Application of systems and control theory‐based hazard analysis to radiation oncology

Pawlicki, Todd; Samost, Aubrey; Brown, Derek; Manger, R; Kim, Gwe-Ya; Leveson, Nancy G.

doi:10.1118/1.4942384

Cited by 53 publications

(27 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, one is not required to understand the detailed operation of a “black‐box” component or details of process steps at a specific institution to arrive at a meaningful safety assessment. Systems‐Theoretic Process Analysis has been previously applied to radiation therapy and the current work follows the same methodology as briefly explained below.…”

Section: Methodsmentioning

confidence: 99%

“…The safety assessment included the entire scope of practice to provide the most realistic context for Halcyon's impact on system safety. Based on previous work, there can be hundreds of causal scenarios for the different unsafe control actions. For the purpose of concisely summarizing the results, the causal scenarios were mapped onto the causality categories in Appendix D of Ford et al, “Consensus recommendations for incident learning database structures in radiation oncology.” The causality categories are the following: organizational management, technical, human behavior of individual staff, patient‐related, external factors, procedural issues, and other.…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Clinical safety assessment of the Halcyon system

et al. 2019

Self Cite

View full text Add to dashboard Cite

Purpose The Halcyon consists of precommissioned linear accelerator and treatment planning algorithms that were designed to simplify the acceptance, commissioning, and clinical workflow for image‐guided intensity‐modulated radiotherapy. The purpose of this work was to perform a comprehensive safety assessment for the clinical use of the Halcyon. Methods Systems‐Theoretic Process Analysis was used as the safety assessment tool. As part of the analysis, a number of control loops and control actions are created to describe system function. Safety is assessed by determining unsafe control actions and a corresponding list of causal scenarios that leads to accidents. The scope of the analysis was from the acceptance of the Halcyon to routine patient treatments. All aspects of treating patients were considered including the roles of physicians, physicists, dosimetrists, and therapists. The analysis was completed by four physicists with input from other members of the radiation therapy team. The causal scenarios were summarized using the causality categories from the consensus recommendations for incident learning database structures in radiation oncology (Med Phys, Vol. 39, No. 12, Dec 2012). Results Twenty‐three (23) control loops containing 52 control actions were created for the clinical use of the Halcyon. One hundred forty‐four (144) unsafe control actions were identified with 385 associated causal scenarios. Twenty‐seven percent (27%) of the causal scenarios were related to equipment technical issues, while 73% of the causal scenarios were predominantly related to procedural issues, human behavior, and organizational management. Conclusions For routine clinical use of closed or largely automated radiation therapy equipment, the majority of safety concerns is related to nontechnical issues. The Halcyon and other similar systems may present opportunities to streamline, reduce, or eliminate some traditional equipment commissioning and routine quality assurance activities in exchange for an increased focus on issues related to organizational management, procedures, and human behavior.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

Clinical safety assessment of the Halcyon system

et al. 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…STAMP-STPA has been applied to multiples domains such as space (Owens et al, 2008;Ishimatsu et al, 2013;Leveson, 2009;Leveson, 2005), nuclear (Thomas et al,2012), rail (Suo, 2012; Song et al 2012), military (Pereira et al, 2006;Abrecht, 2016), automobiles (Placke et al, 2015), and medical domains (Pawlicki et al, 2016;Leveson et al, 2016;Leveson et al, 2012). In the aviation domain STAMP -STPA has been applied to improve safety in ATM (Fleming & Levseon;, for Rotary aircraft (Abrecht et al, 2016), for NextGen avionics (Fleming et al, 2014) and Rapid decompression events (Revell et al, 2016;Allison et al, 2017).…”

Section: Methodsmentioning

confidence: 99%

Modelling distributed crewing in commercial aircraft with STAMP for a rapid decompression hazard

et al. 2018

View full text Add to dashboard Cite

Changes to crewing configurations in commercial airlines are likely as a means of reducing operating costs. To consider the safety implications for a distributed crewing configuration, system theoretic accident model and processes (STAMP) was applied to a rapid decompression hazard. High level control structures for current operations and distributed crewing are presented. The CONOPS generated by STAMP-STPA for distributed crewing, and design constraints associated with unsafe control actions (UCAs) are offered to progress in the route to certification for distributed crewing, and improve safety in current operations. Control loops between stakeholders were created using system-theoretic process analysis (STPA). The factors leading to the Helios 255 incident demonstrated the redundancy that a ground station could offer without the risk of hypoxia, during a decompression incident. STPA analysis also highlighted initial UCAs that could occur within the hypothetical distributed crewing configuration, prompting consideration of design constraints and new CONOPS for ground station design. Practitioner Summary: SPO in commercial aircraft is likely as a means to reduce costs. This paper makes a case for distributed crewing using STAMP-STPA. Comparing current operations with a distributed crewing configuration, the redundancy offered by a ground station is demonstrated. Design constraints and new CONOPs for distributed crewing, and current operations are proposed.

show abstract

“…In addition, depending on the system analyzed, a team of subject matter experts will be required to ensure that all scenarios are analyzed. These are not strictly disadvantageous with the method itself, but in its application [8][9][10][11][12][13].…”

Section: B Comparison Between the Stpa Analysis And The Old Methods mentioning

confidence: 99%

A Comparative Study of STPA Hierarchical Structures in Risk Analysis: The Case of a Complex Multi-Robot Mobile System

Bensaci

Zennir

Pomorski

2018

2018 2nd European Conference on Electrical Engineering and Computer Science (EECS)

View full text Add to dashboard Cite

Autonomous multi-robot systems are among the most complex systems to control, especially when those robots navigate in hazardous and dynamic environments such as chemical analysis laboratories which include dangerous and harmful products (poisonous, flammable, explosive...). This paper presents an approach for systems-complex and theoretic safety assessment, also it considers their coordinating, cooperating and collaborating using different control architectures (centralized, hierarchical and modified hierarchical). We classified those control architectures according to their properties, and then we used a systems-theoretic hazard analysis technique (STPA) to identify the potential safety hazard scenarios and their causal factors.

show abstract

Application of systems and control theory‐based hazard analysis to radiation oncology

Cited by 53 publications

References 29 publications

Clinical safety assessment of the Halcyon system

Clinical safety assessment of the Halcyon system

Modelling distributed crewing in commercial aircraft with STAMP for a rapid decompression hazard

A Comparative Study of STPA Hierarchical Structures in Risk Analysis: The Case of a Complex Multi-Robot Mobile System

Contact Info

Product

Resources

About