Hazard Management in Robot-Assisted Mammography Support
Organizations: Department of Computer Science, University of York, York, United Kingdom · York and Scarborough Teaching Hospitals NHS Foundations Trust, York, United Kingdom · York Law School, University of York, York, United Kingdom · School of Physics, Engineering and Technology, University of York, York, United Kingdom
Abstract
Robotic and embodied-AI systems have the potential to improve accessibility and quality of care in clinical settings, but their deployment in close physical contact with vulnerable patients introduces significant safety risks. This paper presents a hazard management methodology for MammoBot, an assistive robotic system designed to support patients during X-ray mammography. To ensure safety from early development stages, we combine stakeholder-guided process modelling with Software Hazard Analysis and Resolution in Design (SHARD) and System-Theoretic Process Analysis (STPA). The robot-assisted workflow is defined collaboratively with clinicians, roboticists, and patient representatives to capture key human-robot interactions. SHARD is applied to identify technical and procedural deviations, while STPA is used to analyse unsafe control actions arising from user interaction. The results show that many hazards arise not from component failures, but from timing mismatches, premature actions, and misinterpretation of system state. These hazards are translated into refined and additional safety requirements that constrain system behaviour and reduce reliance on correct human timing or interpretation alone. The work demonstrates a structured and traceable approach to safety-driven design with potential applicability to assistive robotic systems in clinical environments.
Figures & tables
| Guide Word | Definition |
|---|---|
| Omission | Original: The service is never delivered, i.e., there is no communication. |
| Adapted: The robotic service is not performed when required (e.g., the robot fails to detect a user request or does not deliver assistance). | |
| Commission | Original: A service is delivered when not required, i.e., there is an unexpected communication. |
| Adapted: A robotic service is performed without a valid trigger (e.g., the robot initiates movement or communication without user command or environmental justification). | |
| Early | Original: The service (communication) occurs earlier than intended. This may be absolute (i.e., early compared to a real-time deadline) or relative (early with respect to other events or communications in the system). |
| Adapted: The robotic service occurs earlier than intended, such as the robot responding before a task condition is met or interrupting the user prematurely. This may be absolute or relative . |
| ID | Description |
|---|---|
| Functional requirements | |
| The system shall respond to radiographer commands (manual or voice input) in <1 second | |
| The system shall be able to determine the stage of the screening process (positioning, imaging, transitioning, etc.) | |
| The system shall be able to identify and adjust the position of the end-effectors under the patient’s arms based on input from the radiographer or sensors | |
| The system shall assist the patient in achieving and maintaining the required posture with an accuracy of ±5 mm | |
| The system shall enable fine adjustments to end-effector positioning (±2 mm) as instructed by the radiographer | |
| ID | Original requirement summary | Refined requirement / added constraint | Methodology |
|---|---|---|---|
| Respond to radiographer commands in <1 second | Command execution shall only occur once all safety preconditions are satisfied (initialisation complete, posture valid, patient ready). The response-time requirement applies after gating. | SHARD | |
| Determine the stage of the screening process | Stage identification shall be validated against contextual cues (arm pose, image index, patient readiness). Inconsistencies shall trigger operator confirmation rather than automatic progression. | SHARD | |
| Identify and adjust end-effector position based on radiographer or sensors | End-effector adjustments shall be inhibited when posture confidence is low or an interruption is active. Manual overrides shall not bypass safety constraints. | SHARD, STPA | |
| Assist patient posture with ±5 mm accuracy | Posture assistance shall only be applied after posture stability is confirmed for a minimum dwell time. Detected instability shall pause motion automatically. | SHARD, STPA | |
| Enable fine adjustments (±2 mm) | Fine adjustments shall be previewed before execution and constrained within predefined safety envelopes to prevent excessive or unintended motion. | SHARD | |
| Detect major posture changes between X-rays | Major posture changes shall automatically pause the workflow and require revalidation before progression to planning or exposure. | SHARD, STPA |
| ID | Description | Method. |
|---|---|---|
| Safety-critical actions (e.g., motion initiation, X-ray exposure, patient release) shall not be enabled through a single user action alone, but shall require multi-step or multi-source confirmation. | SHARD | |
| The system shall enforce a minimum stabilisation period following posture changes, interruptions, or re-positioning before allowing motion planning or X-ray exposure. | SHARD | |
| The system shall clearly indicate when automated decisions (e.g., posture detection or trajectory validation) are provisional, unstable, or awaiting confirmation. | STPA | |
| Following any interruption, detected fault, or unexpected patient movement, the system shall require revalidation of posture, trajectory, and patient readiness before resuming motion or exposure. | SHARD, STPA | |
| X-ray exposure shall remain locked until posture stability, arm immobility, patient assent, and radiographer confirmation are simultaneously satisfied. | SHARD, STPA | |
| Upon fault detection, interruption, or session abandonment, the system shall transition the robot to a predefined low-force, low-rigidity safe posture prior to user intervention. | SHARD |
Robot Safety
Robot safety studies how to prevent harmful physical actions while enabling robots to complete tasks around people and in uncertain environments.
See all 229 papers