© SFRP, 2021

1 Introduction

Radiation therapy is one of three major methods of treating cancer along with surgery and chemotherapy. It is used in more than 50% of cancer cases. To reach its maximum level of efficacy (a cure in 80% of cases), the dose of radiation must be delivered with great ballistic precision to the tumour and must spare the organs at risk and the surrounding healthy tissues; the curative effect should be obtained while avoiding or minimising the immediate (acute) and late (complications, sequelae) side effects. In radiotherapy, the benefit/risk equation is particular because the dose delivered is high. A lower dose exposes the patient to the risk of cancer recurrence and a higher dose to the risk of damage to healthy cells and tissues. To obtain this ballistic precision, the volume to be irradiated, the distribution of the dose in the target volumes and organs at risk, the positioning of the patient (and their repositioning at each session), the delivery of the dose as prescribed by the radiation oncologist, etc., must be complied with, whereas the clinical practice of radiotherapy is just-in-time within the departments and changes regularly due to technical progress. Radiotherapy is therefore a complex activity that is not devoid of risks (Bourguignon, 2019; Bulot, 2019a, 2019b, 2019c), as evidenced by the occurrence of accidents, particularly that of Epinal in France (IRSN, 2007).

Radiation therapy, like any type of care, should be carried out with maximum protection of the patient from the risk of accidents and adverse effects. In this respect, radiation therapy is no different from hazardous industrial activities and must implement risk management approaches.

Risk management is traditionally deployed on at least two levels. The first level is that of risk management policies characterised by Desroche et al. (2006) like all policies defined by a public or private authority and implemented by an organisation to take into account and manage risks (Desroche et al., 2006). “Risk management corresponds to the decision-making process and the policies implemented to reduce or eradicate a risk, based on scientific characterisation of the risk but also legal, economic, social, or strategic data relative to the problem” (Boudia and Demortain, 2014).

The second level is that of the specific methods used to analyse the risks of accidents and to define provisions to reduce their occurrence or the severity of their consequences. These methods aim to characterise the risks and then to define and implement successive and complementary countermeasures (equipment, operating limits, control and monitoring, etc.), often referred to as “safety barriers”. In nuclear power, safety analysis consists of ensuring the validity of each confinement barrier, its independence, and its correct operation under normal and accident conditions (Couturier, 2020). Since the occurrence of serious accidents in radiation therapy in France, this concept of safety barrier is used to evaluate the technical and human provisions defined to make this care process safe (Meyrieux et al., 2012; François et al., 2010; Pernet 2013; Reitz, 2014; Brusadin et al., 2017; Thellier, 2017)

This article focuses on the human safety barriers deployed in radiation therapy, i.e. validation, control, and verification actions (measurements, calculations, tests) that ensure that the right dose is delivered to the right patient, at the right time and in the right place. In this article, we present an analysis of the concept of a safety barrier to identify its limits of application in radiotherapy.

A review of the literature led us, in the first part, to define the concept of a safety barrier, then in the second part to present its performance criteria, and finally in the third part to characterise various limits. The fourth part is dedicated to the analysis of an activity considered as a safety barrier in radiotherapy: “patient positioning control”. These results make it possible in the discussion to propose the concept of an activity contributing to safety in order to cope with the limits of the concept of safety barriers.

2 The concept of a safety barrier and its limits

2.1 Different definitions of the concept of safety barrier

To define a safety barrier, Iddir (2012) refers to the circular of 10 May 2010 on the safety of facilities classified for the protection of the environment. It is “a set of technical and/or organisational elements necessary and sufficient to ensure a safety function”. This safety function is defined by the same circular as: “a function intended to reduce the probability of occurrence and/or the effects and consequences of an unwanted event in a system. The main actions ensured by the major accident safety functions in classified facilities are: prevent, avoid, detect, control, limit, etc.” (Iddir, 2012).

According to Sklet (2005), safety barriers “are physical and/or non-physical means intended to prevent, control or mitigate unwanted events or accidents. The means can range from a simple technical unit or human action, to a complex socio-technical system” (Sklet, 2005). Størseth and his colleagues (2014) speak instead of “barrier elements”. The element is defined as “a measure or solution directly involved in achieving a barrier function” (Størseth et al., 2014).

Generally, safety barriers are divided into 2 classes (“technical” and “non-technical”) (Øien et al., 2015). Technical barriers are physical barriers, whereas non-technical barriers refer to immaterial barriers of an administrative, organisational, human, operational or management nature. This second category is sometimes broken down into 2 parts: human barriers and organisational barriers. The French national authority for health (HAS) describes other types of immaterial barriers: laws and regulations, guidelines, best safety practices, recommendations, procedures and protocols, training programmes, etc. (HAS, 2012).

According to the French National Institute for the Study of Industrial Environments and Risks (INERIS), human barriers consist of a human activity (one or more operations) that prevents or opposes the sequence of events likely to lead to an accident (INERIS, 2009). Human barriers can be functions and activities whose role is to prevent or compensate for the deviation of a process or activity at risk (compensation barriers). They may also take place upstream of an activity or before the start of a process that is likely to present major accident risks. Preparation of this activity is referred to from a safety perspective (verification barriers). “They are defined by the safety function they perform in relation to a major accident scenario. […] Most often, they are associated with a technical component (interaction with a system)” (INERIS, 2009). The human barrier can also refer to tasks to be performed by an operator or by a team of operators according to a procedure (Johansen and Rausand, 2015). This distinction between task-type and activity-type human barriers is reminiscent of the distinction between regulated and managed safety.

The Chartered Institute of Ergonomics and Human Factors (CIEHF) work group guides the definition of human safety barriers on control strategies (Fig. 1) (CIEHF, 2016). For others, human safety barriers are in addition to existing safety and control measures during normal operation (Øien et al., 2015).

While in the field of healthcare it is essentially the concept of safety barriers that is used, other concepts, which may be associated with the concept of a barrier, appear in the literature: “risk management measures”, “protective measures”, “countermeasures” or “lines of defence” in the nuclear industry, and “critical safety elements” or “safety functions” in other risk industries (chemical, oil, etc.). These different concepts introduce clarifications and distinctions.

Fig. 1 Summary of the different representations of human safety barriers.

2.2 Performance of a human safety barrier

The term safety barrier guides the analysis of its performance as to safety functions, i.e. their ability to prevent the occurrence of identified risks or to stop an accident scenario. Evaluating the performance of safety barriers makes it possible, in theory, to determine the level of risk management. Depending on the author, different dimensions can be studied to determine the performance of a safety barrier: its reliability, in particular its ability to operate on demand (Sklet, 2005) or its ability to withstand failures (Neogy et al., 1996); its availability, in other words its ability to perform a function in response to demand or when needed (Sklet, 2005); its robustness, in particular its ability to operate during accident sequences or in degraded mode (Sklet, 2005) or to withstand environmental variability (Hollnagel, 1995); its effectiveness, in other words its ability to perform a specified function under given technical, environmental and operational conditions (Sklet, 2005) or in its context of use and for a given duration of operation (INERIS, 2018); its efficiency, in other words its ability to achieve its objectives (Hollnagel, 1995); and its validity, in other words its ability to manage deviations, threats, etc. (Sklet, 2005).

The CIEHF work group proposes six other criteria for evaluating the “control” safety barrier, including when it is carried out by an operator: having a clear role, being traceable to the management system, being specific, independent, effective and capable of being ensured. Some of these criteria relate to a single defence barrier (specific and independent) and these two elements raise the question of the conditions for performing a control, without specifying how to evaluate them (CIEHF, 2016).

The European ARAMIS project proposes a methodology, which in its final stage, assesses the vulnerability of a safety barrier based on seven elements that have a direct impact on its level of confidence (scheduling and workforce availability; skill and ability; commitment, compliance and conflict resolution; communication and coordination; procedures, rules and objectives; purchasing hardware/software, construction, interface, and installation; and inspection, maintenance, and hardware/software replacement). The “design” confidence level of the barrier is assessed, as well as the properties of the barrier and its components (hardware, software or human behaviour) (ARAMIS, 2004).

INERIS Omega 20 method proposes breaking down human safety barriers into three main sub-tasks: detection, diagnosis and action, and then evaluating the influence of the environment on performing each of these sub-tasks (INERIS, 2009). To assess the safety barrier, INERIS uses the confidence level (CL) criterion. It makes it possible to “determine a factor for reducing the risk of accidents induced by the Barriers”. Different determining factors can then be analysed: the presentation of and access to the information, the availability of the operator, the quality of useful information for diagnosis, the level of guidance for choosing the action, the level of stress in the context of the action, and the level of requirement and complexity of the action. These three sub-tasks refer to the Rasmussen model for which human activity is broken down into several stages of information processing: information acquisition to detect an abnormal event; information processing to assess the current situation; and decision-making to control the observed event (Rasmussen, 1983; Vanderhaegen, 2003).

2.3 Limitations of the concept of a safety barrier

Several limitations of the safety barrier concept have been identified in the literature. We describe here in greater detail the difficulties in classifying, defining and evaluating safety barriers.

2.3.1 Classification difficulties

The diversity of safety barriers according to the field makes the concept unclear. Hollnagel (1999) defined barriers as obstacles, obstructions, or hindrances that can either prevent an inappropriate action or the occurrence of an event or prevent or lessen the impact of its consequences. In the field of production, three safety barriers are described to avoid human error and to reduce the risks associated with human behaviour: the barrier of the designer of the production tool, the barrier of the operator which includes it into the existing work environment, and users’ barriers (Vanderhaegen, 2003). In the medical field, the HAS (2012) describes material and immaterial barriers to block and recover from the errors of the healthcare team. In radiotherapy, three types of safety barriers are traditionally described: technical, human, and organisational barriers (HAS, 2012). In the financial sector, Steinmetz (2020) refers to risk management lines. They clarify each person’s roles and responsibilities to avoid uncontrolled or over-controlled risks. Each employee can thus find their place in the risk management structure and understand the issues and limits of their responsibilities. The first line is at the operational level (implementation of controls and application of control procedures); the second line concerns the “Risk, Compliance, Quality” departments (supervision of the implementation of controls); and the third line is embodied by internal audits and guarantees the effectiveness of risk management. Internal management and the board of directors as well as external regulators and auditors are also included in the model (Steinmetz, 2020).

The diversity of the barriers is confirmed by Sklet’s literature review (2005). This author found “no common terminology applicable across the application sectors and fields”. For some authors, this diversity is a factor of ambiguity: “There are inconsistencies between the various users of barrier models as well as in the published literature regarding the nature and classification of barriers and their components” (CIEHF, 2016). For example, the “control” type safety barrier is controversial. While some authors consider controls as safety barriers (Johansen and Rausand, 2015; CIEHF, 2016; INERIS 2009, 2018), the authors of the SINTEF report distinguish between the two (Øien et al., 2015). For the SINTEF authors, the controls take on the status of a safety barrier only when they are mobilised to manage and control the kinetics of an incident phenomenon or an accident situation (recovery, mitigation).

2.3.2 Difficulties in defining safety barriers

Defining safety barriers is not always easy to do, in particular because any technical, human and/or organisational arrangements to prevent the occurrence of an accident scenario can be considered as a barrier. Sklet (2005) considers that this broad definition weakens the very concept of a barrier and does not provide sufficient information on the attributes that a barrier should have (Sklet, 2005). Conversely, too narrow a definition of the critical situation may weaken the definition of safety barriers (CIEHF, 2016). The safety barrier is defined or formalised in relation to a specific risk. Since there are a multitude of risks more or less related to each other and more or less easy to characterise, certain safety barriers may not be defined, and certain safety functions may not have been considered. The accident is often more creative and surprising than scenarios developed by risk management specialists. In addition, it is difficult to choose barriers that strike the right balance between risk control referring to regulated safety and the resilience underlying managed safety (CIEFH report). Finally, the definition of barriers to making a high-risk activity safe is not self-evident. For example, in the nuclear industry, “[…] if the definition of the first barrier is simple (all the sheaths of fuel rods), the accurate definition of the others is not without difficulties (reactor coolant system boundary, containment)” (Couturier, 2020).

2.3.3 Difficulties in assessing the performance of safety barriers

Safety barriers, whether technical, human or organisational, are not always 100% effective in real work situations (Pitblado and Nelson, 2013). Therefore, their vulnerabilities need to be investigated in detail. Despite the existence of different analytical criteria, the performance of a safety barrier is difficult to establish due to the existence of multiple challenges. They may fall within the limits of the evaluation method, the architecture of the safety barriers, their design, the influence of the context and the working situation, the human nature of the evaluation, and the organisation of the feedback.

Limitations related to assessment methods concerning the choice of the barrier to be analysed, its categorisation (equipment, procedure, skills, communication, availability, etc.) and the identification of vulnerabilities (ARAMIS, 2004). In the Reason model, the “Swiss Cheese Model” (Reason, 2000), characterisation seems easy because each “slice of cheese” represents a line of defence of the system (Larouzée et al., 2014) of a particular type. These defences may relate to the organisation (management, decisions, etc.), the workspace (unfavourable or favourable conditions for errors and violations), operators (errors and violations resulting from compromises and arbitrations of incompatible objectives), and technical elements. A safety barrier may be composed of several dimensions. INERIS describes, for example, “mixed barriers with technical and human components: the operator interacts with the technical elements of the safety system that they monitor or act on” (INERIS, 2018). The multidimensional nature of a safety barrier can make it difficult to assess its performance.

Safety barriers can be structured into a genuinely organised system. For example, in nuclear power, the safety approach developed in France relies on the serial interposition of multiple physical barriers between radioactive products, human beings and the environment (Couturier, 2020). The possible interdependence of safety barriers makes it difficult to assess the performance of one of them because it is difficult to analyse their multiple influences (Pitblado and Nelson, 2013). Risk analysis methods are generally set out to evaluate a single barrier, independently of each other, which limits the relevance of the analysis.

Another evaluation limitation is related to the design of the safety barrier. It may take several years to discover that the performance of a barrier is actually below the required performance. The robustness of the safety barrier is not as high as expected during design and the risk of accidents is potentially higher than expected (SINTEF report).

Another limitation is the difficulty of taking account of the context and work situations. Although some authors propose to evaluate human safety barriers by considering the possible effects of the environment, the context, the work organisation and the working conditions of various disciplines on their application (INERIS, 2009), it is difficult to consider their diversity within a reasonable analysis time. On the other hand, it is more difficult to question certain vulnerabilities in safety barriers, for example when they are part of organisational and strategic choices that may be detrimental to safety. In at-risk industries, “relatively high production pressures are a major cause of accidents, especially when specific safety measures or measures that could offset the effects of productive pressures are not taken” (Llory et al., 2001). Management influences on a safety barrier are rarely studied while “the most harmful effects are possible when a form of management autism develops, where top management sets non-negotiable objectives, and does not pay attention to the difficulties experienced by the actors who carry out the activity” (Conjard and Journoud, 2013).

The performance of human safety barriers is also difficult to assess because the level of human performance required for the barrier to function is rarely or never specified (CIEFH report). The assessment of skills and the simple application of safety rules as presented in the procedures is insufficient to characterise the robustness of these human barriers (INERIS, 2009). Some of their dimensions are subjective, others are invisible and escape analysis. For example, it is not easy to assess the skill of an operator or the quality of a given procedure (Øien et al., 2015).

Finally, feedback on barrier failures is poorly organised in the medical field in France and in the international industrial sector. There is a lack of awareness and reporting of barrier failures: “A particular risk is that the inputs to a barrier analysis are not realistic and properly informed about operational realities” (CIEHF, 2016).

In the following chapter, we propose to study “controlling the positioning of the patient by imaging” by the radiographer, in the position of a human safety barrier mobilised in radiotherapy to make the care process safe.

3 Study of a human safety barrier: monitoring patient positioning by imaging

3.1 Safety barrier and technological change

In the field of radiation therapy, human safety barriers are essentially based on a balance between the ability of the healthcare team to perform prescribed safety tasks (preparation, measurement or calculation, testing, control, verification, validation, monitoring, detection, arbitration, traceability of actions, etc.) and to adapt them when actual work situations depart from the planned work situations. One of the conditions of risk control is to ensure that the patient’s positioning is reproduced at each treatment session. A safety barrier consists in controlling this positioning, in particular with the aid of medical imaging (Fig. 2). Specifically, for radiographers (MERM in French), it is a question of comparing reference images of the positioning taken by the scanner at the start of the treatment, with the images taken on the day of the treatment, in order to identify any differences between the two, and then reduce them by moving the treatment table.

Technological developments in radiation therapy are at a steady pace, which can be the cause of difficulties in the use or mastery of equipment by professionals, especially as this equipment is increasingly complex (IRSN, 2011). As part of a research project to understand the appropriation of a new system, we analysed the effects of introducing a new medical imaging system (MIS) on the safety barrier of “control of patient positioning by imaging” (IRSN, 2021). One of the hypotheses of the study is that the period of appropriation of the new system destabilises work practices and thus reveals the points of fragility of human safety barriers, which will then be “masked” by experience. Data from the study were collected at a Cancer Centre between 2014 and 2017. These data reflect the experience and organisation of this radiotherapy centre at the time of collection. Some data are obsolete due to technical and organisational changes since 2017 but their analysis makes it possible to understand how a control can be impacted by a technical change.

The research revealed various effects of the implementation of a new imaging system on the practices and organisation of the “control of patient positioning by imaging”:

• three major stages of this safety activity have been impacted: the preparation and production of images, the identification of offsets, and the reduction of offsets;

• the practices, roles and responsibilities for this control have changed;

• the difficulties of interaction between doctors and radiographers when capturing images and between doctors, physicists and radiographers when detecting these offsets have increased;

• the development of automation has led to a reduction in the possible detection of parameter drifts (“black box” effect) and control of the technical system by the healthcare team (uncertainties);

• the radiographers had to acquire new skills and expertise within a short period of time;

• what was learned in training sessions had to be adapted when it was implemented in real situations (uncertainties in the deployment and the use of the medical imaging system (MIS)).

Analysis of the effects of the change in the MIS on the “control of the patient positioning by imaging” (Fig. 2) made it possible to identify points of fragility at the stages of preparation and production of the images, detection and then reduction of the offsets.

Fig. 2 Modification of the safety activity following the implementation of a new Medical Imaging System (MIS).

3.2 Image preparation and acquisition step

The introduction of the new MIS has created three new vulnerabilities. The first one existed before the technical change but was exacerbated by the implementation of the new MIS. It concerns the interaction between radiation oncologists and radiographers. The image acquisition activity performed by the radiographers depends on the practices of radiation oncologists. In the absence of an image acquisition protocol, radiation oncologists may have different requirements regarding the characteristics of the desired control images (anterior image, lateral image, treatment fields, single or double exposure, etc.). This interdependence between the activity of the radiographers and that of the radiation oncologists is amplified by the implementation of the MIS which makes it necessary to acquire images more frequently. The dose delivered to the patient is greater.

The second point of fragility is related to the fact that the new MIS no longer makes it possible to acquire a single image after a readjustment. This technical limit goes against optimising the dose delivered to the patient since radiographers are required to acquire two images even if only one is sufficient to control the positioning. Furthermore, the new MIS increases the workload for both radiographers and medical physicists by requiring them to program one anterior image and one lateral image for each patient upstream to treatment sessions, in addition to the two systematically programmed image pairs. A strategy that involves the use of OFFLINE Review software has been developed to allow radiographers to create only one image if it is sufficient.

Finally, the third point of fragility results from a complication of the treatment plans (more numerous beams), which causes a slowing down of the computer system during the treatment sessions. Failure to re-evaluate patient management time in this configuration is likely to result in delays and complications in patient scheduling.

3.3 Stage of identifying offsets

Identifying offsets is composed of various actions, some of which are impacted by the implementation of the MIS. Three practices are particularly concerned: playback of images, how to contrast them, and how to compare them. With the implementation of the MIS, the identification of anatomical structures on the images becomes central in this safety activity.

The playback of images, which is in the physician’s skill set, requires an increase in the skills of radiographers linked to:

• switching from 2D image playback to 3D image playback;

• the multiplication and diversification of the anatomical markers used: increasing anatomical details due to the improvement in image sharpness, expanding the area of interest to be observed (larger scope of the image), difficulties in identifying certain anatomical markers according to the location of the tumour, size and composition of the anatomical marker (bone, organs, gold seeds, etc.) or the tumour (metastasis) and the anatomical markers (old, new) to be compared;

• the possibility of detecting smaller offsets (less than 0.3 cm);

• a context unfavourable to the identification of offsets: presence of contours for organs at risk or markers such as the reticle symbolised by a square on the reference images, and unusual patient morphology (scoliosis for example).

The way images are contrasted has also changed. Radiographers now have the option of “working on the image” at different locations in the area of interest, i.e. using different contrast tool options (slider) to better identify the various anatomical markers. However, radiographers encounter difficulties in defining the contrast level most suited to improving the visibility of anatomical markers of different composition and location. For example, contrasting the image to better see a bone marker can degrade the visibility of another type of marker. This requires, as for the playback of images, the acquisition of new skills, in particular in the use of contrasts and in the choice of filters. Finally, a new “adjust the imager” action must be added by the radiographers for this activity so as not to produce white images.

The comparison of the images is also modified. While the quality of the control image (day of treatment) has increased with the implementation of the MIS (images taken in KV), the quality of the reference image (DRR) does not always change. When the difference in quality is more pronounced between these two types of images, which is the case in the radiotherapy centre where the study took place, it becomes harder to make the same anatomical reference mark on the two corresponding images. Moreover, the comparison of the two images by superposition (and not side by side) has become more difficult because the anatomical marks used on the two images do not always appear in the same way depending on the image. Finally, the proper positioning of the cursor to compare the images also poses difficulties for the radiographers.

With respect to the risks faced by patients, the lack of image playback skills and difficulties in contrasting and comparing images could result in the following situations:

• no detection of a need for image readjustment or for the information that the radiation oncologists use to make the readjustment;

• image readjustment errors when this activity is handled by the radiographers (organisation of delayed validation).

Readjustment errors are likely to cause non-optimisation of the received dose, or a risk of delivering wrong doses to the wrong place.

3.4 Offset reduction step

Installing the MIS is accompanied by a connection of the treatment table and the accelerator arm to the medical imaging software, allowing automatic movement of the treatment table to reduce offsets of less than 2 cm. The radiographers move the image of the day of treatment on the reference image, the software measures the offsets, directly converts the movement of the table in the three planes of space and transmits the positioning offsets. These developments:

• increase the supervisory role of the radiographers, in particular for controlling the movement of the table and the positioning and rotation of the accelerator arm. In the medium and long terms, the transfer of the “table movement” action from a human to a machine could lead the radiographers to lose their capacity for critical thinking by reducing their ability to detect inconsistencies in offsets, between the position of the arm and the treatment field. Conversely, the reduction in the need to store the offsets tends to reduce the radiographers’ confusion about the direction of the offsets when adjusting the treatment table;

• modify the work organisation of the radiographer pairs; this is no longer a question of coordinating the radiographers between the control room and the treatment room but of coordinating the treatment station;

• reduce the time radiographers spend in the treatment room and modify their interactions with patients. This situation is likely to limit the patient’s participation in the safety of their treatment (Pernet, 2013), in particular their ability to alert the radiographers to possible problems (treatment or unusual position, excessively flexible compression, side effects of previous irradiation, risks of collision with the patient during the movements of the machine, etc.) or to limit the ability of the radiographers to identify risk behaviours of the patients (non-compliance with positioning and immobility instructions, lack of information on the risks associated with care, etc.);

• reduce radiographers’ confusion about the direction of offsets of the treatment table.

The installation of the new MIS thus weakens several controls for the positioning of the accelerator arm and the table, and the positioning of the patient on the treatment table.

4 Discussion: activities that do not only contribute to safety

Our analysis of the appropriation of a new imaging system made it possible to identify points of fragility in the “patient positioning control by imaging” safety barrier. These points of fragility and their method of identification call into question the concept of “human safety barriers”.

Control activities are rarely unambiguous. They not only contribute to patient safety but also to providing the treatment. In addition, it can be difficult to distinguish between the two functions of a control (provision, safety). This is the case for “patient positioning control by imaging”. The means of carrying out this control have developed with the changes in the technologies. Prior to imaging development, radiographers controlled patient positioning using table positioning, markers on the patient’s skin, and lasers. This control activity was thus dissociated from the treatment activity and had only a safety function. The activity of “patient positioning control” by imaging was initiated at the time of imaging development. The ability to control the positioning of the target volume before treatment, or even during treatment, has allowed the development of complex treatments that are more geometrically accurate, and to reduce the margins of safety used around the target volume (fewer doses on non-cancerous tissues). Two extremes exist today: stereotactic radiotherapy using safety margins in the millimetre range and conformal radiotherapy using margins which may be in the centimetre range. Between these two extremes, there are several types of treatment, but generally the activity of controlling the patient’s positioning is an integral part of the treatment activity. It is no longer possible to say that the activity of controlling the positioning of the patient is limited to making care safe; it becomes inseparable from the provision of care. In other words, with advanced treatment techniques using limited margins of safety around target volumes, it is no longer possible to treat the patient without this control activity.

Moreover, limiting the analysis of “patient positioning control” to its safety dimension obscures considerations on the dimensions of this activity, which participates in the provision of treatment; in particular: the interactions between radiotherapy oncologists and radiographers during the acquisition of images; the workload of radiographers, physicists and radiotherapy oncologists, linked to the production of these images; the need to develop the skills of radiographers; the organisation of the activities of radiographer pairs; the modification of interactions between radiographers and patients; etc.

To exceed this limit, we propose replacing the concept of safety barrier with that of an activity contributing to the safety of care (ACS). Analysis of the performance of an activity makes it possible to consider its reliability (detection, recovery) and its lack of reliability (human and organisational failures); to consider different dimensions of an activity and not to seek to categorise it (equipment, procedure, skill, communication, availability, etc.); to contextualise the analysis of the performance of an activity; and to overcome the difficulties of evaluating a complex structure of safety barriers.

The structure of an ACS can be simple and limited to a validation, verification or control action, carried out by a professional at a time t of the care process, in an optimal situation, requiring no particular expertise or skills. An ACS can also be complex when it involves multiple professionals in a succession or combination of actions over several days, which may require a high level of expertise, in a stressful work situation. Based on the criteria mentioned above, the “patient positioning control by imaging” ACS is considered complex since it involves several professionals directly (radiographers) and indirectly (doctors, physicists) at different times. In addition, it covers a variety of actions, some of which are dependent on each other (preparation and capture of images, etc.) and are subject to uncertainties (condition of the patient, quality of images, quality of anatomical markers, change of treatment plan, etc.).

The performance of this control after a technical modification has been evaluated. For example, the analysis of the effect of changing the MIS on the “patient positioning control” revealed: constraints encountered by the members of the healthcare team (increase in image control time, recapture of at least two images to check readjustment, etc.); new elements when introducing a modification (effects on groups, on skills in terms of new needs and/or losses, on the use of equipment, etc.); and difficulties (capturing images, images playback, defining contrast and comparing images, etc.).

From our point of view, this analytical approach makes it possible to go beyond a view of risk seen solely as a phenomenon of propagation (alignment of holes in the Swiss cheese model of Reason, successive failures of safety barriers) and also to consider the phenomenon of the emergence of risks (Amalberti, 2014) due to the intersection of constraints, new elements, and difficulties at a given time following a technical change. It is thus possible to assess issues in terms of effect on the dose (non-optimisation) or on patient safety (risks encountered).

5 Conclusion

This research on safety barriers in radiation therapy has two main contributions. At the academic level, it has made it possible to question the concept of “safety barriers” as well as the evaluation of their performance from the point of view of human and organisational factors. One perspective of this research would be to further identify ambiguities and inconsistencies in the concept of safety barriers, including the distinction made between different types of controls, between a barrier and the preconditions necessary for its performance (e.g. maintenance) and/or the distinction made between accident prevention and recovery barriers and/or between safety barriers and control systems.

This research has led to the definition of a new concept, that of an activity contributing to the safety of care in order to overcome the limits of the concept of safety barriers and of the evaluation of their performance. The focus of analysis on constraints, difficulties, and new elements at the time of appropriation of a technical modification makes it possible to evaluate the human and organisational dimensions to make care safe, in particular:

• to study the different facets of the complexity of work situations and the points of fragility during the appropriation phase;

• to address organisational dimensions, including changes, losses, and the needs for interactions between radiographers (intra-profession), between radiographers and other professions in the team (doctor, physicist), and with the patient;

• to raise different questions related to skills. Instead of evaluating skills based on the application of procedures (reductive) and the abilities of radiographers in real work situations (too much analysis), we propose determining the needs for maintaining certain skills, for change, for upgrading skills and for preventing the risks of losing skills.

However, questions remain; is it easy to identify what an ACS is? Is it limited to control activities? Are the technical, human and organisational weaknesses during the appropriation period similar to each other in a stabilised operating situation (before or after the technical modification)? In other words, is the period of appropriation indicative of existing phenomena and problems but less visible in day-to-day operation?

Moreover, the analysis of a single ACS (patient positioning control by imaging) unrelated to other ACSs is a limit to this line of thinking. One perspective of this work could be to refine the analysis of ACSs in radiotherapy and their coexistence and influences.

Finally, another perspective of this work would be to continue considering the activities contributing to safety with regard to the concept of “defence-in-depth”, in particular in terms of the combination and articulation of ACSs in relation to levels of degradation in a facility or a care unit.

References

All Figures

	Fig. 1 Summary of the different representations of human safety barriers.
In the text

	Fig. 2 Modification of the safety activity following the implementation of a new Medical Imaging System (MIS).
In the text