Accident prevention in case of radiotherapy equipment malfunction
Major cases of accidental exposures in external beam
» Accelerator software problems (USA and Canada)
» Incorrect repair of accelerator (Spain)
» Accelerator interlock failure (Poland)
Major cases of accidental exposures in brachytherapy
Accelerator software problems (USA and Canada)
Six events of accidental exposure, relating to the same type of accelerator and involving massive overdoses, are known to have happened in the 1980's in USA and Canada. This type of accelerator relied on software for safety, while older models had mechanical and electrical safety interlocks. Several of these events involved unintended carousel positioning prior to treatment.
A typical event could look like this: the operator had in error selected "X" for X rays instead of "E" for electrons and thus moved the cursor up on the screen to correct the entry, followed by hitting the return key several times to skip to the bottom of the screen, and press "B" for "beam-on". The console would then display 'Malfunction 54' and 'treatment pause'. To start irradiation again, the operator would press "P" for "proceed".
Only later, the real cause was discovered - the speed of entering parameters meant that a malfunction was permitted through the design of the software. This caused the accelerator carousel to be improperly set up for the radiation modality. The result was extremely high electron energy fluence, being repeated several times (by attempting to "proceed" several times), and directed towards the patient. Patients would react immediately, e.g. complaining about feeling a burning sensation but the malfunction’s intermittent characteristics (relying on speed of keyboard input) made the problem difficult to isolate.
Lessons learned for health professionals
- Listen, observe, report, and follow-up on patient reactions and carefully investigate all reports of abnormal operation;
- Include in the Quality Assurance programme a review of procedures for reporting unusual events.
Lessons learned for manufacturers
- Use established software engineering practices;
- Keep designs simple;
- Build in software error logging & audit trails;
- Proceed with extensive software testing and formal analysis at all levels;
- Don't rely only on software for safety and make sure to incorporate redundancy;
- Pay careful attention to human factors and make sure to involve users at all phases.
Read more:
- ALDRICH, J.E., ANDREW, J.W., MICHAELS, H.B., O'BRIEN, P.F., Characteristics of the photon beam from a new 25 MV linear accelerator, Med. Phys. 12 5 (1985) 619-624.
- LEVESON, N.G., TURNER, C.S., An investigation of the Therac-25 accidents, IEEE Computer 26 (1993) 18-41.
- O'BRIEN, P., MICHAELS, H.B., ALDRICH, J.E., ANDREW, J.W., Characteristics of electron beams from a new 25 MeV linear accelerator, Med. Phys. 12 6(1985) 799-805.
- O'BRIEN, P., MICHAELS, H.B., GILLIES, B., ALDRICH, J.E., ANDREW, J.W., Radiation protection aspects of a new high-energy linear accelerator, Med. Phys. 12 1 (1985) 101-107.
Incorrect repair of accelerator (Spain)
In December 1990, a linear accelerator broke down in a hospital in Spain. A technician from the company was nearby, maintaining a cobalt unit, and was called over to the accelerator. The technician started repair work the following work day, recovering the beam, but an instrument on the control panel always indicated the maximum electron energy (36 MeV), regardless of the selected electron energy value e.g. 7, 10, 13 MeV. Treatments resumed in a few days. The technologists observed the discrepancy between the energy selected and the one indicated on the instrument on the control panel. The interpretation was that the indicator must have got stuck at 36 MeV, while the selected energy was the one indicated on the energy selection keyboard.
What actually happened is that a transistor had short-circuited, and independent of the voltage at the base, a full current was always fed to the magnet system. This made it possible to get a beam only when maximum electron energy was used. To get a beam for each of the electron energies, they had all been adjusted to the maximum energy.
The design of this accelerator meant that a homogenous field was achieved through scanning of the electron beam, where the current of the scanning magnet had to match the selected electron energy. As the electron energy was at its maximum, the deflection in the scanning magnets was too small and the field thus became concentrated in the centre. This increased the energy fluence and therefore the dose. For 7 MeV, the absorbed dose was about 9 times the intended. This resulting increase in dose was smaller for higher energies and it became nearly unity when the selected energy coincided with the actual energy. During the 10 days of faulty operations, 27 patients were treated using electrons with the equipment. Of the 27 patients, 15 died as a consequence of the overexposure (most of them within 1 year). Two more died with radiation as a major contributing factor.
Lessons learned for health professionals
Include in the Quality Assurance programme:
- Formal procedures for returning medical equipment after maintenance;
- Formal procedures for making it mandatory to report returned medical equipment to the Physics group, before resuming treatment with patients;
- Consideration of the need to verify the radiation beam by the Physics group, when the repair might have affected beam parameters;
- Procedure to perform a full review or investigation when unusual displays or behaviour of the radiotherapy equipment occurs.
Read more:
- SOCIEDAD ESPAÑOLA DE FÍSICA MÉDICA, The Accident of the Linear Accelerator in the "Hospital Clínico de Zaragoza", SEFM, Madrid (1991).
Accelerator interlock failure (Poland)
Five patients were affected by accidental exposure in a hospital in Poland in 2001. Following a power failure at the department, an accelerator was automatically shut down. When electrical power was restored, the accelerator was restarted and some tests were completed without any indication of problem, except a low dose rate indication, which led to the filament current limitation being increased to a high level by staff. The remaining treatments were completed. Two of the patients indicated that they sensed a burning sensation during treatment. The accelerator was taken out of clinical use after the last patient had been treated, and a physicist measured the absorbed dose on the unit. The reading was extremely high.
Further investigations revealed that there had been a double fault: (1) a fault in a fuse of the power supply to the beam monitoring system lead to a high dose rate, even though the display indicated a lower value than normal; and (2) a diode was broken in the safety interlock chain, which should be indicating problems in the dosimetry system. These faults combined, through the design of the system, meant that no problem was indicated, while dose rate was many times higher than intended. All five patients received substantial overdoses and developed local radiation injuries of varying severities.
Lessons learned for health professionals
- Check dose immediately after start-up following power supply shut downs or in occurrences of any unusual display of dose rate or beam asymmetry;
- React and investigate immediately when patients show unusual reactions.
Lessons learned for manufacturers
- Ensure compliance with IEC safety standards;
- Provide explicit recommendations to users on procedures for tests to be performed before resuming operation after power cuts;
- Include lessons from accidental exposures in training for maintenance engineers;
- Restrict access to safety critical adjustments to maintenance engineers certified by the manufacturer.
Read more:
In 1992, a patient was being treated for anal carcinoma in Indiana, USA, using a high dose rate brachytherapy afterloader, where the source is attached to a wire that can be extended under remote control through one or more catheters in succession into the patient. Five catheters had been placed into the target volume, and a pre-treatment check using a dummy wire testing the catheters had been completed without problems. When the source was being introduced into the catheters, this went well for the first four of these. Upon attempting to direct the source into the fifth catheter, the control console reported an error. After several attempts, the treatment was abandoned.
When the treatment was terminated, the staff entered the treatment room, disconnected the HDR unit from the implanted catheters and removed the patient. An area radiation alarm indicated high radiation levels, but this was ignored. The staff later reported that the alarm "often malfunctioned" and they were used to ignore it. A radiation survey meter was available but was not used to confirm or rule out the area alarm's signal. The HDR console reported that the source was "safe" and the patient was transported back to her nursing home. The hospital staff did not recognize that the source had broken loose from the guide wire, and had remained inside the catheter.
The catheters remained in the patient, with the HDR source, as the patient was transported back to the nursing home. The catheter containing the source fell out four days later and was placed in a "medical biohazard" trash bag. A radiation detector identified radiation emissions from the trash in a trailer sometime later, and the source could be traced back to its origin. The patient had received a massive overdose, and died shortly after the source fell out.
Lessons learned for health professionals:
- Ensure that all staff are:
- Properly trained in radiation safety procedures;
- Properly trained in the operation of equipment;
- Properly trained for emergency situations.
- Include in the Quality Assurance programme:
- Formal procedures for verifying the proper operation of the HDR remote afterloading equipment before patient treatments;
- Formal procedures for verifying the operation of radiation safety equipment;
- Formal procedures for using radiation safety equipment when radioactive materials are used for therapy.
- Perform surveys of HDR patients to ensure that the source has returned properly to the shield after treatment;
Read more:
- NUCLEAR REGULATORY COMMISSION, Report to Congress on Abnormal Occurrences. 92-18. Loss of Iridium-192 Source and Medical Therapy Misadministration at Indiana Regional Cancer Center in Indiana, Pennsylvania, NUREG-0090, Volume 15, No. 4. USNRC, Washington DC (1992).
References:
- INTERNATIONAL ATOMIC ENERGY AGENCY, Lessons Learned from Accidental Exposures in Radiotherapy, IAEA Safety Reports Series No. 17, IAEA, Vienna (2000).
- INTERNATIONAL COMMISSION ON RADIOLOGICAL PROTECTION, Prevention of Accidental Exposures to Patients Undergoing Radiation Therapy, ICRP Publication 86, Pergamon Press, Oxford and New York (2000).