Patient safety considerations concerning the scheduling of emergency-off system tests

Emergency-off systems (EOS) are essential to the safe operation of medical accelerators and other high-risk equipment. To assure reliable functioning, some states require weekly tests; others permit monthly, tri-monthly or even six-monthly tests, while some do not specify test intervals. We investigate the relative safety of the various test schedules by computing the fraction of time during which a nonfunctional state of the EOS may remain undetected. Special attention is given to the effect of flexibility (i.e., to regulations that specify the number of tests that have to be done in any given time interval, but allow a range within the interval during which a test can be done). Compared to strict test intervals, a schedule that provides flexibility increases risk only marginally. Performing tests on any arbitrary day of the week when weekly tests are required increases the time span during which a nonfunctionality goes undetected by only 17%, compared to an exact one-week schedule. The same ratio applies for monthly tests. For a three-month schedule, the relative risk increases by only 2% if tests are done on an arbitrarily chosen day during each due-month, compared to tests done on an exact three-month schedule. The most irregular time intervals possible in a three-calendar month schedule increase the relative risk by 11%. For the six-month and the 12-month schedule the ratio of risks is even smaller. The relative risk is virtually independent of the mean time between failures of the EOS, but the absolute risk decreases in proportion the mean time between failures. Adherence to strict, resource-intensive test intervals provides little extra safety compared to flexible intervals that require the same number of tests per year. Regulations should be changed to provide the practicality offered by flexible test schedules. Any additional increase in patient safety could be achieved by strict regulations concerning reliability of emergency-stop (e-stop) systems.