Risk is generally defined as a product of frequency and magnitude of consequence of the accident. Risk of a system or process can be obtained by the sum of risks of all the potential accidents. Therefore, the risk of system or process can be estimated by the following formula:

where i, F, and D are accidents, frequency, and consequence, respectively.

Estimation of risk primarily requires the identification of accident sequences and consequences. Patient treatment by external radiotherapy is one of systems or operations that apply the concept of defence-in-depth, i.e., multiple barriers of safety measures to adverse consequences [3]. Therefore, there are three key elements when identifying accident sequences and estimating the risk of external radiotherapy, as follows;

Event tree is a logical structure in the form of a tree branch that maps out the different pathways by which the bad event can occur [4,5]. The branching structure shows how an initiating event that starts a sequence at the left side of the tree may lead to the bad event that is shown at the far right side.

In the analysis of safety-critical systems that apply the concept of defence-in-depth, an event tree is a sequential structure of three categories of elements: an initiating event, safety systems which are designed to mitigate the initiating event, and the consequences. Initiating events are bad beginnings. Without initiating events, no accident can occur. Initiating event of an event tree can be the failure of a system or human errors, or it can be initiated externally to the system. Once an initiating event is defined, all the safety measures that possibly can be utilized after the failure event must be identified. If the safety measures fail to mitigate the initiating event, it develops into an accident. These safety measures are then structured in the form of headings for the event tree. Then, each branch of the tree yields one particular accident sequence that leads to adverse consequence.

A simple event tree structure is illustrated in Fig. 1. In this example, three safety measures, i.e., A, B, and C, can be used to mitigate the initiating event, i.e., E1. In case that all the safety measures fail, the initiating event leads to unsafe consequence, while the other three paths result in the safe state. The accident sequence for the initiating event, i.e., "E1-A'-B'-C'-U1", can be represented through this event tree. Then, the frequency of this accident sequence is obtained by the product of probabilities of events in the sequence, i.e.,

This frequency can be used in calculating the risk of accident sequence by using Eq. (1) if the consequence of the accident is estimated.

This study has reviewed 59 adverse events from two retrospective safety reports that accumulate past incidents in the external radiotherapy. These reports extensively collected adverse events in the radiotherapy from a variety of sources for a long period. They also provide relatively rich descriptions which help understand the occurrence of events and their context. Based on the descriptions, this study selects experiences in the external radiotherapy and identifies the initiating events of adverse events, safety measures that have failed to mitigate initiating events, and the consequences of sequences. A brief summary of these reports is given as follows:

1) International Atomic Energy Agency (IAEA) safety reports series no. 17 (n = 50) [6]: This IAEA Safety Report presents a collection of adverse events which were accumulated from a variety of sources such as regulation authorities, scientific journals and other publications. In total, the descriptions of 92 incidents were presented with regard to external beam therapy, brachytherapy and nuclear medicine. Among them, 50 cases were related to external radiotherapy facilities.

2) International Commission on Radiological Protection (ICRP) publication 112, preventing accidental exposures from new external beam radiation therapy technologies (n = 9) [7]: Adverse events related to new technologies in external radiotherapy were reported in this ICRP report. This ICRP report contains the descriptions of 11 incidents related to these new technologies between 2005 and 2008. Except two cases of incidents, 9 adverse events are included in this study.

The initiating events of 59 adverse events are identified and classified by two criteria, i.e., stages (is based on the stage classification from [2]) and initiators of failures, i.e., equipment- or human-initiating events. Classifications by stage and initiator can provide the insight on when initiating events occur and who initiates the event, respectively. Table 1 presents the result of the classification with the short description of initiating events.

With respect to the classification into the treatment stages, the number of adverse events that occurred in the planning stages was 18 (31%), and of remaining 69%, adverse events were due to the errors that occurred in calibration (n = 15, 25%), patient setup (n = 12, 20%), delivery (n = 12, 20%), and simulation (n = 2, 3%).

Human-initiating events account for 73% (n = 43), while equipment-initiated events account for 19% (n = 11). Nine of the 11 equipment-initiating events have occurred in the delivery stage. For five cases (8%), the initiating events were not clearly presented by the reports.

In the calibration stage, the initiating events can be divided into two groups by the objectives of calibration, i.e., miscalibration of measuring instruments and miscalibration of beam. The former includes five errors in calibrating dosimeters (e.g., ionization chamber), which were caused by misinterpretation of data and mislabeling the chamber. Ten adverse events belong to the errors in calibrating beam. Those include applying incorrect units, using inappropriate correction factors, and using incorrect detector.

In the planning stage, the initiating events can be classified into two groups: use of wrong reference data and dose calculation errors. The former group addresses errors in applying reference data which are applicable for all the patients who enter the treatment. The reference data have included output factors, depth dose, and wedge factors. The latter addresses errors in calculating the dose for individual patients. This group includes a variety of errors such as incorrect calculation of dose, treatment times, and monitoring units, and omission of recording wedges as human errors, and computer crash as an equipment failure.

In the patient setup stage, the initiating events can be assigned into two groups: misidentification of patients and incorrect setup for location (or treatment times). The misidentification of patients was caused by handling wrong patients as well as picking up wrong chart. The other group in the patient setup is related to incorrect identification of location for the delivery. Nine cases are involved in this group, but are different in terms of the cause of errors, e.g., 2 cases related to miscommunication, 2 cases related to misidentification of tattoos, and 3 cases related to incorrect positioning.

In the delivery stage, five cases are relating to physical damage of patients due to the mechanical failures of equipment such as falling objects from the machine. The other four cases were initiated by malfunctioning of equipment which includes the failures of switch, indicator and software and the sudden drift of output. The third group of the delivery stage, i.e., human errors, accounts for two cases.

External radiotherapy facilities implement more than one protective safety measures to reduce accident potential, called the concept of "defence-in-depth," such that the safety objective can be achieved even if one of the measures fails [3]. This study could identify two categories of safety measures in the external radiotherapy: multiple independent checks performed by personnel and hardware interlocks actuated by systems. Multiple independent checks mean independency and redundancy in checking calculation and measurement performed by human as well as in checking the recording and transfer of data and instructions between stages or different media (e.g., treatment sheet or computer). This role of independent check is especially stressed in the external radiotherapy, since the treatment process largely relies on personnel's activities. System interlock is a safety function of system that detects any deviation from the normal operation and shut down the operation automatically to protect the patient from the undesired irradiation. These include emergency off and door switches, patient observation systems, and anti-collision systems.

The failures of safety measures for 41 cases were identifiable, while the event descriptions for 18 were not sufficient enough to discriminate the types of failures. The safety measures are divided into human actions and system interlock based on who performs the function. In 35 cases, the failure of independent check was pointed out as the contributor to the failure to detect the initiating event, as shown in Table 2. Three cases belong to the category of mishandling of equipment failure in which the personnel detected the equipment failure, but did not repair the problem correctly and decided to restart the machine.

Although only three cases belong to the system interlock, these cases can be categorized into two categories, i.e., no interlock and the interlock disabled by human errors. For one case, the safety analysis report indicated that there was no interlock system to detect the presence of an unexpected object in the beam and terminate the treatment. There were two cases in which the interlock systems did not function correctly due to human errors. In one case, in response to an equipment problem, the personnel decided to treat patients in physics mode which have disabled interlocks. In the other case, the installation technician enlarged the tolerance range to facilitate the adjustment of beam output and forgot to set is back to the correct values. Consequently, the interlock was not actuated in an initiating event. The failures of safety measures are summarized in Table 2.

Undesired consequences are classified in terms of two perspectives: the deviation from the prescriptions and the number of affected patients. First, the deviation from the prescription is discriminated into the wrong dose or the wrong volume. Following the criteria in the sources, the wrong dose includes the doses differed by larger than 5% from the descriptions, while the wrong volume includes the treatment of wrong patient as well as of wrong site. In addition, this study also considers the number of affected patients, i.e., a single or multiple patients, since it is an important factor in estimating the risk of external radiotherapy. The cases that do not belong to these taxonomies, but cause damages to patients are also identified.

Four groups of accident consequences were identified as a result of the review: 1) wrong dose for a single patient, 2) wrong dose for multiple patients, 3) wrong volume for a single patient, and 4) physical damage for a single patient. Table 3 represents the result of the classification for the consequences of 59 cases. Wrong dose for multiple patients accounts for 44% (n = 26), followed by wrong volume for a single patient (25%, n = 15), wrong dose for a single patient (17%, n = 11), and physical damage for a single patient (7%, n = 4). In addition, this study figured out that physical damage was also a potential risk for patients in the external radiotherapy. The consequences of three cases were not presented clearly in the reports. There was no event that belongs to the wrong volume for multiple patients.

This study grouped the accident sequences according to the similarity of progression. Among the total 59 accidents, there are 40 cases in which all the initiating event, safety measures, and consequences are identifiable. As a result, these cases can be categorized into 14 groups of accident sequences as shown in Table 4. This section provides short descriptions of accident sequence groups, starting with initiating events.

In the calibration stage, there is one group of sequences (n = 8), i.e., the largest group. This group is initiated by miscalibration of measuring instruments or beams which is caused by human errors. The initiating events are supposed to be detected by independent checker(s), but not discovered because the checkers fail to detect it or there is no checking procedure in the facility. This sequence usually causes incorrect dose for multiple patients, since measuring instruments or beams are used repeatedly for the patients who enter the treatment process unless the failure is detected.

In the planning stage, four groups of accident sequences were identified. By the initiating events, these can be divided into application of incorrect reference data (group 2), incorrect dose calculation (groups 3 and 4), and computer crash (group 5). In group 2, the initiating event, i.e., the application of incorrect reference data, was not detected by independent checkers so that it affected multiple patients in term of dose, since the reference data are repeatedly applied to the patients. The sequences initiated by incorrect dose calculation (groups 3 and 4) generally affected a single patient when independent checks fail. One case in group 5 was initiated by an equipment failure, i.e., computer crash, and mishandling of the failure led to the undesired consequence.

Two, but very different cases belong to the simulation stage. One case was initiated by a human error, i.e., incorrect localization of film, which was not discovered by independent checkers (group 6). The sequence led to an irradiation on the wrong site for a single patient. The other case was initiated by the electrical failure of the simulator (group 7). However, there was no interlock for preventing electrical shock to patients and then one patient was damaged physically.

In the stage of patient setup, one type of sequence was identified (group 8). The initiating events are caused by human errors, i.e., misidentification of patients or incorrect setup. Independent checkers failed to detect the initiating events and then the typical consequence was the irradiation on wrong volume for a single patient.

In the delivery stage, six types of accident sequences were identified. Equipment-initiated events (7 cases) are more dominant than human initiated events (2 cases) in this stage. There are three cases in which the patients were damaged physically by objects falling from the machines without any interlock or protection (group 9). In group 10, the initiating events, i.e., equipment malfunctioning, were detected by the personnel in the facilities. However, the failures were not properly corrected and then the facilities decided to restart the treatment. These sequences resulted in wrong doses for a single patient. In groups 11 and 12, the failure of safety measures, i.e., the failure of interlock, was induced by human errors. In group 13, a holder for port films was left in the beam during treatment. There was no interlock system to detect the presence of the plate. The sequence resulted in the deviation between the measured and expected output by 10% to 90%. In group 14, the technologist forgot to change the setup of rotation from the previous patient. This human error was not detected by independent checkers and led to the irradiation on the wrong volume for a patient.

The accident-sequence definition task provides a framework for the entire risk assessment of radiotherapy facility. It delineates the set of events that can initiate accident sequences and describes the facility functions or activities that can control those sequences. It is very difficult and effort-consuming to investigate all the potential initiating events and accident sequences of facility of interest. In this case, experiences of other facilities on the accidents can be a useful input to develop facility-specific initiating events and accident sequences for the risk assessment.

Some noteworthy findings by this study on initiating events are accident sequences are as follows:

1) Accident sequences in the calibration: A notable portion of adverse events (25%) were initiated in the calibration stage which is a pre-stage for the treatment process. This review shows that all the events in the calibration were caused by human errors, not detected by independent checks. These sequences are also worthy of specific interests, since they usually lead to the influence on multiple patients.

2) Large contribution of human errors in both initiating events and mitigation: Human errors contributed largely to the occurrences of adverse events (73%) as well as the failure of safety measures (68%). In specific, most of the accident sequences initiated by human errors (i.e., 30 out of 31 in Table 4) are coupled with the independent check as safety measure. The review also identified other failure such as mishandling of equipment failures and failure of interlocks caused by human errors.

3) Grouping the sequences by the number of affected patients: This study attempted to divide the accident sequences by the number of affected patients, i.e., into a single or multiple patients. This grouping is useful, especially since the accident sequences that may influence the large number of patients need special attention to reduce the risk of treatment.

4) Potential risk of physical damages to patients due to hardware failures: There were four cases in which mechanical (or electrical) failures of equipment caused physical damage to patients. It implies that the physical damage can be a potential consequence in the external radiotherapy.

As mentioned above, the risk of an accident can be obtained by the product of frequency and consequence of accident sequence. Frequency of accident sequences can be calculated by multiplying the frequency of initiating event by failure rates of safety measures which are included in the accident sequence. As an illustration for quantifying frequencies of accident sequences, consider an accident sequence initiated by miscalibration of a beam, which belongs to group 1 in Table 4, i.e., the largest number of cases identified. It is assumed that this accident is initiated by human error in calibrating a beam that has three parameters adjusted and two independent checkers fail to find out this calibration error. Unfortunately, the database that contains human error probability and equipment failure rate is very rare in the medical sector, since the probabilistic risk assessment is not common. To illustrate the applicability in the medical sector, this study uses error probabilities from the nuclear industry where the probabilistic risk assessment is generally required by the regulation and then some databases and guidelines are available. The frequency of this accident sequence can be quantified if the error probabilities are borrowed from the reference [8], which introduces a technique for estimating human errors in nuclear power plant application. This study simply assumes that a technician calibrates three set-points in the radiotherapy beam machine and two persons are supposed to check the calibration task independently. According to reference [8], the calibration error for the tasks and independent checker's error are estimated to be 0.001 and 0.1/trial, respectively.

Then, the frequency of accident sequence can be estimated to be 1 × 10^-5/trial, as shown in Fig. 2. Fatalities or the number of affected patients can be used as a consequence in the external radiotherapy. If it is simply assumed that ten patients are affected until the miscalibration is detected, the risk of this accident becomes 1 × 10^-5/trial × 10 patients = 1 × 10^-4 patients/trial.

In estimating the risk with the proposed method, two quantities need to be known, i.e., failure rate and consequence. It should be noted that the failure data in the example are more or less relevant to tasks in nuclear power plant operations. As discussed above, human error would be the major contributing factor to the risk in the external radiotherapy. Therefore, human reliability analysis needs to be highlighted when the probabilistic risk assessment is applied. Since task characteristics and factors influencing human performance are expected to be different from the other industries, e.g., nuclear industry, the study on the methods and the guidelines of human reliability analysis relevant for the healthcare needs to be carried out. Available techniques for human reliability analysis in the healthcare are well reviewed in reference [9].

The consequence of the accident may rely on the characteristics of initiating events and the work practice of the facility. While an error in the patient setup may affect a single patient being treated, some errors in the calibration can influence multiple patients. The number of patient affected is also related to the work practice in the facility. If the calibration error may be detected in the next calibration task, the number of patients affected is dependent upon how frequently the machine is calibrated and how many patients are treated in the period between calibrations.

This study investigated initiating events, failures of safety measures, and their consequences from the past accidents reported in the retrospective safety analyses for the external radiotherapy facilities. The aim was to provide the useful information associated with a specific occurrence and context for the risk analysis. Those aspects are expected to serve as the key elements for the model of accident scenarios in the quantitative risk analysis.