cs.ROApr 7, 2026
SaveHazard Management in Robot-Assisted Mammography Support
Organizations: Department of Computer Science, University of York, York, United Kingdom · York and Scarborough Teaching Hospitals NHS Foundations Trust, York, United Kingdom · York Law School, University of York, York, United Kingdom · School of Physics, Engineering and Technology, University of York, York, United Kingdom
Abstract
Robotic and embodied-AI systems have the potential to improve accessibility and quality of care in clinical settings, but their deployment in close physical contact with vulnerable patients introduces significant safety risks. This paper presents a hazard management methodology for MammoBot, an assistive robotic system designed to support patients during X-ray mammography. To ensure safety from early development stages, we combine stakeholder-guided process modelling with Software Hazard Analysis and Resolution in Design (SHARD) and System-Theoretic Process Analysis (STPA). The robot-assisted workflow is defined collaboratively with clinicians, roboticists, and patient representatives to capture key human-robot interactions. SHARD is applied to identify technical and procedural deviations, while STPA is used to analyse unsafe control actions arising from user interaction. The results show that many hazards arise not from component failures, but from timing mismatches, premature actions, and misinterpretation of system state. These hazards are translated into refined and additional safety requirements that constrain system behaviour and reduce reliance on correct human timing or interpretation alone. The work demonstrates a structured and traceable approach to safety-driven design with potential applicability to assistive robotic systems in clinical environments.
Figures & tables
Figure 1: The MammoBot bimanual assistive system. ( a ) System overview depicting an X-ray mammography machine mock-up we used for testing purposes, the bimanual robotic manipulation platform with end-effectors, and the thermal imaging system. ( b ) Proof-of-concept 3D-printed end-effectors we co-designed with York Hospital (UK) radiographers and radiologists (red), fitted to two Franka Research 3 robotic arms. Tests conducted at our York Institute for Safe Autonomy lab on a 50kg human-weighted mannequin equipped with force/torque sensors confirmed the need for a bimanual configuration to safely support patients in the required mammography positions, and determined the necessary robotic-arm payload range (8–14 kg, depending on user weight and required level of support).
Figure 2: MammoBot end-effectors for patient positioning and support. ( a ) Right end-effector in the closed configuration (lowered blue “paddle”) to support the upright, forward-facing posture required for the craniocaudal (CC) view. (b) The same end-effector in the open configuration (raised blue arm-supporting “paddle”) to assist the angled, oblique stance with the arm raised for the mediolateral oblique (MLO) view.
Figure 3: Stills from a demonstration video [ 59 ] showing the proof-of-concept MammoBot system being tested with the help of a research team member in our testbed at the University of York’s Institute for Safe Autonomy. The two 3D-printed end-effectors from Figure 2 are mounted on Franka Research 3 robotic arms and used to help the researcher adopt the positions required for mammography in front of the X-ray mock-up from Figure 1 a: (a) the raised right end-effector paddle brings the person’s arm up for mediolateral oblique (MLO) imaging; (b) the robot arms and end-effectors support the transition between MLO and craniocaudal (CC) imaging positions; and (c) the end-effectors push forward slightly to help the person assume the CC-imaging posture.
| Guide Word | Definition |
|---|---|
| Omission | Original: The service is never delivered, i.e., there is no communication. |
| Adapted: The robotic service is not performed when required (e.g., the robot fails to detect a user request or does not deliver assistance). | |
| Commission | Original: A service is delivered when not required, i.e., there is an unexpected communication. |
| Adapted: A robotic service is performed without a valid trigger (e.g., the robot initiates movement or communication without user command or environmental justification). | |
| Early | Original: The service (communication) occurs earlier than intended. This may be absolute (i.e., early compared to a real-time deadline) or relative (early with respect to other events or communications in the system). |
| Adapted: The robotic service occurs earlier than intended, such as the robot responding before a task condition is met or interrupting the user prematurely. This may be absolute or relative . |
Table 1: Original and adapted SHARD guide word definitions for robotics.
Figure 4: UML activity diagram of the MammoBot process. Rounded rectangles denote actions, diamonds represent decision points, with negated guards (e.g., ) indicating false outcomes. Sensor inputs and human commands are shown explicitly to highlight human–robot interaction. Actor annotations (A: automated; M: manual; SA: semi-automated) indicate control responsibility at each stage.
| ID | Description |
|---|---|
| Functional requirements | |
| The system shall respond to radiographer commands (manual or voice input) in <1 second | |
| The system shall be able to determine the stage of the screening process (positioning, imaging, transitioning, etc.) | |
| The system shall be able to identify and adjust the position of the end-effectors under the patient’s arms based on input from the radiographer or sensors | |
| The system shall assist the patient in achieving and maintaining the required posture with an accuracy of ±5 mm | |
| The system shall enable fine adjustments to end-effector positioning (±2 mm) as instructed by the radiographer | |
Table 2: MammoBot system requirements.
Figure 5: STPA-based user error analysis for the MammoBot breast screening process. For each action node, potential UCAs are identified and listed beneath the corresponding stage. Each UCA is annotated with a circular role marker indicating the primary source of the unsafe action: R denotes a radiographer-related user error, while P denotes a patient-related user error. The bottom row of the diagram lists CUEs, which are generic user-error patterns that may occur in any step of the process, regardless of the specific task.
| ID | Original requirement summary | Refined requirement / added constraint | Methodology |
|---|---|---|---|
| Respond to radiographer commands in <1 second | Command execution shall only occur once all safety preconditions are satisfied (initialisation complete, posture valid, patient ready). The response-time requirement applies after gating. | SHARD | |
| Determine the stage of the screening process | Stage identification shall be validated against contextual cues (arm pose, image index, patient readiness). Inconsistencies shall trigger operator confirmation rather than automatic progression. | SHARD | |
| Identify and adjust end-effector position based on radiographer or sensors | End-effector adjustments shall be inhibited when posture confidence is low or an interruption is active. Manual overrides shall not bypass safety constraints. | SHARD, STPA | |
| Assist patient posture with ±5 mm accuracy | Posture assistance shall only be applied after posture stability is confirmed for a minimum dwell time. Detected instability shall pause motion automatically. | SHARD, STPA | |
| Enable fine adjustments (±2 mm) | Fine adjustments shall be previewed before execution and constrained within predefined safety envelopes to prevent excessive or unintended motion. | SHARD | |
| Detect major posture changes between X-rays | Major posture changes shall automatically pause the workflow and require revalidation before progression to planning or exposure. | SHARD, STPA |
Table 3: Refinement of MammoBot system requirements based on SHARD and STPA analyses. Each requirement retains its original identifier, while the methodology column provides direct traceability to the safety analysis (SHARD and/or STPA) that informed the refinement.
| ID | Description | Method. |
|---|---|---|
| Safety-critical actions (e.g., motion initiation, X-ray exposure, patient release) shall not be enabled through a single user action alone, but shall require multi-step or multi-source confirmation. | SHARD | |
| The system shall enforce a minimum stabilisation period following posture changes, interruptions, or re-positioning before allowing motion planning or X-ray exposure. | SHARD | |
| The system shall clearly indicate when automated decisions (e.g., posture detection or trajectory validation) are provisional, unstable, or awaiting confirmation. | STPA | |
| Following any interruption, detected fault, or unexpected patient movement, the system shall require revalidation of posture, trajectory, and patient readiness before resuming motion or exposure. | SHARD, STPA | |
| X-ray exposure shall remain locked until posture stability, arm immobility, patient assent, and radiographer confirmation are simultaneously satisfied. | SHARD, STPA | |
| Upon fault detection, interruption, or session abandonment, the system shall transition the robot to a predefined low-force, low-rigidity safe posture prior to user intervention. | SHARD |
Table 4: Additional safety requirements identified through the SHARD and STPA hazard analyses.
More in this topic
Robot Safety
Robot safety studies how to prevent harmful physical actions while enabling robots to complete tasks around people and in uncertain environments.
See all 229 papers