By Blandine Antoine M. Sc. Nuclear Engineering, University Of
Total Page:16
File Type:pdf, Size:1020Kb
SYSTEMS THEORETIC HAZARD ANALYSIS (STPA) APPLIED TO THE RISK REVIEW OF COMPLEX SYSTEMS : AN EXAMPLE FROM THE MEDICAL DEVICE INDUSTRY by Blandine Antoine M. Sc. Nuclear Engineering, University of California Berkeley, 2005 Dipl. Ing. Ecole Polytechnique, 2006 M.P.A. Ecole Nationale des Ponts et Chaussées, 2007 Submitted to the Engineering Systems Division in partial fulfillment of the requirements for the degree of Doctor of Philosophy at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY February 2013 © 2013 Massachusetts Institute of Technology. All rights reserved. Signature of Author………………………………………………………………………………. Engineering Systems Division, October 17th, 2012 Certified by……………………………………………………………………………………….. Prof. Nancy Leveson Professor of Engineering Systems and Aeronautics and Astronautics Thesis Committee Chair Certified by……………………………………………………………………………………….. Prof. Olivier de Weck Associate Professor of Aeronautics and Astronautics and Engineering Systems Thesis Committee Member Certified by……………………………………………………………………………………….. Prof. Joseph Sussman JR East Professor of Civil and Environmental Engineering and Engineering Systems Thesis Committee Member Certified by……………………………………………………………………………………..… Dr. Christian Hilbes Lecturer at the School of Engineering of the Zurich University of Applied Sciences (ZHAW) Thesis Committee Member Accepted by………………………………………………………………………….................. Prof. Olivier de Weck Associate Professor of Aeronautics and Astronautics and Engineering Systems Chair, Engineering Systems Division Education Committee 1 PAGE INTENTIONALLY LEFT BLANK 2 To Christophe and our children Blessed be the light, your smiles, and our learning journeys. 3 PAGE INTENTIONALLY LEFT BLANK 4 Abstract Methods developed by system engineers could beneficially be applied to the challenge of ensuring patient safety in health care delivery. Achieving safe operations in this and other settings requires that system behavior be bound by safety constraints. These must be defined and enforced at every stage of system design, system operations and, when applicable, system retirement. Traditional methods to identify and document hazards, and the corresponding safety constraints, are lacking in their ability to account for human, software and sub-system interactions in highly technical systems. STAMP, a systems-theoretic accident causality model, was created to overcome these limitations. STAMP offers consideration for context and design features that can lead to unsafe behavior, including behavior resulting from unsafe interactions among correctly operating system elements. The application of STAMP hazard analysis method STPA to five sub-systems of the experimental PROSCAN proton therapy system operated by the Paul Scherrer Institute in Switzerland demonstrated how STPA can augment design and risk review activities of existing complex systems. Focusing on treatment delivery, this case study did not analyze any of the 5 controllers active in treatment planning. With varying degrees of detail, it looked at 2 of the 5 human controllers active in treatment delivery (nurse and local operator), 2 of the 4 process attributes controlled by the PROSCAN facility (on/off function and beam to target alignment), and 1 of the 4 control loops that control the beam to target alignment attribute. In the process of performing this case study, the following contributions were made: - Analyzed the regulations currently in place on the US and European markets for the marketing of external beam radiotherapy devices and, more generally, medical devices that do not contain radioactive materials, and conclude that STPA would fit well in both; - Provided experience in applying STPA to a complex device. Information on efficacy was derived by comparing STPA results with an existing safety assessment but a more formal counterpart is needed for stronger evidence. Information on learnability and usability was obtained when an informal workshop showed that system designers, in the course of one day, could be taught to use STPA to push their thinking about yet to be designed system elements; - Demonstrated the applicability of STPA to an experimental radiotherapy facility and, through this feasibility check, potentially influenced the state of the art in hazard analysis of medical devices; - Advanced the STPA methodology by creating notations and a process to document, query and visualize the possibly large number of hazardous scenarios identified by STPA analyses, with the goal of facilitating their review and use by their intended audience; - Showed how STPA is complementary to more traditional hazard analysis techniques such as fault and event trees. Their respective strengths can be summoned when STPA is used to identify areas on which to focus the investigation lens of traditional hazard analysis techniques. Keywords: STAMP, STPA, hazard analysis, risk analysis, risk management, proton therapy, medical devices, safety, certification 5 PAGE INTENTIONALLY LEFT BLANK 6 Acknowledgments "Travaillez, prenez de la peine: C'est le fonds qui manque le moins. [...]Un trésor est caché dedans." "Work hard, sweat all you can: Riches is what counts the least. [...]A treasure is hidden in [the field]. " Jean de la Fontaine, 1668 - Le Laboureur et ses Enfants Five full years have passed since I joined ESD. This journey has been a humbling experience, a quest whose treasure, as in the ploughman's fable that Jean de la Fontaine borrowed from Aesop, was not the one I had set off to seek. γν ῶθι σεαυτόν truly is a difficult task! And one that I now understand to still be far from completion. My recovery I owe to Professor Nancy Leveson. She offered me a shelter when I wanted to quit it all, confidence to undertake a new project, incredibly prompt comments on all thoughts submitted to her review, frequent refocusing ordeals, a desk with a window (precious!) and the opportunity to work with a magnificent team of colleagues. I am immensely grateful to Professor Olivier de Weck for the generous attention and respectful consideration he has for people in general, and students in particular. I thank Professor Joseph Sussman and him for their faith in this project, for their patience and the wisdom of their guidance, for being the best committee members one could dream of. Dr. Christian Hilbes, from the School of Engineering of the Zurich University of Applied Sciences (ZHAW) initiated and coordinated the research project on which this dissertation builds. He is gladly credited for having pushed my work to higher levels of rigor thanks to his sharp comments, insatiable curiosity, and encyclopedic knowledge of the issues associated with certifying complex systems in the EU and investigating the safety issues they are associated with: thank you! None of the results presented in this dissertation could have been obtained without the dedication of Paul Scherrer Institute's Martin Rejzek. For his help, his friendliness, and his availability to work with me on the analysis of the Gantry-2 user area, I am truly grateful. I also warmly thank Dr. Martin Grossman for the support he has provided to this research project, arranging for its funding by the Paul Scherrer Institute, providing detailed arrangements for all logistical issues, organizing for the PROSCAN design and operation teams to provide input to our analysis, and being such a pleasant person to interact with. I gratefully acknowledge funding from the Paul Scherrer Institute, warm encouragements from PSI Vice-Director Dr. Martin Jermann, and very generous welcome from all the PROSCAN staff to this research. To those who trusted more than I did that this project could be honorably completed: Dr. Christophe Antoine who shouldered a large share of my household responsibilities during these 7 five years, the Laurenty and Antoine families who never hesitated to send thoughts and more across the Atlantic ocean as they understood that more help was needed than I wished to acknowledge, old and new friends in France and the USA, Dr. Franck Carré, Professor Jessika Trancik who also provided TA-ing opportunities that were providential in bridging funding gaps, Francisco Llemos, Eric Pité, Dr. David Opolon, Dr. Philippe Bonefoy, members of the Fondation Carnot, Dr. Ioannis Simaiakis, Dr. Claire Cizaire, Dr. Noemie Chocat, Mario Bernhart. To those who took such great care of my family while I was working on this project: Mrs. Nilda Marquez, Mrs. Leonidas Rodriguez, and the teaching and management staff at the MIT Technology Children Center. To those women who nurtured me, helped me grow and made me realize that, yes, there are different things to be learned from women than there are from men: Claire de Mazancourt, Dr. Lisa d'Ambrosio, Dr. Caroline Brun, Dr. Lynette Cheah, Dr. Karen Tapia-Ahumada, Jacqueline Donoghue, Erica Bates, Professor Hamsa Balakrishnan, visitors to the women restrooms who shared their motherly experiences when they would see me dutifully pumping for Clélia and Paul-Hector, and the Boston Team Handball's ladies, especially Dr. Sonja Hansen, Erin Kitzler, Anne Coulter and Annie Felix. To the diverse, unique and beautiful CSRL team that has made coming to campus a joy every morning of the past two years, was always available for a quick (exception made of food safety and political topics!) chat or a longer theoretical debate, shared their intelligent minds as frequent ideas sounding boards and regularly offered fuel for thoughts and for chocolate-craving guts: John Thomas, Cody Fleming, John Helferich, Melissa Spencer, Ibrahim