1 Introduction

Helical tomotherapy (HT) is an innovative radiation treatment device that combines a linear accelerator and a computed tomography (CT) scanner for the purpose of delivering intensity-modulated radiation therapy (IMRT). Megavoltage computed tomography (MVCT) imaging acquisition is possible before and after the treatments; with new models, an X-ray acquisition is possible during treatment. This allows to provide a prescribed and uniform radiation dose to the target while minimizing the radiation dose to normal tissues.

In IMRT, a lot of equipment, including special software, is required to plan treatments and control the radiation dose. Therefore, this results in a highly complex procedure due to the extensive integration and automation of the HT control systems.

To perform robust safety analyses and to have available effective data to predict and prevent injuries in this context, or in similar contexts where innovative techniques are employed, it is necessary to use new methodologies that can address some issues such as lack of historical data to predict future events.

It is essential to provide adequate answers to the following questions about the application of safety analyses:

  • The need to use of a holistic approach to safety management;

  • The significance of the direct collection of information/data and detailed knowledge of the process under review, mainly with the involvement the different healthcare operators participating in the examined radiotherapy process;

  • Providing a database useful to understand which events, that can be considered of the same nature, have high frequency in terms of occurrence and impact.

An answer to the first question is to use a tool based on the integration of different safety techniques that is also able to collect data/information that require multidisciplinary skills of experts.

In this context, a recent collaboration between the Engineering Department (ED) of the University of Palermo and the Radiotherapy Department (RD) of ARNAS Civico has allowed to develop a new tool, called SAPERO (Patient Safety: advanced techniques and for the assessment of the risk of unwanted events within the care pathway in the Radiotherapy sector). It integrates the application of the following techniques: Hierarchical Task Analysis (HTA) [1], Cognitive Task Analysis (CTA) [2, 3], Human Error Assessment and Reduction Technique (HEART) [4,5,6] and Fuzzy Failure Mode Effects and Criticality Analysis (FFMECA) [7,8,9,10].

The present paper reports obtained results of the SAPERO application in the safety analyses of patients subjected to treatments with HT at the Radiotherapy department of the ARNAS Civico hospital at Palermo, Italy.

Solutions are provided to mitigate the risk of errors/failures considered critical.

2 SAPERO

The SAPERO project was funded as part of the national health plan of the health department of the Sicily Region in the year 2016.

The research activities allowed for the development of the SAPERO software to support safety analysts in the integrated application of the following methodologies:

  • HTA, a structured approach which allows to construct an in-depth list of goals, subgoals, operations, and plans associated with a specific process according to a top-down approach (tree) to achieve certain targets;

  • CTA, s tool which enables to obtain a high degree of detail on how the certain tasks or actions are carried out within the process;

  • HEART, a method which helps in the assessment of the probability of error/failure occurrence by using CTA data;

  • FFMECA, a tool which provides a way to highlight the critical failure modes connected to both human errors and component failures.

Fig. 1 shows the flowchart of the above techniques in SAPERO software.

Fig. 1
figure 1

Flowchart of SAPERO software

Full size image

CTA allows to address a deep description of the cognitive and decision-making processes concerning the execution of the activities carried out by each operator. These data are used to evaluate the error probability occurrence by using HEART. Moreover, CTA enables the creation of a list of technical tools employed in performing a task, which can be used to conduct a Fuzzy FMECA analysis.

As well known, FMECA transforms FMEA from qualitative to quantitative approach by attribution, for each failure mode, numerical values to risk parameters Occurrence, Detection and Severity (O, D, S) on a scale ranging from 1 to 10, and then by calculation of the Risk Priority Number index (RPN) as product of above quoted three risk parameters. RPN rank is between 1 and 1000 and failure modes with higher RPN should be corrected with higher priority than those with a lower RPN.

However, in some applications, RPN values may not accurately reflect the level of risk, since determining the values of O (occurrence), D (detection), and S (severity) can be challenging, as experts may prefer to provide linguistic-based judgments rather than quantitative ones. Additionally, giving equal importance to (O, D, S) may result in inaccurate risk ranking of critical failure modes [11].

Another important aspect is that FMECA has as its natural field of application the industrial field, so it is essential to understand if healthcare FMECA application is equally effective and incisive.

In SAPERO, FFMECA employs the fuzzy theory to define the risk indices (O, S, D) and for the calculation of a new Fuzzy RPN index (FRPN), as proposed in [12].

It is worth emphasizing that the fuzzy methodology aims to achieve the following objectives:

  • take into account issues associated with the classic application of FMECA;

  • take into consideration certain uncertainty elements and subjectivity attributable to the opinion of multidisciplinary team involved in the safety study;

  • ease the expert’s judgment which often resorts to natural language to describe their experience (through the use of fuzzy linguistic variables).

Moreover, in SAPERO software, some packages have been implemented to manage a safety taxonomy by using a web-site interface.

3 The case study description

3.1 HT treatment delivery

The complexity of the treatment procedure is supported by to the extensive integration and automation of the HT control systems that allows moving the patient linearly through the gantry bore at a constant velocity, while the linear accelerator rotates, inside the gantry, around the patient at constant angular speed (Fig. 2).

Fig. 2
figure 2

Main components of the HT unit, schematic drawing of virtual and machine isocenters as seen from the ceiling is shows in the top of figure

Full size image

During this process, the photon beam is switched on and is continuously modulated by the multileaf collimator MLC to achieve the desired geometrical accuracy in the delivered dose to the target. MLC is a collimator made of individual "leaves" of a high atomic numbered material that allow to create beams custom and to spare normal tissue.

A laser positioning system is used in the treatment room to accurately position patients on the treatment couch.

Note that the positive y-direction is inside the bore of the system and the patient is positioned outside the bore. In the clinical practice, the patient is set based on the movable red lasers that move, respectively to the virtual isocenter, in a different way based on the patient's specific treatment plan (Fig. 2, see section at the top of figure).

The alignment of patient is performed by using a laser projection system installed in the room. A fixed green laser system is used to project laser lines to the virtual isocenter, and a movable red laser system allows to project lines to the patient setup marks (tattoos or skin marks used as the reference for patient alignment).

The alignment procedure includes that the patient is positioned on the couch by aligning skin marks with red lasers and the center of the radiation field should agree with the laser position with an accuracy of within 1 mm.

The HT unit can generate megavoltage computed tomography (MVCT) images that offers verification of patient position prior to the radiation therapy, and imaging for reconstruction of the radiation dose delivered, thereby providing unprecedented verification of the actual treatment.

On the basis of the imaging obtained using the MVCT scan, automatic displacements of the couch are performed to align with the planned position, thus correcting the actual position of the patient.

The movement of the patient can be performed automatically (the alignment parameters are set by the machine’s control systems and printed on the screen displayed to the operator) or manually if automated alignment is deemed inadequate.

After the repositioning of the patient (if necessary) the treatment can start.

3.2 Materials and method

The analysis was performed by the working group (WG) made up of different professional operators, as follows:

  • Nuclear engineers, experts in safety analysis who work at ED, University of Palermo;

  • Medical radiology health technicians (MRHT), radiotherapists (RT), medical physicists (MP), nurses who work at RD, risk management engineers who operate at ARNAS Civico hospital.

Countless visits to RD were organized to schematize the HTA tree necessary to track the patient’s journey from the first moment of interaction with the health operators. This activity was carried out solely by the nuclear engineers' group, while the final definition of the HTA was collectively reviewed by the WG. This way of conducting the analysis has initially allowed for the elimination of a subjective approach that could interfere with the accuracy of data recording and HTA theorization.

For the sake of brevity, in Fig. 3 sketch of the first two levels of HTA tree related to the process “Treatment is reported. Table 1 shows a description of the main Tasks and Sub-Tasks defining the HTA reported in Fig. 3.

Fig. 3
figure 3

Sketch of the first two levels of the HTA tree related to the treatment plan

Full size image
Table 1 Tasks and Sub-Tasks defining the levels of the HTA for treatment process
Full size table

The tasks at the lowest level of the HTA were further examined in detail through the use of CTA and FFMECA by using SAPERO software. Meetings, video meetings and calling between WG members were performed to compile CTA, FFMECA and HEART tables. Declarations, ratings, and assumptions were collectively discussed and agreed between members of WG involved in the working activities, time after time under consideration.

In detail, the CTA method was applied to gather information and insights regarding two main aspects:

  • How operators engage in general or clinical decision-making, problem-solving, memory, attention, and judgment;

  • What tools/devices they employ in the task under examination (see Fig. 4 for an example of a CTA table compiled in SAPERO).

Fig. 4
figure 4

Example of CTA table related to Task 3.0

Full size image

FFMECA is also conducted using data from the corresponding CTA table. An example of the FFMECA table compiled in SAPERO is reported in Fig. 5.

Fig. 5
figure 5

Example of FMECA table related to CTA reported in Fig. 4

Full size image

Based on the data and information gathered in SAPERO, the working group of nuclear engineers proceeded to engage with WG experts in order to define the O, D, and S indices. This was accomplished using a linguistic approach, which involved, for example, defining severity levels such as 'low,' 'medium,' 'high,' etc., facilitating the expression of judgment.

It's important to note that these results served as input for the SAPERO software, which incorporates a fuzzy model for calculating the FRPN index.

For some CTA tables, the probabilistic risk assessment was applied to determine a set of critical human errors by using the HEART technique (Fig. 1) as described in [13].

3.3 Safety analyses of the case study

For the sake of brevity, Task 3.0 “Patients list is defined (weekly procedure)”, Task 3.1 “Start-up steps in treatment plan (TP) procedure selection”, and Task 3.2 “Treatment room preparation” are described in detail, as an example of results obtained from the SAPERO application in terms of ability to study complex procedure and convert it into a sequence of simpler steps.

By way of example, the process of preparing and delivering the treatment plan (TP) execution starts with the goals of defining the patient list and performing the start-up steps in the TP procedure. These goals are then broken down into individual tasks that must be executed in order to achieve the main objectives. The outcome is a hierarchical structure that represents the specific actions and behaviours required to carry out each task.

3.3.1 Task 3.0—Patients list is defined

At the beginning of each week, the MRHT updates the list of patients (incoming patient flows at morning and at afternoon) by using a word processing program. He writes data in a table field with a predefined format.

The table is defined by columns reporting in sequence: number and timetable slot assigned to the patient; patient’s name and surname; total number of treatment sessions; data on any TP following the first; number of sessions performed up to the previous week; number of remaining sessions.

Note that the timetable slots are already precompiled in the table of the list. Moreover, the assigned number to the patient remains the same for all the treatments provided in the TP.

The patient is given “shift” card (a sheet of paper) where, by using a table format, it is reported the same number assigned in the weekly list; time at which to present themselves at the reception; any notes concerning the preparatory activities to be carried out before the treatment session.

If TP interruption is necessary (for example, patient A needs a TP interruption for one week and returns to the following week), one of the possible scenarios is that a new patient (patient B) takes the number assigned to patient A.

The next week, patient A, that starts again the therapy, takes again the previously assigned number. If patient B requires a therapy lasting longer than one week, they are assigned one of the identification numbers reserved for such cases.

3.3.2 Task 3.1—Start-up steps in treatment plan (TP) procedure selection

The Patients, who arrives in the waiting room, shows to the nurse the “shift” sheet received as described in Task 3.0.

Two paper folders, that contain data for each patient, are used:

  • Radiotherapy folder recording the main information of the TP;

  • Outpatient note containing the anamnesis data and the clinical diary.

The outpatient note is kept inside the radiotherapy folder that has been already compiled for the parts concerning the various sessions scheduled in the TP.

The MRHT has stacked radiotherapy folders according to the order specified in the weekly list and calls the patients respecting this. Patients who require preparatory procedures are notified in time to be ready when are called.

In sequence, the MRHT reads data in weekly list, checks if a case of homonym is present, and takes the radiotherapy folder. Then, he checks if the patient information match data such as name and surname as well as anatomical site to be irradiated.

Subsequently, in the control room, the MRHT selects, by using the treatment planning system (TPS) provided in HT, data directory related to the patient in terms of new PT to be performed.

The procedure involves using the “Data Selection” screen of the HT management software. The screen contains different PTs associated with the patient with flags “Approved”, “Not approved”, “Cancelled”, which indicate the history of approved, unapproved, and blocked plans, respectively.

In this step, the MVCT scan can be acquired. The MRHT selects the position and the length of the computed tomography (CT) scan starting from the planning CT scan and based on Planned Target Volume (PTV) defined during treatment planning phase. PTV is defined as the clinical target volume (CTV) surrounded by adequate margin to account for variation in patient position, organ motion, and other movement.

This procedure is performed because the treatment machine has a laser system, as described in Sect. 3.1, that allows the patient position setup. It is fundamental to ensure alignment between isocenter of the PTV and the virtual isocenter of the machine (intersection between the central axis of the delivered beam and the axis of the gantry). Then MRHT sets and confirms the following parameters:

-scan width;

-thickness of the anatomical “slice”.

These data are required to perform the subsequent procedure of the Task 3.6.

Through an appropriate pop-up window, the MRHT confirms the patient’s entry “head-to-toe” or viceversa. The machine will automatically position the red lasers on the basis of evaluations made in the CT reference, loaded via PT as described above.

3.3.3 Task 3.2—Treatment room preparation

The MRHT reads in the radiotherapy folder the devices needed for immobilization, their placement, and prepares the treatment room with the help of a nurse. The couch is in “home” position and the devices are taken from a table located in the treatment room.

Individual devices (e.g. thermoplastic masks) are labelled with the patient’s name, surname, and simulation date.

The simulation date allows for differentiation of devices belonging to the same patient but used in different treatment sessions. Only the immobilization devices in use are present in the treatment room, while no longer necessary devices are stored in a room placed near the HT unit and beside the treatment room.

4 Results and discussion

As highlighted by Decree Legislative No. 101 of July 31, 2020, in receipt of the European Directive 2013/59/Euratom, the role of the Medical Physics Specialist must contribute to the prevention and analysis of accidental and undue exposures of individuals undergoing medical procedures.

Specifically, in the context of radiotherapy practices, they are responsible for defining procedures to assess the risks of accidental and undue exposure based on internationally available recommendations and information. Therefore, SAPERO can be a useful tool to support these activities as defined below.

Although the examined process is well-structured and the use of the HT software interface has proved to be a valid support for the operator, the obtained results have allowed some useful suggestions for further improvements in performance.

Specifically, about a hundred failure/error modes have been assessed and ranked according to their FRPN values. This analysis has allowed to determine the highest-risk items reported in Table 2. Among the identified critical issues, Figs. 4 and 5 offer an illustrative example of the CTA and FMECA compiled in SAPERO.

Table 2 Summary of the results obtained with reference to the tasks concerning the Execution of Therapeutic Plan
Full size table

For all critical items, the subsequent re-evaluation of the FRPN index allowed for highlighting the effectiveness of the proposed solutions.

4.1 Critical items in task 3.0

By cross-referencing the data from CTA and FFMECA of failure/error modes with higher priority in terms of FRPN values, it was possible to identify some shortcomings in this task. These insights have facilitated the formulation of applicable solutions and preventive measures aimed at enhancing safety.

Some actions are characterized by a significant number of decisional and executive steps requiring to manage a large amount of information in an organized manner and substantial cognitive effort for compiling the weekly list. For example, after gathering the names of patients scheduled for treatment in the current week, the operator manually compiles the weekly patient list, following the instructions provided in paragraph 3.3.1. During this procedure, the operator distinguishes between morning and afternoon patients, consults their medical records, and ensures the inclusion of patients continuing treatment initiated in the previous week.

Regarding the "shift" card, the patient receives a sheet with a tabular structure containing the information described in paragraph 3.3.1. Upon handing over the card, the patient is advised to carefully read the information and adhere to what is stated.

The analysis has highlighted the absence of a procedure for informing the patient about the importance of following the instructions (why it is crucial to follow the instructions and what are the risks involved). For instance, exchanging cards with another patient could create a dangerous situation not only for the patient involved but also for other patients.

About the transcription of patient names in the weekly list, it is suggested to use one or more of the following guidelines in cases of homonymy (including cases of homonymy for only the surname):

  • Transcribe the textual contents of the name and surname of the patient using coloured characters (e.g. using of red characters) or format option such as bold or italics characters;

  • Use background shading in cells reported name/surname related to the patients subject to the homonym case.

The same guidelines should be reported in the sheet delivered to patient. It is worth noting that the use of the same colour in the cells of the tables of the sheet delivered to the patient and of the weekly list helps the operator correctly identify patients.

To facilitate this procedure, a computerized system could be programmed (e.g. using macros in Word) to automatically detect cases of homonymy and change the formatting of the cells in both tables.

Moreover, for a correct identification of the patient, an automatic device selection system based on the use of a Radio-Frequency Identification (RfID) assigned to the patient coupled with a light activation system (Bluetooth tag) placed on the device could be useful also for subsequent task procedure (e.g. Task 3.7).

It is proposed to print a warning sign on the sheet delivered to the patient regarding their assigned “patient shift”. This warning should inform the patient not to exchange their shift number with the number assigned to other patients, under any circumstances.

4.2 Critical items in task 3.1

For this task the prioritization of failure/error modes using FRPN have highlighted the need to thoroughly examine organizational aspects that include shift changes among technical staff, collaborative capacity among different operators in the department, as well as a deeper understanding of the hardware and software systems and the steps involved in their utilization.

Moreover, the results have brought attention to certain organizational criticalities that can give rise to latent errors. Consequently, it has been necessary to identify actions aimed at reducing the probability of their occurrence, as described below.

The analysis highlights a critical issue related to the presence of multiple PTs associated with the patient in the ‘Data Selection’ screen of Task 3.1.1.

All PTs related to the same patient can be selected but only those that have the status “Approved” can be used for the radiation treatment described by Task 3.7.

When a PT needs to be cancelled because it is no longer valid and cannot be used for radiation treatment in Task 3.7, it is recommended to add the ‘Cancelled’ attribute to that PT directory immediately, without referring it to another operator or performing it at another time. This suggestion ensures that the PT is immediately marked as inactive, which reduces the risk of information loss between different operators.

Moreover, in the tomotherapy system there is an additional possibility to make a plan deliverable or not deliverable that can be used. An approved plan can be not deliverable until the final Quality assurance (QA) approval is given.

Another aspect to consider is that the patient’s list in the ‘Data Selection’ screen displays not only the names of patients being treated, but also the recent history of patients who have already completed the treatment. Therefore, in cases of homonymy, the MRHT should pay extra attention when selecting a patient’s surname, and a historical reconstruction may be necessary for correct identification.

To address this issue, a computerized system for managing the patient database could be useful. This system, based on the periodic update of the database of the HT management software (a task performed by the medical physicist could help identify potential cases of homonymy that may occur over time.

4.3 Critical items in task 3.2

It is worth noting that, through cross-referencing the data from CTA and FMECA for this task, the results have highlighted the importance of paying particular attention to the positioning of the cabinet in the treatment room where the immobilization devices are stored, the labeling method used for these devices, and the procedure for their selection and placement on the couch.

The data have indicated the necessity to support individual and collective practices and actions performed by operators within the treatment room. The available information obtained from the analysis has facilitated the formulation of applicable solutions for improving the procedure, such as implementing an automated device selection system that assists the operator in various tasks involved in the preparation of the room.

For example, an automatic device selection system based on the use of an RfID (Radio-Frequency Identification) assigned to the patient coupled with a light activation system (Bluetooth tag) placed on the device could be useful, an facilitate the association of immobilization devices with the patient present in the room.

5 Comparison with other FMECA analysis strategies

In literature, various authors have highlighted the following main limitations in the application of the FMECA methodology in the healthcare field [13,14,15,16]:

  • Risk evaluation process is substantially subjective;

  • Descriptions and classifications of the O, D, and S risk factors to evaluate RPN are not sufficiently flexible to adapt to the specifics of the context in which the risk assessment is performed;

  • RPN is evaluate by using different methods, resulting in different rankings of the failure modes and human errors;

  • It is usually difficult for the experts to provide numerical input for the O, D, and S risk factors that is as precise as required for the scoring approach.

A response to the first issue has been provided by the experience of the experts chosen as members of the WG, the availability and efficient use of informational materials, and the detailed knowledge of the process under review. However, obtaining accurate and reliable data can be challenging, as failures/errors heavily depend on the systematic approach used to analyse the operational conditions and the environment in which one operates. In this context, the use of a software tool can facilitate the collection, storage, and analysis of the data required for FMECA analysis.

As for the other issues, although literature provides various solutions to take into account experts' opinions [8], the challenge is to facilitate the expert judgements in defining the O, D, and S risk factors underlying the risk assessment and failure modes ranking.

Considering the aforementioned issues and acknowledging that HT processes implemented across various hospital departments can differ significantly in terms of procedures and standards to ensure the safe and effective treatment of patients, in this section a comparison is performed between qualitative outcomes of FMECA analyses in tomotherapy as reported in the literature and some results described in this paper.

In [17], a FMECA analysis in tomotherapy is detailed. This study was carried out by a multidisciplinary working group, including experts in risk management. Medical physicists, radiation oncologists, and external physicists with experience and competence in radiation protection and risk management strategies for radiotherapy composed the WG. The operative methodology was based on group brainstorming procedures, followed by several plenary meetings to delineate and discuss the treatment planning stage process tree, to identify the potential failure modes, and to attribute O, D, and S values. The vulnerabilities of the failure modes have been ranking by using the RPN index as product of O, D, and S risk factors. Critical issues emerged for patient identification, treatment planning (e.g. plan selection), and treatment delivery (e.g. incorrect MVCT matching).

In the application of SAPERO, a strategy akin to the one adopted in [17] is followed, where significant emphasis is placed on 'Assembling the team.' Moreover, for the step 'describe the process (create a process map),' the method of HTA, as expounded in Sect. 3.2, is chosen. This is made to systematically assist in organizing information and identifying relationships among various components of the process.

To identify the failure/error modes, the use of integrated CTA and FMECA analysis is considered preferable compared to classic FMECA approach because it describes not only the sequence of process steps but also emphasises the logical and information dependencies among them.

The RPN calculation and the definition of O, D, and S risk factors is based on fuzzy logic procedure that has allowed to deal with the approximate and typically human way of reasoning. Numerical values of risk parameters O, D, S and of RPN index are converted into linguistic variables to which labels of fuzzy sets are associated. For example, let us parameter O relating to occurrence probability of a failure mode, its values in the range [1,2,3,4,5,6,7,8,9,10] is interpreted by using fuzzy labels such as "low", "medium", "high", etc. This approach greatly facilitated the expert’s judgments in identifying critical aspects of the task under consideration.

Comparing the most critical failure modes identified in the two analyses, a congruence can be observed regarding the process parts that might be subject to undesired events. It is worth noting that the SAPERO tool and the compiled database have been useful tools in supporting the WG's decisions aimed at risk reduction.

Making software, such as the one adopted in this work, available to the medical physicist and the multi-professional team responsible for carrying out risk management, can be valuable. This is valuable not only for addressing issues such as the lack of historical data in the case of innovative techniques being employed, but also for standardizing the method and for agile periodic review of the procedures.

6 Conclusions

The advances in radiotherapy technology have greatly improved the treatment of patients, but the related processes have also increased the complexity of the procedures, making it more challenging for healthcare operators to manage the provided activities safely.

The use of innovative technologies, such as intensity-modulated radiation therapy (IMRT), and the design of complex procedures could lead to the occurrence of adverse events that are a difficult to identify. So, in this context, the use of a holistic approach in performing safety analysis (risk assessment that takes into account the complexities of the real situation) becomes strategic to increase quality assurance.

This approach should include various fundamental aspects such as identifying the more critical failures of the system, highlighting faults in the tasks of all healthcare personnel involved in the process, and identifying problems in organisation and working environments. These are all factors that can be subject to vulnerability or that exploit vulnerabilities of old or new procedures.

In this field, a recent collaboration between the Engineering Department of the University of Palermo and the Radiotherapy Department of ARNAS Civico has allowed the development of a new software, called SAPERO, that integrates the application of safety analyses using HTA, CTA, FFMECA, HEART techniques.

In this work, results obtained in safety assessment of patients subjected to IMRT treatments at ARNAS Civico hospital are reported.

Various solutions/suggestions are proposed to mitigate the risk of failures considered critical.