{'fraction_non_alphanumeric': 0.021522538208550976, 'fraction_numerical': 0.010688721222673631, 'mean_word_length': 5.060082063305979, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Failure Mode and Effects Analysis (FMEA) for Experimental Use of FLASH on a Clinical Accelerator

Background: Use of a linear accelerator in ultra-high dose rate (UHDR) mode can provide a conduit for wider access to UHDR FLASH effects, sparing normal tissue, but care needs to be taken in the use of such systems to ensure errors are minimized. Purpose: Failure Modes and Effects Analysis (FMEA) was carried out in a team that has been involved in converting a LINAC between clinical use and UHDR experimental mode for more than one year, following the proposed methods of TG100. Methods: A team of 9 professionals with extensive experience were polled to outline the process map and workflow for analysis, and developed fault trees for potential errors, as well as failure modes that would results. The team scored the categories of severity magnitude (S), occurrence likelihood (O), and detectability potential (D) in a scale of 1 to 10, so that a risk priority number (RPN=S*O*D) could be assessed for each. Results: A total of 46 potential failure modes were identified, including 5 with RPN>100. These failure modes involved 1) patient set up, 2) gating mechanisms in delivery, and 3) detector in the beam stop mechanism. Identified methods to mitigate errors included 1) use of a checklist post conversion, 2) use of robust radiation detectors, 3) automation of QA and beam consistency checks, and 4) implementation of surface guidance during beam delivery. Conclusions: The FMEA process was considered critically important in this setting of a new use of a LINAC, and the expert team developed a higher level of confidence in the ability to safely move UHDR LINAC use towards expanded research access.


Conclusions:
The FMEA process was considered critically important in this setting of a new use of a LINAC, and the expert team developed a higher level of confidence in the ability to safely move UHDR LINAC use towards expanded research access.

Introduction:
FLASH radiotherapy, or radiation treatment with ultra-high dose rate beams (UHDR, >40Gy/s average and >10 5 Gy/s intrapulse dose rates) has shown results of reduced normal tissue toxicity [1][2][3][4][5][6] , and so it has seen a resurgence in recent years with many biological experiments and human translation ongoing. One of the major roadblocks recognized in the field is a lack of readily accessible systems that can deliver UHDR beams consistently, and so several institutions have tested existing system modifications for FLASH experiments 7,8 . Proton FLASH beams have been developed recently by modulating the particle flux of their highest energy beams to establish small animal and pre-clinical radiation research platforms 4,9,10 . Modified clinical LINACs have been used to deliver UHDR electron beams, with a reduced source to surface distance for preclinical studies with small animals 7,8 . Dedicated UHDR LINACs exist for experimental use (e.g. Oriatron eRT6, Mobetron) [11][12][13] , and are being applied to for human use, although the approvals and protocols are still evolving today.
In order to investigate the FLASH effect on large animals and future human patients, Rahman et al. 14 modified a clinical LINAC (Varian Clinac 2100 C/D) to deliver UHDR beams at the isocenter with minimal changes to the clinical geometry. The method followed the previous work of Schüler et al 7

and
Lempart et al 8 , and required retraction of the photon target, and allowing the electron beam with the machine running in photon mode,) to pass through an empty carousel port, permitting the use of all the clinical accessories such as collimating cones. Since its first conversion the machine has been utilized to treat mice, minipigs, and several spontaneous canine tumor patients 15 . Nonetheless Newell et al. raised concerns about the clinical machine's use for FLASH experiments and how the conversion or modifications could potentially cause mistreatments 16 . As part of the concern around use of such as novel system a detailed analysis of safety was undertaken as described here.
The medical physics community has recently developed methods to identify and mitigate such failures and established risk based quality management programs via failure modes and effects analysis (FMEA) 17 . The FMEA process is a method to identify possible failures in the design and use of a system and combine this with the effects of these failures on the use outcome 18 . Since its adoption by the US military 19 in the 1940's it has been utilized in many industries, including extensively in healthcare 20 . The medical physics community developed recommendations in AAPM task group report 100 to implement this risk management technique 17 and FMEA has been performed by many institutions to mitigate errors of treatment modality programs 21-25 as well as new or existing technology [26][27][28] .
In this study, to mitigate potential errors from conversion and use of a clinical LINAC for FLASH experiments, an FMEA study was conducted with a team of 9 professionals following the methodologies described in AAPM TG 100 report. This FMEA study was conducted during performing FLASH experiments over the course of more than one year, with safe conversions between FLASH and conventional modes approaching 100 times. Methods for mitigating errors and improving the FMEA process were also discussed.

A. Organization of Multidisciplinary Team
A multidisciplinary team consisting of four clinical physicists, two biomedical engineers, two physics/engineering researchers, and one senior PhD student provided input for this FMEA. The team was intentionally diverse to include professionals' experience with the clinical LINAC under FLASH and conventional conditions. The four clinical physicists had first-hand experience utilizing the clinical LINAC for patients and one of the physicists had first-hand experience with delivering the FLASH beam for experiments and converting the LINAC. The two researchers developed technology and experiments that investigate the FLASH dosimetry and radiochemistry effects. The two factory trained biomedical engineers had the most technical experience in converting the LINAC and ensuring consistency in beam delivery. The PhD student had the most experience validating and delivering the beam under FLASH conditions and conducting experiments (dosimetry for in vivo, in vitro, and quality assurance). The team scheduled weekly meetings for approximately 4 weeks to initially develop the process maps, workflow, fault trees, and potential failure modes followed by approximately 3 weeks of meetings to estimate scores and suggest methods of mitigating errors. While there was at least one scheduled meeting each week there were other opportunities throughout other meetings/discussions that led to further suggestions in mitigating error, potential failures etc. Figure 1. Workflow of FLASH/UHDR experiments considering conversions to FLASH mode and then back to conventional mode. Text highlighted in blue are process map steps for conversion and text highlighted in black include fault tree steps with dose and dose rate errors during experimental use.

B. Process Map and Workflow
The FMEA was conducted for the LINAC following the methodology described in AAPM TG 100 report 17 . Figure 1 demonstrates the workflow of the clinical LINAC's (Varian Clinac 2100 C/D) use under FLASH and conventional condition as well as its conversions. The scope of the analysis was defined for conversion of the machine and during experimental use under FLASH conditions. The process and failures during conventional use were not considered as the manufacturers of the machine have interlocks and features in place to ensure safe and consistent delivery of the beam. The process maps, shown in Figure 2 and Figure 5, were developed for the conversion of the machine to FLASH and back to conventional with the portion of the team responsible for conversion and its use under FLASH conditions. The process maps, adapted from Rahman et al 14 , included the modification made to the LINAC as well as add-ons (e.g. dose controller, quality assurance measurements) needed to ensure successful conversion of the machine 29,30 . The team also distinguished between human error and the machine/detector errors.

C. Fault Trees
Faults trees were created for the use of the machine under FLASH condition with the portion of the team responsible for FLASH experiments. The types of errors considered were dose errors, Figure 3, and dose rate errors, Figure 4. The potential causes were organized by logic gates and the types of faults were also discussed such as human, quality assurance, or machine error.

D. Failure Modes
After constructing process maps and fault trees, failure modes for each task in the conversion and cause of the beam delivery faults during FLASH irradiation were defined as shown in Tables 2-4. The failure modes' effect upon the results or experimental outcomes and causes of the failure were also established.
For the process maps, the errors were categorized by parts of the machine, and QA tool responsible for the error (e.g. pulse counter error). From the dose and dose rate fault trees the fundamental failure modes for the experimental use of the machine were defined.

E. Scoring and Risk Priorities
The scoring was defined based on an adaptation of the TG100 report scoring guide ( Table 1), which included scoring of Severity (S), Occurrence (O), and Detectability (D) with a scale of 1 to 10 and risk priority number (RPN=S*O*D). In this study, the scoring differentiated severity for in vivo, in vitro, and quality assurance tool experiments as well as consideration of dose rate differences compared to intended. Table 2-4, the weighted average and the standard deviation in the scores were calculated from the scores determined in the team sessions. During the scoring and afterwards, separate discussions of the team allowed for suggestions for mitigating errors with an RPN >100.

Results:
The FMEA team considered 46 total potential errors during the conversions and the experimental use of the LINAC. As shown in Figure 2 and Table 2, 24 potential failure modes were defined from the conversion of the beam to UHDR and characterization for use in FLASH experiments. The processes defined were based on experiences of the team with the LINAC from conversion of nearly 100 times over the course of more than a year and prior studies for conversion 14 , developing beam controlling 29 , and characterization methods 30 . The team generalized the errors to include errors that may arise from any beam controlling and beam characterization methods while incorporating the institution's method of converting the LINAC to deliver FLASH beams. For conversion of the LINAC the potential errors involved were with the carousel positions, target positions, energy switch positioning, servos errors, and energy selection error. In terms of methods of controlling dose, the potential errors were categorized as the beam gating, pulse counter, or dose detection errors. For beam characterization and verifying consistency of the beam, the identified errors included areas such as pulse counting, phantom consistency, dose profile detector and LINAC errors.
The FMEA team identified 9 potential failure modes during the delivery of UHDR beam for FLASH experiments as shown in table 2. The processes were regarding predominately the setup of the sample/animal, inputting desired beam parameters, dose, delivery, and its confirmation. Fault tree analysis was completed for considerations of both dose, Figure 3, and dose rate, Figure 4. The team identified that there could either be under or overdose of the intended or prescribed dose for the experiments. While the fault tree shows many potential errors that could results in under or overdosing, the overall reasons include errors with the LINAC beam parameters, dose controller /beam gating, beam profile consistency check, and set-up of the animals or samples. The fault tree for dose rate was created for the situation when the dose rate is less than 40 Gy/s, as literature currently does not suggest an upper threshold on dose rate for the FLASH effect and it was assumed that the machine was optimized for UHDR delivery. Again, the underlying reasons for the errors involve change in beam parameters, dose controller, beam profile consistency checks, and set up of samples/animals.
The team also identified 13 potential failure modes while converting the LINAC back to deliver conventional beams, as shown in Figure 5 and Table 4. In comparison to converting the machine to deliver UHDR, there were fewer failure modes, as the LINAC software systems are designed to identify potential errors once the servos are turned back on, and so this internal proprietary software checking operational errors encountered in normal clinical mode were considered beyond the scope of this study.
Nonetheless, the team assumed that performance validation would always be done after conversion, and so considered errors that might arise while ensuring the conventional beam parameters were consistent with previous measurements under conventional conditions. To convert the LINAC back to conventional mode the team identified that it was a matter of letting the target, energy switch, carousel port go back to its desired position once the air valves were returned to conventional mode. Furthermore, while under FLASH conditions, special dosimetry considerations were made such as high temporal resolution detectors, under conventional conditions clinical quality assurance tools (e.g. daily QA phantom) can be utilized to verify beam parameters. Still, errors could arise in returning the machine back to conventional mode which includes carousel, target, energy switch, servos, energy selection, dose profile detector, and LINAC errors.
While scoring each of the failure modes for severity, occurrence, detection, and RPN number, the team suggested methods of mitigating errors for RPN>100. 5 potential failures (highlighted in black in Table 2 Table 3. Failure modes and error analysis of UHDR Delivery for experimental use (phantoms, in vivo, and in vitro). ). RPN numbers shaded in black are errors with a score of 100 or greater. All scores include the mean and standard deviation from the surveyed committee members.  Table 4. Failure modes and error analysis of conversion to conventional beam. RPN numbers shaded in black are errors with a score of 100 or greater. All scores include the mean and standard deviation from the surveyed committee member

Discussion
After this institutional FMEA, team members are now stronger proponents of future risk analysis of other treatment modalities in the radiation oncology suite because this study was found to provide a logical objective framework to mitigate risk for FLASH irradiators. The experiences of the clinical physicists were crucial to improving the current FLASH experimental methods, particularly since historically they This process of educational debate was thought to be a positive side product of the FMEA process.
In response to this analysis, to mitigate some of the errors involving beam monitoring and control, the institution will implement a checklist 31 after conversion of the machine to ensure the beam gating mechanism is turned on and overdosing of samples/animals is avoided. The team always emphasized the importance of secondary dose checks, which for most of the FLASH experiments have involved confirmation of delivery with dose rate independent Gafchromic film. Radiation damage of the detectors was also a concern due to changes in measured dose by the dose controlling system, and so currently there is ongoing exploration of potential alternatives for beam monitoring and control. One potential unconventional method would be to measure the air scintillation, as shown in Figure 6a, to monitor beam output because the radiation damage of the detector could be minimal and it would not be directly irradiated by the beam, while any detector in the beam is more susceptible to damage. Other potential detectors that may be viable are ionization chambers with shifted voltage potential and/or correction for ion recombination. Systems such as this are under development and could be used if they exhibit minimal radiation damage. From discussion with the clinical physics team, there was a push to incorporate surface guidance during FLASH beam delivery as another verification of delivered treatments. Cherenkov emission imaging of patients is currently integrated into the clinic at the institution 32 , and it has been demonstrated that it can be imaged at the single pulse resolution 30 , so imaging in vivo Cherenkov under FLASH conditions is being explored for minimizing errors involving patient/sample set up 33 as shown in Figure   6b.
The biomedical engineers also suggested that sensors could be installed to ensure the positioning of the carousel, target, and energy switch after converting the machine to and from FLASH and would be ideal to minimize errors during conversion of the LINAC. While this has not been developed to date, certainly this could be done and likely should be done in commercial solutions.
While there were five failure modes with RPN>100, there were several other failure modes with RPN close to 100, when accounting for the standard deviation in the responses from the team. For example, the failure modes associated with turning of the servos circuit in Table 2 were within two standard deviations of 100. Another source of failure modes would be the verification of consistent beam parameters (including data acquisition parameters and ambient noise in Table 2). To mitigate errors associated with the servos circuit and beam consistency measures, the checklist suggested by the physicists can be implemented. For beam measurements, the team also suggested automating data acquisition methods with the detector with minimal input from the user (e.g. automated data acquisition parameters, and online method of ambient noise reduction). This may better inform the wider risks and mitigations needs in the community, which is important given that FMEA is still a subjective assessment process, which has potential biases in scoring and inherent variability. With a larger sample of researchers, engineers, and physicists across the radiation oncology community, the scoring variability may be reduced with greater accuracy of the mean. If the open-source survey provided opportunity to include other potential failure not defined by this study, there might be other error mitigations that can improve and ensure safe delivery of FLASH beams. The survey may also inform researchers from other institutions about the conversion process, use of a LINAC for FLASH experiments, and the FMEA process. The exposure to FMEA via an online scoring survey can also promote its integration for other treatment modalities.

Conclusions
In this study, the potential errors of utilizing a clinical LINAC to deliver UHDR beams for FLASH experiments have been identified, with the experience of converting the machine nearly 100 times over the time course of more than a year. The team of 9 professional identified a total of 46 potential failure modes including 5 with RPN>100. These failure modes involved 1) patient set up, 2) gating mechanism in the beam delivery, and 3) the detector of the beam stopping mechanism. From the FMEA, some future methods to mitigate errors included 1) implementation of a checklist post conversion, 2) investigation of robust radiation detectors with reduced long-term damage from UHDR beams, 3) automation of the quality assurance and beam consistency checks, and 4) implementation of surface guidance during treatment delivery. For greater accuracy in the scoring and reduced variability, the FMEA of type of operation could potentially be opened to the larger radiation oncology community via an online survey, where they can score and provide other potential errors.
Acknowledgments: This work was supported by the Norris Cotton Cancer Center seed funding through core grant P30 CA023108 and through the shared irradiation service, as well as through seed funding from the Thayer School of Engineering, and from grant R01 EB024498.

Department of Medicine Scholarship Enhancement in Academic Medicine (SEAM) Awards
Program from the Dartmouth Hitchcock Medical Center and Geisel School of Medicine also supported this work.

Disclosure of Conflicts of Interest: Dr. Brian W. Pogue is a cofounder and Mahbubur Rahman
is an employee of DoseOptics LLC, outside of the submitted work.