IAEA E-learning Program Safety and Quality in Radiotherapy

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Sections: 9.1 Purpose and principles 9.2 Treatment planning 9.3 Information transfer 9.4 Calibration We will first look at the purpose and principles of Fault Tree Analysis and then perform demonstration Fault tree Analyses for treatment planning, Information transfer and calibration failures.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Module objectives To introduce and demonstrate fault tree analysis as a safety tool for radiotherapy. To perform partial fault tree analyses for situations that resemble the three actual incidents that we have discussed during this e-learning program. In module 9, we will introduce and demonstrate fault tree analysis as a safety tool for radiotherapy. And then we will perform partial fault tree analyses for situations that resemble the three actual incidents that were discussed earlier: treatment planning, information transfer, and calibration failures. As mentioned  in Module 8, examining situations under which three major incidents occurred gives us the opportunity to present and discuss a variety of safety strategies.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Sections: 9.1 Purpose and principles 9.2 Treatment planning 9.3 Information transfer 9.4 Calibration We’ll start by discussing the purpose and principles of Fault Tree Analysis.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles OBJECTIVES To examine the anatomy of a fault tree. To appreciate the relationship between fault tree analysis and failure modes and effects analysis. To explore the similarities and differences between fault tree analysis and root cause analysis. To develop a simple demonstration fault tree based on the example used in module 8.1. Here are the objectives of this section: We will: examine the anatomy of a fault tree, appreciate the relationship between fault tree analysis and failure modes and effects analysis, explore the similarities and differences between fault tree analysis and root cause analysis and finally, develop a simple demonstration fault tree based on the example we used in module 8.1.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Approaches to Quality Management Incident learning systems are used retroactively to analyze incidents that have occurred or proactively to analyze potential incidents (near misses). Failure modes and effects analyses (FMEA) and fault tree analyses (FTA) are (typically) used prospectively to analyze systems for weaknesses. We will start the discussion with a reminder of where Fault Tree Analysis fits into a comprehensive quality/safety program. Incident Learning Systems are used reactively to analyze incidents that have occurred or proactively to analyze potential incidents or near misses. Failure Modes and Effects Analyses and Fault Tree Analyses are (typically) used prospectively to analyze systems for weaknesses.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles What’s the purpose of a fault tree analysis? Fault tree analysis (FTA) is a visual tool that helps us to trace the propagation of an error from its basic or root cause through to a postulated failure. When developed, an FTA can help us: Identify possible systemic program weaknesses. Place impediments to error propagation such as barriers and checks (QA and QC). So what’s  the purpose of a fault tree analysis? Fault Tree Analysis is a visual tool that helps us to trace the propagation of an error from its Basic or Root Cause through to a postulated Failure. When developed, an FTA can help us: To identify possible systemic program weaknesses and to place impediments to error propagation such as barriers and checks (QA and QC)

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Where does fault tree analysis fit into a clinical quality management and patient safety program? Fault tree analysis (FTA), complements failure modes and effects analysis being a prospective approach to quality and safety. It is important to realize that a failure modes and effects analysis (FMEA) does not and cannot replace learning from incidents. So where  does Fault Tree Analysis fit into a clinical quality management and patient safety program? Fault Tree Analysis (FTA), complements Failure Modes and Effects Analysis being a prospective approach to quality and safety. It’s important to realise that a failure modes and effects analysis does not and cannot replace learning from incidents.  

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles OBJECTIVES To examine the anatomy of a fault tree. To appreciate the relationship between fault tree analysis and failure modes and effects analysis. To explore the similarities and differences between fault tree analysis and root cause analysis. To develop a simple demonstration fault tree based on the example used in module 8.1. First, we examine the anatomy of a Fault Tree.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Nuclear Explosion Pressure control system fails Can’t retract fuel rods Pump fails Pressure release valve fails Fuel rods stick Manual retraction under repair O Ring hardened Motor burns out Event/situation/circumstance AND OR What does a fault tree look like? This is what a Fault Tree looks like. This is only an illustration and definitely not a real Fault Tree.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Nuclear Explosion Pressure control system fails Can’t retract fuel rods Pump fails Pressure release valve fails Fuel rods stick Manual retraction under repair O Ring hardened Motor burns out Event/situation/circumstance AND OR What does a fault tree look like? What are the components of a Fault Tree? Boxes on the Fault Tree are used to describe events, situations, circumstances including basic causes. Lots of examples of what might go into these boxes will be presented in the subsequent sections of this Module.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Nuclear Explosion Pressure control system fails Can’t retract fuel rods Pump fails Pressure release valve fails Fuel rods stick Manual retraction under repair O Ring hardened Motor burns out Event/situation/circumstance AND OR What does a fault tree look like? Boxes are connected by gates. This shows an “OR” gate. If either of the 2 events to the right of the gate is present then the event to the left of the gate will occur. It is, of course, possible for more than 2 boxes to feed into a gate.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Nuclear Explosion Pressure control system fails Can’t retract fuel rods Pump fails Pressure release valve fails Fuel rods stick Manual retraction under repair O Ring hardened Motor burns out Event/situation/circumstance AND OR What does a fault tree look like? An “AND” gate in a Fault Tree means that both events to the right of the gate have to be present for the event to the left of the gate to occur.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Fault Tree Analysis Fault tree analyses are extensively used in high risk, high reliability industries such as the chemical, nuclear and aviation industries. Fault trees can be descriptive or include probabilities for the various failure pathways. Fault tree analyses are particularly useful for tracing the effects of equipment failures. Fault Tree Analyses are extensively used in high risk, high reliability industries such as the chemical, nuclear and aviation industries. Fault Trees can be descriptive or include probabilities for the various failure pathways. Industrial fault tree analyses are particularly useful for tracing the effects of equipment failure. However, 60-80% of incidents in medicine are considered to result from human factors in contrast to the experience in industry.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles OBJECTIVES To examine the anatomy of a fault tree. To appreciate the relationship between fault tree analysis and failure modes and effects analysis. To explore the similarities and differences between fault tree analysis and root cause analysis. To develop a simple demonstration fault tree based on the example used in module 8.1. Now we’ll explore the connection between a Fault Tree Analysis and a Failure Modes and Effects Analysis which we discussed in detail in the previous module.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Failure Modes and Effects Analysis This is the final FMEA worksheet we developed in Module 8.1. This is the final FMEA Worksheet we developed in Module 8.1.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Failure Modes and Effects Analysis But what do these failure pathways look like. Specifically, where did they start and how can they be interrupted? But what do these failure pathways look like. Specifically, where did they start and how can they be interrupted?

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Failure Modes and Effects Analysis A fault tree analysis is a detailed description of a failure pathway. A fault tree analysis is a detailed description of a failure pathway. So, a Fault  Tree elaborates on the details of how a cause/contributing factor could lead to a failure.  Failier - mistake

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles OBJECTIVES To examine the anatomy of a fault tree. To appreciate the relationship between fault tree analysis and failure modes and effects analysis. To explore the similarities and differences between fault tree analysis and root cause analysis. To develop a simple demonstration fault tree based on the example used in module 8.1. We recall that Root Cause Analysis is a retrospective approach to safety and error management. Root Cause Analysis was discussed in detail in Modules 6 and 7. So it might be surprising that there are structural similarities between fault tree analysis and root cause analysis. That’s what we will now explore.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Root Cause Analysis1 Beam not verified No patient specific QC Policy not followed Lack of training Lack of risk awareness Incomplete review Workload pressures Console screen Not verified Risk Awareness One outcome from a Root Cause Analysis is a Cause and Effect Diagram. This is one we developed in Module 6. The reference refers to another, more complex example of a Cause and Effect Diagram developed during an investigation of an incident that actually occurred.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Fault Tree Analysis2 Nuclear Explosion Pressure control system fails Can’t retract fuel rods Pump fails Pressure release valve fails Fuel rods stick Manual retraction under repair O Ring hardened Motor burns out And here’s our schematic Fault Tree Analysis from earlier in this section. The reference is to much more complicated Fault Trees in the Report of the AAPM’s Task Group 100. The details don’t matter to us for this discussion. It’s the structure that we are focusing on.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles FTA in the context of RCA Look similar? Here are the 2 diagrams side by side. Do they look similar? Boxes joined by lines.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles FTA in the context of RCA A fault tree analysis (FTA) can be regarded as a hypothetical root cause analysis (RCA). An actual or potential failure starts an RCA. Postulated failures are used to start an FTA. However, in both, the failure pathway is traced back to causes/contributory factors. An RCA uses only (implied) “AND” gates. From the preceding discussion we might reasonably conclude that a Fault Tree Analysis can be regarded as a hypothetical Root Cause Analysis. An actual or potential failure starts an RCA Postulated failures are used to start an FTA. However, in both, the failure pathway is traced back to causes/contributing  factors. An RCA uses only (implied) “AND” gates. Thus, there are logical connections between a Fault Tree Analysis and two other error management strategies – Root Cause Analysis and Failure Modes and Effects Analysis.  

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles OBJECTIVES To examine the anatomy of a fault tree. To appreciate the relationship between fault tree analysis and failure modes and effects analysis. To explore the similarities and differences between fault tree analysis and root cause analysis. To develop a simple demonstration fault tree based on the example used in module 8.1. An example will help us better understand how to develop a Fault Tree.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Failure Modes and Effects Analysis As a simple example we’ll develop a fault tree for the failure pathway: “Forgot the map”. Let’s develop a Fault Tree for the Failure Pathway: “forgot the map”

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Calgary Basic Cause Table3 We want the Fault Tree to lead us back to causes or conditions that predispose the system to failure. These causes or conditions should ideally be actionable, i.e. actions can be taken to mitigate the problem. The causes/contributing factors should give us clear pointers to those preventive actions.   http://www.ihe.ca/publications/library/archived/a-reference-guide-for-learning-from-incidents-in-radiation-treatment/

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Communication Inadequate hazard assessment Lost Unfamiliar territory Signposts inadequate Map left on kitchen table Spouse took map from car Damaged by vandals Bankrupt local authority Procedure not followed Event/situation/circumstance AND OR A Fault Tree for “Forgot the map” So here’s a possible  Fault Tree  for the Failure Pathway of “forgot the map”. We might end up getting lost because we find ourselves in an unfamiliar part of town and there are no effective signposts to guide us. These two circumstances are joined by an “AND” gate as both conditions would need to be satisfied simultaneously for us to get lost. So why are we in unfamiliar territory? Two possibilities are that we left the map on the kitchen table or our spouse took the map from the car without telling us. Circumstances that led us to leave the map on the kitchen table might include not realising that we were likely to forget it, which we can describe as Inadequate hazard assessment, or possibly that the household had an understanding or procedure requiring maps which were removed from the car to always be returned there. The lower branch of the Tree is really out of our control so we can’t follow it further to the right.

Always return map to car MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Communication Inadequate hazard assessment Lost Unfamiliar territory Signposts inadequate Map left on kitchen table Spouse took map from car Damaged by vandals Bankrupt local authority Procedure not followed Event/situation/circumstance AND OR Change our standard operating procedure Always return map to car Buy another map Our causes for this particular Failure Pathways suggest actions that may make such a potential Failure Mode less likely in the future. Perhaps reinforce with the household the necessity of leaving the map in the car. Another solution would be to buy another map. Either of these options should reduce the likelihood of Occurrence of this Failure Pathway.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Communication Inadequate hazard assessment Lost Unfamiliar territory Signposts inadequate Map left on kitchen table Spouse took map from car Damaged by vandals Bankrupt local authority Procedure not followed Event/situation/circumstance AND OR Incorporate quality management QC: Check for map before driving off However, even if we change our procedures the system will never be perfectly safe. For that reason we would want to incorporate some form of quality control in the process. For example, perhaps we should have a routine of checking for the map every time before driving off. Thinking of the Failure Modes and Effects Analysis we covered in the previous module, incorporating additional quality control should reduce the Detectability, D, meaning the pathway will be more likely to be interrupted.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles Incorporate quality management Communication Inadequate hazard assessment Lost Unfamiliar territory Signposts inadequate Map left on kitchen table Spouse took map from car Damaged by vandals Bankrupt local authority Procedure not followed Event/situation/circumstance AND OR Fails quality control: no map in car We can modify our Fault Tree to include QC checks which will be linked into the main tree through an “AND” gate.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles TG 100’s Key Core Requirements “To prevent failures in radiation therapy in general (and IMRT in particular), a QM program should have elements that TG 100 terms key core requirements for quality. These core requirements are: Standardized procedures Adequate staff, physical and IT resources Adequate training of staff Maintenance of hardware and software resources Clear lines of communication among staff” The American Association of Physicists in Medicine, AAPM’s Task group 100  went through an extensive Fault Tree Analysis of an IMRT process. These analysts concluded that certain basic causes or contributory factors occurred very frequently in their FTAs. Here’s a quote from the TG 100 Report. “To prevent failures in radiation therapy in general (and IMRT in particular), a quality management program should have elements that TG 100 terms key core requirements for quality. These core requirements are: Standardized procedures Adequate staff, physical and IT resources Adequate training of staff Maintenance of hardware and software resources Clear lines of communication among staff”  

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles A few final notes Basic causes identified in the right most boxes of a fault tree do not, in general, make failure inevitable. To be useful, basic causes should be actionable. Addressing the basic causes identified with a fault tree should reduce the occurrence value in the accompanying failure modes and effects analysis. Incorporating quality control into a fault tree should reduce the detectability value in the accompanying failure modes and effects analysis. Always be aware that changing processes, including QC, has the potential to introduce other sources of error. We use the term basic causes to include contributory factors and latent conditions. Now, here are a few final notes. Basic Causes identified in the right most boxes of a Fault Tree do not, in general, make Failure inevitable. To be useful, Basic Causes should be actionable. Addressing the Basic Causes identified with a Fault Tree should reduce the Occurrence, O, value in the accompanying Failure Modes and Effects Analysis. Incorporating Quality Control into a Fault Tree should reduce the Detectablity, D, value in the accompanying Failure Modes and Effects Analysis. Always be aware that changing processes, including QC, has the potential to introduce other sources of error. The last bullet is important. We should always be aware that changes in organizational factors or quality control could make things worse. So caution is required.

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles summary We have: Examined the anatomy of a fault tree. Appreciated the relationship between fault tree analysis and failure modes and effects analysis. Explored the similarities and differences between fault tree analysis and root cause analysis. Developed a simple demonstration fault tree based on the example used in Module 8.1. Here’s what we have covered in this section. We have: Examined the anatomy of a Fault Tree. Appreciated the relationship between Fault Tree Analysis and Failure Modes and Effects Analysis. Explored the similarities and differences between Fault Tree Analysis and Root Cause Analysis. And developed a simple demonstration Fault Tree based on the example used in Module 8.1

Safety and Quality in Radiotherapy MODULE 9: fault tree analysis Safety and Quality in Radiotherapy Section 1: purpose and principles References and additional resources The Ottawa Incident. https://www.cancercare.on.ca/common/pages/UserFile.aspx?fileId=34948 Huq MS, Fraass BA, Dunscombe PB, et al. The report of Task Group 100 of the AAPM: Application of risk analysis methods to radiation therapy quality management. Medical Physics 43, 4209 – 4262. 2016. Cooke DL, Dubetz M, Rahim H, et al. 2006. http://www.assembly.ab.ca/lao/library/egovdocs/2006/alhfm/153508.pdf And finally, the references