1. Assessing the safety of a nurse call system using STPA
G.R. Kleve, Risk manager
University Medical Centre Groningen, Netherlands

2. Prologue

3. How safe is our nurse call system?

4. STPA - preparations 1. Define at system level
system, scope/boundaries,
accident (significant loss) and hazards,
safety constraints/prerequisites,
major components, controllers & responsibilities.
2. Depict control structure describe control actions

5. System, scope boundaries
The nurse call system is the system the patient uses to get nursing care when perceiving an acute need
Out of scope: connectable medical devices

6. Accidents & Hazards Accidents
Severe harm or death resulting from not getting adequate care in time.
Patient does not adequately use the NCS
NCS does not succeed in delivering the patients signal to the nurse
The nurse does not adequately react on the signal of the NCS
Hazards

7. Safety constraints/prerequisites
The patient must always
monitor his condition and needs
adequately operate the NCS
The NCS must always
establish contact between patient and nurse
The nurse must always
give timely and adequate care when called
monitor the functioning of the NCS

8. Components and responsibilities
Patient
Perform self monitoring
Call nurse if needed
NCS
Establish contact between patient and nurse
Nurse
Respond to call
Give care
Monitor the functioning of NCS

9. Control structure & control actions
Patient
Nursing care
Send signal to beeper of nurse
Arrive at bedside patient
Nurse
Press red button handset
Instruct patient
about use of handset
Instruct nurse about use of nurse call system
Reset alarm signal
Hand set,
Wall set,
Central computer
Radio transmitter
Provide care
NCS
Give a hand set
Check whether the red light lights up
Get the right beeper

10. STPA – step 1 Analysis of control actions Identify control actions
Identify under which circumstances they will turn out to be unsafe, when
not provided,
provided,
at the wrong time / in the wrong order
stopped to soon / provided to long
Derive from these situations new safety constraints

11. Control actions Instruct the patient about the use of the NCS
Give the patient a properly functioning hand set;
Press the red button of the hand set;
Check whether the red light lights up after pressing the button;
Instruct the nurse about the use of the NCS;
Give the nurse the beeper of the NCS;
Send the signal of the hand set to the nurses’ beeper;
Go to the patient indicated on the screen of the beeper;
Reset the NCS in the patients’ room.
Provide care

12. Unsafe control actions
Not providing CA causes hazard
Providing CA causes hazard
Wrong timing/order of CA causes hazard
CA stopped too soon/applied too long
Control action:
Check whether the red light lights up after pressing the button
Unsafe when:
The patient does not check the red light of the hand set when the NCS does not transmit the signal of the hand set to the beeper of the nurse
Safety constraint:
The patient always must check whether or not his call has reached the nurse

13. Unsafe control actions
Not providing CA causes hazard
Providing CA causes hazard
Wrong timing/order of CA causes hazard
CA stopped too soon/applied too long
Control action:
Check whether the red light lights up after pressing
Unsafe when:
The patient checks whether the red indicator lights up and sees it does although the signal has not reached the nurse.
Safety constraint:
The patient always must check whether or not his call has reached the nurse

14. Unsafe control actions
Not providing CA causes hazard
Providing CA causes hazard
Wrong timing/order of CA causes hazard
CA stopped too soon/applied too long
Control action:
Press the red button of the hand set;
Unsafe when:
The patient uses the NCS when his need has become very urgent
Safety constraint:
Instruct the patient to use the NCS in time

15. Unsafe control actions
Not providing CA causes hazard
Providing CA causes hazard
Wrong timing/order of CA causes hazard
CA stopped too soon/applied too long
Control action:
Go to the patient indicated on the screen of the beeper
Unsafe when:
While going to the patient the nurse stops when someone else asks for her attention.
Safety constraint:
The nurse must always be able to give the right priority and arrange for assistance in case of competing priorities

16. STPA - step 2 Analysis of causes of unsafe control actions
Analyze causes of unsafe control actions
control actions,
feedback
process model used by controller
Refine or add safety constraints
3. Formulate means to apply/enforce the safety constraints

17. Control structure & control actions
Potential Control Flaws
Control action:
Go to the pr

18. Looking for causes 2 3 1 1. Control Action not executed
2. Unsafe control provided
3. Process model flaws 2 3 1

19. Causes of UCA UCA nurse does not react on call related to urgent need
Examples:
Code on beeper illegible or wrong
Right beeper, incorrectly programmed
Beeper malfunctioning during shift
Beeper gets lost during shift, without being noticed
Nurse expects no urgency (last impression, handover)
Nurse occupied with another task
Nurse is halted while answering call

20. Results One Table/report with: Description Goals Accidents Hazards
Safety Constraints
Design Requirements
Process model
Control Actions
Unsafe Control Actions
Causal Factors of UCA
system level

21. Number of safety constraints

22. Safety constraints by theme
Selfmonitoring and use of NCS
H-1
Knowing whether call is answered
Functioning of the whole NCS
Enabling adequate respons time
H-2
H-3
Knowing kind of need and acuteness

23. How safe is our nurse call system?8 29

24. Getting findings accepted
Highlighted control actions aimed at
Restoring the validity of assumptions underlying the safety design
Restoring the functionality of control feedback loop
Evident vital safety issue
while referring to the table with results

25. Highlights
Define care policy for incapacitated patients (e.g. delirious or confused)
Uptime must apply to the whole system
The patient must know whether his call has reached the nurse
The nurse must know the kind and urgency of the patients’ needs
Align response time and redirection settings of the NCS with physiological limits

26. Lessons learned Simple topic, 37 unique safety constraints
Broad array of findings
eXSTAMPP really helpful, one table
Getting results accepted
STPA supported the analysis in 5 ways
Limiting to things that really matter (accidents);
Top down reasoning (instead of free brainstorming);
Structured search for unsafe control actions
Predefined flaws of control feedback loops
Check for fit UCA – hazard

27. How about ….