressful environment.
The common thread among all four documents is consistency in design for the machine from the outset, which, in turn, features a sophisticated architecture that facilitates the adoption of new physics clinically without necessitating sweeping reconstructions.
How we approached our task
We grounded our approach by always following the three steps:
- Begin with the clinical day.
- Work backwards to the technology.
- Keep verifying throughout.
This approach allowed us to familiarise ourselves with the process (workflow) and consistently reduced errors and stress.
Beginning with the clinical day means following the patient journey end-to-end, not only the moments when the beam is on.
Once a patient is referred, the clinical team acquires the planning images, creates the contours, and develops the treatment plan.
When treatment day comes, the team needs confidence that the plan, the devices in the room, the setup of the accelerator and the safety interlocks are all aligned.
By working back to the technology, we tapped the day-to-day experience of MedAustron as a running clinical facility, whose staff also led key parts of the safety work. Their feedback filtered out ideas that seemed elegant on paper but would be fragile in practice.
The forward-looking perspective of SEEIIST (South East European International Institute for Sustainable Technologies) ensured we kept the needs of emerging regional centres in focus. They challenged us to consider affordability, staffing and sustainability as design influencers, not constraints to be tolerated.
The analysis and simulation strengths of IJS (Institute Jožef Stefan) contributed to the analysis and verification, including the simulation approaches that enable faster and safer commissioning.
We used workshops with accelerator physicists, medical physicists, radiotherapy technologists and control engineers to test assumptions.
These sessions revealed that future techniques will arrive steadily, such as arc-like deliveries, upright positioning, multi-ion sequencing, and perhaps FLASH in research phases — and that the software controlling the beam should not fail each time a new technology is introduced to the medical device. We concluded that the correct response is a structure that can accept new capabilities and express them as configuration, not as one-off rewrites.
We kept verifying throughout.
In each study, we wrote testable requirements and encouraged the use of simulators and digital twins to ensure that commissioning and change control can occur safely, without tying up clinical hardware.
We treated logs and telemetry as first-class items so that faults could be understood and prevented, not merely reset.
Treatment Control System: a critical treatment subsystem, open to future techniques
The design study for the Treatment Control System demands that the operator’s workplace be predictable and have a straightforward interface.
People should be able to make crucial decisions with confidence, even in the face of time pressure and a noisy environment.
Device states, such as couch position, gantry angle, imaging readiness, and immobilisation devices, must be clearly displayed and tied back to the treatment plan.
Workflow approvals should accurately reflect the operator’s intent rather than hidden side effects.
Under the surface, the design separates the workflow state machine from device orchestration and from the user interface.
The TCS communicates with the ACS and PSS through deterministic handshakes where ready-to-treat, beam permit, pause, terminate, and post-treatment reporting are well-defined messages with clear responsibilities.
How the treatment control system connects with the other subsystems.
This structure also prepares the ground for future upgrades, such as upright positioning and additional device states and checks; however, the backbone of the workflow remains the same.
For control system teams, it means that new ideas can be implemented without destabilising the entire system.
Accelerator Control System with scaling orchestration
The ACS study addresses a different set of priorities. While current control systems are already orchestrating complex accelerator behaviours, HITRIplus pushes that complexity further.
We propose a reference architecture that keeps fast, timing-critical control and protection close to the hardware in FPGAs, PLCs or embedded controllers. Above that, subsystem supervisors coordinate devices within well-understood islands.
At the top, an orchestrator arranges machine modes, room scheduling, and beamline arbitration. Between layers, we define clean contracts so that changes in one area do not ripple unpredictably across the facility.
The design uses a common timing and event system.
We also draw a careful boundary between deterministic parts of the system and less time-sensitive services such as configuration, reporting and analytics, so that facilities may choose modern technologies where appropriate without risking timing behaviour.
The ACS design also prioritises security and maintainability, incorporating role-based access, network segmentation, and secure update processes.
The software tiers and networking.
Rich, structured telemetry enables engineers to diagnose issues quickly and fosters a culture of continuous improvement, rather than relying on firefighting issues.
The Patient Safety System guarantees independence, clarity, and verifiability.
The PSS study is grounded in first principles, where the system must prevent hazardous situations whenever possible, detect them when they occur, and terminate beam delivery safely and promptly when necessary.
It must also help the team recover in a controlled way. We define what is monitored—spot position, size, energy and particle rate—and how independence is maintained. We specify time bounds for termination, expectations for self-tests, and behaviours in degraded modes.
In parallel, the study places the human factors at the centre, stressing unambiguous messages, consistent terminology, and clear ownership. At the same time, cybersecurity is also integral to safety, as a compromised system cannot be trusted to protect patients.
All of this aligns with the framework of MDR 2017/745 and associated standards, including those related to the software lifecycle and usability. The intent is to make compliance natural rather than painful.
Tips for heavy-ion therapy centers planning the next step
If you operate a heavy-ion therapy facility or plan to build one, our practical conclusions are straightforward.
- You should specify systems by the behaviours you need, not by the brand names of components.
- Write down the specifications for the interfaces between treatment control, accelerator control, and the safety system, and verify them thoroughly.
- Create a budget for simulation and test harnesses from the start, which will pay for themselves later by avoiding downtime and lowering the overhead of change requests.
- Treat usability as part of safety and design a clean, legible workflow that reduces error-prone workarounds.
- Take regulatory compliance seriously from day one, because it shapes the system architecture as much as physics does.
With these principles in place, innovation becomes a series of planned steps for a facility rather than a string of exceptions. Upright positioning, arc-like deliveries or multi-ion capabilities can be introduced without redesigning system foundations.
Summary of Cosylab’s studies: clarity that carries forward
HITRIplus challenged the European heavy-ion therapy community to think bigger about their systems, specifically by moving beyond mere components towards integrated, future-proof clinical systems.
Cosylab’s contribution in Work Package 9 was to make this integration tangible.
We studied the state of the art and then produced design studies for the Treatment Control System, the Accelerator Control System, and the Patient Safety System, which are now ready to guide real projects.
Throughout, we collaborated with MedAustron, SEEIIST, and IJS to ensure the proposals remained grounded.
The unifying idea is clarity: clear interfaces, clear responsibilities, clear operator workflows and precise safety semantics. With clarity, innovation becomes adoptable and compliance becomes manageable. But most importantly, with clarity, advanced heavy-ion beams can become reliable for daily cancer care.
—
Note
Project website: https://www.hitriplus.eu/
This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 101008548. This blog reflects only the author’s view, and the Commission is not responsible for any use that is made of the information it contains.